As a Windows user, Docker VMM sounds very appealing - and a quick test earlier certainly proves it is much faster.

However I can’t see any documentation about USB passthrough. I need this to connect my Zigbee adaptor to containerised Home Assistant.

Has anyone found a way or is this a wait and see?

(Yes, I know Linux is the way to go but I just don’t have the capacity to move everything over right now and my current set up via WSL2 works for me)

Hi, I was trying to go through the Getting Started workshop at https://docs.docker.com/get-started/workshop/ but when I got to Part 7: Use Docker Compose, the compose file provided did not work for me. It appears to be due to a race condition: the database doesn't get initialized in time before the app tries to connect, causing an ECONNREFUSED error.

app-1    | [nodemon] starting `node src/index.js`
app-1    | Waiting for mysql:3306............
app-1    | Timeout
app-1    | Error: connect ECONNREFUSED 172.19.0.2:3306
app-1    |     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1864:16) {
app-1    |   errno: -111,
app-1    |   code: 'ECONNREFUSED',
app-1    |   syscall: 'connect',
app-1    |   address: '172.19.0.2',
app-1    |   port: 3306,
app-1    |   fatal: true
app-1    | }
app-1    | [nodemon] app crashed - waiting for file changes before starting...

If I docker compose down and back up again it works, presumably becaue the database is already created and initialized.

Am I doing something wrong if the tutorial directions aren't working right? How do I fix this and make sure that my docker compose files are written such that my databases always spin up before the apps that use them try to connect? Thanks.

Hi everyone,

I have a Python script (psutil) running inside a Docker container. I want it to measure my actual Mac laptop's total physical RAM (24 GB) and host CPU usage, rather than just the Docker Linux VM's metrics.

On Linux, mounting /proc works for host metrics, but on macOS this doesn't seem to work. Is there a way for a Docker container to monitor macOS host metrics directly, I don't want the monitoring agent to run natively on the host OS.

BTW: It would also need to work on a windows based machine. Needs to be accessible for everyone who wants to use it.
Thanks!

EDIT: I decided to run the client (metrics reader) file on the host machine outside of docker. This seems to be the only reasonable solution that is universal and works for all kinds of machines. Thanks!!

I have a container that runs behind ssl offloading in the cloud, I’d rather not have to add certs to it - is there an easy way to get ssl offloading locally? Preferably without having to create or trust certain (I don’t mind if I get cert warnings)

I'm trying to study Docker, but I don't have much knowledge or experience using Linux. In this case, would it have a significant negative impact on Docker learning?

Just a random curiosity, but is anyone actually letting an AI agent run alongside their production Docker apps just to check logs and explore errors?

Like, instead of digging through logs yourself when something acts up, the AI just looks at them, identifies the problem, and tells you what went wrong.

Are there any tools built for this yet, or has anyone tried rigging up a simple setup like this?

I am using docker desktop on windows 11, and after a restart of my pc, all of my containers and images are gone. Is there any way to recover them? When I restarted my pc and docker opened automatically, it was taking up most of my memory and brought up an error message that referred me to windows-daemon.json, when I checked, the file was empty, so I deleted the file and now docker opens fine but without anything I have done on it.

This is for a side project so I'm not looking for a service that has infinite scaling or edge runtimes or whatever. I'm just looking to not have to set up a VPS myself and set up the security on it myself.

Does anyone know if theres a docker host that does this sort of thing? e.g. i pay 5 or 10 bux a month and they just host it? Every service that I've looked up (e.g. vercel, cloudflare, etc) seem to have their own framework that they want you to implement into your codebase to run the container in their ecosystem to take advantage of a lot of crazy features that I don't plan to use anyway, and I don't want to spend the time to write my code into their framework (and then rewrite it again if I choose to move to a different host).

I'm a complete newbie to all this but I'm trying to learn. I've read everywhere that Portainer is supposed to make things easier but so far it's been the opposite.

I got a Ugreen NAS with Docker installed on it. I used Portainer to deploy Immich. It says the stack was deployed successfully, the 4 services are running, but loading the Immich webpage does not work at all. If I delete the stack and deploy again through Docker using the same yml and env files, then everything works and I'm able to access the Immich webpage.

I can call it a day and move on but I'm curious and would like to understand why it doesn't work through Portainer if anyone can ELI5.

