How Caddy Serves a Static Site: The Request Flow
See how Caddy handles a request for a static site, from DNS resolution through container routing to file_server, and how TLS and redirects fit into the flow.
Loading…
Topic
Docker
84 posts about Docker. Every summary links to the original.
- 84 posts
- 13 companies
- 3 explainers
See the idea
Docker explainers
Anka CI Architecture: From Layered Images to Disposable macOS Builds
Anka is a Docker-like macOS virtualization layer for disposable CI environments. This architecture shows how images, Mac hosts, snapshots, build agents, and artifacts connect.
How Alpine Linux Reduces Container Size
Alpine Linux shrinks container images by replacing glibc with musl and using a minimal base, but introduces compatibility trade-offs you must evaluate before switching.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
A local Supabase project per agent, with or without Docker
The Supabase CLI v2.119.0 introduces an experimental native runtime that runs all 13 services as plain processes without Docker, reducing startup time by over 80% and idle memory by 89%. It also supports multiple local projects on one machine via git worktrees, each with its own Postgres, Storage, Edge Functions, and MCP server on auto-assigned ports. This allows each coding agent to have an independent database to reset and test against without affecting others, making a project per worktree practical on a laptop. Remote branches now inherit configuration from their base project and are ready nearly five times faster, with function bundles copied in parallel. The native runtime runs on Linux and macOS, and Docker remains the default when present, but the CLI automatically selects native when Docker is absent.
From Dockerfile to Kit: the Docker Sandboxes Kit Specification
The Docker Sandbox Kit Specification v3 defines how an agent declares the networks, credentials, and volumes it needs, so these grants travel with the artifact rather than living in shell history or dashboards. A Kit is an ordinary OCI image whose manifest carries a descriptor annotation vnd.docker.sandbox.kit.descriptor, so it builds with docker buildx, pulls with docker pull, and gets scanned and signed by existing tooling. Capability types like network-policy@2 and credential@1 are versioned independently, and each normative statement in the specification is covered by a conformance check or a written waiver. Two Kit types exist: a workload supplies the root filesystem, while a mixin adds overlays such as a CLI with its network rule; the runtime rejects required capabilities it cannot satisfy. Composition uses strict provides/requires resolution, so authority changes appear as diffs, and a conforming runtime can gate upgrades that widen the grant set.
Your diff has a demo now with Junie /demo
Junie /demo adds a mode to Junie CLI that builds and launches an application, drives its UI, and records a requested check. It produces an HTML report, screenshots, and video, while leaving reviewers able to inspect steps, outcomes, and evidence. In the example, a prompt selects two issues, marks them Done, checks counter changes, reloads the page, and verifies persistence. Initial setup analyzes the repository and generates configuration after a confirmed build and launch plan; Docker-based environments can use custom templates for complex repositories. The mode also supports GitHub Actions workflows for pull-request demonstrations and release smoke tests, but an explicit PASS verdict is required for a scenario to pass.
Logpoints Walkthrough
Logpoints in IntelliJ IDEA provide a way to inspect a running Java process without suspending it, making them useful when println logging or regular breakpoints would be disruptive. The walkthrough uses a Dockerized gRPC client and server whose incorrect tenant discount is traced by attaching to the server and adding expressions at runtime, without rebuilding or redeploying. Progressive logging shows the tenant value as JetBrains while the expected value is jetbrains, and the correct-discount block is never entered; the supplied fix uses equalsIgnoreCase and returns 2,000 basis points. The article also demonstrates testing changes through logpoint side effects, extending gRPC deadlines selectively, logging in dependencies, and using the ij-debugger AI agent skill. IntelliJ IDEA 2026.2 adds faster placement and instrumentation that removes debugger-introduced overhead, although heavy expressions still execute in the VM.
Scaling Federated Learning Across Docker, Kubernetes, and Slurm with NVIDIA FLARE
NVIDIA FLARE addresses the operational challenge of running federated learning across sites that use different infrastructure, including Docker, Kubernetes, and Slurm. Its two-layer architecture keeps long-running server and client parent processes available for authentication and coordination while launching transient job workers through each site’s native runtime. Jobs declare portable GPU, CPU, and host-memory requirements, which local launchers translate into Docker containers, Kubernetes pods, or Slurm allocations; studies add scoped membership and site-owned mappings for datasets, images, secrets, and scheduling policy. The result is a heterogeneous federation where organizations retain local resource authority, can allocate compute on demand, and run multiple studies without requiring one shared platform.
Scale AV Perception Across Vehicle Platforms with NVIDIA Omniverse NuRec
Autonomous-driving perception changes when the same software moves across carlines because sensor placement, calibration, fields of view, occlusions, geometry, timing, and coverage change. The post presents NVIDIA Omniverse NuRec as a way to adapt a stack before a complete target-carline dataset exists, while retaining real-world data for grounding and validation. NuRec reconstructs recorded drives with 3D Gaussian splatting, renders novel views through a target rig with configurable camera models and calibration, and preserves trajectories, annotations, and map data for label adaptation. The workflow pairs a reconstructed scene with a rig, renders target views, refines frames with NVIDIA Harmonizer, and trains a perception model on the output. It also documents containerized rendering and auxiliary-data generation, including semantic masks, metric depth, and ego-vehicle masks, while noting that views outside observed coverage may be lower quality.
