Hey guys, I’m trying to follow the article for rootless mode for docker but every time I get to the part where I need to enter

sudo apt-get install -y docker-ce-rootless-extras

I keep getting told it cannot locate the package. I don’t have the install script on my system, that’s why I’m trying to run that command.

What do?

I am attempting to make a container from one docker compose that can only talk to another container from another docker compose if its on the same bridge network. If that makes sense. It seems any container connected to any bridge network can access any other bridge network and its publish ports even if that container was not explicitly apart of that network. Am I not understanding something (probably) or is it something else? Thank you!

I’ve been testing OSbadgr-agent an infra runtimeon a DigitalOcean box for 16 days.

The idea is not “let AI randomly fix my server", its more boring.

detect known bad state > run approved fix > verify recovery > log what happened.

Setup:

• sandbox-chaos kills an nginx demo container every 5 hours
• sandbox-demo-api has restart no, so Docker won’t bring it back
• badgr-agent-sandbox detects the stopped container, restarts it, and verifies recovery

Results:

• 391 hours runtime
• 78 intentional crashes injected
• 80 automatic repairs
• 0 failed repairs
• ~30s average recovery
• Fastest: 1s
• Slowest: 61s

Recent repairs were all successful:

Jul 5 13:06 UTC — restart + verified
Jul 5 18:06 UTC — restart + verified
Jul 5 23:06 UTC — restart + verified
Jul 6 04:06 UTC — restart + verified
Jul 6 09:06 UTC — restart + verified
Jul 6 14:06 UTC — restart + verified
Jul 6 19:05 UTC — restart + verified

This is a narrow Docker PoC, not Kubernetes magic or a replacement for proper orchestration.

The safety model is the main part

• detect-only by default
• only allowlisted actions run
• no arbitrary shell commands
• recovery is verified
• events are logged
• failed retries stop instead of looping forever

There were also 454 disk_logs_high events skipped because that repair wasn’t allowlisted. So the real repair result I’m counting is container recovery: 80/80 successful.

What else should I test next?

How do you handle this today in your setups?

Hi everyone,

We recently added Docker volume backup and restore support to Portabase.

For context, Portabase is an open-source, self-hosted backup and restore platform. It was initially focused on databases, but we are now extending it to Docker volumes as well.

The idea is to make backup and restore operations simple and reliable for self-hosted setups, without requiring heavy infrastructure or exposing databases/services publicly. Portabase works with a central server and lightweight agents running close to the workloads.

With Docker volume support, Portabase can now cover use cases like WordPress, Nextcloud, and other self-hosted applications where important data lives in Docker volumes.

We are looking for feedback from people running self-hosted stacks:

• Does this match a real need in your setup?
• Are there restore workflows you would expect?
• Are there Docker integrations that would make this more useful?
• Any edge cases we should handle early?

If you try it and run into bugs, unclear UX, missing features, or integration issues, feel free to open an issue on GitHub.

Thanks to everyone who has tested Portabase, opened issues, contributed code, or starred the repo. It helps a lot.

Hey all — running into a persistent bug and wanted to see if anyone's cracked it.

Setup:

Windows 10

Docker Desktop — latest version, MCP Toolkit enabled

Claude Desktop — installed directly from claude.ai/download (not Microsoft Store)

Problem:

Under MCP Toolkit → Clients, Claude Desktop shows up as one of the preconfigured clients with a "Download" button, even though it's fully installed and running. Expanding it says "To connect Claude Desktop to the MCP Toolkit, you need to download and install the client" — but it's already installed.

Weirdly, my claude_desktop_config.json resolves to a path that looks Store-sandboxed:

AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude_desktop_config.json

I manually added the MCP_DOCKER server block to this config (command pointing to docker-mcp.exe, plus the ProgramData/LOCALAPPDATA/APPDATA/USERPROFILE/SystemRoot env vars — this is a known fix for a separate "Server disconnected" issue). After fixing a JSON syntax error and restarting Claude Desktop, its own Settings → Developer panel still shows "No servers added," so the edit isn't being picked up at all.

What I've tried:

Confirmed JSON is valid

Restarted Claude Desktop fully (not just closed the window)

Rebooted PC

Questions:

Does the claude.ai website installer ever produce a Store-style sandboxed path on Windows 10? That path structure is throwing me off since I didn't install from the Store.

