请教一个问题docker生产部署生成图片的时候不显示出来 #4351

baihuyan · 2024-09-26T05:32:50Z

baihuyan
Sep 26, 2024

📦 Environment

Docker

📌 Version

docker version 26.0.1, build d260a54

💻 Operating System

Other Linux

🌐 Browser

Chrome

🐛 Bug Description

在生成图片的时候无法显示，日志有



这是为什么呢，其他功能都是正常的，就是无法用生成图片到minio里面，图片链接都出来了可以看到

📷 Recurrence Steps

No response

🚦 Expected Behavior

No response

📝 Additional Information

No response

Answered by arvinxx

Oct 13, 2024

@baihuyan 目前我们的 Dall·e 实现里，会有一步去下载生成的图片（因为 Dall·e 生成的图片默认的过期时间就 1~2 小时），我们会走 /webapi/proxy接口拿到图片 base64，由于安全原因( GHSA-mxhq-xw3g-rphc 、 GHSA-3fc8-2r3f-8wrg )，在过 proxy 的时候会检查 dns 是否是内网 ip ，避免出现 SSRF 攻击。

你遇到的问题应该是属于 dns 解析把微软那个地址当成内网 ip 了，看看有没有啥配置可以处理的

View full answer

lobehubbot · 2024-09-26T05:33:03Z

lobehubbot
Sep 26, 2024
Maintainer

👀 @baihuyan

Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible.
Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。请确保您已经提供了尽可能多的背景信息。

0 replies

@baihuyan · 2024-09-26T05:36:00Z

dosubot[bot]
bot Sep 26, 2024

@baihuyan 你好！我是Dosu，一个能帮你解决bug、回答问题并成为贡献者的机器人。我会在等待人类维护者的时候帮助你。期待和你一起解决问题！🤖

I found a similar unsolved discussion and two closed issues that might be relevant to your problem:

Unsolved Discussion:
- 插件“哔哩哔哩”输出的图片是损坏的 ^[1].
Closed Issues:
- 部分图片无法在通过域名访问时加载 ^[2].
  - Suggested solution: Change the domain to something other than .top.
- 无法显示图片 ^[3].

The issue you're experiencing with images not displaying in your Docker production deployment is likely due to a DNS lookup failure. This can be resolved by fixing the /etc/resolv.conf edit permission in the Docker image. This fix is mentioned in the changelog:

#### What's fixed

- **misc**: Fix `/etc/resolv.conf` edit permission in docker image, closes [#3880](https://github.com/lobehub/lobe-chat/issues/3880) ([fdaa190](https://github.com/lobehub/lobe-chat/commit/fdaa190))

Additionally, ensure that your Docker Compose configuration includes the necessary network settings to handle DNS resolution properly. Here is an example configuration:

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${CASDOOR_PORT}:${CASDOOR_PORT}' # Casdoor
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network

  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './data:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:${LOBE_PORT}'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"

  casdoor:
    image: casbin/casdoor
    container_name: lobe-casdoor
    entrypoint: /bin/sh -c './server --createDatabase=true'
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: "postgres"
      dataSourceName: "user=postgres password=${POSTGRES_PASSWORD} host=postgresql port=5432 sslmode=disable dbname=casdoor"
      origin: "http://localhost:${CASDOOR_PORT}"
      runmode: "dev"
    volumes:
      - ./init_data.json:/init_data.json

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      casdoor:
        condition: service_started

    environment:
      - 'APP_URL=http://localhost:3210'
      - 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
      - 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
      - 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
      - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
      - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
      - 'S3_ENABLE_PATH_STYLE=1'
      - 'LLM_VISION_IMAGE_USE_BASE64=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

Ensure that your Docker Compose file includes these configurations to resolve the DNS lookup failure and allow the image to display correctly ^[4]^[5]^[6].

To continue talking to Dosu, mention @dosu.

0 replies

baihuyan · 2024-09-26T06:14:04Z

baihuyan
Sep 26, 2024
Author

@baihuyan 你好！我是Dosu，一个能帮你解决bug、回答问题并成为贡献者的机器人。我会在等待人类维护者的时候帮助你。期待和你一起解决问题！🤖

我发现了一个类似的未解决的讨论和两个可能与您的问题相关的已关闭问题：

未解决的讨论：
- 插件“哔哩哔哩”输出的图片是损坏的 [1].
已关闭的问题：
- 部分图片无法在通过域名访问时加载 [2].
  - 建议的解决方法：将域更改为 ..top
- 无法显示图片 [3].

您遇到的映像未显示在 Docker 生产部署中的问题可能是由于 DNS 查找失败造成的。这可以通过修复 Docker 镜像中的编辑权限来解决。此修复在 changelog 中提到：/etc/resolv.conf

#### What's fixed

- **misc**: Fix `/etc/resolv.conf` edit permission in docker image, closes [#3880](https://github.com/lobehub/lobe-chat/issues/3880) ([fdaa190](https://github.com/lobehub/lobe-chat/commit/fdaa190))

此外，请确保您的 Docker Compose 配置包含必要的网络设置，以正确处理 DNS 解析。下面是一个示例配置：

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${CASDOOR_PORT}:${CASDOOR_PORT}' # Casdoor
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network

  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './data:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:${LOBE_PORT}'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"

  casdoor:
    image: casbin/casdoor
    container_name: lobe-casdoor
    entrypoint: /bin/sh -c './server --createDatabase=true'
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: "postgres"
      dataSourceName: "user=postgres password=${POSTGRES_PASSWORD} host=postgresql port=5432 sslmode=disable dbname=casdoor"
      origin: "http://localhost:${CASDOOR_PORT}"
      runmode: "dev"
    volumes:
      - ./init_data.json:/init_data.json

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      casdoor:
        condition: service_started

    environment:
      - 'APP_URL=http://localhost:3210'
      - 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
      - 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
      - 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
      - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
      - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
      - 'S3_ENABLE_PATH_STYLE=1'
      - 'LLM_VISION_IMAGE_USE_BASE64=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

确保您的 Docker Compose 文件包含这些配置，以解决 DNS 查找失败并允许映像正确显示[4][5][6].

