Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Use an attachable Docker overlay network inside a Swarm, encrypt it with --opt encrypted, and restrict the Swarm and overlay ports to the private addresses of participating hosts. Do not rely on overlay membership alone: any published port can still open a host-facing path, so bind administrative services to loopback or the specific private interface they need.
What “private between hosts” means in Docker
A Docker bridge network is local to one Docker daemon. It can isolate containers on that host, but it does not automatically connect containers running on different hosts. For cross-host container traffic, Docker documents two approaches: a Swarm overlay network or separately managed operating-system routing. The overlay is the normal Swarm-native design because it supplies multi-host connectivity and Docker DNS-based discovery.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPrivacy has several separate layers. The hosts need a private or otherwise restricted path to one another; the Docker control, gossip and overlay-data ports must be filtered; and application ports must not be accidentally published on every host interface. An overlay can provide logical separation and, when encrypted, encryption in transit, but it does not make the host itself unreachable or turn a published port into a private-only service.
The recommended architecture
- Place the Docker hosts on a private routed network, cloud security-group boundary or equivalent controlled network.
- Put the hosts in one Docker Swarm, even if the workloads are ordinary standalone containers rather than Swarm services.
- Create a user-defined overlay network with
--attachableso standalone containers can join it. - Add
--opt encryptedwhen traffic must be protected between hosts in transit. - Allow only the required Docker inter-host ports between the participating hosts.
- Bind host-published ports to loopback or an explicitly selected interface instead of accepting Docker’s default all-interface publication.
Prerequisites and design decisions
Use a Swarm for the overlay control plane
Docker requires the participating daemons to be in a Swarm before they can use an overlay network. The containers do not have to be deployed as Swarm services: an attachable overlay permits standalone containers started with docker run to connect.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose one host as the initial manager and give it a private address that the other nodes can reach. Workers and additional managers should join through that private path. The advertised address matters: if a node advertises a public, NAT-only or otherwise unreachable address, control-plane membership or overlay traffic can fail even when the containers themselves appear healthy.
Decide whether encryption is required
With --opt encrypted, Docker encrypts overlay traffic with IPsec at the VXLAN layer. This protects data in transit between participating hosts, but Docker warns that encryption has a non-negligible performance penalty. Benchmark representative workloads before production rather than assuming the cost is insignificant.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Encrypted overlays are unsupported for Windows containers. If Windows containers are part of the design, verify platform support and use a different protected transport or operating-system network architecture where necessary; do not assume the Linux overlay encryption option applies to them.
Build an attachable encrypted overlay
Run the initialization and network-creation commands from a manager using a private address. The join command for workers is generated by Docker and should be copied only through a trusted administrative channel.
- Initialize the Swarm on the first host.
docker swarm init --advertise-addr <manager-private-ip>
Docker prints a worker-join command. Save it securely and use the manager-join command instead when adding another manager. - Join the remaining hosts.
Run the printeddocker swarm joincommand on each participating node. Confirm that every node is in the same Swarm and that its advertised address is reachable over the private network. - Create the overlay once from a manager.
docker network create
--driver overlay
--attachable
--opt encrypted
private-net
The nameprivate-netis only an example; use a name that clearly identifies the trust boundary and environment. - Start a standalone container on the overlay.
docker run -d --name app --network private-net my-image
Repeat on another node with a different container name. Containers attached to the same overlay can use Docker’s container or service DNS names rather than hard-coding changing IP addresses. - Attach an existing container when needed.
Usedocker network connect private-net <container>for a running container, then confirm that the process is listening on the address and port you expect inside the container.
The overlay is a shared network object, but the workload still follows ordinary container isolation rules. A container must be attached to private-net to use it; being on the same host is not sufficient, and being in the Swarm does not automatically place every container on the overlay.
Restrict the host-to-host firewall
Allow the documented Docker paths only between the participating hosts. Apply the same policy in cloud security groups, network firewalls and each host’s operating-system firewall; filtering at just one layer leaves another path exposed.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
| Port | Protocol | Role | Recommended scope |
|---|---|---|---|
2377 |
TCP | Swarm control plane | Allow only the Docker hosts that must participate in Swarm management; do not expose it to the public Internet. |
4789 |
UDP | Overlay VXLAN data path | Allow between the private addresses of hosts carrying overlay traffic. |
7946 |
TCP | Node communication | Allow only between participating Docker nodes. |
7946 |
UDP | Node communication and discovery | Allow only between participating Docker nodes. |
The safest rule is an allowlist based on private IPs, security-group identity or an equivalent authenticated host group. Do not replace a private boundary with a broad rule such as “any source on the Internet.” If the hosts are separated by routing domains, verify that the private addresses are reachable in both directions where Docker requires it and that no middlebox blocks UDP encapsulation.
