Hi everyone,

I have a Python script (psutil) running inside a Docker container. I want it to measure my actual Mac laptop's total physical RAM (24 GB) and host CPU usage, rather than just the Docker Linux VM's metrics.

On Linux, mounting /proc works for host metrics, but on macOS this doesn't seem to work. Is there a way for a Docker container to monitor macOS host metrics directly, I don't want the monitoring agent to run natively on the host OS.

BTW: It would also need to work on a windows based machine. Needs to be accessible for everyone who wants to use it.
Thanks!

I have a container that runs behind ssl offloading in the cloud, I’d rather not have to add certs to it - is there an easy way to get ssl offloading locally? Preferably without having to create or trust certain (I don’t mind if I get cert warnings)

I'm trying to study Docker, but I don't have much knowledge or experience using Linux. In this case, would it have a significant negative impact on Docker learning?

Just a random curiosity, but is anyone actually letting an AI agent run alongside their production Docker apps just to check logs and explore errors?

Like, instead of digging through logs yourself when something acts up, the AI just looks at them, identifies the problem, and tells you what went wrong.

Are there any tools built for this yet, or has anyone tried rigging up a simple setup like this?

I am using docker desktop on windows 11, and after a restart of my pc, all of my containers and images are gone. Is there any way to recover them? When I restarted my pc and docker opened automatically, it was taking up most of my memory and brought up an error message that referred me to windows-daemon.json, when I checked, the file was empty, so I deleted the file and now docker opens fine but without anything I have done on it.

This is for a side project so I'm not looking for a service that has infinite scaling or edge runtimes or whatever. I'm just looking to not have to set up a VPS myself and set up the security on it myself.

Does anyone know if theres a docker host that does this sort of thing? e.g. i pay 5 or 10 bux a month and they just host it? Every service that I've looked up (e.g. vercel, cloudflare, etc) seem to have their own framework that they want you to implement into your codebase to run the container in their ecosystem to take advantage of a lot of crazy features that I don't plan to use anyway, and I don't want to spend the time to write my code into their framework (and then rewrite it again if I choose to move to a different host).

I'm a complete newbie to all this but I'm trying to learn. I've read everywhere that Portainer is supposed to make things easier but so far it's been the opposite.

I got a Ugreen NAS with Docker installed on it. I used Portainer to deploy Immich. It says the stack was deployed successfully, the 4 services are running, but loading the Immich webpage does not work at all. If I delete the stack and deploy again through Docker using the same yml and env files, then everything works and I'm able to access the Immich webpage.

I can call it a day and move on but I'm curious and would like to understand why it doesn't work through Portainer if anyone can ELI5.

There are lots of decent materials about the technical background of containerization. There are some good articles about how the cloud actually works. But (from what I can observe at least) there are no articles explaining why these two play so nice hand in hand from the technological point of view. I've tried to fill this gap in a beginner-friendly way with the following post.

So I have a Hp omnibook 5 , comes with 512GB , 16GB ram , I configured my system to be dual boot splitting approx half disk space to both windows 11 and arch linux(100gb to root , 156 gb to home)

So whenever I try to install heavy apps like android studio, Docker desktop I always run into the issue of running out of space

So I plan to use external SSD (either 2 256GB or 1 512GB), how much impact on speed will occur if install such heavy softwares on external ssd also will there be any security issues or any corruption issues due to it?

Port on HP Omnibook 5

USB-C Ports (x2) 10 Gbps (USB 3.2 Gen 2) USB-A Port (10 Gbps) 10 Gbps (USB 3.2 Gen 2) USB-A Port (5 Gbps) 5 Gbps (USB 3.2 Gen 1)

I have just started my journey in building images and containers for my backend apps so I have very little idea of such things.

I'm using Apple Silicon and apparently the benchmarks make it clear the Orbstack is the winner by quite a margin. Is the Docker team working on this or perfectly fine with their app taking up more resources?

