The output from docker swarm init tells you how to expand the swarm by joining other nodes. Nodes can belong to only one swarm, and to join, they need to use the joining token. The token prevents rogue nodes joining your swarm if the network is compromised, so you need to treat it as a secure secret. Nodes can join as workers or managers, and there are different tokens for each. You can view and rotate the tokens with the docker swarm join-token command.

On a second machine running the same version of Docker, I can run the swarm join command to join the swarm:

> docker swarm join `
   --token SWMTKN-1-37p6ufk5jku6tndotqlcy1w54grx5tvxb3rxphj8xkdn9lbeml-3w7e8hxfzzpt2fbf340d8phia `
   192.168.2.214:2377

This node joined a swarm as a worker.

Now my Docker host is running in swarm mode, there are more commands available to me when I'm connected to the manager node. The docker node commands manage the nodes in the swarm, so I can list all the nodes in the swarm and see their current status with docker node ls:

> docker node ls
ID    HOSTNAME    STATUS   AVAILABILITY  MANAGER STATUS  ENGINE VERSION
h2ripnp8hvtydewpf5h62ja7u  win2019-02      Ready Active         18.09.2
jea4p57ajjalioqokvmu82q6y * win2019-dev-02 Ready Active Leader  18.09.2

The STATUS value tells you whether the node is online in the swarm, and the AVAILABILITY value tells you whether the node is able to run containers. The MANAGER STATUS field has three options:

• Leader: The active manager controlling the swarm.
• Reachable: A backup manager; it can become the leader if the current leader goes down.
• No value: A worker node.

Multiple managers support high availability. Docker Swarm uses the Raft protocol to elect a new leader if the current leader is lost, so with an odd number of managers, your swarm can survive hardware failure. For production, you should have three manager nodes, which is all you need, even for large swarms with hundreds of worker nodes.

Worker nodes do not automatically get promoted to managers, so if all your managers are lost, then you cannot administer the swarm. In that situation, the containers on the worker nodes continue running, but there are no managers to monitor the worker nodes or the services you have running.