Docker exposing ports madness

Question

I've got several docker containers up and running using docker-compose. Nginx connected to PHP through internal port-forwarding at 9000/tcp. PHP connected to mysql through internal forwarding. Nginx is reachable at public NIC!

Another container running postfix is based on the same baseimage and configured/launched exactly the same as the Nginx-container but its ports are not accessible from the internet.

Both nginx and postfix are exposing the same way, so why is postfix not reachable??

nginx (Dockerfile)

...
EXPOSE 80/tcp 443/tcp
...

postfix (Dockerfile)

...
EXPOSE 25/tcp 465/tcp 587/tcp
...

docker-compose.yml

...nginx
ports:
  - "80:80/tcp"
  - "443:443/tcp"
...
and
...postfix
ports:
  - "25:25/tcp"
  - "465:465/tcp"
  - "587:587/tcp"
...

docker ps -a

CONTAINER ID    IMAGE     COMMAND                  CREATED          STATUS           PORTS                                                             NAMES
550cf81ccfc3    nginx     "nginx -g 'daemon ..."   17 minutes ago   Up 17 minutes    0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp                          nginx
5b1b823c8b75    postfix   "/run.sh"                17 minutes ago   Up 17 minutes    0.0.0.0:25->25/tcp, 0.0.0.0:465->465/tcp, 0.0.0.0:587->587/tcp    postfix
f7541058c973    php       "php5-fpm -F"            17 minutes ago   Up 17 minutes    9000/tcp                                                          php
ad1d1db33351    mysql     "/sbin/entrypoint...."   17 minutes ago   Up 17 minutes    3306/tcp                                                          mysql

netstat -a

Aktive Internetverbindungen (Nur Server)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      464/sshd        
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      461/rsyslogd    
tcp6       0      0 :::25                   :::*                    LISTEN      24924/docker-proxy
tcp6       0      0 :::443                  :::*                    LISTEN      24937/docker-proxy
tcp6       0      0 :::514                  :::*                    LISTEN      461/rsyslogd    
tcp6       0      0 :::587                  :::*                    LISTEN      24899/docker-proxy
tcp6       0      0 :::80                   :::*                    LISTEN      24975/docker-proxy
tcp6       0      0 :::465                  :::*                    LISTEN      24912/docker-proxy

iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-A DOCKER -d 172.17.0.4/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 587 -j ACCEPT
-A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 465 -j ACCEPT
-A DOCKER -d 172.17.0.6/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 25 -j ACCEPT
-A DOCKER -d 172.17.0.7/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.17.0.7/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT

Telnet on all ips:ports works fine from docker host.

nmap from outside to public ip:

25: filtered
80: open
110: filtered (although there is no service running, ~* weird *~)
443: open
465: filtered
587: filtered

uname -a

Linux h2127057 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) x86_64 GNU/Linux

How knows the solution??

Answer 1

A simple server reboot fixed it! Pretty stupid. :-(