Overlay networks in Swarm in Docker - Step-by-Step Execution

Process Flow - Overlay networks in Swarm

Create Swarm Cluster

↓

Create Overlay Network

↓

Deploy Services

↓

Services Join Overlay Network

↓

Containers Communicate Across Hosts

↓

Network Traffic Routed Securely

↓

End

This flow shows how a Docker Swarm cluster uses overlay networks to connect services across multiple hosts securely.

Execution Sample

Docker

docker swarm init

docker network create -d overlay my_overlay

docker service create --name web --network my_overlay nginx

docker service create --name db --network my_overlay mysql

This code initializes a swarm, creates an overlay network, and deploys two services connected to that network.

Process Table

Step	Command	Action	Result/State Change
1	docker swarm init	Initialize swarm mode on current node	Node becomes manager in swarm cluster
2	docker network create -d overlay my_overlay	Create overlay network named 'my_overlay'	Overlay network 'my_overlay' created and ready for services
3	docker service create --name web --network my_overlay nginx	Deploy 'web' service attached to 'my_overlay'	Service 'web' running; containers join overlay network
4	docker service create --name db --network my_overlay mysql	Deploy 'db' service attached to 'my_overlay'	Service 'db' running; containers join overlay network
5	Service containers start	Containers on different swarm nodes join 'my_overlay'	Containers can communicate securely across hosts via overlay network
6	Network traffic routing	Swarm routes packets between containers over encrypted VXLAN tunnels	Cross-host container communication established
7	End	All services connected via overlay network	Swarm overlay network operational

💡 All services deployed and connected via overlay network; cross-host communication enabled

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Swarm Mode	Disabled	Enabled	Enabled	Enabled	Enabled	Enabled
Overlay Network 'my_overlay'	None	None	Created	Created	Created	Created
Service 'web'	None	None	Running	Running	Running	Running
Service 'db'	None	None	None	Running	Running	Running
Containers on Overlay	None	None	None	Joined	Joined	Joined

Key Moments - 3 Insights

Why do containers on different hosts communicate even though they are on separate machines?

Because the overlay network creates a virtual network that spans all swarm nodes, allowing containers to communicate as if on the same network (see execution_table step 5).

What happens if you try to deploy a service without specifying the overlay network?

The service will use the default bridge network, which does not span multiple hosts, so containers on different nodes cannot communicate (not shown in execution_table but implied by step 3 and 4).

How does Docker Swarm secure the network traffic between containers on different hosts?

Swarm uses encrypted VXLAN tunnels to route traffic securely between containers across hosts (see execution_table step 6).

Visual Quiz - 3 Questions

Look at the execution table, at which step is the overlay network created?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Check the 'Action' column for the command that creates the overlay network.

According to the variable tracker, when does the 'web' service start running?

A After Step 4

B After Step 2

C After Step 3

D At Start

💡 Hint

Look at the 'Service web' row and see when its state changes to 'Running'.

If the overlay network was not created, what would happen to container communication across hosts?

A Containers would communicate normally

B Containers could not communicate across hosts

C Containers would communicate but insecurely

D Containers would crash

💡 Hint

Refer to key moment about network communication and overlay network role.

Concept Snapshot

Docker Swarm Overlay Networks:
- Use 'docker network create -d overlay <name>' to create.
- Overlay networks span multiple swarm nodes.
- Services attach with '--network <name>' to communicate.
- Traffic is routed securely via encrypted tunnels.
- Enables multi-host container communication in swarm.

Full Transcript

This visual execution shows how Docker Swarm uses overlay networks to connect containers across multiple hosts. First, swarm mode is initialized on a node. Then, an overlay network named 'my_overlay' is created. Next, two services, 'web' and 'db', are deployed and attached to this overlay network. As containers start on different swarm nodes, they join the overlay network, enabling them to communicate securely across hosts. Docker Swarm routes network traffic using encrypted VXLAN tunnels, ensuring secure communication. The variable tracker shows the state changes of swarm mode, network creation, service deployment, and container joining. Key moments clarify why overlay networks enable cross-host communication and how security is maintained. The quiz tests understanding of when the network is created, when services start, and the importance of the overlay network for communication.

Practice

1. What is the main purpose of an overlay network in Docker Swarm?

easy

A. To provide a graphical interface for managing containers

B. To isolate containers within the same host only

C. To store container logs centrally

D. To enable communication between containers on different Docker hosts

Solution

1. Step 1: Understand overlay network function

   An overlay network connects containers running on different Docker hosts, allowing them to communicate as if on the same network.

2. Step 2: Compare options

   Options A, B, and D describe other features unrelated to overlay networks. Only To enable communication between containers on different Docker hosts correctly describes the main purpose.

