Pinned Image Digests Turn a Container Tag into a Reproducible Dependency
A mutable tag tells you what to ask for; a digest tells you what bytes you actually accepted.
Docker
Putting a PBX in Docker Did Not Remove the Networking
Containerizing a SIP service added another address and NAT boundary, which made port publishing, advertised addresses and RTP ranges more important rather than less important.
A Docker Healthcheck Must Test the Dependency You Actually Need
A process can be alive while the service contract its neighbors depend on is broken.
Block I/O per Container Exposes Noisy Neighbors
Host disk latency can rise because one container is performing heavy reads or writes while every other service only sees the consequence.
Container Running, Healthy and Useful Are Three Different States
A production-engineering deep dive into container running, healthy and useful are three different states, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
How cAdvisor Became One of My Largest Workloads
A production-engineering deep dive into how cadvisor became one of my largest workloads, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
The RTP Port Range Is Part of the Deployment Contract
Media ports must agree across PBX configuration, firewall policy, containers and the surrounding network.
One Ingress Is Easier to Reason About Than Three
Every extra reverse proxy adds another place for routing, TLS and headers to disagree.
Build, Release and Run Fail Differently
Separating image construction, configuration injection and runtime startup makes failures easier to localize.
Running Is Not the Same as Healthy
Container process state only proves that PID 1 exists; readiness has to test the behavior the dependency actually needs.
CPU by Container Is Useful Only Beside Limits
A container using one full CPU may be expected on an unrestricted worker and catastrophic for a service capped at a fraction of a core.
cAdvisor Used 428 MiB Until We Asked What We Actually Needed
Observability can become the workload if collection is broader than the questions operators actually need to answer.
The Runner Is a Privilege-Separation Boundary, Not Just a Worker
Keeping host execution outside the portal containers limits what a web compromise can directly control.
Docker Security Posture Belongs in Monitoring
Privileged containers, Docker socket mounts, root users and published ports are configuration facts that can silently drift after deployment.
Healthcheck Duration Can Warn Before Healthcheck Failure
A probe may keep returning success while taking progressively longer, showing a dependency slowdown before Docker marks the container unhealthy.
Mutable Tags Make Rollback Ambiguous
You cannot reliably roll back to yesterday's image if the tag you used yesterday points somewhere else today.
The Risk of :latest in a GitOps Repository
Why a declarative manifest can still be non-reproducible when the tag is mutable.
The Caddyfile Says dns cloudflare, but Caddy Says the Module Does Not Exist
DNS challenge syntax only works when the running binary contains that provider module.
The containerd Image-Path Bug That Looked Bigger Than It Was
Why image naming semantics matter when moving from local Docker assumptions into Kubernetes.
Running Containers Are Not Healthy Containers
The Docker daemon can report a container as running even when the application inside it has stopped serving useful traffic.
A Five-Minute Cache Was the Right Place for Expensive Docker Storage Inventory
Not every metric needs to be collected at the same cadence; expensive inventory can be cached without weakening real-time health signals.
Root-Owned Runtime Files and Non-Root Containers Need an Explicit Contract
Dropping container privileges is only safe when mounts, ownership and startup scripts are designed for the new identity.
When mlock Is Gone, Swap Policy Becomes Part of Secret-Server Hardening
If the application cannot pin sensitive memory, the container and host memory policy becomes part of the threat model.
How I Took cAdvisor from ~428 MiB to ~20–28 MiB
A production-engineering deep dive into how i took cadvisor from ~428 mib to ~20–28 mib, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Container I/O Pressure Shows Waiting, Not Just Bytes
A workload can perform modest disk throughput and still suffer because requests are waiting behind slow storage or competing I/O.
A Docker Storage Cache Needs Its Own Freshness Metric
A production-engineering deep dive into a docker storage cache needs its own freshness metric, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
A Home Server Became Production the Day I Needed a Recovery Time
The difference between a lab box and production infrastructure is not the hardware; it is whether failure has a documented recovery path.
OOM Events Need Container and Host Context
An application disappearing under load can be either a container memory-limit event or a host-wide memory emergency.
Tailscale with Docker: Host-Level Tailnet or Per-Container Sidecar?
I choose the networking boundary before I add Tailscale to a Docker stack, because the two patterns create different operational models.
A Wrong Container Name Can Fail a Change Window Even When VoIP Is Healthy
A preflight sentinel is only useful if it names the runtime object that actually exists today.
Docker Networks Hid Less Once I Drew the Packet Path
Container networking stopped feeling magical when I separated host routing, bridge interfaces, NAT and the application socket.
Container Restart Counts Are Incident Breadcrumbs
A service can look healthy now and still have restarted repeatedly overnight, erasing the evidence from a simple current-state view.
Restart Counts Without Context Create Noise
A production-engineering deep dive into restart counts without context create noise, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
RTP Relays Made Container Boundaries Easier to Control
Anchoring media at a deliberate boundary reduced the number of private addresses that leaked into SDP and simplified firewall policy.
Database Container Metrics Need Engine Metrics Beside Them
High database container CPU or memory can be an important symptom, but it cannot identify whether the engine is busy with useful work, blocked transactions or internal maintenance.
A Storage Cache Needs Its Own Freshness Metric
Caching Docker storage inventory reduced overhead, but a silent refresh failure could otherwise leave old values looking current indefinitely.
Inside a Caddy Container, localhost Is Caddy — Not Your App
The most common Docker reverse-proxy mistake is technically valid networking aimed at the wrong namespace.
RTPengine Naming Drift Was a Monitoring Bug, Not a Media Bug
When a sentinel references yesterday's container name, the monitoring system becomes the failed component.
Why Voiceware Needed More Than Docker Compose Thinking
The conceptual shift from “start these containers” to declaring desired state and independent service lifecycles.
Deep Database Collection Did Not Need Copied Passwords
Copying every application database password into the observability stack would have expanded the secret blast radius just to collect metrics.
Memory Limit Utilization vs Working Set: Which One Should Page Me?
A production-engineering deep dive into memory limit utilization vs working set: which one should page me?, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Entrypoint Assumptions Are Hidden Dependencies
A container command is only reproducible when you know whether the image entrypoint wraps, replaces or transforms it.
OOM Events Are Better Evidence Than “High Memory” Alone
A production-engineering deep dive into oom events are better evidence than “high memory” alone, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
A Container Entrypoint Can Break a Perfectly Valid Validation Command
CI failed because the image entrypoint changed how arguments were interpreted, not because the OpenBao configuration was invalid.
Docker Filesystem Scanning Was More Expensive Than the Metric Was Worth
A production-engineering deep dive into docker filesystem scanning was more expensive than the metric was worth, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Production Infrastructure Became Easier Once Git, Runtime State and Secrets Had Different Jobs
Most operational confusion came from mixing desired configuration, live state and credentials into the same place.
Container Block I/O and I/O Pressure Tell Different Stories
A production-engineering deep dive into container block i/o and i/o pressure tell different stories, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Monitoring Tax: Why Exporters Need Resource Budgets
A production-engineering deep dive into monitoring tax: why exporters need resource budgets, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Working Set Is More Useful Than a Single Memory Number
Container memory graphs become noisy when cache and reclaimable pages are treated exactly like unreclaimable application working memory.