“docker”
Docker Compose Profiles: Running Only the Services You Need
Compose profiles let one compose.yaml hold your core stack plus every debug, admin, and observability sidecar — and start only the subset you ask for.
Named Build Stages and --target: Building Just the Layer You Need
Name your Dockerfile stages with FROM ... AS, then build only the stage you need with --target — test images in CI, lean runtime images in release, one file.
Bind Mounts: Wiring Host Directories into Containers
-v vs --mount, live code reload, read-only mounts, UID mismatches, SELinux labels and VirtioFS performance — plus how to debug 'mount denied'.
Foreground vs Detached Mode: When to Run Docker Containers in the Background
Foreground or -d? How attached output, Ctrl-C, Ctrl-P Ctrl-Q detach, docker logs and restart policies interact — and how to pick the right mode every time.
Limiting CPU and Memory per Container: A Practical Guide
--memory, --memory-swap, --cpus, --cpu-shares: what each flag really enforces, how OOM kills show up as exit code 137, and how to size limits you can defend.
Tail and Follow Container Logs with docker logs
docker logs -f, --tail, --since and timestamps, plus the json-file vs local drivers, log rotation, and how to stop losing container output.
Signal Handling and Graceful Container Shutdown in Docker
Why PID 1 ignores your SIGTERM, how docker stop's 10-second grace period really works, and how tini, exec-form ENTRYPOINT and healthchecks make shutdown graceful.
BuildKit Cache Mounts: Fast Package Installs in Docker Builds
RUN --mount=type=cache gives Docker builds a persistent, shared cache across builds — pip, npm, apt, Go modules, and Cargo all get dramatically faster with it.
Docker CI Build Caching: GHA Cache vs Registry Cache
Speed up Docker builds in CI with BuildKit caching. Compare --cache-to/--cache-from type=gha and type=registry, and pick the right strategy for GitHub Actions.
Under the Hood: How the Docker CLI Talks to the Docker Engine REST API
Every docker command is an HTTP request. Learn how the Docker CLI communicates with the dockerd REST API over the Unix socket, and how to call the API directly with curl.
Healthchecks and depends_on: Making Docker Compose Startup Order Reliable
docker compose up racing your app? Use healthchecks and depends_on conditions like service_healthy to guarantee your services start in the right order — and stay that way.
How Docker's Embedded DNS Resolves Container Names
Docker containers resolve each other by name via an embedded DNS server at 127.0.0.11. Learn how it works, why it beats /etc/hosts hacks, and how to debug name resolution.
Docker Named Volumes: The Complete Guide
Named volumes are Docker's managed storage for persistent data. Learn how to create, inspect, mount, back up, and clean up named volumes — and when to choose them over bind mounts.
Docker Licensing & Editions in 2026: Docker Engine vs Docker Desktop vs Business
Comparing open-source Docker Engine (Moby) vs Docker Desktop commercial licensing terms, enterprise compliance, and alternatives like OrbStack/Colima.
Docker Desktop on macOS: Apple Silicon (M1/M2/M3) Installation & Optimization
Downloading Docker Desktop for ARM64 Apple Silicon, Rosetta 2 setting, Virtualization framework (VirtioFS), resource limits, and CLI verification.
Deploying Docker Engine on Fedora and RHEL 9: Enterprise Setup
Configuring DNF repositories, handling SELinux policies, installing docker-ce, containerd, configuring cgroups v2, and firewalld rules.
Installing Docker Engine on Amazon Linux 2023 for AWS Workloads
Deploying Docker on AWS EC2 instances running Amazon Linux 2023, dnf install docker, EC2 user permissions, and systemd auto-start.
Installing Docker Engine on Debian 12 (Bookworm): Step-by-Step Guide
Setting up official Docker apt repository, GPG keys, installing docker-ce, containerd.io, Buildx, Compose plugin, systemd enablement, and non-root user setup.
Mastering docker run: Container Flags, Port Mapping, Volumes, and Env Vars
Comprehensive guide to docker run -d -p 8080:80 -v data:/app --env-file .env --name web app:v1, interactive -it containers, and lifecycle flags.
Verifying Your Docker Setup: Diagnostics, Architecture & hello-world
Troubleshooting Docker daemon sockets (/var/run/docker.sock), permission errors, running hello-world, and system diagnostics.
The USER Directive and Secure Defaults
Containers run as root by default — how the USER directive, explicit UIDs, file ownership, and gosu change that, and what USER doesn't fix.
