Docker Container Port Management via Unified Gateway Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In microservice scenarios, especially for small and medium-sized enterprises, the complexity and inefficiency of port management in Docker containers, particularly with multi-port exposure, lead to increased workload and maintenance difficulties due to inefficient iptables-based port mapping and packet forwarding.
Innovation Solution
A method and system for network communication that determines a data forwarding rule within a Docker container, allowing a pair of ports to be mapped to host computer ports, enabling efficient data packet forwarding by a data distribution unit, which reduces port management complexity and improves data transmission efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If port mapping based on iptables is used for multi-port exposure in Docker containers, then service functionality is achieved, but system complexity and operation maintenance difficulty increase
Solution Approach 1:
The patent merges multiple port mapping functions into a single unified port (port 8080). Instead of mapping each service port individually through iptables, all services share one exposed port, and internal routing is handled by the gateway service within the container. This reduces port management complexity while maintaining multi-service functionality.
Solution Approach 2:
The gateway service acts as an intermediary between external requests and internal services. It receives all incoming traffic on port 8080, determines the target service based on request characteristics, and forwards to the appropriate internal service. This mediator approach eliminates the need for complex iptables rules for each service.
2Adaptability or versatility
If port mapping based on iptables is used for data transmission, then service communication is enabled, but data transmission efficiency deteriorates due to increased delay
Solution Approach 1:
The patent extracts the network address translation (NAT) function from the host system's iptables and implements it directly within the Docker container's gateway service. This extraction allows UDP packets to be processed and forwarded within the container without undergoing host-level iptables translation, significantly reducing transmission delay for time-sensitive applications.
Solution Approach 2:
The patent replaces the host system's mechanical iptables packet processing mechanism with a software-based gateway service running inside the container. This substitution enables more flexible and efficient packet handling, particularly for UDP traffic, by eliminating the overhead of host-level network address translation.
3Adaptability or versatility
If docker-proxy processes are created for each container port, then data packet forwarding is achieved, but system complexity and operation maintenance difficulty increase
Solution Approach 1:
The patent merges multiple docker-proxy functions into a single gateway service process. Instead of spawning a separate docker-proxy process for each container port, one gateway service handles all incoming traffic on port 8080 and routes it to the appropriate internal services. This consolidation dramatically reduces process management complexity.
Solution Approach 2:
The gateway service is designed as a universal component that can handle multiple services and protocols simultaneously. It provides multi-functional capabilities including HTTP/HTTPS routing, WebSocket support, and UDP forwarding, replacing the need for multiple specialized proxy processes.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Disclosed are a method and a system for network communication. The method for network communication includes: determining a data forwarding rule of a Docker container; and forwarding, according to the data forwarding rule, a data packet received via a first port to an application deployed in the Docker container, or forwarding a data packet sent by the application deployed in the Docker container to an external device via the first port, where a pair of first ports of the Docker container are mapped to ports of a host computer in which the Docker container is located.