要继续与 Dosu 交谈，请提及。

你好我的域名不是.top是 .com的，然后lobechat的版本是v1.19.32，还是不能显示图片呀

0 replies

lobehubbot · 2024-09-26T06:14:17Z

lobehubbot
Sep 26, 2024
Maintainer

Hello, my domain name is not .top but .com, and the version of lobechat is v1.19.32, but it still cannot display pictures.

0 replies

BiFangKNT · 2024-09-26T08:02:19Z

BiFangKNT
Sep 26, 2024

@baihuyan 你好！我是Dosu，一个能帮你解决bug、回答问题并成为贡献者的机器人。我会在等待人类维护者的时候帮助你。期待和你一起解决问题！🤖
我发现了一个类似的未解决的讨论和两个可能与您的问题相关的已关闭问题：

未解决的讨论：
- 插件“哔哩哔哩”输出的图片是损坏的 [1].
已关闭的问题：
- 部分图片无法在通过域名访问时加载 [2].
  - 建议的解决方法：将域更改为 ..top
- 无法显示图片 [3].

您遇到的映像未显示在 Docker 生产部署中的问题可能是由于 DNS 查找失败造成的。这可以通过修复 Docker 镜像中的编辑权限来解决。此修复在 changelog 中提到：/etc/resolv.conf

#### What's fixed

- **misc**: Fix `/etc/resolv.conf` edit permission in docker image, closes [#3880](https://github.com/lobehub/lobe-chat/issues/3880) ([fdaa190](https://github.com/lobehub/lobe-chat/commit/fdaa190))

此外，请确保您的 Docker Compose 配置包含必要的网络设置，以正确处理 DNS 解析。下面是一个示例配置：

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${CASDOOR_PORT}:${CASDOOR_PORT}' # Casdoor
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network

  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './data:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:${LOBE_PORT}'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"

  casdoor:
    image: casbin/casdoor
    container_name: lobe-casdoor
    entrypoint: /bin/sh -c './server --createDatabase=true'
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: "postgres"
      dataSourceName: "user=postgres password=${POSTGRES_PASSWORD} host=postgresql port=5432 sslmode=disable dbname=casdoor"
      origin: "http://localhost:${CASDOOR_PORT}"
      runmode: "dev"
    volumes:
      - ./init_data.json:/init_data.json

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      casdoor:
        condition: service_started

    environment:
      - 'APP_URL=http://localhost:3210'
      - 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
      - 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
      - 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
      - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
      - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
      - 'S3_ENABLE_PATH_STYLE=1'
      - 'LLM_VISION_IMAGE_USE_BASE64=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

确保您的 Docker Compose 文件包含这些配置，以解决 DNS 查找失败并允许映像正确显示[4][5][6].
要继续与 Dosu 交谈，请提及。

你好我的域名不是.top是 .com的，然后lobechat的版本是v1.19.32，还是不能显示图片呀

你要在回答中@它，它才会回复你

0 replies

lobehubbot · 2024-09-26T08:02:32Z

lobehubbot
Sep 26, 2024
Maintainer

You have to @ it in the answer and it will reply to you

0 replies

baihuyan · 2024-09-26T08:15:15Z

baihuyan
Sep 26, 2024
Author

@lobehubbot @dosubot @dosu

@baihuyan 你好！我是Dosu，一个能帮你解决bug、回答问题并成为贡献者的机器人。我会在等待人类维护者的时候帮助你。期待和你一起解决问题！🤖

I found a similar unsolved discussion and two closed issues that might be relevant to your problem:

Unsolved Discussion:
- 插件“哔哩哔哩”输出的图片是损坏的 [1].
Closed Issues:
- 部分图片无法在通过域名访问时加载 [2].
  - Suggested solution: Change the domain to something other than ..top
- 无法显示图片 [3].

The issue you're experiencing with images not displaying in your Docker production deployment is likely due to a DNS lookup failure. This can be resolved by fixing the edit permission in the Docker image. This fix is mentioned in the changelog:/etc/resolv.conf

#### What's fixed

- **misc**: Fix `/etc/resolv.conf` edit permission in docker image, closes [#3880](https://github.com/lobehub/lobe-chat/issues/3880) ([fdaa190](https://github.com/lobehub/lobe-chat/commit/fdaa190))

Additionally, ensure that your Docker Compose configuration includes the necessary network settings to handle DNS resolution properly. Here is an example configuration:

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${CASDOOR_PORT}:${CASDOOR_PORT}' # Casdoor
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network

  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './data:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:${LOBE_PORT}'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"

  casdoor:
    image: casbin/casdoor
    container_name: lobe-casdoor
    entrypoint: /bin/sh -c './server --createDatabase=true'
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: "postgres"
      dataSourceName: "user=postgres password=${POSTGRES_PASSWORD} host=postgresql port=5432 sslmode=disable dbname=casdoor"
      origin: "http://localhost:${CASDOOR_PORT}"
      runmode: "dev"
    volumes:
      - ./init_data.json:/init_data.json

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      casdoor:
        condition: service_started

    environment:
      - 'APP_URL=http://localhost:3210'
      - 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
      - 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
      - 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
      - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
      - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
      - 'S3_ENABLE_PATH_STYLE=1'
      - 'LLM_VISION_IMAGE_USE_BASE64=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

Ensure that your Docker Compose file includes these configurations to resolve the DNS lookup failure and allow the image to display correctly [4][5][6].