RUN Layer Hygiene and Command Chaining
How to structure RUN instructions — chain update with install, clean up in-layer, avoid over-chaining, and keep the build cache working for you.
Anatomy of a docker-compose.yml File
Walk through every section of a Compose file — services, build, depends_on, ports, networks, volumes, secrets — with a fully annotated example.
Container Sandboxes for Tool Execution: Images, Seccomp, and Network Policies
Harden agent tool execution with container sandboxes: minimal images, seccomp profiles, dropped capabilities, and Kubernetes NetworkPolicy egress control.
Creating User-Defined Bridge Networks
Create Docker bridge networks with docker network create — automatic DNS between containers, scoped isolation, driver options, and IPv6.
Installing Docker Desktop on Windows with the WSL 2 Backend
Install Docker Desktop on Windows using the WSL 2 backend — requirements, installer flags, per-user vs all-users, and first-run verification.
Installing Docker Engine on Ubuntu
Set up Docker Engine on Ubuntu from Docker's official apt repository — remove conflicts, add the GPG key, install, verify, and drop sudo.
Writing Useful HEALTHCHECK Instructions in a Dockerfile
A HEALTHCHECK that always passes is worse than none. A practitioner guide to the instruction forms, timing options and defaults, how health status reaches docker ps and Compose depends_on, and the checks that lie while your app is broken.
COPY vs ADD in a Dockerfile: When Each One Is Right
COPY and ADD look interchangeable but are not. The exact behavioral differences - URL fetching, tar extraction, --chown, --from, cache invalidation - and why the guidance is to prefer COPY.
Running Databases in Containers with Persistent Volumes
A database tutorial for Docker: why the writable layer loses data, how to set up named volumes for Postgres and MySQL, fix ownership problems, back up a running DB, and decide when to go managed.
Cosign and Sigstore: Signing Images at the Registry
A hands-on Sigstore tutorial: keyless signing with Fulcio and Rekor, keypair signing, signing a pushed image by digest, verifying in CI and at deploy, and attaching SBOM attestations.
Docker Hub Rate Limits: How They Work and How to Cope
Docker Hub caps pulls per six-hour window for unauthenticated and Personal users. Learn exactly what counts as a pull, what the 429 looks like, and the mitigation ladder from CI auth to a pull-through cache.
Docker Buildx: The Next-Generation Build CLI
A practical buildx tutorial: verify the plugin, understand builders and drivers, master --load/--push/--platform, wire up cache export and import, and know when plain docker build is enough.
The Default Bridge Network in Depth
A close look at docker0 and Docker's default bridge: how packets flow, which iptables rules the daemon programs, where it diverges from user-defined bridges, and how to migrate.
Dependency Caching for npm, pip, Go Modules, and Cargo
Two layers of build caching for language dependencies: lockfile-first COPY ordering plus BuildKit cache mounts, with Dockerfiles for npm, pip, Go, and Cargo.
Storage Drivers Deep Dive: overlay2
How Docker's overlay2 driver stores image layers and container writes: lower, upper, merged, copy-up, on-disk anatomy, kernel options, and where it performs badly.
Signal-Safe Entrypoints with tini and dumb-init
Why PID 1 in a container ignores SIGTERM and leaks zombies, and how to fix it with docker run --init, tini, or dumb-init, with worked examples.
Build Secrets with BuildKit: Keeping Credentials Out of Layers
Why ARG and ENV secrets stay permanently in image history, and how RUN --mount=type=secret plus the --secret flag keep credentials out of layers.
Rootless Docker: Concepts, Benefits, and Limits
How Docker rootless mode works, how to install it with dockerd-rootless-setuptool, and the practical limits you will hit on ports, cgroups, and storage.
.dockerignore: The Forgotten Build Optimization
A good .dockerignore shrinks build contexts, speeds up builds, and keeps secrets and junk out of your images. Syntax, patterns, and a solid default template.
Multi-File Compose: The Base-Plus-Override Pattern
How docker compose -f base.yml -f override.yml merges files, the automatic compose.override.yml convention, and patterns for dev/staging/prod configs.
Anatomy of a Dockerfile: Instructions from Top to Bottom
FROM, WORKDIR, COPY, RUN, CMD, ENTRYPOINT, USER, HEALTHCHECK — what each instruction does, the order they run in, and how they shape your image layers.
What Docker Compose Is and When to Reach for It
Docker Compose turns a YAML file into a multi-container application. Where it shines, where it stops being enough, and how it fits next to Kubernetes.
How Container Images Are Structured: Manifest, Config, and Layers
A guided tour of the OCI image format: the manifest, the config JSON, content-addressed layers, and how a registry pull actually works.
