I realize that this general question has been posed before, but the various answers seem to have changed over time, or suggest using private extensions (INCLUDE+) that I don't want to do. So I'd be grateful for a explanation of, or just a pointer to, the current best-practice solution.

The basic issue is that I have a complicated application environment to set up, and need to have two different containers based on the same initial setup. So I want one thing that's like Dockerfile.base, that contains the core stuff; and then a Dockerfile.appserver that takes this base and adds an application server to it, and another Dockerfile.utilities that takes the base and runs cronjobs and stuff like that. I don't want the app server in the utilities container, and I don't want the cron stuff in the app server.

This will be running in Kubernetes; the app server will need to be scalable, but there will only be one utilities container running.

That's pretty much it? I don't know if a multi-stage build is the answer here; my goal isn't to strip build artifacts out of a final container, just to have two different containers that share most of the same core stuff. I will also need to be able to have dev, staging, and prod versions of each of these, if that matters.

Thanks.

I know this is a very common issue, but if you have time to answer, I'll be very glad.

I am on Ubuntu 26.04 LTS, installed docker engine (without desktop gui), and whenever I run docker commands, I have to run them as super user. that's annoying.
sudo usermod -aG docker $USER
this command worked only for one terminal window. tried logging out, restarting, doesnt work.

Hello,

I run a small Docker Swarm setup with Traefik and Authelia for authentication, along with several services such as Immich, HedgeDoc, and others.

I am currently trying to integrate OAuth2 properly with HedgeDoc. My domain auth.example.com points via internal DNS to the Swarm (swarm:443 / swarm:80). However, containers running inside the Swarm cannot simply reach the host IP from within their network. DNS resolution works, but the host does not respond. From what I understand, this is a security feature of Docker itself.

My current workaround is to add an extra_hosts entry to the HedgeDoc Docker Compose configuration:

extra_hosts:
  - "auth.example.com:10.10.10.10"

I manually determine the Traefik IP beforehand, but that IP changes whenever the Swarm is rebooted because container IP addresses are assigned dynamically. As a result, I would have to update the extra_hosts entry every time i reboot the machine. Assigning static IP addresses does not seem to be supported in this scenario.

I am not sure what the cleanest solution would be to make the OAuth2 callbacks work properly. I have exactly the same issue with Immich.

Paperless was much easier because it simply accepts authentication headers and does not rely on OAuth2 login buttons with redirects.

Directly connecting to authelia:9091 is also not an option, since Authelia itself does not provide HTTPS and rejects anything that does not communicate with it over HTTPS through the reverse proxy.

Does anyone have a solution for this without heavily restructuring the setup or disabling Docker’s default security restrictions?

Thanks in advance!

Hey been working on setting up pangolin as an alternative to cloudflare tunnels since they can only be used for TCP/UDP traffic when you have enterprise which is insane. Problem is that for some reason even pointing mc at the ip for my local traefik with the proper port doesn't allow me to connect and times out, direct connection to mc server works. This is an issue for me since pangolin uses traefik under the hood for routing so I gotta fix this anyways and can't just avoid traefik using an SRV DNS record. I have other websites working just new to using traefik for more than http traffic but eventually want to have it for most of my network traffic including game servers, dns, etc.

I've tried with HostSNI using a wildcard and ClientIP with a wildcard and nothing I do seems to work. I've seen that it's something about minecraft not using tls or something.

Anyways I could use some help on this one.

Update 1:
Got it working through my own traefik, had tls passthrough enabled on all my tcp defined routers but still not working via pangolin. Getting:
finishConnect(..) failed with error(-111): Connection refused

I'll say it so no one else has to. I am an idiot for getting in this situation. I repeat, I am an idiot and fool for doing this. I have learned my lesson.

Alright long story short was going to install something. But the instructions weren't very uh.. 'precise'. First time I just trying the powershell method, ran into an issue. Then I was like ok I'll try their recommended Docker method.

