Docker Networking for Swarm services

If you are running containers on a Swarm cluster, your containers will use overlay network to communicate with each others.

When a swarm manager is initialized or a worker nodes are joined a swarm, a default overlay network will be created for you automatically. and all your containers across multi docker hosts can communicate with each others via this default overlay network.
But This network is not the best choice for production systems.

You also can create a user-defined overlay network, your own custom overlay network, to connect services. This is recommended for services running in production.

Below tutorial will show you how to create a user-defined overlay network and assign it to your docker containers in multi docker daemons. Steps are:

• On host1, initialize the node as a swarm (manager).
• On host2, join the node to the swarm (worker).
• On host1, create an attachable overlay network (test-net).
• On host1, run an interactive alpine container (alpine1) on test-net.
• On host2, run an interactive, and detached, alpine container (alpine2) on test-net.
• On host1, from within a session of alpine1, ping alpine2.

Prerequisites

For this test, you need two different Docker hosts that can communicate with each other. Each host must have Docker 17.06 or higher with the following ports open between the two Docker hosts:

• TCP port 2377
• TCP and UDP port 7946
• UDP port 4789

This example refers to the two nodes in our swarm as host1 and host2. These hosts are running on the same network with no firewall involved. This example also uses Linux hosts, but the same commands work on Windows.

These hosts will be referred to as managerand worker. The manager host will function as both a manager and a worker, which means it can both run service tasks and manage the swarm. worker will function as workers only.

List the Docker networks on manager and worker and notice that each of them now has an overlay network called ingress and a bridge network called docker_gwbridge. Only the listing for manager is shown here:

$ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
495c570066be        bridge              bridge              local
961c6cae9945        docker_gwbridge     bridge              local
ff35ceda3643        host                host                local
trtnl4tqnc3n        ingress             overlay             swarm
c8357deec9cb        none                null                local

The docker_gwbridge connects the ingress network to the Docker host’s network interface so that traffic can flow to and from swarm managers and workers. If you create swarm services and do not specify a network, they are connected to the ingress network. It is recommended that you use separate overlay networks for each application or group of applications which will work together.

Now, let’s set up the swarm.

1. On host1, initialize a swarm (and if prompted, use --advertise-addr to specify the IP address for the interface that communicates with other hosts in the swarm, for instance, the private IP address of manager host):

$ docker swarm init
Swarm initialized: current node (vz1mm9am11qcmo979tlrlox42) is now a manager.

To add a worker to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-5g90q48weqrtqryq4kj6ow0e8xm9wmv9o6vgqc5j320ymybd5c-8ex8j0bc40s6hgvy5ui5gl4gy 172.31.47.252:2377

To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.

2. On host2, join the swarm as instructed above:

$ docker swarm join --token <your_token> <your_ip_address>:2377
This node joined a swarm as a worker.

If the node fails to join the swarm, the docker swarm join command times out. To resolve, run docker swarm leave --force on host2, verify your network and firewall settings, and try again.

3. On host1, create an attachable overlay network called test-net:

$ docker network create --driver=overlay --attachable test-net
uqsof8phj3ak0rq9k86zta6ht

4. On host1, start an interactive (-it) container (alpine1) that connects to test-net:

$ docker run -it --name alpine1 --network test-net alpine
/ #

On host2, list the available networks — notice that test-net does not yet exist:

$ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
ec299350b504        bridge              bridge              local
66e77d0d0e9a        docker_gwbridge     bridge              local
9f6ae26ccb82        host                host                local
omvdxqrda80z        ingress             overlay             swarm
b65c952a4b2b        none                null                local

5. On host2, start a detached (-d) and interactive (-it) container (alpine2) that connects to test-net:

$ docker run -dit --name alpine2 --network test-net alpine
fb635f5ece59563e7b8b99556f816d24e6949a5f6a5b1fbd92ca244db17a4342

remember that Automatic DNS container discovery only works with unique container names.

On host2, verify that test-net was created (and has the same NETWORK ID as test-net on host1):

 $ docker network ls
 NETWORK ID          NAME                DRIVER              SCOPE
 ...
 uqsof8phj3ak        test-net            overlay             swarm

On host1, ping alpine2 within the interactive terminal of alpine1:

/ # ping -c 2 alpine2
PING alpine2 (10.0.0.5): 56 data bytes
64 bytes from 10.0.0.5: seq=0 ttl=64 time=0.600 ms
64 bytes from 10.0.0.5: seq=1 ttl=64 time=0.555 ms

The two containers communicate with the overlay network connecting the two hosts. If you run another alpine container on host2 that is not detached, you can ping alpine1 from host2(and here we add the remove option for automatic container cleanup):

$ docker run -it --rm --name alpine3 --network test-net alpine
/ # ping -c 2 alpine1
/ # exit

On host1, close the alpine1 session (which also stops the container):

/ # exit

Clean up your containers and networks:

You must stop and remove the containers on each host independently because Docker daemons operate independently and these are standalone containers. You only have to remove the network on host1 because when you stop alpine2 on host2, test-net disappears.

On host2, stop alpine2, check that test-net was removed, then remove alpine2:

$ docker container stop alpine2
$ docker network ls
$ docker container rm alpine2

On host1, remove alpine1 and test-net:

$ docker container rm alpine1
$ docker network rm test-net

Source Link: https://docs.docker.com/network/network-tutorial-overlay/