官方文档，才是正途-docker-compose

需要的ingress网络映射，还是host宿主机端口映射：

https://docs.docker.com/compose/compose-file/#secrets

========================

docker service create --name web \

--publish mode=host,published=80,target=80 \

nginx

==========================

ports

Expose ports.

SHORT SYNTAX

Either specify both ports (HOST:CONTAINER), or just the container port (a random host port will be chosen).

Note: When mapping ports in the HOST:CONTAINER format, you may experience erroneous results when using a container port lower than 60, because YAML will parse numbers in the format xx:yy as sexagesimal (base 60). For this reason, we recommend always explicitly specifying your port mappings as strings.

ports:
 - "3000"
 - "3000-3005"
 - "8000:8000"
 - "9090-9091:8080-8081"
 - "49100:22"
 - "127.0.0.1:8001:8001"
 - "127.0.0.1:5000-5010:5000-5010"
 - "6060:6060/udp"

LONG SYNTAX

The long form syntax allows the configuration of additional fields that can’t be expressed in the short form.

• target: the port inside the container
• published: the publicly exposed port
• protocol: the port protocol (tcp or udp)
• mode: host for publishing a host port on each node, or ingress for a swarm mode port which will be load balanced.

ports:
  - target: 80
    published: 8080
    protocol: tcp
    mode: host

Note: The long syntax is new in v3.2