I have a docker container ruing on a CentOS7 box. The container runs a flask service on port 5000. I can reach the service from the host machine that I am SSH'd into but not from the box I am using to SSH (my laptop).
firewalld is not ruing
[user@centos7box ~]$ sudo systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
May 11 10:38:41 centos7box firewalld[736]: 2016-05-11 10:38:41 ERROR: COMMAND_FAILED: '/sbin/iptables -t filter -C FORWARD -o docker0 -j DOCKER' failed: iptables: No chain/target/match by that name.
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No cha...by that name.
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D PREROUTING' failed: iptables: Bad rule (does a matching rule exist in that chain?).
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -D OUTPUT' failed: iptables: Bad rule (does a matching rule exist in that chain?).
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -n -L DOCKER' failed: iptables: No chain/target/match by that name.
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -D FORWARD -i docker0 -o docker0 -j DROP' failed: iptables: Bad rule (does a matc...that chain?).
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C PREROUTING -m addrtype --dst-type LOCAL -j DOCKER' failed: iptables: No...by that name.
May 11 12:05:03 centos7box firewalld[736]: 2016-05-11 12:05:03 ERROR: COMMAND_FAILED: '/sbin/iptables -t nat -C OUTPUT -m addrtype --dst-type LOCAL -j DOCKER ! --dst 127.0.0.0/8' fail...by that name.
May 11 16:03:44 centos7box systemd[1]: Stopping firewalld - dynamic firewall daemon...
May 11 16:03:45 centos7box systemd[1]: Stopped firewalld - dynamic firewall daemon.
Hint: Some lines were ellipsized, use -l to show in full.
iptables -S
[user@centos7box ~]$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m cotrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 5000 -j ACCEPT
Ruing docker container exposes port 5000
[user@centos7box ~]$ sudo docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
bb8263b6a337 mydocker "python myservice.py" 26 minutes ago Up 26 minutes 0.0.0.0:5000->5000/tcp mydocker
Successful response from cURL to the service from centos7box
[user@centos7box ~]$ curl -X POST -H "Content-Type: application/json" -d '{
"url": "someurl"
}' "http://centos7box:5000/myservice"
{"foo": "bar"}
Successful ping from my laptop to centos7box
➜ ~ ping centos7box
PING centos7box (172.11.15.51): 56 data bytes
64 bytes from 172.11.15.51: icmp_seq=0 ttl=62 time=128.448 ms
64 bytes from 172.11.15.51: icmp_seq=1 ttl=62 time=252.162 ms
Unsuccessful response from cURL to the service from my laptop
➜ ~ curl -X POST -H "Content-Type: application/json" -d '{
quote> "url": "someurl"
quote> }' "http://centos7box:5000/ocr"
curl: (7) Failed to coect to centos7box port 5000: Operation timed out
Question
How can I reach the service from my laptop? I believe it has something to do with docker and iptables but I'm not sure how to debug it.