Tomcat running in Docker container cannot be reached when configured to listen to 127.0.0.1

Question

I am trying to configure Tomcat within a Docker container to listen to 127.0.0.1:80 rather than 0.0.0.0:80. The catalina logs show that the Tomcat server is starting up though it appears that Tomcat cannot be reached. The catalina logs and.netstat both confirm that Tomcat is listening to 127.0.0.1:80.

Wireshark shows that a TCP handshake is being completed. However, the HTTP get request sent by the browser does not get responded to.

Wireshark Trace

This is the Dockerfile:

FROM debian:stretch

RUN \
    apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y default-jre && \
    apt-get install -y libtcnative-1 && \
    apt-get install -y wget && \
    apt-get install -y curl && \
    apt-get install -y unzip && \
    apt-get install -y gettext-base
ENV JAVA_HOME="/usr/lib/jvm/java-8-openjdk-amd64/jre"

RUN \
    TOMCAT_VER=`curl --silent http://mirror.vorboss.net/apache/tomcat/tomcat-9/ | grep v9 -m 1 | awk '{split($5,c,">v") ; split(c[2],d,"/") ; print d[1]}'` && \
    wget -N http://mirror.vorboss.net/apache/tomcat/tomcat-9/v${TOMCAT_VER}/bin/apache-tomcat-${TOMCAT_VER}.tar.gz &&\
    tar xzf apache-tomcat-${TOMCAT_VER}.tar.gz && \
    rm -f apache-tomcat-${TOMCAT_VER}.tar.gz && \
    mv apache-tomcat-${TOMCAT_VER}/ /opt/tomcat

ENV CATALINA_HOME="/opt/tomcat" \
PATH="$PATH:/opt/tomcat/bin"

RUN rm -fr /opt/tomcat/webapps/*

COPY app.war /opt/tomcat/webapps/ROOT.war

COPY server.xml /opt/tomcat/conf/server.xml

CMD ["catalina.sh", "run"]
EXPOSE 80 443

Here is the relevant connecter from server.xml:

<Connector port="80" 
           protocol="HTTP/1.1" 
           address="127.0.0.1"
           connectionTimeout="20000" />

Could someone with deeper knowledge of this shed some light on why a connection to a Tomcat container can not be made when Tomcat is configured to listen to 127.0.0.1?

Answer 1

Network-wise, your dockerized application (Tomcat) is running on a different host than your client (unless you run the client in the same container which is unlikely). If your Tomcat listens to 127.0.0.1:80 only then no client will ever be able to connect from outside the container.

Even if you modify Tomcat to listen to 0.0.0.0:80 tomcat would be listening correctly inside the container, but Docker's defaults still would not allow any traffic. You would have to expose that port to the outside world.