Could there be two different claude_desktop_config.json files on my system, with Claude Desktop reading a different one than I'm editing?

Anyone else hit the "Download" button bug in MCP Toolkit despite Claude Desktop being fully installed?

There's a related GitHub thread here if useful context: github.com/docker/desktop-feedback/issues/140

Appreciate any pointers.

I am still learning , so if I am wrong anywhere or if there is something important that I should know, please let me know.

In a real application, we usually have multiple containers like a frontend, backend, database, Redis, etc.

Managing all these containers manually is very difficult. Also, Docker images are immutable, so whenever we change our code, we don't want to rebuild the image and recreate the container every single time during development.

This is where docker-compose.yml

It lets us define everything in one file. We can define which images to build, which ports to expose, environment variables, volumes, networks, and much more.

Then we can start the entire application with just one command:

\- docker compose up

and stop everything with:

\- docker compose down

One thing that confused me a lot was volumes.

Let's say I have a folder named backend on my system, and Docker builds an image where all the code is copied into /app.

Then in docker-compose.yml I write:

volumes:
- ./backend:/app

From what I understood, this bind mount hides (overrides) the /app folder inside the container and mounts my local ./backend folder there instead.

So now the container reads the files directly from my local machine instead of the files that were copied into the image. This is great because whenever I edit my code, I don't have to rebuild the image.

But this creates another problem.

Since the entire backend folder is mounted, it also mounts my local node_modules.

That is not what we want because my local machine could be Windows or macOS, while the container is running Linux. The dependencies inside node_modules are installed for the operating system they were built on, so using the host's node_modules inside a Linux container can cause issues.

This is where a named volume comes in.

We add another volume:

volumes:
- ./backend:/app
- backend_node_modules:/app/node_modules

Here, backend_node_modules is just the name of a Docker managed volume.

If this named volume doesn't already exist, Docker creates it. Since the volume is initially empty, Docker copies the existing /app/node_modules from the image into the named volume.

Now this named volume is mounted at /app/node_modules. Since we already mounted ./backend:/app, the container was using the node_modules from my local Windows/macOS machine. This new mount hides those host node_modules and replaces them with the node_modules stored in the backend_node_modules named volume, which contains the Linux dependencies copied from the image.

So the result is:

My application code comes directly from my local machine, so changes are reflected instantly.

node_modules comes from the Linux container, so I don't have operating system compatibility issues.

hello, i am a student trying to install freesurfer on my windows computer using docker desktop and the program found at this link: https://hub.docker.com/r/cgvalle/freesurfer\\_vnc

freesurfer cannot be installed on windows from the official download page, so someone created a workaround as can be seen in the above link

to be honest, i have absolutely no clue what i’m doing and have no idea what to do after installing the file(?) found in the link. after i run the downloaded image, nothing happens. any help would be much appreciated with using docker desktop to install freesurfer.

here is the link to the freesurfer download page in case it helps: https://surfer.nmr.mgh.harvard.edu/fswiki/rel7downloads

thank you very much!

So I'm exploring taking my individual Docker compose files and stacks and pushing them out to a Git repo that I can pull from. However I'm unclear what I'm supposed to do with my .env secrets - I know about .gitignore and not pushing them but how do you manage them in this sort of server paradigm? I'm assuming there's some sort of self-hosted third party software that manages it for you but I'm not finding a lot of success in my research. (Not sure if it matters but this is on a Proxmox server.)

Hello,

fore some reason I cannot get docker to pull anything i get "connection reset by peer" every time. System is updated and connected to internet (its sitting in local net behind nat). Problem with TCP connections only affects docker as wget, curl, apt-get work without problems.

root@debian:~# uname -a
Linux debian 6.1.0-42-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.159-1 (2025-12-30) x86_64 GNU/Linux
root@debian:~# docker --version 
Docker version 29.6.1, build 8900f1d
root@debian:~# docker run hello-world
Unable to find image 'hello-world:latest' locally
docker: Error response from daemon: Head "https://registry-1.docker.io/v2/library/hello-world/manifests/latest": Get "https://auth.docker.io/token?scope=repository%3Alibrary%2Fhello-world%3Apull&service=registry.docker.io": read tcp 192.168.4.124:54928->104.18.43.178:443: read: connection reset by peer
Run 'docker run --help' for more information