To continue talking to Dosu, mention @dosu.

@lobehubbot @dosubot @dosu 我的域名不是 .top 而是 .com，lobechat 的版本是 v1.19.32，但还是无法显示图片，报错显示是dns问题reason: DNS lookup 224.0.0.5(family:4, host:oaidalleapiprodscus.blob.core.windows.net) is not allowed. Because, It is private IP address.，图片生成了链接但是无法在lobechat上面显示，也没有上传到minio里面，检查了docker配置变量没有跟你不一样。

0 replies

@dosu · 2024-09-26T08:16:56Z

dosubot[bot]
bot Sep 26, 2024

你的 LobeChat v1.19.32 Docker 部署在使用 .com 域名时无法显示图片，并且显示 DNS 查找错误（224.0.0.5）且无法将图片上传到 MinIO，可能是由于 MinIO 的 CORS 配置不正确导致的。

请确保 MinIO 的 CORS 跨域设置正确配置，以允许来自你的 LobeChat 域名（例如 https://lobe.example.com）的请求。这可以在 MinIO WebUI 中配置，或者通过 Docker Compose 环境变量进行配置。

以下是相关文档中的说明：

<Callout type="warning">
  请记住为 S3 服务提供商配置相应的 CORS 跨域设置，以确保 LobeChat 能够正常访问 S3 服务。

在本文中，你需要允许来自 `https://lobe.example.com` 的跨域请求。这可以在 MinIO WebUI 中的 `Configuration - API - Cors Allow Origin` 下配置，或者在 Docker Compose 中通过 `minio - environment - MINIO_API_CORS_ALLOW_ORIGIN` 配置。

如果你使用第二种方法（也是默认方法）进行配置，则无法在 MinIO WebUI 中进行配置。
</Callout>

此外，请确保 MinIO 存储桶策略正确设置，以允许必要的操作。以下是存储桶策略配置示例：

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:GetBucketLocation"],
      "Resource": ["arn:aws:s3:::lobe"]
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::lobe"],
      "Condition": {
        "StringEquals": {
          "s3:prefix": ["files/*"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
      "Resource": ["arn:aws:s3:::lobe/files/**"]
    }
  ],
  "Version": "2012-10-17"
}

要解决此问题，请执行以下步骤：

确保 MinIO 的 CORS 设置允许来自 https://lobe.example.com 的请求。
验证 Docker Compose 配置中的 MINIO_API_CORS_ALLOW_ORIGIN 环境变量是否正确设置。
在 MinIO 中设置正确的存储桶策略。

在 docker-compose.yml 中的示例配置：

services:
  minio:
    image: minio/minio
    environment:
      MINIO_API_CORS_ALLOW_ORIGIN: "https://lobe.example.com"
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - ./data:/data
    command: server /data

完成这些更改后，重启 LobeChat 服务：

docker compose up -d

这应该能解决 DNS 查找错误，并允许图片正确显示和上传 ^[1]^[2]。

To continue talking to Dosu, mention @dosu.

0 replies

lobehubbot · 2024-09-26T08:17:09Z

lobehubbot
Sep 26, 2024
Maintainer

Your LobeChat v1.19.32 Docker deployment is unable to display images when using a .com domain name and displays a DNS lookup error (224.0.0.5) and fails to upload images to MinIO, possibly due to incorrect CORS configuration for MinIO.

Please make sure MinIO's CORS cross-domain settings are configured correctly to allow requests from your LobeChat domain name (e.g. https://lobe.example.com). This can be configured in the MinIO WebUI or via Docker Compose environment variables.

Here are the instructions from the relevant documentation:

<Callout type="warning">
  Please remember to configure the appropriate CORS cross-domain settings for your S3 service provider to ensure that LobeChat can properly access the S3 service.

In this article, you need to allow cross-origin requests from `https://lobe.example.com`. This can be configured in the MinIO WebUI under `Configuration - API - Cors Allow Origin`, or in Docker Compose via `minio - environment - MINIO_API_CORS_ALLOW_ORIGIN`.

If you configure using the second (and default) method, you cannot configure it in the MinIO WebUI.
</Callout>

Also, make sure the MinIO bucket policy is set correctly to allow the necessary operations. The following is an example bucket policy configuration:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:GetBucketLocation"],
      "Resource": ["arn:aws:s3:::lobe"]
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::lobe"],
      "Condition": {
        "StringEquals": {
          "s3:prefix": ["files/*"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
      "Resource": ["arn:aws:s3:::lobe/files/**"]
    }
  ],
  "Version": "2012-10-17"
}

To resolve this issue, follow these steps:

Make sure MinIO’s CORS settings allow requests from https://lobe.example.com.
Verify that the MINIO_API_CORS_ALLOW_ORIGIN environment variable in the Docker Compose configuration is set correctly.
Set the correct bucket policy in MinIO.

