How is load balancing done in Docker-Swarm mode

Question

I'm working on a project to set up a cloud architecture using docker-swarm. I know that with swarm I could deploy replicas of a service which means multiple containers of that image will be running to serve requests.

I also read that docker has an internal load balancer that manages this request distribution.

However, I need help in understanding the following:

Say I have a container that exposes a service as a REST API or say its a web app. And If I have multiple containers (replicas) deployed in the swarm and I have other containers (running some apps) that talk to this HTTP/REST service.

Then, when I write those apps which IP:PORT combination do I use? Is it any of the worker node IP's running these services? Will doing so take care of distributing the load appropriately even amongst other workers/manager running the same service?

Or should I call the manager which in turn takes care of routing appropriately (even if the manager node does not have a container running this specific service)?

Thanks.

Answer 1

when I write those apps which IP:PORT combination do I use? Is it any of the worker node IP's running these services?

You can use any node that is participating in the swarm, even if there is no replica of the service in question exists on that node. So you will use Node:HostPort combination. The ingress routing mesh will route the request to an active container.

One Picture Worth Ten Thousand Words

Will doing so take care of distributing the load appropriately even amongst other workers/manager running the same service?

The ingress controller will do round robin by default.

Now The clients should use dns round robin to access the service on the docker swarm nodes. The classic DNS cache problem will occur. To avoid that we can use external load balancer like HAproxy.

Answer 2

An important additional information to the existing answer

The advantage of using a proxy (HAProxy) in-front of docker swarm is, swarm nodes can reside on a private network that is accessible to the proxy server, but that is not publicly accessible. This will make your cluster secure.

If you are using AWS VPC, you can create a private subnet and place your swarm nodes inside the private subnet and place the proxy server in public subnet which can forward the traffic to the swarm nodes.

When you access the HAProxy load balancer, it forwards requests to nodes in the swarm. The swarm routing mesh routes the request to an active task. If, for any reason the swarm scheduler dispatches tasks to different nodes, you don’t need to reconfigure the load balancer.

For more details please read https://docs.docker.com/engine/swarm/ingress/