CentOS8 Docker 端口映射

概念

端口映射：端口映射就是将内网中的主机的一个端口映射到外网主机的一个端口，提供相应的服务。当用户访问外网IP的这个端口时，服务器自动将请求映射到对应局域网内部的机器上。

例：
我们在内网中有一台Web服务器，但是外网中的用户是没有办法直接访问该服务器的。于是我们可以在路由器上设置一个端口映射，只要外网用户访问路由器ip的80端口，那么路由器会把自动把流量转到内网Web服务器的80端口上。

使用

使用：docker run --name container-name:tag -d -p 服务器端口:Docker 端口 image-name

1.–name：自定义容器名，不指定时，docker 会自动生成一个名称

2.-d：表示后台运行容器

3.image-name：指定运行的镜像名称以及 Tag

4.-p 表示进行服务器与 Docker 容器的端口映射，默认情况下容器中镜像占用的端口是 Docker 容器中的端口与外界是隔绝的，必须进行端口映射才能访问

先使用iptables开放端口

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 8090 -j ACCEPT

#查看iptabls规则
iptables -L -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
neutron-linuxbri-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8090

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
neutron-filter-top  all  --  0.0.0.0/0            0.0.0.0/0
neutron-linuxbri-FORWARD  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
neutron-filter-top  all  --  0.0.0.0/0            0.0.0.0/0
neutron-linuxbri-OUTPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain neutron-filter-top (2 references)
target     prot opt source               destination
neutron-linuxbri-local  all  --  0.0.0.0/0            0.0.0.0/0

Chain neutron-linuxbri-FORWARD (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-out tap60854a67-44 --physdev-is-bridged /* Accept all packets when port is trusted. */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-in tap60854a67-44 --physdev-is-bridged /* Accept all packets when port is trusted. */

Chain neutron-linuxbri-INPUT (1 references)
target     prot opt source               destination

Chain neutron-linuxbri-OUTPUT (1 references)
target     prot opt source               destination

Chain neutron-linuxbri-local (1 references)
target     prot opt source               destination

Chain neutron-linuxbri-sg-chain (0 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain neutron-linuxbri-sg-fallback (0 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0            /* Default drop rule for unmatched traffic. */

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

运行容器:

docker run --name testport1 -d -p 8080:8080 tomcat:lateset
3a4d6964f0e7ff04bfa435546c67ff9180a3cd50081bab01a3f76a83a4ac7e2c

docker run --name testport2 -d -p 8090:8080 tomcat:latest
8a54f5b60bfe1cbfadabacdd7a8db71c1681b13d477adae51308a5402bd8e85b

查看容器:

docker ps

CONTAINER ID   IMAGE           COMMAND             CREATED          STATUS          PORTS                                       NAMES
8a54f5b60bfe   tomcat:latest   "catalina.sh run"   3 minutes ago    Up 3 minutes    0.0.0.0:8090->8080/tcp, :::8090->8080/tcp   testport2
3a4d6964f0e7   tomcat:latest   "catalina.sh run"   20 minutes ago   Up 20 minutes   0.0.0.0:8080->8080/tcp, :::8080->8080/tcp   testport1

可通过物理机 IP：8080 访问