CentOS服务器Nginx反向代理多Docker容器配置咨询

Hey, your basic Nginx reverse proxy setup for Docker containers works, but there are several tweaks to make it more Docker-friendly, maintainable, and robust. Let's break down the improvements:

Right now you're pointing proxy_pass to 127.0.0.1:9000, which relies on exposing container ports to the host. This isn't ideal because:

• If a container restarts and you adjust its port mapping, you have to update Nginx config every time.
• Exposing unnecessary ports increases your attack surface.

Instead, create a dedicated Docker bridge network and add both Nginx and your containers to it. Then you can use container names (or service names if using Docker Compose) directly in proxy_pass.

Here's how:

1. Create the network:

   docker network create nginx-proxy-net
   

2. Attach your containers to this network when starting them:

   docker run --name container-A --network nginx-proxy-net your-image-A
   

3. Update your Nginx config to use the container name instead of localhost:

   location / {
       proxy_pass http://container-A:9000;
   }
   

This way, containers communicate privately over the Docker network—no need to publish ports to the host at all.

Your current setup repeats SSL config, HTTP-to-HTTPS redirects, and proxy settings across every .conf file. This is a pain to maintain if you need to update something (like SSL protocols) for all services.

Create shared snippet files in /etc/nginx/snippets/:

Example 1: HTTP-to-HTTPS redirect (/etc/nginx/snippets/http-to-https.conf) #

server {
    listen 80;
    server_name _; # Matches all unmatched domains, or list your specific ones
    return 301 https://$host$request_uri;
}

Example 2: SSL security params (/etc/nginx/snippets/ssl-params.conf) #

ssl_certificate /path/to/your/cert.pem;
ssl_certificate_key /path/to/your/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

Example 3: Proxy headers (/etc/nginx/snippets/proxy-headers.conf) #

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Now your per-service config (like A.conf) becomes much cleaner:

include snippets/http-to-https.conf;

server {
    listen 443 ssl;
    server_name A.local;
    include snippets/ssl-params.conf;

    location / {
        proxy_pass http://container-A:9000;
        include snippets/proxy-headers.conf;
    }
}

Right now, if Container A crashes, Nginx will keep sending requests to it, resulting in errors. You can add basic failover with proxy_next_upstream, or use the ngx_http_check_module for active health checks (note: you may need a pre-built Nginx image with this module or compile it yourself).

Basic failover with proxy_next_upstream: #

location / {
    proxy_pass http://container-A:9000;
    include snippets/proxy-headers.conf;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
}

Active health checks (if using ngx_http_check_module): #

upstream container-A {
    server container-A:9000;
    check interval=3s rise=2 fall=3 timeout=1s; # Check every 3s, mark down after 3 fails
}

server {
    listen 443 ssl;
    server_name A.local;
    include snippets/ssl-params.conf;

    location / {
        proxy_pass http://container-A;
        include snippets/proxy-headers.conf;
    }
}

• Run Nginx as a non-root user: Create a dedicated nginx user/group, then add user nginx; at the top of your main nginx.conf.
• Use auto-renewing certificates: If you're using public domains, use Certbot to issue and auto-renew Let's Encrypt certificates—no more manual certificate updates.
• Restrict sensitive paths: If any container has admin endpoints, add IP whitelisting in Nginx:

  location /admin {
      allow 192.168.1.0/24; # Your trusted IP range
      deny all;
      proxy_pass http://container-A:9000/admin;
      include snippets/proxy-headers.conf;
  }
  

• Per-service logs: Add dedicated logs for each service to simplify debugging:

  server {
      listen 443 ssl;
      server_name A.local;
      include snippets/ssl-params.conf;
      access_log /var/log/nginx/A.local.access.log;
      error_log /var/log/nginx/A.local.error.log;
  
      location / {
          proxy_pass http://container-A:9000;
          include snippets/proxy-headers.conf;
      }
  }
  

• Enable Nginx status: Monitor performance with the stub_status module:

  server {
      listen 127.0.0.1:8080;
      location /nginx_status {
          stub_status on;
          allow 127.0.0.1;
          deny all;
      }
  }
  

You can scrape this endpoint with tools like Prometheus to track metrics like active connections and request rates.

Overall, your initial setup is functional, but these changes will make your configuration more aligned with Docker best practices—easier to maintain, more secure, and more resilient to container failures.

内容的提问来源于stack exchange，提问作者Drew