Overlay networks in Swarm in Docker - Commands & Configuration

Introduction

When you run multiple Docker containers on different machines, they need a way to talk to each other securely and easily. Overlay networks in Docker Swarm create a private network that connects containers across these machines as if they were on the same local network.

When you want containers on different servers to communicate without exposing ports to the outside world.

When you deploy a multi-service app using Docker Swarm and need services to find each other by name.

When you want to isolate your app's network traffic from other apps running on the same servers.

When you want to scale your app across multiple machines and keep the network seamless.

When you want to use Docker's built-in service discovery and load balancing features.

Commands

This command creates a new overlay network named 'my-overlay-network' that Docker Swarm services and containers can use to communicate across multiple hosts.

Terminal

docker network create --driver overlay my-overlay-network

Expected Output

3v7xqz7k8kq7k8kq7k8kq7k8

→

--driver overlay - Specifies that the network type is overlay, which works across multiple Docker hosts.

This command creates a new Docker service named 'my-service' that runs the nginx container and connects it to the 'my-overlay-network' so it can communicate with other services on the same network.

Terminal

docker service create --name my-service --network my-overlay-network nginx

Expected Output

q1w2e3r4t5y6u7i8o9p0

→

--name - Names the service for easy reference.

→

--network - Connects the service to the specified overlay network.

This command lists all running Docker services so you can verify that 'my-service' is up and running.

Terminal

docker service ls

Expected Output

ID                  NAME                MODE                REPLICAS            IMAGE               PORTS

q1w2e3r4t5y6u7i8o9p0        my-service          replicated          1/1                 nginx:latest        

This command shows detailed information about the 'my-overlay-network', including which containers and services are connected to it.

Terminal

docker network inspect my-overlay-network

Expected Output

[

    {

        "Name": "my-overlay-network",

        "Id": "3v7xqz7k8kq7k8kq7k8kq7k8",

        "Scope": "swarm",

        "Driver": "overlay",

        "Containers": {

            "q1w2e3r4t5y6u7i8o9p0": {

                "Name": "my-service.1.xxxxx",

                "EndpointID": "abcdef123456",

                "MacAddress": "02:42:ac:11:00:02",

                "IPv4Address": "10.0.0.2/24",

                "IPv6Address": ""

            }

        }

    }

]

Key Concept

If you remember nothing else from this pattern, remember: overlay networks let containers on different Docker hosts communicate securely as if they were on the same local network.

Common Mistakes

Creating an overlay network without initializing Docker Swarm mode.

Overlay networks require Docker Swarm mode to be active; otherwise, the network creation will fail.

Run 'docker swarm init' on your manager node before creating overlay networks.

Not attaching services or containers to the overlay network.

If services are not connected to the overlay network, they cannot communicate across hosts using that network.

Use the '--network' flag when creating or updating services to connect them to the overlay network.

Trying to connect standalone containers (not part of a service) to an overlay network on different hosts without extra setup.

Standalone containers cannot join overlay networks across hosts unless using swarm services or special configurations.

Use Docker services for multi-host networking or use other networking solutions for standalone containers.

Summary

Create an overlay network with 'docker network create --driver overlay' to enable multi-host container communication.

Deploy services connected to the overlay network using 'docker service create --network'.

Verify services and network connections with 'docker service ls' and 'docker network inspect'.

Practice

1. What is the main purpose of an overlay network in Docker Swarm?

easy

A. To provide a graphical interface for managing containers

B. To isolate containers within the same host only

C. To store container logs centrally

D. To enable communication between containers on different Docker hosts

Solution

1. Step 1: Understand overlay network function

   An overlay network connects containers running on different Docker hosts, allowing them to communicate as if on the same network.

2. Step 2: Compare options

   Options A, B, and D describe other features unrelated to overlay networks. Only To enable communication between containers on different Docker hosts correctly describes the main purpose.

3. Final Answer:

   To enable communication between containers on different Docker hosts -> Option D

4. Quick Check:

   Overlay network = cross-host container communication [OK]

Hint: Overlay networks connect containers across hosts, not just one host [OK]

Common Mistakes:

• Thinking overlay networks only work on one host
• Confusing overlay networks with logging or UI features
• Assuming overlay networks isolate containers instead of connecting them

2. Which command correctly creates an overlay network named mynetwork in Docker Swarm?

easy

A. docker network create --driver overlay mynetwork

B. docker network create --driver bridge mynetwork

C. docker swarm network create mynetwork

D. docker create network overlay mynetwork

Solution

1. Step 1: Identify correct command syntax

   The correct syntax to create an overlay network is docker network create --driver overlay [name].