Example configuration in docker-compose.yml:

services:
  minio:
    image: minio/minio
    environment:
      MINIO_API_CORS_ALLOW_ORIGIN: "https://lobe.example.com"
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - ./data:/data
    command: server /data

After completing these changes, restart the LobeChat service:

docker compose up -d

This should resolve the DNS lookup error and allow images to display and upload correctly ^{[[1]](https://github.com/lobehub/lobe-chat/blob/main/docs/self-hosting/server- database/docker-compose.mdx)}^{[[2]](https://github.com/lobehub/lobe-chat/blob/main/docs/self-hosting/server-database/docker -compose.zh-CN.mdx)}.

To continue talking to Dosu, mention @dosu.

0 replies

baihuyan · 2024-09-26T11:34:45Z

baihuyan
Sep 26, 2024
Author

@lobehubbot@dosubot@dosu 您好，设置了MINIO_API_CORS_ALLOW_ORIGIN变量，现在是我用了nginx反代minio9000端口服务好像访问不了，但是9001控制台是没有问题创建桶跟上传文件都没问题，就是在生成的图片无法显示上传

0 replies

lobehubbot · 2024-09-26T11:35:00Z

lobehubbot
Sep 26, 2024
Maintainer

@lobehubbot@dosubot@dosu Hello, I have set the MINIO_API_CORS_ALLOW_ORIGIN variable. Now I use nginx to reverse the minio9000 port service and it seems that it cannot be accessed. However, there is no problem in the 9001 console to create the bucket and upload the file. It is the generated image. Unable to display upload

0 replies

BiFangKNT · 2024-09-26T11:37:28Z

BiFangKNT
Sep 26, 2024

@baihuyan 9000端口是提供api的，没有web页面。

这句没听懂

0 replies

lobehubbot · 2024-09-26T11:37:41Z

lobehubbot
Sep 26, 2024
Maintainer

@baihuyan Port 9000 provides API and does not have a web page.

I didn't understand this sentence

0 replies

BiFangKNT · 2024-09-26T11:39:35Z

BiFangKNT
Sep 26, 2024

@baihuyan 意思是dalle生成的图片既无法显示，也无法保存到minio里吗？这我就不清楚了。

0 replies

lobehubbot · 2024-09-26T11:39:47Z

lobehubbot
Sep 26, 2024
Maintainer

@baihuyan Does it mean that the pictures generated by dalle can neither be displayed nor saved to minio? I don't know this.

0 replies

baihuyan · 2024-09-27T04:19:27Z

baihuyan
Sep 27, 2024
Author

@BiFangKNT 你好非常谢谢，这是我的dockercomposer 和env 还有nginx反代

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${LOGTO_PORT}:${LOGTO_PORT}' # Logto
      - '3002:3002'  # Logto Admin
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network
  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './lobepsqldata:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_DOMAIN=s3api.xxxx.com'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.xxxx.com'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"
      
  logto:
    image: svhd/logto
    container_name: lobe-logto
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      - 'TRUST_PROXY_HEADER=1'
      - 'PORT=${LOGTO_PORT}'
      - 'DB_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/logto'
      - 'ENDPOINT=https://logto.xxxx.com'
      - 'ADMIN_ENDPOINT=https://logtoadmin.xxxxx.com'
    entrypoint: ['sh', '-c', 'npm run cli db seed -- --swe && npm start']

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      logto:
        condition: service_started

    environment:
      - 'APP_URL=https://lobe.xxxx.com'
      - 'NEXT_AUTH_SSO_PROVIDERS=logto'
      - 'NEXT_AUTH_SECRET=xxxx'
      - 'KEY_VAULTS_SECRET=xxxxx'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=https://s3api.xxxx.com'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=https://s3api.xxxx.com'
      - 'S3_ENABLE_PATH_STYLE=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

LOBE_PORT=3210
LOGTO_PORT=3001
MINIO_PORT=9000

# s3api.wujingtech.com 配置文件
server {
    listen 443 ssl;
    server_name s3api.xxxx.com;  # 修改为您的域名

    # SSL 配置
    ssl_certificate /www/server/panel/vhost/cert/s3api/fullchain.pem;  # 证书全链路径
    ssl_certificate_key /www/server/panel/vhost/cert/s3api/privkey.pem;  # 私钥路径

    # 可选的 SSL 进阶配置
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass http://10.0.99.4:9000;
    }
}

# s3ui.wujingtech.com 配置文件
server {
    listen 443 ssl;
    server_name s3ui.xxxx.com;  # 修改为您的域名

    # SSL 配置
    ssl_certificate /www/server/panel/vhost/cert/s3ui/fullchain.pem;  # 证书全链路径
    ssl_certificate_key /www/server/panel/vhost/cert/s3ui/privkey.pem;  # 私钥路径

    # 可选的 SSL 进阶配置
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass http://10.0.99.4:9001;
    }
}

0 replies

lobehubbot · 2024-09-27T04:19:38Z

lobehubbot
Sep 27, 2024
Maintainer

@BiFangKNT 你好非常谢谢，这是我的dockercomposer 和env 还有nginx反代

services:
  network-service:
    image: alpine
    container_name: lobe-network
    ports:
      - '${MINIO_PORT}:${MINIO_PORT}'  # MinIO API
      - '9001:9001'  # MinIO Console
      - '${LOGTO_PORT}:${LOGTO_PORT}' # Logto
      - '3002:3002'  # Logto Admin
      - '${LOBE_PORT}:3210' # LobeChat
    command: tail -f /dev/null
    networks:
      - lobe-network
  postgresql:
    image: pgvector/pgvector:pg16
    container_name: lobe-postgres
    ports:
      - "5432:5432"
    volumes:
      - './lobepsqldata:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_DB=${LOBE_DB_NAME}'
      - 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always
    networks:
      - lobe-network

