Disable external node service accessibility in docker swarm

Question

I have a docker swarm with 2 nodes and each node run 2 services in global mode so each node have 2 services running inside it.
My problem is how to force ubuntu service in node1 only connect to mysql service in node1 and dont use round-robin method to select mysql service. so when I connect to mysql from ubuntu in node1 with mysql -hmysql -uroot -p it select only mysql in node1.

here is the docker-compose file which describes my case

version: '3.8'
services:
  mysql:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD: password
    networks:
      app-net: {}
    deploy:
      mode: global
  ubuntu:
    entrypoint: tail -f /dev/null
    deploy:
      mode: global
    image: ubuntu:20.04
    networks:
      app-net: {}
networks:
  app-net: {}

with this docker-compose file inside ubuntu container when I try to connect to mysql it selects mysql service in both nodes with round-robin algorithm. What I try to achieve is to force each service be only visible to the services inside the same node.

score 2 · Accepted Answer · answered Sep 05 '20 at 22:35

I can't think of an easy way to achieve what you want in swarm with an overlay network. However, you can use unix socket instead of network. Just create a volume, mount it both into MySQL and your application, then make MySQL to put its socket onto that volume. Docker will create a volume on each node and thus you'll have your communication closed within node.

If you insist on using network communications, you can mount node's Docker socket into your app container and use it to find name of the container running MySQL on that node. Once you got the name, you can use it to connect to the particular instance of the service. Now, not only it is hard to make, it is also an anti-pattern and a security threat, so I don't recommend you to implement this idea.

At last there is also Kubernetes, where containers inside a pod can communicate with each other via localhost but I think you won't go that far, will you?

I go with your last option took about 3 weekends but I think it worth it. — Kibo, Sep 28 '20 at 13:21

score 0 · Answer 2 · answered Sep 05 '20 at 13:49

0

You should have a look mode=host.

You can bypass the routing mesh, so that when you access the bound port on a given node, you are always accessing the instance of the service running on that node. This is referred to as host mode. There are a few things to keep in mind.

ports:
- target: 80
  published : 8080
  protocol: tcp
  mode: host

answered Sep 05 '20 at 13:49

Cyril G.

1,879
2
5
19

Thanks for your reply. but as noted [here](https://docs.docker.com/compose/compose-file/#network_mode) swarm mode doesn't have this option. – Kibo Sep 05 '20 at 15:10
The link I sent is explicitly about Swarm configuration, this different from network mode. – Cyril G. Sep 05 '20 at 17:34
Yeah you are right I could use this config in my docker-compose file, but still ubuntu service selects mysql service with round-robin algorithm. I think its useful for external access (exposed ports) and does not apply on internal service selection as it just disables the mesh network. – Kibo Sep 05 '20 at 18:03

score 0 · Answer 3 · answered Sep 05 '20 at 16:11

Unless I'm missing something, I would say you should not use global deploy and instead declare 2 ubuntu service and 2 mysql services in the compose file or deploy 2 separate stacks and in both cases use constraints to pin containers to specific node.

Example for first case would be something like this:

version: '3.8'
services:
  mysql1:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD: password
    deploy:
      placement:
        constraints: [node.hostname == node1]
  mysql2:
    image: mysql:5.7
    environment:
      MYSQL_ROOT_PASSWORD: password
    deploy:
      placement:
        constraints: [node.hostname == node2]
  ubuntu1:
    entrypoint: tail -f /dev/null
    image: ubuntu:20:04
    deploy:
      placement:
        constraints: [node.hostname == node1]
  ubuntu2:
    entrypoint: tail -f /dev/null
    image: ubuntu:20:04
    deploy:
      placement:
        constraints: [node.hostname == node2]

Thanks for you reply. your solution doesn't solve the problem in general case what if I want to increase number of nodes. — Kibo, Sep 05 '20 at 18:28

Disable external node service accessibility in docker swarm

3 Answers3