Topic: docker
-
Which rollout strategy works on a single host with Docker Compose and a reverse proxy?
Open question: rolling, blue-green and canary rollouts are described for orchestrators, yet many small services run on one host with Docker Compose behind Traefik, nginx or Caddy. Which approximation (a second container with a switched proxy rule, weighted distribution, start-first) have teams run for months, what broke it, and at what size does an orchestrator pay off?
-
docker/podman run exit codes: 125, 126, 127, and the signal codes that reach through them
docker run reserves 125, 126 and 127 for failures of Docker itself, an uninvokable command, and a not-found command respectively; any other code is passed through unchanged from the containerized process, including the 128+signal codes (137 for SIGKILL, often OOM; 139 for SIGSEGV; 143 for SIGTERM). The container's own OOMKilled flag, not the bare 137, is the documented way to confirm an out-of-memory kill, though on some cgroup-v2 hosts it reads false even after a kernel OOM kill.
-
Glob pattern dialects: what * and ** mean in .gitignore, .dockerignore, bash, Python and GitHub Actions
The same star and double-star characters mean different things depending on where the pattern is evaluated: a slash-less .gitignore pattern matches at every depth while the same line in .dockerignore only matches at the context root, bash's globstar recursion is opt-in, and Python's fnmatch is not even path-aware.
-
Access to the Docker socket is root on the host: what mounting it into a container really grants
Whoever can talk to the Docker daemon can start a container that mounts the host's root file system with full access. Mounting /var/run/docker.sock into a container, adding a user to the docker group or exposing the API over TCP is therefore equivalent to granting root.
-
.env file parsing dialects: quoting, export, multiline and expansion across five loaders
Docker Compose, docker run --env-file, python-dotenv, Node's dotenv, systemd's EnvironmentFile and sourcing the file in a shell all accept files that look alike but disagree on quoting, the export keyword, multiline values and whether ${VAR} expands.
-
"exec format error" and "cannot execute binary file": architecture and shebang mismatches
The kernel's ENOEXEC error surfaces as 'exec format error' or 'cannot execute binary file: Exec format error' when the CPU architecture does not match or a script lacks a usable shebang; CRLF line endings in the shebang cause a related 'bad interpreter' or 'required file not found' failure. The article shows how to tell them apart with file(1) and fix each without guessing.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Build caching in CI: keys, restore fallbacks and cache poisoning
A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.
-
Docker Engine host administration: daemon.json, disk usage, and live-restore
Administering the Docker Engine on a host means the daemon's configuration file, not application Dockerfiles: log rotation defaults, where images and containers are stored, safely reclaiming disk space, and keeping containers running across a daemon restart.
Machine-readable: JSON