  minio:
    image: minio/minio
    container_name: lobe-minio
    network_mode: 'service:network-service'
    volumes:
      - './s3_data:/etc/minio/data'
    environment:
      - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
      - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
      - 'MINIO_DOMAIN=s3api.xxxx.com'
      - 'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.xxxx.com'
    restart: always
    command: >
      server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"
      
  logto:
    image: svhd/logto
    container_name: lobe-logto
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      - 'TRUST_PROXY_HEADER=1'
      - 'PORT=${LOGTO_PORT}'
      - 'DB_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/logto'
      - 'ENDPOINT=https://logto.xxxx.com'
      - 'ADMIN_ENDPOINT=https://logtoadmin.xxxxx.com'
    entrypoint: ['sh', '-c', 'npm run cli db seed -- --swe && npm start']

  lobe:
    image: lobehub/lobe-chat-database
    container_name: lobe-database
    network_mode: 'service:network-service'
    depends_on:
      postgresql:
        condition: service_healthy
      network-service:
        condition: service_started
      minio:
        condition: service_started
      logto:
        condition: service_started

    environment:
      - 'APP_URL=https://lobe.xxxx.com'
      - 'NEXT_AUTH_SSO_PROVIDERS=logto'
      - 'NEXT_AUTH_SECRET=xxxx'
      - 'KEY_VAULTS_SECRET=xxxxx'
      - 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
      - 'S3_ENDPOINT=https://s3api.xxxx.com'
      - 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
      - 'S3_PUBLIC_DOMAIN=https://s3api.xxxx.com'
      - 'S3_ENABLE_PATH_STYLE=1'
    env_file:
      - .env
    restart: always

volumes:
  data:
    driver: local
  s3_data:
    driver: local

networks:
  lobe-network:
    driver: bridge

LOBE_PORT=3210
LOGTO_PORT=3001
MINIO_PORT=9000

# s3api.wujingtech.com 配置文件
server {
    listen 443 ssl;
    server_name s3api.xxxx.com;  # 修改为您的域名

    # SSL 配置
    ssl_certificate /www/server/panel/vhost/cert/s3api/fullchain.pem;  # 证书全链路径
    ssl_certificate_key /www/server/panel/vhost/cert/s3api/privkey.pem;  # 私钥路径

    # 可选的 SSL 进阶配置
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass http://10.0.99.4:9000;
    }
}

# s3ui.wujingtech.com 配置文件
server {
    listen 443 ssl;
    server_name s3ui.xxxx.com;  # 修改为您的域名

    # SSL 配置
    ssl_certificate /www/server/panel/vhost/cert/s3ui/fullchain.pem;  # 证书全链路径
    ssl_certificate_key /www/server/panel/vhost/cert/s3ui/privkey.pem;  # 私钥路径

    # 可选的 SSL 进阶配置
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass http://10.0.99.4:9001;
    }
}

0 replies

SpeedupMaster · 2024-09-27T09:01:05Z

SpeedupMaster
Sep 27, 2024

桶策略设置了吗？

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:GetBucketLocation"],
      "Resource": ["arn:aws:s3:::lobe"]
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::lobe"],
      "Condition": {
        "StringEquals": {
          "s3:prefix": ["files/*"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
      "Resource": ["arn:aws:s3:::lobe/files/**"]
    }
  ],
  "Version": "2012-10-17"
}

还有你的.env里MINIO_LOBE_BUCKET这个环境变量好像没设置
- 'S3_BUCKET=${MINIO_LOBE_BUCKET}'

0 replies

baihuyan · 2024-09-27T10:10:12Z

baihuyan
Sep 27, 2024
Author

@SpeedupMaster 你好~这些在我的env都有的，但是刚刚没贴上去，现在上传图片，向量化都没问题，就是DALL3生成的图片无法显示，也没上传到桶里面，报错是I: request to https://oaidalleapiprodscus.blob.core.windows.net/private/org-a4URFFTs0zdjKG3uQxJsHOfI/user-BbyDZiRFcT3RO8boMSpovKki/img-Ko9Y6m8P6tKytAc63BAO9Q7q.png?st=2024-09-27T09%3A03%3A55Z&se=2024-09-27T11%3A03%3A55Z&sp=r&sv=2024-08-04&sr=b&rscd=inline&rsct=image/png&skoid=d505667d-d6c1-4a0a-bac7-5c84a87759f8&sktid=a48cca56-e6da-484e-a814-9c849652bcb3&skt=2024-09-26T23%3A11%3A43Z&ske=2024-09-27T23%3A11%3A43Z&sks=b&skv=2024-08-04&sig=nRMn1OKvIOwZ2NyUhpoNEL8KOgoIGyZak6RmqFJTzB4%3D failed, reason: DNS lookup 224.0.0.8(family:4, host:oaidalleapiprodscus.blob.core.windows.net) is not allowed. Because, It is private IP address. at ClientRequest.<anonymous> (/app/.next/server/app/webapi/proxy/route.js:1:17439) at ClientRequest.emit (node:events:519:28) at emitErrorEvent (node:_http_client:108:11) at TLSSocket.socketErrorListener (node:_http_client:511:5) at TLSSocket.emit (node:events:519:28) at emitErrorNT (node:internal/streams/destroy:169:8) at emitErrorCloseNT (node:internal/streams/destroy:128:3) at process.processTicksAndRejections (node:internal/process/task_queues:82:21) { type: 'system', errno: undefined, code: undefined, erroredSysCall: undefined }

0 replies

baihuyan · 2024-09-27T10:28:54Z

baihuyan
Sep 27, 2024
Author

这个已经存在的文件也在界面打不开是什么原因呢

0 replies

lobehubbot · 2024-09-27T10:29:06Z

lobehubbot
Sep 27, 2024
Maintainer

This already existing file cannot be opened in the interface. Why?

