Swarms can be practically any size. You can run a single-node swarm on your laptop to test the functionality, and you can scale up to thousands of nodes. You start by initializing the swarm with the docker swarm init command:
> docker swarm init --listen-addr 192.168.2.214 --advertise-addr 192.168.2.214
Swarm initialized: current node (jea4p57ajjalioqokvmu82q6y) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join --token SWMTKN-1-37p6ufk5jku6tndotqlcy1w54grx5tvxb3rxphj8xkdn9lbeml-3w7e8hxfzzpt2fbf340d8phia 192.168.2.214:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
This creates the swarm with a single node—the Docker Engine where you run the command, and that node becomes the swarm manager. My machine has multiple IP addresses, so I've specified the listen-addr and advertise-addr options that tell Docker which network interface to use for swarm communication. It's a good practice to always specify the IP address and to use static addresses for the manager nodes.
You can keep your swarm secure using an internal private network for the swarm traffic, so that communication is not on the public network. You can even keep your managers off the public network completely. Only worker nodes with public-facing workloads need to be connected to the public network in addition to the internal network - and you can even avoid that if you're using a load-balancer as the public entrypoint to your infrastructure.