I figured out my problem- CentOS 7 was running "rpcbind" in its main scope (outside docker), but ECS's Docker container runs its own version of rpcbind and ECS appears to communicate only with that one.  The giveaway was running "rpcinfo -p" in the CentOS shell (not inside the docker container) and finding no NFS services.

To disable the CentOS global rpcbind process, "systemctl disable rpcbind" seems to do the trick.  I shut down the docker and rebooted the CentOS VM for good measure, then after initialization I was able to mount it up (also reinstalled the whole ECS single-node instance before figuring that out):

root@apollo:~# mount -v ecs.lan:/spir/nfstest1/ /mnt2 -o vers=3,sec=sys,proto=tcp

mount.nfs: timeout set for Thu Feb 23 23:54:42 2017

mount.nfs: trying text-based options 'vers=3,sec=sys,proto=tcp,addr=192.168.0.5'

mount.nfs: prog 100003, trying vers=3, prot=6

mount.nfs: trying 192.168.0.5 prog 100003 vers 3 prot TCP port 2049

mount.nfs: prog 100005, trying vers=3, prot=6

mount.nfs: trying 192.168.0.5 prog 100005 vers 3 prot TCP port 2049

root@apollo:~# df -k

Filesystem                1K-blocks      Used  Available Use% Mounted on

...

ecs.lan:/spir/nfstest1/  4278190080  33029632 4245160448   1% /mnt2

When you have this set up correctly, running "rpcinfo -p" on the CentOS shell throws an error:

[root@ecs ~]# rpcinfo -p

rpcinfo: can't contact portmapper: RPC: Remote system error - No such file or directory

But running rpcinfo -p inside a docker shell works, and port 111 is definitely listening:

[root@ecs ~]# docker exec -ti ecsstandalone /bin/bash

ecs:/ # rpcinfo -p

   program vers proto   port  service

    100000    4   tcp    111  portmapper

    100000    3   tcp    111  portmapper

    100000    2   tcp    111  portmapper

    100000    4   udp    111  portmapper

    100000    3   udp    111  portmapper

    100000    2   udp    111  portmapper

    100005    3   tcp   2049  mountd

    100005    3   udp   2049  mountd

    100003    3   tcp   2049  nfs

    100024    1   tcp   2049  status

    100021    4   tcp  10000  nlockmgr

    100021    4   udp  10000  nlockmgr

ecs:/ # exit

exit

[root@ecs ~]# netstat -nap | grep ':111 '

tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      9788/rpcbind

tcp6       0      0 :::111                  :::*                    LISTEN      9788/rpcbind

udp        0      0 0.0.0.0:111             0.0.0.0:*                           9788/rpcbind

udp6       0      0 :::111                  :::*                                9788/rpcbind