0 replies

SpeedupMaster · 2024-09-27T11:08:44Z

SpeedupMaster
Sep 27, 2024

报错显示私有IP地址，上传的图片，你复制链接，浏览器里能打开吗？

0 replies

BiFangKNT · 2024-09-27T11:23:36Z

BiFangKNT
Sep 27, 2024

dns解析出问题了。错误日志表明，你的请求无法访问 https://oaidalleapiprodscus.blob.core.windows.net，其原因是 DNS 查找了一个私有 IP 地址 224.0.0.8，而该地址被视为不允许访问的私有 IP。

224.0.0.8 是一个多播地址，在网络中通常不用于公共 DNS 解析。请求的目标应该是访问 Azure Blob 存储中的资源，但解析出的 IP 地址属于私有网络。

以下是gpt给出的建议，由于我需要更多信息进行判断，暂时不做推测，你先试试排查一下吧：

问题的焦点可能集中在以下几个方面：

1. MinIO 反向代理与 Docker Compose 的端口配置不一致

在 Docker Compose 中，你设置了 MinIO 使用 ${MINIO_PORT}，即 9000 作为 API 端口。然而在 Nginx 的反向代理配置中，你将 proxy_pass 指向了 10.0.99.4:9000，假设 10.0.99.4 是 MinIO 容器所在的内部 IP 地址。
你还使用了 network_mode: 'service:network-service'，这意味着 MinIO 服务共享 network-service 容器的网络栈，因此它无法独立暴露端口。network-service 自身的端口暴露配置中，只暴露了 ${MINIO_PORT}:${MINIO_PORT}，即 9000:9000。

解决方案：

去掉 network_mode: 'service:network-service'，并显式声明 MinIO 的网络配置，确保它可以暴露端口：

minio:
  image: minio/minio
  container_name: lobe-minio
  ports:
    - '9000:9000'  # MinIO API
    - '9001:9001'  # MinIO Console
  volumes:
    - './s3_data:/etc/minio/data'
  environment:
    - 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
    - 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
    - 'MINIO_DOMAIN=s3api.xxxx.com'
    - 'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.xxxx.com'
  restart: always
  command: >
    server /etc/minio/data --address ":9000" --console-address ":9001"
  networks:
    - lobe-network

在此配置中，你明确暴露了 MinIO 的 API 端口 9000，并通过 Docker 网络 lobe-network 连接。这将确保 MinIO 能够使用 9000 端口并且 Nginx 的反向代理可以通过此端口正确地访问到 MinIO。

2. 反向代理配置检查

根据你的 Nginx 配置，确保 proxy_pass 指向正确的 IP 地址和端口，并且 MinIO 服务可以通过 10.0.99.4:9000 正常访问。

假设你在 Docker Compose 网络中，MinIO 可能使用的是内部容器名称作为主机名，例如 lobe-minio。你可以尝试更新 Nginx 配置，将 proxy_pass 指向 MinIO 容器的主机名而不是 IP 地址：

proxy_pass http://lobe-minio:9000;

这样，Nginx 会通过 Docker DNS 自动解析 lobe-minio 容器的 IP 地址，而无需手动指定。

3. 确保服务间网络连通性

所有服务都应加入同一个网络 lobe-network，以确保 Docker 容器间可以正常通信。在你的 Docker Compose 文件中，network-service 和其他服务的网络配置可能存在冲突。

解决方案：

确保每个服务都连接到同一个 Docker 网络，去掉 network_mode: 'service:network-service'，并在各个服务中显式声明网络：

networks:
  lobe-network:
    driver: bridge

对于每个服务：

networks:
  - lobe-network

4. 环境变量和端口冲突

确认所有服务使用的端口没有冲突。由于你在 Docker Compose 中使用了 ${LOBE_PORT} 等变量，请确保 .env 文件中的这些端口没有被其他服务占用。
例如：
- LOGTO_PORT=3001
- LOBE_PORT=3210
- MINIO_PORT=9000

确保这些端口在宿主机上没有被其他进程占用，否则会导致端口冲突问题。

5. MinIO API 和 CORS 设置

在 MinIO 的环境变量中，你配置了 MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.xxxx.com，这是为跨域请求 (CORS) 设置的。如果你通过浏览器访问 MinIO 的 API，确保该设置匹配前端应用的来源。如果不需要严格的 CORS 限制，可以尝试允许更广泛的来源：

MINIO_API_CORS_ALLOW_ORIGIN=*

6. 健康检查和依赖管理

你已经使用了 depends_on 和 healthcheck 来确保服务的启动顺序。这是正确的做法，但请确保 postgresql 服务已经完全启动并健康后，其他服务才能正常运行。

优化：

考虑在 lobe 和 logto 等服务中增加启动延迟或更严格的依赖检查，以避免因为服务未完全启动而导致的连接失败。

总结

主要问题可能是：

网络模式和端口配置问题：network_mode: 'service:network-service' 导致服务无法正确暴露端口，建议去掉并使用显式网络声明。
Nginx 反向代理：确保 proxy_pass 正确指向 MinIO 的 API 端口，并通过 Docker 网络名而非 IP 地址进行访问。

你可以从这些方面入手来修复配置中的问题。

0 replies

BiFangKNT · 2024-09-27T11:32:13Z

BiFangKNT
Sep 27, 2024

@baihuyan 关于第二项，我是不建议在反代里配置容器名的，因为你现在明显是dns解析有问题，相关的ip需要排查一下，用容器名是顾小而失大。当然，你可以都试试。

0 replies

lobehubbot · 2024-09-27T11:32:24Z

lobehubbot
Sep 27, 2024
Maintainer

@baihuyan Regarding the second item, I don’t recommend configuring the container name in reverse generation, because you obviously have a problem with DNS resolution, and the related IP needs to be checked. Using a container name is a small thing but not a big deal. Of course, you can try them all.

