<p>The container can be accessed via the ip which belongs to the <code>docker_gwbridge</code> interface.</p>
<p>I was able to find out the ip address of the container on the <code>docker_gwbridge</code> interface by running the <code>ifconfig</code> command in the container itself:</p>
<pre class="lang-bash prettyprint-override"><code>$ docker exec &lt;container-id&gt; ifconfig
</code></pre>
<p>This way the container can be accessed from <code>host machine</code> for example by <code>172.18.0.2:5432</code>, without having to publish port <code>5432</code>.</p>
<hr />
<p>Trying to find out the ip address via <code>docker inspect &lt;container-id&gt; (or &lt;service-name&gt; or &lt;network-id&gt;)</code> in swarm services did not lead to the desired result, because the ip from the <code>docker_gwbridge</code> interface was not displayed there. And the &quot;internal&quot; ip (something like 10.0.4.6) was not available from <code>host machine</code>.</p>

CC BY-SA 4.0
2022-02-22T16:34:09.593Z
2022-02-22T16:34:09.593Z
Олег
<p>It is possible to docker-compose to forward a port to the container from <code>localhost</code> only, by writing the desired <code>ports</code> configure in <code>docker-compose.yml</code>, e.g. <code>127.0.0.1:8080:80</code>.</p>
<p>In docker swarm this does not work and the published port is visible from the internet.</p>
<p>How then can I access the container port only from localhost without opening the port to the internet?</p>
<p>I tried configuring iptables to deny connection to port <code>iptables -A INPUT -p tcp --dport 5432 -j DROP</code>, but because of the settings from docker for iptables, that didn't work.</p>

CC BY-SA 4.0
2022-02-21T15:38:49.450Z
Seems like this wouldn't be likely to be a feature in docker swarm since each host would have a different IP.  Are you combining docker and non-docker resources?  If it is just docker, you don't have to publish the port to use it.  Just set up an internal network.
Peter Turner
CC BY-SA 4.0
2022-02-21T16:38:02.947Z
@PeterTurner I want to access postgres, which is running in swarm, from my computer in ValentinaStudio) Previously with docker-compose this was possible. After I switched to swarm I'm looking for an alternative to this method
Олег
CC BY-SA 4.0
2022-02-21T16:46:02.783Z
OK - it makes sense that it's possible with docker-compose, it seems like it wouldn't make sense to be possible with docker-swarm, since the purpose for the program is a distributed application.  Your iptables command would work, if you used `-I` instead of `-A`
Peter Turner
<docker-compose><networking><docker-swarm>
How to access a container/service port in swarm without publishing the port to the outside world?
Олег
# How to access a container/service port in swarm without publishing the port to the outside world?

(Asked by: username_0 on 2022-02-21)

It is possible to docker-compose to forward a port to the container from `localhost` only, by writing the desired `ports` configure in `docker-compose.yml`, e.g. `127.0.0.1:8080:80`.

In docker swarm this does not work and the published port is visible from the internet.

How then can I access the container port only from localhost without opening the port to the internet?

I tried configuring iptables to deny connection to port `iptables -A INPUT -p tcp --dport 5432 -j DROP`, but because of the settings from docker for iptables, that didn't work.

**Tags:** docker-compose, networking, docker-swarm

> **Comments:**
> **username_1**: Seems like this wouldn't be likely to be a feature in docker swarm since each host would have a different IP.  Are you combining docker and non-docker resources?  If it is just docker, you don't have to publish the port to use it.  Just set up an internal network.  
> **username_0**: @PeterTurner I want to access postgres, which is running in swarm, from my computer in ValentinaStudio) Previously with docker-compose this was possible. After I switched to swarm I'm looking for an alternative to this method  
> **username_1**: OK - it makes sense that it's possible with docker-compose, it seems like it wouldn't make sense to be possible with docker-swarm, since the purpose for the program is a distributed application.  Your iptables command would work, if you used `-I` instead of `-A`  

---

## 1 answers

### Answer by username_0 on 2022-02-22. Score: 2

The container can be accessed via the ip which belongs to the docker_gwbridge interface.
I was able to find out the ip address of the container on the docker_gwbridge interface by running the ifconfig command in the container itself:
$ docker exec  ifconfig

This way the container can be accessed from host machine for example by 172.18.0.2:5432, without having to publish port 5432.

Trying to find out the ip address via docker inspect  (or  or ) in swarm services did not lead to the desired result, because the ip from the docker_gwbridge interface was not displayed there. And the "internal" ip (something like 10.0.4.6) was not available from host machine.


---

