如何在Docker Compose中让web服务通过127.0.0.1:5432访问内部db服务？

Absolutely, this is totally doable! Here are a few practical ways to get your web service connecting to the db via 127.0.0.1:5432 instead of the postgres:5432 hostname:

1. Use Socat for Local Port Forwarding #

Socat is a handy tool for routing network traffic. We can tweak your docker-compose.yml to install Socat in the web container, set up a forward from 127.0.0.1:5432 to db:5432, then start Tomcat as usual.

Here's the updated config:

version: '3'
services:
  web:
    image: tomcat:8.0.48-jre8
    command: >
      sh -c "apt-get update && apt-get install -y socat &&
             socat TCP-LISTEN:5432,bind=127.0.0.1,fork TCP:db:5432 &
             catalina.sh run"
  db:
    image: postgres:9.6.6
    expose:
      - "5432"

When the web container starts, it first installs Socat, spins up a background process that listens on 127.0.0.1:5432 and forwards all traffic to db:5432, then launches Tomcat. Any app inside the web container hitting 127.0.0.1:5432 will now reach the database.

2. Share the DB's Network Stack (Simpler but Limited) #

You can configure the web service to share the same network namespace as the db using network_mode: service:db. This makes 127.0.0.1 inside the web container point directly to the db's network interface, so accessing 127.0.0.1:5432 connects straight to the database.

Updated config:

version: '3'
services:
  web:
    image: tomcat:8.0.48-jre8
    network_mode: service:db
    # Note: If you need to expose Tomcat's port externally, move the ports config to the db service
    # ports:
    #   - "8080:8080"  # This line goes under the db service instead
  db:
    image: postgres:9.6.6
    expose:
      - "5432"
    # Uncomment this if you need external access to Tomcat
    # ports:
    #   - "8080:8080"

This method is super clean, but it comes with a catch: the web and db share the same network stack. That means any ports you want to expose for Tomcat have to be defined in the db service, and the two services can't use conflicting ports. It's great if you don't need external access to Tomcat or can work with this constraint.

3. Custom iptables Rules (Advanced) #

If you'd rather avoid extra tools like Socat, you can add iptables rules inside the web container to redirect traffic from 127.0.0.1:5432 to db:5432.

Here's how to set it up:

version: '3'
services:
  web:
    image: tomcat:8.0.48-jre8
    command: >
      sh -c "apt-get update && apt-get install -y iptables &&
             iptables -t nat -A OUTPUT -p tcp --dport 5432 -d 127.0.0.1 -j DNAT --to-destination db:5432 &&
             catalina.sh run"
    cap_add:
      - NET_ADMIN  # Required to modify iptables inside the container
  db:
    image: postgres:9.6.6
    expose:
      - "5432"

This adds a DNAT rule that reroutes any TCP traffic headed to 127.0.0.1:5432 to db:5432. Just note that the container needs the NET_ADMIN capability to modify iptables, which we've added with cap_add.

All these methods will get you the behavior you want. The Socat approach is probably the most straightforward and least restrictive if you don't want to deal with shared network stacks or special permissions.

内容的提问来源于stack exchange，提问作者user2068645