The database password was in the repository, then in the image, then in an environment variable readable by anything that could run ps. Where it went next.
The audit asked where the database password is and there were five answers, all of them true. Enumerating the copies is the first hour and is usually the…
The tests need MySQL and Redis, and CI gives you an empty machine. Service containers, where they differ from compose, and the readiness nothing does for you.
Caching a package manager’s downloads in a layer bloats the image and is invalidated by anything above it. A cache mount lives outside the image entirely. The syntax…
A development machine accumulates dangling layers, stopped containers and orphaned volumes, and none of it is visible until the disk fills. -a –volumes deletes the database volume of…
Docker writes its own iptables rules ahead of the chain UFW manages, so a published port is reachable from the internet regardless of what the firewall says. The…
The default logging driver writes to a file that grows without bound, so a chatty container fills the host disk over a fortnight and nothing warns first. Setting…
PID 1 in Linux gets no default signal handlers, so a shell script as the entrypoint ignores SIGTERM entirely and docker stop waits ten seconds before killing it.…