PhilippTheServer

docker

Containers, images, registries and the build tooling around them.

  1. OpenTaberna: Headless, Open-Source E-Commerce You Self-Host

    OpenTaberna is headless, open-source e-commerce: an Apache-2.0 shop API on FastAPI and PostgreSQL that you self-host with Docker Compose.

    architecture api-design docker databases

  2. Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy

    Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2.

    networking dns security docker

  3. nginx: The Map Variable That Fixes the URI in proxy_pass

    nginx: [emerg] invalid URI prefix in proxy_pass: a regex location needs a bare upstream, and a map on $uri keeps a path-specific Cache-Control header.

    docker networking observability ci-cd

  4. When Microservice Decomposition Is the Wrong Default

    import-linter forbidden contract as a module boundary: a FastAPI modular monolith instead of early microservices, and when a network split pays off.

    architecture docker

  5. Object Storage as the Durability Boundary for a Container Registry

    MANIFEST_UNKNOWN after losing a registry PVC: REGISTRY_STORAGE s3 on MinIO keeps blobs through helm uninstall. What it does not fix: garbage-collect.

    kubernetes storage docker

  6. Pinning Image Tags to Git SHAs Because GitOps Diffs Manifests, Not Registries

    image :latest never triggers an Argo CD rollout because GitOps diffs manifest text. Tagging with git rev-parse --short HEAD and committing it back.

    gitops ci-cd docker

  7. Running Alembic Migrations Once, Before the Workers Fork

    alembic upgrade head in app code runs once per gunicorn worker and races. Running it in the entrypoint under pg_advisory_lock, before exec.

    databases docker

  8. A Multi-Service docker-compose That a New Contributor Can Actually Start

    depends_on condition: service_healthy: why a plain depends_on list races, with Postgres, Redis and Keycloak healthchecks, --import-realm and a smoke test.

    docker identity testing

  9. Runtime Configuration for an Angular Container Without Rebuilding

    Angular environment.ts is baked in at ng build. Load config.json via APP_INITIALIZER, generated by envsubst in /docker-entrypoint.d at container start.

    frontend docker infrastructure-as-code networking

  10. Designing a Docker Image Build API: Job Model and Streamed Logs

    Docker SDK ImageBuild returns a nil error when RUN fails: read the error field in the JSON build stream. A Go job model with POST /builds and live logs.

    go docker api-design

  11. Rootless BuildKit: What fuse-overlayfs Costs on a Cold Cache

    Rootless BuildKit with --oci-worker-snapshotter=fuse-overlayfs needs no --privileged, but cold-cache builds pay a FUSE round-trip per file. Measuring it.

    docker security performance

  12. Running BuildKit as a Remote Builder Without a Docker Daemon

    open /var/run/docker.sock: no such file or directory from docker buildx on a containerd CI worker: run buildkitd with mTLS and use the remote driver.

    docker ci-cd

  13. A Shared Multi-Stage Base Image for a C++ Service Fleet

    vcpkg install pistache rebuilt in every service Dockerfile: a shared, versioned multi-stage base image that compiles C++ dependencies once for the fleet.

    cpp docker performance

  14. Docker Compose or Kubernetes: What the Control Loop Actually Buys You

    Docker Compose restart: always vs a Kubernetes Deployment: what happens when the host dies, and what the control loop costs in debugging.

    kubernetes docker architecture gitops

  15. Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole

    secret_id_response_wrapping_path in Vault Agent approle auto_auth: a sidecar that bootstraps from a single-use wrapped secret_id and renders secrets to a file.

    vault secrets-management security docker

  16. Multi-Stage Docker Builds: Shipping a Runtime Without the Toolchain

    COPY --from=build with CGO_ENABLED=0 and distroless/static: a multi-stage Dockerfile taking a Go image from 812MB to 24MB, and the no-shell trade-off.

    docker performance

  17. Configuration Precedence: Docker Secrets, Kubernetes Secrets, Environment, .env, Default

    Docker secrets in /run/secrets, Kubernetes secret mounts, env vars and .env: a Python resolver with fixed precedence that reports which source won.

    python infrastructure-as-code docker kubernetes

  18. chmod -R and the setgid Bit: Why a Four-Digit Mode Is Not Enough

    chmod -R 775 clears the setgid bit of 2775 directories, so new files lose the shared group. Separate find -type d and -type f, and assert with stat -c %a.

    linux docker testing

  19. Docker Registry Credentials for Two Local Users on One Host

    "may require 'docker login'" for a deploy user after root logged in: credentials live in each user's ~/.docker/config.json. Per-user login with Ansible.

    docker ansible linux

  20. Reasserting Kernel Sysctls That Docker Silently Reverts

    net.ipv4.ip_forward = 1 although sysctl.d says 0: dockerd rewrites it at start. A oneshot unit After=docker.service reruns sysctl --system.

    linux docker security

  21. Deploying Docker Compose from Ansible Without Shelling Out

    community.docker.docker_compose_v2 instead of a command task running docker compose up -d: real changed status and --check --diff support.

    ansible docker infrastructure-as-code

All topics · All writing