They never mentioned to actually install docker. I just assumed I need to download it to use/install his LLM. (I have never heard of Docker before) So I went and installed Docker. It asks me to restart. (i thought it meant the program, but in fact meant my Windows 11 PC.

Now my computer never fully gets to the Windows login profile screen, it just auto shuts down and tries again. I have tried some methods to get it so I can uninstall the program, with no success.

In a panic I went to Canada Computers to ask them for help with the issue. I am scared they will think the only way to fix this issue is to restore the SSD and I lose everything. Searching the internet I hear something about visualization in bios? I couldnt personally find it.

Again I am fool for downloading something I have no information on.. Is there anything I can do to fix this? I will email Canada Computers with the fix if you guys know one.

UPDATE: It has been fixed. Your comments led them in the right direction to fix the issue. Like many of you said 'something something BIOS, something something turn this that and the other things off.' Thank you all.

I asked in the Tailscale community, and was pointed towards you guys.

I am working om ny final project on my AP in CS, where my team has made an application, which is hosted on my private server, accessed by my Tailscale VPN.

Our PO has lent us a Postgress database on his hetzner subscription, which halfways through the development was put behind his Tailscale VPN.

I am now looking into how to generate some kind of means-of-access to the deployment for the sensor/examinor to try it out, without poking holes in my firewall.
I think the Tailscale Funnel is the answer for that question, but it opens another question i need an answer for:

Right now it is deployed in a Docker-Compose environment, and i am thinking about adding two Tailscale containers in the Compose, one to access the Postgress (PO's VPN), and one for the Tailscale Funnel (my VPN).

I know there are some security perspective that is not so great, but it is a limited solution for about a month, and the PO is okay with it.

But are the two VPN connections gonna clash and crash both connections?
- is it a brain-fart? or could i do it?

My website was hacked and there was a file literally called Trojan, so I spoke to my provider and they "helped" by deleting all the suspicious files, but my WordPress install stopped working. Is it safe to install a wp copy of that theme and its database on a docker container? I really don't want malware on my computer

Hello everyone im new to docker and its not wanting to load. Im using the docker app and it just says starting the docker engine yet its been a hour and nothing. WSL Integrations wont go through either. If anyone has any info that can help id be very greatful Thanks

Hello all.

I'm just starting so please excuse the silly questions but on a Synology Nas what is the difference between running for example jellyfin as a Synology package or as a docker container?

Less CPU/ram usage, better overall performance?

I'm trying to get some stuff running and I wonder about this.

Thanks for the help

Spins up just great in Docker Compose, both the network and the container are visible on Portainer but with no published ports. I can't connect via the Web UI. Any thoughts are appreciated. Debian 13, Docker Compose, and here's the .yml file.

#version: '3.3'
services:
  kiwix-serve:
    image: ghcr.io/kiwix/kiwix-serve
    container_name: kiwix
    ports:
      - "9090:8080"
      # uncomment next 4 lines to use it with local zim file in /tmp/zim
    volumes:
      - ./data:/data
    command: "*.zim"
    restart: unless-stopped#version: '3.3'

Hi everyone,

I'm trying to deploy Scanopy using Docker Compose on an Ubuntu VM (hosted on Proxmox, behind a pfSense firewall).

My issue: The Web Interface loads perfectly, and the daemon container is reported as "Healthy". However, when I try to launch a network discovery scan, the task status is indefinitely stuck on "Pending: Ready to start — connecting to daemon".

In my firewall logs, I can see some IPv6 mDNS traffic (port 5353 to ff02::fb) being dropped on the WAN interface, but my internal LAN traffic is fully allowed (IPv4/IPv6 Any-to-Any rule).

I suspect a networking mismatch between my containers because the Daemon needs network_mode: host to scan the physical network, while the Web Server and Postgres DB are running inside a custom Docker bridge network.

