Tag: containers

Kaniko & Buildah: Daemonless Container Builds

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.

Podman Compose for Docker-Free Workflows

Drop Docker's daemon entirely. Podman rootless containers with podman-compose, drop-in compatibility, daemonless orchestration, and where it bites you.

LXC vs Docker: Lightweight Containers

LXC and Docker both containerize workloads, but one runs mini-VMs with init processes while the other handles single-process apps. Here's when each wins.

regclient: Container Image Lifecycle Without a Daemon

regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.

Incus: LXD's Community Fork, Two Years In

Two years after Canonical's LXD CLA grab, Incus is shipping in Debian/Fedora/NixOS. Here's what changed, what works, and when to use it.

Your Agent Doesn't Need a Shell

Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.

Where Should Your Coding Agent Run?

Claude Code and other AI coding agents need somewhere to run. Compare laptop, Docker, throwaway VMs, and Cloudflare Workers on blast radius, cost, and setup.

Go on Scratch: Docker With No OS at All

A Go binary on FROM scratch gives you a 10 MB image with no shell, no libc, no /tmp. Everything that breaks on an empty filesystem, and how to fix each one.

Multi-Arch Docker Builds With QEMU & buildx

Build Docker images that run on amd64 and arm64 from one command. QEMU emulation, native multi-node builders, CI caching, and manifest lists explained.

cgroups v2 in Practice: Limits, Pressure, Containers

cgroups v2 unified hierarchy explained: read /sys/fs/cgroup/, limit CPU/IO/memory, use systemd slices and PSI pressure files.

crun vs runc vs youki: OCI Runtimes Compared

runc, crun, and youki all run your containers, but they differ wildly in startup speed, language, and cgroups v2 support. Here's which to pick.

Skopeo: Container Image Surgery Without a Daemon

Skopeo lets you copy, inspect, and sync container images between any registry without Docker. No daemon, no bloat, just clean image ops.