配置近乎相同的Azure Docker容器：公网正常，内网实例报404

问题 #

我部署了两个配置近乎一致的Azure Docker容器，仅有的区别是一个配置为虚拟网络（内网访问），另一个配置为公网访问。从同属该虚拟网络（不同子网）的Azure Web App终端执行curl命令：访问公网实例的https://public.example.com可正常返回页面，而访问内网实例的https://private.example.com则返回404错误。

内网容器日志显示404错误，说明已成功建立连接；下游服务器已设为公网访问，排除防火墙问题；从内网容器执行curl已验证可访问下游服务器；微软支持确认网络连通性正常，问题出在容器配置本身。

内网实例YAML配置 #

additional_properties: {}
apiVersion: '2023-05-01'
extended_location: null
identity:
  type: SystemAssigned
location: australiaeast
name: myprivatecontainergroup
properties:
  containers:
  - name: myprivatecontainer
    properties:
      environmentVariables:
      - name: MODSEC_RULE_ENGINE
        value: 'DetectionOnly'
      - name: LOGLEVEL
        value: 'info'
      - name: SERVER_NAME
        value: private.example.com
      - name: PROXY_SSL
        value: 'on'
      - name: PROXY
        value: '1'
      - name: BACKEND
        value: https://mysamebackend.com
      image: owasp/modsecurity-crs:latest
      ports:
      - port: 443
        protocol: TCP
      resources:
        requests:
          cpu: 1.0
          memoryInGB: 1.5
      volumeMounts:
      - mountPath: /etc/nginx/conf
        name: myshare1
      - mountPath: /var/log/nginx
        name: logs
  initContainers: []
  ipAddress:
    autoGeneratedDomainNameLabelScope: Unsecure
    ports:
    - port: 443
      protocol: TCP
    type: Private
  isCustomProvisioningTimeout: false
  osType: Linux
  restartPolicy: OnFailure
  subnetIds:
   - id: /subscriptions/mysubscription/resourceGroups/myrg/providers/Microsoft.Network/virtualNetworks/amy-vn/subnets/mystorage
     name: mystorage
  sku: Standard
  volumes:
  - name: myvol1
    azureFile:
      sharename: myshare1
      storageAccountName: myaccount
      storageAccountKey: <key>
  - name: myvol2
    azureFile:
      sharename: myshare2
      storageAccountName: myacount
      storageAccountKey: <key>
tags: {}
type: Microsoft.ContainerInstance/containerGroups

公网实例YAML配置 #

additional_properties: {}
apiVersion: '2023-05-01'
extended_location: null
identity:
  type: SystemAssigned
location: australiaeast
name: mypubliccontainergroup
properties:
  containers:
  - name: mypubliccontainer
    properties:
      environmentVariables:
      - name: MODSEC_RULE_ENGINE
        value: 'DetectionOnly'
      - name: SERVER_NAME
        value: public.example.com
      - name: PROXY_SSL
        value: 'on'
      - name: PROXY
        value: '1'
      - name: BACKEND
        value: https://mysamebackend.com
      image: owasp/modsecurity-crs:latest
      ports:
      - port: 443
        protocol: TCP
      resources:
        requests:
          cpu: 1.0
          memoryInGB: 1.5
      volumeMounts:
      - mountPath: /etc/nginx/conf
        name: myshare1
      - mountPath: /var/log/nginx
        name: logs
  initContainers: []
  ipAddress:
    autoGeneratedDomainNameLabelScope: Unsecure
    dnsNameLabel: mydnslabel
    fqdn: my.public.azurecontainer.io
    ports:
    - port: 443
      protocol: TCP
    type: Public
  isCustomProvisioningTimeout: false
  osType: Linux
  restartPolicy: OnFailure
  sku: Standard
  volumes:
  - name: myvol1
    azureFile:
      sharename: myshare1
      storageAccountName: myaccount
      storageAccountKey: mykey
  - name: myvol2
    azureFile:
      sharename: myshare2
      storageAccountName: myaccount
      storageAccountKey: mykey
tags: {}
type: Microsoft.ContainerInstance/containerGroups

问题原因分析 #

导致内网容器返回404的核心问题是容器挂载的卷名称不匹配，次要问题是存储账户名拼写错误：

1. 卷名称不匹配
   内网容器的volumeMounts中指定的卷名称是myshare1和logs，但在volumes配置里对应的卷名称却是myvol1和myvol2——两者完全不对应，导致Nginx的配置目录/etc/nginx/conf无法正确挂载你存储在Azure File Share中的自定义配置。
   公网实例能正常工作，大概率是实际配置中卷名称是匹配的（可能粘贴时出现笔误）。没有自定义配置的情况下，Nginx使用默认配置，无法正确匹配private.example.com的请求或反向代理到指定后端，最终返回404。

2. 存储账户名拼写错误
   内网第二个卷的storageAccountName写成了myacount（少了字母c），而正确名称应为myaccount，这会导致日志卷/var/log/nginx挂载失败，但这不是404的直接原因，仅会影响日志记录。

修复方案 #

• 修正卷名称匹配：将volumes中的name改为myshare1和logs，或者将volumeMounts中的name改为myvol1和myvol2，确保两者一致。
• 修正存储账户名：将myacount改为myaccount，确保日志卷能正常挂载。

内容的提问来源于stack exchange，提问作者ibeme99