Why it is recommended to run only one process in a container?
In many blog posts, and general opinion, there is a saying that goes "one process per container".Why does this rule exist?Why not run ntp, nginx, uwsgi and more processes in a single container that...
View ArticleList of container images signed with Podman (PGP, GPG)?
How can I find a list of all container images that have been signed by their publishers using Podman and PGP?Unfortunately, I just discovered that the official docker documentation says that DCT is...
View ArticleList of container images signed with Notation?
How can I find a list of all container images that have been signed by their publishers using Notary v2?Unfortunately, I just discovered that the official docker documentation says that DCT is being...
View ArticleIs Cosign's keyless verification model vulnerable to insider threats at the...
I'm evaluating Cosign as a replacement for Docker Content Trust (DCT) in a CI pipeline where the threat model assumes ephemeral GitHub Actions runners with no previously established trust...
View ArticleAfter removing Docker container, why is it automatically re-created?
I'm using ubuntu-16.04 desktop and installed Docker-1.5-1 and docker-engine-17.05.0~ce-0~ubuntu-xenial, in which I installed openmedicus/phplist. My aim is to remove the container, and the image as...
View ArticleDo docker layers work at file level or block level?
I'm considering using a Docker image as way to snapshot a MySQL database after fixtures have been loaded, in order to quickly restore the snapshot before each acceptance test.In order for this to be...
View ArticleShall I exclude istio-proxy in datadog agent?
We have istio-proxy and it's observable in datadog, we want to consider whether we should exclude it or not.As we know istio-proxy is just sidecar container.
View ArticleDoes Docker on MacOS support tmpfs?
I am new to Docker and I want to run Docker with ram only storage. In other words, I do not want Docker to save anything on persistent storage. I found out that on Linux Docker supports tmpfs. Is there...
View Articlerelease of stable NET10 chiseled images
For our .NET base images we would like to migrate to .NET10 and then also the chiseled images.Right now we are using:FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base....FROM...
View ArticleDo docker layers work at file level or block level?
I'm considering using a Docker image as way to snapshot a MySQL database after fixtures have been loaded, in order to quickly restore the snapshot before each acceptance test.In order for this to be...
View ArticleOptimizing container startup time in Kubernetes
What are effective strategies or best practices to reduce pod startup time in Kubernetes (image pulling, scheduling, initialization)?
View ArticleClik here to view.
mutatingwebhook created invalid kubectl container
I have a Mutating webhook running in a rancher controlled kubernetes 1.32 cluster.Full code here:https://github.com/laurijssen/cacerts-webhookIt has the following mutate code. patch = `[ {"op":...
View ArticleRunning sysbox on an initrd device does not work - jailing process inside...
I am trying to run sysbox inside a physical device.It has kernel 6.1.107 which was compiled by me.I've added all the necessary kernel modules in the kernel's...
View ArticleHow can I automatically reduce known CVEs in Docker images during CI/CD by...
I'm building Docker images as part of a CI/CD pipeline (using GitLab CI and GitHub Actions) and want to minimize the number of known vulnerabilities (CVEs) in the final image. Rather than relying...
View Articlekubelet connecting to docker.sock instead of containerd.sock
Kubernetes version: latestInstallation method: kubeadmHost OS: debian9container runtime: containerdKubelet fails when starting and after inspecting the logs using journalctl -xeu kubelet i see that it...
View ArticleHow reliable is NFS for using in Kubernetes?
I'm setting up a self-managed Kubernetes cluster where I'm limited by the number of choices for the backend storage for Pods.I should use a remote storage, so that multiple Pods can read/write at the...
View ArticleAre there examples of other production grade container runtimes?
While we say "Docker is just one possible container runtime", are there other implementations used in production environments as of late 2019, and do they have different approaches? (while Docker being...
View ArticleClik here to view.
Podman containers fail when agent finishes the job
I am using an Azure DevOps self hosted agent to automate starting containers on an Azure VM. The agent uses the "podman-compose up -d" command and all is well as long as the agent's job is still...
View ArticleHow to run multiple services in docker compose file
Below is the docker-compose.yml file that I am using to run multiple containers:services:#############################| auth |############################# rule-auth: build: context: ./ms_auth...
View ArticleIn kubernetes, I want to restrict my pod scheduling on worker node if memory...
For eg: worker node(W) have 64GB of memory and 16vCPUsresources assigned to a pod : cpu - 4 , memory- 8GBNow only 4 pods can be scheduled on worker node(W).How can i achieve this ?Node affinity , node...
View Article
