Why Chrome can't inspect nodejs code in Docker container?

Question

I try to start simple nodejs server inside Docker container and debug it with chrome://inspect or WebStorm. Debugging port 9229 is binded but inspection not works. On the other hand when I run same code without docker i can inspect it in chrome://inspect and in WebStorm both well.

Can anybody explain me why Chrome can't inspect nodejs code in Docker container???

Dockerfile

FROM node:8.2.1-alpine

WORKDIR /code

COPY package.json /code/package.json
RUN npm install && npm ls
RUN mv /code/node_modules /node_modules

COPY . /code

EXPOSE 8000
EXPOSE 9229

CMD ["npm", "run", "start"]

alexey@home:~/app$ docker run -p 9229:9229 -p 8000:8000 node-dev

npm info it worked if it ends with ok 
npm info using [email protected]  
npm info using [email protected]  
npm info lifecycle @~prestart: @  
npm info lifecycle @~start: @

> @ start /code
> node --inspect app

Debugger listening on ws://127.0.0.1:9229/5b225f7d-0e18-4ded-894b-a7993bb7da64 
For help see https://nodejs.org/en/docs/inspector 
HTTP server listening on port 8000

You need to make your debugger listen on 0.0.0.0. It's currently listening on 127.0.0.1 which is only reachable from within the container (not your host). — johnharris85
@johnharris85 thank you for reply. it works now. I would like understand why wasn't work with 127.0.0.1. As I understand -p 9229:9229 bind internal docker's port with host's port which is reachable outside docker, isn't it? — alexey2baranov
'Internal Docker's port' isn't really a concept. Docker creates an veth interface inside the container, and forwards traffic to that using a bridge from the host. If you do an ifconfig inside your container, you'll see multiple interfaces. Docker's will likely start with 172.xxxxx. You could bind to that (and it would work fine) but that's not practical as we don't know for the most part what it's going to be ahead of time, so binding on 0.0.0.0 solves the problem. 127.0.0.1 is the loopback for the container only. — johnharris85
@alexey2baranov please can you write your exact solution. I can not reproduce it. I understand: only a 0.0.0.0 binding of the debug port make access of chrome devtools possible. But how in detail? — Gerd

Hoffmann Hoffmann · Accepted Answer · 2018-09-26T15:02:21

in your package.json scripts:

"debug": "nodemon --inspect=0.0.0.0:9229 index.js",

in your docker-compose.yaml:

services:
  service_name:
    command: npm run debug
    ports:
      - 9229:9229

I am not 100% sure on this but I think that mapping the debugger to run on 0.0.0.0 exposes it to your local network meaning that anyone can connect to your machine IP on port 9229 will be able to debug your nodejs server. Beware your nodejs server has access to the filesystem. So do not run production (or development) servers with this ever.

Why Chrome can't inspect nodejs code in Docker container?

3 Answers