Docker Swarm

Docker Swarm is a cluster-management feature in Docker Engine for running production workloads across multiple Docker daemons. Current Docker versions include it, and administrators manage it through the Docker CLI without separate orchestration software. Managers use a declarative service model to maintain desired settings such as replica counts, networks, storage resources, and exposed ports. Services can be replicated or run globally, with one task on every node. Overlay networking connects daemons, and an ingress network supports load balancing. Services receive DNS names and can use virtual IP or DNS round-robin discovery. Swarm can deploy updates incrementally and roll back to a previous version. Nodes authenticate and encrypt communications with mutual TLS, with TLS 1.2 as the minimum. Application traffic on overlay networks is not encrypted by default; enabling IPsec encryption can reduce performance. Docker recommends a maximum of seven manager nodes and /24 overlay blocks, which limit a network to 256 IP addresses. Swarm mode is free and open source, and is self-hosted. It does not include multi-cluster management or autoscaling.

Swarm provides built-in, self-hosted cluster management with service discovery, networking, and incremental updates. Consider its encryption defaults, network limits, and lack of autoscaling before choosing it.

It suits teams running Docker workloads across multiple daemons that want cluster management built into Docker Engine. Teams needing autoscaling or multi-cluster management should note those capabilities are not included.

Docker Swarm is a production-oriented cluster manager built directly into Docker Engine. It suits teams that want declarative service control from the Docker CLI and prefer a self-hosted, open-source approach. Its focused design keeps orchestration straightforward, but the lack of autoscaling and default encryption for application traffic narrows where it is the right fit.

Overview

Swarm mode coordinates a cluster of Docker daemons without requiring a separate orchestration product. Managers maintain the state you declare for replica counts, networks, storage resources, and exposed ports, continually working to bring the cluster back to that target. This is useful when you want one operational model for services instead of manually placing individual containers.

The deployment model is self-hosted, with Docker Engine and the Docker CLI at the center. Swarm does not provide multi-cluster management or autoscaling, so it is best for a defined environment that you can size and operate yourself rather than a platform expected to adjust capacity automatically or present several clusters in one control plane.

Key features

Scheduling and service updates

Replicated services let you set how many tasks should run, while global services place one task on every node. Managers reconcile those declarations across the cluster, making the model practical for predictable workloads and node-wide agents. Updates can roll out incrementally and roll back to the previous service version when a change fails, reducing the risk of an all-at-once deployment. That is a meaningful release safeguard, but it remains a deployment control rather than automatic capacity management.

Networking and discovery

Overlay networks connect daemons across the cluster, and the ingress network provides load balancing for incoming traffic. Services receive DNS names and can be reached through virtual-IP load balancing or DNS round-robin discovery, so service-to-service addressing does not depend on tracking individual task locations.

Cluster networking has concrete planning costs. Nodes require TCP and UDP port 7946 for discovery and UDP port 4789 by default for overlay data traffic. Docker recommends /24 overlay blocks, limiting a network to 256 IP addresses. Those boundaries can become restrictive for large or densely segmented deployments.

Security

Swarm uses mutual TLS to authenticate nodes and encrypt their communications, with TLS 1.2 as the minimum. Application data crossing overlay networks is not encrypted by default. You can enable IPsec-based overlay encryption, but Docker warns of a non-negligible performance penalty, so teams handling sensitive east-west traffic must balance protection against throughput.

Cluster scale

Docker recommends no more than seven manager nodes and notes that adding managers can reduce performance. That guidance favors a compact control plane and makes Swarm less suitable when a very large manager quorum is part of your architecture.

Pricing

Swarm mode costs free and is open source. The Docker Swarm mode plan is built into Docker Engine, with no additional orchestration software needed. It is the relevant choice for anyone deploying the cluster manager itself; there is no free trial because the software is already free.

Docker’s account plans matter for associated Docker Hub and tooling services rather than adding Swarm features. Docker Personal costs free for one user, one private Docker Hub repository, and 100 Docker Hub pulls per hour. It fits an individual or small experiment, but the private-repository and pull-rate caps can constrain active teams.

Docker Pro is $9 a month per user when billed yearly, or $11 per user/month on a monthly plan. It includes one user, two Docker Scout-enabled repositories, and an unlimited Docker Hub pull rate. Docker Team is $15 a month per user with annual billing, or $16 per user/month monthly, supporting up to 100 users, unlimited private Docker Hub repositories, and 10 organization access tokens. Docker Business is $24 a month per user with annual billing, with no user cap, unlimited private repositories, and 100 organization access tokens. Choose Pro for an individual needing higher pull capacity, Team for a bounded organization, and Business for organizations that exceed Team’s user or token limits.

Platforms

Swarm supports API, Linux, self-hosted, and Windows environments. Its self-hosted nature leaves infrastructure operation, network setup, and capacity planning with your team.

Who it's for

Swarm is a strong match for Docker-focused teams running production services on a manageable number of nodes, especially when declarative scheduling, built-in discovery, and reversible rolling updates matter more than advanced platform breadth. It is less appropriate for organizations that require autoscaling, multi-cluster administration, very large manager groups, or encrypted overlay application traffic without a performance trade-off.

Pros and cons

• Pro: Included with Docker Engine, so there is no separate orchestration license or product to add.
• Pro: Declarative services, replicated and global scheduling, discovery, ingress load balancing, and rollback support cover core cluster operations in one CLI-driven model.
• Pro: Mutual TLS protects node communication with a minimum TLS 1.2 requirement.
• Con: Application traffic on overlays is unencrypted by default, and IPsec encryption can impose a non-negligible performance penalty.
• Con: No autoscaling or multi-cluster management means more manual capacity and fleet work.
• Con: The recommended seven-manager ceiling and /24 overlay guidance limit some large or highly segmented designs.

Alternatives

For a broader comparison, see Container Orchestration Software.

• .NET is a free, open-source option on Windows, Mac, Linux, iOS, and Android, with a free plan supporting up to 1,000 nodes.
• MicroK8s is a free Kubernetes distribution for Linux, macOS, self-hosted, and Windows, with a free trial and no-license-fee MicroK8s plan.
• Civo Block Storage suits teams seeking persistent volumes with distributed data mirrors and usage-based billing.
• Exoscale Scalable Kubernetes Service offers a free starter cluster with a managed control plane and CLI, API, and Terraform integration.
• Google Kubernetes Engine is a managed Kubernetes route with a free tier and trial.
• k0s is a 100% open-source Kubernetes distribution free for personal or commercial use.
• Kubermatic Kubernetes Platform provides an Apache-licensed community edition and a separate enterprise edition.
• Kubernetes is the free, open-source platform to consider when you want the broader Kubernetes ecosystem.

Verdict

Choose Docker Swarm when you want no-cost, self-hosted production orchestration that stays close to Docker Engine and provides dependable scheduling, discovery, networking, and rolling rollback controls. Look elsewhere if autoscaling, multi-cluster operations, larger control planes, or encrypted application traffic by default are requirements; Swarm’s compact scope and network trade-offs will otherwise become limiting.