多.NET应用Docker端口映射失败问题排查求助

问题背景 #

尝试为两个.NET 7应用创建Docker容器并配置端口映射，但无法通过5001/5002（DemoAppTwo）和5003/5004（DemoApp）访问应用。

当前配置文件 #

Dockerfile (DemoAppTwo) #

#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
WORKDIR /src
COPY ["DemoAppTwo/DemoAppTwo.csproj", "DemoAppTwo/"]
RUN dotnet restore "DemoAppTwo/DemoAppTwo.csproj"
COPY . .
WORKDIR "/src/DemoAppTwo"
RUN dotnet build "DemoAppTwo.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "DemoAppTwo.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "DemoAppTwo.dll"]

Dockerfile (DemoApp) #

#See https://aka.ms/containerfastmode to understand how Visual Studio uses this Dockerfile to build your images for faster debugging.

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
WORKDIR /src
COPY ["DemoApp/DemoApp.csproj", "DemoApp/"]
RUN dotnet restore "DemoApp/DemoApp.csproj"
COPY . .
WORKDIR "/src/DemoApp"
RUN dotnet build "DemoApp.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "DemoApp.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "DemoApp.dll"]

docker-compose.yml #

version: '3.4'

services:
  demoapptwo:
    image: ${DOCKER_REGISTRY-}demoapptwo
    build:
      context: .
      dockerfile: DemoAppTwo/Dockerfile
    ports:
      - "5001:80"
      - "5002:443"

  demoapp:
    image: ${DOCKER_REGISTRY-}demoapp
    build:
      context: .
      dockerfile: DemoApp/Dockerfile
    ports:
      - "5003:80"
      - "5004:443"

排查与修复步骤 #

1. 强制应用监听容器内端口 #

.NET默认在容器中可能监听localhost:5000/5001而非80/443，需修改配置让应用监听容器内的公开端口：

方案一：修改Program.cs配置

在每个项目的Program.cs中添加Kestrel端口配置：

var builder = WebApplication.CreateBuilder(args);

// 配置监听任意IP的80和443端口
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(80);
    options.ListenAnyIP(443, o => o.UseHttps());
});

// 其他业务配置...

var app = builder.Build();
// ...
app.Run();

方案二：通过环境变量配置

在docker-compose.yml中为每个服务添加环境变量，指定监听地址：

services:
  demoapptwo:
    # 现有配置保留
    environment:
      - ASPNETCORE_URLS=http://+:80;https://+:443
  demoapp:
    # 现有配置保留
    environment:
      - ASPNETCORE_URLS=http://+:80;https://+:443

2. 解决HTTPS证书问题 #

访问HTTPS端口（5002/5004）时，容器需要有效的证书：

• 开发环境：挂载本地.NET开发证书到容器（以Windows为例）
  在docker-compose.yml中添加卷挂载和证书配置：

  services:
    demoapptwo:
      # 现有配置保留
      volumes:
        - ${USERPROFILE}\.aspnet\https:/https/
      environment:
        - ASPNETCORE_Kestrel__Certificates__Default__Password=你的证书密码
        - ASPNETCORE_Kestrel__Certificates__Default__Path=/https/DemoAppTwo.pfx
    # DemoApp服务做相同配置，替换证书文件名
  

• 生产环境：使用自定义SSL证书或Let's Encrypt证书。

3. 验证容器运行状态 #

执行以下命令排查容器是否正常启动：

# 查看所有容器状态
docker-compose ps

# 查看应用启动日志，排查错误
docker-compose logs demoapptwo
docker-compose logs demoapp

如果容器未启动，根据日志修复构建或依赖问题。

4. 检查端口占用与网络连通性 #

• 确认宿主机端口未被占用：

  # Windows
  netstat -ano | findstr :5001
  # Linux/macOS
  lsof -i :5001
  

• 直接访问容器内部IP验证服务是否正常：
  先获取容器IP：

  docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' demoapptwo
  

  然后访问http://<容器IP>:80，如果能访问说明端口映射存在问题；不能访问则是应用本身未正常启动。

5. 确认Docker网络配置 #

默认bridge网络支持端口映射，无需额外配置。如果使用自定义网络，需确认网络模式允许宿主机访问容器。

内容的提问来源于stack exchange，提问作者Gage