2

It is possible to docker-compose to forward a port to the container from localhost only, by writing the desired ports configure in docker-compose.yml, e.g. 127.0.0.1:8080:80.

In docker swarm this does not work and the published port is visible from the internet.

How then can I access the container port only from localhost without opening the port to the internet?

I tried configuring iptables to deny connection to port iptables -A INPUT -p tcp --dport 5432 -j DROP, but because of the settings from docker for iptables, that didn't work.

3
  • Seems like this wouldn't be likely to be a feature in docker swarm since each host would have a different IP. Are you combining docker and non-docker resources? If it is just docker, you don't have to publish the port to use it. Just set up an internal network.
    – Peter Turner
    Feb 21, 2022 at 15:38
  • @PeterTurner I want to access postgres, which is running in swarm, from my computer in ValentinaStudio) Previously with docker-compose this was possible. After I switched to swarm I'm looking for an alternative to this method
    – Олег
    Feb 21, 2022 at 16:38
  • OK - it makes sense that it's possible with docker-compose, it seems like it wouldn't make sense to be possible with docker-swarm, since the purpose for the program is a distributed application. Your iptables command would work, if you used -I instead of -A
    – Peter Turner
    Feb 21, 2022 at 16:46

1 Answer 1

2

The container can be accessed via the ip which belongs to the docker_gwbridge interface.

I was able to find out the ip address of the container on the docker_gwbridge interface by running the ifconfig command in the container itself:

$ docker exec <container-id> ifconfig

This way the container can be accessed from host machine for example by 172.18.0.2:5432, without having to publish port 5432.


Trying to find out the ip address via docker inspect <container-id> (or <service-name> or <network-id>) in swarm services did not lead to the desired result, because the ip from the docker_gwbridge interface was not displayed there. And the "internal" ip (something like 10.0.4.6) was not available from host machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.