Running the container of Rancher in local Docker Desktop, but it is not accessible on localhost:80 or :443

Question

I am new in Rancher. My purpose of using it is to manage a k8s cluster.

I am using MacBook Pro with M2 chip. I would like to run Rancher container on my Docker Desktop environment.

So, I followed the quick-start guide to spin up the Rancher container, based on the guide, I only need to run the following command on my laptop:

$ sudo docker run --privileged -d --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher

I can see the container is running successfully:

 ~ docker ps
CONTAINER ID   IMAGE             COMMAND           CREATED        STATUS        PORTS                                      NAMES
871b54fb1003   rancher/rancher   "entrypoint.sh"   1 hours ago   Up 1 hours   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   youthful_villani

But when I try to access http://localhost:80 or https://localhost , there is no response:

Why is that? What am I missing to spin up Rancher in my local environment?

The logs of the container:

...

2023-05-09 11:04:44 2023/05/09 08:04:44 [INFO] dynamic schema for kontainerdriver azurekubernetesservice updating
2023-05-09 11:04:45 2023/05/09 08:04:45 [INFO] Refreshing driverMetadata in 1440 minutes
2023-05-09 11:04:45 2023/05/09 08:04:45 [INFO] getReleaseConfig: reloading config for k3s
2023-05-09 11:04:45 2023/05/09 08:04:45 [INFO] getReleaseConfig: reloading config for rke2
2023-05-09 11:04:46 2023/05/09 08:04:46 [INFO] driverMetadata: refreshing data from upstream https://releases.rancher.com/kontainer-driver-metadata/dev-v2.7/data.json
2023-05-09 11:04:46 2023/05/09 08:04:46 [INFO] Retrieve data.json from local path /var/lib/rancher-data/driver-metadata/data.json
2023-05-09 11:04:48 2023/05/09 08:04:48 [INFO] Loaded configuration from https://releases.rancher.com/kontainer-driver-metadata/dev-v2.7/data.json in [0x70202b0]
2023-05-09 11:04:48 2023/05/09 08:04:48 [INFO] Loaded configuration from https://releases.rancher.com/kontainer-driver-metadata/dev-v2.7/data.json in [0x70202b0]
2023-05-09 11:04:48 2023/05/09 08:04:48 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-system
2023-05-09 11:04:48 2023/05/09 08:04:48 [ERROR] namespaceHandler: Sync: error adding project id label to namespace err=Operation cannot be fulfilled on namespaces "cattle-fleet-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:04:48 2023/05/09 08:04:48 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:04:48 2023/05/09 08:04:48 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-system
2023-05-09 11:04:48 2023/05/09 08:04:48 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:04:48 2023/05/09 08:04:48 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:17 2023/05/09 08:05:17 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-clusters-system
2023-05-09 11:05:17 2023/05/09 08:05:17 [ERROR] namespaceHandler: Sync: error adding project id label to namespace err=Operation cannot be fulfilled on namespaces "cattle-fleet-clusters-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:17 2023/05/09 08:05:17 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-clusters-system
2023-05-09 11:05:17 2023/05/09 08:05:17 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-clusters-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-clusters-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=BundleDeployment
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=BundleNamespaceMapping
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=ClusterGroup
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for gitjob.cattle.io/v1, Kind=GitJob
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=ClusterRegistration
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=GitRepo
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=Content
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=GitRepoRestriction
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=ClusterRegistrationToken
2023-05-09 11:05:25 2023/05/09 08:05:25 [INFO] Watching metadata for fleet.cattle.io/v1alpha1, Kind=ImageScan
2023-05-09 11:05:36 2023/05/09 08:05:36 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cluster-fleet-local-local-1a3d67d0a899
2023-05-09 11:05:36 2023/05/09 08:05:36 [ERROR] namespaceHandler: Sync: error adding project id label to namespace err=Operation cannot be fulfilled on namespaces "cluster-fleet-local-local-1a3d67d0a899": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:36 2023/05/09 08:05:36 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cluster-fleet-local-local-1a3d67d0a899
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-local-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-local-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:40 2023/05/09 08:05:40 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-local-system
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] namespaceHandler: Sync: error adding project id label to namespace err=Operation cannot be fulfilled on namespaces "cattle-fleet-local-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:40 2023/05/09 08:05:40 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-local-system
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] namespaceHandler: Sync: error adding project id label to namespace err=Operation cannot be fulfilled on namespaces "cattle-fleet-local-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-local-system, err=Operation cannot be fulfilled on namespaces "cattle-fleet-local-system": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:40 2023/05/09 08:05:40 [INFO] namespaceHandler: addProjectIDLabelToNamespace: adding label field.cattle.io/projectId=p-k2flm to namespace=cattle-fleet-local-system
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] defaultSvcAccountHandler: error updating default service account flag for namespace: cattle-fleet-local-system, err=Operation cannot be fulfilled on serviceaccounts "default": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:40 2023/05/09 08:05:40 [ERROR] defaultSvcAccountHandler: Sync: error handling default ServiceAccount of namespace key=cattle-fleet-local-system, err=Operation cannot be fulfilled on serviceaccounts "default": the object has been modified; please apply your changes to the latest version and try again
2023-05-09 11:05:53 2023/05/09 08:05:53 [ERROR] error syncing 'local': handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:53 2023/05/09 08:05:53 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:53 2023/05/09 08:05:53 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:54 2023/05/09 08:05:54 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:54 2023/05/09 08:05:54 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:55 2023/05/09 08:05:55 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:05:56 2023/05/09 08:05:56 [ERROR] error syncing 'local': handler cluster-stats: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", handler cluster-secret-migrator: Internal error occurred: failed calling webhook "rancher.cattle.io.clusters.management.cattle.io": failed to call webhook: Post "https://rancher-webhook.cattle-system.svc:443/v1/webhook/mutation/clusters.management.cattle.io?timeout=10s": no endpoints available for service "rancher-webhook", requeuing
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] starting duplicate binding cleanup
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] starting bindings cleanup
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] total PRTB duplicate clusterRoleBindings 0, roleBindings 0
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] binding with deterministic name not found, will delete all except the oldest binding
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] binding with deterministic name not found, will delete all except the oldest binding
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] binding with deterministic name not found, will delete all except the oldest binding
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] binding with deterministic name not found, will delete all except the oldest binding
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] [clean-dupe-bindings] total CRTB duplicate clusterRoleBindings 0, roleBindings 0
2023-05-09 11:07:22 2023/05/09 08:07:22 [INFO] successfully cleaned up duplicate bindings

