Docker Swarm Networking#

Dokploy builds its entire networking stack on a single Docker Swarm overlay network named dokploy-network. Every internal service (Postgres, Redis, the Dokploy app, Traefik, Forward Auth) joins this network by name, enabling DNS-based service discovery across both Swarm services and standalone containers.

Network Creation#

dokploy-network is created at install time as an attachable overlay network:

docker network create --driver overlay --attachable dokploy-network

1

The --attachable flag is what makes the hybrid setup possible: it lets standalone Docker containers (not just Swarm services) connect to an overlay network that is otherwise managed by Swarm.

The same creation logic is mirrored in the server setup code via initializeNetwork(), which creates the network programmatically with Attachable: true, Driver: "overlay".

What Joins dokploy-network#

All core Dokploy Swarm services reference the network by name in their TaskTemplate.Networks:

The Traefik container in standalone mode (the default install path) is launched with docker run and then explicitly attached via docker network connect dokploy-network dokploy-traefik 6. The standalone container's NetworkingConfig also pre-joins dokploy-network at creation time 7.

Traefik's static config (traefik.yml) sets network: dokploy-network on both the docker and swarm providers 8, so Traefik always routes traffic through that network when selecting container IPs.

User Deployment Networking: Two Modes#

Shared Mode (default)#

For compose apps, addDokployNetworkToService() and addDokployNetworkToRoot() inject dokploy-network (declared external: true) into each service that has a domain configured. The label traefik.docker.network=dokploy-network (docker-compose) or traefik.swarm.network=dokploy-network (Swarm stack) is added to tell Traefik which network IP to use. See Docker Compose Networking and Traefik Docker Network Routing for full details.

Isolated Mode (isolatedDeployment = true)#

A per-app named network is created at deploy time 9:

docker network create [--driver overlay] --attachable <appName>
docker network connect <appName> $(docker ps --filter "name=dokploy-traefik" -q)

• Stack deployments get --driver overlay; docker-compose deployments get the default bridge driver.
• Traefik is dynamically connected to the per-app network at deploy time. The traefik.docker.network label is intentionally omitted — Traefik finds the service because the isolated network is the only shared network between it and the service.
• Caveat: This connection is not persisted. If Traefik is recreated (e.g., via UI settings changes), the dynamic connections are lost and each affected app must be redeployed to re-run docker network connect. See Traefik Docker Network Routing — Non-Persistent Network Attachments for workarounds.

Network Suffix & Collision Prevention#

When multiple compose apps share the same internal network names, Dokploy adds a suffix (e.g., frontend-abc123) to avoid collisions. dokploy-network is explicitly excluded from suffixing and is always treated as an external reference. See packages/server/src/utils/docker/compose/network.ts for implementation details. 10

Architecture Diagram#

Key Source Files#