Docker - no route to place

Question

When I try to connect to a port from my container to another container, I unsuccessfully and get

root@ac1590a59fe5 :/opt/f5massupgrade# curl -v https://172.17.0.1:6379 * Rebuilt URL to: https://172.17.0.1:6379/ * Hostname was NOT found in DNS cache * Trying 172.17.0.1... * connect to 172.17.0.1 port 6379 failed: No route to host * Failed to connect to 172.17.0.1 port 6379: No route to host * Closing connection 0 

From the docker host, I am successful ,

 [ root@docker-host ~]# curl -v https://172.17.0.1:6379/0 * About to connect() to 172.17.0.1 port 6379 (#0) * Trying 172.17.0.1... * Connected to 172.17.0.1 (172.17.0.1) port 6379 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none 

If I check iptables , I see a problem,

 [ root@docker-host ~]# iptables -S INPUT -P INPUT ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i docker0 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited 

So, I will add the following and everything works well,

 iptables -I INPUT 4 -i docker0 -j ACCEPT 

Am I missing something?

 [ root@docker-host ~]# docker version Client: Version: 1.9.1 API version: 1.21 Package version: docker-common-1.9.1-40.el7.centos.x86_64 Go version: go1.4.2 Git commit: ab77bde/1.9.1 Built: OS/Arch: linux/amd64 Server: Version: 1.9.1 API version: 1.21 Package version: docker-common-1.9.1-40.el7.centos.x86_64 Go version: go1.4.2 Git commit: ab77bde/1.9.1 Built: OS/Arch: linux/amd64 

Thanks,

Answer 1

We ran into this problem on the RHEL box that worked firewalld . The firewall prevented the container from accessing the host (except for icmp traffic).

We needed to configure a firewall to pass traffic from the dock containers to the host. In our case, the containers were on the bridge network in the subnet 172.27.0.0/16 (determined using docker network ls and docker inspect <network-name> ). Firewall rules for firewalld can be updated with:

 firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address=172.27.0.0/16 accept' firewall-cmd --reload 

This was a useful link in solving the problem.

Answer 2

Try starting the container with the --net flag set for the host.

 docker run --net host image 

Answer 3

For me, the problem was the MAC address conflict ... I don’t know how this could happen ...