Multi-cloud Docker Swarm Security

[CarlosEspejo]

Given the following facts:

• When setting up a Docker Swarm you need to open these ports (https://www.bretfisher.com/docker-swarm-firewall-ports/)
• Ideally, your swarm nodes will be protected by a VPC, firewall rule or security-group from the outside world.

Now when you need to spread swarm workers across multiple public clouds, the tutorials that you find online will create a firewall rule that allows anything to connect to the swarm ports.

How secure is it to have the swarm ports mentioned above open to the public internet?

[BretFisher]

A few thoughts:

1. A single swarm spanning across cloud providers (or regions of a single provider) is not recommended. Ideally all your nodes are sub 10ms response time. There are no hard limits but the higher the latency the slower things get. Docker announced last year a “mutli-swarm management app” but I haven’t heard more about it. The recommended design is to create a swarm for each region/provider and use higher level tools like dns failover to manage redundancy.
2. The swarm manager/worker communciation ports, aka the “control plane” are encrypted and mutually authenicated, so those are fine. Your inter-overlay network apps will all communicate over a UDP tunnel that isn’t encrypted by default, so I’d enable the IPSec on all those overlay networks (which adds protocol overhead) if you’re going over untrusted/public networks.

[CarlosEspejo]

Once again you have put my mind at ease 😌

[BretFisher]

Rock on!