开启VPN后Testcontainer无法连接localhost:49198的Ryuk

在Java/Maven项目中使用Testcontainers执行单元与集成测试，原本运行正常，但开启工作VPN后出现错误：Can not connect to Ryuk at localhost:49198，完整日志如下：

Connected to the target VM, address: '127.0.0.1:50813', transport: 'socket'
2022-10-03 18:01:49.728  INFO   --- [           main] o.t.d.DockerClientProviderStrategy       : Loaded org.testcontainers.dockerclient.UnixSocketClientProviderStrategy from ~/.testcontainers.properties, will try it first
2022-10-03 18:01:50.280  INFO   --- [           main] o.t.d.DockerClientProviderStrategy       : Found Docker environment with local Unix socket (unix:///var/run/docker.sock)
2022-10-03 18:01:50.282  INFO   --- [           main] org.testcontainers.DockerClientFactory   : Docker host IP address is localhost
2022-10-03 18:01:50.308  INFO   --- [           main] org.testcontainers.DockerClientFactory   : Connected to docker: 
  Server Version: 20.10.16
  API Version: 1.41
  Operating System: Ubuntu 20.04.3 LTS
  Total Memory: 15716 MB
2022-10-03 18:01:50.311  INFO   --- [           main] o.t.utility.ImageNameSubstitutor         : Image name substitution will be performed by: DefaultImageNameSubstitutor (composite of 'ConfigurationFileImageNameSubstitutor' and 'PrefixingImageNameSubstitutor')
2022-10-03 18:01:50.926  WARN   --- [containers-ryuk] o.testcontainers.utility.ResourceReaper  : Can not connect to Ryuk at localhost:49198

java.net.SocketException: Connection reset
    at java.base/sun.nio.ch.NioSocketImpl.implRead(NioSocketImpl.java:323)
    at java.base/sun.nio.ch.NioSocketImpl.read(NioSocketImpl.java:350)
    at java.base/sun.nio.ch.NioSocketImpl$1.read(NioSocketImpl.java:803)
    at java.base/java.net.Socket$SocketInputStream.read(Socket.java:966)
    at java.base/sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:270)
    at java.base/sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:313)
    at java.base/sun.nio.cs.StreamDecoder.read(StreamDecoder.java:188)
    at java.base/java.io.InputStreamReader.read(InputStreamReader.java:177)
    at java.base/java.io.BufferedReader.fill(BufferedReader.java:162)
    at java.base/java.io.BufferedReader.readLine(BufferedReader.java:329)
    at java.base/java.io.BufferedReader.readLine(BufferedReader.java:396)
    at org.testcontainers.utility.ResourceReaper$FilterRegistry.waitForAcknowledgment(ResourceReaper.java:489)
    at org.testcontainers.utility.ResourceReaper$FilterRegistry.register(ResourceReaper.java:485)
    at org.testcontainers.utility.ResourceReaper.lambda$null$1(ResourceReaper.java:203)
    at org.rnorth.ducttape.ratelimits.RateLimiter.doWhenReady(RateLimiter.java:27)
    at org.testcontainers.utility.ResourceReaper.lambda$start$2(ResourceReaper.java:185)
    at java.base/java.lang.Thread.run(Thread.java:833)

已尝试设置TESTCONTAINERS_HOST_OVERRIDE=localhost但无效，不确定该变量的正确设置位置，且开启/关闭VPN时未发现Testcontainers相关Docker容器有差异，求解决思路。

1. 确认TESTCONTAINERS_HOST_OVERRIDE的正确设置方式 #

这个环境变量有多种生效方式，任选其一即可：

• 终端临时设置：执行测试前在终端导出变量

  export TESTCONTAINERS_HOST_OVERRIDE=localhost
  mvn test
  

• Maven配置：在pom.xml的maven-surefire-plugin中添加环境变量

  <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-surefire-plugin</artifactId>
      <configuration>
          <environmentVariables>
              <TESTCONTAINERS_HOST_OVERRIDE>localhost</TESTCONTAINERS_HOST_OVERRIDE>
          </environmentVariables>
      </configuration>
  </plugin>
  

• IDE运行配置：在IntelliJ IDEA等IDE的测试运行配置中，添加环境变量TESTCONTAINERS_HOST_OVERRIDE=localhost
• 全局配置文件：在用户目录下的~/.testcontainers.properties中添加一行

  testcontainers.host.override=localhost
  

2. 排查VPN的路由与防火墙干扰 #

VPN可能修改本地路由或拦截本地端口连接：

• 执行route -n查看本地路由表，确认127.0.0.1的路由未被VPN覆盖
• 检查VPN客户端是否有“强制所有流量走VPN”“拦截本地流量”类选项，尝试关闭后重试
• 临时关闭VPN的防火墙规则（如iptables），测试连接是否恢复

3. 调整Ryuk的连接配置 #

• 延长Ryuk连接超时时间，避免VPN延迟导致连接失败：

  export TESTCONTAINERS_RYUK_CONNECTION_TIMEOUT=10000
  

• 尝试将TESTCONTAINERS_HOST_OVERRIDE设置为主机的局域网IP（如192.168.x.x），而非localhost，绕开VPN对回环地址的拦截

4. 临时禁用Ryuk（应急方案） #

若上述方法均无效，可临时关闭Ryuk资源回收器（注意：可能导致Docker容器残留，需手动清理）：

• 设置环境变量TESTCONTAINERS_RYUK_DISABLED=true，可通过终端、Maven配置或IDE运行配置添加

5. 检查Docker端口映射 #

• 执行docker ps查看Ryuk容器的端口映射，确认宿主机端口（如49198）绑定到0.0.0.0而非仅VPN网卡
• 若端口仅绑定到VPN网卡，修改Docker配置，确保容器端口默认绑定到所有网卡

内容的提问来源于stack exchange，提问作者Quentin Lerebours