SSH隧道到远程docker服务

Question

I have a server with several Docker services ran by docker-compose . Database service looks like this:

myproject_influxdb:                                    
  container_name: myproject_influxdb
  image: 'influxdb:alpine'
  volumes:                                        
   - '/var/lib/influxdb:/var/lib/influxdb'
   - './influxdb.conf:/etc/influxdb/influxdb.conf'
  ports:
   - '8086:8086'

It can be accessed by myproject_influxdb:8086 from other containers.

Now I want to connect to that database from my local docker service. I run ssh -L 8086:localhost:8086 user@host in a new terminal. Then I try to connect to remote myproject_influxdb service but no matter what host I enter ( localhost , myproject_influxdb , 0.0.0.0 ) I get same error: [Errno 111] Connection refused .

Is it because both remote and host services are not using network_mode: "host" ?

Answer 1

docker-compose services are on different network than standard docker run containers.

That is why the myproject_influxdb wont work. If you are inside docker container and try to access something with localhost you are just inside the same container (not the host). With that being said you can access the influxdb via the exposed port on host with

host_ip:8086

to get the ip address of host you can use this bash command

/sbin/ip route|awk '/default/ { print $3 }'

Answer 2

Two option:

1) Use --network=host to run your container locally like so

docker run -it --rm --network=host -p 8888:8888 chronograf --influxdb-url=http://localhost:8086

However this does give your container access to your entire host network, which raises security vulnerabilities.

2) You could to connect the tunnel to your local Docker bridge network and then tell your local docker container to use the bridge's IP as well.

You can get your local bridge IP address with either ip addr or docker network inspect bridge

After that your ssh command would be

ssh -L <bridge-ip>:8086:localhost:8086 user@host

If, like me, you were trying to run chronograf locally, this shell script would do it for you.

#! /usr/bin/env sh
echo "Retrieving BRIDGE IP"
BRIDGE_IP=$(docker network inspect --format '{{(index .IPAM.Config 0).Gateway}}' bridge)
echo "Found BRIDGE_IP: ${BRIDGE_IP}"
ssh -NL ${BRIDGE_IP}:8086:127.0.0.1:8086 <user>@<host> &
PID=$!
echo "Saved SSH PID: ${PID}"
docker run -it --rm -p 8888:8888 chronograf --influxdb-url=http://${BRIDGE_IP}:8086
kill $PID
echo "Done ..."