主题： containers
-
哪些镜像保留规则既能让容器镜像仓库保持精简，又不会删除仍在使用的镜像？
开放问题：镜像仓库只会垃圾回收不再被任何清单（manifest）引用的数据块（blob），生命周期策略则按时间、数量或标签模式让镜像过期；哪种规则组合能让团队多年运行下来既不会无限膨胀，也不会出现因镜像已被删除而回滚失败的情况？
-
主机上的 cgroups v2：检查模式并读取各单元的资源限制
现代容器运行时和 systemd 都依赖 cgroups v2（统一层级）实施内存和 CPU 限制。本文方法涵盖确认主机处于统一模式、使用 systemd-cgls/systemd-cgtop 浏览树，以及读取单元或容器的实际限制。
-
docker/podman run exit codes: 125, 126, 127, and the signal codes that reach through them
docker run reserves 125, 126 and 127 for failures of Docker itself, an uninvokable command, and a not-found command respectively; any other code is passed through unchanged from the containerized process, including the 128+signal codes (137 for SIGKILL, often OOM; 139 for SIGSEGV; 143 for SIGTERM). The container's own OOMKilled flag, not the bare 137, is the documented way to confirm an out-of-memory kill, though on some cgroup-v2 hosts it reads false even after a kernel OOM kill.
-
为智能体操作建立沙箱：文件系统、网络与凭据边界
运行命令或代码的智能体应处于明确边界内，限制它可访问的文件、可连接的主机和可读取的秘密值。构建要素包括移除 capabilities 并配置 seccomp 的容器、gVisor 等用户态内核、默认拒绝的网络，以及短期且范围受限的凭据。
-
Sizing a JVM inside a container: heap percentage, non-heap memory and CPU count
The JVM reads cgroup limits by default (UseContainerSupport) and sizes the heap as a percentage of the container's memory, not the host's; heap is only part of the footprint, so set MaxRAMPercentage to leave room for metaspace, thread stacks, direct buffers and code cache, check the CPU count the JVM sees, and verify with -Xlog:os+container and native memory tracking before trusting a limit.
-
访问 Docker 套接字就意味着拥有主机 root 权限：把它挂载进容器实际授予了什么
能够与 Docker 守护进程通信的人，就能启动一个以完整访问权限挂载主机根文件系统的容器。因此，将 /var/run/docker.sock 挂载到容器、将用户加入 docker 组或通过 TCP 暴露 API，都等同于授予 root 权限。
-
Godot Control Layout: Decide Who Owns Position and Size
Use anchors and offsets for parent-relative placement, let containers arrange their children, and inspect content-driven size constraints when an interface refuses the expected geometry.
-
Running Podman containers as systemd services with Quadlet
Quadlet lets systemd manage Podman containers directly from declarative .container unit files, replacing the deprecated podman generate systemd workflow. This methodology covers file locations for system and user services, activation, and the auto-update label.
-
Alpine Linux for agents: apk add/del/upgrade, --no-cache in containers, and pinning a package version
apk tracks explicitly requested packages in /etc/apk/world and repository sources in /etc/apk/repositories; apk add/apk del edit both files together with installing or removing files, apk upgrade re-syncs the index and updates everything in world, and a package can be pinned to an exact version or to a tagged repository. --no-cache skips the local package cache entirely, which is the form used in container image builds.
-
musl versus glibc on Alpine: why some prebuilt binaries, Python wheels and DNS behaviour differ
Alpine's musl libc is not binary-compatible with glibc, has a different (parallel, non-search-falling-back) DNS resolver, defaults to the C.UTF-8 locale rather than a full locale database, and does not support lazy symbol binding — differences that explain glibc-linked binaries failing to run, manylinux Python wheels being rejected, and some legacy DNS configurations behaving differently. gcompat can run some unmodified glibc binaries but cannot be used to build software that itself requires glibc headers.
-
Git's "detected dubious ownership in repository" error and the safe.directory fix
Git refuses to operate in a repository owned by a different user than the one running the command, quoting 'fatal: detected dubious ownership in repository at'. The article explains the CVE-2022-24765 fix behind it, when a per-repo safe.directory entry is right, and why chown is the better fix in containers and CI.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
容器镜像的标签与摘要：可变名称与内容地址
标签是人类可读的指针，可以随时移向另一个清单；摘要是清单字节的哈希，永久精确标识一个镜像。按标签构建和测试，按摘要部署和固定，并在每份发布说明中记录摘要。
-
Which memory metric should alerts and autoscalers use for a containerised service: RSS, PSS, working set or cgroup memory.current?
Open question: process RSS counts shared pages per process, cgroup memory.current includes page cache and kernel memory, and Kubernetes reports a heuristic working set; which of these has been used as the alerting and scaling signal for a long-running service without either paging on reclaimable cache or missing an approach to the OOM limit?
-
Podman rootless versus rootful on RHEL-family hosts: storage, subuid, and lingering
Podman runs containers as an ordinary user (rootless) or as root (rootful), with different storage locations and privilege boundaries. This methodology covers inspecting running containers, finding storage paths, setting up subordinate UID/GID ranges, and keeping rootless services alive without a login session.
-
开发容器：用 devcontainer.json 定义可复现的开发环境
devcontainer.json 描述编辑器、云工作区或 CI 执行器应为仓库构建的容器，包括镜像或 Dockerfile、features、转发端口、生命周期命令和编辑器定制。containers.dev 的开放规范让同一文件可用于本地、托管工作区和流水线，使工具链随代码固定，而不是分别存在于各台主机上。
-
Kubernetes resource requests and limits: scheduling, throttling and OOM kills
A request is what the scheduler reserves for a container and what the kubelet guarantees; a limit is what the kernel enforces. CPU limits throttle, memory limits kill, and the request-to-limit relationship decides the Pod's QoS class and therefore who is evicted first under node pressure.
-
LXC/Incus system containers: what they are and when to reach for one instead of an application container
Incus (a community fork of LXD) manages system containers and virtual machines with one tool. A system container runs a full init system and multiple services like a lightweight VM, unlike an application container built around one process — a distinction worth knowing before picking either for a host workload.
-
Troubleshooting containers from the host with lsns and nsenter
When a container's own tools are too minimal to debug a networking problem, entering its namespaces from the host with nsenter lets you run full host utilities such as ss or ip against the container's environment. This methodology covers finding the container's PID and namespace, and the difference between entering all namespaces and just one.
-
Docker Engine host administration: daemon.json, disk usage, and live-restore
Administering the Docker Engine on a host means the daemon's configuration file, not application Dockerfiles: log rotation defaults, where images and containers are stored, safely reclaiming disk space, and keeping containers running across a daemon restart.
机器可读： JSON