Archive
Since 13 May 2026, the Let's Encrypt tlsserver profile issues 45-day certificates. The default classic profile moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028. I tested certbot, Caddy, Traefik, acme.sh and lego against Pebble, and all five let you choose the profile.
The No vector extension found error appears when Immich v3 starts on the old tensorchord/pgvecto-rs image, because version 3 no longer supports pgvecto.rs. Switch the Postgres image to ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0, let Immich migrate to VectorChord, and you keep smart search and faces.
The quay.io/minio/minio 401 UNAUTHORIZED error is not a credentials problem: MinIO took public access away from that repository in September 2026 and it fails for every tag. Switch the image to cgr.dev/chainguard/minio or pgsty/silo in Compose, Kubernetes or Helm; the AIStor image on Quay still pulls, but without a license it refuses every request.
To install Docker on Ubuntu 26.04 LTS, add Docker's official repository with its GPG key and a docker.sources file, then install docker-ce, containerd.io and the Buildx and Compose plugins. On 7 October 2026 that gave Docker 29.8.2 and Compose 5.6.0, against Docker 29.1.3 and Compose 2.40.3 from Ubuntu's docker.io package.
API Anything is an open source tool that learns a website's internal requests and exposes them as operations your agent calls over HTTP, with no browser. It shares what it learns in a common catalog. In my test, 6 of its 7 read operations answered in under 0.9 s; Google Flights failed from Europe.
Node.js 26 becomes active LTS on 28 October 2026 and Node 24 enters maintenance on 20 October. Moving a Docker image takes swapping node:24-slim for node:26-slim, but check three things first: the removed internal _stream_* modules, the removed writeHeader() and native modules, which target ABI 147.
Traefik logged plugin integrity check failed because its plugin catalog served one zip and validated another. It hit Pangolin's Badger v1.8.0 and Sablier v1.3.1. Traefik fixed it on 30 October 2026: if you pinned the zip hash, remove that line or pin the new hash.
Authentik 2026.8 only accepts X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-For when the connection comes from a network listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS. If your reverse proxy sits outside the default private ranges, Authentik treats the request as HTTP and login breaks. Add the proxy's IP or network to that variable and restart.
Ollama prints this model requires MLX support, but the MLX runtime is not available when you pull a tag that only exists as MLX safetensors, such as embeddinggemma-2:740m-bf16 or phonon, on a machine without MLX: Linux arm64, Linux without an NVIDIA GPU, or Windows. Pull the GGUF variant (q8_0) with Ollama 0.40.4 or later.
PostgreSQL 19 adds REPACK, which replaces VACUUM FULL and CLUSTER and, with CONCURRENTLY, compacts a table without blocking writes, plus WAIT FOR LSN for replicas and logical replication of sequences. On Beta 4, a 1895 MB table shrank to 474 MB, and pg_upgrade from 18 required rebuilding a GiST index first.
PixelRAG is a retrieval system for RAG that turns every web page into screenshot tiles and searches the images, without converting the HTML to text. Its Berkeley paper beats Trafilatura on recall in NQ, SimpleQA and LiveVQA. In my test of the public API it found the right article for 8 of 10 English questions.
Grafana Tempo 3.1 stores distributed traces and queries them with TraceQL. In Docker Compose one container in monolithic mode is enough, with no Kafka, using Alloy as the OpenTelemetry collector and Grafana to explore them. Since 3.1 it writes vParquet5 blocks and supports arithmetic in TraceQL metrics; coming from 2.x, the config has to be migrated.
The UPGRADE PROBLEM: Found an invalid featureCompatibilityVersion document error appears because mongo:latest has pointed at MongoDB 9.0 since 1 October 2026, and 9.0 only opens data at FCV 8.0 or 8.3. Go back to your previous image, move to mongo:8.3, set the FCV to 8.3 and only then switch to 9.0.
The Jellyfin 12 dashboard error r.map is not a function appears when /web/ConfigurationPages returns HTML or an empty body instead of JSON, and the web client keeps that answer in IndexedDB for 24 hours. Fix the reverse proxy, then delete the jellyfin-query-cache key and the browser's cached files.
The gitea/act_runner image has been frozen at v0.6.1 since 30 April 2026; the runner now lives in gitea/runner and is at 5.2.4. The jump keeps your registration, but three changes break jobs: ${VAR} in config.yaml, the valid_volumes wildcard and jobs without runs-on.
A reranker rereads the passages pgvector returns and reorders them by relevance. With bge-reranker-v2-m3 served by llama.cpp on CPU, reranking 20 candidates raised nDCG@10 from 0.805 to 0.850 on 300 Spanish MIRACL questions; handing it 50 improved nothing and cost 2.7 times more tokens.
