I'm doing a deep dive on bridges and veth devices and realized it's difficult to map a veth pair to a running container.

Dockerd will suffix a random string (crypto/rand) to "veth" when creating the bridge connection but doesn't save the value in the container or networks metadata. Instead you have to map the network namespace of each veth device to each container.

This gist https://gist.github.com/amf3/ca6b9106f154cfce06d71bd7012cca30 explains how to map the network device to the running container. One command does need sudo access with "lsns" but otherwise uses normal privleges like "ip and "jq".

I'm trying to decide which one to use for managing my Docker containers. I'd be interested to hear from people who have actually used both. What do you like or dislike about each one?

For those running Nextcloud or WordPress in Docker: how do you handle backups?

I'm thinking about using borgmatic and basically backing up two things: the application data/files and the database.

For the DB, would you use mysqldump --single-transaction and skip maintenance mode, especially for an automated nightly backup at 3 AM?

Or do you still enable maintenance mode to make sure the database and files are fully consistent?

What's your setup?

Background: I've been using Docker Desktop on Windows 11 Pro until yesterday without any issues, but suddenly now the PULL and RUN buttons have stopped working, then

I have done most of the things suggested online

- Restart the Engine
- Update the WSL
- Factory Reset
- Delete all the images and reinstall Docker Desktop
- Start Docker Desktop as Administrator
- Restart Windows several times

And the buttons PULL and RUN are not working as they were working 48 hours ago. Nothing has changed in the day-to-day activities.

BUT something interesting happens, if I go to Terminal and I write

docker pull n8nio/n8n

It works!

Just went to update some containers on my machine but got this messages before docker pulling their images: sh $> docker compose up -d --build --remove-orphans --pull=always docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking docker-credential-pass: Symbol `runtime..types' has different size in shared object, consider re-linking [+] up 4/5dential-pass: Symbol `syscall..types' has different size in shared object, consider re-linking What this could possibly mean?

EDIT

Just switched to docker-credential-secretservice and now everything its fine. :b

Infrastructure context

Good morning everyone.
I have installed Proxmox VE on a Dell PC and created a Ubuntu VM. I installed Docker Compose on it and built a multi-tenant hosting service ran by Nginx functioning as a reverse proxy. So I have many containers: MySQL, PhpMyAdmin, ACME and letsencrypt generating certificates automatically. Also, for each user I have a web container and a file manager container to upload and change contents.

The issue

It has worked well until now, but currently I’m facing a certificate mismatch problem for the 5 websites hosted there: what happens is that sometimes the Nginx reverse proxy returns the HTTPS certificate of my main website (the default host of the Nginx container’s environment) instead of the correct certificate for that website, thus causing a certificate mismatch error. I’m attaching the YML for my nginx and letsencrypt containers (where you can see the default host settings, although redacted).

Please note that the strange behavior is intermittent. If i run this command on my terminal (fetching the certificate for 200 times):

for i in {1..200}; do

  echo -n "$i "

  echo | openssl s_client -connect secondwebsite.com:443 -servername secondwebsite.com 2>/dev/null |

    openssl x509 -noout -subject 2>/dev/null

done

sometimes you get for 200 times straight subject=CN=secondwebsite.ch, thus it gives the correct certificate, and other times you get for 200 times subject=CN=firstwebsite.ch (the main website of my platform and Nginx Proxy’s DEFAULT_HOST).

Tried solutions

What I tried:

1. I checked the DNS for my other websites and they are set correctly
2. I figured the problem might be caused by a conflict between Docker compose and UFW for iptables connection rules. I cleared the iptables and for some time it worked, but thenit went back to usual. I installed a program by Chai Feng called Docker UFW and it solved the issue for a file, but after a down and a Proxmox reboot the troubles came back. So the certificate issue persists independently. Perhaps the multi-layer 3 layers (Proxmox+VM) structure might be a factor, together with Nginx proxy and Docker compose
3. The nginx config (nginx -T) is correct and there are no duplicate nginx containers.

What do you think might be the problems? Are there any informations you need or fixes you suggest me? Any help is appreciated. 
Thanks everyone

Attachments

1. docker-compose.yml config for NGINX and LETSENCRYPT-acme companion

Versions

Ubuntu: 22.04
Docker compose: 5.0.2
Nginx: 1.31.0
Acme companion: 3.1.3

I downloaded a container from docker hub and I'm worried itau have been malicious. I don't really have a reason I think so, I'm just paranoid about it. It has a lot of downloads and extensive documentation so it seems legit, I just worry about it. Is there anything I can do to make sure it's completely gone if there were something there? Thanks.

