DOCKER(1)

📦
version 29.9.2 · 13 versions
, in alpine 3.24, fedora 43, fedora 44, opensuse-leap 16.0

DOCKER(1) — bestie's guide to docker service update 💅

okay so before we even start — hi, welcome, you're in the Docker User Manuals and this specific page is about updating a service. that's the whole vibe. no cap, it's just "update a service." that's the description. that's it. but the options? bestie. the options are a whole main character. there are NINETY-FOUR of them. i counted. twice. 😭

🌸 NAME 🌸

docker-service-update — Update a service

yes the name has dashes and the synopsis has spaces, that's just how the docker girlies do it, don't @ me

✨ SYNOPSIS ✨

docker service update [OPTIONS] SERVICE

one service. lots of options. let's go 🫶

💖 DESCRIPTION 💖

Update a service. 🦋

that's it. that's the description. the real lore is in the options below and there are SO many of them. hydrate first. 🍓

👑 OPTIONS 👑

okay bestie, deep breath, this is the long part. every single one of these is real and i'm not skipping a single one. periodt.

  • --args= — the command args for the service 🎀
  • --cap-add= — add Linux capabilities
  • --cap-drop= — drop Linux capabilities
  • --config-add= — add or update a config file on a service
  • --config-rm= — remove a configuration file
  • --constraint-add= — add or update a placement constraint
  • --constraint-rm= — remove a constraint
  • --container-label-add= — add or update a container label
  • --container-label-rm= — remove a container label by its key
  • --credential-spec= — credential spec for managed service account (Windows only, so if you're on Linux this one's not your problem 💅)
  • -d, --detach[=false] — exit immediately instead of waiting for the service to converge. it's giving "i'm not waiting for the group chat to finish typing" ✨
  • --dns-add= — add or update a custom DNS server
  • --dns-option-add= — add or update a DNS option
  • --dns-option-rm= — remove a DNS option
  • --dns-rm= — remove a custom DNS server
  • --dns-search-add= — add or update a custom DNS search domain
  • --dns-search-rm= — remove a DNS search domain
  • --endpoint-mode="" — endpoint mode (vip or dnsrr)
  • --entrypoint= — overwrite the default ENTRYPOINT of the image
  • --env-add= — add or update an environment variable
  • --env-rm= — remove an environment variable
  • --force[=false] — force update even if no changes require it. chaotic energy, use responsibly 💀
  • --generic-resource-add= — add a Generic resource
  • --generic-resource-rm= — remove a Generic resource
  • --group-add= — add an additional supplementary user group to the container
  • --group-rm= — remove a previously added supplementary user group from the container
  • --health-cmd="" — command to run to check health 🩺
  • --health-interval= — time between running the check (ms|s|m|h)
  • --health-retries=0 — consecutive failures needed to report unhealthy
  • --health-start-interval= — time between running the check during the start period (ms|s|m|h)
  • --health-start-period= — start period for the container to initialize before counting retries towards unstable (ms|s|m|h)
  • --health-timeout= — maximum time to allow one check to run (ms|s|m|h)
  • --host-add= — add a custom host-to-IP mapping ("host:ip")
  • --host-rm= — remove a custom host-to-IP mapping ("host:ip")
  • --hostname="" — container hostname
  • --image="" — service image tag
  • --init[=false] — use an init inside each service container to forward signals and reap processes
  • --isolation="" — service container isolation mode
  • --label-add= — add or update a service label
  • --label-rm= — remove a label by its key
  • --limit-cpu= — limit CPUs
  • --limit-memory=0 — limit Memory
  • --limit-pids=0 — limit maximum number of processes (default 0 = unlimited)
  • --log-driver="" — logging driver for service
  • --log-opt= — logging driver options
  • --max-concurrent= — number of job tasks to run concurrently (default equal to --replicas)