2. Step 2: Evaluate options

   docker network create --driver bridge mynetwork uses the bridge driver, not overlay. docker swarm network create mynetwork is invalid syntax. docker create network overlay mynetwork is incorrect command order. Only docker network create --driver overlay mynetwork is correct.

3. Final Answer:

   docker network create --driver overlay mynetwork -> Option A

4. Quick Check:

   Correct overlay network creation uses --driver overlay [OK]

Hint: Use 'docker network create --driver overlay' to create overlay networks [OK]

Common Mistakes:

• Using bridge driver instead of overlay
• Incorrect command order or missing 'network' keyword
• Confusing swarm commands with network commands

3. Given the following Docker Swarm overlay network creation command:

docker network create -d overlay --attachable mynet

What does the --attachable flag do?

medium

A. Limits the network to only swarm services

B. Prevents services from using the network

C. Allows standalone containers to connect to the overlay network

D. Automatically attaches volumes to containers

Solution

1. Step 1: Understand the --attachable flag

   The --attachable flag allows standalone containers (not part of swarm services) to connect to the overlay network.

2. Step 2: Analyze options

   Prevents services from using the network is false because it does not prevent services. Limits the network to only swarm services is opposite of what attachable does. Automatically attaches volumes to containers is unrelated to networks.

3. Final Answer:

   Allows standalone containers to connect to the overlay network -> Option C

4. Quick Check:

   --attachable = standalone container access [OK]

Hint: Attachable lets normal containers join overlay networks [OK]

Common Mistakes:

• Thinking --attachable restricts network to swarm services
• Confusing attachable with volume or storage options
• Assuming it disables service connections

4. You created an overlay network with:

docker network create -d overlay mynet

But when you try to connect a standalone container using docker run --net mynet, it fails. What is the likely cause?

medium

A. The overlay network was not created with the --attachable flag

B. The container image is incompatible with overlay networks

C. Docker Swarm mode is not initialized

D. The container must be part of a service to use overlay networks

Solution

1. Step 1: Identify overlay network usage for standalone containers

   Standalone containers can only connect to overlay networks if the network was created with --attachable.

2. Step 2: Evaluate other options

   The container image is incompatible with overlay networks is incorrect; container images do not affect network connection. Docker Swarm mode is not initialized is unrelated if network was created. The container must be part of a service to use overlay networks is false because attachable networks allow standalone containers.

3. Final Answer:

   The overlay network was not created with the --attachable flag -> Option A

4. Quick Check:

   Standalone container needs --attachable network [OK]

Hint: Add --attachable to overlay network for standalone containers [OK]

Common Mistakes:

• Ignoring the need for --attachable flag
• Blaming container image compatibility
• Assuming all overlay networks allow standalone containers

5. You want to deploy a multi-host Docker Swarm service that uses an overlay network named swarmnet. You also want to allow some standalone containers to join this network for debugging. Which sequence of commands correctly sets this up?

hard

A. docker network create -d overlay swarmnetdocker service create --network swarmnet myservice

B. docker network create -d overlay --attachable swarmnetdocker service create --network swarmnet myservice

C. docker network create -d bridge --attachable swarmnetdocker service create --network swarmnet myservice

D. docker network create --driver overlay swarmnetdocker run --net swarmnet myservice

Solution

1. Step 1: Create overlay network with attachable flag

   To allow standalone containers to join, the overlay network must be created with --attachable.

2. Step 2: Deploy service on the created network

   Use docker service create --network swarmnet myservice to deploy the service on the overlay network.

3. Step 3: Analyze options

   docker network create -d overlay swarmnet
   docker service create --network swarmnet myservice misses --attachable, so standalone containers cannot join. docker network create -d bridge --attachable swarmnet
   docker service create --network swarmnet myservice uses bridge driver, which is not multi-host. docker network create --driver overlay swarmnet
   docker run --net swarmnet myservice tries to run a service as a container, which is incorrect.

4. Final Answer:

   docker network create -d overlay --attachable swarmnet and docker service create --network swarmnet myservice -> Option B

5. Quick Check:

   Attachable overlay network + service create = correct setup [OK]

Hint: Use --attachable overlay network for standalone container access [OK]

Common Mistakes:

• Omitting --attachable flag for standalone containers
• Using bridge driver for multi-host networking
• Confusing service create with container run commands