Docker-compose 服務/容器之間互訪失敗

問題

同網絡內，容器間能ping 但訪問監聽端口時，提示'No route to host'

復現步驟

通過 docker-compose 啟動多個服務容器， 並且服務都在同一個網絡內

sh-4.2# ping 172.20.0.2
PING 172.20.0.2 (172.20.0.2) 56(84) bytes of data.
64 bytes from 172.20.0.2: icmp_seq=1 ttl=64 time=0.152 ms
64 bytes from 172.20.0.2: icmp_seq=2 ttl=64 time=0.081 ms

sh-4.2# curl -vvv  http://172.20.0.2:8080
* About to connect() to 172.20.0.2 port 8080 (#0)
*   Trying 172.20.0.2...
* No route to host
* Failed connect to core:8080; No route to host
* Closing connection 0
curl: (7) Failed connect to core:8080; No route to host

解決

這是一個docker/firewalld的已知bug， 通過執行以下命令解決

firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address=172.17.0.0/16 accept' && firewall-cmd --reload