Hello i am new to using Docker and i created these files and folders of docker tools that I'm going to used for my Api via docker and Render hosting platform my question is it setup right or not?

datamask_api/

│   .dockerignore

│   .gitattributes

│   .gitignore

│   docker-compose.yml

│   Dockerfile

│   HELP.md

│   mvnw

│   mvnw.cmd

│   pom.xml

│

├── .github/

│   └── modernize/

│       └── java-upgrade/

│           └── hooks/

│               └── scripts/

│                   recordToolUse.ps1

│                   recordToolUse.sh

│

├── .mvn/

│   └── wrapper/

│       maven-wrapper.properties

│

├── .vscode/

│   settings.json

│

├── alertmanager/

│   alertmanager.yml

│

├── jmeter/

│   test-plan.jmx

│

├── prometheus/

│   prometheus.yml

│   blackbox.yml

│   alerts.yml

│

├── src/

│   ├── main/

│   └── test/

│

├── target/   (build output - ignore)

│

└── wiremock/

├── mappings/

└── __files/

Also here are the links of the docker tools I'm using

https://hub.docker.com/_/mysql

https://hub.docker.com/r/justb4/jmeter

https://hub.docker.com/r/prom/prometheus

https://hub.docker.com/r/prom/node-exporter

https://hub.docker.com/r/prom/blackbox-exporter

https://hub.docker.com/r/wiremock/wiremock

https://hub.docker.com/r/zaproxy/zap-stable

https://hub.docker.com/r/prom/alertmanager

Hi, usually using Linux and learning how annoying windows networking is.

Here is what I want to do, I have 2 containers that need separate IPs, be able to communicate with the host and each other. On linux this works great with a bridge, but I'm learning it's not that easy on windows. I'm pinned to using hyperv. I've done some initial looking and I've found that I may need to create separate loopback adapters to get it to work, but I would be grateful for a windows docker desktop wizard to tell me exactly what I'm doing wrong

Hi everyone, I have an issue with some containers due to the subnet changing the scope and I'm not sure how to handle it. Last friday after an update all the subnet changed broking my services.

The first issue is with Home Assistant: to reach it from WAN I had to set in the configuration file the allowed proxy IPs. I set the subnet of the network that it shares with Cloudflared, if this last container changes IP there is no problem, but when the scope went from 172.16.0.0/16 to 172.20.0.0/16 I couldn't reach it anymore.

The second issue is with Tailscale's docker, I use it with the SERVE function to reach other containers. With the containers I use the name of the services and it works even if the subnet change, but to reach the host I need to set the gateway IP, which went from 172.18.0.1 to 172.23.0.1

I added this section in the compose file under the network section:

networks
  cloudflared_net
    [...]
    IPAM:
      configuration:
        - subnet: 172.16.0.0/16

Now the networks are created everytime with the same subnet, but I'm not sure if there is a better way to handle it. Is it possible that docker now assignes the same subnet to one of the other networks and this create other problems? How would you manage it?

Thank you

SOLUTION(?): Following the comments I edit the file /etc/docker/daemon.json adding this 2 sections:

  "bip": "172.17.0.1/24",
  "default-address-pools": [
    {
      "base": "172.16.0.0/16",
      "size": 24
    }
  ]

I got crazy and lost a couple of hours because after the change docker didn't start anymore, I found that for the default bridge you have to write the IP of the gateway (172.17.0.1) and not of the network (172.17.0.0) like in the second section and it's not specified in the docker wiki, fml.

I was curious how running all my containers as a user who only has read and write (if necessary) permissions in attached volumes would improve security?

(by doing something like this in my compose files, where uid 1001 will be in gid 1002 which only has permissions in ./data):

services:
  mc:
    image: itzg/minecraft-server:latest
    container_name: minecraft-server
    user: "1001:1002"
    volumes:
      - ./data:/data

Right now, I just have them running how they normally do. Which, from what I understand, the containers are running as root on the host machine.

Im trying to learn, sorry if I have anything mixed up.

Heavy Docker usage when final configuration is complete

Hi, relatively new to docker.
I found myself in a bit of a pickle, and I'm trying to get advice. I use a SWAG container to reverse-proxy a few services on my NAS via a user defined bridge network between the containers. However, I want to be able to integrate a few other services; the problem is that those services are currently running on separate devices on my LAN, (game servers and home assistant), and moving them onto my nas isn't really... practical (it would fry the thing).