Run curl http://localhost:80 -v on my local laptop shows this:

 ~ curl http://localhost:80 -v
*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80 (#0)
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/7.84.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Content-Type: text/html; charset=utf-8
< Location: https://localhost/
< Date: Wed, 10 May 2023 19:52:32 GMT
< Content-Length: 41
<
<a href="https://localhost/">Found</a>.

* Connection #0 to host localhost left intact

Answer 1

Rancher is creating a self-signed certificate as described here:

If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.

curl is working to port 80, and redirecting to port 443.

The reason your browser and curl are failing on port 443 is that it is self-signed. If you install openssl client, you can see the details of the certificate Rancher generates:

$ openssl s_client -showcerts -connect localhost:443 </dev/null
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
verify return:1
depth=0 O = dynamic, CN = dynamic
verify return:1
---
Certificate chain
 0 s:O = dynamic, CN = dynamic
   i:O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256
   v:NotBefore: May 18 22:23:22 2023 GMT; NotAfter: May 17 22:23:22 2024 GMT
-----BEGIN CERTIFICATE-----
MIIB4jCCAYigAwIBAgIITJ16Q9J0tsEwCgYIKoZIzj0EAwIwRjEcMBoGA1UEChMT
ZHluYW1pY2xpc3RlbmVyLW9yZzEmMCQGA1UEAwwdZHluYW1pY2xpc3RlbmVyLWNh
QDE2ODQ0NDg2MDIwHhcNMjMwNTE4MjIyMzIyWhcNMjQwNTE3MjIyMzIyWjAkMRAw
DgYDVQQKEwdkeW5hbWljMRAwDgYDVQQDEwdkeW5hbWljMFkwEwYHKoZIzj0CAQYI
KoZIzj0DAQcDQgAE1aULzZ0Q5zM7xLG5tzGbT1+LHzCtI8F0aCeblMPNeOWsLuT5
vY3UVAmTxfH8Iy6WAs1Jy80WuPMDUgOv7U4V+6OBgTB/MA4GA1UdDwEB/wQEAwIF
oDATBgNVHSUEDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSdqwGht3ZObJFQ/Hh1
5r2QmcevVzA3BgNVHREEMDAugglsb2NhbGhvc3SCFXJhbmNoZXIuY2F0dGxlLXN5
c3RlbYcEfwAAAYcErBEAAjAKBggqhkjOPQQDAgNIADBFAiEA7apWSVx6vms+watF
Zv06lINfcqFQWdVhO2zjMs8acOcCIHBs063AFSefJ0rtFpM7dRnaYTmiaaMKwZCm
Q24KwGuK
-----END CERTIFICATE-----
 1 s:O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
   i:O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256
   v:NotBefore: May 18 22:23:22 2023 GMT; NotAfter: May 15 22:23:22 2033 GMT
-----BEGIN CERTIFICATE-----
MIIBvTCCAWOgAwIBAgIBADAKBggqhkjOPQQDAjBGMRwwGgYDVQQKExNkeW5hbWlj
bGlzdGVuZXItb3JnMSYwJAYDVQQDDB1keW5hbWljbGlzdGVuZXItY2FAMTY4NDQ0
ODYwMjAeFw0yMzA1MTgyMjIzMjJaFw0zMzA1MTUyMjIzMjJaMEYxHDAaBgNVBAoT
E2R5bmFtaWNsaXN0ZW5lci1vcmcxJjAkBgNVBAMMHWR5bmFtaWNsaXN0ZW5lci1j
YUAxNjg0NDQ4NjAyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEozn6cICcm961
nqhLoHDRkG2/AoEyLZDtGta7F+zzC549qBMFoN32nKmJi1+kvVaISm0fVI1QHKBT
PPAHiarNN6NCMEAwDgYDVR0PAQH/BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYD
