无法通过主机上的已发布端口访问 Docker Swarm 服务

Question

I have deployed a Docker Swarm cluster on several machines and I am now trying to access to the server running in Docker from the host.

I use docker compose file to define my service and the exposed port appears when I inspect the service:

"Endpoint": {
        "Spec": {
            "Mode": "vip",
            "Ports": [
                {
                    "Protocol": "tcp",
                    "TargetPort": 27017,
                    "PublishedPort": 3017,
                    "PublishMode": "host"
                }
            ]
        },
        "Ports": [
            {
                "Protocol": "tcp",
                "TargetPort": 27017,
                "PublishedPort": 3017,
                "PublishMode": "host"
            }
        ],
        "VirtualIPs": [
            {
                "NetworkID": "**********",
                "Addr": "10.0.0.34/24"
            }
        ]
    }

I use host mode because the service is constrained to run on a particular machine, and I want it accessible only from this machine.

But when I list the processes listening on ports on the host machine, the port doesn't appear.

And of course I cannot connect to the server from the host through the exposed port.

I am using iptables as firewall and restrains as much as possible the open ports, but the Docker Swarm needed ones are opened.

Here is my docker-compose.yml file:

version: '3.4'
services:
  mongo-router:
    image: mongo
    networks:
      - mongo-cluster
    volumes:
      - db-data-router:/data/db
      - db-config-router:/data/configdb
    ports:
      - target: 27017
        published: 3017
        protocol: tcp
        mode: host
    deploy:
      placement:
        constraints:
          - node.labels.mongo.router == true
    command: mongos --configdb cnf/mongodb-cnf_mongo-cnf-1:27017,mongodb-cnf_mongo-cnf-2:27017,mongodb-cnf_mongo-cnf-3:27017

volumes:
  db-data-router:
  db-config-router:

networks:
  mongo-cluster:
    external: true

The network is an overlay network on which all services are subscribing.

Answer 1

I had a similar issue. After installing hyper-v feature on windows (even though the cpu did not support hyper-v) I was able to access published ports from the host (even in ingress mode).