The unexpected argument '--frozen-lockfile' found error appears because npm install -g pnpm now installs pnpm 12, rewritten in Rust, and its CLI no longer takes a space-separated value. Replace --frozen-lockfile false with --no-frozen-lockfile, and pin pnpm in your Dockerfile and in packageManager so the next major does not surprise you.
npm 11.19 ships two defences against compromised packages: allowScripts, which makes you approve each dependency's install scripts, and min-release-age, which ignores versions published less than N days ago. Together they would have stopped August 2026's ChainDrop worm, which spread through a preinstall hook and fresh patch releases.
Since Caddy 2.11.6, request headers are capped at 16 KiB and anything larger gets 431 Request Header Fields Too Large. Raise the cap with max_header_size in the servers block. The same release silently drops headers that contain a dot, cuts stalled uploads after 60 s and stops inheriting client_auth from a wildcard site.
Espresso is a Swift library that compiles MIL programs straight for the Neural Engine of Apple Silicon Macs through private APIs, without Core ML. On a 6-layer model on an M3 Max it generates 519 tokens per second against 152 for Core ML; with real models such as Qwen2.5, attention stays on the CPU.
You upgrade Nginx Proxy Manager to 2.16.0 by changing the image tag and recreating the container. It ships no database migrations, and in my test it kept every host, certificate and access list. Back up data and letsencrypt first: rolling back to 2.15 by swapping only the image leaves any path you protect with the new feature unprotected.
To install Talos Linux without touching hardware, talosctl cluster create docker brings up a two-node Kubernetes cluster in containers. On real machines or Proxmox three things change: you boot an Image Factory ISO, push the configuration with apply-config and run bootstrap exactly once. Everything is operated through an API, with no SSH.
Gitea 28 shows You cannot import from disallowed hosts when you migrate or mirror from a private IP, such as another container on your Docker network. A hostname is no longer enough: add the source IP or subnet with its port to [migrations] ALLOWED_HOST_LIST, for example 172.31.105.0/24:3000, and the migration goes through.
gpu-unlock is a Linux kernel module that, before the NVIDIA driver loads, lifts the cap that halves tensor core throughput for FP16 and BF16 with FP32 accumulation on GeForce RTX 30 cards. On an RTX 3090 Ti, BF16 goes from 87.5 to 157.4 TFLOPS; in LLMs the prefill gains, not generation.
Promtail lost support on 2 March 2026 and its replacement is Grafana Alloy. The alloy convert command translates the configuration and inherits the positions file, but it silently changes multiline and rereads the history of Docker containers. Here I migrate a real setup and check with LogQL that no line is lost or duplicated.
Docker Desktop 4.94, released on 5 October 2026, uses the local logging driver for new Linux containers: it rotates and compresses with no setup. In my test, 3 million lines took 454.5 MB with json-file and 15.5 MB with local. Docker Engine on Linux still defaults to json-file, so on a server you have to change it yourself.
The pull access denied for minio/mc error appears because MinIO deleted that image from Docker Hub in September 2026, and it stops the whole compose stack even though only the bucket-creation container uses it. Swap it for pgsty/silo, the Chainguard image or aws-cli, or drop the service if your buckets already exist.
On an arm64 CPU with no GPU, llama.cpp 0.5.0 served Qwen3-1.7B as a Q8_0 GGUF at 72.7 tokens/s per request and 236.9 tokens/s with 8 concurrent requests. vLLM 0.30 in BF16 reached 10.1 and 68.3 tokens/s and used 11.4 GiB of RAM against 7.0 GiB.
FIPS 203 (ML-KEM) defines how to agree on a secret key, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) how to sign, all three resistant to a quantum computer and final since August 2024. With OpenSSL 3.5.9 I measured their sizes: an ML-KEM-768 public key takes 1,184 bytes and an SLH-DSA-128s signature 7,856.
The Error loading configuration file: /config/config/encoding.xml message in Jellyfin 12.0 and 12.1 comes from the EncoderPreset xsi:nil line that 10.11 writes by default. The server starts, but transcoding falls back to defaults and QSV is gone. Jump to 12.2 before migrating, or change that line to auto.
oMLX serves text-to-speech (TTS) models on an Apple Silicon Mac through the same API as OpenAI. With POST /v1/audio/speech you request audio in a preset voice, a voice described in plain language or a voice cloned from a few seconds of reference. On an M5 Max, Qwen3-TTS 1.7B generates each second of audio in 0.33 s.
To upgrade Nextcloud 34 to 35 in Docker, back up the database and the volume, switch the image to nextcloud:35 and let the container start run occ upgrade. You can only move one major version at a time. What breaks are apps with no release for 35, and going back to 34 means restoring the backup.
oMLX 0.7.2, released on 21 October 2026, one day after 0.7.1, speeds up DeepSeek V4.1 on the oQ2e to oQ4e quants, turns on Lightning MTP in multi-Mac clusters, runs Qwen3.8-Flash-Next GGUFs on Splash and stops re-prefilling the whole conversation on every Claude Code turn. You upgrade it from the app, Homebrew or source.
