Hi all, hope you're having a great summer. I'm tinkering with Docker Swarm as a complete newbie and self taught homelab hobbyist, and I was hoping you could help me out with an oddity I'm facing at the moment.

I'm trying to deploy traefik as a centralized service on my home network, using Docker Swarm and an overlay docker network to discover services in other docker stacks that use traefik flags. Previously, Traefik was deployed alongside my other services on my media server, but since I'm scaling up my homelab, I prefer having one dedicated machine to act as a centralized reverse proxy that receives forwarded requests from my router on ports 80/443 and forwards them back to the right services on the right machine. Here's a convenient diagram that I made :

https://imgur.com/a/o55gBHJ

I have successfully created a master node on Vega, deployed Traefik as a global service accross the worker nodes, created an overlay network and attached each stack to it.

ℹ️Important note : on Vega, traefik is brought up using docker stack deploy -c docker-compose.yml traefik , and on my media server, I use docker compose up -d for deployment. I have seen mixed comments opinions online about the cross-compatibility of compose and swarm, but so far the "swarmed" traefik seems to discover compose services just fine.

Traefik seems to be generating SSL certificates just fine, and services are reachable, which is already a good sign.

❌My issue is that those certificates are never put to use. The acme.json file is still empty (I did chmod 600), and Firefox still throws a security alert at me because the backend service uses Traefik's default cert. Furthermore, docker service logs traefik_traefik returns nothing (except this error :

error from daemon in stream: Error grabbing logs: rpc error: code = Unknown desc = warning: incomplete log stream. some logs could not be retrievedfor the following reasons: node yryk8132s58wbul5u0q9e19hk is not available

Which is quite funny because docker node ls clearly shows the node as available and ready😂)

Below are my traefik yml file and config file, and an example compose file from my media server.

traefik-compose.yml

networks:
  traefik-net:
    external: true
services:
  traefik:
    image: traefik:v3.7
    #restart: always
    command:
      - --api.insecure=true
      - --configfile=/traefik.yml
      - --log.level=DEBUG
      # - --providers.docker
      # - --providers.docker.swarmMode=true
    ports:
      - "80:80"
      - "443:443"
      - "8081:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
    networks:
      - traefik-net
    deploy:
      mode: global

traefik config file

global:
  checkNewVersion: false
  sendAnonymousUsage: false


# Enables the web based api for testing, do not enable in production!
api:
  dashboard: true
  insecure: true


entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"


#Source of configuration. E.g Docker, Kubernetes..
providers:
  swarm:
  # Connects to docker via Unix socket
    endpoint: "unix:///var/run/docker.sock"
  # Containers must explicitely opt-in to Traefik routing via Docker labels
    network: "traefik-net"
  # Only containers on this Docker network are discovered
    exposedByDefault: false
# Uses Let's Encrypt to provide free SSL certificates
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /acme.json
      # Validates domain ownership via HTTP-01 challenge (uses the web entrypoint on port 80)
      httpChallenge:
        entryPoint: web

jellyfin-compose.yml (on my media server node)

networks:
  traefik-net:
    external: true
    name: "traefik-net"


services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    networks:
      - "traefik-net"
    labels: 
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.service=jellyfin"
      - "traefik.http.routers.jellyfin.rule=Host(`mydomain.jellyfin.fr`)"
      - "traefik.http.routers.jellyfin.entrypoints=websecure"
      - "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
      - "traefik.http.routers.jellyfin.tls=true"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - ./config:/config
      - /media:/media
    #devices:
      #- /dev/dri:/dev/dri #Use for Intel QuickSync
    ports:
      - 192.168.1.101:8096:8096
      - 7359:7359/udp #Service Discovery
      - 1900:1900/udp #Client Discovery
    restart: unless-stopped

(I've replaced my actual domain name and email with placeholders for obvious privacy reasons.)

I hope you guys can help me make any sense out of it XD

Cheers!

Hello, how can I get an invite to the Docker community slack ?

The official website has a short link https://dockr.ly/comm-slack which points to https://communityinviter.com/apps/dockercommunity/docker-community, which is dead since communityinviter changed their URL.

Thanks !

Hi, maybe can someone help me to run zeppos and zeus in an docker enviroment. I tried running ubuntu and nodejs in dockerfile but i cant start the login. Its not possible to connect host and container.