  • --memory-swap=0 — swap Bytes (-1 for unlimited)
  • --memory-swappiness=-1 — tune memory swappiness (0-100), -1 to reset to default
  • --mount-add= — add or update a mount on a service
  • --mount-rm= — remove a mount by its target path
  • --network-add= — add a network
  • --network-rm= — remove a network
  • --no-healthcheck[=false] — disable any container-specified HEALTHCHECK
  • --no-resolve-image[=false] — do not query the registry to resolve image digest and supported platforms
  • --oom-score-adj=0 — tune host's OOM preferences (-1000 to 1000)
  • --placement-pref-add= — add a placement preference
  • --placement-pref-rm= — remove a placement preference
  • --publish-add= — add or update a published port
  • --publish-rm= — remove a published port by its target port
  • -q, --quiet[=false] — suppress progress output. silent but slaying 🤫
  • --read-only[=false] — mount the container's root filesystem as read only
  • --replicas= — number of tasks
  • --replicas-max-per-node=0 — maximum number of tasks per node (default 0 = unlimited)
  • --reserve-cpu= — reserve CPUs
  • --reserve-memory=0 — reserve Memory
  • --restart-condition="" — restart when condition is met ("none", "on-failure", "any")
  • --restart-delay= — delay between restart attempts (ns|us|ms|s|m|h)
  • --restart-max-attempts= — maximum number of restarts before giving up
  • --restart-window= — window used to evaluate the restart policy (ns|us|ms|s|m|h)
  • --rollback[=false] — rollback to previous specification. the "nvm bestie, take it back" button 🙈
  • --rollback-delay=0s — delay between task rollbacks (ns|us|ms|s|m|h)
  • --rollback-failure-action="" — action on rollback failure ("pause", "continue")
  • --rollback-max-failure-ratio=0 — failure rate to tolerate during a rollback
  • --rollback-monitor=0s — duration after each task rollback to monitor for failure (ns|us|ms|s|m|h)
  • --rollback-order="" — rollback order ("start-first", "stop-first")
  • --rollback-parallelism=0 — maximum number of tasks rolled back simultaneously (0 to roll back all at once)
  • --secret-add= — add or update a secret on a service 🤫
  • --secret-rm= — remove a secret
  • --stop-grace-period= — time to wait before force killing a container (ns|us|ms|s|m|h)
  • --stop-signal="" — signal to stop the container
  • --sysctl-add= — add or update a Sysctl option
  • --sysctl-rm= — remove a Sysctl option
  • -t, --tty[=false] — allocate a pseudo-TTY
  • --ulimit-add=[] — add or update a ulimit option
  • --ulimit-rm= — remove a ulimit option
  • --update-delay=0s — delay between updates (ns|us|ms|s|m|h)
  • --update-failure-action="" — action on update failure ("pause", "continue", "rollback")
  • --update-max-failure-ratio=0 — failure rate to tolerate during an update
  • --update-monitor=0s — duration after each task update to monitor for failure (ns|us|ms|s|m|h)
  • --update-order="" — update order ("start-first", "stop-first")
  • --update-parallelism=0 — maximum number of tasks updated simultaneously (0 to update all at once)
  • -u, --user="" — username or UID (format: [:])
  • --with-registry-auth[=false] — send registry authentication details to swarm agents
  • -w, --workdir="" — working directory inside the container
real talk bestie: a bunch of these flags come in <something>-add and <something>-rm pairs. the -add ones add or update, the -rm ones remove. that pattern is doing a LOT of heavy lifting on this page and it's honestly iconic. 🔥

🦋 SEE ALSO 🦋

go read that one too, it's the parent page and it's lowkey the whole lore. iykyk 💜

okay that's the whole page!! every single flag, every default, every ms|s|m|h, all accounted for. not one skipped. we ate. 💅✨

this little love letter was brought to you by the fine people at Docker Community, dated Oct 2026 — so if you're reading this, hey, you're doing amazing, go update that service, and drink some water. 🫶🌈⭐

📦 where this page comes from