ECS部署时Nginx无法解析容器名称，本地运行正常

我正在部署一套ECS配置，但Nginx的frontend容器启动失败，报错信息如下：

nginx: [emerg] host not found in upstream “backend”

该配置在本地运行完全正常，但ECS环境下无法解析Docker容器名称。部署细节：

• 使用ecs-cli部署
• 启动类型：EC2
• 网络模式：bridge

部署命令 #

ecs-cli compose \
--cluster mycluster \
--file docker-compose.yml \
--ecs-params ecs-params.yml service up \
--deployment-min-healthy-percent=50 --force-deployment \
--target-groups targetGroupArn=<load-balancer>,containerName=frontend,containerPort=80 \
--health-check-grace-period 60 \
--role <my-role> \
--timeout 30

ecs-params.yml 内容 #

task_definition:
  task_role_arn: <my-arn>
  task_execution_role: <my-exec-role>
  services:
    backend:
      essential: true
      mem_reservation: 1024m
    frontend:
      essential: true
      mem_reservation: 1024m

nginx.conf 内容 #

events {
  worker_connections 1024;
}

http {
  server_tokens off;
  upstream backend_server {
        server backend:8001;
    }

  server {
    listen 80;
    listen [::]:80;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        try_files $uri $uri/ /index.html;
    }

    location /api {
      proxy_pass      http://backend_server/api;
    }

  }
}

docker-compose.yml 内容 #

version: '3'

services:
  backend:
    image: <backend-image>
    ports:
      - 8001:8001

  frontend:
    image: <frontend-image, 本地构建时包含上述nginx配置>
    ports:
      - 80:80

任务定义（Task definition） #

{
  "ipcMode": null,
  "executionRoleArn": <exec-role>,
  "containerDefinitions": [
    {
      "dnsSearchDomains": [],
      "environmentFiles": null,
      "logConfiguration": {
        "logDriver": "awslogs",
        "secretOptions": null,
        "options": { <log-options>
        }
      },
      "entryPoint": [],
      "portMappings": [
        {
          "hostPort": 8001,
          "protocol": "tcp",
          "containerPort": 8001
        }
      ],
      "command": [],
      "linuxParameters": {
        "capabilities": {
          "add": null,
          "drop": null
        },
        "sharedMemorySize": null,
        "tmpfs": null,
        "devices": [],
        "maxSwap": null,
        "swappiness": null,
        "initProcessEnabled": null
      },
      "cpu": 0,
      "environment": [
      ],
      "resourceRequirements": null,
      "ulimits": null,
      "dnsServers": [],
      "mountPoints": [],
      "workingDirectory": null,
      "secrets": null,
      "dockerSecurityOptions": [],
      "memory": null,
      "memoryReservation": 1024,
      "volumesFrom": [],
      "stopTimeout": null,
      "image": <backend-image>,
      "startTimeout": null,
      "firelensConfiguration": null,
      "dependsOn": null,
      "disableNetworking": null,
      "interactive": null,
      "healthCheck": null,
      "essential": true,
      "links": [],
      "hostname": null,
      "extraHosts": [],
      "pseudoTerminal": false,
      "user": null,
      "readonlyRootFilesystem": false,
      "dockerLabels": null,
      "systemControls": null,
      "privileged": false,
      "name": "backend"
    },
    {
      "dnsSearchDomains": [],
      "environmentFiles": null,
      "logConfiguration": {
        "logDriver": "awslogs",
        "secretOptions": null,
        "options": { <log-options>
        }
      },
      "entryPoint": [],
      "portMappings": [
        {
          "hostPort": 80,
          "protocol": "tcp",
          "containerPort": 80
        }
      ],
      "command": [],
      "linuxParameters": {
        "capabilities": {
          "add": null,
          "drop": null
        },
        "sharedMemorySize": null,
        "tmpfs": null,
        "devices": [],
        "maxSwap": null,
        "swappiness": null,
        "initProcessEnabled": null
      },
      "cpu": 0,
      "environment": [],
      "resourceRequirements": null,
      "ulimits": null,
      "dnsServers": [],
      "mountPoints": [],
      "workingDirectory": null,
      "secrets": null,
      "dockerSecurityOptions": [],
      "memory": null,
      "memoryReservation": 1024,
      "volumesFrom": [],
      "stopTimeout": null,
      "image": <frontend-image>,
      "startTimeout": null,
      "firelensConfiguration": null,
      "dependsOn": null,
      "disableNetworking": null,
      "interactive": null,
      "healthCheck": null,
      "essential": true,
      "links": [],
      "hostname": null,
      "extraHosts": [],
      "pseudoTerminal": false,
      "user": null,
      "readonlyRootFilesystem": false,
      "dockerLabels": null,
      "systemControls": null,
      "privileged": false,
      "name": "frontend"
    }
  ],
  "placementConstraints": [],
  "memory": null,
  "taskRoleArn": <task-role-arn>,
  "compatibilities": [
    "EXTERNAL",
    "EC2"
  ],
  "taskDefinitionArn": <definition>,
  "family": "<my-family>",
  "requiresAttributes": [
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.execution-role-awslogs"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.ecr-auth"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.17"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.docker-remote-api.1.21"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "com.amazonaws.ecs.capability.task-iam-role"
    },
    {
      "targetId": null,
      "targetType": null,
      "value": null,
      "name": "ecs.capability.execution-role-ecr-pull"
    }
  ],
  "pidMode": null,
  "requiresCompatibilities": [],
  "networkMode": null,
  "runtimePlatform": null,
  "cpu": null,
  "revision": 75,
  "status": "ACTIVE",
  "inferenceAccelerators": null,
  "proxyConfiguration": null,
  "volumes": []
}

