使用Terraform部署Lightstreamer至Azure容器实例遇端口异常

问题描述 #

将Lightstreamer Docker实例部署到Azure容器组（ACI）后，配置6661/6662端口暴露以适配adapters.xml的Proxy适配器需求，但启动时出现连接失败错误。本地运行完全正常，仅ACI环境下触发该问题。

相关配置 #

adapters.xml 配置 #

<?xml version="1.0"?>

<adapters_conf id="SHOWCASE">

  <metadata_provider>
    <adapter_class>com.lightstreamer.adapters.metadata.LiteralBasedProvider</adapter_class>
  </metadata_provider>

  <data_provider>
    <adapter_class>ROBUST_PROXY_FOR_REMOTE_ADAPTER</adapter_class>
    <classloader>log-enabled</classloader>
    <param name="request_reply_port">6661</param>
    <param name="notify_port">6662</param>
  </data_provider>

</adapters_conf>

Dockerfile 内容 #

FROM lightstreamer:7.0

COPY ["adapters.xml", "/lightstreamer/adapters/proxy/"]

Terraform Azure容器组配置 #

resource "azurerm_container_group" "lightstreamer" {
     name = "${var.organization}-${var.project}-lightstreamer"
     depends_on = [
       azurerm_container_registry.container_registry
     ]
     location = var.location
     resource_group_name = azurerm_resource_group.resource_group.name
     ip_address_type = "Public"
     os_type = "Linux"
     container {
       name = "lightstreamer-web"
       image = "${azurerm_container_registry.container_registry.login_server}/lightstreamer:${var.image_tag}"
       cpu = "0.5"
       memory = "1.5"
       ports {
         port = 8080
         protocol = "TCP"
       }
       ports {
         port = 6661
         protocol = "TCP"
       }
       ports {
         port = 6662
         protocol = "TCP"
       }
     }
     exposed_port = [
       {
           port = 8080
           protocol = "TCP"
       },
       {
           port = 6661
           protocol = "TCP"
       },
       {
           port = 6662
           protocol = "TCP"
       }
     ]
     image_registry_credential {
         server = "${azurerm_container_registry.container_registry.login_server}"
         username = "${azurerm_container_registry.container_registry.admin_username}"
         password = "${azurerm_container_registry.container_registry.admin_password}"
     }    
     dns_name_label = "${var.organization}-${var.project}-lightstreamer"
 }

错误日志 #

09.Aug.22 17:48:41,358 < INFO> Request sender 'SHOWCASE.DEFAULT' starting...
09.Aug.22 17:48:41,372 < INFO> Reply receiver 'SHOWCASE.DEFAULT' starting...
09.Aug.22 17:48:44,232 < INFO> Request sender 'SHOWCASE.DEFAULT' stopped
09.Aug.22 17:48:44,235 <ERROR> Exception caught while trying to initialize the Remote Server
com.lightstreamer.adapters.proxy.request_reply.DisconnectedException: Connection closed while waiting for an answer to request 10000018283b91608
    at com.lightstreamer.adapters.proxy.request_reply.RequestSender.quit(RequestSender.java:175)
    at com.lightstreamer.adapters.proxy.BaseRemoteProvider.stop(BaseRemoteProvider.java:100)
    at com.lightstreamer.adapters.proxy.data.RobustNetworkedDataProvider$RecoverableNDP.onInnerException(RobustNetworkedDataProvider.java:390)
    at com.lightstreamer.adapters.proxy.data.RobustNetworkedDataProvider$RecoverableNDP.access$400(RobustNetworkedDataProvider.java:258)
    at com.lightstreamer.adapters.proxy.data.RobustNetworkedDataProvider$RecoverableNDP$1.onException(RobustNetworkedDataProvider.java:375)
    at com.lightstreamer.adapters.proxy.request_reply.NotifyReceiver.run(NotifyReceiver.java:110)
09.Aug.22 17:48:44,236 <ERROR> Exception from the inner Proxy Data Adapter: com.lightstreamer.interfaces.data.DataProviderException: Connection closed while waiting for an answer to request 10000018283b91608
09.Aug.22 17:48:44,236 <ERROR> Got fatal error from the inner Proxy Data Adapter
com.lightstreamer.adapters.proxy.RemotingException: Unexpected end of reply stream reached
    at com.lightstreamer.adapters.proxy.request_reply.NotifyReceiver.run(NotifyReceiver.java:110)
Caused by: java.io.EOFException: null
    ... 1 common frames omitted
09.Aug.22 17:48:44,236 < INFO> Reply receiver 'SHOWCASE.DEFAULT' stopped
09.Aug.22 17:48:44,237 <ERROR> Inner Proxy Data Adapter initialization failure; no Inner Proxy will be used

