51.4 Overlay networks across hosts

Example 1: Server A IP

Type this:

hostname -I | awk '{print $1}'

You will see:

10.0.1.10

What it means: Private IP of server A.

Example 2: Server B IP

Type this:

hostname -I | awk '{print $1}'

You will see:

10.0.1.20

What it means: Run this on server B.

Example 3: Can they talk?

Type this:

ping -c2 10.0.1.20 | tail -1

You will see:

rtt min/avg/max/mdev = 0.412/0.430/0.448/0.018 ms

What it means: From A to B works.

Example 4: 2377

Type this:

aws ec2 authorize-security-group-ingress --group-id sg-0swarm1 --protocol tcp --port 2377 --source-group sg-0swarm1

You will see:

{"Return": true}

What it means: Only members of the same group.

Example 5: 7946 both

Type this:

aws ec2 authorize-security-group-ingress --group-id sg-0swarm1 --ip-permissions IpProtocol=tcp,FromPort=7946,ToPort=7946,UserIdGroupPairs=[{GroupId=sg-0swarm1}] IpProtocol=udp,FromPort=7946,ToPort=7946,UserIdGroupPairs=[{GroupId=sg-0swarm1}]

You will see:

{"Return": true}

What it means: Gossip between nodes.

Example 6: 4789 UDP

Type this:

aws ec2 authorize-security-group-ingress --group-id sg-0swarm1 --protocol udp --port 4789 --source-group sg-0swarm1

You will see:

{"Return": true}

What it means: The tunnel itself.

Example 7: Init

Type this:

docker swarm init --advertise-addr 10.0.1.10

You will see:

Swarm initialized: current node (k3x9...) is now a manager.

    docker swarm join --token SWMTKN-1-EXAMPLE-TOKEN 10.0.1.10:2377

What it means: Copy the join line. The token shown here is a placeholder.

Example 8: Get it again later

Type this:

docker swarm join-token worker -q

You will see:

SWMTKN-1-EXAMPLE-TOKEN

What it means: Prints only the token.

Example 9: Check state

Type this:

docker info -f '{{.Swarm.LocalNodeState}}'

You will see:

active

What it means: Swarm is on.

Example 10: Join

Type this:

docker swarm join --token SWMTKN-1-EXAMPLE-TOKEN 10.0.1.10:2377

You will see:

This node joined a swarm as a worker.

What it means: Run on server B.

Example 11: List nodes on A

Type this:

docker node ls

You will see:

ID        HOSTNAME    STATUS  AVAILABILITY  MANAGER STATUS
k3x9... * server-a    Ready   Active        Leader
m7q2...   server-b    Ready   Active

What it means: Two nodes, both Ready.

Example 12: Label server B

Type this:

docker node update --label-add role=payments server-b

You will see:

server-b

What it means: We will use this label to place payments.

Example 13: Create

Type this:

docker network create -d overlay --attachable shopnet

You will see:

x8r1...

What it means: Created on the manager.

Example 14: List

Type this:

docker network ls -f driver=overlay

You will see:

NETWORK ID   NAME      DRIVER    SCOPE
q1w2...      ingress   overlay   swarm
x8r1...      shopnet   overlay   swarm

What it means: Scope swarm means cluster-wide. ingress is Swarm's own.

Example 15: Subnet

Type this:

docker network inspect shopnet -f '{{(index .IPAM.Config 0).Subnet}}'

You will see:

10.0.2.0/24

What it means: Docker picked a range.

Example 16: Create service

Type this:

docker service create --name payments --network shopnet --constraint node.labels.role==payments hashicorp/http-echo:1.0 -listen=:8080 -text=paid

You will see:

overall progress: 1 out of 1 tasks
verify: Service converged

What it means: Runs on server B.

Example 17: Where is it?

Type this:

docker service ps payments --format '{{.Node}} {{.CurrentState}}'

You will see:

server-b Running 10 seconds ago

What it means: Placed as asked.

Example 18: Network exists on B now

Type this:

docker network ls -f name=shopnet --format '{{.Name}} {{.Scope}}'

You will see:

shopnet swarm

What it means: Run on B. The overlay appears only when a task needs it.

