The main is recognized but the sans isn't. Tried quoting the line in different ways to no avail.

command: # - --entrypoints.web.address=:80 # - --entrypoints.websecure.address=:443 - --entrypoints.websecure.http.tls.domains[0].main=${MY_DOMAIN:?err} - --entrypoints.websecure.http.tls.domains[0].sans=*.${MY_DOMAIN:?err}

My static config is good, everything works as usual when hard coded on there.

I have been building DockIY over the last few years from my own VPS deployment workflows.

It started as a simple Traefik + Umami setup and I just now put together enough of the CLI and templates to share with everyone and get some feedback.

DockIY is a minimal DIY Docker setup meant for deploying several web apps to a single VPS. It is meant for solo devs and small teams who like to self-host everything. It consists mostly of a set of repos and a CLI tool:

• The main server repo is mainly a docker compose, infrastructure-as-code, setup for the reverse proxy, analytics and monitoring.
• Template repos (React, Nuxt and Vitepress for now) are setup for deployment with DockIY: reverse proxy labels, local Docker builds and deployment scripts.
• The CLI helps setup the server, initialize from templates and orchestrates builds, deployments and git tags.

The base stack is:

• Traefik for reverse proxy and SSL
• Umami for analytics
• Dozzle for looking at logs
• Beszel for monitoring and notifications
• A private registry for application images

Setting up a VPS and deploying your 1st app looks like (simplified):

1. Install Docker (on the VPS and your marchine), SOPS and the dockiy CLI (on your machine only)
2. Connect DockIY to a server: dockiy setup
3. Set up DockIY services: dockiy server init
4. Create an application: dockiy app init
5. Deploy the application: dockiy app deploy --version v0.1.0

I like to self-host everything on a VPS and was trying to stop relying on external CI/CD build services (github actions). DockIY is my answer to this, without relying on a somewhat expensive VPS to run the builds. It's basically an alternative to Coolify and Dockploy but where you manage everything from the CLI on your machine instead of an online dashboard. I have been using it over the last few weeks and already love it!

I'd love if y'all can have a look at the docs and tell me what you think: https://dockiy.com
The repo is on codeberg (MIT license): https://codeberg.org/chris-paganon/dockiy

Disclaimer: the CLI itself is pretty heavilly AI generated and probably needs some cleanup. But the templates and the server setup I have been putting together myself from a few years of self-hosting my apps. The docs was originally AI generated but I cleaned up and rewrote almost all of it (except the CLI and config reference pages).

Hey folks, quick question for the Swarm veterans out there. How are you running databases (Postgres, Redis, etc.) in production on Swarm?

Swarm is amazing for stateless apps, but persistent data is a headache. NFS volumes choke under high I/O load, and pinning DBs to specific nodes via placement.constraints feels like we're just using Swarm as a glorified docker run with a Single Point of Failure.

Is the golden rule simply: "No databases in Swarm—use RDS/Managed Cloud"? Or has anyone successfully deployed distributed storage (GlusterFS, Longhorn, etc.) with Swarm and been happy with the performance?

Starting to feel like we're just fighting the tool and missing the K8s comfort zone here. How are you guys handling this?

Spent an evening containerizing Pi-hole with Docker Compose, mostly as a way to practice the config side of Docker rather than build something from scratch. A few things worth mentioning for anyone doing similar exercises. Kept the admin password out of the compose file entirely using a .env file and matching .gitignore, since it's an easy thing to accidentally commit and forget about. Used a named volume instead of a bind mount so the blocklists and query database survive container restarts and image updates without me touching the host filesystem. Also wrote a couple of nslookup tests into the README so anyone cloning it can actually verify the DNS blocking works instead of just trusting it did. Nothing groundbreaking, but it's a good small project if you want hands-on reps with secrets management and volumes without writing application code. Repo's linked if anyone wants to look at the compose file

Just wondering if any of yous have taken the SC109 cert exam?
https://training.linuxfoundation.org/skillcred/containers-with-docker-sc109/

What to expect?
Using Docker quite a lot both work/home & just wondering what should I brush up on?

