Tag: containers

Run a WireGuard VPN server in Docker with the linuxserver image — Compose setup, peer config generation, and road warrior access to your home network.

Run WordPress on PHP-FPM with Caddy as the web server — all in Docker Compose with automatic HTTPS and proper PHP config.

PID 1 zombie reaping in containers — tini, dumb-init, and docker --init compared; when each one fixes your signal handling and stops your 10s shutdown tax.

Containers are not VMs. Here are the real escape vectors — privileged mode, mounted sockets, kernel CVEs — and the runtime hardening that actually helps.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

The CRI runtime under your Kubernetes cluster — cri-o vs containerd compared on footprint, distros, performance, and day-2 operability.

nerdctl is the containerd-native docker CLI replacement — when it's a drop-in, when it's not, and why you'd bother switching at all.

Containers aren't security boundaries — Sysbox, gVisor, and Kata fix that. Here's which isolation runtime fits your actual threat model.

Trivy, Grype, and Docker Scout go head-to-head on speed, CVE coverage, CI integration, and cost. Pick the right scanner for your home lab or pipeline.

Docker Desktop got expensive and RAM-hungry. Colima is the lean alternative. OrbStack is the one everyone's actually using now. Here's the honest breakdown for Mac developers.

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.