暴露Docker Port的问题

Question

I am trying to package a war file using a tomcat Docker image. I'm trying to expose the tomcat port in the image for it to be accessed externally.

This is my docker file

 FROM tomcat8:3.0.0

 COPY target/hello-world-war-1.0.0.war /usr/local/tomcat/webapps

 EXPOSE 8080

However, when I build this image, run it and try to access from my host browser (localhost:8080) it doesn't hit the endpoint, therefore it does not work as expected

I still have to expose the port externally with the -p switch.

What have I missed? or is the usage of EXPOSE something else?

My end need is to be able to deploy this in kubernetes.

Answer 1

What have I missed?

You need to publish port in some way:

• either by directly publishing it in docker run command remapping the EXPOSE Dockerfile directive to different host port using (note lowercase p):

   -p=[] : Publish a container᾿s port or a range of ports to the host 

• or, as stated in docker documentation , implicitly publish ports listed in the EXPOSE Dockerfile directive using (note capital P):

   -P : Publish all exposed ports to the host interfaces 

My end need is to be able to deploy this in kubernetes.

And to that goal you will be using ports listed in k8s manifests in similar fashion. Say, you expose port 8080 in your docker image (and publish it with -p or -P), you will then be using it in container spec (exact manifest depending on chosen k8s object type) and very probably later in service manifest, and in each layer you can change port mapping (similar to docker run -p mapping host:docker port to different values if you require to do so). So as far as k8s is concerned if you EXPOSE port in Dockerfile and it works correctly locally in container and also on host through any means of publishing it ( docker run with -p or -P) it will function in kubernetes as well (as far as you list it in proper manifest files).

Answer 2

The EXPOSE statement in your war simply means that the war is listening to port 8080 in the image, allowing access to your application through that port.

This however does not mean that it opens these ports. Thus you still need to use the -p switch to open the internal and/or external ports of docker to allow traffic between containers and/or external connections.

The first port specified by -p is the host port and the second one the container port. When you only specify one port this means the container can only be accessed by other containers running in the same docker network.