Service Constraints

  • Can filter task placement based on built-in or custom labels
  • Can be added at create time, or add/remove at update time
  • Creates a hard requirement, placement fails if not matched
  • Supports multiple constraints
  • Supports either a <key> or a <key>=<value> pair
  • Can match with == or !=
  • Labels can be node.labels or engine.labels
    • node.labels only added via manager to raft rol
    • engine.labels added in daemon.json to any node {"labels":["dmz=true"]}
    • Default to using node.labels, use engine.labels for autoscaling hardware, os


  • place only on a manager(2 options for same result)
docker service create --constraints=node.role==manager nginx
docker service create --constraint=node.role!=worker nginx
  • Add label to node2 for dmz=true, and constrain to it
docker node update --label-add=dmz=true node2
docker service create --constraint=node.labels.dmz==true nginx

Hands On

[node1] ~> docker service create --name app1 --constraint node.role==worker nginx
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged

[node1] ~> docker service update --constraint-rm node.role==worker --constraint-add node.role==manager app1
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged

[node1] ~> docker node update --label-add dmz=true manager2

[node1] ~> docker service create --name dmz-nginx --constraint node.labels.dmz==true --replicas 2 nginx
overall progress: 2 out of 2 tasks
1/2: running   [==================================================>]
2/2: running   [==================================================>]
verify: Service converged

Service Constraints in Stack Files

version: "3.1"
    image: mysql:5.7
          - node.labels.disk == ssd

Built-in Labels

  • (listed in docker node ls)
  • node.hostname (listed in docker node ls)
  • node.ip (e.g.
  • node.role (manager|worker)
  • node.platform.os (linux|windows|etc.)
  • node.platform.arch (x86_64|arm64|386|etc.)
  • node.labels (empty by default)
  • Might be others out there, but not well documented

results matching ""

    No results matching ""