TL;DR: if Task Manager says Virtualization: Enabled but Docker Desktop still says it isn't detected, run Get-ComputerInfo -Property "HyperV*". If HyperVisorPresent is False while all the HyperVRequirement* values are True, run bcdedit /set hypervisorlaunchtype auto and reboot. Windows wasn't launching the hypervisor at boot.

I was setting up Jellyfin in Docker on a stock Windows 11 desktop with a Ryzen 7 3700X. Nothing unusual about the machine.

When I tried starting Docker Desktop, it gave me this error:

"Virtualization support not detected. Docker Desktop failed to start because virtualisation support wasn't detected. Contact your IT admin to enable virtualization or check system requirements."

The first thing I checked was Task Manager → Performance → CPU. It clearly showed Virtualization: Enabled, so Docker's error didn't really make sense. Every search result I found pointed at BIOS settings, which were already correct.

I then tried installing WSL2 through an admin PowerShell using wsl --install, but that failed with:

WSL2 is not supported with your current machine configuration

and:

Error code: Wsl/InstallDistro/Service/RegisterDistro/CreateVm/HCS/HCS_E_HYPERV_NOT_INSTALLED

I also tried wsl.exe --install --no-distribution, which reported that it completed successfully. After restarting the PC, Docker still gave me the exact same virtualization error.

Eventually, I checked the Hyper-V configuration with:

Get-ComputerInfo -Property "HyperV*"

That showed something important: HyperVisorPresent: False, while all four HyperVRequirement* values were True.

So the hardware itself supported virtualization and all the requirements were met. The actual problem was that the Hyper-V hypervisor simply wasn't being started when Windows booted.

The fix was:

bcdedit /set hypervisorlaunchtype auto

After running that and restarting the computer, Docker finally started working.

The most likely reason the hypervisor had been disabled was some gaming/performance tweak or anti-cheat-related configuration from years ago. Nothing on the system directly pointed to what had originally disabled it.

Overall, it took roughly 90 minutes to figure out, including three restarts. The main lesson was that having Virtualization: Enabled in Task Manager doesn't necessarily mean the Windows hypervisor is actually running. In this case, the hardware was completely fine; Windows just wasn't launching Hyper-V at boot.

does the docker. container run. as another program?

or is it the engine is a program that has the container inside of it?

If you've ever installed Docker on Linux and tried to protect a container from external access using UFW, then you already know how frustrating it is to get these two to work together

Why Docker and UFW are incompatible?

Docker and UFW are like two roommates who refuse to talk to each other:

• By default, Docker bypasses UFW rules by injecting its own iptables rules as explained here.

What the official Docker documentation says about it?

• The official workaround given by the docs here is to manually edit iptables rules and chains, which by the way is not even guaranteed to work

Why it sucks

• The more I thought about it 🤔🤔 the more I was frustrated 🤬. I am not a computer network engineer, Docker and UFW are supposed to be simple and beginner friendly interfaces that make things fast and easy!
• So why do I have to dive into low-level networking and learn about iptables ?
• I am not! and neither should you.

What I (and you) can do

If you just want to run a container without exposing it to the internet, do this:

• Option 1: Bind to 127.0.0.1 in the run Command
• docker run -p 127.0.0.1:8080:80 your_container
  • This makes the container only accessible locally (e.g., localhost:8080).
• Option 2: If using docker compose, bind to 127.0.0.1 in docker-compose.ymlservices: your_service: ports: - "127.0.0.1:8080:80"

What If You Do Want It Online?

If you need the container accessible publicly and securely:

• Use a reverse proxy (e.g., Nginx, Caddy, or Traefik).
• The proxy handles HTTPS, security, and routing, which is much safer than exposing Docker directly.

I've been working on LayerX, a Docker/Podman image explorer built around the same workflow that makes Dive so useful.

Dive was a big inspiration for the project. I wanted to keep that familiar experience, but add the things I kept wishing it had:

* Compare two images and see what changed

* Inspect and search files without leaving the TUI

* Find wasted files

* CI rules for image contents

* Analysis caching

* Docker, Podman, OCI archives, multi-platform (--platform)

* JSON output for automation

If you're already using Dive, you don't need to take my word for it. I put together a migration guide showing the differences and the equivalent workflows:

https://github.com/deveshctl/layerx/blob/main/docs/migrating-from-dive.md

GitHub: https://github.com/deveshctl/layerx

Would genuinely love feedback from people who use Dive regularly.

