使用Terraform挂载自定义Nginx配置到Docker容器启动失败求助

我尝试通过Terraform创建运行Nginx的Docker容器，希望将自定义default.conf挂载到容器内的/etc/nginx/conf.d/default.conf路径，但容器总是立即退出。试过挂载整个/tmp/nginx_conf.d目录到容器/etc/nginx/conf.d，结果还是一样。

我的main.tf配置 #

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "3.0.2"
    }
  }
}

provider "docker" {}

data "docker_registry_image" "nginx" {
  name = "nginx:1.25.2-alpine"
}

resource "docker_image" "nginx" {
  name          = data.docker_registry_image.nginx.name
  pull_triggers = [data.docker_registry_image.nginx.sha256_digest]
}

resource "docker_container" "test_nginx" {
  name  = "frontend"
  image = docker_image.nginx.image_id

  volumes {
    container_path = "/etc/nginx/conf.d/default.conf"
    host_path      = "/tmp/nginx_conf.d/default.conf"
  }

  ports {
    internal = 80
  }
}

执行报错信息 #

data.docker_registry_image.nginx: Reading...
data.docker_registry_image.nginx: Read complete after 2s [id=sha256:4c93a3bd8bf95412889dd84213570102176b6052d88bb828eaf449c56aca55ef]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # docker_container.test_nginx will be created
  + resource "docker_container" "test_nginx" {
      + attach                                      = false
      + bridge                                      = (known after apply)
      + command                                     = (known after apply)
      + container_logs                              = (known after apply)
      + container_read_refresh_timeout_milliseconds = 15000
      + entrypoint                                  = (known after apply)
      + env                                         = (known after apply)
      + exit_code                                   = (known after apply)
      + hostname                                    = (known after apply)
      + id                                          = (known after apply)
      + image                                       = (known after apply)
      + init                                        = (known after apply)
      + ipc_mode                                    = (known after apply)
      + log_driver                                  = (known after apply)
      + logs                                        = false
      + must_run                                    = true
      + name                                        = "frontend"
      + network_data                                = (known after apply)
      + read_only                                   = false
      + remove_volumes                              = true
      + restart                                     = "no"
      + rm                                          = false
      + runtime                                     = (known after apply)
      + security_opts                               = (known after apply)
      + shm_size                                    = (known after apply)
      + start                                       = true
      + stdin_open                                  = false
      + stop_signal                                 = (known after apply)
      + stop_timeout                                = (known after apply)
      + tty                                         = false
      + wait                                        = false
      + wait_timeout                                = 60

      + ports {
          + external = (known after apply)
          + internal = 80
          + ip       = "0.0.0.0"
          + protocol = "tcp"
        }

      + volumes {
          + container_path = "/etc/nginx/conf.d/default.conf"
          + host_path      = "/tmp/nginx_conf.d/default.conf"
        }
    }

  # docker_image.nginx will be created
  + resource "docker_image" "nginx" {
      + id            = (known after apply)
      + image_id      = (known after apply)
      + name          = "nginx:1.25.2-alpine"
      + pull_triggers = [
          + "sha256:4c93a3bd8bf95412889dd84213570102176b6052d88bb828eaf449c56aca55ef",
        ]
      + repo_digest   = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

docker_image.nginx: Creating...
docker_image.nginx: Creation complete after 7s [id=sha256:d571254277f6a0ba9d0c4a08f29b94476dcd4a95275bd484ece060ee4ff847e4nginx:1.25.2-alpine]
docker_container.test_nginx: Creating...
╷
│ Error: container exited immediately
│ 
│   with docker_container.test_nginx,
│   on main.tf line 21, in resource "docker_container" "test_nginx":
│   21: resource "docker_container" "test_nginx" {
│ 
╵

我的环境版本 #

Terraform v1.6.0
on linux_amd64
+ provider registry.terraform.io/kreuzwerker/docker v3.0.2

排查与解决方案 #

1. 先验证自定义Nginx配置语法 #

Nginx启动失败90%以上是配置文件语法错误，直接用镜像验证：

docker run --rm -v /tmp/nginx_conf.d/default.conf:/etc/nginx/conf.d/default.conf nginx:1.25.2-alpine nginx -t

如果输出nginx: configuration file /etc/nginx/nginx.conf test failed，就去修正配置里的语法问题，比如缺分号、括号不匹配等。

2. 检查宿主机文件/目录权限与存在性 #

• 确保/tmp/nginx_conf.d/default.conf文件存在，没创建的话先手动建：

  mkdir -p /tmp/nginx_conf.d && touch /tmp/nginx_conf.d/default.conf
  

• 给文件加可读权限，避免Docker进程读不到：

  chmod 644 /tmp/nginx_conf.d/default.conf
  

• 如果挂载的是目录，要确保目录下至少有一个有效的Nginx配置文件，空目录会导致Nginx找不到配置直接退出。

3. 查看容器日志找具体原因 #

Terraform的报错太笼统，直接看容器日志：

docker logs frontend

日志会明确告诉你失败原因，比如invalid number of arguments in "listen" directive或者file not found。

4. 优化Terraform配置 #

添加日志输出、指定宿主机端口、设置配置文件只读，方便调试和安全：

terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "3.0.2"
    }
  }
}

provider "docker" {}

data "docker_registry_image" "nginx" {
  name = "nginx:1.25.2-alpine"
}

resource "docker_image" "nginx" {
  name          = data.docker_registry_image.nginx.name
  pull_triggers = [data.docker_registry_image.nginx.sha256_digest]
}

resource "docker_container" "test_nginx" {
  name  = "frontend"
  image = docker_image.nginx.image_id
  logs  = true # 让Terraform输出容器日志，不用手动查

  volumes {
    container_path = "/etc/nginx/conf.d/default.conf"
    host_path      = "/tmp/nginx_conf.d/default.conf"
    read_only      = true # 配置文件没必要可写，提升安全性
  }

  ports {
    internal = 80
    external = 8080 # 指定宿主机端口，方便测试访问
  }
}

内容的提问来源于stack exchange，提问作者harrier