Debug Docker networking and Windows 10 firewall

Question

Given:

1. Windows 10 / 64 bit
2. Docker edge 17.11-ce-win40

Experiment:

docker run -it --rm -p 8888:8080 tomcat:8.0

Expected behaviour:

• If all network settings are okay, Tomcat must be reachable locally and from outside on the host port 8888.

Observed behaviour:

• curl localhost:8080 inside container proves Tomcat to be up and running
• ERR_EMPTY_RESPONSE locally/from outside
• Flipping Windows Firewall leads to the question whether vpnkit should be allowed, allowing leads to no change
• nmap from outside reveals port open
• telnet is possible as well but no further interaction
• docker inspect -f '{{ .NetworkSettings.Networks.nat.IPAddress }} <CONTAINER_ID> outputs <no value>
• find ipconfig /all output below

Further debugging

ipconfig /all [excerpt]


   Hostname  . . . . . . . . . . . . : foo
   Primäres DNS-Suffix . . . . . . . : foo.com
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : No
   WINS-Proxy aktiviert  . . . . . . : No
   DNS-Suffixsuchliste . . . . . . . : foo.com

Ethernet-Adapter vEthernet (DockerNAT):

   Verbindungsspezifisches DNS-Suffix:
   Beschreibung. . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter
   Physische Adresse . . . . . . . . : 00-15-5D-48-8F-A4
   DHCP aktiviert. . . . . . . . . . : No
   Autokonfiguration aktiviert . . . : Yes
   Verbindungslokale IPv6-Adresse  . : fe80::e93b:535c:4ea5:84cf%18
   IPv4-Adresse  . . . . . . . . . . : 10.0.75.1
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Standardgateway . . . . . . . . . :
   DNS-Server  . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS über TCP/IP . . . . . . . : Active

Ethernet-Adapter Ethernet:

   Verbindungsspezifisches DNS-Suffix: foo.com
   Beschreibung. . . . . . . . . . . : Realtek USB GbE Family Controller
   Physische Adresse . . . . . . . . : D4-81-D7-57-AC-C6
   DHCP aktiviert. . . . . . . . . . : Yes
   Autokonfiguration aktiviert . . . : Yes

Answer 1

Since Windows use a tiny VM called MobyLinux, the port mapping will happen with tiny VM and not with Windows Host. If you are not reachable from Windows Host to Docker MobyVM, check windows events for possible error. For more networking related information, please see -

https://docs.docker.com/engine/userguide/networking/

Answer 2

The tomcat is reachable on port 8080 instead of 8888 when the following is defined in the question

docker run -it --rm -p 8888:8080 tomcat:8.0

Documentation

Publish or expose port (-p, –expose)

$ docker run -p 127.0.0.1:80:8080 ubuntu bash

This binds port 8080 of the container to port 80 on 127.0.0.1 of the host machine. The Docker User Guide explains in detail how to manipulate ports in Docker.

$ docker run --expose 80 ubuntu bash

This exposes port 80 of the container without publishing the port to the host system’s interfaces.

Based on the documentation, the first port is the internal port, i.e. 8080 and the second one, i.e. 8888 the external or exposed one.