Hello r/docker

I have created a new load balancer , based on cloudflare's proxy lib. The project is till on 0.x.x version, but I'm working on standardizing everything. It have fantastic proxy performance, even beats nginx in performance/stability tests with many thousands of concurrent connections.

It would be great to have a human review and suggestions .

This is the link for quickstart : 

And the link to main project in GitHUB: 

Thanks

Thank you for letting me into the group .

I'm very new to Linux and just getting into home labing .

My main computer is windows 11 in registered ( still can't let go). But I recently added two computers to my family. I have a Plex server and a Media gathering box . Both are running on mint . I remote into both of them from my main computer.

On YouTube I have seen what people are doing with docker and I want in . Lol . I created a new computer with mint that I want to run docker on it .

Is this the place that I can ask many silly questions on my quest to learn how to use it ?

Sorry for the wrong words, just stumbled into docker via webui Setup; and now over half my system runs via docker. But i think i missed some bacics. Right now my containers are running inside /srv/docker/.. e.g /srv/docker/jellyfin/... I was just wondering what are recommended setting of the distrubitons of yaml files or the config etc folders.

Hello folks!
My docker stack has been running for quite some time, and recently i updated the host from debian 12 to debian 13. Things ran well, until today, on a reboot, docker won't start or anything. after investigating, i find that the drive is full.

Main culprits for disk hogging are in /var/lib/docker :

22G     ./overlay2
73G     ./containers

I started docker manually, and can run docker system df :

root@sanakan:/var/lib/docker# docker system df
TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          41        41        19.13GB   0B (0%)
Containers      43        36        269.7MB   1.578MB (0%)
Local Volumes   24        12        260.3MB   22.87MB (8%)
Build Cache     0         0         0B        0B

I managed to reclaim 2G by removing dangling images, but somehow ./overlay2 grew to 34G when i do a du -h | grep '[0-9\.]\+G' .

I don't really know what i should do. Portainer did not start, some containers started but not all, and i don't know where to go from here.

Any insights?
thanks in advance!

EDIT1 :
i stopped a docker (unifi thing, stopped it with docker compose down, it was the only docker stack that was new , at 9 days, all the others ran for years), and it gave me back 17GB, so other dockers can run properly.
I got 17G on the filesystem back once it stopped.

EDIT2 :

So, after a message of u/burstinrust i investigated the logs, and i have 53G of logs, i am trying to figure out how to remove said logs, and then how to limit logfile size.

Hello, I have tailscale has been working fine via Docker on UGREEN NAS for more than 2 month. This past 2 days it has stopped working the exit node option, I reboot the project and works for like 3 minutes and stops working.

This is my docker compose:

services:
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
hostname: tailscale
network_mode: host
environment:
- TS_AUTHKEY=tskey-auth-#########hidden########
- TS_EXTRA_ARGS=--advertise-exit-node --accept-dns=false --accept-routes=false
- TS_STATE_DIR=/var/lib/tailscale
volumes:
- ./tailscale-data:/var/lib/tailscale
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN
- NET_RAW
restart: unless-stopped

I have rebooted my modem, my wifi, the NAS, docker itself and still is doing the same thing. One thing that I found out is that tailscale is up because I can ping the IP of Tailscale on my laptop.

Let me know if there's anything else I can provide if needed
Thanks!

Hi all! Trying to get the word out about our project, which recreates core AWS services including EC2, ECS, ECR and EKS, on whatever hardware you want.

If you're curious, checkout the GitHub: https://github.com/mulgadc/spinifex

Open to feedback!

[AI Disclaimer: We use AI to speed up development]

​

I've been working on making my Docker deployments more reusable.

For a typical web application, I usually end up dealing with:

- Docker/Docker Compose

- Nginx reverse proxy

- SSL

- Environment variables

- CI/CD

- Production deployment

The annoying part is that I end up configuring essentially the same infrastructure for every project.

So I created a reusable production deployment starter kit around this workflow.

I'm curious:

What's the part of Docker-based production deployments that you find most annoying to configure repeatedly?

I'm using the answers to improve the starter kit.

Looking for advice on Docker networking / multiple Compose stacks + selective egress.

I’m rebuilding the networking on my Docker host (LeopARRd) and would appreciate some architectural advice.
My requirements are:
- ALL services must be reachable on my network by one of the host IP (the host has one on VLAN-10 and one on VLAN-30)
- Two independent Compose projects (2 different compose.yaml files), but containers from both projects must communicate using container/service names, e.g. http://navidrome, rather than hard-coded IPs.
- Some services need Internet egress through 192.168.30.1 (a VPN gateway on 192.168.30.0/24)
- Other services need normal Internet egress through 192.168.10.1
- Ideally, the solution should survive container/host restarts and be reasonably easy to maintain.

