---
title: "Docker"
description: "84 posts about Docker, summarised, each linking to the original."
---

# Docker
> 84 posts about Docker, summarised, each linking to the original.

## Articles

### [Running Apache Kafka on Kubernetes at Shopify](https://yomu.fyi/post/running-apache-kafka-on-kubernetes-at-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Sam Obeid
- Published: Nov 7, 2018
- Type: Explainer

Shopify adopted Apache Kafka in 2014 as a data bus for reliable messaging, initially collecting events and aggregating logs, then expanded to multi-tenant regional and aggregate clusters delivering billions of messages daily. In 2017, it migrated Kafka infrastructure from data centers to the cloud with zero downtime by mirroring regional data to both aggregate clusters before moving producers and consumers to cloud clusters. Shopify chose Kubernetes over GCP virtual machines because StatefulSets provide ordered, graceful deployment and scaling, while Custom Resources and Controllers support cluster-specific automation. The implementation uses self-built Kafka images in an own registry, persistent volumes, node and inter-pod affinity controls, taints, rack-awareness across zones, readiness probes, and resource-monitoring sidecars to limit restart and availability risks. The migration completed successfully, and Shopify now runs multiple regional clusters plus an aggregate cluster that mirrors data for the data warehouse.


### [Shopify’s Infrastructure Collaboration with Google](https://yomu.fyi/post/shopify-s-infrastructure-collaboration-with-google.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Dale Neufeld
- Published: Mar 26, 2018
- Type: Announcement

Shopify announces that it is building its Cloud with Google after more than a decade of operating the foundation of its commerce cloud through its own data centers and incremental public-cloud adoption. Its infrastructure evolved from database and application sharding, performance testing, automated failovers, and Docker-based immutable infrastructure toward Kubernetes orchestration, after the company initially built minimal container-management features itself. During the migration, Shopify created Shop Mover, a selective database migration tool that rebalances shops between shards with an average of 2.5s downtime per shop, and moved more than 50% of data-center workloads to Google Cloud. It also grew to more than 400 production services, consolidated them on Kubernetes through a platform-as-a-service, and contributed to and used Grafeas for software supply-chain auditing and governance.


### [A House of Cards: An Exploration of Security When Building Docker Containers](https://yomu.fyi/post/a-house-of-cards-an-exploration-of-security-when-building-docker-conta.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Etienne Stalmans
- Published: Mar 8, 2018
- Type: Incident / postmortem

The post examines how a Docker-based, multi-tenant build environment can expose untrusted code when layered isolation is misconfigured. It traces a setup using AWS CodeBuild, Docker-in-Docker, and per-step build containers, then tests directory traversal through configurable Dockerfile paths before focusing on daemon networking. The vulnerability comes from starting dockerd with tcp://0.0.0.0:2375 and placing containers on a shared default network; build code can reach the daemon, issue Docker commands, mount the host filesystem, and retrieve container-managed AWS credentials. The excerpt reports a reverse shell, access to the CodeBuild filesystem, and temporary credentials whose impact depends on IAM permissions, while noting that the build must remain alive. The stated fix is to remove the TCP listener and retain the mapped Unix socket.


### [Deep Dive into Database Timeouts in Rails](https://yomu.fyi/post/deep-dive-into-database-timeouts-in-rails.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Jia Hao Goh
- Published: Jan 29, 2018
- Type: Explainer

Following a production outage where a database failover caused a Ruby on Rails application to exhaust its Puma server threads, an investigation was conducted to understand how ActiveRecord and MySQL timeout settings behave. A reproduction environment using Docker, Puma, and Toxiproxy replicated how hanging requests to a failing database consume all available server threads, ultimately starving unrelated endpoints. The analysis breaks down ActiveRecord connection pooling mechanics alongside underlying mysql2 and libmysqlclient settings, specifically checkout\_timeout, connect\_timeout, and read\_timeout. Testing confirmed how existing and new TCP connections transition through socket states during network interruptions while waiting on configured timeout intervals.


[Newer posts](https://yomu.fyi/topic/docker/page/4.md)