ECS容器内执行Curl请求失败问题求助

部署详情 #

• Spring Boot应用以任务形式部署在配置了AutoScalingGroup的ECS(EC2)集群中；
• 网络模式设置为awsvpc；
• 任务定义未显式配置健康检查，但应用提供无需认证的/healthz接口，返回HTTP 200状态码，其余接口受Spring Security保护。

任务部署成功，日志无报错，默认Docker健康检查显示Tomcat主进程运行正常。

问题现象 #

连接到运行ECS优化版Amazon Linux 2的EC2实例后，执行Curl请求出现异常：

• 使用EC2实例主私有IP执行Curl时，连接立即被拒绝，命令及报错如下：

sh-4.2$ curl -vvv http://localhost:8085/
*   Trying 127.0.0.1:8085...
* connect to 127.0.0.1 port 8085 failed: Connection refused
*   Trying [::1]:8085...
* connect to ::1 port 8085 failed: Connection refused
* Failed to connect to localhost port 8085 after 0 ms: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to localhost port 8085 after 0 ms: Couldn't connect to server

• 使用任务ENI的IP执行Curl时，请求2分钟后超时，命令及报错如下：

sh-4.2$ curl -vvv http://10.0.1.95:8085/
*   Trying 10.0.1.95:8085...
* connect to 10.0.1.95 port 8085 failed: Connection timed out
* Failed to connect to 10.0.1.95 port 8085 after 129583 ms: Couldn't connect to server
* Closing connection 0
curl: (28) Failed to connect to 10.0.1.95 port 8085 after 129583 ms: Couldn't connect to server

应用部署在带NAT网关的私有子网，支持出站连接，无VPC外入站连接，测试环境下安全组已配置为全开。

更新说明 #

尽管Curl请求失败，但ECS服务与ALB(负载均衡器)集成正常，运行中的任务已注册为ALB目标组的健康目标，可通过负载均衡器正常访问Spring Boot应用的接口。

任务定义 #

{
    "containerDefinitions": [
        {
            "name": "boot-app-web-container",
            "image": "687xxxxxxxxx.dkr.ecr.ap-south-1.amazonaws.com/cdkbootapp:latest",
            "cpu": 1024,
            "memory": 2048,
            "memoryReservation": 2048,
            "links": [],
            "portMappings": [
                {
                    "name": "bootwebapp",
                    "containerPort": 8085,
                    "hostPort": 8085,
                    "protocol": "tcp",
                    "appProtocol": "http"
                }
            ],
            "essential": true,
            "entryPoint": [],
            "command": [],
            "environment": [
                {
                    "name": "DB_ENDPOINT_URL",
                    "value": "dev-boot-app-db.xxxxxxxx.ap-south-1.rds.amazonaws.com"
                },
                {
                    "name": "DB_PORT",
                    "value": "3306"
                },
                {
                    "name": "COGNITO_CLIENT_SECRET",
                    "value": "1mhfohg82arcdv0mmrt97upaittj1db2eilhfpxxxxxxx"
                },
                {
                    "name": "DB_NAME",
                    "value": "bootappdb"
                },
                {
                    "name": "COGNITO_CLIENT_ID",
                    "value": "29ik1ommu2tlm7gxxxxx"
                },
                {
                    "name": "COGNITO_ISSUER_URL",
                    "value": "https://cognito-idp.ap-south-1.amazonaws.com/ap-south-1_LXeqQWgik"
                },
                {
                    "name": "DB_PASSWORD",
                    "value": "dQoTxxxxxxxx"
                }
            ],
            "environmentFiles": [],
            "mountPoints": [],
            "volumesFrom": [],
            "secrets": [],
            "startTimeout": 120,
            "stopTimeout": 60,
            "dnsServers": [],
            "dnsSearchDomains": [],
            "extraHosts": [],
            "dockerSecurityOptions": [],
            "dockerLabels": {},
            "ulimits": [],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-datetime-format": "%Y-%m-%dT%H:%M:%S.%f%z",
                    "awslogs-group": "dev-boot-app-log-group",
                    "awslogs-region": "ap-south-1",
                    "awslogs-stream-prefix": "boot-web-app-ecs-stream",
                    "mode": "non-blocking"
                },
                "secretOptions": []
            },
            "healthCheck": {
                "command": [
                    "CMD-SHELL",
                    "curl -f http://localhost:8085/healthz || exit 1"
                ],
                "interval": 5,
                "timeout": 3,
                "retries": 3,
                "startPeriod": 30
            },
            "systemControls": []
        }
    ],
    "family": "boot-app-ecs-tasks",
    "taskRoleArn": "arn:aws:iam::687842843974:role/bootappEcsTaskRole",
    "executionRoleArn": "arn:aws:iam::687842843974:role/bootappEcsTaskExecutionRole",
    "networkMode": "awsvpc",
    "revision": 31,
    "volumes": [],
    "status": "ACTIVE",
    "requiresAttributes": [
        {
            "name": "ecs.capability.execution-role-awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.ecr-auth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.17"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.28"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.21"
        },
        {
            "name": "com.amazonaws.ecs.capability.task-iam-role"
        },
        {
            "name": "ecs.capability.container-health-check"
        },
        {
            "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
            "name": "ecs.capability.task-eni"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.29"
        },
        {
            "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.30"
        },
        {
            "name": "ecs.capability.container-ordering"
        }
    ],
    "placementConstraints": [],
    "compatibilities": [
        "EC2"
    ],
    "requiresCompatibilities": [
        "EC2"
    ],
}

内容的提问来源于stack exchange，提问作者Mandar K