Topic
Docker & Containers
If you spend any time in this corner of the internet, sooner or later everything ends up in a container. These posts cover the practical side: Compose files that actually run, networking that doesn't break, volumes that survive an upgrade, and the trade-offs nobody tells you about until you're at 2 AM trying to figure out why your mounts went read-only. Docker, Podman, image hardening, registries, and a healthy amount of "don't reach for Kubernetes yet."
166 articles in this topic.
Featured posts
-
Prompt Injection vs Your Coding Agent
Prompt-level defenses against injection are probabilistic and lose to a patient attacker. Here's the capability-level design that holds, with working configs.
14 min read -
Stop Handing CI Jobs Root on Your Box
Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.
13 min read -
RabbitMQ vs NATS: Pick a Message Bus
RabbitMQ vs NATS for a self-hosted app: routing, delivery guarantees, Docker Compose setups, Python code, and which broker to run for background jobs.
14 min read -
Meilisearch vs Typesense for Self-Hosters
Meilisearch and Typesense both promise instant search without Elasticsearch's weight. I ran both in Docker and picked a winner per self-hosted use case.
13 min read -
Docker MCP Toolkit: Trust the Sandbox?
Docker MCP Toolkit sandboxes AI agent tools in containers. Here's exactly what that isolation stops, where it silently breaks, and how to configure it safely.
12 min read -
Komodo MCP vs the Docker Socket
Komodo's community MCP server beats mounting the Docker socket or handing an AI agent SSH: scoped auth, per-tool RBAC, and confirmation before deletes.
12 min read
All Docker & Containers articles
- Prompt Injection vs Your Coding Agent
- Stop Handing CI Jobs Root on Your Box
- RabbitMQ vs NATS: Pick a Message Bus
- Meilisearch vs Typesense for Self-Hosters
- Docker MCP Toolkit: Trust the Sandbox?
- Komodo MCP vs the Docker Socket
- Tinyauth vs Pocket ID vs Authelia
- Pterodactyl vs Pelican vs Crafty
- 20 Unix Users, 20 Rootless Dockers
- Self-Hosted OSRM in Docker
- Nominatim: Self-Hosted Geocoding
- Devcontainers Without VS Code Lock-In
- Docker Ate 215GB in a Week
- Stoat vs Fluxer: Self-Hosting Costs
- Postgres in Docker: The Durable Setup
- The *arr Stack Without 9000 Reddit Threads
- Self-Host SigNoz: Install Guide
- TrueNAS Apps vs Docker on TrueNAS Scale
- Kaniko & Buildah: Daemonless Container Builds
- Podman Compose for Docker-Free Workflows
- LXC vs Docker: Lightweight Containers
- regclient: Container Image Lifecycle Without a Daemon
- Incus: LXD's Community Fork, Two Years In
- Your Agent Doesn't Need a Shell
- Where Should Your Coding Agent Run?
- Go on Scratch: Docker With No OS at All
- Multi-Arch Docker Builds With QEMU & buildx
- Mullvad VPN Containers via Gluetun: Per-App VPN
- cgroups v2 in Practice: Limits, Pressure, Containers
- crun vs runc vs youki: OCI Runtimes Compared
- Stirling-PDF: Stop Uploading Your Tax Returns to Sketchy Sites
- Skopeo: Container Image Surgery Without a Daemon
- Dragonfly: P2P Container Image Distribution at Scale
- Karakeep: Self-Hosted Bookmarks With AI Tagging
- Kasm Workspaces: Browser Desktops
- Rootless Docker: Tips, Gotchas & Fixes
- Dead Container Took Down Prod
- Self-Host a Local AI Coding Workhorse
- Linux Namespaces from Scratch
- Home Assistant Add-Ons vs Docker Containers
- Rancher vs Podman vs Docker Desktop
- Garden vs Tilt vs Skaffold
- Lima vs Multipass
- Compose Watch: Faster Dev Loops
- tini vs dumb-init vs --init
- Container Escape: How to Stop It
- ko vs Jib vs Buildpacks
- Cosign Keyless: Sign Without Keys
- Docker Bake vs Compose Build
- WASM Containers in 2026
- cri-o vs containerd
- Nerdctl vs Docker CLI
- Sysbox vs gVisor vs Kata
- Trivy vs Grype vs Docker Scout
- Blog Comments: Self-Host or SaaS?
