AWS ECS部署Growthbook与Nginx Sidecar容器失败排查求助

我通过Docker Compose（ECS上下文）将Growthbook（A/B测试工具）与负责SSL/TLS终止的Nginx反向代理部署到AWS ECS。执行docker compose --project-name growthbook up后，网络负载均衡、目标组、ECS任务定义等资源已创建，但ECS服务创建失败并触发资源删除，报错原因是Nginx sidecar容器退出。

原配置信息 #

docker-compose.yml #

version: "3"
x-aws-vpc: "vpc-*************"
services:
  growthbook:
    image: "growthbook/growthbook:latest"
    ports:
      - 3000:3000
      - 3100:3100
    environment:
      - MONGODB_URI=<mongo_db_connection_string>
      - JWT_SECRET=<jwt_secret>
    volumes:
      - uploads:/usr/local/src/app/packages/back-end/uploads
  nginx-tls-sidecar:
    image: <nginx_sidecar_image>
    ports:
      - 443:443
    links:
      - growthbook
volumes:
  uploads:

Nginx Dockerfile #

FROM nginx
COPY nginx.conf /etc/nginx/nginx.conf
COPY ssl.key /etc/nginx/ssl.key
COPY ssl.crt /etc/nginx/ssl.crt

原nginx.conf #

# nginx Configuration File
user nginx;
worker_processes auto;

events {
  worker_connections 1024;
}

pid        /var/run/nginx.pid;

http {
    server {
        listen [::]:443 ssl;
        listen 443 ssl;

        server_name localhost;

        ssl_protocols              TLSv1.2;
        ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
        ssl_prefer_server_ciphers  on;

        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout  24h;

        keepalive_timeout 300;
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';

        ssl_certificate      /etc/nginx/ssl.crt;
        ssl_certificate_key  /etc/nginx/ssl.key;

        location / {
            proxy_pass http://localhost:3000;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
        }

        location / {
            proxy_pass http://localhost:3100;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
        }
    }
}

核心问题排查 #

1. Nginx路由规则冲突 #

配置中有两个完全相同的location /块，Nginx启动时会因路由规则重复直接报错退出，这是容器退出的首要原因。Growthbook的3000端口对应前端UI，3100端口对应API接口，需要用不同的路径区分。

2. 容器间访问地址错误 #

ECS同一任务内的容器属于同一网络，不能用localhost访问Growthbook，需使用docker-compose中定义的服务名growthbook作为访问地址。

3. 端口暴露冗余 #

Growthbook的3000/3100端口无需暴露到ECS实例，内部容器可通过服务名直接访问，暴露端口会增加安全风险并触发不必要的ECS端口映射配置。

4. 启动依赖缺失 #

Nginx启动时Growthbook可能未就绪，导致Nginx无法连接后端触发退出，需配置容器启动依赖，确保Growthbook就绪后再启动Nginx。

修正后的配置 #

1. 调整后的docker-compose.yml #

version: "3"
x-aws-vpc: "vpc-*************"
services:
  growthbook:
    image: "growthbook/growthbook:latest"
    environment:
      - MONGODB_URI=<mongo_db_connection_string>
      - JWT_SECRET=<jwt_secret>
    volumes:
      - uploads:/usr/local/src/app/packages/back-end/uploads
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000"]
      interval: 10s
      timeout: 5s
      retries: 5
  nginx-tls-sidecar:
    image: <nginx_sidecar_image>
    ports:
      - 443:443
    depends_on:
      growthbook:
        condition: service_healthy
    links:
      - growthbook
volumes:
  uploads:

2. 修正后的nginx.conf #

# nginx Configuration File
user nginx;
worker_processes auto;

events {
  worker_connections 1024;
}

pid        /var/run/nginx.pid;

http {
    server {
        listen [::]:443 ssl;
        listen 443 ssl;

        server_name localhost;

        ssl_protocols              TLSv1.2 TLSv1.3;
        ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
        ssl_prefer_server_ciphers  on;

        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout  24h;

        keepalive_timeout 300;
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';

        ssl_certificate      /etc/nginx/ssl.crt;
        ssl_certificate_key  /etc/nginx/ssl.key;

        # 代理Growthbook前端UI（3000端口）
        location / {
            proxy_pass http://growthbook:3000;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
        }

        # 代理Growthbook API接口（3100端口）
        location /api {
            proxy_pass http://growthbook:3100/api;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
        }
    }

    # 80端口跳转至HTTPS
    server {
        listen 80;
        listen [::]:80;
        return 301 https://$host$request_uri;
    }
}

验证步骤 #

• 本地测试Nginx镜像：执行docker run -d --name nginx-test <nginx_sidecar_image>，通过docker logs nginx-test检查启动日志，确认无配置错误。
• 本地docker-compose测试：在本地环境启动服务，验证Nginx是否能正确代理Growthbook的前端和API接口，确保配置正常后再部署到ECS。

内容的提问来源于stack exchange，提问作者Sree Teja