The TanStack compromise showed that supply chain attacks aren't going away. What Dockerfile practices do you consider mandatory today that you wouldn't have cared about 3–5 years ago?

youtu.be/KKRda0H4wTE

[Warning] Access denied for user 'user'@'localhost' (using password: YES)

i have been working on a project where i need to link nginx,mariadb and wordpress together . wordpress depends on mariadb and nginx depends on wordpress . i keep getting this error , any ideas what it could be and how i can fix it ? i have tried so many things that i have lost track of them at this point

Hi everyone,

Actually I am having issues with doker desktop (win11), I am trying to run RabbitMQ4 using docker, but it is not able to download/pull the image.
command - docker pull rabbitmq:4-management

it starts with downloading the layers but then it suddenly stops with an error

failed to copy: httpReadSeeker: failed open: failed to do request: Get https://production.cloudfront.docker...": EOF

I also tried to pull the docker pull rabbitmq:3.13-management, and the: docker pull postgres:17 commands but it also failed

But when i tried to pull the alpine, it worked successfully though.

then i decided to restart the wsl and again run the docker still it got the problem

if you have any suggestions please tell me.

Reddit I beg of your assistance again.

I got rootless docker to work now, I just reinstalled docker entirely and now I was able to get rootless mode to work fine.

Goal: have a playit tunnel running in one container, have a Minecraft server running in another container with docker in rootless mode

1) I have successfully done my goal above with docker being in rootful mode.

2) if I follow the same steps I did to get it to work in rootful mode I get the below error. I’ve spent days trying to figure out how to fix it. Please help

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF

I've used AI for Docker a lot lately, mostly for compose files, networking, volumes, containers, and other setup tasks.

One thing that's been driving me crazy is how often it gives me commands or configs that look completely valid, but when I check the official Docker docs they're either outdated, wrong, or don't even exist there.

A recent example was when I asked Gemini for the Docker commands to run a service (I honestly don't remember which service it was anymore). The AI gave me a command that looked perfectly reasonable, so I copied it, pasted it, and hit Enter without thinking too much about it.

It failed.

I spent another 10-15 minutes assuming I was the problem before finally checking the documentation. Turns out the command Gemini gave me wasn't even what the official docs recommended.

The worst part is that the answer sounded really confident. If you're learning Docker or working with something you've never used before, it's pretty easy to trust it and waste time debugging something that was wrong from the start.

Am I the only one running into this?

• What's the most ridiculous Docker mistake you've seen an AI make?
• Which AI do you notice it with the most?
• Do you trust the output and test it, or do you check the docs first?

I'd love to hear some examples because this keeps happening to me way more often than I'd expect.

I'm trying to really understand the distroless tradeoff before I move our services over.

I get the upside, way fewer packages and the scanner basically goes quiet. But then there's no shell, no package manager, sometimes not even the libc I expect. And when something breaks in prod at a bad hour, getting a shell in and poking around is pretty much what I do even if I'm not meant to.

Here's where I'm stuck. When it's a minimal image and the logs aren't enough, what do you do then. Spin up an ephemeral container? Keep a separate debug image around? What do you actually reach for.

Thanks in advance.

Docker image size question.

Got it from 3.18GB down to 965MB by trimming requirements.txt.

Turns out evidently was silently pulling in torch + nvidia-nccl — 300MB+ of GPU libs I don't even need for CPU inference lol.

But 965MB still feels heavy for a FastAPI serving container.

What am I missing?

Things I haven't tried yet:

→ multi-stage builds

→ python:slim vs alpine base

→ splitting dev deps (jupyter, matplotlib, seaborn) out of the prod image

→ pip install --no-cache-dir (already doing this)

If you've shipped lean ML/FastAPI images before, would love to know what actually moved the needle for you.

Building the mlops-credit-risk project in public and trying to get this production-ready, not just "works on my machine."

#MLOps #Docker #buildinpublic

I was just curious if I'm the only one who doesn't like logging in to things that I expect running locally.

Or does it need cloud resources?

Hi everyone, I’m completely stuck and would really appreciate some help.pleaseeeeeeeeeeeee anyoneeeeeeee😭

I’ve been trying to fix this for the last **5–6 hours** and have tried almost every suggestion I could find,usimg chatgpt claude..

