To create a Docker Swarm on Linux VPS servers, install Docker Engine on every VPS, initialize one VPS as the manager with docker swarm init --advertise-addr <MANAGER_IP>, join the other VPSs with the printed worker or manager token, then confirm membership with docker node ls. Before initialization, restrict the Swarm control and overlay ports to traffic between your nodes.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
This guide covers Swarm mode, not the obsolete Swarm Classic implementation. It uses the VPS address that the other nodes can actually reach; substitute your own address wherever <MANAGER_IP> appears.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What a Docker Swarm does on VPS servers
Docker Swarm mode turns several Docker Engine installations into one cluster. A manager maintains the swarm state and accepts administrative commands. Workers provide nodes on which workloads can run. A node can be a manager, a worker, or both, depending on the join operation used.
The cluster uses Docker’s built-in security material and networking. During initialization, Docker creates a self-signed root certificate authority, generates separate join tokens for workers and managers, and creates the ingress overlay network used when service ports are published through the routing mesh.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Swarm membership is controlled by tokens. A worker token adds a node as a worker; a manager token adds it as a manager with control over the swarm. Because a manager token can grant control of the entire cluster, handle it like a high-value credential rather than ordinary setup output.
Prerequisites and planning
Prepare every VPS
- Use Linux VPS instances that can communicate with one another over their reachable node addresses.
- Install Docker Engine on every VPS by following the installation guide for that VPS’s Linux distribution. Engine installation is separate from Swarm initialization.
- Record the address of the VPS that will become the first manager. It must be reachable by every node that will join.
- Decide whether the nodes will communicate over public addresses or a provider’s private network. A private network is preferable where the provider offers one, but verify its routing and firewall behavior before relying on it.
Choose the first manager carefully
Run the initialization command on the VPS you intend to administer from. The address passed to --advertise-addr is the address other swarm nodes use to contact that manager. Do not use a loopback address or an address that exists only inside an unreachable interface.
Recommended Free Tools
Plan firewall rules before joining nodes
Swarm control traffic and overlay traffic are different from application traffic. Permit the Swarm ports only between trusted node addresses, then expose application ports separately as required by the services you deploy. Do not make the manager control port publicly reachable merely because the VPS has a public IP.
Swarm ports and VPS firewall rules
The following ports are the standard Swarm-mode ports identified in Docker’s tutorial material. Docker documentation should be checked again before production because the exact current port guidance must be verified against the release you are running.
| Port or protocol | Transport | Purpose | Recommended exposure |
|---|---|---|---|
| 2377 | TCP | Communication with and between manager nodes. | Allow only between swarm nodes; do not expose publicly. |
| 7946 | TCP and UDP | Overlay-network node discovery. | Allow between every swarm node. |
| 4789 | UDP | Overlay-network traffic, using the default VXLAN port. | Allow between every swarm node. The port is configurable, so match any deliberate configuration. |
| IP protocol 50 | IPSec ESP | Required only for encrypted overlay networks created with --opt encrypted. |
Permit between nodes only when you use encrypted overlays and your provider supports ESP. |
Open TCP 2377, TCP and UDP 7946, and UDP 4789 between the node IP addresses before enabling Swarm mode and using the routing mesh. Keep public application ports separate: a web service might need a public HTTP or HTTPS port, while the Swarm control plane should remain on the private side of your firewall.
Do not copy legacy port lists without checking their context
Some community posts mention TCP 2376, while other lists contain ports such as 2375, 3375, or 8500. Those lists do not match the official Swarm-mode set described above: one community list is inconsistent with the official guidance, and the latter ports are associated with Swarm Classic from Docker 1.11 and older. Do not add them to a Swarm-mode firewall rule unless a current, authoritative requirement for your exact deployment says otherwise.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Step 1: Install Docker Engine on all VPSs
Install Docker Engine on the manager VPS and on every intended worker or additional manager. Use the distribution-specific Docker installation procedure for your Linux release. The installation process is not covered by the Swarm commands themselves, so confirm that the docker command works on each host before continuing.
At this stage, do not run docker swarm init on every server. Only one VPS becomes the initial manager. The remaining servers join that swarm using a command generated by the manager.
Step 2: Initialize the first manager
On the chosen manager VPS, run:
docker swarm init --advertise-addr <MANAGER_IP>For example, Docker’s reference command uses:
docker swarm init --advertise-addr 192.168.99.121Use the manager address reachable from the other VPSs rather than copying the example address. A successful initialization prints a message similar to:
Swarm initialized: current node (bvz81updecsj6wjz393c09vti) is now a manager.The node identifier in your output will be different. Initialization also creates the swarm’s self-signed root CA, a worker join token, a manager join token, and the ingress overlay network used for published service ports.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat to record from the output
- The manager’s reachable IP address or hostname, if your network design uses one.
- The worker join command, including its token and the manager endpoint on port 2377.
- The manager join command, if you plan to add additional managers.
Tokens printed during initialization are credentials. Avoid placing them in public tickets, screenshots, shell history shared with untrusted users, or source repositories.
Step 3: Join worker VPSs
On each worker VPS, run the worker command printed by docker swarm init:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
docker swarm join --token <WORKER_TOKEN> <MANAGER_IP>:2377Replace <WORKER_TOKEN> with the worker token generated by the manager and replace <MANAGER_IP> with the manager endpoint. Run the command on the worker, not on the manager.