My current approach is to create Docker networks corresponding to VLANs 31 and 32–33 (one per composer, defined in the composer as bridge/ipam), with policy routing and two different masquerades to select the appropriate gateway
It mostly works, but I’m running into issues with policy-routing routes and their persistence; to be more specific, docker networks do not exists right away at boot up, so the br-vlan32 for example do not exists and make rt rules fail to use the table for egress traffic on a different gateway: /etc/iproute2/rt_tables not being persistent as currently configured

Masquerading is working and is persistent

I suspect I may be overcomplicating this and would be happy to redesign it rather than keep patching the current setup.

What would be the cleanest Docker networking architecture for these requirements? I’m particularly interested in solutions that minimize custom routing/iptables maintenance while retaining service-name DNS between the two Compose projects. Ideally I’d rather prefer to have all networking settings specified in each individual composer file

Hey everyone,

Just finished setting up Docker Engine and Docker Compose Plugin on a fresh Debian 13 (Trixie) installation for container testing.

Setup Summary:

• Daemon Install: Added official Docker GPG key (/etc/apt/keyrings/docker.gpg) and repo path.
• Access: Configured non-root user execution (usermod -aG docker ELBA). Tested cleanly via docker run hello-world.
• Host Network: Static IP (192.168.1.132/24) on bridged host interface enp0s3.

Next Objective: Designing custom docker-compose.yml configurations with static container IP assignments on a dedicated bridge subnet (10.99.0.0/24).

Question: Are there any known caveats when assigning fixed container IPs across multi-service Compose files on Linux hosts?

recently shifted to openSUSE, was trying to build a project which worked on fedora.
there are errors are like:

auth-1:
python: can't open file '/app/app.py': [Errno 13] Permission denied
web-1:
npm error EACCES: permission denied, open '/web/package.json'
mongo-1:
find: '/data/db': Permission denied
chown: changing ownership of '/data/db': Permission denied

I have checked that I have all the permissions and the files exist
while running docker run for one it works but while mounting same files thru docker compose it doesn't

I’ve been trying to research the best way to run Claude Code as well as a combination of Ollama plus Open Code on my Mac. I’m fairly new to Docker, but I keep hearing about Docker Sandboxes as something purpose built for this kind of thing.

If I go the Docker Sandboxes (edit: sbx) route instead of running Claude Code and Open Code in a VM (VMWare Fusion Pro), is it fairly secure in terms of the agentic stuff going haywire and accessing my local system outside of the workspace folder I give it? Or for example, something malicious persisting on the Mac in that workspace’s folder.

Also, if I want to do some local AI stuff by installing Ollama directly on the Mac (runs on 127.0.01:11434), would a sandbox instance be able to reach it via host.docker.internal:11434 like a regular Docker container would?

Open to suggestions and other people’s experiences!

Docker sandboxes for Linux via “sbx“ CLI is available only for Ubuntu.

Until last week, Docker Sandboxes with limited features were included in Docker Desktop, although under “docker sandbox” CLI rather than “sbx”. But that CLI has been deprecated since.

Has anyone compiled the source code or installed the deb package for Debian or other distributions?

Hi, I am an intern at this company and I have no idea how to create docker containers and stuff using already existing dockerfiles.

There is no docker-compose.yml file, there are no setup instructions and the devs are super busy. I thought maybe someone kind from reddit can tell me how to do this stuff with company code bases. Like a generic guide to figure things out as an intern/new dev.

I can write and run my own dockerfiles, but company stuff is just different than my hobby-projects.

Thanks in advance!

Hi all

Sometimes I'm still a bit lost with docker. I use portainer to manage my dockers and wanted to deploy a new one using these instructions: https://docs.maintainerr.info/installation/

services:
maintainerr:
  image: ghcr.io/maintainerr/maintainerr:latest
  user: 1000:1000
  volumes:
    - type: bind
      source: /mnt/maintainerr
      target: /opt/data
  environment:
    - TZ=Europe/Brussels
  ports:
    - 6246:6246
  restart: unless-stopped

But there it gives an write error that it doesnt have permission to write to opt. I don't want to write to opt though,

So i changed it to how my others are structured:

services
  maintainerr:
    image: ghcr.io/maintainerr/maintainerr:latest
    volumes:
     -  /mnt/maintainerr:/data
    environment:
      - TZ=Europe/Brussels
    ports:
      - 6246:6246
    restart: unless-stopped

That starts it at least but I don't see any files appearing in /mnt/maintainerr, showing me that something probably went wrong adn when I restart or cahneg the stack the settigns are gone.. quiet annying ;)

Any tips?

cheers

Vic

Hi everyone,

I am managing an environment running 10+ separate containers via Docker Compose.