解决方案 #

1. 修正远程适配器地址配置（核心问题） #

ROBUST_PROXY_FOR_REMOTE_ADAPTER默认会连接localhost的6661/6662端口。本地运行时，远程适配器可能和Lightstreamer在同一机器，所以能连通；但ACI容器内只有Lightstreamer服务，localhost指向容器自身，自然找不到远程适配器。

在adapters.xml中添加remote_host参数，指定远程适配器的实际地址：

<data_provider>
  <adapter_class>ROBUST_PROXY_FOR_REMOTE_ADAPTER</adapter_class>
  <classloader>log-enabled</classloader>
  <param name="request_reply_port">6661</param>
  <param name="notify_port">6662</param>
  <param name="remote_host">远程适配器的私有IP/公网IP/域名</param> <!-- 新增该行 -->
</data_provider>

如果远程适配器和ACI在同一Azure虚拟网络，优先使用私有IP，避免公网延迟和安全风险。

2. 清理Terraform中重复的端口配置 #

Terraform配置里同时设置了container.ports和顶层的exposed_port，这两个字段功能重复，可能导致端口绑定异常。删除顶层的exposed_port块，保留container.ports即可：

resource "azurerm_container_group" "lightstreamer" {
     name = "${var.organization}-${var.project}-lightstreamer"
     depends_on = [
       azurerm_container_registry.container_registry
     ]
     location = var.location
     resource_group_name = azurerm_resource_group.resource_group.name
     ip_address_type = "Public"
     os_type = "Linux"
     container {
       name = "lightstreamer-web"
       image = "${azurerm_container_registry.container_registry.login_server}/lightstreamer:${var.image_tag}"
       cpu = "0.5"
       memory = "1.5"
       ports {
         port = 8080
         protocol = "TCP"
       }
       ports {
         port = 6661
         protocol = "TCP"
       }
       ports {
         port = 6662
         protocol = "TCP"
       }
     }
     image_registry_credential {
         server = "${azurerm_container_registry.container_registry.login_server}"
         username = "${azurerm_container_registry.container_registry.admin_username}"
         password = "${azurerm_container_registry.container_registry.admin_password}"
     }    
     dns_name_label = "${var.organization}-${var.project}-lightstreamer"
 }

3. 验证网络连通性 #

进入ACI容器内部，用nc或telnet测试远程适配器的端口是否可达：

# 进入ACI容器
az container exec --resource-group <你的资源组名> --name <容器组名> --container-name lightstreamer-web --exec-command "/bin/bash"

# 测试端口连通性
nc -zv <远程适配器地址> 6661
nc -zv <远程适配器地址> 6662

如果测试失败，排查以下网络问题：

• 远程适配器所在服务器的防火墙是否放行6661/6662端口的入站流量
• Azure网络安全组（NSG）是否允许ACI的IP访问远程适配器的端口
• 远程适配器是否正常运行并监听6661/6662端口

4. 增加连接超时参数 #

在adapters.xml中添加超时配置，避免因Azure网络延迟导致连接中断：

<param name="connect_timeout">10000</param> <!-- 10秒连接超时 -->
<param name="reply_timeout">30000</param> <!-- 30秒回复超时 -->

内容的提问来源于stack exchange，提问作者DSpirit