Docker Swarm

Enable deliberately

Swarm is off until an operator initializes it on the panel, confirms with an interactive password re-check, and enables it. Each node needs agent v0.15.4 or newer and NINEDEPLOY_AGENT_SWARM_MANAGER=<panel-address>:2377 to opt in. Set the Docker service's orchestrator to swarm and deploy; existing services keep their container runtime.

Updates and routing

• One stack per service applies the image, env, replicas and limits on every deploy. Updates are rolling and start-first; a failed Traefik probe triggers rollback.
• Only nodes joined through the panel receive NineDeploy tasks. Images arrive by registry digest or sealed image transfer before a node gets tasks.
• Traefik is the public entry point; workload ports are not published on the Swarm ingress mesh. Overlay networks are encrypted.
• Between Swarm hosts, allow 2377/tcp, 7946/tcp and udp, 4789/udp and ESP (IP protocol 50), restricted to the cluster. Encrypted overlays do not support Windows nodes.

Supported scope

Swarm does not accept Compose, PM2, node-pinned services, volumes, Docker socket mounts, published host ports, managed databases, fan-out targets or multiline env values. PR previews use ordinary containers. Swarm cannot express memory-swap caps or CPU shares. Read the multi-node rollback runbook before reverting to a pre-Swarm panel.

ninedeploy swarm status
ninedeploy services swarm

# SDK: placement, image transfers, Swarm and server roles
# MCP inspection: get_service_placement, list_image_transfers,
# get_service_swarm, get_swarm_status