How to get the IDs of Docker Containers that belong to a Service, given the Service name or id

Background

I'm trying to maintain some websites running in a Docker Swarm. I want to do security updates on them.

In a non-Docker environment, like a VPS, my simple process is that I would connect in and git pull updates and run any database updates associated with these.

I want to do the same with websites that are running in a Docker Swarm as Docker Containers that belong to a respective Docker Service.

But it seems to be a disproportionate of effort to find the Docker commands to help me with this.

Specifically my question is:

If I know the Docker Service name or ID, what Docker command can I run to find out the IDs of all the containers to be able to connect into them.

The reason why I start with the Docker Service when I list them on the Docker master node, using docker service ls I get a "user friendly" list of services, which helps me pick out the particular service for the site to maintain, e.g.:

    $ docker service ls    ID                  NAME                       MODE                REPLICAS            IMAGE                      PORTS    sr2w12kl8bg1        site1_db                    replicated          1/1                 animage2/mariadb:latest        *:13306->3306/tcp    e083ij8abje1        site1_drupal                replicated          1/1                 animage2/drupal:d7             *:7150->80/tcp    sejb0f2mfo22        site1_drush                 replicated          0/1                 drush/drush:latest             kbae02doa8rs        site1_haproxy               replicated          2/2                 haproxy:alpine                 khgmnu1566rb        site2_db                    replicated          1/1                 mariadb:latest                 notoc1fam1gk        site3_drupal                replicated          1/1                 animage1/drupal:d8             *:7160->80/tcp    0xtxx4jmmwa3        site4_db                    replicated          1/1                 mariadb:latest            etc...

I can look at this list above, and pick out a line and say "that's the site".

So here's the blocker:

Having picked out a line, I've got an ID, say e083ij8abje1 for a service running Drupal.

Now I want to ssh into a Docker container inside that Docker Service to do the upgrade.

There's this command for ssh-ing into a Docker container:

docker exec -it <container_id> /bin/bash 

Where container is a Hexadecimal number e.g. a1b2c3d4ee8 so it would e.g. look like docker exec -it a1b2c3d4ee8 /bin/bash

But I don't have the Docker container ID, I have the Docker Service ID which is an alphanumeric number, as in the above example e083ij8abje1 - this won't work for the above docker exec command.

So I need a docker command that lists the Docker Container IDs that belong to a Docker Service.

To my surprise, there doesn't seem to be one!

I know I can also list the Docker Containers

$ docker psCONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS                    NAMESd5d45a94d45e        haproxy:alpine         "/docker-entrypoint.…"   3 days ago          Up 3 days                                    db_proxy_haproxy.2.91aw0apofd3iw537d249pyi626a4676df2b3a        22dbb7890585           "docker-entrypoint.s…"   3 days ago          Up 3 days           3306/tcp                 site2_db.1.xxizdccg9a2hgf83tcgg1tkaej538172a86a57        site1/drupal:asite      "docker-php-entrypoi…"  3 days ago          Up 3 days           80/tcp                   site3.1.uofsfssl72aj867r0hfs86i7m24linae82d487ea3788e        22dbb7890585           "docker-entrypoint.s…"   3 days ago          Up 3 days           3306/tcp                 site4_db.1.3lnd0f9sl027f0skgza3kq373c0d671069584d7        mariadb:latest         "docker-entrypoint.s…"   3 days ago          Up 3 days           3306/tcp                 site5.1.xoy0r6720362hlkhksu2qdbeb6bcb66f43        mariadb:latest         "docker-entrypoint.s…"   3 days ago          Up 3 days           3306/tcp                 site2.1.kobk423624kljfs1uhpflfs3

But this doesn't tell me what Service a Docker Container is running in. Neither command gives me the full information and that's frustrating.

Research done already

• How to get container id of a docker service Various answers that don't seem to work for me and they are convoluted not simple commands, I'm using Docker 19.03

• Swarm mode: getting Container ID from Task ID Nothing definitive here stands out. And they've introduced the idea of "Task" - what is that in relation to Docker, Service, Containe?

• I also found several similar question / answers that were just wordy and pointing to the general documentation. Not very helpful as they don't show by example.

I'm trying my best to understand these concepts and have drawn a diagram below. ( Please confirm that Docker Containers belong to a Service. )

Yes, I understand that Docker Swarm is declarative and can allocate Containers where it decides are best, in terms of running them on a particular node. That seems to be the approach encountered whenever I've been trying to find this answer, answers seem to want to give too much information for the reader, when what the reader needs is specific practical examples, not loads of theory and concepts.

So to summarise what I am looking for is a simple command or 2 that enables me to:

• list the Docker Containers by ID that belong to a Service, given the Service ID / name to start with
• for a given Docker Container and ID, find out what Docker Service it belongs to.

I am aware about Docker Swarm end-of-life so don't want answers telling me to use something else. please.