# 初始化 Swarm
docker swarm init

# 查看节点
docker node ls
# ID    HOSTNAME   STATUS   AVAILABILITY   MANAGER STATUS
# xxx   node1      Ready    Active         Leader

# 在 Manager 节点上
docker swarm init --advertise-addr 192.168.1.100

# 输出 join token，用于 Worker 加入
# docker swarm join --token SWMTKN-xxx 192.168.1.100:2377

# 在 Worker 节点上执行上述 join 命令
docker swarm join --token SWMTKN-xxx 192.168.1.100:2377

# 查看集群节点
docker node ls

services:
  web:
    image: myapp:latest
    deploy:
      # 副本数
      replicas: 3

      # 部署约束
      placement:
        constraints:
          - node.role == worker       # 只部署到 Worker 节点
          - node.labels.zone == east  # 部署到标记为 east 的节点
        preferences:
          - spread: node.labels.zone  # 尽量分散到不同可用区

      # 资源限制
      resources:
        limits:
          cpus: "0.50"               # 最多使用 0.5 个 CPU
          memory: 512M               # 最多使用 512MB 内存
        reservations:
          cpus: "0.25"               # 保留 0.25 个 CPU
          memory: 256M               # 保留 256MB 内存
          devices:
            - capabilities: [gpu]    # 保留 GPU
              count: 1

      # 滚动更新策略
      update_config:
        parallelism: 1               # 每次更新 1 个容器
        delay: 30s                   # 每批更新间隔
        failure_action: rollback     # 失败时回滚
        monitor: 60s                 # 监控 60s 判断是否成功
        max_failure_ratio: 0.1       # 允许 10% 失败率
        order: start-first           # 先启动新容器再停止旧容器

      # 回滚策略
      rollback_config:
        parallelism: 1
        delay: 10s
        failure_action: pause
        monitor: 30s
        max_failure_ratio: 0
        order: stop-first

      # 重启策略
      restart_policy:
        condition: on-failure        # none | on-failure | any
        delay: 5s                    # 重启前等待
        max_attempts: 3              # 最大重启次数
        window: 120s                 # 判断重启成功的时间窗口

      # 端点模式
      endpoint_mode: vip             # vip（默认）| dnsrr

      # 服务标签
      labels:
        com.example.project: myapp
        com.example.environment: production

    # 网络
    networks:
      - frontend
      - backend

    # 端口（Swarm 模式下使用 ingress 发布）
    ports:
      - target: 80
        published: "80"
        protocol: tcp
        mode: ingress                # ingress（集群级）| host（单节点）

services:
  web:
    image: myapp:latest
    deploy:
      replicas: 3    # 运行 3 个副本

# 使用 docker service scale
docker service scale myapp_web=5

# 使用 docker compose（需要 deploy 配置）
docker compose up -d --scale web=5

# 注意：--scale 会覆盖 compose.yaml 中的 replicas
# 但不能用于已发布到 Swarm 的 stack

services:
  web:
    deploy:
      replicas: 6
      placement:
        constraints:
          - node.role == worker
        preferences:
          - spread: node.labels.zone   # 均匀分布到不同 zone

services:
  web:
    image: myapp:1.0.0
    deploy:
      replicas: 6
      update_config:
        parallelism: 2        # 每次同时更新 2 个
        delay: 10s            # 两批之间等待 10s
        failure_action: rollback
        monitor: 30s
        order: start-first    # 推荐：先启新的再停旧的

# 更新镜像版本
docker service update --image myapp:2.0.0 myapp_web

# 使用 Compose（修改 compose.yaml 后重新 deploy）
docker stack deploy -c compose.yaml myapp

# 手动回滚
docker service rollback myapp_web

services:
  web:
    deploy:
      resources:
        limits:
          cpus: "1.0"         # 硬限制：最多 1 个 CPU
          memory: 1G          # 硬限制：最多 1GB 内存
        reservations:
          cpus: "0.5"         # 软保证：至少 0.5 个 CPU
          memory: 512M        # 软保证：至少 512MB 内存

  # GPU 资源
  ml-worker:
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1         # 使用 1 个 GPU
              capabilities: [gpu]

services:
  db:
    deploy:
      placement:
        constraints:
          # 节点角色
          - node.role == manager
          - node.role == worker

          # 节点 ID
          - node.id == abc123def

          # 节点主机名
          - node.hostname == server-01

          # 自定义标签
          - node.labels.zone == us-east
          - node.labels.disk == ssd
          - node.labels.environment == production

          # 操作系统
          - node.platform.os == linux
          - node.platform.arch == x86_64

# 给节点添加标签
docker node update --label-add zone=us-east node1
docker node update --label-add disk=ssd node1
docker node update --label-add zone=us-west node2

# 查看节点标签
docker node inspect --format '{{ .Spec.Labels }}' node1

# 初始化 Swarm（如果还没有）
docker swarm init

# 部署 Stack
docker stack deploy -c compose.yaml myapp

# 查看 Stack
docker stack ls

# 查看 Stack 的服务
docker stack services myapp

# 查看 Stack 的任务
docker stack ps myapp

# 修改 compose.yaml 后重新部署
docker stack deploy -c compose.yaml myapp
# Swarm 会自动执行滚动更新

docker stack rm myapp

services:
  web:
    image: myapp:latest
    networks:
      - frontend
      - backend

  db:
    image: postgres:16
    networks:
      - backend

networks:
  frontend:
    driver: overlay
    attachable: true    # 允许非 Swarm 容器连接
  backend:
    driver: overlay
    internal: true      # 不允许外部访问

# compose.swarm.yaml
services:
  web:
    image: myregistry.io/myapp-web:${VERSION:-latest}
    ports:
      - target: 80
        published: "80"
        mode: ingress
    networks:
      - frontend
      - backend
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      rollback_config:
        parallelism: 1
        order: stop-first
      restart_policy:
        condition: any
        delay: 5s
      placement:
        constraints:
          - node.role == worker
        preferences:
          - spread: node.labels.zone
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  db:
    image: postgres:16-alpine
    networks:
      - backend
    volumes:
      - pgdata:/var/lib/postgresql/data
    secrets:
      - db_password
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.db == true
      resources:
        limits:
          memory: 1G

networks:
  frontend:
    driver: overlay
  backend:
    driver: overlay
    internal: true

volumes:
  pgdata:
    driver: local

secrets:
  db_password:
    external: true    # 使用 docker secret create 创建

# 部署
docker secret create db_password ./secrets/db_password.txt
docker stack deploy -c compose.swarm.yaml myapp