Docker容器运行Duende IdentityServer时不监听443端口问题求助

现象 #

• 在Visual Studio中以Docker调试运行时，日志显示应用正常监听80和443端口：

[05:08:57 Information] Microsoft.Hosting.Lifetime
Now listening on: https://[::]:443

[05:08:57 Information] Microsoft.Hosting.Lifetime
Now listening on: http://[::]:80

• 但使用docker run命令手动运行容器时，日志仅显示监听80端口：

docker run -d -p 9441:443 -p 9442:80 --name duendetest test/duendeserver:1.0

[05:16:48 Information] Microsoft.Hosting.Lifetime
Now listening on: http://[::]:80

相关配置 #

Dockerfile #

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
WORKDIR /src
COPY ["Test.DuendeServer/Test.DuendeServer.csproj", "Test.DuendeServer/"]
RUN dotnet restore "Test.DuendeServer/Test.DuendeServer.csproj"
COPY . .
WORKDIR "/src/Test.DuendeServer"
RUN dotnet build "Test.DuendeServer.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Test.DuendeServer.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .

# Install ca-certificates for certificate management
RUN apt-get update && apt-get install -y ca-certificates

# Create a directory for custom certificates
RUN mkdir /usr/local/share/ca-certificates/my_custom_certs

# Copy certificate to the container
COPY Test.DuendeServer/certificates/ /usr/local/share/ca-certificates/my_custom_certs/

# Update the trusted certificates store
RUN update-ca-certificates

ENTRYPOINT ["dotnet", "Test.DuendeServer.dll"]

launchSettings.json的Docker配置 #

"Docker": {
  "commandName": "Docker",
  "launchBrowser": true,
  "launchUrl": "{Scheme}://{ServiceHost}:{ServicePort}",
  "publishAllPorts": true,
  "useSSL": true
}

排查解决方向 #

• 证书与Kestrel配置缺失：VS调试时会自动注入开发证书并配置HTTPS，但手动运行容器时，需要确保项目中显式配置Kestrel监听443端口并指定证书。检查Program.cs是否有类似配置：

  builder.WebHost.ConfigureKestrel(options =>
  {
      options.ListenAnyIP(80);
      options.ListenAnyIP(443, o => o.UseHttps("path/to/cert.pfx", "cert-password"));
  });
  

• 环境变量差异：VS调试会自动设置ASPNETCORE_URLS等环境变量，手动运行时需显式传递。尝试在docker run命令中添加：

  -e ASPNETCORE_URLS="https://+:443;http://+:80"
  

• 证书加载验证：检查容器内证书是否正确复制、路径是否匹配，以及应用是否有权限读取证书。可以进入容器执行ls /usr/local/share/ca-certificates/my_custom_certs确认文件存在，或在启动命令中添加日志查看证书加载报错信息。
• 发布配置差异：VS调试用Debug配置，手动运行的是Release包，检查两种配置下的appsettings.json是否有HTTPS相关配置差异，比如证书路径、是否启用HTTPS等。

内容的提问来源于stack exchange，提问作者Kman