Count Proxy Exits Separately from Replicas

Three proxy replicas behind one translating gateway can still expose one public exit. Private container addresses do not determine the identity visible at the destination.

client → published service → proxy replica → egress/NAT → destination

Follow the drawing in two parts. The published service chooses how a client reaches a replica. The egress route and NAT choose the source address of that replica's onward connection.

Docker Swarm's routing mesh accepts traffic on a published service port and sends it to an active task. That supports entry distribution and task placement changes; it does not assign a distinct public exit to each replica.

If distinct exits are required, design their real routes and addresses, such as separately routed hosts or assigned egress gateways, then count observed outward identities.

Replacing a replica also replaces its live streams

An established CONNECT tunnel belongs to one proxy process. Another task cannot transparently recreate the destination TCP and TLS state when it replaces that process. Plan reconnects and drain long-lived connections for maintenance.

Carry client authentication and destination policies across the replicas too. A load balancer's successful port check is narrower than a permitted client negotiating the required proxy protocol. Capacity, exit identity and connection survival are separate requirements to evaluate.