需要的ingress网络映射，还是host宿主机端口映射：
https://docs.docker.com/compose/compose-file/#secrets
========================
docker service create --name web \
--publish mode=host,published=80,target=80 \
nginx
==========================
ports
Expose ports.
SHORT SYNTAX
Either specify both ports (HOST:CONTAINER), or just the container port (a random host port will be chosen).
Note: When mapping ports in the HOST:CONTAINER format, you may experience erroneous results when using a container port lower than 60, because YAML will parse numbers in the format xx:yy as sexagesimal (base 60). For this reason, we recommend always explicitly specifying your port mappings as strings.
ports:
- "3000"
- "3000-3005"
- "8000:8000"
- "9090-9091:8080-8081"
- "49100:22"
- "127.0.0.1:8001:8001"
- "127.0.0.1:5000-5010:5000-5010"
- "6060:6060/udp"
LONG SYNTAX
The long form syntax allows the configuration of additional fields that can’t be expressed in the short form.
-
target: the port inside the container
-
published: the publicly exposed port
-
protocol: the port protocol (tcp or udp)
-
mode: host for publishing a host port on each node, or ingress for a swarm mode port which will be load balanced.
ports:
- target: 80
published: 8080
protocol: tcp
mode: host
Note: The long syntax is new in v3.2
