XDebug 无法从 docker 容器连接到客户端

Question

I have few docker containers: php, nginx, mariadb, redis, adminer and try to debug some PHP code with PhpStorm and Xdebug.

主机（联想 T490 笔记本电脑）：

$ hostname
T490


$ docker -v
Docker version 20.10.5, build 55c4c88


$ docker-compose -v
docker-compose version 1.24.1, build 4667896b


$ cat /etc/lsb-release 
DISTRIB_ID=neon
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="KDE neon User Edition 5.21"


$ php -v
PHP 7.4.16 (cli) (built: Mar  5 2021 07:54:20) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.16, Copyright (c), by Zend Technologies


$ lsof -i :9003 | grep LISTEN
java    14868 kane   48u  IPv6 401093      0t0  TCP *:9003 (LISTEN)


$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       T490

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

172.17.0.1 foo.pl adm.foo.pl api.foo.pl

PhpStorm 2020.3.3 配置：

Docker-compose.yml

version: "3"
services:
  php-7.4:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    build: ./docker-images/php-7.4
    image: ap/php:7.4
    container_name: foo-php-7.4
    environment:
      - GITHUB_API_TOKEN=${GITHUB_API_TOKEN}
      - XDEBUG_IDEKEY=${XDEBUG_IDEKEY}
    volumes:
      - ~/.composer-docker/cache:/root/.composer/cache:delegated
      - ~/.gitconfig:/root/.gitconfig
      - ${WORKSPACE_DIR}:/var/www
      - ~/.ssh:/root/ssh:ro
      - ./docker/php/conf.d/xdebug.ini:/usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini

DockerFile 中的 XDebug 通过以下方式安装：

RUN pecl install xdebug \
    && docker-php-ext-enable xdebug

.env

GITHUB_API_TOKEN=
WORKSPACE_DIR=/home/kane/workspace

XDEBUG_IDEKEY=PHPSTORM

COMPOSE_PROJECT_NAME=yii2fpm
COMPOSE_FILE=docker-compose.yml
X_LEGACY_GD_LIB=1
PHP_CGI_PASS=php-7.4:9000
NGINX_PORT=80
NGINX_SSL_PORT=443
DB_PORT=3306
ADMINER_PORT=8182

xdebug.ini

zend_extension=xdebug

[xdebug]
xdebug.mode=develop,debug
xdebug.client_host=172.17.0.1
xdebug.start_with_request = yes

docker-compose 起来后，在容器中：

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         T490            0.0.0.0         UG    0      0        0 eth0
172.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0


# ping T490
PING T490 (127.0.1.1) 56(84) bytes of data.
64 bytes from T490 (127.0.1.1): icmp_seq=1 ttl=64 time=0.057 ms


# ping 172.17.0.1
PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.145 ms


# telnet 172.17.0.1 9003
Trying 172.17.0.1...


# telnet T490 9003
Trying 127.0.1.1...
telnet: Unable to connect to remote host: Connection refused


# php -v
PHP 7.4.16 (cli) (built: Mar 13 2021 02:52:33) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.16, Copyright (c), by Zend Technologies
    with Xdebug v3.0.3, Copyright (c) 2002-2021, by Derick Rethans

当我从 go 到http://adm.foo.pl/ （带有 cookie XDEBUG_SESSION:"PHPSTORM"）docker 日志说：

NOTICE: PHP message: Xdebug: [Step Debug] Time-out connecting to debugging client, waited: 200 ms. Tried: 172.17.0.1:9003 (through xdebug.client_host/xdebug.client_port):-(

将 xdebug.ini 更改为：

zend_extension=xdebug

[xdebug]
xdebug.mode=develop,debug
xdebug.discover_client_host = yes
xdebug.start_with_request = yes

它说：

NOTICE: PHP message: Xdebug: [Step Debug] Could not connect to debugging client. Tried: 172.18.0.1:9003 (from REMOTE_ADDR HTTP header), localhost:9003 (fallback through xdebug.client_host/xdebug.client_port):-(

添加extra_host后说：

NOTICE: PHP message: Xdebug: [Step Debug] Time-out connecting to debugging client, waited: 200 ms. Tried: host.docker.internal:9003 (through xdebug.client_host/xdebug.client_port):-(

请帮忙：-）

Answer 1

使用 Linux 上的 Docker，您可以

1. 使用物理网络接口（ens* 或 eth0 或类似的东西）IP 连接到主机，或
2. 使用这个黑客能够使用host.docker.internal ： https://github.com/docker/for-linux/issues/264#issuecomment-759737542

在容器中安装telnet以检查端口的可用性始终是一个好主意， 172.17.0.1响应 ping 的事实并不一定意味着它是主机。

Answer 2

多么可悲...通常我在 Centos7 上工作，所以我通过firewall-cmd而不是ufw （在 Ubuntu/Debian 上）寻找防火墙。

$ sudo ufw allow 9003

现在一切都开始正常工作了。