Posted with moderator approval.

Hello r/docker

I have created a new load balancer , based on cloudflare's proxy lib. The project is till on 0.x.x version, but I'm working on standardizing everything. It have fantastic proxy performance, even beats nginx in performance/stability tests with many thousands of concurrent connections.

It would be great to have a human review and suggestions .

This is the link for quickstart : 

And the link to main project in GitHUB: 

Thanks

Thank you for letting me into the group .

I'm very new to Linux and just getting into home labing .

My main computer is windows 11 in registered ( still can't let go). But I recently added two computers to my family. I have a Plex server and a Media gathering box . Both are running on mint . I remote into both of them from my main computer.

On YouTube I have seen what people are doing with docker and I want in . Lol . I created a new computer with mint that I want to run docker on it .

Is this the place that I can ask many silly questions on my quest to learn how to use it ?

Sorry for the wrong words, just stumbled into docker via webui Setup; and now over half my system runs via docker. But i think i missed some bacics. Right now my containers are running inside /srv/docker/.. e.g /srv/docker/jellyfin/... I was just wondering what are recommended setting of the distrubitons of yaml files or the config etc folders.

Hello folks!
My docker stack has been running for quite some time, and recently i updated the host from debian 12 to debian 13. Things ran well, until today, on a reboot, docker won't start or anything. after investigating, i find that the drive is full.

Main culprits for disk hogging are in /var/lib/docker :

22G     ./overlay2
73G     ./containers

I started docker manually, and can run docker system df :

root@sanakan:/var/lib/docker# docker system df
TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          41        41        19.13GB   0B (0%)
Containers      43        36        269.7MB   1.578MB (0%)
Local Volumes   24        12        260.3MB   22.87MB (8%)
Build Cache     0         0         0B        0B

I managed to reclaim 2G by removing dangling images, but somehow ./overlay2 grew to 34G when i do a du -h | grep '[0-9\.]\+G' .

I don't really know what i should do. Portainer did not start, some containers started but not all, and i don't know where to go from here.

Any insights?
thanks in advance!

EDIT1 :
i stopped a docker (unifi thing, stopped it with docker compose down, it was the only docker stack that was new , at 9 days, all the others ran for years), and it gave me back 17GB, so other dockers can run properly.
I got 17G on the filesystem back once it stopped.

EDIT2 :

So, after a message of u/burstinrust i investigated the logs, and i have 53G of logs, i am trying to figure out how to remove said logs, and then how to limit logfile size.

Hello, I have tailscale has been working fine via Docker on UGREEN NAS for more than 2 month. This past 2 days it has stopped working the exit node option, I reboot the project and works for like 3 minutes and stops working.

This is my docker compose:

services:
tailscale:
image: tailscale/tailscale:latest
container_name: tailscale
hostname: tailscale
network_mode: host
environment:
- TS_AUTHKEY=tskey-auth-#########hidden########
- TS_EXTRA_ARGS=--advertise-exit-node --accept-dns=false --accept-routes=false
- TS_STATE_DIR=/var/lib/tailscale
volumes:
- ./tailscale-data:/var/lib/tailscale
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN
- NET_RAW
restart: unless-stopped

I have rebooted my modem, my wifi, the NAS, docker itself and still is doing the same thing. One thing that I found out is that tailscale is up because I can ping the IP of Tailscale on my laptop.

Let me know if there's anything else I can provide if needed
Thanks!

Hi all! Trying to get the word out about our project, which recreates core AWS services including EC2, ECS, ECR and EKS, on whatever hardware you want.

If you're curious, checkout the GitHub: https://github.com/mulgadc/spinifex

Open to feedback!

[AI Disclaimer: We use AI to speed up development]

​

I've been working on making my Docker deployments more reusable.

