diff --git a/scripts/create-servers.sh b/scripts/create-servers.sh
new file mode 100644
index 0000000..7ee5db2
--- /dev/null
+++ b/scripts/create-servers.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# set -x
+
+# create managers servers in digital ocean with pre-set environment vars
+# https://docs.docker.com/machine/drivers/digital-ocean/
+
+# DO_TOKEN get the token from digitalocean.com (read/write)
+# DO_SIZE pick your droplet size from "doctl compute size list"
+# SSH_FINGERPRINT in the format of "8d:30:8a..." with a comand like "ssh-keygen -E md5 -lf  ~/.ssh/id_rsa.pub"
+
+for server in {1..3}; do
+docker-machine create \
+  --driver=digitalocean \
+  --digitalocean-access-token="${DO_TOKEN}" \
+  --digitalocean-size="${DO_SIZE}" \
+  --digitalocean-ssh-key-fingerprint="${SSH_FINGERPRINT}" \
+  --digitalocean-tags=dogvscat \
+  --digitalocean-private-networking=true \
+  dvc${server} &
+done
+
+
+# if you wanted to create these locally in virtualbox, you might do this
+# remember to check if you have enough RAM
+# https://docs.docker.com/machine/drivers/virtualbox/
+
+#for server in {1..3}; do
+#docker-machine create \
+#  --driver=virtualbox \
+#  --virtualbox-memory=2048 \
+#  dvc${server} &
+#done
+
+# if you wanted to create these locally in hyper-v (windows 10), you might do this from git bash
+# remember to check if you have enough RAM and if virtual switch is created
+# https://docs.docker.com/machine/drivers/hyper-v/
+
+#for server in {1..3}; do
+#docker-machine create \
+#  --driver=hyperv \
+#  --hyperv-memory=2048 \
+#  --hyperv-virtual-switch="Primary Virtual Swtich" \
+#  dvc${server} &
+#done
\ No newline at end of file
diff --git a/scripts/create-swarm.sh b/scripts/create-swarm.sh
new file mode 100644
index 0000000..9e27fcd
--- /dev/null
+++ b/scripts/create-swarm.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -x
+
+# since we created droplets with a private NIC on eth1, lets use that for swarm comms
+LEADER_IP=$(docker-machine ssh dvc1 ifconfig eth1 | grep 'inet addr' | cut -d: -f2 | awk '{print $1}')
+
+# create a swarm as all managers
+docker-machine ssh dvc1 docker swarm init --advertise-addr "$LEADER_IP"
+
+# note that if you use eth1 above (private network in digitalocean) it makes the below
+# a bit tricky, because docker-machine lists the public IP's but we need the 
+# private IP of manager for join commands, so we can't simply envvar the token
+# like lots of scripts do... we'd need to fist get private IP of first node
+
+# TODO: provide flexable numbers at cli for x managers and x workers
+JOIN_TOKEN=$(docker-machine ssh dvc1 docker swarm join-token -q manager)
+
+for i in 2 3; do
+  docker-machine ssh dvc$i docker swarm join --token "$JOIN_TOKEN" "$LEADER_IP":2377
+done
+
+docker-machine env dvc1
diff --git a/swarm/core.yml b/swarm/core.yml
index 1a2700c..08aec37 100644
--- a/swarm/core.yml
+++ b/swarm/core.yml
@@ -123,6 +123,26 @@ services:
       # Use the public network created to be shared between Traefik and
       # any other service that needs to be publicly available with HTTPS
       - traefik-public
+  shepherd:
+    image: containrrr/shepherd
+    environment:
+      # Beware YAML gotchas regarding quoting:
+      # With KEY: 'VALUE', quotes are part of yaml syntax and thus get stripped
+      # but with KEY='VALUE', they are part of the value and stay there,
+      # causing problems!
+      TZ: 'Asia/Singapore'
+      SLEEP_TIME: '60m'
+      FILTER_SERVICES: ''
+      VERBOSE: 'true'
+      UPDATE_OPTIONS: '--update-delay=30s'
+      ROLLBACK_OPTIONS: '--rollback-delay=0s'
+      IMAGE_AUTOCLEAN_LIMIT: '5'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    deploy:
+      placement:
+        constraints:
+          - node.role == manager
 
 volumes:
   # Create a volume to store the certificates, there is a constraint to make sure