AWS多容器Docker的Link是否单向？容器可发现性不对称问题咨询

Hey there, this one-way container discovery problem is a pretty common gotcha in EB's multi-container Docker setups, especially with default network configurations. Let's walk through the most likely causes and how to fix them, since your containers are identical (same code, Dockerfiles) and running the latest environment components.

1. Verify Mutual Linking & Service Discovery Config #

EB's multi-container environments default to bridge networking, and while links are supposed to work bidirectionally, startup order and DNS caching can create this one-way reachability issue. Make sure both containers explicitly link to each other in your Dockerrun.aws.json:

"containerDefinitions": [
  {
    "name": "first-container",
    "links": ["second-container"],
    // Rest of your config (portMappings, image, etc.)
  },
  {
    "name": "second-container",
    "links": ["first-container"],
    // Rest of your config
  }
]

Even though EB should handle cross-container DNS automatically, explicit linking helps enforce DNS registration during startup.

2. Check Node.js Service Listening Address (Critical!) #

Since both containers are running Node servers, this is the #1 culprit for one-way reachability:

• Ensure your Node server is listening on 0.0.0.0, not localhost. If your first container's server is only bound to localhost, it'll accept traffic from inside its own container but reject requests from the second container.
  Example fix in your Node code:

  app.listen(3000, '0.0.0.0', () => {
    console.log('Server running on 0.0.0.0:3000');
  });
  

This is an easy mistake to make, and since your code is identical, double-check that both containers are using this binding (sometimes local dev setups use localhost which works locally but breaks in container networks).

3. Flush Node.js DNS Cache #

Node.js caches DNS results by default (TTL of ~60 seconds). If the second container started after the first, the first might have already resolved the second's hostname once it came online—but the second container might have tried resolving the first before it was fully registered, and cached a failed result.
Add this to your Node code to disable DNS caching (or reduce TTL) for cross-container requests:

const dns = require('dns');
dns.setDefaultResultOrder('ipv4first'); // Optional, but helps with container DNS
// Disable DNS caching
dns.resolve.cache = {};

Alternatively, use a dynamic DNS lookup for each request instead of relying on cached results.

4. Validate Security Groups & Network Policies #

• Confirm your EB environment's security group allows internal traffic between containers. Add an inbound rule that allows all traffic (or your Node service port) from the same security group.
• If you've specified custom securityGroups in your container definitions, ensure both containers' security groups allow inbound/outbound traffic to each other on your service port.

5. Troubleshooting Steps to Diagnose the Root Cause #

To narrow down the issue quickly:

• SSH into your EB EC2 instance, then run docker exec -it second-container ping first-container to check if hostname resolution works. If ping fails, it's a DNS/network issue; if ping succeeds but your service request fails, it's a port/listening address issue.
• Inside the second container, run nslookup first-container to verify DNS returns the correct IP of the first container.
• Check the first container's Node logs to see if incoming requests from the second container are being rejected or never reaching the server.

6. Try AWSVPC Network Mode (More Stable for Service Discovery) #

If you're using an older EB platform version, consider switching to awsvpc network mode. This puts all containers in the same VPC subnet, eliminating bridge network DNS quirks. Update your Dockerrun.aws.json:

{
  "AWSEBDockerrunVersion": 2,
  "networkMode": "awsvpc",
  "containerDefinitions": [
    // Your container configs here
  ]
}

Note: You'll need to ensure your EB platform version supports awsvpc (most recent versions do) and adjust port mappings accordingly.

Since your containers are identical, the most likely fix is verifying the Node server listens on 0.0.0.0 or ensuring mutual linking in your Dockerrun config. Start with those two—they resolve 90% of cases like this.

内容的提问来源于stack exchange，提问作者Adam Coster