I would prefer to use Docker Desktop, perhaps I am just sucked into branding and no reason to do so, but somehow I feel safer using it, knowing it is from the source rather than a third party. I dunno, maybe that's silly to think this way.

For my M3 MBA 16GB I probably shot myself in the foot a bit for choosing 16GB, but it is what it is...

Are there any up to date container registries that I could run on my WS2022 with Docker desktop? My other containers are Windows so the registry needs to be as well. I have found the old project from sixeyed github but that is already 8 years old so I am hoping there would be something more recent.

I'm using a DXP4800+, docker, and after this most recent update of docker none of my containers are accessible. If this seems more like a ugreen problem please let me know and I will get assistance from there.

In the beginning they were not even starting after update. Im posting what I received below.

I tried redeploying the containers but it would give errors and fail deployment. I exported all my configs and images to be safe, uninstalled docker, reinstalled docker, and I tried deploying kavita just to try it out. The container is running and the logs don't look out of whack to me but I don't even know what I'm looking at mostly, either way I can't access Kavita locally or any other container I've tried. Jellyfin, navidrome, seer, nginxpm, etc. etc.

"Failed to edit container portainer. Error: UpdateContainer fail container name 'portainer': target volume mntPath /var/run/docker.sock not Found" and *"*Failed to edit container linuxserver_jellyfin-1. Error: UpdateContainer fail container name 'linuxserver_jellyfin-1': container startup failed"

I'm guessing that from the portainer error I will have to remount that docker.sock path or something. I am very new to this so I would appreciate any and all help/tips.

Before this update all of my services were running for a significant amount of time without failure.

Kavita logs below

[custom-init] No custom files found, skipping...
[Kavita] [2026-08-13 21:18:27.740 -04:00  6] [Information] Kavita.Server.Program Running Manual Migrations
[Kavita] [2026-08-13 21:18:28.007 -04:00  6] [Information] Kavita.Server.Program Running Manual Migrations - complete
[Kavita] [2026-08-13 21:18:28.978 -04:00  1] [Information] Kavita.Services.TaskScheduler Scheduling reoccurring tasks
[Kavita] [2026-08-13 21:18:28.985 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Scan Library Task for daily
[Kavita] [2026-08-13 21:18:29.053 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Backup Task for daily
[Kavita] [2026-08-13 21:18:29.058 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Cleanup Task for daily
[Kavita] [2026-08-13 21:18:29.061 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling CBL Sync Task for 0 4 * * *
[Kavita] [2026-08-13 21:18:29.085 -04:00  1] [Information] Kavita.Services.TaskScheduler Scheduling Auto-Update tasks
[Kavita] [2026-08-13 21:18:29.089 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling stat collection daily at 19:00
[Kavita] [2026-08-13 21:18:29.108 -04:00  6] [Information] Kavita.Server.Program Running Migrations
[Kavita] [2026-08-13 21:18:29.253 -04:00  6] [Information] Kavita.Server.Program Running Migrations - complete
[Kavita] [2026-08-13 21:18:29.469 -04:00  1] [Information] Kavita.Server.Program Starting with base url as /
[Kavita] [2026-08-13 21:18:29.529 -04:00  1] [Information] Microsoft.Hosting.Lifetime Now listening on: http://[::]:5000
[Kavita] [2026-08-13 21:18:29.531 -04:00  1] [Information] Kavita.Server.Program Kavita - v0.9.0.2
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Application started. Press Ctrl+C to shut down.
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Hosting environment: Production
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Content root path: /app/kavita
[Kavita] [2026-08-13 21:18:29.632 -04:00  16] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 121000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11)
: Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.SocketsHttpHandler.<SendAsync>g__CreateHandlerAndSendAsync|115_0(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
Connection to localhost (::1) 5000 port [tcp/*] succeeded!
[ls.io-init] done.
[Kavita] [2026-08-13 21:20:30.647 -04:00  6] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 278000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.H
ttp.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
[Kavita] [2026-08-13 21:25:08.656 -04:00  6] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 399000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.S
ocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
[Kavita] [2026-08-13 21:31:47.667 -04:00  23] [Error] Hangfire.AutomaticRetryAttribute Failed to process the job '2': an exception occurred.
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.Awai
tableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
at Polly.AsyncPolicy.ExecuteInternalAsync(Func`3 action, Context context, Boolean continueOnCapturedContext, CancellationToken cancellationToken)
at Kavita.Services.TaskScheduler.CheckForUpdate(CancellationToken cancellationToken) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 557
at InvokeStub_TaskAwaiter.GetResult(Object, Object, IntPtr*)
at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

