Docker Swarm Instead of Kubernetes: The Exact Bill

Description and use

Swarm enables a low‑cost DevSecOps platform (~30 €/month) for small teams, yet node management is manual and the VPN is a hard dependency.

Problem

Choosing an orchestrator that balances cost, simplicity, and operational overhead for small teams or solo builders.

Outcome

Swarm delivers a low‑cost, low‑complexity platform (~30 €/month) suitable for small teams, but node changes are manual and the VPN is a critical dependency.

Workflow

• Provision VMs with Terraform
• Configure VMs with Ansible (install Docker, set up Swarm manager, join workers, set labels, create networks and secrets)
• Render Docker Compose files with Jinja2 (avoid .env with docker stack deploy)
• Deploy services with docker stack deploy
• Adjust Docker daemon MTU to account for VXLAN + WireGuard encapsulation (mtu_docker = mtu_vpn - 50)
• Monitor and drain services manually when removing nodes
• Maintain VPN and Swarm control plane together

Evidence

My complete DevSecOps platform runs on Docker Swarm, on top of a WireGuard mesh, for about 30 euros a month, real invoice.

Source

Trap 1: docker stack deploy ignores your .env

Source

MTU is the maximum packet size on a link. Each encapsulation eats a piece of it.

Source