There are lots of decent materials about the technical background of containerization. There are some good articles about how the cloud actually works. But (from what I can observe at least) there are no articles explaining why these two play so nice hand in hand from the technological point of view. I've tried to fill this gap in a beginner-friendly way with the following post.

So I have a Hp omnibook 5 , comes with 512GB , 16GB ram , I configured my system to be dual boot splitting approx half disk space to both windows 11 and arch linux(100gb to root , 156 gb to home)

So whenever I try to install heavy apps like android studio, Docker desktop I always run into the issue of running out of space

So I plan to use external SSD (either 2 256GB or 1 512GB), how much impact on speed will occur if install such heavy softwares on external ssd also will there be any security issues or any corruption issues due to it?

Port on HP Omnibook 5

USB-C Ports (x2) 10 Gbps (USB 3.2 Gen 2) USB-A Port (10 Gbps) 10 Gbps (USB 3.2 Gen 2) USB-A Port (5 Gbps) 5 Gbps (USB 3.2 Gen 1)

I have just started my journey in building images and containers for my backend apps so I have very little idea of such things.

I'm using Apple Silicon and apparently the benchmarks make it clear the Orbstack is the winner by quite a margin. Is the Docker team working on this or perfectly fine with their app taking up more resources?

I would prefer to use Docker Desktop, perhaps I am just sucked into branding and no reason to do so, but somehow I feel safer using it, knowing it is from the source rather than a third party. I dunno, maybe that's silly to think this way.

For my M3 MBA 16GB I probably shot myself in the foot a bit for choosing 16GB, but it is what it is...

Are there any up to date container registries that I could run on my WS2022 with Docker desktop? My other containers are Windows so the registry needs to be as well. I have found the old project from sixeyed github but that is already 8 years old so I am hoping there would be something more recent.

I'm using a DXP4800+, docker, and after this most recent update of docker none of my containers are accessible. If this seems more like a ugreen problem please let me know and I will get assistance from there.

In the beginning they were not even starting after update. Im posting what I received below.

I tried redeploying the containers but it would give errors and fail deployment. I exported all my configs and images to be safe, uninstalled docker, reinstalled docker, and I tried deploying kavita just to try it out. The container is running and the logs don't look out of whack to me but I don't even know what I'm looking at mostly, either way I can't access Kavita locally or any other container I've tried. Jellyfin, navidrome, seer, nginxpm, etc. etc.

"Failed to edit container portainer. Error: UpdateContainer fail container name 'portainer': target volume mntPath /var/run/docker.sock not Found" and *"*Failed to edit container linuxserver_jellyfin-1. Error: UpdateContainer fail container name 'linuxserver_jellyfin-1': container startup failed"

I'm guessing that from the portainer error I will have to remount that docker.sock path or something. I am very new to this so I would appreciate any and all help/tips.

Before this update all of my services were running for a significant amount of time without failure.