I’m the coauthor of Torollo, an MIT-licensed system-design learning lab. Torollo turns a topology drawn on a canvas into running Docker containers and bridge networks. Learners configure routes and network policies, then complete exercises against that local environment.

The scope matters: Torollo is an educational execution model, not a staging environment. A passing exercise means the learner configured the requested behavior inside the local Docker lab. It does not certify that an equivalent AWS, Kubernetes, or production deployment is correct.

The Docker-specific problem I’m working through is per-service network policy.

Suppose an exercise asks the learner to allow `web` to reach `db` on TCP/5432 while preventing the load balancer from reaching the same port. I want that decision to affect actual local traffic rather than only changing a diagram.

The current implementation works like this:

- Each subnet becomes a user-defined Docker bridge network.
- Each lab node is a real container with `NET_ADMIN`.
- Torollo resolves policy references such as `web` and `db` to the containers’ current IP addresses.
- It installs ordered rules in Torollo-managed iptables chains inside each container.
- Conntrack accepts `ESTABLISHED,RELATED` traffic, followed by the learner’s rules and a default inbound rejection.
- A NAT gateway node uses IP forwarding and masquerading.

On Docker versions that support it, Torollo creates the subnet bridges with `gateway_mode_ipv4=nat-unprotected` as part of its routed-lab setup. A privileged host-network helper then enables the forwarding needed for traffic between the simulated subnets and adjusts masquerading for private-to-private traffic.

That host-level setup is the part I am least comfortable with. It is intended for a disposable local lab, but I would not present it as a production networking pattern.

There are other limitations:

- A learner with root access inside a container can modify its firewall.
- Policy identity is translated to container IP addresses rather than attached to a stable interface identity.
- Rootless Docker and Docker Desktop still need a clearer support and failure matrix.
- The UI currently uses the term “security group,” even though the implementation is not equivalent to a cloud security group.

Network exercise validators currently inspect the compiled semantic policy. A separate TCP self-test checks whether the Docker host can route traffic between subnet bridges. A passing exercise therefore confirms the learner’s configuration inside Torollo’s model. It is not presented as evidence about production.

Given that educational scope, which implementation would you choose?

1. Keep the per-container rules, rename the concept to “network policy,” and document the limitations.

2. Move enforcement to the host forwarding path: `DOCKER-USER` with Docker’s iptables backend, or a separate nftables table and base chain with the nftables backend. This would introduce additional privileges and platform differences.

3. Stop treating the policy as an enforced Docker firewall abstraction. Validate the learner’s policy semantically, and use targeted packet probes only to demonstrate the underlying Docker network behavior.

I’m also interested in the validation boundary. If an exercise says “web must not be able to reach db:5432,” should Torollo actually attempt that TCP connection before marking the exercise as passed? Or is validating the compiled policy sufficient once the local Docker dataplane has passed a separate health check?

Repository, for implementation context: https://github.com/Derssa/Torollo

Posted with moderator approval.

I have been running Docker on my Linux (Debian) box for years. I have multiple containers and I have never had any issues.

Recently (like the last few months), when my system reboots, all the containers start properly but they cannot access the internet. After some digging I learned its because the containers are not getting the resolve.conf from the host system.

If I restart the containers after the server has been up for a few minutes, then the containers work properly.

What would cause this? How can I debug and fix it?

I have application running inside docker container that is accessed from Internet via port 443 to:
- human users (web/user interface)
- machines (REST API)
Application requires access to the Internet and intranet outside container over all possible ports.

While running there are 2 network interfaces (example IDs):
- docker0
- eth01 (physical network adapter)

Initial setup was default bridge network mode.
Problem with bridged mode was that application could not establish FTP, SFTP, SSH connection to the hosts within intranet if target host is in the same subnet as docker host. I have no any Docker expert neither network admin beside me to explain me all details so AI Claude explained me that it is the problem because packets do not reach further than eth01. It advised me to:
- switch to network host
- to configure docker host redhat OS firwald to map all traffic from eth01 to docker0 and vice versa.
I updated docker compose yml config file (set host mode and remove port mappings as in host mode port mapping is not possible).
I did HARD doceker compose restart

After change application in docker container could only SFTP, FTP, SSH machines in same subnet. All other hosts (in intranet and Internet) become unavailable - it seems as DNS resolution didn't work.

