Docker容器暴露端口无法访问？问题排查与解决方法咨询

Let's work through why you're having trouble accessing your xyz container's exposed port, and get it fixed step by step.

First: Verify the service inside the container is running and listening on port 5000 #

The most common root cause here is that even though you mapped the port in Docker, the actual service inside the container isn't active or isn't bound to port 5000.

• Run this command to check active ports inside the container:

  docker exec xyz netstat -tulpn | grep 5000
  

  If you get no output, nothing is listening on port 5000 in the container. You'll need to start the intended service, or fix its configuration to use port 5000.

• Test connectivity directly from inside the container to eliminate external factors:

  docker exec xyz curl localhost:5000
  

  If this fails, the problem is definitely with the service inside the container—not Docker's port mapping.

Second: Check if the service is listening on 0.0.0.0 (not just 127.0.0.1) #

If your service only binds to 127.0.0.1:5000, it will only be accessible from within the container itself. Requests from your host (using either localhost:5000 or the container's IP 172.17.0.3:5000) won't reach it.

• From the netstat output, look for the "Local Address" column. It should show 0.0.0.0:5000 (or :::5000 for IPv6) instead of 127.0.0.1:5000.
• Fix this by updating your service's configuration to bind to 0.0.0.0. For example, a Flask app would use app.run(host='0.0.0.0', port=5000) instead of the default app.run().

Third: Diagnose the "connection reset by peer" error for localhost:5000 #

This error means your host is successfully reaching the container via the port map, but the connection is being closed immediately by the service inside. This almost always ties back to:

• The service not running properly, or

• The service crashing when it receives a request (check container logs for clues).

• Check container logs to see if the service is throwing errors:

  docker logs xyz
  

Quick Additional Checks #

• Host Firewall: While localhost access is rarely blocked, double-check your host's firewall rules (e.g., ufw status on Ubuntu, firewall-cmd --list-all on RHEL/CentOS) if you need to access the port from other machines on your network.
• Port Mapping Validation: Confirm your port mapping was set correctly when starting the container. You can cross-verify with:

  docker inspect xyz | grep -A5 -B5 "5000"
  

Once you fix the service inside the container to listen on the correct port and address, both localhost:5000 and the container's IP 172.17.0.3:5000 should work as expected.

内容的提问来源于stack exchange，提问作者Aquarius_Girl