Estou totalmente perdido aqui. Após atualizar para Ubuntu 16.04 a partir de 14.04 no servidor virtual Leaseweb, o docker não aceita mais conexões com localhost. Usando a imagem original do servidor CouchBase, executar o seguinte comando em meu laptop funciona perfeitamente (Docker versão 1.12.1, build 23cf638):
$ docker run --rm -ti --name couchbase-server -p 127.0.0.1:8091:8091 couchbase/server:community-4.5.0
Starting Couchbase Server -- Web UI available at http://<ip>:8091 and logs available in /opt/couchbase/var/lib/couchbase/logs
$ curl localhost:8091
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://localhost:8091/ui/index.html>here</a>.</p></body></html>
No entanto, quando executo o mesmo comando em minha VM Ubuntu 16.04 hospedada no Leaseweb (o mesmo docker Docker versão 1.12.1, build 23cf638), ele falha:
# curl localhost:8091
curl: (7) Failed to connect to localhost port 8091: Connection refused
# netstat -tnlp|grep 8091
tcp 0 0 127.0.0.1:8091 0.0.0.0:* LISTEN 7387/docker-proxy
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8080
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 8443
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE all -- 172.18.0.0/16 anywhere
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:8091
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere localhost tcp dpt:8091 to:172.17.0.2:8091
Porém, quando abro a porta para público, ela começa a funcionar:
# docker run --rm -ti --name couchbase-server -p 8091:8091 couchbase/server:community-4.5.0
# netstat -tnlp|grep 8091
tcp6 0 0 :::8091 :::* LISTEN 15434/docker-proxy
# curl localhost:8091
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://localhost:8091/ui/index.html>here</a>.</p></body></html>
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8080
REDIRECT tcp -- anywhere anywhere tcp dpt:https redir ports 8443
DOCKER all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DOCKER all -- anywhere !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 anywhere
MASQUERADE all -- 172.18.0.0/16 anywhere
MASQUERADE tcp -- 172.17.0.2 172.17.0.2 tcp dpt:8091
Chain DOCKER (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
DNAT tcp -- anywhere anywhere tcp dpt:8091 to:172.17.0.2:8091
A única diferença está na última linha, destination anywhereVS localhost. No entanto, na minha máquina doméstica, a regra relevante do iptables localhosttambém diz e funciona. Na verdade, na minha máquina doméstica as regras do iptables são totalmente as mesmas, mas funcionam. A máquina doméstica usa kernel mais recente (4.8.0-34-genérico vs 4.4.0-59-genérico na VM) e é executada em bare metal versus paravirtualização na VM. Talvez seja esse o caso? O suporte diz que o acima funciona perfeitamente no Ubuntu 14.04 VM, talvez eu não devesse ter atualizado...