What the firewall policy does and does not protect
These four port groups protect Docker’s node-to-node operation; they do not decide which application ports are reachable by users. Application exposure is controlled separately by container port publishing, host firewall rules and the interface to which a published port is bound.
Prevent accidental exposure through published ports
Docker states that “Publishing container ports is insecure by default.” A mapping such as -p 8080:80 publishes the container’s port on host addresses, which can make it reachable from networks you did not intend to trust. Overlay membership does not override that host-level listener.
Host-only administrative access
Bind an administrative endpoint to IPv4 loopback when it should be reachable only from the Docker host:
docker run -d
--network private-net
-p 127.0.0.1:8080:80
admin-imageFor a host that also needs IPv6 loopback access, add an explicit IPv6 mapping:
-p '[::1]:8080:80'Binding to loopback prevents remote machines from reaching that listener through the host’s private or public interfaces. It does not, however, make the process private from other local users or processes on the host.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Private-interface application access
If an application must be reached by other approved machines, bind the published port to the host’s private address rather than all addresses. Then enforce the same source allowlist in the host and cloud firewalls. A published port is effectively a firewall opening: document its listening interface, source ranges, owner and removal procedure.
When not to publish at all
Containers that only need to talk to peers on private-net do not need -p. Let them listen on their container port and use Docker DNS from another attached container. Removing an unnecessary publication eliminates a host-level attack surface and avoids confusion about whether traffic is taking the overlay path or entering through a host listener.
Free tools Windows power users keep installed
One-click scans. No signup required.
Docker firewall behavior by network driver
On Linux, Docker creates firewall rules for bridge-network isolation, port publishing, NAT and masquerading. Docker advises administrators not to modify the rules it creates for bridge networks, because manual changes can break isolation or publishing behavior during daemon and network changes.
The ipvlan, macvlan and host drivers do not receive those Docker-created firewall rules. Designs using them therefore require an explicit operating-system or upstream filtering policy. This distinction is important when moving a workload from a user-defined bridge to a driver that places containers more directly on the host or physical network.
Why a local bridge is not a cross-host private network
A user-defined bridge improves isolation and naming on one Docker host, but a second daemon cannot join that bridge merely by using the same network name. To connect containers across daemons, use an overlay or build and maintain OS-level routing yourself. If you choose OS routing, you also become responsible for route distribution, filtering, name discovery and any encryption that the routed network needs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOverlay versus an OS-routed bridge design
Both designs can carry private traffic between hosts, but they place different responsibilities on Docker and on your network team.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
| Decision factor | Docker overlay | OS-routed bridge network |
|---|---|---|
| Cross-host connectivity | Provided by Docker’s Swarm-aware overlay and VXLAN data path. | Provided by routes, interfaces and forwarding configured outside Docker. |
| Encryption in transit | Optional IPsec protection with --opt encrypted; Docker warns of a non-negligible performance penalty. |
Not supplied by a bridge alone; use a separately managed encrypted network if required. |
| Operational complexity | Requires Swarm membership and the documented control, gossip and data ports. | Requires route management, forwarding, filtering and usually a separate discovery plan. |
| Firewall ports | Requires TCP 2377, UDP 4789 and TCP/UDP 7946 between participating nodes. | Depends on the routing and transport technology; Docker does not provide one universal port set. |
| Portability across hosts | Containers can attach to the same named overlay on participating Swarm nodes. | Containers depend on the host and network configuration being consistent across nodes. |
| DNS and service discovery | Docker’s overlay-aware naming can resolve attached containers or services. | You must provide compatible name resolution or use another discovery mechanism. |
| Performance considerations | Encapsulation adds overhead, and encryption adds additional CPU and latency cost. | May avoid overlay encapsulation, but performance depends on the chosen routes, interfaces and security controls. |
Choose the overlay when you want Docker to manage multi-host attachment and discovery and can permit the Swarm port set. Choose routed networking when your organization already operates a controlled private network and needs its routing, addressing or security tooling to remain authoritative. In either case, keep application publishing and firewall policy explicit.
Validate the private-network configuration
Validation should test membership, control paths, data paths, exposure and performance separately. A container that resolves a peer name proves only that discovery works; it does not prove that an untrusted network cannot reach a published port.
- Check Swarm membership. Confirm every intended host appears in the same Swarm and that each node advertises a reachable private address. A node joined to a different Swarm cannot use this overlay.
- Check the network definition. Run
docker network inspect private-neton the manager and verify that the network uses theoverlaydriver, is attachable, and has the encrypted option enabled. Confirm that the expected containers are listed as endpoints. - Check name resolution. From one attached container, resolve the peer by its Docker container or service DNS name. Use the name rather than recording an overlay IP as a permanent configuration value.
