How to properly expose/publish network ports for an ACAP application?

[jooshal]

Hello,

I'd like to put a simple TCP server socket listening at a pre-defined port for incoming connections in my Docker/ACAP application running in the camera. This would facilitate an exchange of messages between a PC and a camera. However, I'm unable to establish a connection to my ACAP app from my PC (a test script runs there) as the connection to the specified port number gets refused (at the PC's point of view). The camera is in the same subnet with my PC. Next I'll explain in more details my app and testing setup.

My App

Regarding my containerized app, I have created an ACAP/EAP project in C++ that combines features from the object detection sample project (1) and the containerization example (2).

1. https://github.com/AxisCommunications/acap-computer-vision-sdk-examples/tree/main/object-detector-cpp
2. https://github.com/AxisCommunications/acap-native-sdk-examples/tree/main/container-example

I'm able to build an EAP file, then upload it to the camera, and once completed I can start the EAP/app from the Apps tab in the web GUI. My app is built with ACAP Computer Vision SDK v1.5 and Ubuntu Runtime at 22.04, while Docker Daemon with Compose app is v1.2.5. The camera model is an Axis Q1656 with firmware 11.1.65.

My (simplified) docker-compose.yml looks like the following:

version: '3.3'
services:
  object-detector:
    image: ${APP_NAME}
    command: /usr/bin/objdetector /models/server.pem
    depends_on:
      - acap-models
      - inference-server
    ipc: host
    environment:
      - APPDATA_SERVER_ADDRESS=127.0.0.1:9922
      - INFERENCE_HOST=unix:///tmp/acap-runtime.sock
      - INFERENCE_PORT=0
      - MODEL_PATH=${MODEL_PATH}
    ports:
      ##- "9922:9922"          ## this and different ports tried, no success
      ##- "127.0.0.1:9922:9922"    ## tried, no success
      - target: 9922
        host_ip: 0.0.0.0           ## tried 127.0.0.1
        published: 9922
        protocol: tcp
        mode: host
    volumes:
      - /usr/lib/libvdostream.so.1:/usr/lib/libvdostream.so.1
      - acap_models_vol:/models:ro
      - /var/run/dbus:/var/run/dbus:rw
      - inference-server:/tmp

  inference-server:
    image: ${INFERENCE_SERVER_IMAGE}
    entrypoint: ["/opt/app/acap_runtime/acapruntime", "-m", "${MODEL_PATH}", "-j", "${INFERENCE_CHIP}", "-c", "/models/server.pem", "-k", "/models/server.key"]
    depends_on:
      - acap-models
    ipc: host
    volumes:
      - /usr/acap-root/lib:/host/lib
      - acap_models_vol:/models:ro
      - /run/dbus/system_bus_socket:/run/dbus/system_bus_socket
      - /run/parhand/parhandsocket:/run/parhand/parhandsocket
      - /usr/lib:/usr/lib
      - /usr/bin:/usr/bin
      - inference-server:/tmp

  acap-models:
    image: ${MODEL_NAME}
    volumes:
      - acap_models_vol:/models

volumes:
  acap_models_vol: {}
  inference-server: {}

The environment variable APPDATA_SERVER_ADDRESS provides an address which my container app uses for binding a socket (see below for the sample code) to a port. Under ports group, I've tried both the shown 0.0.0.0 as well as 127.0.0.1 and "localhost" to set host_ip, without success. I also tried to define "9922:9922" (and different ports) as a short form under ports group without success.