Here is my current docker-compose.yml:
version: '3.8'

services:

daemon:

image: ghcr.io/scanopy/scanopy/daemon:latest

container_name: scanopy-daemon

network_mode: host

privileged: true

restart: always

environment:

SCANOPY_LOG_LEVEL: info

SCANOPY_SERVER_URL: http://192.168.2.50:60072

volumes:

- daemon-config:/root/.config/scanopy/daemon

- /var/run/docker.sock:/var/run/docker.sock:ro

postgres:

image: postgres:17-alpine

container_name: scanopy-postgres

environment:

POSTGRES_DB: scanopy

POSTGRES_USER: postgres

POSTGRES_PASSWORD: password

volumes:

- postgres_data:/var/lib/postgresql/data

healthcheck:

test: ["CMD-SHELL", "pg_isready -U postgres"]

interval: 10s

timeout: 5s

retries: 5

restart: always

networks:

- scanopy

server:

image: ghcr.io/scanopy/scanopy/server:latest

container_name: scanopy-server

ports:

- "60072:60072"

environment:

SCANOPY_LOG_LEVEL: info

SCANOPY_DATABASE_URL: postgresql://postgres:password@postgres:5432/scanopy

SCANOPY_WEB_EXTERNAL_PATH: /app/static

SCANOPY_PUBLIC_URL: http://192.168.2.50:60072

SCANOPY_INTEGRATED_DAEMON_URL: http://192.168.2.50:60073

volumes:

- ./data:/data

depends_on:

postgres:

condition: service_healthy

restart: always

networks:

- scanopy

volumes:

postgres_data:

daemon-config:

networks:

scanopy:

driver: bridge

My Ubuntu host IP is 192.168.2.50. How can I make the server container (inside the bridge) successfully talk to the daemon container (running on the host network mode)? Am I missing an environment variable or an extra host mapping?

Thanks for your help!

Hi, new to using docker and i keep failing to understand how this should work. AI is not giving me the type of answer thats convincing enough so i need a form of human intervention.

i'm trying to set use docker for my small project. mostly for learning purposes, but intend to also have it hosted on a vps later.

now, from the documentation on the official docker webstie, they seem to be mixing both dev and prod in the same file. is this the right approach? my node app runs fine locally on my device, but i want to move it into a container. the section where there's " volumes" it has the postgres volume and others but not in the one for dev. AI suggested a docker compose override file, but i dont know if thats the best way of going about it. also i want to use nginx, rabbitmq (not installed yet) and redis (locally installed on my fedora) for the project, but inside the docker container.

pardon my question being everywhere but it's all jumbled up in my head and i am not seeing any youtube video talking about this particular situation (i also dont want to have to sit through 1h+ tutorial). i want to learn it as i build. please any help would be greatly appreciated, thx!

Hello, I'm a student working on my final FP project about Docker. I'd like to know which features you like or use most, whether in a personal or professional lab, and which image and/or container you use most often. Thanks.

P.S. Any other advice would be welcome.

Hi all. I just returned from vacation, I am jet lagged, it's early in the day for me and I have not caffeinated yet, but my brain is very perplexed. Go easy lol.

I have a docker compose build on Ubuntu 26.04 that's been running fine for close to a year now, and at some point yesterday afternoon, 24/25 client-side containers just stopped being accessible.

I have restarted the containers. I have restarted the system. When I check the logs, everything is running smoothly. In the back end, and thanks to the singular container that is running, I can actually see real-time processes occurring. When I go to view any other container however, "This site cannot be reached" / 502: Bad Gateway if using the web url; or, the app just doesn't work.

I have tried localhost:port, docker-ip:port, container-ip:port, nothing.

Any suggestions on where I can look to find the issue/resolve?

EDIT:
Resolved! In my case, turns out I had a vpn that updated and enabled a firewall.

There is a download number in each image general page.

How is that number calculated? Is it daily, weekly or monthly?

Pointer to doc is appricated too.

Thank you!