3. Final Answer:

   To enable communication between containers on different Docker hosts -> Option D

4. Quick Check:

   Overlay network = cross-host container communication [OK]

Hint: Overlay networks connect containers across hosts, not just one host [OK]

Common Mistakes:

• Thinking overlay networks only work on one host
• Confusing overlay networks with logging or UI features
• Assuming overlay networks isolate containers instead of connecting them

2. Which command correctly creates an overlay network named mynetwork in Docker Swarm?

easy

A. docker network create --driver overlay mynetwork

B. docker network create --driver bridge mynetwork

C. docker swarm network create mynetwork

D. docker create network overlay mynetwork

Solution

1. Step 1: Identify correct command syntax

   The correct syntax to create an overlay network is docker network create --driver overlay [name].

2. Step 2: Evaluate options

   docker network create --driver bridge mynetwork uses the bridge driver, not overlay. docker swarm network create mynetwork is invalid syntax. docker create network overlay mynetwork is incorrect command order. Only docker network create --driver overlay mynetwork is correct.

3. Final Answer:

   docker network create --driver overlay mynetwork -> Option A

4. Quick Check:

   Correct overlay network creation uses --driver overlay [OK]

Hint: Use 'docker network create --driver overlay' to create overlay networks [OK]

Common Mistakes:

• Using bridge driver instead of overlay
• Incorrect command order or missing 'network' keyword
• Confusing swarm commands with network commands

3. Given the following Docker Swarm overlay network creation command:

docker network create -d overlay --attachable mynet

What does the --attachable flag do?

medium

A. Limits the network to only swarm services

B. Prevents services from using the network

C. Allows standalone containers to connect to the overlay network

D. Automatically attaches volumes to containers

Solution

1. Step 1: Understand the --attachable flag

   The --attachable flag allows standalone containers (not part of swarm services) to connect to the overlay network.

2. Step 2: Analyze options

   Prevents services from using the network is false because it does not prevent services. Limits the network to only swarm services is opposite of what attachable does. Automatically attaches volumes to containers is unrelated to networks.

3. Final Answer:

   Allows standalone containers to connect to the overlay network -> Option C

4. Quick Check:

   --attachable = standalone container access [OK]

Hint: Attachable lets normal containers join overlay networks [OK]

Common Mistakes:

• Thinking --attachable restricts network to swarm services
• Confusing attachable with volume or storage options
• Assuming it disables service connections

4. You created an overlay network with:

docker network create -d overlay mynet

But when you try to connect a standalone container using docker run --net mynet, it fails. What is the likely cause?

medium

A. The overlay network was not created with the --attachable flag

B. The container image is incompatible with overlay networks

C. Docker Swarm mode is not initialized

D. The container must be part of a service to use overlay networks

Solution

1. Step 1: Identify overlay network usage for standalone containers

   Standalone containers can only connect to overlay networks if the network was created with --attachable.

2. Step 2: Evaluate other options

   The container image is incompatible with overlay networks is incorrect; container images do not affect network connection. Docker Swarm mode is not initialized is unrelated if network was created. The container must be part of a service to use overlay networks is false because attachable networks allow standalone containers.

3. Final Answer:

   The overlay network was not created with the --attachable flag -> Option A

4. Quick Check:

   Standalone container needs --attachable network [OK]

Hint: Add --attachable to overlay network for standalone containers [OK]

Common Mistakes:

• Ignoring the need for --attachable flag
• Blaming container image compatibility
• Assuming all overlay networks allow standalone containers

5. You want to deploy a multi-host Docker Swarm service that uses an overlay network named swarmnet. You also want to allow some standalone containers to join this network for debugging. Which sequence of commands correctly sets this up?

hard

A. docker network create -d overlay swarmnetdocker service create --network swarmnet myservice

B. docker network create -d overlay --attachable swarmnetdocker service create --network swarmnet myservice

C. docker network create -d bridge --attachable swarmnetdocker service create --network swarmnet myservice

D. docker network create --driver overlay swarmnetdocker run --net swarmnet myservice

Solution

1. Step 1: Create overlay network with attachable flag

   To allow standalone containers to join, the overlay network must be created with --attachable.

2. Step 2: Deploy service on the created network

   Use docker service create --network swarmnet myservice to deploy the service on the overlay network.

3. Step 3: Analyze options

   docker network create -d overlay swarmnet
   docker service create --network swarmnet myservice misses --attachable, so standalone containers cannot join. docker network create -d bridge --attachable swarmnet
   docker service create --network swarmnet myservice uses bridge driver, which is not multi-host. docker network create --driver overlay swarmnet
   docker run --net swarmnet myservice tries to run a service as a container, which is incorrect.

4. Final Answer:

   docker network create -d overlay --attachable swarmnet and docker service create --network swarmnet myservice -> Option B

5. Quick Check:

   Attachable overlay network + service create = correct setup [OK]

Hint: Use --attachable overlay network for standalone container access [OK]

Common Mistakes:

• Omitting --attachable flag for standalone containers
• Using bridge driver for multi-host networking
• Confusing service create with container run commands