【发布时间】:2020-10-01 18:09:03
【问题描述】:
我正在尝试在我的主 PC 上设置 docker 桌面,然后使用网络上笔记本电脑上的 docker-compose 进行部署。
我将笔记本电脑上的“DOCKER_HOST”环境变量设置为“tcp://{ipaddress}:2375”
不幸的是,据我所知,我似乎无法让 docker 将守护进程绑定到除 localhost / 127.0.0.1 之外的任何其他 ip。如果我像这样在配置 json 中指定我的主机 ip,
{
"registry-mirrors": [],
"insecure-registries": [],
"debug": false,
"experimental": false,
"features": {
"buildkit": true
},
"hosts": [ "tcp://192.168.1.198:2375" ]
}
它只是拒绝启动,我也尝试将 0.0.0.0 作为 IP 来推测绑定到所有 IP 地址,但无法使其工作,有时我会收到以下错误,
Docker.Core.HttpBadResponseException:
{"status":"error","message":"exit status 1"}
at Docker.Core.Logging.HttpClientExceptionInterceptor.<InterceptResponseAsync>d__0.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\Logging\HttpClientExceptionInterceptor.cs:line 26
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Docker.Core.Logging.LoggingMessageHandler.<SendAsync>d__4.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\Logging\LoggingMessageHandler.cs:line 36
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Net.Http.HttpClient.<FinishSendAsyncBuffered>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.Core.HttpClientExtensions.<GetJsonAsync>d__0`1.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\HttpClientExtensions.cs:line 16
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.ApiServices.LifecycleClient.<DockerStartAsync>d__10.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\LifecycleClient.cs:line 122
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.LinuxkitDaemonStartup.<StartAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\LinuxkitDaemonStartup.cs:line 30
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.Engines.WSL2.LinuxWSL2Engine.<DoStartAsync>d__25.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\Engines\WSL2\LinuxWSL2Engine.cs:line 160
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.ApiServices.StateMachines.TaskExtensions.<WrapAsyncInCancellationException>d__0.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\TaskExtensions.cs:line 29
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.ApiServices.StateMachines.StartTransition.<DoRunAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\StartTransition.cs:line 67
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Docker.ApiServices.StateMachines.StartTransition.<DoRunAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\StartTransition.cs:line 92
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.ApiServices.StateMachines.EngineStateMachine.<StartAsync>d__14.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\EngineStateMachine.cs:line 69
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Docker.Engines.Engines.<RestartAsync>d__28.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\Engines\Engines.cs:line 272
我安装了最新版本的 docker desktop,我还在做的一件事是使用 netstat 检查 IP 0.0.0.0 或 192.168.1.198 上的端口 2375 上是否有任何东西正在监听,但我没有设法得到它可以绑定到除 127.0.0.1 / ::1 之外的任何东西。
有什么想法吗?
作为另一个不起作用的配置的示例,
{
"hosts": [
"0.0.0.0:2375"
]
}
Docker 启动正常,但绑定在以下位置
TCP 127.0.0.1:2375 0.0.0.0:0 LISTENING 4940
TCP [::1]:2375 [::]:0 LISTENING 4940
我还可以使用以下方法测试 IP 绑定,
Test-NetConnection -ComputerName localhost -Port 2375 (SUCCESS)
Test-NetConnection -ComputerName 192.168.1.198 -Port 2375 (FAILS)
【问题讨论】:
-
不!停止!远程访问 Docker 守护进程是一个主要的安全问题!不要尝试这个! (任何可以访问套接字的人都可以通过管理员权限访问 Docker 可以访问的任何文件,如果它可以通过网络访问,那么您网络上的任何人至少可以读取您的
Users目录中的任何内容,而无需任何身份验证或审核;在 Linux 上,他们可以轻松地root 整个主机。) -
我在专用网络上执行此操作,只有一台其他计算机,我的。它也被用于开发测试,而不是生产。
-
但是感谢您提供的信息,这让我想知道如果安全性如此糟糕,他们如何设法在 Azure 等中提供远程 docker 服务。还是仅限于 Docker for Windows?
-
云中的容器产品往往是 Kubernetes,它内置了安全功能,使其更加安全(带有加密的 TLS 传输、用户身份、一种限制用户可以访问的权限模型)做)。
标签: docker docker-compose