【问题标题】:Connecting to Windows docker desktop from remote computer on same network从同一网络上的远程计算机连接到 Windows docker 桌面
【发布时间】:2020-10-01 18:09:03
【问题描述】:

我正在尝试在我的主 PC 上设置 docker 桌面,然后使用网络上笔记本电脑上的 docker-compose 进行部署。

我将笔记本电脑上的“DOCKER_HOST”环境变量设置为“tcp://{ipaddress}:2375”

不幸的是,据我所知,我似乎无法让 docker 将守护进程绑定到除 localhost / 127.0.0.1 之外的任何其他 ip。如果我像这样在配置 json 中指定我的主机 ip,

{
  "registry-mirrors": [],
  "insecure-registries": [],
  "debug": false,
  "experimental": false,
  "features": {
    "buildkit": true
  },
  "hosts": [ "tcp://192.168.1.198:2375" ]
}

它只是拒绝启动,我也尝试将 0.0.0.0 作为 IP 来推测绑定到所有 IP 地址,但无法使其工作,有时我会收到以下错误,

Docker.Core.HttpBadResponseException:
{"status":"error","message":"exit status 1"}

   at Docker.Core.Logging.HttpClientExceptionInterceptor.<InterceptResponseAsync>d__0.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\Logging\HttpClientExceptionInterceptor.cs:line 26
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Docker.Core.Logging.LoggingMessageHandler.<SendAsync>d__4.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\Logging\LoggingMessageHandler.cs:line 36
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.HttpClient.<FinishSendAsyncBuffered>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.Core.HttpClientExtensions.<GetJsonAsync>d__0`1.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Core\HttpClientExtensions.cs:line 16
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.ApiServices.LifecycleClient.<DockerStartAsync>d__10.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\LifecycleClient.cs:line 122
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.LinuxkitDaemonStartup.<StartAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\LinuxkitDaemonStartup.cs:line 30
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.Engines.WSL2.LinuxWSL2Engine.<DoStartAsync>d__25.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\Engines\WSL2\LinuxWSL2Engine.cs:line 160
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.ApiServices.StateMachines.TaskExtensions.<WrapAsyncInCancellationException>d__0.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\TaskExtensions.cs:line 29
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.ApiServices.StateMachines.StartTransition.<DoRunAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\StartTransition.cs:line 67
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Docker.ApiServices.StateMachines.StartTransition.<DoRunAsync>d__5.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\StartTransition.cs:line 92
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.ApiServices.StateMachines.EngineStateMachine.<StartAsync>d__14.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.ApiServices\StateMachines\EngineStateMachine.cs:line 69
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Docker.Engines.Engines.<RestartAsync>d__28.MoveNext() in C:\workspaces\stable-2.4.x\src\github.com\docker\pinata\win\src\Docker.Desktop\Engines\Engines.cs:line 272

我安装了最新版本的 docker desktop,我还在做的一件事是使用 netstat 检查 IP 0.0.0.0 或 192.168.1.198 上的端口 2375 上是否有任何东西正在监听,但我没有设法得到它可以绑定到除 127.0.0.1 / ::1 之外的任何东西。

有什么想法吗?


作为另一个不起作用的配置的示例,

{
  "hosts": [
    "0.0.0.0:2375"
  ]
}

Docker 启动正常,但绑定在以下位置

TCP    127.0.0.1:2375         0.0.0.0:0              LISTENING       4940
TCP    [::1]:2375             [::]:0                 LISTENING       4940

我还可以使用以下方法测试 IP 绑定,

Test-NetConnection -ComputerName localhost -Port 2375  (SUCCESS)
Test-NetConnection -ComputerName 192.168.1.198 -Port 2375 (FAILS)

【问题讨论】:

  • 不!停止!远程访问 Docker 守护进程是一个主要的安全问题!不要尝试这个! (任何可以访问套接字的人都可以通过管理员权限访问 Docker 可以访问的任何文件,如果它可以通过网络访问,那么您网络上的任何人至少可以读取您的 Users 目录中的任何内容,而无需任何身份验证或审核;在 Linux 上,他们可以轻松地root 整个主机。)
  • 我在专用网络上执行此操作,只有一台其他计算机,我的。它也被用于开发测试,而不是生产。
  • 但是感谢您提供的信息,这让我想知道如果安全性如此糟糕,他们如何设法在 Azure 等中提供远程 docker 服务。还是仅限于 Docker for Windows?
  • 云中的容器产品往往是 Kubernetes,它内置了安全功能,使其更加安全(带有加密的 TLS 传输、用户身份、一种限制用户可以访问的权限模型)做)。

标签: docker docker-compose


【解决方案1】:

我发现我需要使用 netsh 在我的 LAN IP 和 docker 管理端口之间进行路由,

netsh interface portproxy add v4tov4 listenport=2375 listenaddress={lan ip address} connectport=2375 connectaddress=127.0.0.1

这对我有用。

【讨论】:

    猜你喜欢
    • 1970-01-01
    • 1970-01-01
    • 2021-12-09
    • 1970-01-01
    • 2019-05-31
    • 1970-01-01
    • 2016-09-19
    • 2016-03-07
    • 1970-01-01
    相关资源
    最近更新 更多