Deploy a Replicated Swarm Service with a Secret

Deploy a Replicated Swarm Service with a Secret

Create a secret and deploy a replicated swarm service that consumes it.

1. Confirm this daemon is part of a swarm before touching any service or secret endpoint. On a non-swarm node every subsequent call in this flow returns 503.
2. Create the secret in the swarm's raft store. Secrets are only ever delivered to tasks that explicitly reference them, and only in memory.
3. Deploy the replicated service. The task template mounts the secret created above at /run/secrets/<name>, sets a rolling update policy, and restarts tasks on failure.
4. Read the service back to capture its version index, which any later update must supply to avoid a conflicting write.
5. List the tasks the scheduler has placed for this service, filtered to those desired to be running, so the caller can watch the service converge.

What you'll need to have ready

• secretName: Name of the secret to create (e.g. "app-db-password").
• secretData: Base64-encoded secret payload.
• serviceName: Name of the service to deploy.
• image: Image the service tasks run, ideally pinned by digest.
• replicas: Number of replicas to run.
• networkId: Optional overlay network id or name to attach the service to.
• publishedPort: Port to publish on the swarm ingress routing mesh.
• targetPort: Container port the published port maps to.

For your developer

Arazzo workflow docker:deploy-swarm-service, 5 operations: SwarmInspect → SecretCreate → ServiceCreate → ServiceInspect → TaskList. Specs on APIs.io.