Building hermetic notebook images for Open Data Hub and Red Hat OpenShift AI
Open Data Hub and Red Hat OpenShift AI adopted hermetic container builds to eliminate network failures, satisfy Conforma compliance, and ensure reproducible notebook environments. Instead of pulling packages during image creation, dependencies are pinned in lockfiles, prefetched into a local cache using tools like Cachi2, and installed with the network disabled. The workflow relies on a unified Containerfile capable of running locally, within GitHub Actions, and on Konflux via Tekton tasks. To pass audit checks and avoid generic tarball downloads, the team packaged awkward binaries like ripgrep and Pandoc into multi-arch Python wheels while patching Node postinstall scripts that fetch files at install time. Upstream CentOS and downstream Red Hat Enterprise Linux dependencies are maintained in distinct lock trees to prevent subtle packaging mismatches.
Running AI agents in GitHub Actions with Docker Sandboxes
GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.
Red Hat Ansible development workspaces for governed automation content creation
Ansible development workspaces in Red Hat Ansible Automation Platform leverage Red Hat OpenShift Dev Spaces to solve environment drift and lengthy developer onboarding. Instead of configuring local environments, developers access cloud-hosted VS Code instances via a web browser using declarative devfile.yaml configurations. The platform enforces immutability with a read-only /var directory at runtime, preventing arbitrary package installations that cause configuration drift. To address differing domain requirements across teams without creating bloated monolithic images, the solution implements a four-tiered image strategy based on OpenShift BuildConfigs and ImageStreams. When base container images receive security patches, the dependent image layers automatically rebuild throughout the entire chain.
17,600 Actions: Agent Security Is a Systems Problem
Security incidents involving AI agents, such as the OpenAI and Hugging Face event where attackers executed 17,600 actions, demonstrate that system security cannot rely entirely on manual human review. Managing agent velocity requires dedicated system-level controls to properly constrain, observe, and govern their behaviors during execution. To secure autonomous development workflows, Docker Sandboxes allow AI agents to operate within GitHub Actions, run Testcontainers tests, adjust code, and automatically generate draft pull requests inside isolated environments. In addition, escalating software supply-chain threats and the increased volume of AI-generated code drive the adoption of Docker Hardened Images and Docker Extended Lifecycle Support. These updates incorporate software built from source into container images, extend security patch coverage past end-of-life milestones, and move organizational policy enforcement directly onto developer machines.
Coding Agent Horror Stories: The Command You Already Approved
The OpenAI and Hugging Face security incident involved 17,600 attacker actions, demonstrating that AI agent security cannot rely exclusively on manual human review. Modern development workflows require systems controls to constrain, observe, and govern autonomous agents operating at high speeds. To address related isolation and automation requirements, developers can run AI agents inside GitHub Actions using Docker Sandboxes to execute Testcontainers tests, fix code, and generate draft pull requests. In addition, Docker Extended Lifecycle Support provides continued security coverage past software end of life while moving policy enforcement directly to developer workstations. Finally, Docker Hub has transitioned Docker Verified Publisher applications to a self-serve model, enabling publishers to distribute verified content directly to developers.
The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense
A research report by Omdia examines escalating software supply chain security risks driven by growing dependencies on third-party code, open-source software, and artificial intelligence. Over three-fourths of surveyed organizations experienced a software supply chain incident in the preceding year, with known vulnerabilities in third-party software representing the most common exploit vector. Surveyed respondents ranked AI technology as their top supply chain concern, alongside broader issues involving vulnerability remediation and code composition identification. While shifting security left is a high priority for 98% of organizations, 45% still lack confidence in the robustness of their supply chain defenses. Although secure container libraries and Software Bills of Materials provide measurable mitigation benefits, many organizations only generate inventories on a case-by-case basis.
NVIDIA Video Codec SDK 13.1: Zero-Copy Transcode, AV1 B-Frames, and Frame-Accurate Seek
Modern video pipelines require higher efficiency and support for complex workloads across streaming, collaboration, and artificial intelligence media tools. NVIDIA released Video Codec SDK 13.1 to expand GPU-accelerated encoding, decoding, and transcoding capabilities. The release introduces Hierarchical Reference Mode for AV1 with up to 31 B-frames, combines UHQ tuning with iterative encoding, and extracts per-macroblock decode statistics for H.264 and HEVC without CPU overhead. It also implements frame-accurate, GOP-aware seeking through the NvVideoDecoder class and adds stereoscopic MV-HEVC decode metadata. To simplify setup across different environments, the update delivers an official multi-stage Docker container pinned to Ubuntu 22.04 LTS, CUDA 12.3.2, and Vulkan SDK.