0 replies

BiFangKNT · 2024-09-27T11:54:02Z

BiFangKNT
Sep 27, 2024

@baihuyan

可能原因分析：

DNS 解析错误：
- 容器内 DNS 配置错误，导致外部请求被误认为是私有 IP。Docker 容器在默认情况下会使用 Docker 的内置 DNS 解析系统来解析主机名。
- 如果 Docker 内部的 DNS 服务未能正确解析公共域名（例如 blob.core.windows.net），那么它可能会返回错误的 IP 地址（如你看到的 224.0.0.8 多播地址）。
网络配置问题：
- 你使用了 network_mode: 'service:network-service'，这意味着这些服务共用 network-service 的网络栈。而 network-service 本身并没有做任何实际的服务处理，只是保持运行状态（通过 tail -f /dev/null）。这种网络模式可能限制了 DNS 的正常解析，特别是在多个服务都依赖于相同的网络栈时。
- 由于容器使用了 network_mode，可能限制了容器对外部网络的访问，尤其是像 Azure 这样的公共云服务。
容器网络隔离问题：
- 如果 Docker 网络被过度隔离，例如所有服务都在单独的内部网络中，可能会导致容器无法正确访问外部互联网。这可能也与 Docker 的 bridge 网络模式有关，尤其是如果你没有正确配置容器的 DNS 设置或默认网关。
防火墙或网络策略限制：
- 如果你的服务器上启用了防火墙规则，或者你的 Docker 容器的网络配置限制了对外部 IP 地址或 DNS 的访问，也可能导致这个问题。

解决方案建议：

检查和修改网络模式：
- 去掉 network_mode: 'service:network-service' 并显式为每个服务声明 networks，确保所有服务都在同一个 Docker 网络中，并且网络配置允许它们访问外部网络。
更新后的配置可能如下：
```
minio:
  image: minio/minio
  container_name: lobe-minio
  ports:
    - '9000:9000'
    - '9001:9001'
  networks:
    - lobe-network
```
检查 DNS 解析设置：
- 在 Docker 中显式设置容器的 DNS 服务器，以确保它可以正确解析外部域名。可以通过在 Docker Compose 文件中添加 dns 配置：
```
services:
  lobe:
    ...
    dns:
      - 8.8.8.8  # Google DNS
      - 1.1.1.1  # Cloudflare DNS
```
检查服务器的防火墙和网络策略：
- 确保服务器或 Docker 的防火墙规则不会阻止容器访问外部 DNS 或 Azure Blob Storage。可以使用 ping 或 nslookup 命令在容器内测试 DNS 解析。
检查 .env 文件中网络相关的环境变量：
- 确保 .env 文件中不存在影响容器网络访问的错误配置。你可以检查 MinIO、Lobe 等服务的 APP_URL、S3_ENDPOINT 等配置是否正确指向外部服务。
测试容器的外部访问能力：
- 进入 lobe 容器，使用命令行工具 curl 或 wget 来测试容器是否能够访问外部网络，例如 https://oaidalleapiprodscus.blob.core.windows.net。

总结：

这个报错极有可能是由于容器的 DNS 解析配置问题，或者网络模式（network_mode: 'service:network-service'）限制了容器对外部网络的访问。建议调整网络配置，使各个服务能够独立工作，并确保容器能够正确访问公共 DNS 和外部服务。

0 replies

lobehubbot · 2024-09-27T11:54:15Z

lobehubbot
Sep 27, 2024
Maintainer

@baihuyan

Possible cause analysis:

DNS resolution error:
- DNS configuration error within the container, causing external requests to be mistaken for private IPs. Docker containers by default use Docker's built-in DNS resolution system to resolve hostnames.
- If the DNS service inside Docker fails to correctly resolve public domain names (e.g. blob.core.windows.net), then it may return the wrong IP address (as you see with the 224.0.0.8 multicast address) .
Network configuration problem:
- You used network_mode: 'service:network-service', which means these services share the network stack of network-service. The network-service itself does not do any actual service processing, it just keeps running (through tail -f /dev/null). This network pattern may limit proper DNS resolution, especially if multiple services rely on the same network stack.
- Since the container uses network_mode, it may limit the container's access to external networks, especially public cloud services like Azure.
Container network isolation issues:
- If the Docker network is excessively isolated, such as all services being in separate internal networks, it may prevent the container from properly accessing the external internet. This may also be related to Docker's bridge networking mode, especially if you haven't configured the container's DNS settings or default gateway correctly.
Firewall or network policy restrictions:
- This issue can also be caused if firewall rules are enabled on your server, or if your Docker container's network configuration restricts access to external IP addresses or DNS.

