在Google Cloud部署Docker+Nginx+FastAPI遇Upstream超时错误

尝试通过SSH在Google Cloud上部署FastAPI应用，采用Docker+Nginx反向代理架构。本地SSH终端内curl localhost可正常访问，该配置在普通VPS上也能运行，但在Google Cloud VM上外部访问example.com时出现504 Gateway Time-out，Nginx日志提示：

*3 upstream timed out (110: Connection timed out) while connecting to upstream...

已开放Google Cloud防火墙对应端口并配置VM网络参数，需仅通过docker-compose工具解决该问题。

nginx.conf 配置 #

access_log                  /var/log/nginx/app.log;
error_log                   /var/log/nginx/app.log;

proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 128;

proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
proxy_set_header X-Original-URI $request_uri;
proxy_set_header Proxy "";

upstream app_server {
  server example.com:8000;
}

server {
  server_name               example.com;
  listen                    80;
  return 301 https://$host$request_uri;
}

server {
  listen                  443 ssl;
  server_name             example.com;
  ssl_certificate         /root/ssl/cert.pem;
  ssl_certificate_key     /root/ssl/key.pem;
  location / {
    proxy_pass "http://app_server";
  }
}

docker-compose.yml 配置 #

version: '3.8'

services:
  reverse-proxy:
    image: jwilder/nginx-proxy
    container_name: reverse-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx:/etc/nginx/conf.d
      - ./ssl/cert1.pem:/root/ssl/cert.pem
      - ./ssl/privkey1.pem:/root/ssl/key.pem
      - ./ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem
    networks:
      - reverse-proxy

  web:
    environment: [.env]
    build: ./project
    ports:
      - 8000:8000
    command: gunicorn main:app -k uvicorn.workers.UvicornWorker -w 2 -b 0.0.0.0:8000
    volumes:
      - ./project:/usr/src/app
    networks:
      - reverse-proxy
      - back

networks:
  reverse-proxy:
    external:
      name: reverse-proxy
  back:
      driver: bridge

1. 修改Nginx upstream地址 #

问题核心是Nginx容器通过公网域名example.com:8000访问FastAPI服务，在Google Cloud环境下可能触发网络限制。Docker Compose会自动为同一网络内的服务分配DNS解析，直接使用服务名即可实现容器间内部通信。

修改nginx.conf中的upstream块：

upstream app_server {
  server web:8000; # 将example.com替换为FastAPI服务名web
}

2. 优化Docker Compose网络与端口配置 #

• 移除web服务的主机端口映射：Nginx与FastAPI容器在同一reverse-proxy网络内，无需暴露主机端口，减少安全风险。
• 调整reverse-proxy网络配置：若未提前创建外部网络，删除external配置，让Docker Compose自动创建内部网络，避免网络适配问题。

修改后的docker-compose.yml关键部分：

services:
  web:
    # 移除主机端口映射
    # ports:
    #   - 8000:8000
    ...

networks:
  reverse-proxy:
    # 删除外部网络配置，由Compose自动创建
    # external:
    #   name: reverse-proxy
  back:
      driver: bridge

3. 重启服务 #

执行命令重启容器，使配置生效：

docker-compose down
docker-compose up -d

内容的提问来源于stack exchange，提问作者Egor Richman