如何从 .net Core Linux Docker 容器（使用 Docker for Windows）连接到 Internet 上的 Sql Server？

Question

We're trying to access a Sql Server database that's on a remote network from within a Docker container. However, every attempt at connecting just hangs the application (no exception, no timeout, just endless nothing).

It's easy to reproduce by creating a new .Net Core 3.1 console application and adding this code (add package reference to Microsoft.Data.SqlClient):

using System;
using System.Threading.Tasks;
using Microsoft.Data.SqlClient;

namespace ConsoleApp1
{
    class Program
    {
        static async Task Main(string[] args)
        {
            var connStr = "Data Source=<public server ip>,1433;Integrated Security=False;Initial Catalog=TestDatabase;User ID=user;Password=password";
            await using var connection = new SqlConnection(connStr);

            await connection.OpenAsync();

            Console.WriteLine("Hello World!");
        }
    }
}

Then add Docker support via Visual Studio, which generates a DOCKERFILE:

#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.

FROM mcr.microsoft.com/dotnet/core/runtime:3.1-buster-slim AS base
WORKDIR /app

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
COPY ["ConsoleApp1/ConsoleApp1.csproj", "ConsoleApp1/"]
RUN dotnet restore "ConsoleApp1/ConsoleApp1.csproj"
COPY . .
WORKDIR "/src/ConsoleApp1"
RUN dotnet build "ConsoleApp1.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "ConsoleApp1.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "ConsoleApp1.dll"]

Now when we start the project as the ConsoleApp1 -profile the connection is made as expected. When starting the project using the Docker -profile the application just hangs on the await connection.OpenAsync(); call.

There's no exception or anything. It just doesn't connect and just sits there indefinitely...

I realise running a Linux container on a Windows machine involves all kinds of magic, but creating a webrequest to an external page does work. Which gives me the impression that it has something to do with the port number or the nature of a connection to a Sql Server.

Any help would be greatly appreciated.

Answer 1

As it turns out, the new version of the mcr.microsoft.com/dotnet/core/runtime:3.1-buster-slim source-image is much stricter on the TLS/Cipher usage.

This, combined with a bug in the SqlClient caused this behaviour. As it turns out the issue and various resolutions/workarounds is very extensively discussed on the SqlClient repository:

https://github.com/dotnet/SqlClient/issues/201