docker
Containers, images, registries and the build tooling around them.
-
When Microservice Decomposition Is the Wrong Default
Splitting a system into microservices before there is an actual scaling, ownership or isolation reason costs real coordination: versioned contracts, retries, and version-skew windows that a single process never has. This article builds the same three responsibilities as a modular monolith with an enforced internal boundary, so a later real split is mechanical rather than a rewrite.
-
Object Storage as the Durability Boundary for a Container Registry
A self-hosted registry backed by a single PersistentVolumeClaim keeps exactly one copy of every image layer, and routine maintenance is enough to delete it. This walks through why the fix is moving the durability guarantee to object storage rather than the volume, and gives a complete, runnable example that proves the registry container itself has become disposable.
-
Pinning Image Tags to Git SHAs Because GitOps Diffs Manifests, Not Registries
A Deployment manifest that references an image by a floating tag such as latest never changes as text, so a GitOps controller comparing git to the cluster sees no diff and triggers no rollout even after CI pushes a new image. This shows why, and how baking the git SHA into the tag at build time, with a reproducible local-registry demo proving both the failure and the fix.
-
Running Alembic Migrations Once, Before the Workers Fork
Calling alembic upgrade head from inside application code means every gunicorn worker, and every replica of the container, races to run the same migration concurrently. This shows why that races, and an entrypoint that migrates exactly once, guarded by a Postgres advisory lock, before the server process ever starts.
-
A Multi-Service docker-compose That a New Contributor Can Actually Start
A backend that needs an identity provider, a database, a cache and a time-series store fails unpredictably under a naive docker-compose file because none of it waits for the others to actually be ready. This shows the healthcheck, seeding and end-to-end test that make `docker compose up` a reliable one-command environment.
-
Runtime Configuration for an Angular Container Without Rebuilding
A frontend that reads its backend URL from an environment variable at build time needs a full rebuild for every deployment target, which defeats the point of building an image once. This article generates the frontend's runtime configuration from a container-start entrypoint instead, with a complete Dockerfile and compose setup that proves one image serves two different backends without being rebuilt.
-
Designing a Docker Image Build API: Job Model and Streamed Logs
An HTTP endpoint that triggers a Docker image build cannot behave like a normal request/response call, because the build takes an unpredictable amount of time and a client needs to watch its output as it happens rather than poll for a final result. This article designs the job and streaming model for that, with a complete Go service built on the Docker SDK.
-
Rootless BuildKit: What fuse-overlayfs Costs on a Cold Cache
The standard BuildKit container image needs privileged mode to use the kernel's overlayfs snapshotter, which is unwelcome on a cluster that flags privileged workloads. Rootless BuildKit avoids that by running its snapshotter in userspace via fuse-overlayfs instead, and this article measures, reproducibly, what that substitution costs on a build with a cold cache.
-
Running BuildKit as a Remote Builder Without a Docker Daemon
A CI runner scheduled on a containerd node has no Docker daemon to hand buildx, so the default docker-container driver cannot even start. This article sets up BuildKit as a standalone, always-on builder that buildx talks to over TLS instead, with a complete docker compose file, certificate generation and the exact buildx commands a pipeline needs.
-
A Shared Multi-Stage Base Image for a C++ Service Fleet
A dozen C++ services that each install and build the same HTTP framework and JSON library from source turn every Docker build into a multi-minute wait, for a change that touched one function. Here is a shared, versioned base image that compiles those dependencies once, and per-service Dockerfiles that only ever rebuild the service's own code against it.
-
Docker Compose or Kubernetes: What the Control Loop Actually Buys You
Kubernetes is usually sold as the next step up from Docker Compose, which makes it sound like a bigger version of what you already have. It is a trade: you hand over control of where things run in exchange for a system that keeps working when a machine dies. This works through what that trade actually costs, with a runnable example showing the control loop doing its job and a Compose stack that cannot do the same thing.
-
Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole
Rendering secrets into config files during a deploy leaves plaintext sitting on disk indefinitely and turns every rotation into a redeploy. This sets up a Vault Agent sidecar that authenticates with a single-use, response-wrapped AppRole secret and renders a live secret into a file an application container reads, verified end to end with a complete docker-compose stack.
-
Multi-Stage Docker Builds: Shipping a Runtime Without the Toolchain
Building an application inside the same image you intend to ship means every runtime container carries a compiler, build cache and source tree it will never use again, inflating image size and attack surface for no benefit. This walks through a multi-stage Dockerfile that separates building from running, with a measured image-size comparison a reader can reproduce on a laptop.
-
Configuration Precedence: Docker Secrets, Kubernetes Secrets, Environment, .env, Default
A service that reads configuration only from environment variables forces every deployment target to shoehorn secrets into that one mechanism, and nothing in the code says which value wins when two sources disagree. Here is a small, tested resolver with a fixed precedence order, and the tests that prove it behaves the same in Compose, in Kubernetes and on a laptop.
-
chmod -R and the setgid Bit: Why a Four-Digit Mode Is Not Enough
Fixing shared-volume permissions with chmod -R 775 looks like a correct fix and passes an immediate check, but it clears the setgid bit that made new files inherit the directory's group, so the fix quietly regresses days later. This covers how the octal digits actually work, why the fix has to treat files and directories differently, and a way to test it that a one-off manual check will not catch.
-
Docker Registry Credentials for Two Local Users on One Host
The Docker CLI reads credentials from the config file of whoever runs it, not from a single host-wide location, so a login task that only runs as root leaves any other user pulling private images unauthenticated and failing with a generic denied error. This shows how to provision registry credentials for every user who actually needs them, with a reproducible local registry to test against.
-
Reasserting Kernel Sysctls That Docker Silently Reverts
Docker sets several networking sysctls itself whenever it starts or creates a bridge network, and it does so after boot-time hardening has already run, overwriting values you set on purpose. This walks through which values move, why systemd-sysctl cannot protect you, and a small systemd unit that reasserts the values after Docker has finished starting.
-
Deploying Docker Compose from Ansible Without Shelling Out
Wrapping docker compose up in an Ansible command task gets a stack deployed but throws away everything Ansible is for: real change detection, check mode, and a diff you can trust. Here is how to deploy the same stack through a module that actually understands compose state, with a full working example.