title: Unable to connect to remote SQL server from docker container with bridge network mode
body: <p>I have a Docker Swarm of four Ubuntu 20.04 machines. I want to run many different apps in a replicated fashion. One of these apps is an API that reads from a remote SQL Server running on a named instance.</p>
  <p>I am able to connect to SQL Server if I specify the host network mode but this is not ideal since I won't be able to map ports for other services that I want to run in the future. It also feels like a hack.</p>
  <p>This is my docker-compose file named scapi-stack.yaml</p>
  <pre><code>version: '3.7'
  
  services:
    sc-api:
      command: [ &quot;--privileged&quot; ]
      image: #private repo image
      deploy:
        replicas: 4
        restart_policy:
          condition: on-failure
      ports:
        - &quot;51955:51955&quot; #SQL Server instance port
        - &quot;8443:443&quot;
        - &quot;8080:80&quot;
      environment:
        - ASPNETCORE_URLS=http://+:80
        - ASPNETCORE_URLS=https://+:443
  </code></pre>
  <p>This is the command with which I run the service:</p>
  <pre><code>docker stack deploy --compose-file scapi-stack.yaml scapi
  </code></pre>
  <p>If I then do <code>docker attach </code> to a container and navigate to port 8080 I see the following error:</p>
  <pre><code>Microsoft.Data.SqlClient.SqlException (0x80131904): A network-related or instance-specific error occurred
   while establishing a connection to SQL Server. The server was not found or was not accessible. 
  Verify that the instance name is correct and that SQL Server is configured to allow remote connections.
   (provider: TCP Provider, error: 40 - Could not open a connection to SQL Server)
  </code></pre>
  <p>I've tried specifying the <code>--privileged</code> command to no avail.
  I've also tried changing images from the main ones to bionic, focal and buster-slim.
  I've tried going down to .Net Core 3.1 as well and it made no difference.
  I have also run these two commands found in this <a href="https://stackoverflow.com/a/50519027/15402062">answer</a>:</p>
  <pre><code>sysctl net.ipv4.conf.all.forwarding=1
  sudo iptables -P FORWARD ACCEPT
  </code></pre>
  <p>The only way I can get it to work is with the host network but that defeats the purpose.</p>
  <p>The dockerfile for the image is this:</p>
  <pre><code>FROM mcr.microsoft.com/dotnet/aspnet:5.0 AS base
  WORKDIR /app
  EXPOSE 80
  EXPOSE 443
  EXPOSE 51955
  
  FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build
  WORKDIR /src
  COPY [&quot;SCAPI/SCAPI.csproj&quot;, &quot;SCAPI/&quot;]
  COPY [&quot;src/Infrastructure/Infrastructure.csproj&quot;, &quot;src/Infrastructure/&quot;]
  COPY [&quot;src/Application/Application.csproj&quot;, &quot;src/Application/&quot;]
  COPY [&quot;src/Domain/Domain.csproj&quot;, &quot;src/Domain/&quot;]
  RUN dotnet restore &quot;SCAPI/SCAPI.csproj&quot;
  COPY . .
  WORKDIR &quot;/src/SCAPI&quot;
  RUN dotnet build &quot;SCAPI.csproj&quot; -c Release -o /app/build
  
  FROM build AS publish
  RUN dotnet publish &quot;SCAPI.csproj&quot; -c Release -o /app/publish
  
  FROM base AS final
  #Enable connections with TLS 1.0
  RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
  RUN sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /usr/lib/ssl/openssl.cnf
  RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf
  RUN sed -i 's/DEFAULT@SECLEVEL=2/DEFAULT@SECLEVEL=1/g' /usr/lib/ssl/openssl.cnf
  WORKDIR /app
  COPY --from=publish /app/publish .
  ENTRYPOINT [&quot;dotnet&quot;, &quot;SCAPI.dll&quot;]
  </code></pre>
  <p>What am I missing? How can I specify the ports to enable comms to SQL Server without using the host network?</p>
  <h1>Update</h1>
  <p>The SQL server I am trying to connect to is on a Windows machine outside of the swarm. I can connect to it if I remove port mapping and specify 'host' networking in my compose file:</p>
  <pre><code>version: '3.7'
  
  services:
    sc-api:
      command: [ &quot;--privileged&quot; ]
      image: #private repo image
      deploy:
        replicas: 4
        restart_policy:
          condition: on-failure
      environment:
        - ASPNETCORE_URLS=http://+:80
        - ASPNETCORE_URLS=https://+:44
      networks:
        - host
  
  networks:
    host:
      name: host
      external: true
  </code></pre>
  <p>But that has drawbacks as described in the official Docker <a href="https://docs.docker.com/network/host/" rel="nofollow noreferrer">documentation</a>:</p>
  <blockquote>
  <p>If you use the host network mode for a container, that container’s network stack is not isolated from the Docker host (the container shares the host’s networking namespace), and the container does not get its own IP-address allocated. For instance, if you run a container which binds to port 80 and you use host networking, the container’s application is available on port 80 on the host’s IP address.</p>
  </blockquote>