docker 容器之间的通信（keycloak 和 spring）

Question

So I have created a java spring boot application which uses Keycloak for authenticating its users. When I run keycloak from docker-compose I can sucesfully authenticate when running my application as a standalone jar file or when debugging. But when I put my spring boot application as a docker containers inside docker-compose. I cannot authenticate users anymore.

my error log from spring boot docker container:

springBootApp  | 2019-12-19 13:16:41.498 ERROR 1 --- [nio-8081-exec-2] o.k.a.rotation.JWKPublicKeyLocator       : Error when sending request to retrieve realm keys
springBootApp  | 
springBootApp  | org.keycloak.adapters.HttpClientAdapterException: IO error

I though that the problem is with network. but all containers are running in the same virtual network. They are also also in same docker-compose file.

this is my keycloak part:

  keycloak:
    image: jboss/keycloak
    ports:
      - 18080:8080
    volumes:
        - ../keycloak:/opt/jboss/keycloak/imports
    command: 
        - "-b 0.0.0.0 -Dkeycloak.import=/opt/jboss/keycloak/imports/realm-export.json"
    environment:
              - KEYCLOAK_USER=admin
              - KEYCLOAK_PASSWORD=admin

my spring boot app

  mySpringBootApp:
    image: mySpringBootApp:master-1
    environment:
      - SPRING_PROFILES_ACTIVE=developmentTest
    depends_on: 
      - jaeger
      - keycloak
      - db
    ports:
      - "8081:8081"

When I try to use curl localhost:18080 from my host. I get the response. when I try to use curl from springBootApp docker I get connection refused. So I assume that even though they are in the same network they don't see each other.

Answer 1

You have to keep in mind that your docker container is isolated from the host it is running on. localhost for your computer is different then localhost from inside the docker container.

You are using docker-compose and both services are in the same docker-compose.yaml configuration this means you can use the service name of a service to reach it from within another service that is in the same docker-compose file.

In your case the service you want to access is called keycloak and you have mapped its ports as 18080:8080 meaning that from your computer localhost 18080 accesses the port 8080 of this particular container.

In order to access this container (or service in a docker-compose context) you need to replace localhost by the name of your service.

In your case to curl the keycloak container from mySprngBootApp container you need to replace lcalhost by the name of the service so long story short: curl keycloak:18080

Answer 2

I would define network for your services in docker compose, like:

services:
  app:
    image: some-image
    networks:
      - my-network-name

networks:
  my-network-name:
   name: my-global-net

And you can be sure, that services are in the same network and speak via service's name with each other.