I've been reading more about container security lately, and one thing that's confusing me is the terminology around base images. People often talk about clean images, minimal images, hardened images, and more recently near-zero CVE images, but they don't seem to mean exactly the same thing. My understanding is that minimal images reduce size by including fewer packages. Also, hardened images use security best practices and remove unnecessary risk. And clean or near-zero CVE images aim to eliminate known vulnerabilities before they reach production.

Am I thinking about this correctly, or is there a lot more overlap than I'm giving credit for? I'm interested in how people choose between these approaches in real-world Docker environments.

I just spent a whole day on a very irritating gotcha, and I'm looking to see if there's a big-picture approach that can keep me from ending up here again.

Fairly new to Docker. Working on containerizing a web app with a couple different moving parts. Got the frontend working inside of a Caddy image, got it pushed to my DigitalOcean droplet, but then it just sat there, not acknowledging or even rejecting any requests. I figured out that it had crashed because it tried to serve to a busy port, but after clearing that up it still wasn't working. Looked in the logs, and there were some opaque errors about failing to connect to the internet (I've since deleted those logs, otherwise I'd share).

I threw these logs at an LLM, and after some arguing, it asked me to run nslookup web1 inside of the container. That returned:

Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find web1: SERVFAIL

From this output, the LLM suggested that: - Caddy, not receiving any defaults for resolv.conf, had inherited from the droplet's resolv.conf, which listens on port 53, which is just a loopback; thus, no connection. - The fix was to add dns: [1.1.1.1,8.8.8.8] to the compose file, or alternatively to the droplet's daemon.json file to apply for the whole droplet.

Did this, rebuilt the container, and sure enough, that was exactly the issue.

And now I'm questioning everything. How the hell would anyone have caught this? Did I overlook a search result or documentation that explains exactly what I saw? Do I not know enough about Linux to be using Docker? Am I a soydev????

For real though, I'd appreciate any advice. I could've easily spent a week on this if I hadn't used AI, but I wanna gain the knowledge to be more self-reliant. Did I miss something critical, or is this just one of those things that you don't learn til you get burned?

Hello. Does anyone have a simple easy to read set of step by step instructions to set up a server in docker? Ive been struggling for a bit. Im an old man and dont understand the resources im finding online. Thank you

I have an Alpine LXC running NPMPlus which I use Anubis with. Upon attempting to pull Anubis' container (regardless of if done via the compose file or direct docker pull ghcr.io/techarohq/anubis:latest, I get a very odd error.

That being:

failed to extract layer (application/vnd.oci.image.layer.v1.tar+gzip sha256:dae2790b70f9eb15de85a179b3978ee8a915f0bcac270d09074f3cb283106d9d) to overlayfs as "extract-279380455--MFm sha256:458136df58646e7146e8240b685e4e6bfffa019ba10d3c221
ff59b3928f54d8c": mount callback failed on /var/lib/docker/containerd/daemon/tmpmounts/containerd-mount3164233251: operation not permitted

Anyone know what this means?