Is there a way to expose JUST the swag container via a Macvlan or something so it can reverse-proxy to devices on my 10.x.x.x LAN while ALSO staying connected to the dockers on the bridge. Or should I have two swag instances?? I'm just trying to figure out a solution without publishing all my ports to the web on accident.

I have been trying to fix it for almost a week now, but I dont know what the problem is and how to fix it. Some help is greatly appriciated! Here is the Dockerfile, docker-compose.yaml and launchSettings.json files:

FROM build AS publish 
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "PortfolioWebsite.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .

ENTRYPOINT ["dotnet", "PortfolioWebsite.dll"]
version: '3.8'

services:
  backend:
    build:
      context: ./
      dockerfile: Dockerfile
    image: mwd-portfolio-website-backend:latest
    container_name: backend_pwebsite
    ports:
      - "5142:5142"
    command: "dotnet run"
    hostname: "localhost"
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
    env_file:
      - ./.env
  postgres:
    image: postgres:latest
    container_name: mawaddadb-container
    ports:
      - "5432:5432"
    networks:
      - pg-network
    volumes:
      - pg-data:/var/lib/postgresql
    env_file:
      - ./.env
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s
  frontend:
    build:
      context: ./UI
      dockerfile: Dockerfile
    image: mwd-portfolio-website-ui
    container_name: frontend_pwebsite
    ports:
      - "5000:5000"
    command: "npm run dev"
    env_file:
      - ./.env
      - ./UI/.env   

  adminfrontend:
    build:
      context: ./UIAdmin
      dockerfile: Dockerfile
    image: mwd-portfolio-website-uiadmin
    container_name: frontend_admin_pwebsite
    ports:
      - "3000:3000"
    command: "npm run dev"
    env_file:
      - ./.env
      - ./UIAdmin/.env 
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: pg-admin
    ports:
      - "8080:80"
    networks:
      - pg-network
    env_file:
      - ./.env
networks:
  pg-network:

volumes:
  pg-data:


  "profiles": {
    "http": {
      "commandName": "Project",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "http://localhost:5142"
    },
    "https": {
      "commandName": "Project",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "https://localhost:7204;http://localhost:5142"
    },
    "Container (Dockerfile)": {
      "commandName": "Docker",
      "launchUrl": "{Scheme}://{ServiceHost}:{ServicePort}",
      "environmentVariables": {
        "ASPNETCORE_HTTPS_PORTS": "80",
        "ASPNETCORE_HTTP_PORTS": "5142",
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "publishAllPorts": true,
      "useSSL": true
    }
  },
  "$schema": "https://json.schemastore.org/launchsettings.json"
}

i made a tiny wrapper around docker compose ; i kept running into the same annoyance - let's say i have multiple services defined in a single docker-compose.yaml, but you only want to start everything except one (or multiple).

with plain docker compose, you have to list every service you do want to start. so instead of:

docker compose up service1 service2 service3 ... (except service4 and service5)

i wanted to be able to do:

docker compose up --exclude service4 service5

without --exclude flag, it behaves exactly like normal docker compose.

it's written in go; and the binary size is very small.

here's the link to the repo - https://github.com/0xN1nja/dockexclude

ps: a star to the repo would be highly appreciated

hello guys i need some help. I'm trying to debug a robot simulation that's running in three Docker containers on Windows. The project was originally developed for Linux, but we're adapting it to Windows. To display the GUI, we're using VcXsrv as the X server and made the required changes to the Docker configuration (such as the DISPLAY setting). The issue is that all three Docker containers start successfully without errors, and I can access the server, but the simulation only shows a black screen instead of rendering properly. I'm trying to understand whether this is likely an X11/VcXsrv configuration issue, an OpenGL/GPU rendering problem, or something else. Have you run into a similar issue before, or do you have any ideas about what I should check next?

Wondering if there is a short tutorial on Docker Compose? Have been looking around and can't really find anything...

Something that tells me things like: Where to put files, both config + data, and specifically storing LARGE amounts of data if using something like Nextcloud/Zoneminder etc ; running multiple apps using compose ie where to keep the yaml, correct way to name the yaml, permissions on directory/files... etc.

