blocks|key|2525924|text|对于此设置，我将：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2525925|2525926|删除.htaccess文件；|ordered-list-item|offset|length|style|CODE|2525927|确保未使用docker+run+-p或Docker+Compose+ports:选项发布后端服务。|2525928|2525929|Docker的标准网络设置将容器的私有IP地址主要作为实现细节。来自当前主机外部的调用者(在某些情况下，甚至同一主机上的调用者)不能直接到达容器的IP地址；它们必须联系主机并使用容器发布的TCP端口。如果一个容器没有发布的端口，那么它是不可访问的。|2525930|在容器之间，只要它们在相同的Docker内部网络上(或者在没有显式networks:的相同docker-compose.yml文件中)，它们就可以使用容器名称作为主机名直接到达对方。|2525931|所以如果你运行：|2525932|docker+network+create+app
docker+run+--net+app+-p+80:80+-v+...+nginx
docker+run+--net+app+++++++++++++++++service1
docker+run+--net+app+++++++++++++++++service2
docker+run+--net+app+++++++++++++++++service3|code-block|syntax|javascript|2525933|然后：|2525934|nginx容器可以代理，因为这些服务在同一个network|2525935|Off-host上-内部containers|unordered-list-item|2525936|
|2525937|Off-host调用者可以到达http://physical_host.example.com/，主机上的HTTP端口80被路由到nginx代理调用者除了通过nginx代理|2525938|
之外无法到达这三个后端服务。|2525939|如果这是您试图通过Apache的访问机制实现的唯一控制，那么Docker的IP级保护在这里就足够了。|2525940|entityMap^0|0|0|2|9|0|5|D|Y|6|0|0|0|X|9|19|I|0|0|0|0|0|0|0|F|X|0|0|0^^$0|@$1|2|3|4|5|6|7|1E|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|1F|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|1G|8|@$F|1H|G|1I|H|I]]|9|@]|A|$]]|$1|J|3|K|5|E|7|1J|8|@$F|1K|G|1L|H|I]|$F|1M|G|1N|H|I]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|1O|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|1P|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1Q|8|@$F|1R|G|1S|H|I]|$F|1T|G|1U|H|I]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1V|8|@]|9|@]|A|$]]|$1|S|3|T|5|U|7|1W|8|@]|9|@]|A|$V|W]]|$1|X|3|Y|5|6|7|1X|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|11|3|12|5|13|7|1Z|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|20|8|@]|9|@]|A|$]]|$1|16|3|17|5|13|7|21|8|@$F|22|G|23|H|I]]|9|@]|A|$]]|$1|18|3|19|5|6|7|24|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|6|7|25|8|@]|9|@]|A|$]]|$1|1C|3|-4|5|6|7|26|8|@]|9|@]|A|$]]]|1D|$]]

For this setup, I would:

<ol>
<li>Remove the <code>.htaccess</code> files; and</li>
<li>Make sure the backend services aren't published with <code>docker run -p</code> or Docker Compose <code>ports:</code> options.</li>
</ol>

Docker's standard networking setup gives containers private IP addresses as mostly an implementation detail. Callers from outside the current host (and in some cases even callers on the same host) can't reach the containers' IP addresses directly; they must contact the host and use a container's published TCP port. If a container doesn't have a published port, it's not reachable.

Between containers, so long as they're on the same Docker-internal network (or are in the same <code>docker-compose.yml</code> file with no explicit <code>networks:</code>), they can reach each other directly using the container names as hostnames.

So if you ran:

<pre><code>docker network create app
docker run --net app -p 80:80 -v ... nginx
docker run --net app service1
docker run --net app service2
docker run --net app service3
</code></pre>

Then:

<ul>
<li>The nginx container can <code>proxy_pass http://service1/</code>, because the services are on the same Docker-internal network</li>
<li>Off-host callers can reach <code>http://physical_host.example.com/</code>, and HTTP port 80 on the host gets routed to the nginx containers</li>
<li>Off-host callers can't reach the three back-end services except via the nginx proxy</li>
</ul>

If that's the only control you're trying to implement via Apache's access mechanisms, then Docker's IP-level protection is enough for you here.

I have 4 containers. Main one with nginx that serves as proxy and redirect all traffic to another 3 containers. Those containers are with apache and stores different web application. Each of this container, contain folder with .htaccess. This file allows access to this folder only for particular IPes. And here is the issue when I remove this file everything work and traffic is redirected but when I add this file as follow:

<pre><code> order allow,deny
 allow from 172.26.0.0/16 (IP of the nginx-proxy)
 allow from nginx-proxy.net (name of the container)
 allow from x.x.x.x (another IPes)
 deny from all 
</code></pre>

It doesn't work and I'm getting 'You don't have permission to acces ...'. How to make it work with .htaccess or maybe there should be different approach. But only particular folder need to be protected the rest no. Thanks

.htaccess allow access for docker proxy container

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有4个容器。Main使用nginx作为代理，并将所有流量重定向到另外3个容器。这些容器与apache一起存储不同的web应用程序。这个容器中的每个容器都包含带有.htaccess的文件夹。此文件仅允许特定IPes访问此文件夹。这里的问题是，当我删除这个文件时，所有的工作和流量都被重定向，但当我添加这个文件时，如下所示...

.htaccess允许访问docker代理容器-腾讯云开发者社区-腾讯云

问.htaccess允许访问docker代理容器
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问.htaccess允许访问docker代理容器EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问.htaccess允许访问docker代理容器
EN