if you mean using the swarm token, that relies on a third party service which might or might not be available at any point in the future. and won't work on a private network iirc
From here (https://docs.docker.com/engine/swarm/swarm-mode/#view-the-jo...):
"...starts an internal distributed data store for Engines participating in the swarm to maintain a consistent view of the swarm and all services running on it"
Here are the docs for "swarm init" in docker 1.12: https://docs.docker.com/engine/reference/commandline/swarm_i...
that goes to some docker owned server, ask for nodes, and join/create the swarm as necessary. I wouldn't build the cornerstone of an infrastructure on this, like, never.
there's an undocumented feature I just discovered to use a local token server, it seems, but then you're back to square one.
> documentation is scarce
for being a container, documentation is not just scarce but outright insufficient - especially in regards to its failure and recovery modes
Here's how it works:
- When you run `docker swarm init` it initializes the current node as a "manager" which has a datastore of cluster configuration and is responsible for assigning tasks to "worker" nodes (including itself). This init process also generates a cluster CA and two secrets authorizing manager and worker joins. The output of this command will be two tokens which you can use to join new nodes to the cluster as either a "manager" or a "worker". These tokens are structured like this:
SWMTKN-1-<cluster CA hash>-<manager or worker secret>
- If the new node is joining as a manager then the cluster configuration is replicated to to the new manager. Docker uses the Raft consensus algorithm to maintain consistency of the configuration data. As long as a majority of your manager nodes are available then the managers will be able to coordinate and issue work to the available workers in the cluster.
I hope this helps you better understand how the cluster is secured.
"The create argument makes the Swarm container connect to the Docker Hub discovery service and get a unique Swarm ID, also known as a “discovery token”. The token appears in the output, it is not saved to a file on the host"
are there two type of tokens now?