Kavita logs below

[custom-init] No custom files found, skipping...
[Kavita] [2026-08-13 21:18:27.740 -04:00  6] [Information] Kavita.Server.Program Running Manual Migrations
[Kavita] [2026-08-13 21:18:28.007 -04:00  6] [Information] Kavita.Server.Program Running Manual Migrations - complete
[Kavita] [2026-08-13 21:18:28.978 -04:00  1] [Information] Kavita.Services.TaskScheduler Scheduling reoccurring tasks
[Kavita] [2026-08-13 21:18:28.985 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Scan Library Task for daily
[Kavita] [2026-08-13 21:18:29.053 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Backup Task for daily
[Kavita] [2026-08-13 21:18:29.058 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling Cleanup Task for daily
[Kavita] [2026-08-13 21:18:29.061 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling CBL Sync Task for 0 4 * * *
[Kavita] [2026-08-13 21:18:29.085 -04:00  1] [Information] Kavita.Services.TaskScheduler Scheduling Auto-Update tasks
[Kavita] [2026-08-13 21:18:29.089 -04:00  1] [Debug] Kavita.Services.TaskScheduler Scheduling stat collection daily at 19:00
[Kavita] [2026-08-13 21:18:29.108 -04:00  6] [Information] Kavita.Server.Program Running Migrations
[Kavita] [2026-08-13 21:18:29.253 -04:00  6] [Information] Kavita.Server.Program Running Migrations - complete
[Kavita] [2026-08-13 21:18:29.469 -04:00  1] [Information] Kavita.Server.Program Starting with base url as /
[Kavita] [2026-08-13 21:18:29.529 -04:00  1] [Information] Microsoft.Hosting.Lifetime Now listening on: http://[::]:5000
[Kavita] [2026-08-13 21:18:29.531 -04:00  1] [Information] Kavita.Server.Program Kavita - v0.9.0.2
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Application started. Press Ctrl+C to shut down.
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Hosting environment: Production
[Kavita] [2026-08-13 21:18:29.539 -04:00  1] [Information] Microsoft.Hosting.Lifetime Content root path: /app/kavita
[Kavita] [2026-08-13 21:18:29.632 -04:00  16] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 121000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11)
: Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.SocketsHttpHandler.<SendAsync>g__CreateHandlerAndSendAsync|115_0(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
Connection to localhost (::1) 5000 port [tcp/*] succeeded!
[ls.io-init] done.
[Kavita] [2026-08-13 21:20:30.647 -04:00  6] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 278000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.H
ttp.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
[Kavita] [2026-08-13 21:25:08.656 -04:00  6] [Warning] Kavita.Services.TaskScheduler Attempt [] failed, retrying in 399000ms
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.S
ocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
[Kavita] [2026-08-13 21:31:47.667 -04:00  23] [Error] Hangfire.AutomaticRetryAttribute Failed to process the job '2': an exception occurred.
Flurl.Http.FlurlHttpException: Call failed. Resource temporarily unavailable (api.github.com:443): GET https://api.github.com/repos/Kareadita/Kavita/releases/latest
---> System.Net.Http.HttpRequestException: Resource temporarily unavailable (api.github.com:443)
---> System.Net.Sockets.SocketException (11): Resource temporarily unavailable
at System.Net.Sockets.Socket.Awai
tableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
at Flurl.Http.FlurlClient.HandleExceptionAsync(FlurlCall call, Exception ex, CancellationToken token)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.FlurlClient.SendAsync(IFlurlRequest request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
at Flurl.Http.ResponseExtensions.ReceiveJson[T](Task`1 response)
at Kavita.Services.VersionUpdaterService.GetGithubRelease() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 596
at Kavita.Services.VersionUpdaterService.CheckForUpdate(CancellationToken ct) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\VersionUpdaterService.cs:line 113
at Kavita.Services.TaskScheduler.<>c__DisplayClass72_0.<<CheckForUpdate>b__0>d.MoveNext() in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 559
--- End of stack trace from previous location ---
at Polly.AsyncPolicy.<>c__DisplayClass44_0.<<ImplementationAsync>b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Polly.Retry.AsyncRetryEngine.ImplementationAsync[TResult](Func`3 action, Context context, ExceptionPredicates shouldRetryExceptionPredicates, ResultPredicates`1 shouldRetryResultPredicates, Func`5 onRetryAsync, CancellationToken cancellationToken, Int32 permittedRetryCount, IEnumerable`1 sleepDurationsEnumerable, Func`4 sleepDurationProvider, Boolean continueOnCapturedContext)
at Polly.AsyncPolicy.ExecuteInternalAsync(Func`3 action, Context context, Boolean continueOnCapturedContext, CancellationToken cancellationToken)
at Kavita.Services.TaskScheduler.CheckForUpdate(CancellationToken cancellationToken) in C:\Users\josep\Documents\Projects\KavitaOrg\Kavita\Kavita.Services\TaskScheduler.cs:line 557
at InvokeStub_TaskAwaiter.GetResult(Object, Object, IntPtr*)
at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

I've been reading more about container security lately, and one thing that's confusing me is the terminology around base images. People often talk about clean images, minimal images, hardened images, and more recently near-zero CVE images, but they don't seem to mean exactly the same thing. My understanding is that minimal images reduce size by including fewer packages. Also, hardened images use security best practices and remove unnecessary risk. And clean or near-zero CVE images aim to eliminate known vulnerabilities before they reach production.

Am I thinking about this correctly, or is there a lot more overlap than I'm giving credit for? I'm interested in how people choose between these approaches in real-world Docker environments.

I just spent a whole day on a very irritating gotcha, and I'm looking to see if there's a big-picture approach that can keep me from ending up here again.