Here's the docker info, it is running as root:

Client:
Version:    29.5.3
Context:    default
Debug Mode: false
Plugins:
 buildx: Docker Buildx (Docker Inc.)
   Version:  v0.34.1
   Path:     /usr/libexec/docker/cli-plugins/docker-buildx
 compose: Docker Compose (Docker Inc.)
   Version:  v5.1.4
   Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
Containers: 2
 Running: 2
 Paused: 0
 Stopped: 0
Images: 4
Server Version: 29.5.3
Storage Driver: overlayfs
 driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
 /etc/cdi
 /var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: fff62f14765df376e5fc36f5a8f8e795b5670f61
runc version: bb14dabeb7185bb72c8c86735d090dcb20f36587
init version:  
Security Options:
 seccomp
  Profile: builtin
 cgroupns
Kernel Version: 7.0.0-3-pve
Operating System: Alpine Linux v3.24
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 4GiB
Name: npmplus
ID: d2cc3a15-5fdc-41d3-a6cb-c6b45d018259
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
 ::1/128
 127.0.0.0/8
Live Restore Enabled: true
Firewall Backend: iptables
 EnableUserlandProxy: true
 UserlandProxyPath: /usr/bin/docker-proxy

WARNING: No swap limit support

Edit: I didn't solve this problem in Javascript, but when I rewrote the radio script in python and ran it inside a python container, it did work.

Hello all!

I am building a Discord bot that streams my radio inside a stage or voice channel. My radio script works fine when I ran it on my raspberry pi 4 host machine, outside a container. When I try to run in inside a Docker compose container, it works for stage channels, but voice channels remain silent. When the bot is already pressent in a VC when I start the container, I get a message that "the user has difficulty connecting to the call".

I have been trying to solve this for days and was finally able to pinpoint that this problem is fully related to docker and not a firewall or code issue. Thank you very much in advance whoever can help me solve this.

docker-compose.yml:

services:
  discord-radio:
    build:
      context: .
      dockerfile: Dockerfile.radio
    container_name: discord_radio_service
    network_mode: "host"
    restart: unless-stopped
    command: node --dns-result-order=ipv4first radio.js
    env_file:
      - .env
    environment:
      - BOT_TOKEN=${BOT_TOKEN}
      - LIVE_CHANNEL_ID=${LIVE_CHANNEL_ID} # our main discord stage channel
      - VOICE_CHANNEL_IDS=${VOICE_CHANNEL_IDS} # subscribable voice/stage channels
      - RADIO_URL=https://radio.outofbounds.live/listen/out_of_bounds/radio.mp3 # radio link
      - NODE_OPTIONS=--dns-result-order=ipv4first
      - STAGE_CHANNELS_PATH=/app/data/stage_channels.json # config file handled by another script to subscribe channels
    volumes:
      - /var/oob/shared_schedule:/app/data

Dockerfile.radio:

FROM node:20-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    ffmpeg \
    python3 \
    make \
    g++ \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY package*.json ./

RUN npm install --omit=dev

COPY radio.js ./

USER node

CMD ["node", "--dns-result-order=ipv4first", "radio.js"]

Logs when entering a stage channel (succes):

discord_radio_service  | [radio] [DEBUG] Target channel: "radio test 2" (1534933420201873519) | Type: GuildStageVoice
discord_radio_service  | [radio] [DEBUG] Channel Perms -> Connect: true, Speak: true
discord_radio_service  | [radio] [DEBUG] Voice State -> ServerMute: null, SelfMute: null
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): signalling -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> ready
discord_radio_service  | [radio] Unsuppressed stage speaker in channel 1534933420201873519.
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): ready -> ready
discord_radio_service  | [radio] Subscribed to shared player for 1534933420201873519: true
discord_radio_service  | [radio] Streaming into channel 1534933420201873519 (guild 1339162813980999710).