- Hoist: Label-Driven Docker Updates
- Immich Hardware Acceleration: Stop Cooking Your CPU
- systemd-nspawn: The Container Runtime Already on Your Box
- Distroless Images: When Minimal Goes Too Far
- OpenCanary: Honeypots for Your Home Lab
- Colima vs OrbStack vs Docker Desktop on Mac
- SBOMs and Supply Chain Security
- Authentik vs Authelia: SSO for Your Self-Hosted Stack
- Container Security: Scan and Sign Your Images Like You Mean It
- Falco: Catch Container Attacks at Runtime
- Loki vs ELK: Centralized Logging Without the RAM Tax
- Cloudflare Tunnels: Beyond Port Forwarding
- Immich vs PhotoPrism: Escape Google Photos Without Losing Your Mind
- Trivy + Cosign: Scan and Sign Your Images
- Prometheus + Grafana: Monitoring That Doesn't Lie to You
- Wazuh: Open Source SIEM for Your Home Lab
- Rootless Docker: Run Without Root
- Docker Networking Demystified
- EmDash: WordPress Done Right, Finally
- De-Googling: Self-Hosted Replacements for Google Apps
- ctop and lazydocker: Docker Monitoring Tools
- Private Docker Registry with Harbor
- Docker Manager Showdown: Pick One
- Obsidian LiveSync: Self-Hosted Sync Without Paying for the Privilege
- HAProxy: Load Balancing Done Right
- Stop Living Dangerously on :latest Docker
- MySQL & MariaDB CLI in 2026: What Changed
- Alpine vs. Distroless: Choosing Your Minimalist Base
- Distroless: How to Build Slim, Secure Containers
- Multi-Stage Docker Builds: Stop Shipping Your node_modules to Production
- Traefik: Docker Routing with Labels
- Docker BuildKit: Stop Waiting for Your Images to Build
- Piper vs Coqui: Text-to-Speech on Your Own Hardware (Because AWS Polly Charges Per Character Like It's 1999 SMS)
- Nginx Proxy Manager for Normal Humans
- Healthcheck vs Restart Policy: The Difference Matters
- Nginx: The Config That Makes Sense
- Appwrite: Your Own Firebase, Minus the Google Surveillance Subscription
- Sysctl Tuning: The Linux Kernel Knobs That Actually Matter
- Watchtower vs Diun: Automating Docker Updates Without Burning Your Stack
- Uptime Kuma: Status Pages, Alerts, and Knowing Before Your Users Do
- Watchtower: Safe Container Auto-Updates
- Chaos Engineering: Break Things on Purpose Before They Break Themselves
- Docker Health Checks: Because "It's Running" Doesn't Mean "It's Working"
- Prometheus + Grafana on Docker: Know When Your Server Is Crying Before It Dies
- Docker Logging: From "Where Did My Logs Go?" to Centralized Bliss
- NocoDB: Because Airtable Doesn't Need to Know Your Business
- Caddy Advanced: Automatic HTTPS, Plugins, and Config That Doesn't Make You Cry
- Lazy Docker & Dive: CLI Tools That Make Docker Less Painful
- Docker Compose Environment Variable Precedence
- Podman Quadlets: Running Containers Without the Docker Daemon (or Your Sanity)
- Why Self-Hosted Apps Lose Data After Updates
- Ollama Beyond the Basics: Model Management, Custom Models, and Optimization
- Linux Capabilities: Drop Root Without Breaking Everything
- Docker Security Hardening: 15 Things You're Doing Wrong Right Now
- Paperless-ngx: Scan It, Forget It, Find It Instantly
- Whisper & Faster-Whisper: Self-Hosted Speech-to-Text That Actually Works
- Ulimit, Cgroups, and the Art of Stopping Processes From Eating Your Server
- Portainer vs Dockge: Managing Containers Without the Terminal
- Docker Volumes vs Bind Mounts: Where Your Data Actually Lives
- Plex Optimization: Remote Access, Transcoding, and Taming the Beast
- Traefik vs Nginx Proxy Manager: Reverse Proxies for Humans
- Wiki.js with GitSync: Documentation That Lives in Version Control Like It Should
- Docker Compose vs Docker Swarm: When "Good Enough" Beats "Enterprise"
- Vaultwarden vs Bitwarden: Own Your Passwords Before Someone Else Does
- Docker Resource Limits: Stop Letting Containers Eat Your RAM
- Docker CMD vs ENTRYPOINT: The Final Answer
- Docker Compose Profiles: Run Only What You Need
- Cleaning Up Docker Disk Space the Right Way
- Stop Putting Passwords in Docker ENV
- Why the `latest` Docker Tag Is Lying to You
- Multi-Platform Docker Builds with buildx
- Docker Network Aliases: The Feature Nobody Uses
- Docker Healthcheck Patterns That Actually Work
- Running Docker Containers as Non-Root (And Why You Should)
- Docker Container Labels: The Metadata You're Ignoring
- Why Docker Builds Are Slow: Layer Cache Explained
- Docker Exit Codes: Why Your Container Keeps Restarting
- The .dockerignore File You're Not Writing
- Why Your Docker Logs Are Eating Your Disk
- Why Your Docker Container Ignores Ctrl+C
- Understanding and Optimizing Docker’s daemon.json File
- Docker Networking Essential Guide for All Skill Levels
- Docker Volume Mounts: Essential Flags
- How to Transfer docker Images Without a Repository
- Understanding CMD and ENTRYPOINT in Dockerfiles
- Copying Files Between Docker Containers and Host Machines
- Dockerfile: Differences Between COPY and ADD
- Docker Strategies for Load Balancing and Failover
- Docker Networking: Connecting to the Host from a Container
- Understanding Docker vs. Full Virtual Machines (VMs)
- Multiple Actions with a Single docker exec Call
- Executing Commands with Asterisks in Docker
- WordPress, Docker, NGINX, and MySQL via Ansible
- Automating Docker via Ansible
- Observability and Monitoring for Containers
- Docker vs Podman: Key Differences
- A Guide to LXC/LXD
- Docker Compose: Orchestrating Multi-Container Applications
- Wiki.js for your documentation in docker
- NocoDB DB Management System
- Appwrite Backend-as-a-service (BaaS)
- Wireguard VPN Server in Docker
- Install & use Doxygen via Docker
- Automatic Backup of Docker MySQL or MariaDB Containers
- WordPress on PHP-FPM & Caddy in Docker
- Docker Compose useful commands
- How to install NextCloud via Docker
- Install a php script in PHP-FPM & Caddy via Docker
- Install Caddy reverse proxy via Docker
- Access Docker socket via TCP
- Install docker on Ubuntu/Debian