Four Ways to Deploy More Secure AI Agents
Connecting large language models to live tools and enterprise systems introduces severe security vulnerabilities across multiple deployment harnesses. Over six months of evaluations, the NVIDIA AI Red Team identified recurring failures in AI agents, including missing access controls, arbitrary code execution via shell or file-write tools, unrestricted network egress, and exposed plaintext credentials. Mitigations operating in the same control plane as the model, such as system prompts or LLM-as-a-judge review agents, consistently fail against adversarial manipulation. Securing agentic deployments instead requires deterministic, architectural controls enforced outside the model control plane. Effective defenses include authenticating users, isolating command execution inside hardened sandboxes, blocking network egress by default, and delivering ephemeral secrets via external managers.
The Future of Agentic AI Depends on Openness and Trust. That’s Why Docker Is Joining Nvidia’s Open Secure AI Alliance.
Modern discussions surrounding agentic AI increasingly center on whether autonomous systems can be trusted and securely placed at the core of enterprise workflows. While intelligence is generated by underlying models, operational trust depends on the surrounding execution runtime, identity frameworks, governance models, and security boundaries. To address these challenges across an open ecosystem, Docker has joined NVIDIA's Open Secure AI Alliance. This initiative aims to ensure developers can seamlessly route tasks between open-weight and frontier models without rewriting their application architectures or sacrificing control. By extending security and governance into the agent execution environment, the alliance seeks to deliver predictable control as AI agents become fundamental components of software stacks.
How to Self-Host a Validated AI Coding Assistant with NVIDIA NeMo Guardrails
Deploying AI coding assistants in regulated or sovereign environments presents risks around data privacy, hallucinated dependencies, and auditability. This tutorial outlines a self-hosted architecture deploying StarCoder2-7B as an NVIDIA NIM endpoint served entirely from local GPUs. NVIDIA NeMo Guardrails sits as an OpenAI-compatible proxy between developer IDEs and the model to intercept and reject requests for restricted or human-only code paths. Downstream CI gates catch package hallucinations and verify changes, while commit trailers and a Prometheus and Grafana metrics loop monitor defect escape rates. Because the model remains distinct from the external policy and validation layers, teams can incrementally adopt components or upgrade models without rearchitecting the pipeline.
Coding Agent Horror Stories: The 29 Million Secret Problem
Compromised versions of the Nx npm package, dubbed the s1ngularity campaign, used a post-install hook to repurpose installed AI coding agents as credential scanners. Because AI command-line interfaces often run with the developer's full user permissions, the malware invoked tools such as Claude Code, Gemini CLI, and Amazon Q with permission-bypass flags to map sensitive files. GitGuardian findings indicate that AI-assisted code leaks secrets at roughly twice the baseline rate, largely because models ingest live credentials into working contexts. Docker Sandboxes addresses this risk by restricting the execution environment to the project workspace and keeping actual credentials on the host. When sandboxed with sbx, agents receive sentinel placeholders, while an egress proxy injects real secrets into outgoing network requests.
Coding Agent Horror Stories: The Agent That Deleted Production
Recent industry updates focus on AI agent security, container maintenance, and developer workflows within Docker ecosystems. The OpenAI and Hugging Face incident involved 17,600 attacker actions, demonstrating that AI agent security requires automated system controls to constrain, observe, and govern agents rather than relying on human review. In software maintenance, Docker Extended Lifecycle Support (ELS) addresses escalating supply-chain risks and MinIO end of life by maintaining patches, building software from source, and enforcing local developer policies. For continuous integration, Docker Sandboxes enable isolated AI agents to run Testcontainers tests, implement code fixes, and submit draft pull requests within GitHub Actions. Additionally, Docker Verified Publisher applications have transitioned to a self-serve process accessible directly through Docker Hub.
AI Agents Explained: How to Build with Them Safely
AI agents combine reasoning models, external tools, memory, orchestration, and execution environments to autonomously pursue goals across iterative perceive-reason-act loops. While simple chatbots only generate text responses to direct prompts, autonomous agents execute multi-step operations such as querying databases, modifying codebases, and executing shell commands without requiring continuous manual approvals. However, this unchecked operational autonomy significantly widens the blast radius when models encounter logic errors or vague instructions, risking destructive filesystem operations and credential leaks. Safe deployment requires shifting focus from model-level guardrails to infrastructure-level containment strategies, such as scoping tool access and isolating execution inside disposable microVM sandboxes. Controlling networking boundaries, file access, and credential exposure ensures teams achieve automated execution velocity without exposing developer host environments to uncontained systemic risk.
Post-Train NVIDIA Cosmos 3 in One Day Using Agent Skills
Adapting vision reasoning models for specialized physical AI video tasks often demands days of manual container configuration, training script authoring, and hyperparameter tuning. NVIDIA Cosmos 3 Nano, an omnimodal mixture-of-transformers model, pairs an autoregressive Reasoner tower with an iterative diffusion Generator tower for video question answering. By integrating NVIDIA TAO agent skills with a coding agent like Codex, developers can automate data patching, evaluation, and Low-Rank Adaptation (LoRA) post-training. In experiments using the Woven Traffic Safety dataset, LoRA fine-tuning boosted zero-shot baseline accuracy from 54.41% to 87.14% while using approximately seven times fewer GPU hours than full-parameter supervised fine-tuning. Combining this agent workflow with TAO AutoML further elevated model accuracy to 93.35% before automated deployment via NVIDIA NIM.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.