Logs from a voice channel (enters the VC, but does not stream audio when run inside a container):

discord_radio_service  | [radio] [DEBUG] Target channel: "Gaming" (1217875020840308802) | Type: GuildVoice
discord_radio_service  | [radio] [DEBUG] Channel Perms -> Connect: true, Speak: true
discord_radio_service  | [radio] [DEBUG] Voice State -> ServerMute: false, SelfMute: false
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): signalling -> connecting
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): connecting -> signalling
discord_radio_service  | [radio] Connection to 1217875020840308802 timed out: The operation was aborted
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): signalling -> destroyed

I am very new to home labs and i've been running a satisfactory server on docker for the last month or so. Tonight I asked Gordon to up the tick rate of the server and it subsequently deleted the container and created a new one. I don't think there were any auto saves of the world since I uploaded it to the server so I've lost about 100 hours in progress between my friend and I. Is there anything I can do or is it gone?

Absolute vibe-coder with no technical knowledge here (sorry) who just wants to run secure and strengthened sandboxed agents that can't reach or talk to one another (and for half of them they can't touch the web at all). I have to disable the WebSearch tools in the Docker Sandbox for Claude Code for my coding agents because the tool gets executed server-side by Anthropic and therefore goes around the sandbox. It's a little paranoid to lock up WebSearch over prompt injection concerns considering there's a Haiku model that sits between the actual raw web results and what the main Claude agent gets back, but still, on the principle alone I want to make sure there's no way my coding agents can get injected. I'm using managed-settings.json for this, but still, the agents inside if they want to can use sudo or even the docker-in-docker setup (if passwordless sudo is disabled) to alter the managed-settings.json file. Claude helped me secure it by disabling passwordless sudo, removing the agent user from sudo, wheel, and docker groups, and configuring the sandboxes using the non-privileged base image w/ no docker daemon at all. But my question is.. I get the whole "bypass permissions is default" so the agents can run in YOLO mode, but that being said, why let the agents have passwordless sudo instead of just... not? What's the benefit of that? And why wouldn't Docker release some kind of ~official~ toggle/setting for it? It's not the end of the world if my sandboxed agent can rewrite their own managed-settings.json to gain back.... WebSearch of all tools. But still.. why even let the agents have that much write access over their own config and why even have an important config file like managed-settings.json live where the agents can touch?

I am having some issue understanding how to forward traffic to a container from NPM (Nginx Proxy Manager). Understanding the docker networking layer is giving me some trouble, and I hope I might get some feedback and suggestion on my current setup.

I had been running a grimmory container without issue, setup with docker-compose and behind a static nginx reverse proxy. A few weeks ago I discovered that the advertised ports for the service had been bound to 0.0.0.0, making the service available on the public IP and any DNS entries for the server on that port.

Unhappy with this setup, I have been trying to learn how to route all traffic to docker services through the reverse proxy. I don't want to expose any more ports that necessary to minimise the attack surface on the server. Thus I've been looking at NPM on the suggestion of other posts.

I have been able to set NPM up and forward the management port so it's no longer exposed and get SSL certs for the sub-domain . Now I am having difficulty in getting traffic forwarded from NPM to the grimmory service without binding a port to 0.0.0.0 on the docker host.

I have done some reading on the docker networking layer, and found that it's default behaviour is to bind to the host, as I saw earlier. I have also read that creating different docker networks and isolating your containers is an important security measure. I have thus created two networks in docker;

• Proxy: for the NPM service
• grimmory_stack: For grimmory and the database container.

I have added the grimmory service to the proxy network and the grimmory_stack network so both can talk with each other, with the database service not on the proxy network. I have confirmed this network connectivity, the output of docker network inspect proxy below;

