foxxmd.dev / blog
[READ-ONLY] Mirror of https://github.com/FoxxMD/blog. blog.foxxmd.dev
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

Update swarm usage

FoxxMD (Sep 23, 2025, 4:48 PM UTC) 64135a9e e4573ced

+10
+10
_posts/2025-04-07-migrating-to-traefik.md
··· 1764 1764 * *Do I have to do things the swarm way if in a swarm?* 1765 1765 * **No.** And that is the crux of this FAQ...we can take advantage of Swarm features (Overlay network) without needing to actually use Swarm for anything else. 1766 1766 1767 + **When Should You NOT Swarm?** 1768 + 1769 + * Hosts span an untrusted network/public internet 1770 + * Swarm requires [some open ports](https://docs.docker.com/engine/swarm/swarm-tutorial/#open-protocols-and-ports-between-the-hosts) that should never be opened to the public internet. 1771 + * Even on moderately trusted networks, encrypting overlay networks can have [non-trivial performance penalties](https://docs.docker.com/engine/network/drivers/overlay/#encrypt-traffic-on-an-overlay-network) and encryption is not supported on windows 1772 + * Hosts communicate solely over a VPN 1773 + * VXLAN, the protocol Swarm uses for host communication and overlay networks, introduces [50 bytes of packet overhead](https://lev-0.com/2024/03/11/scalable-and-secure-vxlan-multisite-using-netbird-part-1initial-config-l3vpn/). Wireguard also has its own packet overhead. Combining both of these for traffic can cause MTU over-limit issues for the [swarm ingress network](https://github.com/moby/moby/issues/36689#issuecomment-987706496) and elsewhere. 1774 + 1775 + The above points don't mean you shouldn't use swarm *at all*. If you have a trusted network with multiple hosts swarm can still be run there -- it just shouldn't be used to join *all* hosts in the event they fit either of those scenarios. 1776 + 1767 1777 ##### A Note On Quorum 1768 1778 1769 1779 Swarm nodes run as either a [manager](https://docs.docker.com/engine/swarm/how-swarm-mode-works/nodes/#manager-nodes) or [worker](https://docs.docker.com/engine/swarm/how-swarm-mode-works/nodes/#worker-nodes) node. Manager nodes are responsible for maintaining the cluster and workers are dumb nodes that just do work.[^manager-worker] Managers must [maintain a **quoroum**](https://docs.docker.com/engine/swarm/admin_guide/#maintain-the-quorum-of-managers) to decide how things are done. Each manager gets a vote. If there are 0 managers online, or *only an even number*, then a stalemate is reached and the cluster can't operate.