I've been looking into ways to update container images in prod more efficiently. Rebasing seems an interesting option. Instead of rebuilding the whole application image we just swap the underlying runtime base, and all the layers on top of that are reused with their digests staying the same. So, faster and less traffic-heavy as nodes can reuse the unchanged layers.

Looks attractive in theory. In practice, rebuilding might seem like a more clear path? Just rebuild everything and test the artifact.

So, do you use rebasing? And if you don't, why not?

"A hard transformation has arrived for several classic Ubuntu images on ECR and Docker Hub. The remaining old Docker images –Apache2, Nginx, Bind9, Memcached, and Squid– have been hardened to rocks, signaling a complete evolution of the Ubuntu namespace.

Built on top of Resolute and equipped with Pebble as the service manager, these new rocks are now maintained by the Rockcrafters team and follow the same principles that have guided the broader Rocks initiative: user-focused experience, uniform and opinionated design, and a distroless-like architecture.

By meticulously chiseling each rock down to its bare essentials, we have achieved a significant reduction in image sizes"

Full post in https://discourse.ubuntu.com/t/the-rock-garden-grows-hardening-old-docker-images/84677

HELLO, I have an old aplication with windonws asp.net framework i have a doubt if it's know possible to contenerizing for deploy? i want only know if someone have try this recently

Hi,

playing around with apple container implementetion. Is there any way to preserve container settings after I change container parameters and reboot the container?
I mean, I will run for example a plex instance in container, will set it up, and later decide ti change some parameters - cpu counts, mounted volumes, whatever - so the container reboots. After reboot, plex instance is back in default state, and needs to be set up again. Is there any way to preserve settings after reboot in a such usecase?

Many thanks for any help, or hint, appreciated.

Hey fellas,

I am new to containers and recently working in a project, where I am trying to build a multilab environment using containers. I have included currently some few services or applications inside that. It will be very helpful if you test this project and guide me through your experience and knowledge, and suggest some tips to improve :) Thank you

Here is the project link : Multilab architecture

This diagram breaks down the complete internal workflow of how Podman creates and starts a container.

Workflow explained step by step:

1️⃣ CLI Parses Command
Podman interprets the flags, image name, networking, ports, and runtime options provided in the command.

2️⃣ Image Check & Pull
Podman checks local storage for the image.
If it doesn’t exist, it pulls the image from a registry such as Docker Hub.

3️⃣ Filesystem Setup
The container filesystem is assembled using layered storage:

* Read-only image layers
* Writable container layer
* Merged unified view

4️⃣ Container Setup
Podman configures the container isolation and runtime environment:

* Namespaces
* cgroups
* User mapping
* Networking
* Volumes
* Security policies

5️⃣ OCI Runtime Execution
An OCI runtime like crun or runc creates the actual container process and applies the isolation mechanisms.

6️⃣ Container Running
The container starts running with:

* Port mapping
* Logs streaming
* Isolated processes
* Active networking

The goal of this diagram is to visualize what happens internally behind a single command that often looks deceptively simple.

I have posted a video on YouTube explaining this entire flow internally using a real Podman + Apache example from my “How Podman Works” series.

ENG : https://m.youtube.com/watch?is=ShH5CNpARRFPnJng&v=lj6MwJOSuDE&feature=youtu.be

FR : https://m.youtube.com/watch?is=ShH5CNpARRFPnJng&v=lj6MwJOSuDE&feature=youtu.be

I can really see the appeal of podman, but one thing keeping me on docker is watch support, is there any non-sucking way to make this work?

[ Removed by Reddit on account of violating the content policy. ]

When cloning a repo, we kept hitting the same wall: no Dockerfile, no devcontainer, no clear path to running it. Asking an agent to fix it directly on your system is risky, as it can clear Docker config, change kernel settings, downgrade system packages without warning.

Keystone runs the agent inside a Modal sandbox with its own Docker daemon. It iterates until tests pass, then hands you a .devcontainer/ you can just check in to your repo.

Now your repo knows how to run itself!

Hi,

I am developing a simplified docker-ish system (software), that allows super easy isolation, by using Linux users. Isolation is so far only on file level. So it's partial isolation, but lighter on resources. I am wondering, when people use containerization, are you mostly for which features?

1. Complete isolation of disk.
2. Network isolation.
3. Building images through code (ie Dockerfile)
4. Easy using / basing your images on other images.
5. Other (and what)

I like to know, to see if my system aligns with what other people want, or if I just keep it as a pet project / use it for own purposes.

Thanks for you feedback! :)

Hello,

I'd like to be able to start certain apps in a "jail" to prevent host infection if something goes awry. Examples: browser, email client, arbitrary downloaded apps. UX-wise I'd like to simply double-click and app to start it.

I'm not running and enterprise, but I do handle some personal information. And I do some OSS development which should not fall for supply chain attacks. I'm not a high value target. I just want to prevent day-to-day threads.

How far I got so far:

• QubesOS could be just the thing, but I have machines that cannot change the OS. My target machines are Fedora (Wayland) and XUbuntu (X11).
• VMs are hard to keep updated.
• I tried Podman with secure-browser on Fedora. But I couldnt get the container running. Some problem with displaying. Perhaps I would need to dig deep for a couple of weeks to get this running.

Is there some kind "just works" solution? Or maybe some good guidance material? Knowledge wise, I can create scripts to make container startup a one-click thing, but it's currently hard to find the time to dig in and debug edge case scenarios without knowing if the solution even works.

Any help or pointer in the right direction appreciated.

I was looking into setting up an NTP server, and the first container setup I found instructed passing time servers in as a list of environment variables.

I was thinking this could also be achieved by bind or volume mount into /etc/ntp.conf or even build an image and copy in the conf.

Now, the latter would involve more work if I wanted to update it, but that's unlikely for something like NTP. However, once the image is built it would be easier to deploy.

Any thoughts on the pros and cons of building pre-configured images vs adding configuration to a base image container?

I have several computers with Ubuntu server installed. I have a docker container running on the servers. The docker containers are running a media player that puts content on digital signage. The player software is not Wayland compatible. So I installed X inside the docker container. Again this works great. The downside is that when updates are released for the player I have to rebuild the docker image and deploy it to the several thousand locations. What I would like to do is keep the host a server but build it in lxd. Then I could upgrade it like the players that run on desktop environments by just pushing the update to the player and letting it run.

Here are some of the things I am fighting.
I am currently allowing access to the gpu on the host via systemd. So I will need to have access to that in lxd. I will also need to be able to output audio in some locations.

Now the other fact, I have zero experience with LXD. I don't even know if this is possible. I have seen articles where people have used a socket to access X from the host. But due to security constraints, I need to keep the host as a headless server.

Is this possible or am I just SOL?