Docker Swarm Instead of Kubernetes: The Exact Bill

说明与用途

Swarm 让小团队以约30 €/月的成本运行 DevSecOps 平台，但节点管理仍需手动，VPN 是关键依赖。

问题

Choosing an orchestrator that balances cost, simplicity, and operational overhead for small teams or solo builders.

结果

Swarm delivers a low‑cost, low‑complexity platform (~30 €/month) suitable for small teams, but node changes are manual and the VPN is a critical dependency.

工作流

• Provision VMs with Terraform
• Configure VMs with Ansible (install Docker, set up Swarm manager, join workers, set labels, create networks and secrets)
• Render Docker Compose files with Jinja2 (avoid .env with docker stack deploy)
• Deploy services with docker stack deploy
• Adjust Docker daemon MTU to account for VXLAN + WireGuard encapsulation (mtu_docker = mtu_vpn - 50)
• Monitor and drain services manually when removing nodes
• Maintain VPN and Swarm control plane together

证据

My complete DevSecOps platform runs on Docker Swarm, on top of a WireGuard mesh, for about 30 euros a month, real invoice.

来源

Trap 1: docker stack deploy ignores your .env

来源

MTU is the maximum packet size on a link. Each encapsulation eats a piece of it.

来源