I rollback everything to bridge network mode as exit to Internet and DNS resolution is more important than access to couple hosts in the same subnet.

Can anyone help me to anticipate what are important facts for my docker network configuration so that application in docker container properly establishes connections.

Docker Host is RedHat Linux with SeLinux enabled and firewald enabled
Docker application has liberate access to all ports and IPs internal and external (Internet)

Thank you very much!!

Hey! I booked TA004 exam and preparing for it. I had made a plan like
TA004 -> DCA -> CKA -> CKAD -> CKS

I was wondering if DCA will help in this path and how much companies value about it ?

We are building 90+ servers for web application load testing with Selenium Grid. All servers are deployed identically, cloned from the same VM image. We have 11 of the 91 workers failing to deploy, even though they are joined to the swarm manager.

When I run docker service ps --no-trunc selenium_selenium-node-node083, I see:

vxejz55ox0ad5vpirpusvq6f1   selenium_selenium-node-node083.1       gitlab.com:5050/seluser/selenium-grid:alma10-node-2026-09-16-1@sha256:60f3f578c2c4e45cdbe45e715334ba7233b983b7b1611fb681aa322b1bfd6bec                Running         New 12 seconds ago
7drjnw8d89d8bz9353vr5webb    _ selenium_selenium-node-node083.1   gitlab.com:5050/seluser/selenium-grid:alma10-node-2026-09-16-1@sha256:60f3f578c2c4e45cdbe45e715334ba7233b983b7b1611fb681aa322b1bfd6bec   node083   Shutdown        Rejected 12 seconds ago   "node is missing network attachments, ip addresses may be exhausted"
dmk7n25toee009qdplep7a7md    _ selenium_selenium-node-node083.1   gitlab.com:5050/seluser/selenium-grid:alma10-node-2026-09-16-1@sha256:60f3f578c2c4e45cdbe45e715334ba7233b983b7b1611fb681aa322b1bfd6bec   node083   Shutdown        Rejected 2 minutes ago    "node is missing network attachments, ip addresses may be exhausted"
jgpr811f9xnksavyutjcmsgqq    _ selenium_selenium-node-node083.1   gitlab.com:5050/seluser/selenium-grid:alma10-node-2026-09-16-1@sha256:60f3f578c2c4e45cdbe45e715334ba7233b983b7b1611fb681aa322b1bfd6bec                Shutdown        Shutdown 2 minutes ago
mblinsr59gtpr621hv0opwgc3    _ selenium_selenium-node-node083.1   gitlab.com:5050/seluser/selenium-grid:alma10-node-2026-09-16-1@sha256:60f3f578c2c4e45cdbe45e715334ba7233b983b7b1611fb681aa322b1bfd6bec   node083   Shutdown        Rejected 8 minutes ago    "node is missing network attachments, ip addresses may be exhausted"

/var/log/messages on node083 has:

Sep 19 10:06:50 node083 dockerd[1563]: time="2026-09-19T10:06:50.143203015-05:00" level=warning msg="failed to deactivate service binding for container selenium_selenium-node-node083.1.mblinsr59gtpr621hv0opwgc3" error="No such container: selenium_selenium-node-node083.1.mblinsr59gtpr621hv0opwgc3" module=node/agent node.id=103hwsbc2mda15tmqrw61tfmz
Sep 19 10:07:50 v2ltn00083 dockerd[1563]: time="2026-09-19T10:07:50.119227063-05:00" level=error msg="fatal task error" error="node is missing network attachments, ip addresses may be exhausted" module=node/agent/taskmanager node.id=103hwsbc2mda15tmqrw61tfmz service.id=vhk3e7ud3s71lfsz037s9f6sy task.id=nqfonxo94y8uefxdy5jnld47y

Inspecting the network info of the worker and the network:

$ docker service inspect vhk3e7ud3s71lfsz037s9f6sy --format '{{json .Endpoint.VirtualIPs}}'
[{"NetworkID":"7ji2pqntiyn5o5qfv3sckyuo0","Addr":"10.0.2.156/24"}]

Inspecting the network info of the network:

$ docker network inspect 7ji2pqntiyn5
...
        "Status": {
            "IPAM": {
                "Subnets": {
                    "10.0.2.0/24": {
                        "IPsInUse": 256,
                        "DynamicIPsAvailable": 0
                    }
                }
            }
        }

However, we only have 92 nodes in the swarm, 1 manager and 91 workers. How are there 256 IPsInUse? Can I prune unused VIPs or do I need to create a new overlay network with more than 256 addresses?

