テーマ： docker
-
Welche Rollout-Strategie funktioniert auf einem einzelnen Host mit Docker Compose und Reverse Proxy?
Offene Frage: Rollierend, Blue-Green und Canary sind für Orchestratoren beschrieben; viele kleine Dienste laufen aber auf einem Host mit Docker Compose hinter Traefik, nginx oder Caddy. Welche Nachbildung – zweiter Container mit umgeschalteter Proxy-Regel, gewichtete Verteilung, start-first – haben Teams über Monate betrieben, was hat sie gebrochen, und ab welcher Grösse lohnt sich der Orchestrator?
-
docker/podman run exit codes: 125, 126, 127, and the signal codes that reach through them
docker run reserves 125, 126 and 127 for failures of Docker itself, an uninvokable command, and a not-found command respectively; any other code is passed through unchanged from the containerized process, including the 128+signal codes (137 for SIGKILL, often OOM; 139 for SIGSEGV; 143 for SIGTERM). The container's own OOMKilled flag, not the bare 137, is the documented way to confirm an out-of-memory kill, though on some cgroup-v2 hosts it reads false even after a kernel OOM kill.
-
Glob pattern dialects: what * and ** mean in .gitignore, .dockerignore, bash, Python and GitHub Actions
The same star and double-star characters mean different things depending on where the pattern is evaluated: a slash-less .gitignore pattern matches at every depth while the same line in .dockerignore only matches at the context root, bash's globstar recursion is opt-in, and Python's fnmatch is not even path-aware.
-
Dockerソケットへのアクセスはホストのroot権限：コンテナへのマウントが実際に与えるもの
Dockerデーモンと通信できる人は、ホストのルートファイルシステムを完全なアクセス権でマウントするコンテナを起動できます。そのため、/var/run/docker.sockのコンテナへのマウント、ユーザーのdockerグループへの追加、TCP経由でのAPI公開は、root権限の付与に相当します。
-
.env file parsing dialects: quoting, export, multiline and expansion across five loaders
Docker Compose, docker run --env-file, python-dotenv, Node's dotenv, systemd's EnvironmentFile and sourcing the file in a shell all accept files that look alike but disagree on quoting, the export keyword, multiline values and whether ${VAR} expands.
-
"exec format error" and "cannot execute binary file": architecture and shebang mismatches
The kernel's ENOEXEC error surfaces as 'exec format error' or 'cannot execute binary file: Exec format error' when the CPU architecture does not match or a script lacks a usable shebang; CRLF line endings in the shebang cause a related 'bad interpreter' or 'required file not found' failure. The article shows how to tell them apart with file(1) and fix each without guessing.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Build caching in CI: keys, restore fallbacks and cache poisoning
A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.
-
Docker Engine host administration: daemon.json, disk usage, and live-restore
Administering the Docker Engine on a host means the daemon's configuration file, not application Dockerfiles: log rotation defaults, where images and containers are stored, safely reclaiming disk space, and keeping containers running across a daemon restart.
機械可読： JSON