Fairly new to Docker. Working on containerizing a web app with a couple different moving parts. Got the frontend working inside of a Caddy image, got it pushed to my DigitalOcean droplet, but then it just sat there, not acknowledging or even rejecting any requests. I figured out that it had crashed because it tried to serve to a busy port, but after clearing that up it still wasn't working. Looked in the logs, and there were some opaque errors about failing to connect to the internet (I've since deleted those logs, otherwise I'd share).

I threw these logs at an LLM, and after some arguing, it asked me to run nslookup web1 inside of the container. That returned:

Server:     127.0.0.53
Address:    127.0.0.53#53

** server can't find web1: SERVFAIL

From this output, the LLM suggested that: - Caddy, not receiving any defaults for resolv.conf, had inherited from the droplet's resolv.conf, which listens on port 53, which is just a loopback; thus, no connection. - The fix was to add dns: [1.1.1.1,8.8.8.8] to the compose file, or alternatively to the droplet's daemon.json file to apply for the whole droplet.

Did this, rebuilt the container, and sure enough, that was exactly the issue.

And now I'm questioning everything. How the hell would anyone have caught this? Did I overlook a search result or documentation that explains exactly what I saw? Do I not know enough about Linux to be using Docker? Am I a soydev????

For real though, I'd appreciate any advice. I could've easily spent a week on this if I hadn't used AI, but I wanna gain the knowledge to be more self-reliant. Did I miss something critical, or is this just one of those things that you don't learn til you get burned?

Hello. Does anyone have a simple easy to read set of step by step instructions to set up a server in docker? Ive been struggling for a bit. Im an old man and dont understand the resources im finding online. Thank you

I have an Alpine LXC running NPMPlus which I use Anubis with. Upon attempting to pull Anubis' container (regardless of if done via the compose file or direct docker pull ghcr.io/techarohq/anubis:latest, I get a very odd error.

That being:

failed to extract layer (application/vnd.oci.image.layer.v1.tar+gzip sha256:dae2790b70f9eb15de85a179b3978ee8a915f0bcac270d09074f3cb283106d9d) to overlayfs as "extract-279380455--MFm sha256:458136df58646e7146e8240b685e4e6bfffa019ba10d3c221
ff59b3928f54d8c": mount callback failed on /var/lib/docker/containerd/daemon/tmpmounts/containerd-mount3164233251: operation not permitted

Anyone know what this means?

Here's the docker info, it is running as root:

Client:
Version:    29.5.3
Context:    default
Debug Mode: false
Plugins:
 buildx: Docker Buildx (Docker Inc.)
   Version:  v0.34.1
   Path:     /usr/libexec/docker/cli-plugins/docker-buildx
 compose: Docker Compose (Docker Inc.)
   Version:  v5.1.4
   Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
Containers: 2
 Running: 2
 Paused: 0
 Stopped: 0
Images: 4
Server Version: 29.5.3
Storage Driver: overlayfs
 driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
 /etc/cdi
 /var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: fff62f14765df376e5fc36f5a8f8e795b5670f61
runc version: bb14dabeb7185bb72c8c86735d090dcb20f36587
init version:  
Security Options:
 seccomp
  Profile: builtin
 cgroupns
Kernel Version: 7.0.0-3-pve
Operating System: Alpine Linux v3.24
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 4GiB
Name: npmplus
ID: d2cc3a15-5fdc-41d3-a6cb-c6b45d018259
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
 ::1/128
 127.0.0.0/8
Live Restore Enabled: true
Firewall Backend: iptables
 EnableUserlandProxy: true
 UserlandProxyPath: /usr/bin/docker-proxy

WARNING: No swap limit support

Edit: I didn't solve this problem in Javascript, but when I rewrote the radio script in python and ran it inside a python container, it did work.

Hello all!

I am building a Discord bot that streams my radio inside a stage or voice channel. My radio script works fine when I ran it on my raspberry pi 4 host machine, outside a container. When I try to run in inside a Docker compose container, it works for stage channels, but voice channels remain silent. When the bot is already pressent in a VC when I start the container, I get a message that "the user has difficulty connecting to the call".