1. 修复Nginx启动时的DNS解析问题 #

Nginx启动时会强制解析upstream中的主机名，如果此时backend容器还未启动或DNS未就绪，就会报错。修改nginx.conf，使用变量延迟解析并指定Docker内置DNS：

events {
  worker_connections 1024;
}

http {
  server_tokens off;
  resolver 127.0.0.11 valid=30s; # Docker内置DNS服务器

  # 使用变量避免启动时解析upstream
  set $backend_host backend:8001;

  server {
    listen 80;
    listen [::]:80;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
        try_files $uri $uri/ /index.html;
    }

    location /api {
      proxy_pass      http://$backend_host/api;
    }
  }
}

这样Nginx启动时不会验证backend的存在，仅在实际请求时才解析主机名，容错性更强。

2. 配置容器启动依赖 #

在docker-compose.yml中给frontend添加依赖，确保backend容器先启动就绪：

version: '3'

services:
  backend:
    image: <backend-image>
    ports:
      - 8001:8001

  frontend:
    image: <frontend-image, 本地构建时包含上述nginx配置>
    ports:
      - 80:80
    depends_on:
      - backend

重新部署后，ECS会保证backend容器先启动，再启动frontend，减少因启动顺序导致的解析失败。

3. 改用ECS awsvpc网络模式（推荐） #

awsvpc模式下，同一个任务内的所有容器共享同一个网络命名空间，可直接通过localhost访问彼此端口，且容器名解析更可靠。修改ecs-params.yml添加网络模式配置：

task_definition:
  task_role_arn: <my-arn>
  task_execution_role: <my-exec-role>
  network_mode: awsvpc
  services:
    backend:
      essential: true
      mem_reservation: 1024m
    frontend:
      essential: true
      mem_reservation: 1024m

同时需要在部署命令中指定子网和安全组，或者在ECS集群中配置默认网络参数。

4. 临时解决方案：添加容器链接（不推荐） #

在任务定义的frontend容器中添加links配置，让Docker在/etc/hosts中写入backend的IP：

{
  // ... frontend容器配置
  "links": ["backend"]
}

该方法属于Docker旧特性，已被dependsOn替代，仅作临时修复使用。

内容的提问来源于stack exchange，提问作者SoftwareThings