- Check the data path. Test the application protocol between containers on different hosts. A successful local-host test is not enough; deliberately place the peers on separate nodes.
- Check firewall exposure. From an untrusted network, verify that Swarm administrative and application ports are not reachable. From an approved private node, verify that only the intended services respond.
- Check published-port bindings. Inspect the container and host listener configuration. Confirm that administrative mappings use loopback and that application mappings use only the intended private interface.
- Measure the encryption cost. Benchmark encrypted and unencrypted overlays with representative request rates, message sizes and concurrency. Compare throughput, latency and host CPU before selecting production settings.
Troubleshooting common failures
The network command says Swarm is not active
An overlay cannot be created on an ordinary standalone daemon. Initialize a manager with docker swarm init, join the other nodes, and retry network creation from a manager. If the host was previously in another Swarm, leave that Swarm only after confirming that doing so will not disrupt its workloads, then join the intended one.
Nodes join, but containers on different hosts time out
Check the private routes and the firewall rules first. UDP 4789 carries the overlay data path, while TCP and UDP 7946 support node communication. A policy that allows only TCP can leave membership appearing healthy while cross-host packets fail. Also check cloud security groups, host firewalls and network ACLs; all must permit the same source allowlist.
Swarm membership is unstable
Verify TCP 2377 between the nodes that need Swarm control traffic and confirm that the manager advertises a stable private address. NAT, changing interface priorities or advertising a public address that peers cannot route to can produce intermittent joins and task communication.
Peer names do not resolve
Make sure both containers are attached to the same user-defined overlay and that the overlay is attachable when using standalone containers. Check the exact network name and endpoint list with docker network inspect. A container attached only to a local bridge cannot resolve peers on the overlay through that bridge.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
An administrative service is reachable from outside
Look for an unqualified mapping such as -p 8080:80. Replace it with a loopback or private-interface binding, remove the publication if peers can use the overlay directly, and then retest from both an untrusted network and an approved private host. Remember that changing a container’s network membership does not remove an existing host publication.
Encryption causes unacceptable performance
Docker documents a performance penalty for encrypted overlays. Measure CPU, latency and throughput under realistic load. If encryption is mandatory, capacity-plan for the measured cost or reduce unnecessary cross-host traffic. If the hosts already sit inside a separately encrypted private network, document that security boundary and make an explicit decision about whether the additional overlay encryption is worth its overhead.
The design uses Windows containers
Docker’s encrypted overlay option is unsupported for Windows containers. Do not enable it as though it supplied protection on that platform. Re-evaluate the container platform and use a supported private, encrypted transport managed at the host or network layer where the security requirement remains.
Operational practices that keep the boundary private
- Separate control and application policy. Keep the Swarm port allowlist limited to Docker nodes, and maintain a separate inventory of application ports that users or services are allowed to reach.
- Use stable private addressing. Reserve private addresses or stable security-group identities for Docker nodes so firewall rules do not silently broaden when instances are replaced.
- Minimize publications. Prefer overlay DNS and container-to-container traffic for internal services. Publish only ingress points that have a documented consumer.
- Review every interface. A service bound to loopback, a private address and all addresses has three very different exposure profiles. Record the binding alongside the port number.
- Protect join credentials. Treat Swarm join tokens as administrative secrets. Rotate them when exposure is suspected and limit who can run manager-join commands.
- Re-test after network changes. Changes to cloud security groups, host firewalls, routing, MTU or node interfaces can break VXLAN traffic without changing a Docker command.
- Account for MTU and encapsulation. Overlay traffic adds encapsulation overhead. If large requests fragment or fail only across hosts, inspect the private path’s MTU and test with the actual application payload sizes before changing container settings.
A practical decision checklist
Use the following sequence when implementing or reviewing the design:
- Are all Docker daemons in one Swarm, with reachable private advertised addresses?
- Is the cross-host network an overlay rather than a host-local bridge?
- Is the overlay attachable if standalone containers must join?
- Does the security requirement call for
--opt encrypted, and has its performance cost been measured? - Are TCP
2377, UDP4789, and TCP/UDP7946allowed only between participating hosts? - Are those same restrictions enforced in cloud and host firewalls?
- Does every
-pmapping have a documented consumer and an explicit bind address? - Are administrative endpoints bound to loopback or another restricted interface?
- Have cross-host DNS, application traffic, untrusted-network access and failover behavior been tested?
- Are driver-specific firewall assumptions documented for any use of
host,macvlanoripvlan?
This combination—Swarm membership, an attachable overlay, narrowly scoped inter-host firewall rules, deliberate port bindings and validation from both trusted and untrusted vantage points—creates a private Docker communication path without confusing container networking with host exposure.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