VR0OBBYEFJ2rAaG3dk5skVD8eHXmvZCZx69XMAoGCCqGSM49BAMCA0gAMEUCIDOA
QDBPccCrMJXOvqeeF0jERO89XvYNZlafMd9RjIYZAiEAnu9qHLHml98ZXlJNZjp5
fAZ3arpaRgGOD/9NKphdN6c=
-----END CERTIFICATE-----
---
Server certificate
subject=O = dynamic, CN = dynamic
issuer=O = dynamiclistener-org, CN = dynamiclistener-ca@1684448602
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1295 bytes and written 357 bytes
Verification error: self-signed certificate in certificate chain
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 19 (self-signed certificate in certificate chain)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: 7BEE259FCEA7E9AF64D0DE768AD00B444CE27CFA67054D1E804E56AC9071E938
    Session-ID-ctx: 
    Resumption PSK: A74FF6D8CA135B2B73A05820C8C7E3F4BF70A4B3944B035D3D3C2431DD1C9CF9
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 604800 (seconds)
    TLS session ticket:
    0000 - a1 a1 88 fc a0 73 2d b8-82 97 80 a9 4c 09 39 fc   .....s-.....L.9.
    0010 - e4 f3 7a ce 5a 46 da 78-c2 9d c0 c6 87 96 f9 90   ..z.ZF.x........
    0020 - e4 5a 33 b9 7e c9 d5 53-52 43 c0 fb aa 3b b5 67   .Z3.~..SRC...;.g
    0030 - 48 23 25 20 8b b1 99 aa-e2 a6 16 11 cb fd a8 5e   H#% ...........^
    0040 - 4c 2c da 80 90 17 aa 27-3b e3 2b e9 c5 a0 77 1e   L,.....';.+...w.
    0050 - 07 df ea 45 1e 5a 39 44-d4 04 2c 88 39 9c ee 91   ...E.Z9D..,.9...
    0060 - 36 40 e0 71 1e 98 75 4b-8b 9d 65 c7 4c 4b 7a 74   6@.q..uK..e.LKzt
    0070 - c8                                                .

    Start Time: 1684448659
    Timeout   : 7200 (sec)
    Verify return code: 19 (self-signed certificate in certificate chain)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
DONE

Here verify return:1 means my system does not trust this certificate.

The solution is to either trust the certificate authority that Rancher uses to automatically generate a certificate, both at the OS level and the browser level.

Alternatively, you can generate your own self-signed certificate, trust that on your machine and browser, and then bind it to the container.

A separate issue is Chrome(?) does not appear to be displaying the correct error page. This could be caused by a number of issues, most of which shouldn't apply to localhost, however. I would recommend deleting all cached content or using a separate profile to have a clean slate to work with.

Answer 2

The possibile issues may be multiple:

• you've set a proxy. Check it for example with scutil --proxy
• you're using a VPN
• you're using IPV6. Since you're running on MacOS and some MacOS services use IPV6. maybe you're using IPV6 and you need to disable it. On the terminale type networksetup -setv6off Ethernet to disable IPv6 for ethernet or networksetup -setv6off Wi-Fi for wireless network.