Docker端口映射疑问：为何Kafka无法使用9092以外的本地端口？

环境信息 #

• 操作系统：Windows 10 Pro
• Docker版本：v27.4.0
• 技术栈：C# + Confluent.Kafka客户端、Apache Kafka 3.9.0容器

正常运行场景 #

docker-compose.yml配置 #

services:
  kafka390:
    container_name: kafka390
    image: "apache/kafka:3.9.0"
    ports:
      - "9092:9092"
    networks:
      - message_brokers

networks:
  message_brokers:
    name: message_brokers

C#客户端核心配置 #

var config = new ProducerConfig {
    BootstrapServers = "localhost:9092",
    SecurityProtocol = SecurityProtocol.Plaintext,
    AllowAutoCreateTopics = true,
};

成功输出日志 #

The message 'Hello, World!' produced to Topic 'test-topic', Partition/Offset: [0]/0
The message 'Hello, World!' produced to Topic 'test-topic', Partition/Offset: [0]/1
The message 'Hello, World!' produced to Topic 'test-topic', Partition/Offset: [0]/2
The message 'Hello, World!' produced to Topic 'test-topic', Partition/Offset: [0]/3
The message 'Hello, World!' produced to Topic 'test-topic', Partition/Offset: [0]/4

异常场景（修改端口后） #

修改后的docker-compose.yml #

services:
  kafka390:
    container_name: kafka390
    image: "apache/kafka:3.9.0"
    ports:
      - "9001:9092"
    networks:
      - message_brokers

networks:
  message_brokers:
    name: message_brokers

修改后的C#客户端配置 #

BootstrapServers = "localhost:9001"

错误输出日志 #

%3|1734768639.305|FAIL|rdkafka#producer-1| [thrd:localhost:9092/1]: localhost:9092/1: Connect to ipv4#127.0.0.1:9092 failed: Unknown error (after 2035ms in state CONNECT)
ERROR CODE: Local_Transport. IsLocalError: True, IsBrokerError: False, IsFatal: False, Reason: localhost:9092/1: Connect to ipv4#127.0.0.1:9092 failed: Unknown error (after 2035ms in state CONNECT).
%3|1734768641.644|FAIL|rdkafka#producer-1| [thrd:localhost:9092/1]: localhost:9092/1: Connect to ipv6#[::1]:9092 failed: Unknown error (after 2029ms in state CONNECT)
ERROR CODE: Local_Transport. IsLocalError: True, IsBrokerError: False, IsFatal: False, Reason: localhost:9092/1: Connect to ipv6#[::1]:9092 failed: Unknown error (after 2029ms in state CONNECT).
%3|1734768643.684|FAIL|rdkafka#producer-1| [thrd:localhost:9092/1]: localhost:9092/1: Connect to ipv6#[::1]:9092 failed: Unknown error (after 2040ms in state CONNECT, 1 identical error(s) suppressed)
ERROR CODE: Local_Transport. IsLocalError: True, IsBrokerError: False, IsFatal: False, Reason: localhost:9092/1: Connect to ipv6#[::1]:9092 failed: Unknown error (after 2040ms in state CONNECT, 1 identical error(s) suppressed).

问题原因 #

Kafka的通信机制是：客户端通过bootstrap服务器建立初始连接后，会从broker获取advertised.listeners配置的地址，后续所有生产/消费请求都会切换到这个地址通信。

默认情况下，Apache Kafka容器的advertised.listeners配置为PLAINTEXT://localhost:9092。当你修改本地映射端口为9001后：

1. 客户端先通过localhost:9001成功建立初始连接
2. 但从broker拿到的通信地址还是localhost:9092
3. 此时客户端尝试连接未映射的localhost:9092端口，导致连接失败

错误日志也能验证这一点：日志明确显示客户端在尝试连接localhost:9092，而非配置的9001端口。

解决方法 #

需要修改Kafka容器的advertised.listeners和listeners配置，让broker告知客户端正确的外部访问地址。

1. 更新docker-compose.yml #

添加环境变量配置，指定监听地址和对外暴露地址：

services:
  kafka390:
    container_name: kafka390
    image: "apache/kafka:3.9.0"
    ports:
      - "9001:9092"
    environment:
      - KAFKA_LISTENERS=PLAINTEXT://0.0.0.0:9092
      - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9001
      - KAFKA_LISTENER_SECURITY_PROTOCOL_MAP=PLAINTEXT:PLAINTEXT
    networks:
      - message_brokers

networks:
  message_brokers:
    name: message_brokers

• KAFKA_LISTENERS：配置Kafka在容器内部监听所有网卡的9092端口
• KAFKA_ADVERTISED_LISTENERS：配置broker对外暴露的地址，即客户端实际连接的localhost:9001
• KAFKA_LISTENER_SECURITY_PROTOCOL_MAP：绑定监听协议与安全协议（此处使用明文）

2. 重启容器 #

执行命令让配置生效：

docker-compose down
docker-compose up -d

3. 保持C#客户端配置不变 #

确保客户端的BootstrapServers仍为localhost:9001：

var config = new ProducerConfig {
    BootstrapServers = "localhost:9001",
    SecurityProtocol = SecurityProtocol.Plaintext,
    AllowAutoCreateTopics = true,
};

修改完成后，客户端初始连接localhost:9001，从broker获取的通信地址也为localhost:9001，即可正常进行消息生产/消费。

内容的提问来源于stack exchange，提问作者Andrey Bushman