The token determines the role. A worker token joins the node as a worker; a manager token joins it as a manager. If the command succeeds, Docker reports that the node joined the swarm. Repeat the worker command on each additional worker VPS.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Joining another manager instead
If you need another manager, use the manager join command generated by initialization rather than the worker command. The endpoint still uses the manager address and TCP port 2377, but the token must be the manager token. A manager has administrative control, so give that token only to hosts and operators that should be able to manage the whole swarm.
Step 4: Retrieve or rotate join tokens
You can display the current join command for either role from a manager:
docker swarm join-token workerdocker swarm join-token manager
Use the quiet option when you need only the token value:
docker swarm join-token worker -qdocker swarm join-token manager -q
The role-specific command is useful when the original initialization output is no longer available. Treat the manager token as especially sensitive. If a token has been exposed, rotate the relevant token and use the newly generated value for future joins rather than continuing to distribute the compromised value.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Step 5: Verify the cluster from a manager
Run this command on a manager:
docker node lsThe listing is the manager’s view of swarm membership. Confirm that the expected nodes appear and that each node has the role you intended. A worker should not be mistaken for a manager simply because Docker is installed and running on it; the role is established by the token used during the join.
If a node does not appear
- Confirm that the join command ran on the intended VPS and completed without an error.
- Check that the worker can reach the manager endpoint on TCP 2377.
- Check TCP and UDP 7946 and UDP 4789 between all swarm nodes; these are needed for discovery and overlay traffic.
- Verify that
<MANAGER_IP>is the address advertised by the manager and is routable from the joining VPS. - Generate a fresh role-appropriate command with
docker swarm join-token workerordocker swarm join-token managerif the copied token may be incomplete or stale.
Networking after the swarm is formed
The ingress network and routing mesh
Initialization creates an overlay network named ingress. It supports published service ports through Swarm’s routing mesh. Because the routing mesh depends on node-to-node overlay communication, opening only the manager’s control port is not enough; TCP and UDP 7946 plus UDP 4789 must be permitted between the nodes.
Publishing an application port is a separate decision from joining the swarm. Open only the public application ports your service actually needs, and keep 2377, 7946, and 4789 restricted to the node network wherever possible.
Encrypted overlay networks
If you create an encrypted overlay with --opt encrypted, the nodes also need IP protocol 50 (IPSec ESP). This is not required for an ordinary unencrypted overlay. Check your VPS provider’s network policy before enabling encryption, because a provider or upstream firewall may block ESP even when the usual TCP and UDP rules are correct.
Common setup failures and their causes
“Connection refused” or a timeout on port 2377
This usually indicates that the joining VPS cannot reach the manager’s advertised endpoint. Check the manager’s firewall, the worker’s egress rules, the provider’s security group, and the address supplied to --advertise-addr. Do not solve the problem by exposing 2377 to the entire internet; narrow the rule to the trusted node addresses.
Nodes join but overlay services cannot communicate
Membership and overlay networking use different traffic paths. A successful join does not prove that discovery and VXLAN traffic are allowed. Permit TCP and UDP 7946 and UDP 4789 between every node, then verify that the provider’s private or public routing allows those packets in both directions.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The wrong role appears in docker node ls
The token selected the role. Leave the node from the incorrect role and join it again with the appropriate worker or manager command generated by the manager. Do not distribute a manager token merely to make a node appear in the manager column.
Copied commands contain the wrong address
The address in Docker’s example is illustrative. Replace it with the actual manager address reachable by your VPSs. If a host has multiple interfaces, confirm which interface carries inter-node traffic before reinitializing or joining.
Firewall rules include obsolete ports
Remove rules copied from Swarm Classic guides or unverified forum lists unless another service genuinely requires them. For Swarm mode, begin with 2377/TCP, 7946/TCP and UDP, and 4789/UDP, adding protocol 50 only for encrypted overlays.
A practical firewall checklist
- List the private or public IP addresses of every manager and worker.
- Allow TCP 2377 only between those node addresses, with manager-to-manager communication included when you have multiple managers.
- Allow TCP 7946 and UDP 7946 between all nodes.
- Allow UDP 4789 between all nodes.
- If using
--opt encrypted, allow IP protocol 50 between nodes and confirm provider support. - Deny public access to the Swarm control port unless a tightly controlled administrative design explicitly requires it.
- Add public rules only for the application ports your deployed services publish.
- After applying the rules, run
docker node lson a manager and test the service’s intended network path.
Manager and worker choices
| Choice | Join method | Capability | Credential handling |
|---|---|---|---|
| Worker | docker swarm join --token <WORKER_TOKEN> <MANAGER_IP>:2377 |
Joins the swarm as a worker node. | Use the worker token; do not substitute the manager token. |
| Manager | Use the manager join command and manager token generated by initialization. | Joins with swarm-management control. | Protect the manager token as a credential granting control of the swarm. |
Choose the least-privileged role that meets the node’s purpose. A server that only needs to run workloads does not need a manager token.
Operational safeguards
- Keep a private record of which VPS address was advertised and which nodes were intended to be managers or workers.
- Regenerate a join token when its confidentiality is uncertain, then distribute the replacement through a protected channel.
- Review firewall rules whenever a node is added, removed, or moved between public and private networking.
- Recheck the current Docker documentation before production changes, especially the port list and any release-specific behavior, because documentation wording and requirements can change.
- Do not confuse a successful cluster join with a complete application deployment: service publishing, public ingress, data persistence, backups, and monitoring require their own designs.
What a successful result looks like
At the end of the setup, Docker Engine is installed on every VPS, one manager has initialized the swarm with a reachable advertised address, each additional node has joined with the intended role-specific token, and docker node ls on the manager lists the expected membership. The control and overlay ports are limited to node-to-node traffic, while application ports are opened independently according to the services you deploy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
