Docker服务未在已发布的端口上监听

Question

我有一个Docker Swarm服务，它是作为具有两个已发布端口（80-> 80和443-> 443）的堆栈的一部分启动的，但是Docker在服务创建时并没有开始监听这些端口（ sudo netstat -lp不包括端口。

我的stack.yml：

version: '3.7'
services:
  nginx:
    image: staticfloat/nginx-certbot
    ports:
      - 80:80
      - 443:443
    volumes:
      - letsencrypt_data:/etc/letsencrypt
    configs:
      - source: nginx_conf
        target: /nginx-conf.template
      - source: nginx_startup
        target: /nginx-startup.sh
        mode: 0500
    command: /nginx-startup.sh
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      update_config:
        parallelism: 1
        delay: 10s
    healthcheck:
      test: 'printf "GET / HTTP/1.1\r\nHost: localhost\r\nAccept: */*\r\n\r\n" | nc localhost 80'

一些相关的输出docker service list：

75uh9c0jdj3t        web_nginx           replicated          0/1                 staticfloat/nginx-certbot:latest   *:80->80/tcp, *:443->443/tcp

docker ps：

0c32feb5da5e        staticfloat/nginx-certbot:latest   "/nginx-startup.sh"      42 seconds ago      Up 37 seconds (health: starting)   80/tcp, 443/tcp     web_nginx.1.9zmklax6je4l8pmt4k3jnsvdz

sudo netstat -lp的第一部分：

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 localhost:domain        0.0.0.0:*               LISTEN      888/systemd-resolve 
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      1212/sshd           
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      1212/sshd           
tcp6       0      0 [::]:2377               [::]:*                  LISTEN      1288/dockerd        
tcp6       0      0 [::]:7946               [::]:*                  LISTEN      1288/dockerd        
udp        0      0 0.0.0.0:4789            0.0.0.0:*                           -                   
udp        0      0 localhost:domain        0.0.0.0:*                           888/systemd-resolve 
udp        0      0 grahamchapman:bootpc    0.0.0.0:*                           865/systemd-network 
udp6       0      0 [::]:7946               [::]:*                              1288/dockerd        
raw6       0      0 [::]:ipv6-icmp          [::]:*                  7           865/systemd-network

docker version：

Client: Docker Engine - Community
 Version:           19.03.8
 API version:       1.40
 Go version:        go1.12.17
 Git commit:        afacb8b7f0
 Built:             Wed Mar 11 01:25:46 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.8
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.17
  Git commit:       afacb8b7f0
  Built:            Wed Mar 11 01:24:19 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

如果我改为运行docker service create --name test --publish 80:80 nginx，它将成功开始监听80。