Remote end closed connection without response

[vsosnin]

Hi, I'm trying to run a simple GoLang app https://snyk.io/blog/containerizing-go-applications-with-docker/ inside of a podman container on Windows but for some reason it's closing incoming connections while doing GET request with http :8080/time command and returning the following error:
http: error: ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')) while doing GET request to URL: http://localhost:8080/time

The container was started successfully with:

podman run --rm -p 8080:8080 --name current-time current-time
Server is running at 127.0.0.1:8080

and I can see that on the host port 8080 is open and listening for incoming requests:

> get-nettcpconnection | where {($_.State -eq "Listen") -and ($_.LocalPort -eq "8080")}

LocalAddress                        LocalPort RemoteAddress                       RemotePort State       AppliedSetting OwningProcess
------------                        --------- -------------                       ---------- -----       -------------- -------------
::1                                 8080      ::                                  0          Listen                     12788
127.0.0.1                           8080      0.0.0.0                             0          Listen                     12788

I don't think there's anything wrong with the app itself because it works fine when I run it on the host outside of the container.
Is there some option I'm missing in podman run command?

The full Dockerfile is below:

# syntax=docker/dockerfile:1

##
## STAGE 1 - BUILD
##
# specify the base image to  be used for the application
FROM golang:1.20.5-alpine3.18 AS build

# create a working directory inside the image
WORKDIR /app

# copy Go modules and dependencies to image
COPY go.mod ./

# download Go modules and dependencies
RUN go mod download

# copy directory files i.e all files ending with .go
COPY *.go ./

# compile application
RUN go build -o /current-time

##
## STAGE 2 - DEPLOY
##
FROM alpine:3.18

WORKDIR /

# copy the app built in Stage 1
COPY --from=build /current-time /current-time

# tells Docker that the container listens on specified network ports at runtime
EXPOSE 8080

# command to be used to execute when the image is used to start a container
CMD ["/current-time"]

[Luap99]

Did you try with a different image, maybe nginx?

[vsosnin]

I did try with scratch image in Stage 2 like in the article but it didn't make any difference. However, the podman run --rm -d -p 8080:80 --name httpd docker.io/library/httpd example with httpd without the Dockerfile worked fine - requests to httpd server weren't blocked

[vsosnin]

Also, if I start the container with --network=host, everything works (even though port mapping is discarded):

> podman run --rm --network=host -p 8080:8080 --name current-time current-time
Port mappings have been discarded as one of the Host, Container, Pod, and None network modes are in use
Server is running at 127.0.0.1:8080

$ http -v :8080/time
GET /time HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: localhost:8080
User-Agent: HTTPie/1.0.2



HTTP/1.1 200 OK
Content-Length: 51
Content-Type: text/plain; charset=utf-8
Date: Wed, 28 Jun 2023 18:14:17 GMT

[
    {
        "current_time": "Mon, 02 Jan 2006 15:04:05 GMT"
    }
]

[vsosnin]

I figured it out. It didn't like localhost in main.go.
After changing log.Fatal(http.ListenAndServe("localhost:8080", mux)) to log.Fatal(http.ListenAndServe(":8080", mux)), recreating the image and restarting the container, I was able to get the response back from the server.
Any idea why requests are blocked when localhost is present?

[Luap99]

Ok this is the normal/correct behaviour then. Unless --network host the container runs in a separate netns so it has its own localhost. And there is no way to connect to that directly from outside the coriander. All the external connections need to go into the eth0/tap0 interface in the container so the application must bind that.
It is no different on your host, if you only bind localhost no other computer on the network can connect to that.

[vsosnin]

I see. That makes sense. Thanks for explaining it to me. Does http.ListenAndServe(":8080", mux) bind eth0/tap0 since it's considered default device to bind to?

[vsosnin]

https://github.com/golang/go/blob/master/src/net/dial.go#L382
// For TCP, UDP and IP networks, if the host is empty or a literal
// unspecified IP address, as in ":80", "0.0.0.0:80" or "[::]:80" for
// TCP and UDP, "", "0.0.0.0" or "::" for IP, the local system is
// assumed.

"The local system is assumed" sounds a bit vague. In container's context, what exactly is the local system?

[Luap99]

Binding :8080 is the normal thing to do when you want to expose your application. Otherwise you would need to figure the exact ip address of the interface which adds unnecessary work.

"The local system is assumed" sounds a bit vague. In container's context, what exactly is the local system?

The namesapce is completely transparent, the application has no longer direct access to the host system.
This just means all local (in this case container) addresses are bound.