To make sure a Docker Swarm service only runs on nodes that have specific attributes or labels, what service deployment option is configured?

The service deployment option configured to ensure a Docker Swarm service only runs on nodes with specific attributes or labels is placement constraints. Placement constraints are rules that dictate where a service's tasks can be scheduled within the Docker Swarm cluster. The Swarm manager uses these constraints to filter the available nodes, ensuring that service tasks are only deployed to nodes that meet the specified criteria. These constraints operate by evaluating node labels. A node label is a key-value pair, or sometimes just a key, assigned by an administrator to a specific node in the Swarm. Labels describe the characteristics or attributes of a node, such as its hardware capabilities, location, or intended use. For example, an administrator might label a node `disk=ssd` to indicate it has solid-state drives, or `gpu=true` if it contains a GPU. When a service is created or updated with a placement constraint, the Swarm manager checks the labels of all active nodes. Only nodes whose labels satisfy the conditions defined in the constraint are considered eligible to run tasks for that service. This effectively limits the pool of potential nodes for a service. For example, to ensure a service runs only on nodes designated for production environments, a placement constraint like `--constraint 'node.labels.env==production'` would be applied. Here, `node.labels.env` refers to a label named `env` on a node, and `==production` specifies that its value must precisely match `production`. Another example is `--constraint 'node.labels.gpu'`, which ensures the service only runs on nodes that have a label named `gpu` defined, regardless of its value. This mechanism provides precise control over service deployment, allowing users to align service requirements with node capabilities.