Docker Stack服务映射端口无法访问问题求助（Ubuntu环境）

问题背景 #

在Ubuntu最新版本上使用Docker Desktop 4.24.0部署Docker Stack后，栈内a-service和mongo服务的映射端口（6522、6517）无法通过localhost访问，容器正常运行但外部连接超时或返回空响应。

关键信息收集 #

服务配置（docker-compose.yml片段） #

a-service:
  image: private-repo/services-a:1.0.0
  depends_on:
    - mongo
  ports:
    - "6522:8080"
  deploy:
    replicas: 2
  env_file: .env
  networks:
    - devnet

mongo:
  image: mongo:5.0.6
  ports:
    - "6517:27017"
  networks:
    - devnet
  volumes:
    - mongo_data:/data/db

服务状态 #

$ docker stack services dev-stack 
ID             NAME                          MODE         REPLICAS   IMAGE                                            PORTS
mdo7sfx54cjp   dev-stack_a-service           replicated   2/2        private-repo/services-a:1.0.0                    *:6522->8080/tcp
lx1po9lkg5zo   dev-stack_mongo               replicated   1/1        mongo:5.0.6                                      *:6517->27017/tcp

容器日志 #

a-service日志片段

$ docker container logs ab98faac8b80
[2023-10-12T17:08:38.863+0000] [] [INFO] [] [PayaraMicro] [tid: _ThreadID=1 _ThreadName=main] [timeMillis: 1697130518863] [levelValue: 800] [[
  
Payara Micro URLs:Payara Micro URLs:
http://172.18.0.12:8080/a

'a-service-1.0.0' REST Endpoints:
GET /a/api/v1/status

]]

mongo日志片段

$ docker container logs 037307ce2bd6
{"t":{"$date":"2023-10-12T17:08:00.043+00:00"},"s":"I",  "c":"NETWORK",  "id":23015,   "ctx":"listener","msg":"Listening on","attr":{"address":"/tmp/mongodb-27017.sock"}}
{"t":{"$date":"2023-10-12T17:08:00.043+00:00"},"s":"I",  "c":"NETWORK",  "id":23015,   "ctx":"listener","msg":"Listening on","attr":{"address":"0.0.0.0"}}
{"t":{"$date":"2023-10-12T17:08:00.043+00:00"},"s":"I",  "c":"NETWORK",  "id":23016,   "ctx":"listener","msg":"Waiting for connections","attr":{"port":27017,"ssl":"off"}}

连接测试 #

$ curl http://localhost:6522/a/api/v1/status
curl: (52) Empty reply from server

$ mongosh mongodb://localhost:6517
Current Mongosh Log ID: 65282973340b5cbff1e035fa
Connecting to:      mongodb://localhost:6517/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.5.4
MongoServerSelectionError: Server selection timed out after 2000 ms

端口监听状态 #

$ sudo netstat -tunlp | grep 6522
tcp6       0      0 :::6522                 :::*                    LISTEN      3855/com.docker.bac 

$ sudo netstat -tunlp | grep 6517
tcp6       0      0 :::6517                 :::*                    LISTEN      3855/com.docker.bac 

Docker信息片段 #

$ docker info
...
Swarm: active
  NodeID: kb213yi4lkr3kx5fetf7aidtp
  Is Manager: true
  ClusterID: k3vutzcr0275nxf7wk9z0f32y
  Node Address: 192.168.65.4
...
Kernel Version: 6.4.16-linuxkit
Operating System: Docker Desktop
...

排查分析 #

1. 容器内部服务正常：从日志看，a-service在容器内的172.18.0.12:8080正常启动，mongo绑定了容器内的0.0.0.0:27017，服务本身无问题。
2. 端口绑定仅IPv6：宿主机端口监听仅显示IPv6的:::6522和:::6517，未绑定IPv4的0.0.0.0，导致IPv4的localhost请求无法被正确转发。
3. Docker Desktop网络特性：Docker Desktop在Linux上运行于虚拟机环境，Swarm服务的端口默认绑定到虚拟机的IPv6地址，而非宿主机的IPv4回环地址。

解决方案 #

方案1：使用Docker虚拟机IP访问 #

直接使用docker info中显示的Node Address（192.168.65.4）代替localhost访问服务：

# 测试a-service
curl http://192.168.65.4:6522/a/api/v1/status

# 测试mongo
mongosh mongodb://192.168.65.4:6517

方案2：强制端口绑定IPv4 #

修改docker-compose.yml中的端口配置，明确指定绑定IPv4地址0.0.0.0：

a-service:
  # ...其他配置
  ports:
    - "0.0.0.0:6522:8080"

mongo:
  # ...其他配置
  ports:
    - "0.0.0.0:6517:27017"

重新部署栈：

docker stack rm dev-stack
docker stack deploy -c docker-compose.yml dev-stack

方案3：调整Docker Desktop网络设置 #

1. 打开Docker Desktop设置 → Resources → Network
2. 确保"Allow IPv4"选项已启用
3. 重启Docker Desktop后重新部署栈

方案4：检查宿主机防火墙与IPv6转发 #

• 启用IPv6转发（临时生效）：

  sudo sysctl -w net.ipv6.conf.all.forwarding=1
  

• 允许端口通过防火墙：

  sudo ufw allow 6522/tcp
  sudo ufw allow 6517/tcp
  

验证步骤 #

1. 检查端口是否同时绑定IPv4：

   sudo netstat -tunlp | grep -E "6522|6517"
   

   预期输出包含tcp 0 0 0.0.0.0:6522 0.0.0.0:* LISTEN

2. 再次测试本地连接：

   curl http://localhost:6522/a/api/v1/status
   mongosh mongodb://localhost:6517
   

内容的提问来源于stack exchange，提问作者John Manko