"network not manually attachable" when running one-off command against docker swarm network

I'm trying to run a one-off command to initialise a database schema in a new docker swarm which is deployed with 1.13's new support for docker-compose files.

The swarm has the following network:

$ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
...
b7dptlu8zyqa        vme_internal         overlay             swarm
...

defined in the docker-compose.yml file as:

networks:
    internal:

The command I run is

docker run --rm --network vme_internal app:0.1 db upgrade

with the extra vme_ prefix coming from the name that I gave the stack when deploying. Now when I run the above command, I get:

docker: Error response from daemon: Could not attach to network vme_internal:
rpc error: code = 7 desc = network vme_internal not manually attachable.

How do I make the network attachable?

I couldn't find any specific info about attachable in Docker networking and tried adding an attribute attachable to the network definition without success.

Solution

Using compose

Since compose v3.2 it is possible to configure the attachable property through the compose file using the keyword attachable like so:

networks:
  mynet1:
    driver: overlay
    attachable: true

Using docker network create

Since Docker Engine API v1.25 it is possible to create a network and make it attachable using the --attachable parameter like:

docker network create --driver overlay --attachable my-overlay-network

To update an already running docker service:

Create an attachable overlay network:

 docker network create --driver overlay --attachable my-attachable-overlay-network

Remove the network stack with a disabled "attachable" overlay network (in this example called: my-non-attachable-overlay-network):
```
 docker service update --network-rm my-non-attachable-overlay-network myservice
```

Add the network stack with an enabled "attachable" overlay network:

 docker service update --network-add my-attachable-overlay-network myservice