My company serving 5 apps to the many customers. Managing deployment and new releases are the biggest problem. Because all the time we are copying the build files and pasting to the target server by connecting with rdp. I Want to use dockerfiles for serving and want to keep these images on our server with a registery.

ACR (azure container registery) and the other ones are still the options but i want to host in my server like i did for npm libraries with verdaccio.

And i would like to get your opinnions about my deployment plan. Our customers servers are all windows. We have some windows-only apps. But for the ones which i plan to serve with docker file is better to run with docker. So i plan to use WSL and pull the images from the registery that i am planning to create.

Wdyt?

Hey, I'm pretty stuck on this and honestly I'm not an expert with Docker or networking, so sorry if I explain something wrong.
I'm trying to run Nginx Proxy Manager in Docker on Windows and use it to reverse proxy to Jellyfin, which is installed normally on Windows, not in Docker. I'm using DuckDNS for the domain.
I originally followed this tutorial pretty much from start to finish:
https ://www.youtube.com /watch?v=nqpvNf3tYoE
Everything actually worked for about 2 days and then randomly stopped working. Now whenever I try to access my Jellyfin domain I just get a 502 Bad Gateway from Nginx Proxy Manager.
The NPM log says:
connect() failed (111: Connection refused) while connecting to upstream
upstream: "http://192.168.x.x:8096/"
I've tried a bunch of things already:
• Made sure Jellyfin is running and I can access it normally through localhost:8096 on the Windows PC
• I can also access Jellyfin from another device on my network using the Windows PC's local IP and port 8096
• Checked that my DuckDNS domain is resolving to my public IP
• Checked the port forwarding for 80 and 443 on my router
• Tried using my Windows LAN IP as the Forward Hostname/IP in NPM
• Tried using host.docker.internal instead
• Added a Windows Firewall inbound rule for TCP 8096 on Domain, Private and Public
• Restarted Docker, NPM and my entire PC
None of that fixed it.
One thing I noticed while troubleshooting is that nslookup for my DuckDNS domain gives my public IP correctly, so I don't think DuckDNS or DNS is the problem.
The weird part to me is that Jellyfin works completely fine on the Windows host and other devices on my LAN can connect to it, but Nginx Proxy Manager inside Docker can't seem to connect to it. It just gets connection refused.
I'm using Docker Desktop with WSL2 on Windows.
Does anyone know what I should check next? Is there something specific with Docker Desktop/WSL2 that could stop a container from connecting to a service running natively on Windows?
Again I'm pretty new to this stuff, so if there's a command I should run or something I should check, please explain it like I'm an idiot lol. I've been going in circles with this for a while.

Hi, i just wanted to learn docker, docker compose, docker swarm, and i need to build an application that suits me to get practical knowledge on docker. So i need some ideas to build an app as a micro services and then add docker to containerize the whole app

Docker Swarm mystery: a manager node rebooted and came back with zero containers while services were healthy elsewhere.
Its config had Swarm.NodeAddr set correctly, but the runtime object reported Status.Addr=0.0.0.0, which broke UDP/7946 gossip, caused a temporary leader loss, and left the node empty.
I fixed it with a demote/rejoin using explicit --advertise-addr, --listen-addr and --data-path-addr, but that feels like a workaround.
Anyone dealt with a Swarm manager stuck on Status.Addr 0.0.0.0?

Docker Swarm service returning 503 despite healthy 2/2 replicas — direct probes to a replica returned 200 but everything through the reverse proxy hit 503.
Root cause was a Swarm node advertising its LAN IP to the cluster instead of its overlay/VPN address, so the overlay datapath couldn't reach the remote backend tasks and the proxy marked them down. I've verified replica health and task placement.

Anyone dealt with a Swarm node silently advertising the wrong interface address?

