AWS ECS容器中Python requests无代理时遇SSLZeroReturnError求助

在AWS ECS的Docker容器中使用Python的requests库时，遇到以下异常：

• 不使用代理发起请求时，触发错误：

HTTPSConnectionPool(host='www.foo.com', port=443): Max retries exceeded with url: /foo/JMD87FHD6GA068ZD9SS (Caused by SSLError(SSLZeroReturnError(6, 'TLS/SSL connection has been closed (EOF) (_ssl.c:997)')))

• 使用住宅代理发起请求时无此错误；EC2、Fargate两种任务运行方式下结果一致，该现象持续存在。现有旧帖多指向过时Python库，但当前环境依赖版本不算老旧，需明确排查方向。

环境配置信息 #

Dockerfile片段 #

FROM python:3.10-alpine

# machine requirements
RUN apk --no-cache update
RUN apk --no-cache add python3-dev gcc libc-dev libffi-dev bash

# project requirements
COPY ./requirements ./requirements
RUN pip install --no-cache-dir -r requirements/pip-tools.txt
RUN pip-sync requirements/prod.txt --pip-args '--no-cache-dir'

requirements/prod.txt内容 #

#
# This file is autogenerated by pip-compile with python 3.10
# To update, run:
#
#    pip-compile requirements/prod.in
#
anyio==3.6.1
    # via
    #   starlette
    #   watchfiles
bcrypt==4.0.0
    # via passlib
beautifulsoup4==4.10.0
    # via -r requirements/base.in
certifi==2022.6.15
    # via
    #   elasticsearch
    #   requests
cffi==1.15.0
    # via cryptography
charset-normalizer==2.1.1
    # via requests
click==8.1.3
    # via uvicorn
cloudscraper==1.2.66
    # via -r requirements/base.in
cryptography==37.0.2
    # via
    #   pymysql
    #   python-jose
dependency-injector==4.39.1
    # via -r requirements/base.in
dnspython==2.2.1
    # via email-validator
ecdsa==0.18.0
    # via python-jose
elasticsearch==7.13.4
    # via -r requirements/base.in
email-validator==1.3.0
    # via fastapi
fastapi[all]==0.85.0
    # via -r requirements/base.in
h11==0.14.0
    # via uvicorn
httptools==0.5.0
    # via uvicorn
idna==3.3
    # via
    #   anyio
    #   email-validator
    #   requests
itsdangerous==2.1.2
    # via fastapi
jinja2==3.1.2
    # via fastapi
markupsafe==2.1.1
    # via jinja2
orjson==3.8.0
    # via fastapi
passlib[bcrypt]==1.7.4
    # via -r requirements/base.in
pyasn1==0.4.8
    # via
    #   python-jose
    #   rsa
pycparser==2.21
    # via cffi
pydantic==1.10.2
    # via fastapi
pymysql[rsa]==1.0.2
    # via -r requirements/base.in
pyparsing==3.0.9
    # via cloudscraper
python-dotenv==0.21.0
    # via uvicorn
python-jose[cryptography]==3.3.0
    # via -r requirements/base.in
python-multipart==0.0.5
    # via fastapi
pyyaml==6.0
    # via
    #   fastapi
    #   uvicorn
requests==2.28.1
    # via
    #   cloudscraper
    #   fastapi
    #   requests-toolbelt
requests-toolbelt==0.9.1
    # via cloudscraper
rsa==4.9
    # via python-jose
six==1.16.0
    # via
    #   dependency-injector
    #   ecdsa
    #   python-multipart
    #   user-agent
sniffio==1.3.0
    # via anyio
soupsieve==2.3.2.post1
    # via beautifulsoup4
starlette==0.20.4
    # via fastapi
tqdm==4.63.0
    # via -r requirements/base.in
typing-extensions==4.3.0
    # via pydantic
ujson==5.5.0
    # via fastapi
urllib3==1.26.12
    # via
    #   elasticsearch
    #   requests
user-agent==0.1.10
    # via -r requirements/base.in
uvicorn[standard]==0.18.3
    # via
    #   -r requirements/base.in
    #   fastapi
uvloop==0.17.0
    # via uvicorn
watchfiles==0.17.0
    # via uvicorn
websockets==10.3
    # via uvicorn

排查方向指引 #

• 目标站点IP封禁/流量识别：目标站点可能对AWS ECS的出站IP段做了限制，代理请求时IP不同所以正常。可以用ECS任务所在VPC的弹性公网IP在本地发起请求，验证是否触发相同错误。
• TLS版本/加密套件兼容性：检查目标站点支持的TLS版本和加密套件，对比容器中OpenSSL的默认配置。尝试在requests请求中指定TLS版本（如requests.get(url, tls_version=ssl.PROTOCOL_TLSv1_2)）或调整加密套件，测试是否解决问题。
• Alpine系统CA证书问题：Alpine默认可能未安装完整的ca-certificates包，导致证书验证异常。在Dockerfile中添加RUN apk --no-cache add ca-certificates，更新系统根证书后重试。
• 连接复用/超时设置：Requests默认复用连接，目标站点可能对长连接有限制。尝试禁用连接复用（session = requests.Session(); session.adapters['https://'].pool_connections = 1），或调整超时参数（如timeout=(5, 15)），看是否能避免EOF错误。
• Cloudscraper干扰排查：项目依赖cloudscraper，它会修改requests请求逻辑。尝试直接用原生requests发起请求，排除cloudscraper的影响。
• AWS网络层限制检查：检查VPC安全组、NACL是否有出站流量限制，是否启用了VPC端点、防火墙规则拦截特定TLS流量。同时确认ECS任务网络模式下的DNS解析是否正常，目标域名解析的IP是否正确。

内容的提问来源于stack exchange，提问作者praddc