Answers: <p>The container can be accessed via the ip which belongs to the <code>docker_gwbridge</code> interface.</p>
  <p>I was able to find out the ip address of the container on the <code>docker_gwbridge</code> interface by running the <code>ifconfig</code> command in the container itself:</p>
  <pre class="lang-bash prettyprint-override"><code>$ docker exec &lt;container-id&gt; ifconfig
  </code></pre>
  <p>This way the container can be accessed from <code>host machine</code> for example by <code>172.18.0.2:5432</code>, without having to publish port <code>5432</code>.</p>
  <hr />
  <p>Trying to find out the ip address via <code>docker inspect &lt;container-id&gt; (or &lt;service-name&gt; or &lt;network-id&gt;)</code> in swarm services did not lead to the desired result, because the ip from the <code>docker_gwbridge</code> interface was not displayed there. And the &quot;internal&quot; ip (something like 10.0.4.6) was not available from <code>host machine</code>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-02-22T16:34:09.593Z
Answers: 2022-02-22T16:34:09.593Z
Answers: Олег
Body: <p>It is possible to docker-compose to forward a port to the container from <code>localhost</code> only, by writing the desired <code>ports</code> configure in <code>docker-compose.yml</code>, e.g. <code>127.0.0.1:8080:80</code>.</p>
  <p>In docker swarm this does not work and the published port is visible from the internet.</p>
  <p>How then can I access the container port only from localhost without opening the port to the internet?</p>
  <p>I tried configuring iptables to deny connection to port <code>iptables -A INPUT -p tcp --dport 5432 -j DROP</code>, but because of the settings from docker for iptables, that didn't work.</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-02-21T15:38:49.450Z
Comments: Seems like this wouldn't be likely to be a feature in docker swarm since each host would have a different IP.  Are you combining docker and non-docker resources?  If it is just docker, you don't have to publish the port to use it.  Just set up an internal network.
Comments: Peter Turner
Comments: CC BY-SA 4.0
Comments: 2022-02-21T16:38:02.947Z
Comments: @PeterTurner I want to access postgres, which is running in swarm, from my computer in ValentinaStudio) Previously with docker-compose this was possible. After I switched to swarm I'm looking for an alternative to this method
Comments: Олег
Comments: CC BY-SA 4.0
Comments: 2022-02-21T16:46:02.783Z
Comments: OK - it makes sense that it's possible with docker-compose, it seems like it wouldn't make sense to be possible with docker-swarm, since the purpose for the program is a distributed application.  Your iptables command would work, if you used `-I` instead of `-A`
Comments: Peter Turner
Tags: <docker-compose><networking><docker-swarm>
Title: How to access a container/service port in swarm without publishing the port to the outside world?
UserDisplayName: Олег
ThreadText: # How to access a container/service port in swarm without publishing the port to the outside world?
  
  (Asked by: username_0 on 2022-02-21)
  
  It is possible to docker-compose to forward a port to the container from `localhost` only, by writing the desired `ports` configure in `docker-compose.yml`, e.g. `127.0.0.1:8080:80`.
  
  In docker swarm this does not work and the published port is visible from the internet.
  
  How then can I access the container port only from localhost without opening the port to the internet?
  
  I tried configuring iptables to deny connection to port `iptables -A INPUT -p tcp --dport 5432 -j DROP`, but because of the settings from docker for iptables, that didn't work.
  
  **Tags:** docker-compose, networking, docker-swarm
  
  > **Comments:**
  > **username_1**: Seems like this wouldn't be likely to be a feature in docker swarm since each host would have a different IP.  Are you combining docker and non-docker resources?  If it is just docker, you don't have to publish the port to use it.  Just set up an internal network.  
  > **username_0**: @username_1 I want to access postgres, which is running in swarm, from my computer in ValentinaStudio) Previously with docker-compose this was possible. After I switched to swarm I'm looking for an alternative to this method  
  > **username_1**: OK - it makes sense that it's possible with docker-compose, it seems like it wouldn't make sense to be possible with docker-swarm, since the purpose for the program is a distributed application.  Your iptables command would work, if you used `-I` instead of `-A`  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-02-22. Score: 2
  
  The container can be accessed via the ip which belongs to the `docker_gwbridge` interface.
  
  I was able to find out the ip address of the container on the `docker_gwbridge` interface by running the `ifconfig` command in the container itself:
  
  ```bash
  $ docker exec <container-id> ifconfig
  
  ```
  
  This way the container can be accessed from `host machine` for example by `172.18.0.2:5432`, without having to publish port `5432`.
  
  ---
  
  Trying to find out the ip address via `docker inspect <container-id> (or <service-name> or <network-id>)` in swarm services did not lead to the desired result, because the ip from the `docker_gwbridge` interface was not displayed there. And the "internal" ip (something like 10.0.4.6) was not available from `host machine`.
  
  
  ---
  
  