Tag: containers

Kasm Workspaces streams disposable Linux desktops and apps to your browser. Threat model, real homelab uses, and how it compares to Guacamole.

Rootless Docker tuning deep-dive: network drivers, env vars, port drivers, cgroup delegation, and real troubleshooting, anchored to Docker Engine 29.x.

Containers are just namespaces and cgroups in a trench coat. Build one yourself with unshare and nsenter, no Docker required. Here's what actually happens.

HAOS Add-Ons vs bare Docker Compose for Mosquitto, ESPHome, Frigate, when the Supervisor magic is worth it and when it just gets in your way.

Rancher Desktop, Podman Desktop, and Docker Desktop go head-to-head on cost, k8s, resource use, and real-world friction for local dev.

PID 1 zombie reaping in containers, tini, dumb-init, and docker --init compared; when each one fixes your signal handling and stops your 10s shutdown tax.

Containers are not VMs. Here are the real escape vectors, privileged mode, mounted sockets, kernel CVEs, and the runtime hardening that actually helps.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

Spin, WasmEdge, and wasmCloud compared: what WASM containers can actually replace in 2026, where Docker still wins, and which tools are production-ready.

The CRI runtime under your Kubernetes cluster, cri-o vs containerd compared on footprint, distros, performance, and day-2 operability.

nerdctl is the containerd-native docker CLI replacement, when it's a drop-in, when it's not, and why you'd bother switching at all.

Containers aren't security boundaries, Sysbox, gVisor, and Kata fix that. Here's which isolation runtime fits your actual threat model.