CVE-2026-109618 and CVE-2026-109619 are two critical PHP flaws (CVSS 9.2) that allow unauthenticated remote code execution. They affect PHP 8.2, 8.3, 8.4 and 8.5 below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026. The only complete fix is to update and restart every PHP worker.
Since Ollama 0.40, released on 25 September 2026, models with a supported architecture run on MLX instead of llama.cpp on Apple Silicon Macs. Ollama picks the model variant at download time, and ollama ps shows in its RUNNER column which engine serves it. On Linux and Windows llama.cpp is still the default.
The cannot import name streamablehttp_client error appears because the Python mcp package 2.x deleted that function, and McpError was renamed MCPError. To get unblocked, pin mcp
Since 18 October 2026, at least five Mexican outlets have said the three lines next to some WhatsApp chats mark a poll, but WhatsApp has not confirmed it. The only lines its official help documents sit inside the poll composer, where they reorder the options. To find polls, use the Polls filter in the Chats search bar.
Lightpanda 0.4.1 and Obscura 0.2.3 speak CDP and open the same sites as headless Chrome, but they do not pass the same tests. On arm64, driven by Playwright, Chrome passed 17 of 17 and Lightpanda and Obscura 10 each. With 8 sessions, Lightpanda loaded 5.6 times as many pages per second as Chrome, and Obscura 4 times as many.
Vaultwarden 1.37.3 supports single sign-on over OpenID Connect through SSO_ENABLED, SSO_AUTHORITY and a client registered in your provider. With Pocket ID you sign in with a passkey, but the master password is still required because it is what encrypts the vault. SSO_SIGNUPS_ALLOWED decides whether SSO may create new accounts.
llama-server prints error: invalid argument: --mlock because build b10875, from 9 September 2026, deleted --mmap, --no-mmap, --mlock and --direct-io. Replace them with --load-mode: --mlock becomes mmap+mlock, --no-mmap becomes none and --direct-io becomes dio. The LLAMA_ARG_MLOCK and LLAMA_ARG_MMAP variables now do nothing, with no warning.
MariaDB 13.0.2, stable since 15 September 2026, is a rolling release with community support until Q4 2026, not an LTS. It adds redo log archiving, UPDATE with RETURNING and implicit query block names for hints. I upgraded in Docker from 12.3 and 11.8: the server starts, but mariadb-upgrade misses broken stored routines.
Clef and Clef-flash are the open decision models Cloudflare released on 1 October 2026: instead of text they return a choice with its probability. On Ollama 0.35.1 you call them through /v1/systemone. Clef-flash labelled 23 of 24 support tickets correctly in my test, and the only miss had the lowest confidence.
REA (Reverse Engineer Anything) is an MIT-licensed MCP server and CLI that gives Claude Code, Codex or Cursor reverse engineering tools. I tested rea-agents 6.7.0 in Docker: it exposes 207 tools, rebuilt the graph of the Hyper Electron app and, with Ghidra 12.1.4, decompiled a C binary I compiled myself.
Keycloak 26.7.4 can act as the authorization server for an MCP server: it publishes its metadata, supports dynamic client registration and issues JWTs that FastMCP validates. It does not implement RFC 8707, so the token audience comes from a client scope and a mapper, and the MCP server must always check it.
WSL containers is the WSL 3.0.1 feature that ships wslc.exe, a CLI with Docker syntax to build and run Linux containers on Windows without installing another engine. It has been stable since 29 September 2026, but it does not read compose.yaml yet, so Docker Desktop is still needed for Compose projects.
September 2026 produced few open models of home-machine size. The one worth disk space is Xiaomi's MiMo-V2.6-Distill-Qwen-9B, MIT licensed: in my CPU tests it got tool calls and JSON right. MiniCPM5-2B remains the small option, and DFM Mimir is only useful in Danish or English.
I built the same Go and Python app on Wolfi, Alpine, distroless and Debian slim. For Go, chainguard/static and distroless/static leave 3.1 and 3.3 MB compressed with zero CVEs. For Python, Alpine gives the smallest image (24.2 MB) if every dependency ships a musl wheel; Debian slim weighs twice as much and Trivy reports 204 findings.
Soup is an open-source CLI (Apache 2.0) that covers LLM post-training end to end: it decides whether training is worth it, writes the config, trains with LoRA, DPO or GRPO and returns a SHIP or DON'T SHIP verdict. I tested version 0.76.1 on 15 October 2026 on Linux arm64 with no GPU.
