We can isolate a database service by not exposing its ports. That can be accomplished easily with the service create command:
docker service create --name go-demo-db \
mongo:3.2.10We can confirm that the ports are indeed not exposed by inspecting the service:
docker service inspect --pretty go-demo-dbThe output is as follows:
ID: rcedo70r2f1njpm0eyb3nwf8w
Name: go-demo-db
Service Mode: Replicated
Replicas: 1
Placement:
UpdateConfig:
Parallelism: 1
On failure: pause
Max failure ratio: 0
ContainerSpec:
Image: mongo:3.2.10@sha256:532a19da83ee0e4e2a2ec6bc4212fc4af\
26357c040675d5c2629a4e4c4563cef
Resources:
Endpoint Mode: vipAs you can see, there is no mention of any port. Our go-demo-db service is fully isolated and inaccessible to anyone. However, that is too much isolation. We want the service to be isolated from anything but the service it belongs to go-demo. We can accomplish that through the usage of Docker Swarm networking...