Docker Production Deployment: The Complete Swarm & Compose Guide for 2026

1# docker-compose.yml - No version field needed in 2026
2services:
3  web:
4    image: myapp/web:1.5.2
5    build:
6      context: .
7      dockerfile: Dockerfile
8      target: production
9    user: "1000:1000"
10    read_only: true
11    tmpfs:
12      - /tmp
13      - /var/run
14    deploy:
15      resources:
16        limits:
17          cpus: '1.0'
18          memory: 512M
19        reservations:
20          cpus: '0.25'
21          memory: 128M
22    healthcheck:
23      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
24      interval: 30s
25      timeout: 10s
26      retries: 3
27      start_period: 40s
28    environment:
29      - NODE_ENV=production
30    env_file:
31      - .env.production
32    secrets:
33      - db_password
34      - jwt_secret
35    ports:
36      - "3000:3000"
37    networks:
38      - frontend
39    depends_on:
40      db:
41        condition: service_healthy
42    logging:
43      driver: "json-file"
44      options:
45        max-size: "10m"
46        max-file: "5"
47
48  db:
49    image: postgres:16-alpine
50    user: "999:999"
51    volumes:
52      - postgres_data:/var/lib/postgresql/data
53    environment:
54      POSTGRES_DB: myapp
55      POSTGRES_USER: myapp
56    secrets:
57      - source: db_password
58        target: /run/secrets/postgres_password
59    healthcheck:
60      test: ["CMD-SHELL", "pg_isready -U myapp"]
61      interval: 10s
62      timeout: 5s
63      retries: 5
64    networks:
65      - backend
66    deploy:
67      resources:
68        limits:
69          cpus: '2.0'
70          memory: 1G
71
72  redis:
73    image: redis:7-alpine
74    command: redis-server --appendonly yes --requirepass_file /run/secrets/redis_password
75    volumes:
76      - redis_data:/data
77    secrets:
78      - redis_password
79    healthcheck:
80      test: ["CMD", "redis-cli", "ping"]
81      interval: 10s
82      timeout: 5s
83      retries: 5
84    networks:
85      - backend
86    deploy:
87      resources:
88        limits:
89          cpus: '0.5'
90          memory: 256M
91
92networks:
93  frontend:
94    driver: bridge
95  backend:
96    driver: bridge
97    internal: true
98
99volumes:
100  postgres_data:
101  redis_data:
102
103secrets:
104  db_password:
105    file: ./secrets/db_password.txt
106  jwt_secret:
107    file: ./secrets/jwt_secret.txt
108  redis_password:
109    file: ./secrets/redis_password.txt

1# HTTP service
2healthcheck:
3  test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
4  interval: 30s
5  timeout: 10s
6  retries: 3
7
8# Database
9healthcheck:
10  test: ["CMD-SHELL", "pg_isready -U postgres"]
11  interval: 10s
12  timeout: 5s
13  retries: 5
14
15# Redis
16healthcheck:
17  test: ["CMD", "redis-cli", "ping"]
18  interval: 10s
19  timeout: 5s
20  retries: 5
21
22# Custom script
23healthcheck:
24  test: ["CMD", "/app/healthcheck.sh"]
25  interval: 30s
26  timeout: 10s
27  retries: 3
28  start_period: 60s

1# Initialize Swarm on first manager
2docker swarm init --advertise-addr 192.168.1.10
3
4# Output provides join tokens
5# To add a manager:
6docker swarm join-token manager
7
8# To add a worker:
9docker swarm join-token worker
10
11# Join additional managers (run on each manager node)
12docker swarm join --token SWMTKN-1-xxx 192.168.1.10:2377
13
14# Join workers (run on each worker node)
15docker swarm join --token SWMTKN-1-yyy 192.168.1.10:2377

1# Create from stdin
2echo "my-super-secret-password" | docker secret create db_password -
3
4# Create from file
5docker secret create ssl_cert ./certs/server.crt
6docker secret create ssl_key ./certs/server.key
7
8# List secrets
9docker secret ls
10
11# Inspect secret metadata (not the value)
12docker secret inspect db_password

1# docker-compose.yml for Swarm
2services:
3  api:
4    image: myapp/api:latest
5    secrets:
6      - db_password
7      - source: ssl_cert
8        target: /etc/ssl/certs/server.crt
9        mode: 0444
10      - source: ssl_key
11        target: /etc/ssl/private/server.key
12        uid: '1000'
13        gid: '1000'
14        mode: 0400
15
16secrets:
17  db_password:
18    external: true
19  ssl_cert:
20    external: true
21  ssl_key:
22    external: true

1// Node.js example
2import { readFileSync } from 'fs';
3
4function getSecret(name: string): string {
5  try {
6    // Secrets are mounted at /run/secrets/
7    return readFileSync(`/run/secrets/${name}`, 'utf8').trim();
8  } catch (error) {
9    // Fallback to environment variable for development
10    const envValue = process.env[name.toUpperCase()];
11    if (!envValue) {
12      throw new Error(`Secret ${name} not found`);
13    }
14    return envValue;
15  }
16}
17
18const dbPassword = getSecret('db_password');