Union Filesystems and How Docker Image Layers Stack
Every Dockerfile instruction adds a layer. How union filesystems (overlay2) stack read-only layers with a writable top layer, copy-on-write, and what it means for image size and performance.
What Docker Is and Why Containers Exist
Containers solved the 'works on my machine' problem by packaging apps with their dependencies. What Docker actually does under the hood and why it took over deployment.
CVE Scanning with Trivy: Finding Vulnerabilities in Container Images
A practical guide to scanning container images for known vulnerabilities with Trivy — from a one-line local scan to CI gates, ignore policies, and air-gapped setups.
Docker Build Cache: What Invalidates Each Layer
Why changing one line of code re-downloads your dependencies — the exact rules Docker uses to hit or miss the cache, and how to structure a Dockerfile so it hits almost every time.
Base Images Compared: Alpine, Slim, Distroless, and Scratch
The FROM line decides your image size, your CVE count, your glibc-vs-musl headaches, and whether you have a shell to debug with. A practical guide to choosing a base image.
Docker Network Drivers: bridge, host, overlay, macvlan, and when to use each
Six built-in network drivers, each with a different isolation model. A practical guide to bridge vs host vs overlay vs macvlan vs ipvlan — and the user-defined network features most projects never discover.
ENTRYPOINT vs CMD: Who Actually Runs in Your Container
ENTRYPOINT sets the executable, CMD sets the default arguments — and the rules for how they combine, override, and break signal handling are the ones every Docker user eventually needs.
The Container Security Model: What Is and Is Not Isolated
Containers share one host kernel, so isolation is a bundle of kernel features, not a wall. NIST SP 800-190 frames the model — this post maps each layer to what it really isolates and how to harden it.
Startup Ordering That Actually Works: Healthchecks and depends_on in Compose
Compose depends_on only waits for containers to start, not to be ready. Gate startup on real readiness with healthchecks and condition: service_healthy — and know what that guarantee does not cover.
Linux Namespaces: The Isolation Primitive Behind Containers
What Linux namespaces actually do, the eight namespace types, how to inspect them on a live system, and why they make containers fundamentally different from virtual machines.
Docker Multi-Stage Builds: Smaller Images From First Principles
How multi-stage Docker builds shrink images, cut attack surface, and improve caching — with real examples for Go, Node.js, and Python.
Docker Volumes vs Bind Mounts vs tmpfs: Where Your Data Should Live
Containers are ephemeral — your data shouldn't be. Compare Docker volumes, bind mounts, and tmpfs mounts, and learn exactly when to use each.
Docker Restart Policies Explained: no, always, on-failure, unless-stopped
When should Docker restart your container? A practical guide to the four restart policies and how to choose the right one for each workload.
Containers vs Virtual Machines: Architecture and Trade-offs
A clear architectural comparison of containers and virtual machines: what they share, where they diverge, and how to choose between them.
Sandboxed Agents: Safe Code Execution with Container Workspaces
Build agents that can safely execute code, edit files, and run commands using sandboxed workspaces with the OpenAI Agents SDK. Learn to configure Docker and Unix-local sandboxes with filesystem and shell capabilities.
Docker for Web Developers: Images That Ship
A code-first walkthrough of writing Dockerfiles for web apps that actually ship: multi-stage builds, non-root users, .dockerignore, secrets, BuildKit caching, and docker compose for local dev.
Securing Local Agents: Sandboxing Gemini 3 Tool Execution for Enterprise Safety
A developer laptop holds years of credentials. Learn how to sandbox local Gemini 3 agent tool execution with hardened containers, gVisor, and microVMs.
Containerizing & Deploying ADK Agents to Cloud Run
Learn how to package your Google ADK agent harnesses into lightweight Docker containers using uv and deploy them as auto-scaling microservices on Google Cloud Run.
Containerize It: A Guide to Deploying Your AI App with Docker and FastAPI
Learn how to package your AI applications into portable, scalable containers using Docker and the high-performance FastAPI framework.
Platform Engineering with Docker: Automating the Container Lifecycle
Move beyond manual Dockerfiles and learn how to build internal developer platforms to automate your container lifecycles.
Serverless AI is Here: Deploying Language Models with AWS Lambda
Move your AI application from a script to a scalable, production-ready serverless API using AWS Lambda, API Gateway, and Docker.
Your First Local LLM: A Developers Guide to Ollama and Docker
Learn how to run powerful, open-source large language models on your own machine for free, private, and offline AI development.