Docker swarm mode routing mesh not work as expected

问题

I tried to create services in docker swarm model by following this document

I created two nodes in the swarm:

Then create the deploy the service, I use jwilder/whoami here instead of nginx in the document, docker service create --name my-web --publish published=8888,target=8000 --replicas 2 jwilder/whoami

Seems like they started successfully:

As the document said:

When you access port 8080 on any node, Docker routes your request to an active container.

SO in my opinion, I can access the my-web service from any of the node, however I found that only one node work:

What's going on?

回答1:

This can be caused by ports being blocked between the nodes. The swarm mesh networking uses the "ingress" network to connect the published port to a VIP for the service. That ingress network is an overlay network implemented with vxlan. For that you need:

TCP port 2377 for cluster management communications
TCP and UDP port 7946 for communication among nodes
UDP port 4789 for overlay network traffic

Reference: https://docs.docker.com/network/overlay/

It's possible for these ports to be blocked at many levels, including iptables, firewalls on the routers, and I've even seen VMware block this with their NSX tool that also implemented vxlan.

For iptables, I typically use the following commands:

iptables -A INPUT -p tcp -m tcp --dport 2376 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 2377 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 7946 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 7946 -j ACCEPT
iptables -A INPUT -p tcp -m udp --dport 4789 -j ACCEPT
iptables -A INPUT -p 50 -j ACCEPT

The above will differ if you use firewalld or need to change firewall rules on the network routers.

来源：https://stackoverflow.com/questions/55133535/docker-swarm-mode-routing-mesh-not-work-as-expected

标签

Docker

docker-swarm