0

I am working with CentOS 7 OS hosting a set of docker containers.

By using a web browser I can reach a service on port 80 and I get back a response. A bit of local knowledge helps me understand that the response comes from one of the docker containers.

However, I have a big problem: I can't seem to find a way for the OS to indicate that port 80 is open. Here is what I have tried (all with root user):

  • netstat -tulnp | grep 80 lists nothing listening on port 80
  • ss -nutlp | grep 80 lists nothing listening on port 80
  • lsof -i -P | grep 80 also lists nothing listening on port 80
  • wget 127.0.0.1 successfully fetches index.html

Interrogating Docker directly through docker ps is not really the answer I am looking for, because we must be able to interrogate the OS and see what process is responsible for treating requests to port 80. It's also not helpful, because docker ps returns several containers that have the following entry in the PORTS column:

PORTS 80/tcp 8080/tcp 80/tcp

Again, I don't want to go to docker for answers, because there must be a way to interrogate the OS and identify the process responsible for handling port 80.

My only guess is that docker installs some sort of low-level driver that intercepts such network requests.

Any suggestions on how to get CentOS to hand out this information, accompanied with command line commands, would be greatly appreciated!

Improve this question

1 Answer 1

Reset to default
3

Are you certain the docker host is listening on port 80? It might be redirected from port 80 to whatever port it is listening on using the built-in firewall.

If you are running IPTABLES, you could check this by using:

iptables -L -t nat

You would then see a chain named DOCKER which will tell you what redirects are in place, similar to this:

Chain DOCKER (2 references) target prot opt source destination RETURN all -- anywhere anywhere RETURN all -- anywhere anywhere DNAT tcp -- anywhere anywhere tcp dpt:http-alt to:172.17.0.3:80 DNAT tcp -- anywhere anywhere tcp dpt:4433 to:172.17.0.3:443 DNAT tcp -- anywhere anywhere tcp dpt:1688 to:172.17.0.4:1688
Improve this answer
1
  • 1
    Thank you, it certainly was iptables! I've made a mistake of using -S without specifying the exact table, leaving me with an impression that there were no nat rules Commented Apr 15, 2021 at 14:19

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.