# I’m currently learning Docker, and because of this issue I can’t continue learning.i neeed mysql image 😭

**Problem:**
Every docker pull fails with an error like:
failed to copy: httpReadSeeker: failed open: failed to do request:
Get "https://production.cloudfront.docker.com/...": EOF

Initially only mysql:8 was failing, but after reinstalling Docker, even hello-world fails with the same EOF error.

I can only pull small size images ,sometimes this also fails and large size images like mysql….. nahhhh straight NOOOoOo

**What I’ve already tried:**
Reinstalled Docker Desktop
Tried different Docker Desktop versions (including downgrading)
Restarted Docker Desktop and my PC multiple times
wsl --shutdown
netsh winsock reset
ipconfig /flushdns
Changed DNS (Cloudflare/Google)
Tried a different network (mobile hotspot)
Verified WSL2 is working
Tested CloudFront using curl inside Ubuntu WSL (it works)
Cleared all Docker data (0 images, 0 containers)
Deleted Docker files and performed a clean reinstall
Ran docker --debug pull hello-world (still fails with the same EOF error)

**System:**
Windows 11
Docker Desktop (WSL2 backend)
Docker Engine 29.6.1 (also tested another Docker Desktop version)
At this point I’m completely out of ideas. If anyone has experienced this exact CloudFront EOF error or has any suggestions, I’d really appreciate the help. This issue has completely blocked my learning.
Thank you!

Docker MCP Servers are configured to automatically connect to Claude Code etc

But the list excludes other exploitations as OpenWebUi

https://github.com/open-webui/open-webui

Hello everyone...

I am kinda new to docker, only knowing enough to get myself in trouble, and i am running a couple images/containers on my NAS.

So far so good and usually when there is an update on the software i use, i redeploy the the container with pulling newest release and it does, comes back up and is updated...

But this time, immich in my case, does not follow that rule...i saw that there is a new version out and the bug fixes address something i need to be fixed, so i decided to do as i always did...
Redploy with pulling newest release...it does something, says pulling, creating and done...

But nothing changed.

Here my compose file...

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    extends:
      file: hwaccel.transcoding.yml
      service: vaapi # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /volume1/photo:/usr/src/app/external_library_mount_point:ro 
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
      file: hwaccel.ml.yml
      service: openvino # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8@sha256:abc6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:abc63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always


volumes:
  model-cache:

Any tip is highly appreciated....thx alot up front

I've been trying to get caddy to work, but it seems like nothing will make things play nicely.

My docker compose:

  caddy:
    container_name: caddy
    image: caddy:latest
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    volumes:
      - ${CONFIG_PATH}/caddy/conf:/etc/caddy
      - ${CONFIG_PATH}/caddy/site:/srv
      - ${DATA_PATH}/caddy:/data
      - ${CONFIG_PATH}/caddy:/config

My Caddyfile:

jellyfin.local {
reverse_proxy jellyfin:8096
}

I've also tried localhost:8096, but neither will resolve in my browser, not with http or https. I want to set up several reverse proxies, but I want to figure it out with one first. I have checked the autosave.json, and any changes I make to the Caddyfile are coming through the program, but it doesn't seem to actually do the action of directing the address to the jellyfin page.

Any help would be greatly appreciated.

Is it still possible to use docker-compose with a workaround on GCP more recent Container OS?

I am trying to build a auto job extracter and using this project with the help of ChatGPT to understand few thing. I have to mention I am not a CS/developer or an IT guy. I am into Logistics but always try to tinker stuff to expand my understanding of computers and this Project seems really really fun (and practical) to me. So NOOB.

After few hours of Chatgpt troubleshooting.
Docker Works. WSL works. Small downloads work. Large download (from Wifi or Mobile Hotspot) fails mid-stream resulting in a EOF at the end of failure statement.

My hope was to do Docker -->n8n-->Ollama-->Firecrawl-->SQLite. But now I am stuck at step 1.

Not using any VPN. I just have a hunch this might be my Wifi connection blocking things.

i am getting started with Docker Swarm so I might get some terminology wrong. I tried to mount a bind volume over an existing directory in a container but failed. Does anyone know how to properly mount it?