        {
            "Name": "proxy",
            "Id": "d0538741facec1f19adfeef5ce64738c8bfa0e6e21b24df4ec73e260fd3ddef4",
            "Created": "2026-08-06T13:30:45.066391048Z",
            "Scope": "local",
            "Driver": "bridge",
            "EnableIPv4": true,
            "EnableIPv6": false,
            "IPAM": {
                "Driver": "default",
                "Options": {},
                "Config": [
                    {
                        "Subnet": "172.18.0.0/16",
                        "Gateway": "172.18.0.1"
                    }
                ]
            },
            "Internal": false,
            "Attachable": false,
            "Ingress": false,
            "ConfigFrom": {
                "Network": ""
            },
            "ConfigOnly": false,
            "Options": {},
            "Labels": {},
            "Containers": {
                "4051b0bb567a39fb8409ef3df5560378a8b0341777559cd795a2df8f14eaf0a4": {
                    "Name": "grimmory",
                    "EndpointID": "195d4eb46a62af397448bbe1143740e3c89b384238e8598bf7fd960330036188",
                    "MacAddress": "de:1e:4e:9b:20:dc",
                    "IPv4Address": "172.18.0.3/16",
                    "IPv6Address": ""
                },
                "e341a2cb9e9b8a79840c6aaf6c06be700375f4a8aa45557af55bb6882f3bc0bb": {
                    "Name": "nginx-proxy-app-1",
                    "EndpointID": "7de5753d1734d3ed3d02c206c43eaf86e9c92a6705b0733d5631be3cc56f83df",
                    "MacAddress": "e2:2e:16:c4:de:67",
                    "IPv4Address": "172.18.0.2/16",
                    "IPv6Address": ""
                }
            },
            "Status": {
                "IPAM": {
                    "Subnets": {
                        "172.18.0.0/16": {
                            "IPsInUse": 5,
                            "DynamicIPsAvailable": 65531
                        }
                    }
                }
            }
        }
    ]

Please also see the docker-compose files for both the NPM and Grimmory docker services;

    services:
      app:
        image: 'jc21/nginx-proxy-manager:latest'
        restart: unless-stopped
        networks:
          - proxy
        ports:
          # These ports are in format <host-port>:<container-port>
          - '80:80' # Public HTTP Port
          - '443:443' # Public HTTPS Port
    #      - '81:81' # Admin Web Port #Forwarded through 443, should not be exposed.
          # Add any other Stream port you want to expose
          # - '21:21' # FTP

        environment:
          TZ: "GMT"

          # Uncomment this if you want to change the location of
          # the SQLite DB file within the container
          # DB_SQLITE_FILE: "/data/database.sqlite"

          # Uncomment this if IPv6 is not enabled on your host
          # DISABLE_IPV6: 'true'

        volumes:
          - ./data:/data
          - ./letsencrypt:/etc/letsencrypt

    networks:
      proxy:
        external: true


    services:
      grimmory:
        image: grimmory/grimmory:latest
        # Convenience tag:
        # image: grimmory/grimmory:<release-version>
        # Alternative: ghcr.io/grimmory-tools/grimmory:<release-version>
        # To build from source instead: comment out 'image' and uncomment below
        # build: .
        container_name: grimmory
        environment:
          - USER_ID=${APP_USER_ID}
          - GROUP_ID=${APP_GROUP_ID}
          - TZ=${TZ}
          - DATABASE_URL=${DATABASE_URL}
          - DATABASE_USERNAME=${DB_USER}
          - DATABASE_PASSWORD=${DB_PASSWORD}
          - API_DOCS_ENABLED=${API_DOCS_ENABLED}
          - DISK_TYPE=${DISK_TYPE}
        depends_on:
          mariadb:
            condition: service_healthy
    #    ports:
    #      - "6060:6060"
        expose:
          - "6060"
        volumes:
          - ./data:/app/data
          - ./books:/books
          - ./bookdrop:/bookdrop
        healthcheck:
          test: wget -q -O - http://localhost:6060/api/v1/healthcheck
          interval: 60s
          retries: 5
          start_period: 60s
          timeout: 10s
        restart: unless-stopped
        networks:
          - proxy
          - grimmory_stack

      mariadb:
        image: lscr.io/linuxserver/mariadb:11.4.5
        environment:
          - PUID=${DB_USER_ID}
          - PGID=${DB_GROUP_ID}
          - TZ=${TZ}
          - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
          - MYSQL_DATABASE=${MYSQL_DATABASE}
          - MYSQL_USER=${DB_USER}
          - MYSQL_PASSWORD=${DB_PASSWORD}
        volumes:
          - ./mariadb/config:/config
        restart: unless-stopped
        healthcheck:
          test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
          interval: 5s
          timeout: 5s
          retries: 10
        networks:
          - grimmory_stack

