AWS Beanstalk and Docker ports = which way to tomfoolery?

Question

So, I have a docker application that runs on port 9000, and I would like it to be available only through https, not through http, but I don't seem to understand how amazon handles ports. In short, I would like to expose port 443, not 80 (at the level of load balancing and instance level), but I could not do this.

So my Dockerfile has:

EXPOSE 9000 

and my Dockerrun.aws.json has:

 { "AWSEBDockerrunVersion": "1", "Ports": [{ "ContainerPort": "9000" }] } 

and I can’t access things through port 9000, but only to 80.

When I pass ssh to the instance where the docker container is running and find the ports with netstat, I get ports 80 and 22 and some other udp ports, but not port 9000. How does Amazon actually handle this? More importantly, how does the user get the expected behavior?

Trying this with ssl and https also gives the same thing. Certificates are installed and mapped to port 443, I even created a case in the .ebextensions configuration file to open port 443 in the instance and still no ssl

  sslSecurityGroupIngress: Type: AWS::EC2::SecurityGroupIngress Properties: GroupName: {Ref : AWSEBSecurityGroup} IpProtocol: tcp ToPort: 443 FromPort: 443 CidrIp: 0.0.0.0/0 

The only way I can get SSL to work is to use a Load Balancer, using port 443 (ssl) to forward to instance port 80 (not https), but this is ridiculous. How can I open the ssl port on an instance and install docker to use this port? Has anyone ever done this successfully?

I would be grateful for any help in this - I combed through the documents and got to this, but it just puzzles me. In short, I would like to expose port 443, not 80 (at the level of load balancing and instance level), but I could not do this.

Excellent day

Greetings

Answer 1

Known issue: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker_image.html :

You can specify multiple container ports, but Elastic Beanstalk uses only the first one to connect your container to the reverse host proxy and route requests from the public Internet.

So, if you need multiple ports, AWS Elastic Beanstalk is probably not the best choice. At least the Docker option.

As for SSL - we solved this by using a dedicated instance of nginx and proxy_pass'ing to the URL of the Elastic Beanstalk environment.