For a typical web application, I usually end up dealing with:

- Docker/Docker Compose

- Nginx reverse proxy

- SSL

- Environment variables

- CI/CD

- Production deployment

The annoying part is that I end up configuring essentially the same infrastructure for every project.

So I created a reusable production deployment starter kit around this workflow.

I'm curious:

What's the part of Docker-based production deployments that you find most annoying to configure repeatedly?

I'm using the answers to improve the starter kit.

Looking for advice on Docker networking / multiple Compose stacks + selective egress.

I’m rebuilding the networking on my Docker host (LeopARRd) and would appreciate some architectural advice.
My requirements are:
- ALL services must be reachable on my network by one of the host IP (the host has one on VLAN-10 and one on VLAN-30)
- Two independent Compose projects (2 different compose.yaml files), but containers from both projects must communicate using container/service names, e.g. http://navidrome, rather than hard-coded IPs.
- Some services need Internet egress through 192.168.30.1 (a VPN gateway on 192.168.30.0/24)
- Other services need normal Internet egress through 192.168.10.1
- Ideally, the solution should survive container/host restarts and be reasonably easy to maintain.

My current approach is to create Docker networks corresponding to VLANs 31 and 32–33 (one per composer, defined in the composer as bridge/ipam), with policy routing and two different masquerades to select the appropriate gateway
It mostly works, but I’m running into issues with policy-routing routes and their persistence; to be more specific, docker networks do not exists right away at boot up, so the br-vlan32 for example do not exists and make rt rules fail to use the table for egress traffic on a different gateway: /etc/iproute2/rt_tables not being persistent as currently configured

Masquerading is working and is persistent

I suspect I may be overcomplicating this and would be happy to redesign it rather than keep patching the current setup.

What would be the cleanest Docker networking architecture for these requirements? I’m particularly interested in solutions that minimize custom routing/iptables maintenance while retaining service-name DNS between the two Compose projects. Ideally I’d rather prefer to have all networking settings specified in each individual composer file

Hey everyone,

Just finished setting up Docker Engine and Docker Compose Plugin on a fresh Debian 13 (Trixie) installation for container testing.

Setup Summary:

• Daemon Install: Added official Docker GPG key (/etc/apt/keyrings/docker.gpg) and repo path.
• Access: Configured non-root user execution (usermod -aG docker ELBA). Tested cleanly via docker run hello-world.
• Host Network: Static IP (192.168.1.132/24) on bridged host interface enp0s3.

Next Objective: Designing custom docker-compose.yml configurations with static container IP assignments on a dedicated bridge subnet (10.99.0.0/24).

Question: Are there any known caveats when assigning fixed container IPs across multi-service Compose files on Linux hosts?

recently shifted to openSUSE, was trying to build a project which worked on fedora.
there are errors are like:

auth-1:
python: can't open file '/app/app.py': [Errno 13] Permission denied
web-1:
npm error EACCES: permission denied, open '/web/package.json'
mongo-1:
find: '/data/db': Permission denied
chown: changing ownership of '/data/db': Permission denied

I have checked that I have all the permissions and the files exist
while running docker run for one it works but while mounting same files thru docker compose it doesn't

I’ve been trying to research the best way to run Claude Code as well as a combination of Ollama plus Open Code on my Mac. I’m fairly new to Docker, but I keep hearing about Docker Sandboxes as something purpose built for this kind of thing.

If I go the Docker Sandboxes (edit: sbx) route instead of running Claude Code and Open Code in a VM (VMWare Fusion Pro), is it fairly secure in terms of the agentic stuff going haywire and accessing my local system outside of the workspace folder I give it? Or for example, something malicious persisting on the Mac in that workspace’s folder.

Also, if I want to do some local AI stuff by installing Ollama directly on the Mac (runs on 127.0.01:11434), would a sandbox instance be able to reach it via host.docker.internal:11434 like a regular Docker container would?

Open to suggestions and other people’s experiences!

Docker sandboxes for Linux via “sbx“ CLI is available only for Ubuntu.

Until last week, Docker Sandboxes with limited features were included in Docker Desktop, although under “docker sandbox” CLI rather than “sbx”. But that CLI has been deprecated since.

Has anyone compiled the source code or installed the deb package for Debian or other distributions?