Solution suggestions:

Check and modify network mode:
- Remove network_mode: 'service:network-service' and explicitly declare networks for each service, ensuring that all services are in the same Docker network and that the network configuration allows them to access external networks.
The updated configuration might look like this:
```
minio:
  image: minio/minio
  container_name: lobe-minio
  ports:
    - '9000:9000'
    - '9001:9001'
  networks:
    -lobe-network
```
Check DNS resolution settings:
- Explicitly set the container's DNS server in Docker to ensure it can resolve external domain names correctly. This can be configured by adding dns in the Docker Compose file:
```
services:
  lobe:
    ...
    dns:
      - 8.8.8.8 # Google DNS
      - 1.1.1.1 #Cloudflare DNS
```
Check the server’s firewall and network policies:
- Ensure that the server or Docker's firewall rules do not prevent the container from accessing external DNS or Azure Blob Storage. DNS resolution can be tested within the container using the ping or nslookup commands.
Check the network-related environment variables in the .env file:
- Make sure there are no misconfigurations in the .env file that affect the container's network access. You can check whether the APP_URL, S3_ENDPOINT and other configurations of MinIO, Lobe and other services correctly point to external services.
Test the external access capability of the container:
- Enter the lobe container and use the command line tool curl or wget to test whether the container can access the external network, such as https://oaidalleapiprodscus.blob.core.windows.net.

Summarize:

This error is most likely due to a DNS resolution configuration problem in the container, or the network mode (network_mode: 'service:network-service') restricts the container's access to the external network. It is recommended to adjust the network configuration so that each service can work independently and ensure that the container can correctly access public DNS and external services.

0 replies

BiFangKNT · 2024-09-27T12:01:19Z

BiFangKNT
Sep 27, 2024

@baihuyan 关于dns问题，可以参考这个讨论的最下面 #4058

0 replies

lobehubbot · 2024-09-27T12:01:33Z

lobehubbot
Sep 27, 2024
Maintainer

@baihuyan Regarding the dns issue, you can refer to the bottom of this discussion #4058

0 replies

arvinxx · 2024-10-13T03:33:37Z

arvinxx
Oct 13, 2024
Maintainer

@baihuyan 目前我们的 Dall·e 实现里，会有一步去下载生成的图片（因为 Dall·e 生成的图片默认的过期时间就 1~2 小时），我们会走 /webapi/proxy接口拿到图片 base64，由于安全原因( GHSA-mxhq-xw3g-rphc 、 GHSA-3fc8-2r3f-8wrg )，在过 proxy 的时候会检查 dns 是否是内网 ip ，避免出现 SSRF 攻击。

你遇到的问题应该是属于 dns 解析把微软那个地址当成内网 ip 了，看看有没有啥配置可以处理的

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

请教一个问题docker生产部署生成图片的时候不显示出来 #4351

{{title}}

Replies: 34 comments

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

请教一个问题docker生产部署 生成图片的时候不显示出来 #4351

📦 Environment

📌 Version

💻 Operating System

🌐 Browser

🐛 Bug Description

📷 Recurrence Steps

🚦 Expected Behavior

📝 Additional Information

Replies: 34 comments

lobehubbot Sep 26, 2024 Maintainer

dosubot[bot] bot Sep 26, 2024

baihuyan Sep 26, 2024 Author

lobehubbot Sep 26, 2024 Maintainer

lobehubbot Sep 26, 2024 Maintainer

baihuyan Sep 26, 2024 Author

dosubot[bot] bot Sep 26, 2024

lobehubbot Sep 26, 2024 Maintainer

baihuyan Sep 26, 2024 Author

lobehubbot Sep 26, 2024 Maintainer

lobehubbot Sep 26, 2024 Maintainer

lobehubbot Sep 26, 2024 Maintainer

baihuyan Sep 27, 2024 Author

lobehubbot Sep 27, 2024 Maintainer

baihuyan Sep 27, 2024 Author

baihuyan Sep 27, 2024 Author

lobehubbot Sep 27, 2024 Maintainer

1. MinIO 反向代理与 Docker Compose 的端口配置不一致

解决方案：

2. 反向代理配置检查

3. 确保服务间网络连通性

解决方案：

4. 环境变量和端口冲突

5. MinIO API 和 CORS 设置

6. 健康检查和依赖管理

优化：

总结

lobehubbot Sep 27, 2024 Maintainer

可能原因分析：

解决方案建议：

总结：

lobehubbot Sep 27, 2024 Maintainer

Possible cause analysis:

Solution suggestions:

Summarize:

lobehubbot Sep 27, 2024 Maintainer

arvinxx Oct 13, 2024 Maintainer

请教一个问题docker生产部署生成图片的时候不显示出来 #4351

lobehubbot
Sep 26, 2024
Maintainer

dosubot[bot]
bot Sep 26, 2024

baihuyan
Sep 26, 2024
Author

lobehubbot
Sep 26, 2024
Maintainer

lobehubbot
Sep 26, 2024
Maintainer

baihuyan
Sep 26, 2024
Author

dosubot[bot]
bot Sep 26, 2024

lobehubbot
Sep 26, 2024
Maintainer

baihuyan
Sep 26, 2024
Author

lobehubbot
Sep 26, 2024
Maintainer

lobehubbot
Sep 26, 2024
Maintainer

lobehubbot
Sep 26, 2024
Maintainer

baihuyan
Sep 27, 2024
Author

lobehubbot
Sep 27, 2024
Maintainer

baihuyan
Sep 27, 2024
Author

baihuyan
Sep 27, 2024
Author

lobehubbot
Sep 27, 2024
Maintainer

lobehubbot
Sep 27, 2024
Maintainer

lobehubbot
Sep 27, 2024
Maintainer

lobehubbot
Sep 27, 2024
Maintainer

arvinxx
Oct 13, 2024
Maintainer