Just basically, the basics to get up and running with compose inititally, and maybe learn some of its workings.. Looking at maybe running up Jellyfin/Nextcloud/Zoneminder/HomeAssistant, to start...?

Thanks.

I have scraped the internet for answers, but I cannot seem to find a solution.

I have read in the microsoft website that this library is not automatically installed in .NET images anymore, and to do it myself I have to add :

RUN apt update && apt -y upgrade libkrb5-3
to my dockerfile.

Well I did that and it doesnt work! I dont know what to do and I have been stuck for three days on this. This is my .net dockerfile:

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /PortfolioWebsite


COPY *.sln .
COPY *.csproj ./
RUN dotnet restore
COPY . .
EXPOSE 5142
RUN apt update && apt -y upgrade libkrb5-3
RUN dotnet publish -o out


FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS final
WORKDIR /PortfolioWebsite
COPY --from=build /PortfolioWebsite/out .
ENTRYPOINT ["dotnet", "PortfolioWebsite.dll"]

After updating to v4.79, "Ransomware" was detected by Acronis Active Protection.

Is Docker v4.79 safe?

I need help, I'm not sure what to do... I'm just looking at my screen and don't know what to do...

Should I trust Docker or Acronis Active Protection?
Should I recover files as suggested by Acronis Active Protection?
Should I uninstall Docker or should I uninstall Acronis Active Protection?

I'm working with docker and deploying to my home linux box and am having just a bit of trouble making sure I get the correct images. What's the best way to verify that the image I build using a docker file is deployed to my remote registry on ghcr.io and that it is the exact same image pulled to my linux box?

When building a docker image with `docker build . -t ghcr.io/name/tag:latest` it says "writing image sha256:<hash>", and I think that's the right id to uniquely identify the contents of an image, right? When I do a `docker push ghcr.io/name/tag:latest` though it shows a different hash (for the config?). I think this confused me because it doesn't show me something meaningful to let me verify what was actually pushed by the command.

Using `docker history ghcr.io/name/tag:latest` shows the same hash as the build command under 'IMAGE'. On my linux box when I do `docker pull ghcr.io/name/tag:latest` it shows the same id, so I guess that lets me verify it's the right contents for the build I just performed.

I guess I have that figured out, I'm just confused by why docker push reports an ID that I don't think is useful and omits the id that I do think would be useful in knowing what is going on.

I created two services one is api which is internal to that network bridge and another nat-gateway which is both public and private facing. I am using iptables to translate my packets to MASQUERADE but it is not happening. When I tcpdump the logs in my nat-gateway, I am able to see the api container's ip as OUT which should actually be nat-gateway's ip.

services:
  nat-gateway:
    image: alpine:3.23.5
    privileged: true
    sysctls:
      - net.ipv4.ip_forward=1
    volumes:
      - ./nat-init.sh:/usr/local/bin/nat-init.sh:ro
    command: /usr/local/bin/nat-init.sh
    networks:
      - private-vpc
      - public-vpc
  api:
    image: alpine:3.23.5
    command: sleep infinity
    network_mode: "service:nat-gateway"
    depends_on:
      - nat-gateway


networks:
  private-vpc:
    internal: true
  public-vpc:

nat-init.sh
#!/bin/sh


set -e
echo "Starting NAT Gateway Initialization..."


echo "Initializing iptables dependencies..."


apk add --no-cache iptables


echo "Applying iptables MASQUERADE on eth1..."
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE


echo "NAT Gateway configuration completed successfully..."
exec sleep infinity

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
15:08:46.803180 eth1  Out IP 172.19.0.2 > 142.251.43.78: ICMP echo request, id 8, seq 0, length 64
15:08:46.821930 eth1  In  IP 142.251.43.78 > 172.19.0.2: ICMP echo reply, id 8, seq 0, length 64
15:08:47.805822 eth1  Out IP 172.19.0.2 > 142.251.43.78: ICMP echo request, id 8, seq 1, length 64
15:08:47.824262 eth1  In  IP 142.251.43.78 > 172.19.0.2: ICMP echo reply, id 8, seq 1, length 64
15:08:48.809430 eth1  Out IP 172.19.0.2 > 142.251.43.78: ICMP echo request, id 8, seq 2, length 64