The `--network` option allows label usage, so you can just do a `--network private` to get the service net enabled.