Topic · 12 stories
12 stories tagged docker on AI Tamer, newest first.
docker run -p 8080:80 listens on all host addresses, IPv4 and IPv6, and Docker's own docs say its rules bypass ufw. Writing 127.0.0.1 in front of the port is the difference between a local service and a public one.
Poisoned LiteLLM 1.107.0 wheels and images stole cloud, SSH and AI keys, plus provider keys stored in the proxy database. What happened and what to do.
Use py-spy dump, top and record to see what a stuck or slow Python process is doing without restarting it, and grant the ptrace access it needs on Linux, Docker and Kubernetes.
A bind mount overlays its container target, hiding files packaged there. Read-only protects the host source from container writes but does not preserve obscured image files.
BuildKit secret mounts make credentials available only to the build instruction that needs them. ARG, ENV and copied files can disclose values through image metadata, layers or cache.
A multistage Docker build can compile an application in one stage and copy the finished binary into a smaller final image.
Docker and Kubernetes ask a container to stop with SIGTERM and then kill it. Why some services never hear the request, and how to make sure yours finishes its writes before the grace period runs out.
A tag like :latest or :2.1 is a name that can be moved to a different image at any time. A digest cannot. What that means for what you run, and how to pin it.
An open port and a running process say little about whether a service actually answers. How to write a health check that asks the real question, in Docker and Kubernetes.
A full disk breaks everything at once. Where the space usually hides on a small Linux server, and the warnings worth setting before the last few percent go.
Several AI coding sessions sharing one server will collide over ports, checkouts, containers and disk. Four small habits that keep them out of each other's way.
Modal (Oct 1, 2026) made VM Sandboxes generally available via runtime="vm": full Linux VMs (Cloud Hypervisor–based) with Sandbox APIs, Images, and cold-starts; gVisor stays default.