Example 19: Call

Type this:

docker run --rm --network shopnet curlimages/curl:8.10.1 -s http://payments:8080

You will see:

paid

What it means: From server A to server B by name.

Example 20: Look up the name

Type this:

docker run --rm --network shopnet busybox:1.36 nslookup payments | tail -2

You will see:

Name:      payments
Address:   10.0.2.2

What it means: A virtual IP for the service.

Example 21: Look up tasks

Type this:

docker run --rm --network shopnet busybox:1.36 nslookup tasks.payments | tail -1

You will see:

Address:   10.0.2.3

What it means: tasks.NAME gives each real container IP.

Example 22: Scale

Type this:

docker service update --constraint-rm node.labels.role==payments payments && docker service scale payments=3

You will see:

payments scaled to 3
verify: Service converged

What it means: Constraint removed so replicas can land on both servers.

Example 23: Where

Type this:

docker service ps payments --format '{{.Node}}' | sort | uniq -c

You will see:

2 server-a
1 server-b

What it means: Spread over two nodes.

Example 24: All task IPs

Type this:

docker run --rm --network shopnet busybox:1.36 nslookup tasks.payments | grep Address | tail -3

You will see:

Address:   10.0.2.3
Address:   10.0.2.6
Address:   10.0.2.7

What it means: Three replicas behind one name.

Example 25: Create

Type this:

docker network create -d overlay --opt encrypted --attachable paysecure

You will see:

p9z...

What it means: Encrypted overlay.

Example 26: Check

Type this:

docker network inspect paysecure -f '{{.Options}}'

You will see:

map[com.docker.network.driver.overlay.vxlanid_list:4098 encrypted:]

What it means: encrypted is set.

Example 27: Firewall note

Type this:

echo 'allow protocol 50 (ESP) between nodes'

You will see:

allow protocol 50 (ESP) between nodes

What it means: IPsec needs ESP open too.

Example 28: Nodes healthy?

Type this:

docker node ls --format '{{.Hostname}} {{.Status}}'

You will see:

server-a Ready
server-b Ready

What it means: Both Ready.

Example 29: Watch the tunnel on B

Type this:

sudo tcpdump -ni ens5 udp port 4789 -c 3

You will see:

3 packets captured

What it means: Packets arrive, so the tunnel works. Zero packets means the security group blocks 4789.

Example 30: Peers seen by the network

Type this:

docker network inspect shopnet -f '{{range .Peers}}{{.Name}} {{.IP}}  {{end}}'

You will see:

server-a 10.0.1.10  server-b 10.0.1.20

What it means: Both servers are peers.

Example 31: Write it

Type this:

printf 'services:\n  payments:\n    image: hashicorp/http-echo:1.0\n    command: ["-listen=:8080","-text=paid"]\n    deploy:\n      replicas: 2\n    networks: [shop]\nnetworks:\n  shop:\n    driver: overlay\n' > stack.yaml

You will see:

(no output)

What it means: One service on an overlay.

Example 32: Deploy

Type this:

docker stack deploy -c stack.yaml swg

You will see:

Creating network swg_shop
Creating service swg_payments

What it means: Prefix swg_ is the stack name.

Example 33: Remove

Type this:

docker stack rm swg

You will see:

Removing service swg_payments
Removing network swg_shop

What it means: Clean.

Example 34: Services

Type this:

docker service rm payments

You will see:

payments

What it means: Containers stop on both nodes.

Example 35: Networks

Type this:

docker network rm shopnet paysecure

You will see:

shopnet
paysecure

What it means: Now unused.

Example 36: Leave

Type this:

docker swarm leave --force

You will see:

Node left the swarm.

What it means: Run on B first, then on A.

Example 37: Publish

Type this:

docker service create --name web --replicas 1 -p 8088:80 nginx:1.27

You will see:

overall progress: 1 out of 1 tasks
verify: Service converged

What it means: One replica, port 8088 on every node.

Example 38: Hit server B

Type this:

curl -s -o /dev/null -w '%{http_code}\n' http://10.0.1.20:8088

You will see:

200

What it means: Even if the replica runs on server A.

Example 39: Remove

Type this:

docker service rm web

You will see:

web

What it means: The mesh is great behind a load balancer that checks every node.