Nginx proxy_pass行为异常：反向代理WordPress容器返回502错误

问题背景 #

使用Nginx作为SSL前端为多个后端服务提供反向代理，原有按端口转发至对应容器的server配置运行稳定，但新增WordPress容器并复制原有配置修改端口和容器名称后，出现502错误网关，WordPress容器未收到请求。

相关配置信息 #

Docker Compose配置 #

version: '3.8'

services:
  frontend:
    image: djmcmath/mysite-frontend:v0.0.47b
    ports:
      - "80:80"
      - "443:443"
      - "433:433"
      - "8443:8443"
    restart: unless-stopped
    volumes:
      - ./certbot/www:/var/www/certbot/:ro
      - ./certbot/conf/:/etc/nginx/ssl/:ro
    networks: 
      - frontend
      - backend
      
  backend:
    image: djmcmath/mysite-backend:v0.0.15a
    restart: unless-stopped
    ports:
      - "8080:8080"
    networks:
      - backend

  wordpress:
    image: wordpress
    restart: unless-stopped
    environment:
      WORDPRESS_DB_HOST: "db.mysite.com:3306"
      WORDPRESS_DB_USER: blog_user
      WORDPRESS_DB_PASSWORD: blog_pass
      WORDPRESS_DB_NAME: blog_db
    volumes:
      - ./wordpress/default-nonssl.conf:/etc/apache2/sites-available/default-nonssl.conf:ro
      - ./wordpress/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh:ro
      - ./wordpress/apache2.conf:/etc/apache2/apache2.conf:ro
    ports:
      - 81:80
      - 3306:3306
    networks:
      - backend

networks: 
  frontend:
  backend:

Nginx配置片段 #

#Blog
#Reverse proxy redirect; like the backend, where Cargo runs the service but can't do SSL, let Nginx do the SSL and wordpress just does wordpress.
server {
    listen 433 ssl http2;
    listen [::]:433 ssl http2;
    server_name mysite.com;
    
    add_header 'Access-Control-Allow-Origin' $http_origin always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
    add_header 'Access-Control-Allow-Headers' 'Authorization,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type' always;
    add_header 'X-Content-Type-Options' '4444' always;

    location / {
        proxy_redirect  off;
        proxy_set_header        Host    $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_pass              http://wordpress:81/;
    }
    ssl_certificate /etc/nginx/ssl/live/mysite.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/mysite.com/privkey.pem;    
}

WordPress容器内Apache虚拟主机配置 #

<VirtualHost *:80>
  DocumentRoot /var/www/html
  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  ServerName mysite.com
  ServerAlias www.mysite.com
  ServerAlias wordpress
</VirtualHost>

错误现象 #

Nginx在433端口收到请求后返回502错误网关，WordPress容器未收到请求，Nginx日志显示：

connect() failed (111: Connection refused) while connecting to upstream, client: x.y.z.a, server: mysite.com, request: "GET / HTTP/2.0", upstream: "http://172.31.0.4:81/", host: "mysite.com:433"

排查方向 #

• 修正容器间访问端口：Docker Compose中81:80是宿主机到容器的端口映射，容器内部通信需使用容器自身的端口（即80）。将Nginx配置中的proxy_pass http://wordpress:81/改为proxy_pass http://wordpress:80/，这是最可能的问题点。
• 验证WordPress容器服务状态：进入WordPress容器，执行service apache2 status检查Apache是否正常启动，或通过docker logs wordpress查看容器启动日志，确认无服务启动失败的报错。
• 测试容器间网络连通性：进入frontend容器，执行ping wordpress确认服务名可解析，再用curl http://wordpress:80测试是否能获取到WordPress的响应内容，排查网络连通问题。
• 检查Apache虚拟主机配置：确认容器内的虚拟主机已启用，执行a2ensite default-nonssl.conf并重启Apache；同时验证ServerAlias wordpress是否能让Apache正确响应来自容器服务名的请求。
• 验证Nginx配置合法性：在frontend容器内执行nginx -t检查配置语法，确认无误后重启Nginx服务。

内容的提问来源于stack exchange，提问作者djmcmath