Q: Your team runs a 12-node Docker Swarm cluster hosting an API gateway. Clients report sporadic 504 Gateway Timeouts during peak traffic. Investigation reveals that the Swarm Ingress Routing Mesh uses IPVS to distribute incoming connections across all nodes via the `ingress` overlay network. This SNATs (source NATs) all client traffic to an internal overlay IP (e.g., `10.255.0.x`), masking client real IPs from security firewalls and causing severe IPVS connection table drops during high connection churn. You must analyze the routing mesh mechanics, restore real client IPs, and configure host-mode port publishing.

Deconstruct how Docker Swarm routes ingress traffic: Any published port (`-p 80:80`) binds on all Swarm nodes. Incoming packets on node A are routed through the Linux kernel IPVS (IP Virtual Server) load balancer to a task running on node B via VXLAN overlay encapsulation, altering the source IP to an internal ingress IP.

<!-- Swarm Routing Mesh Path -->
Client (203.0.113.5) ---> Node A (:80)
                             │ (IPVS SNAT: Client IP converted to 10.255.0.2)
                             └─── VXLAN Overlay (Port 4789 UDP) ───> Node B Task Container
                                                                      (Container sees 10.255.0.2!)

Inspect IPVS connection states and kernel conntrack utilization inside the Swarm ingress sandbox network namespace.

# Inspect IPVS connections in ingress sandbox
ip netns exec $(ls /var/run/docker/netns | grep ingress) ipvsadm -ln

# Check conntrack table saturation on host
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

To preserve client real IPs and eliminate IPVS routing overhead, publish ports in `host` mode. In host mode, ports bind strictly to nodes where the container task is actively running, completely bypassing the Swarm ingress overlay network.

# docker-compose.yml (Swarm Stack)
version: '3.8'
services:
  api-gateway:
    image: nginx:alpine
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host  # Bypasses routing mesh, binds directly to host interface
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    deploy:
      mode: global  # Runs one instance on every Swarm node

Pair `mode: host` with an external AWS ALB or HAProxy load balancer configured to check health on each individual node's published port. When a task dies or moves, the upstream load balancer stops sending traffic to that node immediately.