I was something similar to below

volumes:

- type: bind

source: /mnt/nfs_share/config

target: /usr/share/app/config

read_only: true

i have a vps and want to be able to host multiple web servers on the vps. the current setup i have is my nginx container right inside the docker compose file where my other web server services are and they communicate accross the same internal network. but from my research, it would be redundant and even counter productive having multiple containers of nginx and certbot in for every project. so just for a better guidance since i'm not well versed in docker, what is the best approach for this. should i have a single container for nginx and certbot that can communicate with any other container or just go ahead with the multiple nginx and certbot containers per project

I put together a walkthrough on using Docker's new sbx sandboxes to run Claude Code with MCP servers in an isolated environment.

The guide covers:

• Running Claude Code inside a microVM
• Restricting outbound network access with policies
• Safely exposing only the MCP servers and domains you need

If you're experimenting with AI coding agents and want stronger isolation than a regular container, I'd love to hear your thoughts and any feedback.

https://hrittikhere.com/posts/sandbox-claude-code-mcp-docker-sbx

I'm using a Turborepo with Bun workspaces. My repository structure looks like this:

architecture-web/
├── apps/
│   ├── api
│   ├── admin
│   └── public
├── packages/
│   ├── db
│   ├── typescript-config
│   ├── ui
│   └── eslint-config
├── package.json
├── bun.lock
└── turbo.json

The API depends on a shared workspace package:

// apps/api/package.json

{
  "dependencies": {
    "@repo/db": "*"
  }
}

The root package.json contains:

{
  "workspaces": [
    "apps/*",
    "packages/*"
  ]
}

I only want to build a Docker image for apps/api. I don't want to include apps/admin or apps/public.

My first attempt was something like:

FROM oven/bun:1

WORKDIR /usr/src/app

COPY package.json bun.lock turbo.json ./

COPY apps/api/package.json ./apps/api/
COPY packages/db/package.json ./packages/db/
COPY packages/typescript-config/package.json ./packages/typescript-config/

RUN bun install

COPY apps/api ./apps/api
COPY packages/db ./packages/db
COPY packages/typescript-config ./packages/typescript-config

CMD ["bun", "run", "start"]

However, bun install fails with errors like:

Could not resolve package '/admin'
Could not resolve package '/public'
Could not resolve package '@repo/ui'

because the root workspace declares:

"workspaces": [
  "apps/*",
  "packages/*"
]

and Bun expects every matching workspace to exist.

If I instead do:

COPY . .
RUN bun install

everything works, but the Docker image contains the entire Turborepo, including apps that are unrelated to the API.

Questions

1. What is the recommended way to build a Docker image for only one app in a Turborepo?
2. Is copying the whole repository the normal approach?
3. Should I use turbo prune --docker for this use case?
4. Is there a way to make Bun install only the API workspace and its dependencies without copying every workspace into the Docker build context?

I'm looking for the recommended production approach rather than just a workaround

I’ve just downloaded WSL Ubuntu but I have no idea where to go from here to get Ganymede ([https://github.com/Zibbp/ganymede](https://github.com/Zibbp/ganymede))) working? It mentions Docker but I have no idea what Docker is for or how it works. Could anyone please help me understand what I need to do to get this to work?

So I have Pangolin running on a VPS with a few containers. I have them all setup with network_mode: pangolin. my problem is when the VPS gets restarted the ip addresses get changed and now pangolin has the wrong addresses for the containers and everything gets a bad gateway.

Is there a way to assign ip addresses in Docker Compose without creating a new network for each container?

Heyyy everyone,

I'm developing on Windows 11 using Docker Desktop with WSL2.

I usually start my project with:

docker compose up --build

probably 20–30 times a day while developing.

Over time my docker_data.vhdx has grown to around 90 GB.

I've already tried:

• docker system prune -a
• docker builder prune
• wsl --shutdown
• diskpart -> compact vdisk

These reclaim some space, but after a few days of development the VHDX starts growing again.

I just wonder,

1. Is this expected when using docker compose up --build frequently?
2. Should I avoid --build unless the Dockerfile or dependencies actually changed?
3. Is there a recommended workflow for daily development that keeps docker_data.vhdx from continuously growing?
4. Do you periodically prune build cache, or is there a better long-term solution?

I'd appreciate hearing how other Windows + WSL2 developers manage this.

EDIT: SOLVED.

Steps:

wsl --shutdown

select vdisk file="C:\YOUR_VHDX_PATH\docker_data.vhdx"

attach vdisk readonly

compact vdisk

detach vdisk

exit

From 97GB to 6GB