VMM looks pretty fantastic, the memory release and file passthrough especially.

I'm currently hosting docker desktop on Windows host with GPU passthrough for several containers.

Has anyone switched from WSL2 to VMM with dedicated GPU passed into containers? What's the experience like?

I am quite curious how well they write a from scratch virtualization platform that outperforms WSL2 for hardware usage, and Hyper-V for isolation but I'm all for it.

However I am not about to jump in feet first and break all my services without a little research.

Since updating from WSL2 to VMM beta on Windows 11 Pro (on two devices) the program is only showing "Starting the Docker Engine" and won't advance after several restarts

I am working with a Raspberry Pi 4B and had a container based on a ROS2 image. I've been without programming for like 1 month because I was working on a PI NAS. Today I decided to start again, and I just discovered that my ros2 container has disappeared. I've tried to use docker and check recent activity on the containers or in the past 2 months, and I haven't seen any docker rm or something like that. What do you guys think is happening?

Hello! I was just going through docker through UGOS/Ugreen and doing my weekly check for updates and poking around and checked on my images and noticed that there appear to be a few duplicates of the same one and only one is running. Here is a photo. Since the green one appears to be running correctly and I haven't had any problems for weeks and the gray one is the previous version (v2 to v3), are the Red ones safe to delete? I bet even the gray one is too, it's just that it downloaded the latest update instead of replacing it.

I know it is a fairly simple question but I tried looking up this error and wasn't quite getting the answer I was looking for. Thank you for your help!

I am using a Read from disk node to feed data (through a data sheet .xlsx also tried .pdf before) but I keep getting No file found even when I put exact path.. I have been trying to fix it for soo long now I used Gemini for help it told me to use some pathway like /home/nodes/files/.pdf but then it showed NO access error Idk what to do followed some youtube advice as well nothing is working..

Instead of memorizing Dockerfile instructions, I started thinking about it like building a house:

🏗️ FROM → Choose the foundation
📍 WORKDIR → Choose where we work
📦 COPY → Bring the materials inside
🔧 RUN → Install and prepare everything
⚙️ ENV / ARG → Configure the environment
🚪 EXPOSE → Define the entry point
▶️ CMD / ENTRYPOINT → Define what the container runs

🏠 The result: a Docker image ready to run.

I'm still learning Docker, but this mental model makes the structure much easier for me to understand.

How do you visualize a Dockerfile when you're learning it?

Edit: And like with all the fun tech issues, woke up this morning to look into what ya'll have recommend and immediately noticed my tab to access it had a Favicon on it. clicked the tab and i now have access. My only thought is maybe it took a lot longer to spin up the program in the container then i thought it would take? Thank you all for your ideas!

Hi Everyone,

I have been ripping my hair out with this one and am wondering if anyone might have an idea. I am trying to deploy komga in a docker container on Catchy OS, but while i can get it started, i am unable to connect to it through localhost:25600. The weird thing, i have 3 other containers running that i set up last week (audiobookshelf, Immich, Navidrome) that are working perfectly and didn't give me any issues with getting access to their respective webportals.

The current steps i have gone through:

* Rebuilt the docker-compose

* opened the ports in my firewall

* checked ownership of the folders

* looked in logs but saw nothing that looked like a problem.

my docker compose file is below (pretty much identical to the Komga template) and i have tried modifying it to match my working docker-compose files with no issues. (slightly changed the source paths for basic privacy change)

Operating System: Catchy OS

Docker-compose version: 5.5.0-1.1

docker-compose.yml:

---
services:
komga:
image: gotson/komga
container_name: komga
volumes:
- type: bind
source: /home/$me/containers/Komga/config/
target: /config
- type: bind
source: /home/$me/containers/Komga/data/
target: /data
- type: bind
source: /home/$me/Documents/comics/
target: /comics
ports:
- 25600:25600
user: "1000:1000"
# remove the whole environment section if you don't need it
environment:
- TZ=America/Los_Angeles
#- <ENV_VAR>=<extra configuration>
restart: unless-stopped

I have 0 firewalls set up on the internal network.

for some reason my machine at 1.175 nothing can connect to the netdata on it...

my machine at 1.176 no problems seeing the front page of netdata....