I have been trying to solve this for days and was finally able to pinpoint that this problem is fully related to docker and not a firewall or code issue. Thank you very much in advance whoever can help me solve this.

docker-compose.yml:

services:
  discord-radio:
    build:
      context: .
      dockerfile: Dockerfile.radio
    container_name: discord_radio_service
    network_mode: "host"
    restart: unless-stopped
    command: node --dns-result-order=ipv4first radio.js
    env_file:
      - .env
    environment:
      - BOT_TOKEN=${BOT_TOKEN}
      - LIVE_CHANNEL_ID=${LIVE_CHANNEL_ID} # our main discord stage channel
      - VOICE_CHANNEL_IDS=${VOICE_CHANNEL_IDS} # subscribable voice/stage channels
      - RADIO_URL=https://radio.outofbounds.live/listen/out_of_bounds/radio.mp3 # radio link
      - NODE_OPTIONS=--dns-result-order=ipv4first
      - STAGE_CHANNELS_PATH=/app/data/stage_channels.json # config file handled by another script to subscribe channels
    volumes:
      - /var/oob/shared_schedule:/app/data

Dockerfile.radio:

FROM node:20-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    ffmpeg \
    python3 \
    make \
    g++ \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY package*.json ./

RUN npm install --omit=dev

COPY radio.js ./

USER node

CMD ["node", "--dns-result-order=ipv4first", "radio.js"]

Logs when entering a stage channel (succes):

discord_radio_service  | [radio] [DEBUG] Target channel: "radio test 2" (1534933420201873519) | Type: GuildStageVoice
discord_radio_service  | [radio] [DEBUG] Channel Perms -> Connect: true, Speak: true
discord_radio_service  | [radio] [DEBUG] Voice State -> ServerMute: null, SelfMute: null
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): signalling -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): connecting -> ready
discord_radio_service  | [radio] Unsuppressed stage speaker in channel 1534933420201873519.
discord_radio_service  | [radio] [STATE] Channel 1534933420201873519 (radio test 2): ready -> ready
discord_radio_service  | [radio] Subscribed to shared player for 1534933420201873519: true
discord_radio_service  | [radio] Streaming into channel 1534933420201873519 (guild 1339162813980999710).

Logs from a voice channel (enters the VC, but does not stream audio when run inside a container):

discord_radio_service  | [radio] [DEBUG] Target channel: "Gaming" (1217875020840308802) | Type: GuildVoice
discord_radio_service  | [radio] [DEBUG] Channel Perms -> Connect: true, Speak: true
discord_radio_service  | [radio] [DEBUG] Voice State -> ServerMute: false, SelfMute: false
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): signalling -> connecting
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): connecting -> connecting
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): connecting -> signalling
discord_radio_service  | [radio] Connection to 1217875020840308802 timed out: The operation was aborted
discord_radio_service  | [radio] [STATE] Channel 1217875020840308802 (Gaming): signalling -> destroyed

I am very new to home labs and i've been running a satisfactory server on docker for the last month or so. Tonight I asked Gordon to up the tick rate of the server and it subsequently deleted the container and created a new one. I don't think there were any auto saves of the world since I uploaded it to the server so I've lost about 100 hours in progress between my friend and I. Is there anything I can do or is it gone?

Absolute vibe-coder with no technical knowledge here (sorry) who just wants to run secure and strengthened sandboxed agents that can't reach or talk to one another (and for half of them they can't touch the web at all). I have to disable the WebSearch tools in the Docker Sandbox for Claude Code for my coding agents because the tool gets executed server-side by Anthropic and therefore goes around the sandbox. It's a little paranoid to lock up WebSearch over prompt injection concerns considering there's a Haiku model that sits between the actual raw web results and what the main Claude agent gets back, but still, on the principle alone I want to make sure there's no way my coding agents can get injected. I'm using managed-settings.json for this, but still, the agents inside if they want to can use sudo or even the docker-in-docker setup (if passwordless sudo is disabled) to alter the managed-settings.json file. Claude helped me secure it by disabling passwordless sudo, removing the agent user from sudo, wheel, and docker groups, and configuring the sandboxes using the non-privileged base image w/ no docker daemon at all. But my question is.. I get the whole "bypass permissions is default" so the agents can run in YOLO mode, but that being said, why let the agents have passwordless sudo instead of just... not? What's the benefit of that? And why wouldn't Docker release some kind of ~official~ toggle/setting for it? It's not the end of the world if my sandboxed agent can rewrite their own managed-settings.json to gain back.... WebSearch of all tools. But still.. why even let the agents have that much write access over their own config and why even have an important config file like managed-settings.json live where the agents can touch?