docker swarm: How to inspect ingress-endpoint container - docker

Question

When I inspect ingress I getting info about containers:
$docker inspect ingress
"Containers": {
"1234567890": {
"Name": "gateway.1.qwertyuiop",
"EndpointID": "12345678990",
"MacAddress": "00:11:22:33:44:55",
"IPv4Address": "10.255.0.11/16",
"IPv6Address": ""
},
"ingress-sbox": {
"Name": "ingress-endpoint",
"EndpointID": "1234567890",
"MacAddress": "00:11:22:33:44:55",
"IPv4Address": "10.255.0.3/16",
"IPv6Address": ""
}
},
Then I can inspect first container but inspecting ingress-endpoint returns nothing
$ docker inspect ingress-endpoint
[]
What I'm trying to find is the local ip for ingress-endpoint in the swarm node.

Answer 1

Not sure why you need that, but if you are looking for where incoming packets are being routed to, you may look at iptables.
iptables -n -t nat -L DOCKER-INGRESS
On my setup (where one of the services publishes the port 80) I get following output:
Chain DOCKER-INGRESS (2 references)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:172.18.0.2:80
RETURN all -- 0.0.0.0/0 0.0.0.0/0
So 172.18.0.2 is the IP address of the ingress container
Notice that this ingress-sbox container is part of both networks that Swarm mode creates for you:
ingress
docker_gwbridge
This is all part of Linux network namespaces, as explained in this very good post: https://neuvector.com/network-security/docker-swarm-container-networking/ which I recommend reading.
# cd /var/run/
# ln -s docker/netns .
# ip netns exec ingress_sbox ip addr
This gives (on my system):
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
7: eth0#if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default
link/ether 02:42:0a:ff:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.255.0.2/16 brd 10.255.255.255 scope global eth0
valid_lft forever preferred_lft forever
inet 10.255.0.4/32 brd 10.255.0.4 scope global eth0
valid_lft forever preferred_lft forever
10: eth1#if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet 172.18.0.2/16 brd 172.18.255.255 scope global eth1
valid_lft forever preferred_lft forever
You can also run iptables commands from within those network namespaces to try and follow how packets get magically routed...

Answer 2

As running docker inspect ingress-endpoint giving output of [], it very possibly means such endpoint is a stale container, which still hooks ingress network. You might want to disconnect the network, remove such container then re- join Swarm cluster, by doing
docker network disconnect ingress --force ingress-endpoint
docker network rm ingess