Docker + Golang HTTPS 问题。 OpenSSL SSL_connect：SSL_ERROR_SYSCALL

Question

我正在尝试从 Docker 容器连接到在 Go 中创建的 HTTPS 会话，当我在本地运行它时它工作正常，但是一旦我尝试在容器中运行它，我就无法访问网址。

func main() {

    // I'm using Go-Chi V5
    r := chi.NewRouter()

    // TLS connection. Inspired from https://blog.cloudflare.com/exposing-go-on-the-internet
    tlsConfig := &tls.Config{
        PreferServerCipherSuites: true,
        CurvePreferences: []tls.CurveID{
            tls.CurveP256,
            tls.X25519,
        },

        MinVersion: tls.VersionTLS12,
        CipherSuites: []uint16{
            tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
            tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
            tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
            tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
    }
    srv := &http.Server{
        Addr:         "localhost:9090",
        ReadTimeout:  5 * time.Second,
        WriteTimeout: 20 * time.Second,
        IdleTimeout:  200 * time.Second,
        TLSConfig:    tlsConfig,
        Handler:      r,
    }

    r.Get("/", func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("hello world"))
    })

    err := srv.ListenAndServeTLS("./.dev/localhost.crt", "./.dev/localhost.key")
    if err != nil {
        log.Fatalf("server failed to start: %v", err)
    }
}

我的 Dockerfile：

FROM golang:1.17-buster AS build

WORKDIR /app

COPY go.mod .
COPY go.sum .
RUN go mod download

COPY ./.dev/localhost.key .
COPY ./.dev/localhost.crt .

COPY . .

RUN go build -o /dev-admin ./cmd/admin

##
## Deploy
##

FROM gcr.io/distroless/base-debian10

WORKDIR /

COPY --from=build /dev-admin /dev-admin

COPY --from=build ./app/localhost.key ./.dev/localhost.key
COPY --from=build ./app/localhost.crt ./.dev/localhost.crt

EXPOSE 9090
EXPOSE 443

ENTRYPOINT ["/dev-admin"]

docker-compose.yml:

version: '3.9'
services:
  web:
    image: api_test
    build: .
    ports:
      - '9090:9090'
    volumes:
      - .:/app

$ curl https://localhost:9090
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:9090

当我尝试正常的 HTTP 版本时，容器工作正常，所以只有 HTTPS 被阻塞，我无法弄清楚它是什么。

Answer 1

您在Server 定义中指定要监听的地址：

srv := &http.Server{
        Addr:         "localhost:9090",
...

将其更改为：

srv := &http.Server{
        Addr:         ":9090",
...

需要此更改的原因is that the address“指定服务器要侦听的 TCP 地址”。当您指定 localhost:9090 时，您将绑定到容器内的环回接口，并且在大多数情况下，外部无法访问（请参阅this question 了解更多信息）。

Answer 2

问题似乎出在您的 docker-compose.yaml 中。您只转发端口 9090。虽然 SSL 需要 443。

像这样，它应该可以工作：

version: '3.9'
services:
  web:
    image: api_test
    build: .
    ports:
      - '9090:9090'
      - '443:443'
    volumes:
      - .:/app