Because of this, I think I spent at least 24 hours in total... I thought it was a problem with the nginx configuration, so I kept changing it and changing it ag
Contents
Because of this, I think I spent at least 24 hours in total... I thought it was a problem with the nginx configuration, so I kept changing it and changing it again... but it still wouldn't work... I set up a test environment, changed the settings one by one, reinstalled everything, and kept repeating the process... So I want to explain the conclusion I eventually reached.
After installing Docker on CentOS 8 or Fedora, try running the following commands:
docker run busybox nslookup google.com
nslookup: write to '108.61.10.10': No route to host
;; connection timed out; no servers could be reached
docker run yauritux/busybox-curl curl google.comIt doesn't work.
Apparently, this happens because of some issue with the host between containers (?) Anyway,
here's the link I found.
This fixed it for me. In fact, dnf install works without any problems, and so does nslookup.
firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens3
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:masquerade: yes is set to yes.
And connections between containers and the host work fine too... But,,, there's just one thing,,, one thing,, one thing !!!!!!!!!!!!!!!!!
Even if you configure nginx.conf to get x-real-ip,
when using traefik, it's impossible to get X-REAL-IP.
Even when it does come through, you always get the Docker network IP, such as "172.19.0.1".
This method involves editing "etc/firewalld/firewalld.conf".
Change FirewallBackend=nftables
to FirewallBackend=iptables.
firewall-cmd --permanent --zone=trusted --add-interface=docker0
firewall-cmd --reloadApply it using the commands.
With this, connections work without any problems when running dnf install host or anything else during a docker build. But!!
If your docker-compose service is set up with a separate network, such as frontend or backend, you must also add that network to the trusted zone.
Otherwise, when using traefik, you'll get an error like the following.
'502 Bad Gateway' caused by: dial tcp 172.18.0.4:80: connect: no route to host# ifconfig
br-d193b7e58cd8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255
inet6 fe80::42:17ff:fed7:dc73 prefixlen 64 scopeid 0x20<link>
ether 02:42:17:d7:dc:73 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-e34899da24a1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.19.0.1 netmask 255.255.0.0 broadcast 172.19.255.255
inet6 fe80::42:61ff:fe06:9f0c prefixlen 64 scopeid 0x20<link>
ether 02:42:61:06:9f:0c txqueuelen 0 (Ethernet)
RX packets 41 bytes 2757 (2.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 73 bytes 6079 (5.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
inet6 fe80::42:6dff:fe00:e5f1 prefixlen 64 scopeid 0x20<link>
ether 02:42:6d:00:e5:f1 txqueuelen 0 (Ethernet)
RX packets 12831 bytes 722769 (705.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 18098 bytes 98702867 (94.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0firewall-cmd --permanent --zone=trusted --add-interface=br-d193b7e58cd8
firewall-cmd --permanent --zone=trusted --add-interface=br-e34899da24a1
firewall-cmd --reloadSo, as shown above, you just need to add that interface as well.
firewall-cmd --list-all-zones
public (active)
target: default
icmp-block-inversion: no
interfaces: ens3
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: br-d193b7e58cd8 br-e34899da24a1 docker0
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:Once you do this, X-REAL-IP will come through correctly.
It seems this problem occurs because Docker does not support nftables..
Anyway... I hope support is added and this is officially fixed in the future.
For now... I'm glad I was able to fix it this way.
firewall-cmd --permanent --zone=public --add-masquerade
when applied using this command
firewall-cmd --permanent --zone=trusted --add-interface=docker0
firewall-cmd --permanent --zone=trusted --add-interface=br-87014b87949d
firewall-cmd --permanent --zone=trusted --add-interface=br-fb2316a253cd
firewall-cmd --reloadI think applying it this way should work.