"network not manually attachable" when running one-off command against docker swarm network

Question

I'm trying to run a one-off command to initialise a database schema in a new docker swarm which is deployed with 1.13's new support for docker-compose files.

The swarm has the following network:

$ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
...
b7dptlu8zyqa        vme_internal         overlay             swarm
...

defined in the docker-compose.yml file as:

networks:
    internal:

The command I run is

docker run --rm --network vme_internal app:0.1 db upgrade

with the extra vme_ prefix coming from the name that I gave the stack when deploying. Now when I run the above command, I get:

docker: Error response from daemon: Could not attach to network vme_internal:
rpc error: code = 7 desc = network vme_internal not manually attachable.

How do I make the network attachable?

I couldn't find any specific info about attachable in Docker networking and tried adding an attribute attachable to the network definition without success.

Solution 1

Using composer

Since composer v3.2 it is possible to configure the attachable property through the composer file using the keyword attachable like:

networks:
  mynet1:
    driver: overlay
    attachable: true

Using docker network create

Since Docker Engine API v1.25 it is possible to create a network and make it attachable using the --attachable parameter like:

docker network create --driver overlay --attachable my-overlay-network

---

To update an already running docker service:

1. Create an attachable overlay network:

   docker network create --driver overlay --attachable my-attachable-overlay-network
   

2. Remove the network stack with a disabled "attachable" overlay network (in this example called: my-non-attachable-overlay-network):

   docker service update --network-rm my-non-attachable-overlay-network myservice
   

3. Add the network stack with an enabled "attachable" overlay network:

   docker service update --network-add my-attachable-overlay-network myservice
   

Solution 2

By default, overlay networks created with the new swarm mode cannot be used with containers not run from swarm. Version 1.13 allows you to toggle this setting, so make sure you've upgraded. You must create the network with the attachable flag. I also couldn't get this to work on a swarm worker, the node needed to be promoted to a swarm manager.