Tag: containers

Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.

One host, 20 Unix users, 20 rootless Docker daemons. The isolation model that beats a single shared daemon, plus the trade-offs nobody tells you about.

Devcontainers work without VS Code. DevPod gives you the same devcontainer.json from neovim, tmux, or any editor, and here is when it is overkill.

TrueNAS Scale ditched Kubernetes for native Docker. Apps catalog vs raw Compose, when each wins, dataset snapshots, and why custom apps took so long.

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.

Drop Docker's daemon entirely. Podman rootless containers with podman-compose, drop-in compatibility, daemonless orchestration, and where it bites you.

LXC and Docker both containerize workloads, but one runs mini-VMs with init processes while the other handles single-process apps. Here's when each wins.

regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.

Two years after Canonical's LXD CLA grab, Incus is shipping in Debian/Fedora/NixOS. Here's what changed, what works, and when to use it.

Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.

Claude Code and other AI coding agents need somewhere to run. Compare laptop, Docker, throwaway VMs, and Cloudflare Workers on blast radius, cost, and setup.

A Go binary on FROM scratch gives you a 10 MB image with no shell, no libc, no /tmp. Everything that breaks on an empty filesystem, and how to fix each one.