One common use case for CI pipelines is building the Docker images you’ll use to deploy your application. GitLab CI is a great choice for this as it supports an integrated pull proxy service, meaning faster pipelines, and a b…

Docker containers are usually treated as immutable once they’ve started running. You can update some configuration parameters dynamically though, such as the container’s name and its hardware resource limits….

Docker’s API is completely unprotected by default except for filesystem permissions on its Unix socket. You should set up TLS when exposing the Docker API over TCP so Docker Engine and your clients can verify each others’ ide…

Docker containers are intentionally isolated environments. Each container has its own filesystem which can’t be directly accessed by other containers or your host.

Docker is the best known containerization platform but it doesn’t exist in isolation. An entire ecosystem of complementary tools and spin-off projects has sprung up around the shift to containers.

Redis is an in-memory key-value store which can save abstract data structures with high performance. The open-source software is typically used for database, messaging, and caching functions.

Docker Engine supports a plugin system that lets you add extra functionality to the container runtime. Plugins for new storage drivers, networking stacks, and logging systems are all freely available.

Docker lets you package up software as self-sufficient containers that share their host’s kernel but look and feel like independent VMs. The software within runs with near-native performance. This makes Docker containers a gr…

Docker containers don’t see your system’s GPU automatically. This causes reduced performance in GPU-dependent workloads such as machine learning frameworks. Here’s how to expose your host’s NVIDIA GPU to your containers….

While Docker is a useful tool for packaging and managing applications, it also presents many unique challenges, such as dealing with stored data. Usually, you add volumes to containers in the creation script, but what if you …

Exposed and Published container ports are two different but related concepts in Docker. Exposed ports are defined in your Dockerfile as simple metadata. You must publish them when your container starts if you want to enable o…

Containers running in Kubernetes Pods are meant to be self-contained compute units that you don’t need to manually interact with. Sometimes you might have to copy files to or from a Pod’s filesystem though, perhaps because yo…

Running Docker inside Docker lets you build images and start containers within an already containerized environment. There are two possible approaches to achieve this depending on whether you want to start child or sibling co…

Docker volume and bind mounts are used to bind directories on the host OS to locations in the container’s file system. While they’re commonly used to mount entire directories, you can also use them to symlink individual files…

Syft is a CLI utility that generates a Software Bill of Materials (SBOM) for container images. An SBOM is a catalogue of dependencies used by your image. It gives you visibility into the “materials” that form your image’s fil…

Docker images can bundle arbitrary binaries and libraries into a single blob of data. Inspecting what’s actually inside an image helps you assess its suitability and identify any security hazards.

Docker storage drivers control how images and containers are stored on your filesystem. They’re the mechanism that lets you create images, start containers, and modify writable layers. Here are the differences between each dr…

Docker provides tools to bridge the filesystems of containers and the host operating system running the container, such as bind mounts and volumes. These can be very useful both in development and production environments….

Docker’s ONBUILD instruction lets you set up triggers within an image. Your triggers will be executed later, when the image is used as a base for another one. They’ll become part of the new downstream image context and won’t …

Usually, you want Docker applications to be fully contained, but sometimes for development or automation purposes it’s useful to be able to work with Docker containers as if there were Linux VMs. Docker provides tools for run…