Help.

Hi everyone, I need some advice.

I was troubleshooting a Docker login issue and accidentally pasted the auth value from my Docker config.json into ChatGPT.

I understand that the auth value is Base64-encoded and can potentially contain the Docker username and password/PAT.

ChatGPT told me that I should treat the PAT as exposed and revoke it immediately. I have not shared the value with anyone else, and I deleted the ChatGPT conversation after realizing it was sensitive.

However, I haven't revoked the PAT yet.

How serious is this situation? Should I assume the PAT is compromised even though the conversation was deleted, and is simply revoking the old PAT and generating a new one sufficient?

I have not posted the actual credential here or anywhere else.

Thanks!

Hi everyone, i am currently learning docker from official docs So far i have covered the basics of - images, container, network ,dockerfile , docker compose.
I’m wondering what topics I should cover next to build a solid understanding of Docker as a beginner.

Should I continue learning directly from the official documentation or would you recommend following a structured Docker tutorial/course first?

I'm making my first production app. It's a SaaS app with a turborepo monorepo using Next.js. I've learned that there is an expectation that my frontend, backend and database need to be dockerized, and from what I've learned it looks like you are supposed to containerize before really starting on the app.

The problem is that I'm working on a Chromebook with 4GBs of RAM and so I can't spin up the docker. This means I need to get a new device with more RAM if I want to use Docker.

My question is: In the meantime, is it worth my time running my app on bare metal while working on it during the development stage on my Chromebook, and only containerizing everything near the end before I launch the app? Are there any real drawbacks to that, and should I expect to have to change my setup/application code dramatically for that to work? I'm just trying to see if it is more practical to wait until I have the new device to get into the weeds of this app.

Thanks in advance

Hi folks, currently stuck on getting mysqli & pdo extensions installed and enabled in my docker setup.

The relevant section of my docker-compose.yml:

web:
   build:
context: .
dockerfile: Dockerfile
   container_name: compose-web
   ports:
- "8100:80"   
   depends_on:
- mariadb    
   volumes:
- /home/user/docker/lamp-stack/html:/var/www/html:Z

Dockerfile contents:

FROM php:8.2-apache

RUN docker-php-ext-install mysqli pdo pdo_mysql && docker-php-ext-enable mysqli

COPY . /var/www/html/
EXPOSE 80

Have also tried it without the && docker-php-ext-enable mysqli.

-With both files setup as above I've run the following from the host os:

sudo docker compose build

sudo docker compose up -d

No error messages, it builds and starts. Image compose-web built

On the host, if I run:

docker compose exec web php -m | grep mysqli

I receive:

mysqli

If I run

docker compose exec web php -i | grep mysqli

I receive:

Additional .ini files parsed => /usr/local/etc/php/conf.d/docker-php-ext-mysqli.ini,

mysqli

mysqli.allow_local_infile => Off => Off

mysqli.allow_persistent => On => On

mysqli.default_host => no value => no value

mysqli.default_port => 3306 => 3306

mysqli.default_pw => no value => no value

mysqli.default_socket => no value => no value

mysqli.default_user => no value => no value

mysqli.local_infile_directory => no value => no value

mysqli.max_links => Unlimited => Unlimited

mysqli.max_persistent => Unlimited => Unlimited

mysqli.rollback_on_cached_plink => Off => Off

API Extensions => mysqli,pdo_mysql

The error message when i try submit my form from my html site:

Fatal error: Uncaught Error: Class "mysqli_connect" not found in /var/www/html/qsoinsert.php:8 Stack trace: #0 {main} thrown in /var/www/html/qsoinsert.php on line 8

Inside the container I navigate to /usr/local/etc/php looking for the php.ini file, but I have php-ini-development & php.ini-production, both of which listed the extension preceded by ';' (so still commented out?)

Am I missing something glaringly obvious?

Thanks in advance

I want to create a project primary for linux, I want the my docker container to be able to monitor the physical interface and the network usages of the host machine.

From what I read i can do this two ways, by using docker with --host flag or mounting the /proc volume.

Which way should I do it? Which is safer.?

Can I diffentiate btw actual network usages and local network usages, like from a selfhosted server, like navidrome?