Sorry about the slow response.
Currently we support passing --registry-auth to docker service create. This will cause swarm to store and use repo creds when starting more instances of the service in the future for any reason.
It looks like this is also showing up with docker deploy, although it’s not in the release client I’m using atm: https://github.com/docker/docker/blob/master/api/client/stack/deploy.go#L45
There are some gotchas with this approach, see here: https://github.com/docker/docker/issues/24940