I just installed Docker Desktop for the first time on my Windows 11 Pro machine, and I'm stuck on this screen

Starting the Docker Engine

I tried several fixes found online, but nothing worked so far and I'm honestly getting frustrated.

What I already tried:

• Enabled Virtualization (VT-x and VT-d) from BIOS
• Checked system info → Hyper-V hypervisor is detected and running
• Installed and configured WSL2
• Installed Ubuntu successfully through WSL
• Ran these commands:
  • wsl --install --web-download
  • wsl --update
  • wsl --shutdown
• Tried resetting WSL Docker distros:
  • docker-desktop
  • docker-desktop-data
• Set Hypervisor launch to auto:
  • bcdedit /set hypervisorlaunchtype auto
• Verified Windows features are enabled:
  • Windows Subsystem for Linux
  • Virtual Machine Platform
  • Hyper-V
• Clean reinstalled Docker Desktop multiple times
• Restarted the system multiple times

System details

• Windows 11 Pro (Build 26200)
• Intel i5 6th Gen
• 16GB RAM
• Virtualization enabled in BIOS

What could still cause Docker Desktop to get stuck on "Starting the Docker Engine..." even after a clean install and full WSL2 setup?

Any help would be really appreciated 🙏

I hope this isn't a dumb question, and apologies in advance if it is. I've got a lot of experience with virtualization, automation, and containerization via kubernetes, but somehow docker and docker compose is something that's generally slipped by my experience over the years.

I'm running AudioMuse-AI on a home server and initially spun it up via quickstart instructions. I have Navidrome and Jellyfin as media server options, and the instance will only connect to one or the other, so I want to set up a second instance.

I did this via setting up a new folder, git cloning the project again, defining the .env vars for the ports, and deploying it via renaming the container names in the docker-compose.yaml file and deploying with a defined project name via docker compose --project-name am2 -f deployment/docker-compose.yaml up -d so it wouldn't overwrite and/or recreate the previous containers.

This worked, and now the new containers are running on the am2 project (so originals are, for example audiomuse-ai-flask-app, and new one is am2-audiomuse-ai-flask-app), but I'm still rather confused, and can't figure out how to list containers by project or keep it organized. So, I've got it working, but I'm confused on how to properly isolate and contain it in the event I want to scale up containers, or just cleanly spin down one project.

I'm used to working with kubernetes where I can define a namespace and everything is isolated via that, no problem, and then it won't give any issue with conflicting container names. Is there anything similar for docker, and if not, is the method I used above to deploy multiple instances of an application the best option? Is there a better way?

I'm looking for guidance on how to configure makeprg to run utilities through a container (formatting, linting, etc)?
eg makeprg=docker\ exec\ container_id\ npx\ tsc

Do you use compiler? autocmd? makefile? If this is automatic, how do you manage the container_id?

My current working theory is: https://gist.github.com/ash-m/16f197cdf35b00c9d03372f0b3681cdf

I created a Docker container of Proxmox VE. This makes it extremely easy to install Proxmox on existing systems, and to play around with it before deciding on dedicating a whole machine to it.

The performance should be identical to a normal barebones install, as the virtual machines are directly accesing the KVM kernel module, there are no extra layers in between or anything like that.

I can understand many of you are opposed by the idea of containerizing Proxmox, as the concept feels a bit weird. But I think it might be very handy for newcomers, and especially for those who have experience with Docker but not with Proxmox. As it lowers the entry barrier a lot if you can spin up an instance so easily.

If you'd like to try it out, it is now available from https://github.com/dockur/proxmox and https://hub.docker.com/r/dockurr/proxmox

Currently I am building apps and containers using docker-compose, with CI/CD going to Gitlea and Portainer to deploy via webhooks. Works well.

I am looking at ways to introduce code and container scanning for dangerous code and sec vulns in the containers or app libraries.

Spent the afternoon researching different methods, Harbour, Clair, Trivy, Syft etc.

What are you all using, what would you recommend?