We can isolate a database service by not exposing its ports. That can be accomplished easily with the service create command:
docker service create --name go-demo-db \ mongo:3.2.10
We can confirm that the ports are indeed not exposed by inspecting the service:
docker service inspect --pretty go-demo-db
The output is as follows:
ID: rcedo70r2f1njpm0eyb3nwf8wName: go-demo-dbService Mode: Replicated Replicas: 1Placement:UpdateConfig: Parallelism: 1 On failure: pause Max failure ratio: 0ContainerSpec: Image: mongo:3.2.10@sha256:532a19da83ee0e4e2a2ec6bc4212fc4af\26357c040675d5c2629a4e4c4563cefResources:Endpoint Mode: vip
As you can see, there is no mention of any port. Our go-demo-db service is fully isolated ...