Our Constraint:
We are strictly not allowed to edit or modify the existing docker-compose.yml files to add labels, configs, or container-level sidecars.

Our Goal:
We need to guarantee 24/7 uptime. If any of these 10+ containers becomes unhealthy, a system must automatically detect the failure and restart it immediately without manual human intervention.

Since we cannot modify the Compose files, we are looking for a solution that sits completely outside of the container configurations on the host server.

My Questions:

1. Are there external, host-level watchdogs or daemons that can scan all running container states globally and instantly trigger a docker restart on any unhealthy instance?
2. If we automate this via a host-level system script (like a background systemd cron loop checking docker events or docker ps), what is the best practice to avoid script race-conditions?

I would love to hear how you handle automated 24/7 recovery when touching the deployment files is completely off the table.

Thanks!

Right now I have a docker container with a VPN that provides it's connection to the other services.

I thought about adding a VPN connection on the host system to basically create a multihop over different providers. Would that work?

As far as I understood the one inside the docker should be the "better" one as that's the one that's exposed first and the one on host would only see the VPN-encrypted traffic anyway? How about port forwarding? That should only be necessary on the one inside docker, too - or is there something I'm missing?

What are the disadvantages to do that (other than the lower speed)? Could I actually add risk of exposure if just one of them is compromised?

Or would it be smarter to spin up another docker and route the traffic through that one?

I started learning CI/CD using github actions after containerising my application and I have created CI pipeline for django app that runs test, builds and pushes image to github container registry.
I am sharing my yaml file for CI pipeline. Please do share your thoughts and where can i improve.

name: Test Pipeline 
on: 
  push:
jobs:
  test-backend:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:14
        ports:
          - 5432:5432
        env: 
          POSTGRES_USER: test_user
          POSTGRES_DB: erp
          POSTGRES_PASSWORD: 123456

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: setup python
        uses: actions/setup-python@v5
        with: 
          python-version: "3.13.5"

      - name: install dependencies
        run: pip install -r Backend/requirement.txt

      - name: run tests
        env: 
          DATABASE_URL: postgresql://test_user:123456@localhost:5432/erp
          DEBUG: 'True'
          ALLOWED_HOST: '*'
        run: |
          cd Backend 
          python manage.py test

  build-and-push-image:
    needs: test-backend
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: login to ghcr
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      - name: checkout repo
        uses: actions/checkout@v4


      - name: build image
        run: docker build -t ghcr.io/namespace/erp:${{ github.sha }} ./Backend


      - name: push image
        run: docker push ghcr.io/namespace/erp:${{ github.sha }}

I'm doing a deep dive on bridges and veth devices and realized it's difficult to map a veth pair to a running container.

Dockerd will suffix a random string (crypto/rand) to "veth" when creating the bridge connection but doesn't save the value in the container or networks metadata. Instead you have to map the network namespace of each veth device to each container.

This gist https://gist.github.com/amf3/ca6b9106f154cfce06d71bd7012cca30 explains how to map the network device to the running container. One command does need sudo access with "lsns" but otherwise uses normal privleges like "ip and "jq".

I'm trying to decide which one to use for managing my Docker containers. I'd be interested to hear from people who have actually used both. What do you like or dislike about each one?

For those running Nextcloud or WordPress in Docker: how do you handle backups?

I'm thinking about using borgmatic and basically backing up two things: the application data/files and the database.

For the DB, would you use mysqldump --single-transaction and skip maintenance mode, especially for an automated nightly backup at 3 AM?

Or do you still enable maintenance mode to make sure the database and files are fully consistent?

What's your setup?

Background: I've been using Docker Desktop on Windows 11 Pro until yesterday without any issues, but suddenly now the PULL and RUN buttons have stopped working, then

I have done most of the things suggested online

- Restart the Engine
- Update the WSL
- Factory Reset
- Delete all the images and reinstall Docker Desktop
- Start Docker Desktop as Administrator
- Restart Windows several times

And the buttons PULL and RUN are not working as they were working 48 hours ago. Nothing has changed in the day-to-day activities.

BUT something interesting happens, if I go to Terminal and I write

docker pull n8nio/n8n

It works!

Just went to update some containers on my machine but got this messages before docker pulling their images: sh $> docker compose up -d --build --remove-orphans --pull=always docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking [+] up 4/5dential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking What this could possibly mean?

EDIT

Just switched to docker-credential-secretservice and now everything its fine. :b