Docker Community Forums

Share and learn in the Docker community.

Docker Service Unavailable

Overview

I have a fairly straightforward portainer service running on my docker swarm. When I curl the published port from the docker host, it returns the webpage. When I do the same from any other host on my network, the connection times out. The docker host and my testing machine are on the same network and same subnet.

Issue type

networking?

OS Version/build

output of cat /etc/os-release:

PRETTY_NAME="Ubuntu 18.04.4 LTS"

App version

output of docker version

Client: Docker Engine - Community
 Version:           19.03.12
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        48a66213fe
 Built:             Mon Jun 22 15:45:36 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.12
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       48a66213fe
  Built:            Mon Jun 22 15:44:07 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

Steps to reproduce

Step 1. run the below docker-compose.yml file as shown:

docker stack deploy --compose-file docker-compose.yml

the file:

compose:
  - version: '3.2'
    services:
      agent:
        image: portainer/agent
        volumes:
          - /var/run/docker.sock:/var/run/docker.sock
          - /var/lib/docker/volumes:/var/lib/docker/volumes
        networks:
          - agent_network
        deploy:
          mode: global
          placement:
            constraints: [node.platform.os == linux]
      portainer:
        image: portainer/portainer
        command: -H tcp://tasks.agent:9001
        ports:
          - "8000:8000"
          - target: 9000
            published: 9000
            protocol: tcp
            mode: ingress
            volumes:
              - /mnt/portainer/data:/data
            networks:
              - agent_network
            deploy:
              mode: replicated
              replicas: 1
              placement:
                constraints: [node.role == manager]
    networks:
      agent_network:
        driver: overlay
        attachable: true

Step 2: On the docker host, run curl localhost:9000

you should see the html for the webpage of the portainer admin page

Step 3: Do the same, but on another host on the same network

On my machine, I run curl 10.0.0.6:9000. This times out every time.

Step 4: Just for a sanity check, do the same thing from inside a browser.

On my machine, I open firefox and attempt to go to 10.0.0.6:9000. This should time out after a while.

Other useful information

Iptables

Output of iptables --list-rules

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-INGRESS
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -i docker0 -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-INGRESS
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker_gwbridge -j DOCKER
-A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
-A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
-A DOCKER-INGRESS -j RETURN
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker_gwbridge ! -o docker_gwbridge -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker_gwbridge -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

Thank you for any help. This has been very frustrating to troubleshoot over the last week.