1# stack.yml - Full production example
2services:
3  traefik:
4    image: traefik:v3.0
5    command:
6      - "--api.dashboard=true"
7      - "--providers.docker.swarmMode=true"
8      - "--providers.docker.exposedbydefault=false"
9      - "--entrypoints.web.address=:80"
10      - "--entrypoints.websecure.address=:443"
11      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
12      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
13      - "--certificatesresolvers.letsencrypt.acme.email=admin@example.com"
14      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
15    ports:
16      - "80:80"
17      - "443:443"
18    volumes:
19      - /var/run/docker.sock:/var/run/docker.sock:ro
20      - traefik_certs:/letsencrypt
21    networks:
22      - traefik-public
23    deploy:
24      mode: global
25      placement:
26        constraints:
27          - node.role == manager
28      labels:
29        - "traefik.enable=true"
30        - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
31        - "traefik.http.routers.dashboard.service=api@internal"
32        - "traefik.http.routers.dashboard.middlewares=auth"
33        - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xxx"
34
35  api:
36    image: myapp/api:1.5.0
37    environment:
38      - NODE_ENV=production
39      - DATABASE_URL=postgresql://myapp@db:5432/myapp
40    secrets:
41      - db_password
42      - jwt_secret
43    networks:
44      - traefik-public
45      - backend
46    deploy:
47      replicas: 3
48      update_config:
49        parallelism: 1
50        delay: 30s
51        failure_action: rollback
52        monitor: 60s
53        order: start-first
54      rollback_config:
55        parallelism: 1
56        delay: 10s
57      restart_policy:
58        condition: on-failure
59        delay: 5s
60        max_attempts: 3
61        window: 120s
62      resources:
63        limits:
64          cpus: '1'
65          memory: 512M
66        reservations:
67          cpus: '0.25'
68          memory: 128M
69      labels:
70        - "traefik.enable=true"
71        - "traefik.http.routers.api.rule=Host(`api.example.com`)"
72        - "traefik.http.routers.api.entrypoints=websecure"
73        - "traefik.http.routers.api.tls.certresolver=letsencrypt"
74        - "traefik.http.services.api.loadbalancer.server.port=3000"
75    healthcheck:
76      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
77      interval: 30s
78      timeout: 10s
79      retries: 3
80
81  db:
82    image: postgres:16-alpine
83    volumes:
84      - postgres_data:/var/lib/postgresql/data
85    environment:
86      POSTGRES_DB: myapp
87      POSTGRES_USER: myapp
88      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
89    secrets:
90      - db_password
91    networks:
92      - backend
93    deploy:
94      replicas: 1
95      placement:
96        constraints:
97          - node.labels.db == true
98      resources:
99        limits:
100          cpus: '4'
101          memory: 4G
102
103networks:
104  traefik-public:
105    driver: overlay
106    attachable: true
107  backend:
108    driver: overlay
109    driver_opts:
110      encrypted: "true"
111    internal: true
112
113volumes:
114  traefik_certs:
115  postgres_data:
116
117secrets:
118  db_password:
119    external: true
120  jwt_secret:
121    external: true

1# Deploy stack
2docker stack deploy -c stack.yml myapp
3
4# List stacks
5docker stack ls
6
7# List services in stack
8docker stack services myapp
9
10# View service logs
11docker service logs myapp_api -f
12
13# Scale a service
14docker service scale myapp_api=5
15
16# Rolling update
17docker service update --image myapp/api:1.6.0 myapp_api
18
19# Rollback
20docker service rollback myapp_api
21
22# Remove stack
23docker stack rm myapp

1deploy:
2  update_config:
3    parallelism: 1        # Update one container at a time
4    delay: 30s            # Wait 30s between updates
5    failure_action: rollback  # Auto-rollback on failure
6    monitor: 60s          # Monitor for 60s after update
7    max_failure_ratio: 0  # Any failure triggers rollback
8    order: start-first    # Start new before stopping old

1networks:
2  # Public-facing services
3  public:
4    driver: overlay
5    attachable: true
6
7  # Internal services - no external access
8  private:
9    driver: overlay
10    driver_opts:
11      encrypted: "true"  # Encrypt traffic between nodes
12    internal: true       # No external connectivity
13
14  # Database network - extra isolation
15  database:
16    driver: overlay
17    driver_opts:
18      encrypted: "true"
19    internal: true

1services:
2  prometheus:
3    image: prom/prometheus:latest
4    volumes:
5      - ./prometheus.yml:/etc/prometheus/prometheus.yml
6      - prometheus_data:/prometheus
7    command:
8      - '--config.file=/etc/prometheus/prometheus.yml'
9      - '--storage.tsdb.path=/prometheus'
10    networks:
11      - monitoring
12    deploy:
13      placement:
14        constraints:
15          - node.role == manager
16
17  grafana:
18    image: grafana/grafana:latest
19    volumes:
20      - grafana_data:/var/lib/grafana
21    environment:
22      - GF_SECURITY_ADMIN_PASSWORD_FILE=/run/secrets/grafana_password
23    secrets:
24      - grafana_password
25    networks:
26      - monitoring
27      - public
28
29  cadvisor:
30    image: gcr.io/cadvisor/cadvisor:latest
31    volumes:
32      - /:/rootfs:ro
33      - /var/run:/var/run:ro
34      - /sys:/sys:ro
35      - /var/lib/docker/:/var/lib/docker:ro
36    networks:
37      - monitoring
38    deploy:
39      mode: global
40
41volumes:
42  prometheus_data:
43  grafana_data:
44
45networks:
46  monitoring:
47    driver: overlay
48    internal: true