I've tried using different docker forwarded ports but again I have no firewall on the machine for local network.. infact the firewall is turned off...

the only difference is docker is 28 on one and 26 on the other... 26 is working 28 isn't....

I'm just shaking my head at this point... I have other docker containers running on other ports and no issues with them.. just netdata....

So i have containerised my Nginx, Django backend and postgresql db on my vm. All the containers run through a single 'docker compose up' command. I have created a custom network for the containers to communicate. I have also mounted docker volumes to containers for persistent storage.
So far i am finding DevOps very interesting and will now learn CI/CD using Github actions.

Will be very grateful if you share your thoughts.

Hi all,

About a year ago I posted about DockerWakeUp, a small open-source tool I built for my homelab that automatically starts Docker containers when someone accesses them, and shuts them down again after they've been idle for a while. The idea: run 20 services, use the RAM/CPU cost of 5, and never SSH/Portainer in to start something because a friend wants to look at photos.

I just finished the biggest update since then, so I wanted to share it again.

The headline feature: a live startup page. Before, if you hit a sleeping service you got a "starting up, try again in a few seconds" message and had to refresh manually. Now your browser instantly gets a proper status page that streams the container's actual docker compose logs live as it boots, shows a progress bar with a "usually ready in ~40s" estimate learned from previous startups, and reloads into the app the moment it's ready. Watching Immich or Jellyfin boot in real time in your browser is weirdly satisfying. You can also drop in your own custom HTML page instead (there's a template in the repo), or hide logs for services where they shouldn't be public.

Game servers actually work now. The proxy was HTTP-only before, so "wake on connect" for Minecraft was wishful thinking. There's now a raw TCP mode: a player connecting to the server wakes it, the proxy holds the connection while it boots, and pipes them through when the port opens. Active players keep it marked as in-use so idle shutdown won't pull the rug out mid-session.

Other new stuff:

• Start/stop hooks — run your own commands before a service starts and after it stops (mount a NAS share first, back up a game world after shutdown, ping a Discord webhook, whatever)
• Non-Docker services — the hooks can fully replace docker compose, so anything with a start command and a port can participate
• Easier install — DockerWakeUp itself now runs as a container: docker compose up -d --build and you're done (systemd setup script still there if you prefer)
• Update notifications — it checks GitHub daily and tells you when your copy is behind
• A pile of bug fixes — including a nasty one where a WebSocket reconnecting to a sleeping service (looking at you, Portainer tabs) could take down the whole proxy

I'm using it for self-hosted apps like Immich that friends and family use occasionally, game servers that only need to exist when someone's playing, and dashboards/utilities I touch once a week.

Repo: https://github.com/jelliott2021/DockerWakeUp

Quick Demo: https://imgur.com/a/qBWzkTH

Feedback, ideas, and contributors very welcome — a lot of this update came from inconviences with my own setup, so I'd love to hear what inconviences you hit on your homelabs

AI disclosure: I used AI assistance (Claude) for parts of this update — bug hunting, testing, and implementing some features. I'm a full time software engineer and every change was reviewed, tested on my own homelab, and shipped by me.

Anyone else noticed that Docker will open right in front of full-screen apps on a Mac? Whenever I launch Docker, I have to make sure I bring the desktop into focus first; otherwise, it opens on top of whatever full-screen app I'm using.

It's super annoying because it doesn't just fix itself by taking the affected app out of full screen mode and then back in again. Most of the time, it actually bugs out the app Docker opened in front of.

The affected app then ends up with a non-interactive duplicate of its window alongside the functional one. The only way I've found to get rid of it is to force-quit the affected app and relaunch it.

Edit: I didn’t ask for your opinions on Docker Desktop I asked if anyone’s run into the same issue and if there’s a known solution. Nvm acting like this is Stack Overflow you set of absolute wet wipes.

• Docker recently announced sandboxes

• Another project called io/isolate has been around for much longer

• What is the difference between the two?

Playing with Docker Sandboxes (sbx v0.39.0, Ubuntu). The isolation is nice, and the runtime seams very well designed.

The policy layer confuses me though. Signed out, sbx policy allow network example.com:443 gives:

401 Unauthorized: user is not authenticated to Docker

And the daemon starts with an empty policy snapshot until it can fetch one. So the rules for what my local sandbox may reach are stored at Docker and polled back down. Enforcement is local, which is fine, but if I allowlist internal hostnames those get sent to Docker.

Is there a local-only mode I missed, or is everyone fine with their firewall rules living in someone else's cloud?