带Docker的Windows容器：无法从主机到达容器中的httpd（Win2016 TP5）

Question

I have a Windows Server 2016 TP5 machine that I use as a container host.

I have a Windows Container running that I manage with Docker . Inside this container I have an Apache httpd running on port 88.

The port mapping when I start the container is: 0.0.0.0:80->88/tcp , so I map port 80 of my container host to port 88 of the container. This is the output from docker inspect : http://pastebin.com/AVem1eGV

I can now reach the Apache http start page from any other computer in the network through the DNS or IP.

In my case:

• http://10.10.1.162/
• http://documents.test2016-3.company.com/

But the same does not work when I try to call the same from the host system itself or from inside the container . So, on the host system, I try to access the same URL via browser or wget, and getting:

C:\> wget -UseBasicParsing http://documents.test2016-3.company.com/
wget : Unable to connect to the remote server

in both cases.

But I can ping the host from both the host itself as well as the container.

From the host:

C:\>ping test2016-3.company.com    
Ping wird ausgeführt für TEST2016-3.company.com [fe80::847a:1430:8a10:b120%4] mit 32 Bytes Daten:

From the container:

PS C:\> ping documents.test2016-3.company.com
Pinging documents.test2016-3.company.com [10.10.1.162] with 32 bytes of data:

which seems to be able to resolve the name just fine.

What does work though is to call the Apache default page via the container hostname (which is win-de6u4068naf) and its running port directly (not through the port mapping), both from the host as well as inside the container:

http://win-de6u4068naf:88/

Just going the route through the container host hostname and mapped port from the host or container itself does not work properly!

Firewall rules allow everything on port 80 from any remote address or to port 80 (=inbound and outbound rules are both set to "allow" for "any").

I know that Microsoft/Docker changed the networking code base of the container/docker support from Windows Server 2016 TP4 to TP5. Not sure if that's related, or whether this is a bug or I'm having something not configured correctly yet.

I made a test and left Docker/Container out of the picture above and installed a plain Apache httpd itself on the container host system on port 80 (and no Docker running at all) just to check whether such setup works or not, in order to be sure that it is actually somehow Docker/Container related and not a problem with my network/host configuration in general. And this works fine, I can reach the Apache from outside as well as from the host itself, thus it must be a Docker/Container related problem.

Environment:

• Windows Server 2016 TP5
• Docker version 1.12.0-dev, build 2b97201

Answer 1

Got a reply on Microsoft's Github:

https://github.com/Microsoft/Virtualization-Documentation/issues/253#issuecomment-217975932

This is a known limitation in our Windows NAT implementation (WinNAT) that you cannot access the external port in a static port mapping directly from the container (NAT) host.