Running a database in isolation

We can isolate a database service by not exposing its ports. That can be accomplished easily with the service create command:

docker service create --name go-demo-db \
  mongo:3.2.10

We can confirm that the ports are indeed not exposed by inspecting the service:

docker service inspect --pretty go-demo-db

The output is as follows:

ID:            rcedo70r2f1njpm0eyb3nwf8w
Name:          go-demo-db
Service Mode:  Replicated
 Replicas:     1
Placement:
UpdateConfig:
 Parallelism:  1
 On failure:   pause
 Max failure ratio: 0
ContainerSpec:
 Image:      mongo:3.2.10@sha256:532a19da83ee0e4e2a2ec6bc4212fc4af\
26357c040675d5c2629a4e4c4563cef
Resources:
Endpoint Mode: vip

As you can see, there is no mention of any port. Our go-demo-db service is fully isolated and inaccessible to anyone. However, that is too much isolation. We want the service to be isolated from anything but the service it belongs to go-demo. We can accomplish that through the usage of Docker Swarm networking...