It would be amazing if Docker would only bind to the ports published by services on the hosts that meet the constraints for that service (maybe make it a flag to do so?).

Example:

• I have X hosts that are a "management layer". They run the load balancers and other stuff. Load balancers are constrained to these nodes by node labels.
• I have Y hosts that are an "application layer". They run app servers, no ports published here via the mesh network, load balancers connect to them via the overlay networks. App services only run on these hosts by constraints via node labels.
• I have Z hosts that are a "DB layer" which have access to special distributed storage, etc. DB services only run on these hosts by constraints via node labels.

It sounds reasonable that Docker would only listen for ports published by the load balancers only on the "management" nodes and for ports published by the databases on their respective nodes.