The desired server functionality in my container app implementation relies on the Poco library, the following shows some of the main logic in a simplified form:

.. in the construction phase ..
myServerSocket = std::make_unique<Poco::Net::ServerSocket>();
myServerSocket->bind(Poco::Net::SocketAddress(myServerAddress));
myServerSocket->listen();

.. and later in the execution ..
while (!StopRequested)
{
    if (myServerSocket->poll(Poco::Timespan(std::chrono::microseconds(PollSpan)),
                             Poco::Net::Socket::SELECT_READ /*| Poco::Net::Socket::SELECT_WRITE*/))
    {
        // Execution never arrives here due to the socket problems
        Poco::Net::StreamSocket clientSocket = myServerSocket->acceptConnection();
        ...
    }
    else
    {
        // socket not yet ready, wait in a sleep
    }
}

Poco library version is 1.12.4. The parameter APPDATA_SERVER_ADDRESS seen in docker-compose.yml is read to initialize here myServerAddress which is then used to bind an address and a port. When I'm using 127.0.0.1:9922 for myServerAddress, socket binding seems to succeed, but if I tried to use camera's external IP (192.168.x.x:9922) for myServerAddress, an exception gets thrown from the bind() method.

Testing

Simultaneously while my Docker app runs in the camera, on my Windows command prompt I'll start a simple Python script that tries to establish a connection to the IP and port where my Docker app is (should be) awaiting. The script works like this, python tcp_client.py --ip 192.168.x.x --port 9922 where args.ip takes the camera's (external) IP address 192.168.x.x and port number args.port is specified as 9922:

import socket
if __name__ == "__main__":
    args = parser.parse_args()
    connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connection.connect((args.ip, args.port))

Almost immediately (a couple of seconds after start) appears the ConnectionRefusedError printout:

Traceback (most recent call last):
  File "tcp_client.py", line 27, in <module>
    connection.connect((args.ip, args.port))
ConnectionRefusedError: [WinError 10061] No connection could be made because the target machine actively refused it

There's one thing that works but it requires changing the roles of the app and the PC. I have another testing mode in my container app where it takes the initiative to connect to an external client (which is my PC running a test script awaiting connections):

myClientSocket = std::make_unique<Poco::Net::StreamSocket>();
myClientSocket->connect(Poco::Net::SocketAddress(myClientAddress));  // This call blocks until a connection is established

In this way I've managed to establish a connection from the camera to the PC. This setup requires that the docker-compose.yml defines open ports (like 9922:9922) and myClientAddress is set for PC's external IP address (192.168.y.y:9922) where a listener awaits. However, this doesn't help me since it's the other way around of socket communications that I want to succeed in. But I do wonder, why it's so easy to start/establish the connection this way but not the another? The socket class (C++) from Poco is different but I'm not so sure it explains the difference, as I believe that I'm using Poco::Net::ServerSocket correctly.

Relevant Docker documentation

As you see above, I've tried a few things and I wonder if the reason for this refusal error could be that the container application does not really have open ports to the outside world. Docker has following documentation:
https://docs.docker.com/config/containers/container-networking/#published-ports

"By default, when you create or run a container using docker create or docker run, it does not publish any of its ports to the outside world. To make a port available to services outside of Docker, or to Docker containers which are not connected to the container’s network, use the --publish or -p flag."

There's another piece of Docker documentation that informs the following:

"docker-compose run ignores ports unless you include --service-ports"
https://docs.docker.com/compose/compose-file/compose-file-v3/#ports

When my ACAP app is running in the camera, I can see some port information by executing docker -H tcp://192.168.x.x:2375 ps.
Interestingly, it does show the seemingly correct port numbers there (in this particular test I enabled both 9922 and 9944 ports).

Questions

Based on the given information, is this enough of a proof that the ports setup of the docker-compose.yml is working correctly? Or could it be that my ACAP app is still not exposing ports from the container's firewall for incoming traffic properly (see the referenced Docker documentation)? What else I could try out? Would it help to get an interactive access to the live container via docker exec -it .. and execute some query?

[jooshal]

Hi, it seems like I found a solution after all to this connectivity problem. The problem was indeed in my docker-compose.yml at this position:

The socket started working when I changed the highlighted address to 0.0.0.0:9922. Likely the port(s) was correctly published already before, but the socket was not listening the right network interface (or something like that).