21

I have created one service and exposed it to run only on localhost in one of my docker swarm node but I can access the service publicly too easily.

I have deleted and redeployed the docker stack but still same issue.

Here is my docker-compose.yml I have used to deploy the service in stack

version: "3"
networks:
    api-net:
        ipam:
            config:
                - subnet: 10.0.10.0/24

services:
    health-api:
        image: myprivateregistry:5000/healthapi:qa
        ports:
            - "127.0.0.1:9010:9010"
        networks:
            - api-net
        depends_on:
            - config-server
        deploy:
            mode: replicated
            replicas: 1
            placement:
                constraints:
                    - node.role == manager

I haven't added the service on which it depends as I don't think that is the problem.

Few says its not supported in docker swarm mode. Than what is solution in that case.

4
  • I have exactly the same issue with Swarm mode. Commented Jun 1, 2018 at 12:44
  • edit: @gesellix's answer is correct, for some reason initially it seemed to be only bound to localhost, but it actually is available on all host interfaces unfortunately. Commented Jun 1, 2018 at 13:04
  • @Dmitri it is not supported in swarm mode. Commented Jun 6, 2018 at 6:19
  • similar to stackoverflow.com/questions/43653699/…
    – db80
    Commented Jun 12, 2018 at 13:49

1 Answer 1

12
+25

Quoting https://github.com/moby/moby/issues/32299#issuecomment-290978794:

On swarm mode, if you publish something (ports for stack deploy), it is published on the ingress network, and thus it is public. There is a few ways to get around, but putting kind/bug on that because we should at least warn people about that when doing a stack deploy with ports that have this notation (i.e. host:port:port).

To work around this, there is a few ways:

  • first, you should publish mongo ports only if you want it to be public, otherwise, it is available through the name discovery bundle in docker (another container/service on the same network will be able to reach it through mongo dns name).
  • If you want to publish it in the host and not in ingress (so not swarm public, just on the host it is running, same way as without swarm mode), you need to use ports expanded syntax.

ports:
  - mode: host
    target: 80
    published: 9005

So, the reason is Swarm's ingress network, which makes every port publicly available. The workaround using the extended syntax doesn't bind to the loopback interface, but to the host's 0.0.0.0 interface, which is still an improvement compared to an externally exposed port via the ingress network.

2
  • no longer works. maybe you have some updates? Commented Jun 21, 2024 at 11:45
  • I'm not sure what you mean with "no longer works". Can you elaborate if your issue is related to the original question?
    – gesellix
    Commented Jun 21, 2024 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.