An image with no shell, no package manager and no coreutils has a very small attack surface and is genuinely unpleasant the first time something goes wrong inside…
Passing a private repository token as a build argument puts it in the image history, where docker history will read it back out for anyone with the image.…
A secret in an environment variable is visible in docker inspect, in the process environment, and in any crash dump or error page that prints the environment. The…
Caching Composer or npm downloads previously meant a layer holding the cache directory, which bloats the image and is invalidated whenever anything above it changes. The cache lives…
A published container port is reachable from the internet regardless of what UFW says, because Docker inserts its rules ahead of the chain UFW manages. Binding to the…
Alpine uses musl rather than glibc, and musl’s resolver queries all configured nameservers in parallel and takes the first answer — which behaves differently from glibc under partial…
19.03 made rootless mode usable, and it is worth knowing what it costs before installing it on a machine that matters. The security gain is real and specific:…
PID 1 in Linux does not get default signal handlers, so a shell script as the entrypoint ignores SIGTERM entirely — and docker stop waits ten seconds and…
The default update order stops a task before starting its replacement, so capacity dips during every deploy — invisible at eight replicas, a visible outage at two. failure_action:…