필사 모드: 도커 네트워크 모드와 연결 문제 — bridge, host, overlay, 그리고 127.0.0.1의 함정

docker run -d --name web nginx:1.27
ip -br link show type bridge
ip -br link | grep veth

docker0          UP             02:42:8f:1c:03:aa <BROADCAST,MULTICAST,UP,LOWER_UP>
veth3a91c7e@if12 UP             ba:19:7c:2e:44:81 <BROADCAST,MULTICAST,UP,LOWER_UP>

docker exec web ip -br addr

lo               UNKNOWN        127.0.0.1/8
eth0@if13        UP             172.17.0.2/16

docker run --rm --network host alpine:3.20 ip -br addr | head -3

lo               UNKNOWN        127.0.0.1/8
enp5s0           UP             10.0.4.17/24
docker0          UP             172.17.0.1/16

docker run -d --name app myapp:v1
docker run -d --name sidecar --network container:app envoyproxy/envoy:v1.31-latest
docker exec sidecar ip -br addr

lo               UNKNOWN        127.0.0.1/8
eth0@if17        UP             172.17.0.4/16

docker run -d --name db postgres:16
docker run --rm alpine:3.20 ping -c1 db

ping: bad address 'db'

docker network create app-net
docker run -d --name db --network app-net postgres:16
docker run --rm --network app-net alpine:3.20 ping -c1 db

PING db (172.19.0.2): 56 data bytes
64 bytes from 172.19.0.2: seq=0 ttl=64 time=0.089 ms

docker run --rm --network app-net alpine:3.20 cat /etc/resolv.conf

nameserver 127.0.0.11
options ndots:0

docker run -d --name api-v2 \
  --network app-net \
  --network-alias api \
  --network-alias backend \
  api:v312

services:
  api:
    image: api:v312
    environment:
      DATABASE_URL: postgres://app@db:5432/app   # 'db'가 서비스 이름
  db:
    image: postgres:16

docker run -d --name web -p 8080:80 nginx:1.27
sudo iptables -t nat -S DOCKER

-N DOCKER
-A DOCKER -i docker0 -j RETURN
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80

ps -eo pid,args | grep docker-proxy | head -1

  52104 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8080 -container-ip 172.17.0.2 -container-port 80

# 위험: 모든 인터페이스에 노출
docker run -d -p 5432:5432 postgres:16

# 안전: 호스트 루프백에서만 접근 가능
docker run -d -p 127.0.0.1:5432:5432 postgres:16

ss -tlnp | grep -E '5432'

LISTEN 0  4096  127.0.0.1:5432  0.0.0.0:*  users:(("docker-proxy",pid=52310,fd=4))

ssh -N -L 5432:127.0.0.1:5432 dev@build-01.internal

docker run --rm --network app-net api:v312 \
  sh -c 'nc -zv 127.0.0.1 5432'

nc: 127.0.0.1 (127.0.0.1:5432): Connection refused

docker run --rm alpine:3.20 \
  sh -c 'apk add -q bind-tools && dig +short host.docker.internal'

192.168.65.254

docker run --rm --add-host=host.docker.internal:host-gateway \
  alpine:3.20 getent hosts host.docker.internal

172.17.0.1        host.docker.internal

services:
  api:
    image: api:v312
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      DATABASE_URL: postgres://app@host.docker.internal:5432/app

docker run -d --name api -p 3000:3000 api:v312
curl -sS -m 3 http://localhost:3000/healthz

curl: (52) Empty reply from server

docker exec api sh -c 'ss -tlnp'

State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process
LISTEN  0       511          127.0.0.1:3000        0.0.0.0:*      users:(("node",pid=1,fd=20))

LISTEN  0  511  0.0.0.0:3000  0.0.0.0:*  users:(("node",pid=1,fd=20))

# Node / Express
node -e "require('express')().listen(3000, '0.0.0.0')"

# Flask
flask run --host=0.0.0.0 --port=5000

# Django
python manage.py runserver 0.0.0.0:8000

# Rails
bin/rails server -b 0.0.0.0 -p 3000

# Vite
vite --host 0.0.0.0

# Next.js
next start -H 0.0.0.0 -p 3000

# Go: net/http
# http.ListenAndServe(":8080", nil)  <- 이미 모든 인터페이스

sudo ufw status | head -4

Status: active
To                         Action      From
--                         ------      ----
8080/tcp                   DENY        Anywhere

curl -sS -o /dev/null -w '%{http_code}\n' http://203.0.113.42:8080/

200

sudo iptables -I DOCKER-USER -i enp5s0 ! -s 10.0.0.0/8 -p tcp --dport 8080 -j DROP
sudo iptables -t filter -S DOCKER-USER

-N DOCKER-USER
-A DOCKER-USER -i enp5s0 ! -s 10.0.0.0/8 -p tcp -m tcp --dport 8080 -j DROP
-A DOCKER-USER -j RETURN

docker exec api curl -sS -o /dev/null -w '%{http_code}\n' https://api.partner.example.com/v1/ping

200

docker exec api curl -sS -o /dev/null -w '%{http_code}\n' https://api.partner.example.com/v1/bulk

curl: (28) Operation timed out after 30001 milliseconds with 0 bytes received

docker exec api ping -M do -s 1472 -c 2 api.partner.example.com

PING api.partner.example.com (203.0.113.90) 1472(1500) bytes of data.
ping: local error: message too long, mtu=1450

docker exec api ping -M do -s 1422 -c 2 api.partner.example.com

1430 bytes from 203.0.113.90: icmp_seq=1 ttl=52 time=11.8 ms

docker network create \
  --driver bridge \
  --opt com.docker.network.driver.mtu=1450 \
  app-net

// /etc/docker/daemon.json — 기본 브리지에 적용
{
  "mtu": 1450
}

docker network create --driver overlay --attachable --opt encrypted app-mesh
docker service create --name api --network app-mesh --replicas 3 api:v312
docker network inspect app-mesh --format '{{json .Containers}}' | jq 'keys | length'

3

docker exec api ss -tlnp                                  # 1. 리스닝 주소
docker run --rm --network app-net alpine:3.20 \
  sh -c 'nc -zv api 3000; nc -zv 172.19.0.3 3000'         # 2. 이름/IP 해석
curl -sS -m 3 http://127.0.0.1:3000/healthz               # 3. 호스트에서
curl -sS -m 3 http://203.0.113.42:3000/healthz            # 4. 외부에서