Docker Swarm无法部署Stack，副本始终停留在0/1状态求助

问题现象 #

测试Docker Swarm时执行stack deploy后，服务副本数始终停留在0/1，无容器实际部署。集群为1个manager节点（设置为drain状态）+1个worker节点的双节点架构，预期服务部署到worker节点。

操作步骤与环境信息 #

docker-compose.yml配置 #

---
services:
  whoami:
    image: traefik/whoami

部署命令与反馈 #

test-portal:/app/whoami$ docker stack deploy -c docker-compose.yml whoami
Since --detach=false was not specified, tasks will be created in the background.
In a future release, --detach=false will become the default.
Creating network whoami_default
Creating service whoami_whoami

故障状态检查 #

• 服务状态：

test-portal:/app/whoami$ docker service ls
ID             NAME            MODE         REPLICAS   IMAGE                   PORTS
tsxrvw12zg6i   whoami_whoami   replicated   0/1        traefik/whoami:latest   

• 网络状态：

test-portal:/app/whoami$ docker network ls
NETWORK ID     NAME              DRIVER    SCOPE
149473faf294   bridge            bridge    local
76df1d9a4c91   docker_gwbridge   bridge    local
0939cda44322   host              host      local
n00f2g1whcn0   ingress           overlay   swarm
ee11daff62a5   none              null      local
uno0f18wnbbp   whoami_default              swarm

• 自定义网络详情（whoami_default）：

[
    {
        "Name": "whoami_default",
        "Id": "uno0f18wnbbp14jv0000wnnzs",
        "Created": "2025-03-02T14:38:34.136561408Z",
        "Scope": "swarm",
        "Driver": "",
        "EnableIPv4": false,
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "",
            "Options": null,
            "Config": null
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": null,
        "Options": null,
        "Labels": {
            "com.docker.stack.namespace": "whoami"
        }
    }
]

潜在线索 #

• 初始默认Swarm配置可正常部署，但overlay网络默认10.0.0.x子网与自有网络冲突。执行swarm leave后用--default-pool-addr 10.1.99.0/24重建Swarm，故障出现；即使改回默认配置，问题仍存在。
• 更新Docker CE后默认配置曾恢复正常，但再次自定义子网重建Swarm后故障复发。
• 重启服务器无效。

测试更新 #

更新#1 #

• 集群缩减为单manager节点，问题依旧。
• 移除Swarm，执行docker system prune --all，用默认命令docker swarm init --advertise-addr 10.1.5.101创建单节点Swarm，部署正常。
• 移除Swarm，执行docker system prune --all，用自定义子网docker swarm init --advertise-addr 10.1.5.101 --default-addr-pool 10.99.99.0/24创建单节点Swarm，部署失败。
  结论：Swarm网络配置/子网是核心诱因。

更新#2 #

用docker swarm init --default-addr-pool 10.100.0.0/16 --default-addr-pool-mask-length 24重建Swarm后，服务可启动并寻址，但存在两个疑问：

1. 为何/16掩码+修改默认掩码长度能解决问题？难道/24掩码过于严格或存在冲突？
2. 新网络中容器（如whoami_default内的10.100.1.3）无法从manager/worker节点本身访问，是否仍存在路由配置问题？Docker是否应自动路由到该子网？

补充环境信息 #

节点列表 #

test-portal:/app/whoami$ docker node ls
ID                            HOSTNAME                            STATUS    AVAILABILITY   MANAGER STATUS   ENGINE VERSION
phg2egnc6m4o7vpf47osurp4s *   test-portal.private.network         Ready     Drain          Leader           28.0.1
wer4delycdryonov1l1u3tp4l     test-swarm-node-1.private.network   Ready     Active                          28.0.

Docker Info #

test-portal:/app/whoami$ docker info
Client: Docker Engine - Community
 Version:    28.0.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.21.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.33.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 2
 Server Version: 28.0.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: active
  NodeID: phg2egnc6m4o7vpf47osurp4s
  Is Manager: true
  ClusterID: yq0wosj1mkj28sbkv6vfoj42j
  Managers: 1
  Nodes: 2
  Default Address Pool: 10.1.99.0/24  
  SubnetSize: 24
  Data Path Port: 4789
  Orchestration:
   Task History Retention Limit: 5
  Raft:
   Snapshot Interval: 10000
   Number of Old Snapshots to Retain: 0
   Heartbeat Tick: 1
   Election Tick: 10
  Dispatcher:
   Heartbeat Period: 5 seconds
  CA Configuration:
   Expiry Duration: 3 months
   Force Rotate: 0
  Autolock Managers: false
  Root Rotation In Progress: false
  Node Address: 10.1.5.101
  Manager Addresses:
   10.1.5.101:2377
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
 runc version: v1.2.4-0-g6c52b3f
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.1.0-18-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 1
 Total Memory: 3.816GiB
 Name: test-portal.private.network
 ID: 9538b0fe-cc7d-4882-97cc-52c5f1d0bb92
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

Ingress网络详情 #

[
    {
        "Name": "ingress",
        "Id": "n00f2g1whcn0wzsts4hvgvyzo",
        "Created": "2025-03-01T14:56:43.92160206-05:00",
        "Scope": "swarm",
        "Driver": "overlay",
        "EnableIPv4": true,
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "10.1.99.0/24",
                    "Gateway": "10.1.99.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": true,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "ingress-sbox": {
                "Name": "ingress-endpoint",
                "EndpointID": "309e69924e66c572bbc690672cb8cd9ef466b8b4f3d7e8e9228d0ee7513f71ae",
                "MacAddress": "02:42:0a:01:63:02",
                "IPv4Address": "10.1.99.2/24",
                "IPv6Address": ""
            }
        },
        "Options": {
            "com.docker.network.driver.overlay.vxlanid_list": "4096"
        },
        "Labels": {},
        "Peers": [
            {
                "Name": "24b3935b696e",
                "IP": "10.1.5.101"
            },
            {
                "Name": "9ab40688269f",
                "IP": "10.1.5.102"
            }
        ]
    }
]

故障分析与解决 #

子网配置问题根源 #

当使用--default-addr-pool指定单个/24子网时，Docker Swarm会将整个地址池分配给ingress网络，导致后续创建的服务网络（如whoami_default）没有可用子网资源，从而无法完成网络初始化，服务无法调度。而使用/16大子网配合--default-addr-pool-mask-length 24时，Swarm会自动从大子网中划分出多个/24子网，分别分配给ingress和各个服务网络，避免资源耗尽。

节点无法访问容器子网的解决 #

容器所在的overlay网络默认是Swarm内部网络，节点本身无法直接访问容器IP，这是正常设计。如果需要从节点访问容器，有两种方案：

1. 在服务配置中暴露端口，通过节点IP+暴露端口访问；
2. 创建overlay网络时添加--attachable参数，允许节点上的独立容器加入该网络，但Swarm服务的容器仍需通过服务发现或端口映射访问。

另外，检查节点间的VXLAN端口（默认4789）是否开放，确保Swarm网络的通信正常，这是overlay网络路由的基础。

内容的提问来源于stack exchange，提问作者David Elner