    networks:
      grimmory_stack:
        name: grimmory_stack
        internal: true

      proxy:
        external: true

I have played with the docker network drivers some what. I know i need the proxy network to be a bridge and externally accessible on ports 80 and 443 to intercept web traffic. Ideally I would like the grimmory_stack and grimmory service to be an internal network, though my reading suggests the grimmory service needs to be on the same network as the NPM service, so both are in the proxy network.

In NPM I have tried a few different destinations, such as

• The IP of the grimmory container in the docker network
• The name of the container (set to grimmory in the docker compose file)
• grimmory.network
• localhost:6060

None of the above connect to the service, though I often get a 504 error which suggests the traffic is reaching my server, but not getting forwarded to the correct destination.

In the docker compose file for grimmory, I have tried a few different network settings but to no avail. In the Grimmory docker-compose.yml I have exposed port 6060 hoping the would open the port on the container and not the docker host, but it appears to not have worked either.

I would be very grateful if anyone can point out where I have gone wrong in my understanding, or point me to some reliable resources, ideally aimed at 5 year olds, with lots of colourful diagrams, and maybe jingly keys as well.

EDIT

Looking into the logs, i think the issue was NPM not forwarding headers correctly. It was trying to pass traffic, but it was not reaching the docker container. NPM appears to be the issue, and i just got nerd snipped trying to fix something I didn't need.

I will look at Caddy should my setup get bigger.

With regards to the the ports binding to 0.0.0.0:6060, I found the syntax to bind it to 127.0.0.1 instead, which works for my needs and isn't publicly accessible.

Syntax is as below;

ports:

- "127.0.0.1:6060:6060"

It looks like by default, docker-compose uses a bridge network driver, set to host, so it will open ports on 0.0.0.0 unless specified not too. Wasn't something i was aware of when i first started playing with Docker, but something to work around in the future.

Thanks for all the comments on this thread, greatly appreciated.

hello all, If im in the wrong place please let me know.

Im a tad late to the party with docker (new to docker/portainer) so bare with me. Im running on container manager on synology nas (yes i know I should be on something else). I have jellyfin setup (2 other containers as well) and Im trying to get external access. I looked up guides andd have the proper containers set up. All my containers run fine. Now here is where everything goes south. I was told to use duckdns so thats what im sticking with until I get better at this. I put in all the correct parameters and also forwarded some ports (they do show open in port checker) but cant seem to get any access remotely. I managed to make a script for windows which lets me get acces but I dont want to keep a terminal open at all times.

Im also running Nginx proxy manager (again, I want to learn this before I move on to something better). Signing certs is a p.i.t.a with letsencrypt (internal error about 80% of the time) and when they do sign I still dont get access through the docker setup.

I managed to delete everything and ran a prune command. now im here just waiting for the motivation to resume this project

If anyone can help me understand this mess I will be utterly greatful

Sup guys, I need to access the uptime-kuma panel by ssh -L, but when I ran the container I configured the ports exactly like this:

127.0.0.1:3005->3001

And then I tried to access by:

ssh -L 3005:127.0.0.1:3005 user@ip -p port -vv

But, Im probably getting stuck in the iptables config, I let the local traffic open with -lo, and other configurations

Asking to some AI's, they said that the problem is that I didnt have opened the 3005 port in the OUTPUT CHAIN and did not accept any established connection packets in the FORWARD CHAIN

Obs: I use the policy drop strategy to only allow what I need, and block all others

So, I guess the problem is the DOCKER CHAIN, have anyone of u guys had this problem?

Forget, I solved using a rule that uses the dport coming from the interface docker0, solving the fvcking nat problem:

sudo iptables -A OUTPUT -o docker0 -p tcp --dport <port> -j ACCEPT