nginx:1.9? docker 容器内获取 client-IP 做 whitelist

用的 dockerfile 构建 nginx 服务

 MAINTAINER dkey ENV RUN_USER nginx ENV RUN_GROUP nginx ENV DATA_DIR /data/web ENV LOG_DIR /data/log/nginx RUN mkdir /data/log/nginx -p RUN chown nginx.nginx -R /data/log/nginx #ADD web /data/web ADD nginx.conf /etc/nginx/nginx.conf #ADD default.conf /etc/nginx/conf.d/default.conf EXPOSE 8080 ENTRYPOINT nginx -g "daemon off;" ## nginx.conf ```worker_processes 1; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; log_format compression '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" "$gzip_ratio"'; sendfile on; keepalive_timeout 65; server { listen 8000; gzip on; access_log /data/log/nginx/nginx-access.log compression; location /CenterApi/ { proxy_pass http://ana-web-center:8000/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header HTTP_X_FORWARDED_FOR $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect default; # 指定允许跨域的方法，*代表所有 add_header Access-Control-Allow-Methods *; # 预检命令的缓存，如果不缓存每次会发送两次请求 add_header Access-Control-Max-Age 3600; # 带 cookie 请求需要加上这个字段，并设置为 true add_header Access-Control-Allow-Credentials true; # 表示允许这个域跨域调用（客户端发送请求的域名和端口） # $http_origin 动态获取请求客户端请求的域 不用*的原因是带 cookie 的请求不支持*号 add_header Access-Control-Allow-Origin $http_origin; # 表示请求头的字段 动态获取 add_header Access-Control-Allow-Headers $http_access_control_request_headers; } ## log 日志对应参数 $remote_addr ------- 172.19.1.1 proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header HTTP_X_FORWARDED_FOR $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect default; web 端服务获取的 headers <CIMultiDictProxy('Host': 'xxx.xx.xxx.xx', 'X-Real-IP': '172.19.1.1', 'X-Forwarded-For': '172.19.1.1', 'HTTP_X_FORWARDED_FOR': '172.19.1.1', 'X-Forwarded-Proto': 'http', 'Connection': 'close', 'User-Agent': 'Apache-HttpClient/4.5.5 (Java/1.8.0_181)', 'Accept-Encoding': 'gzip,deflate')> 查了挺多解决方案 0.0 说是改容器网络模式为->host 现在环境是在 tencent 的容器服务 改 yaml 说不支持,而且我看配置模式也仅有映射 大手子们给点灵感 0.0,难道只有在集群网络内搞个主机装个 nginx 做分发,不能用 docker 么