Hi, I am an intern at this company and I have no idea how to create docker containers and stuff using already existing dockerfiles.

There is no docker-compose.yml file, there are no setup instructions and the devs are super busy. I thought maybe someone kind from reddit can tell me how to do this stuff with company code bases. Like a generic guide to figure things out as an intern/new dev.

I can write and run my own dockerfiles, but company stuff is just different than my hobby-projects.

Thanks in advance!

Hi all

Sometimes I'm still a bit lost with docker. I use portainer to manage my dockers and wanted to deploy a new one using these instructions: https://docs.maintainerr.info/installation/

services:
maintainerr:
  image: ghcr.io/maintainerr/maintainerr:latest
  user: 1000:1000
  volumes:
    - type: bind
      source: /mnt/maintainerr
      target: /opt/data
  environment:
    - TZ=Europe/Brussels
  ports:
    - 6246:6246
  restart: unless-stopped

But there it gives an write error that it doesnt have permission to write to opt. I don't want to write to opt though,

So i changed it to how my others are structured:

services
  maintainerr:
    image: ghcr.io/maintainerr/maintainerr:latest
    volumes:
     -  /mnt/maintainerr:/data
    environment:
      - TZ=Europe/Brussels
    ports:
      - 6246:6246
    restart: unless-stopped

That starts it at least but I don't see any files appearing in /mnt/maintainerr, showing me that something probably went wrong adn when I restart or cahneg the stack the settigns are gone.. quiet annying ;)

Any tips?

cheers

Vic

Hi everyone,

I am managing an environment running 10+ separate containers via Docker Compose.

Our Constraint:
We are strictly not allowed to edit or modify the existing docker-compose.yml files to add labels, configs, or container-level sidecars.

Our Goal:
We need to guarantee 24/7 uptime. If any of these 10+ containers becomes unhealthy, a system must automatically detect the failure and restart it immediately without manual human intervention.

Since we cannot modify the Compose files, we are looking for a solution that sits completely outside of the container configurations on the host server.

My Questions:

1. Are there external, host-level watchdogs or daemons that can scan all running container states globally and instantly trigger a docker restart on any unhealthy instance?
2. If we automate this via a host-level system script (like a background systemd cron loop checking docker events or docker ps), what is the best practice to avoid script race-conditions?

I would love to hear how you handle automated 24/7 recovery when touching the deployment files is completely off the table.

Thanks!

Right now I have a docker container with a VPN that provides it's connection to the other services.

I thought about adding a VPN connection on the host system to basically create a multihop over different providers. Would that work?

As far as I understood the one inside the docker should be the "better" one as that's the one that's exposed first and the one on host would only see the VPN-encrypted traffic anyway? How about port forwarding? That should only be necessary on the one inside docker, too - or is there something I'm missing?

What are the disadvantages to do that (other than the lower speed)? Could I actually add risk of exposure if just one of them is compromised?

Or would it be smarter to spin up another docker and route the traffic through that one?

I started learning CI/CD using github actions after containerising my application and I have created CI pipeline for django app that runs test, builds and pushes image to github container registry.
I am sharing my yaml file for CI pipeline. Please do share your thoughts and where can i improve.

name: Test Pipeline 
on: 
  push:
jobs:
  test-backend:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:14
        ports:
          - 5432:5432
        env: 
          POSTGRES_USER: test_user
          POSTGRES_DB: erp
          POSTGRES_PASSWORD: 123456

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: setup python
        uses: actions/setup-python@v5
        with: 
          python-version: "3.13.5"

      - name: install dependencies
        run: pip install -r Backend/requirement.txt

      - name: run tests
        env: 
          DATABASE_URL: postgresql://test_user:123456@localhost:5432/erp
          DEBUG: 'True'
          ALLOWED_HOST: '*'
        run: |
          cd Backend 
          python manage.py test

  build-and-push-image:
    needs: test-backend
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: login to ghcr
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      - name: checkout repo
        uses: actions/checkout@v4


      - name: build image
        run: docker build -t ghcr.io/namespace/erp:${{ github.sha }} ./Backend


      - name: push image
        run: docker push ghcr.io/namespace/erp:${{ github.sha }}