Category
Tools we use daily: setups, tricks and battle-tested automations.
Related paths
The Plugin 'mysql_native_password' is not loaded error appears because MySQL 8.4 disables that authentication method and 9.x removes it, and mysql:lts is now 9.7.4. Start 8.4 with --mysql-native-password=ON, convert every account to caching_sha2_password with ALTER USER, then move to 9.7.
The unknown storage type file error appears because OpenBao 2.7 removed the file backend, and the server stops as soon as it reads that configuration. Stop the container, back up the volume, migrate the data to PebbleDB with the 2.7.2 bao operator migrate and change the storage block: your unseal keys and token stay the same.
NetBird 0.82 removed the MySQL engine, and the server stops with the error the MySQL store engine is no longer supported. Roll back to the 0.81.5 image, move the data to PostgreSQL with the netbird-mysql-migrate tool from that same version, because 0.82 no longer ships it, and only then upgrade by pinning the 0.82.0 tag.
Vaultwarden 1.37.5 stops with Error loading config if your .env sets a rate limit or a database timeout to 0, or if a purge schedule is not a valid cron. Fix each variable the log names; out-of-range numbers do not stop it, but they are silently replaced by defaults.
Moving from Grafana 12.4.12 to 13.2.3 in Docker, my two dashboards kept working, but a script that queried Prometheus by numeric id started returning 404. Grafana 13 disables the by-id data source APIs by default, and the fix is to call by uid. Here is the procedure, with a grafana.db backup and a rollback.
Podman 6 removed cgroups v1, CNI, iptables, slirp4netns and BoltDB. I tested Podman 6.1.3 against state created by 4.9.4 and 5.8.7: BoltDB migrates by itself, but a CNI network silently disappears and a slirp4netns container will not start. A 38-line script detects each case before you upgrade.
To upgrade Uptime Kuma 1.23 to version 2 with Docker, stop the container, archive the data directory and switch the image to louislam/uptime-kuma:2.5.9, because latest still points to 1.23.17. The first start aggregates the history into new tables and deletes the raw heartbeats: do not interrupt it, and keep the backup to roll back.
The docker.io/bitnami/postgresql:16: not found error appears because Bitnami removed its versioned tags from Docker Hub and only keeps latest. As a stop-gap, switch to bitnamilegacy/postgresql. The real fix is the official postgres image, pointing PGDATA at the Bitnami directory, creating postgresql.conf and pg_hba.conf and refreshing the collation version.
Valkey 9.1.2 used 62.9 bytes per key with 5 million short-value keys, against 70.9 for Valkey 9.0.6 and 81.5 for Redis 8.10.2. The saving disappears with values of 100 bytes or more. And Valkey 9.1 refuses the RDB files of Redis 7.4 and Redis 8.
Since 13 May 2026, the Let's Encrypt tlsserver profile issues 45-day certificates. The default classic profile moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028. I tested certbot, Caddy, Traefik, acme.sh and lego against Pebble, and all five let you choose the profile.
The No vector extension found error appears when Immich v3 starts on the old tensorchord/pgvecto-rs image, because version 3 no longer supports pgvecto.rs. Switch the Postgres image to ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0, let Immich migrate to VectorChord, and you keep smart search and faces.
The quay.io/minio/minio 401 UNAUTHORIZED error is not a credentials problem: MinIO took public access away from that repository in September 2026 and it fails for every tag. Switch the image to cgr.dev/chainguard/minio or pgsty/silo in Compose, Kubernetes or Helm; the AIStor image on Quay still pulls, but without a license it refuses every request.
Node.js 26 becomes active LTS on 28 October 2026 and Node 24 enters maintenance on 20 October. Moving a Docker image takes swapping node:24-slim for node:26-slim, but check three things first: the removed internal _stream_* modules, the removed writeHeader() and native modules, which target ABI 147.
Traefik logged plugin integrity check failed because its plugin catalog served one zip and validated another. It hit Pangolin's Badger v1.8.0 and Sablier v1.3.1. Traefik fixed it on 30 October 2026: if you pinned the zip hash, remove that line or pin the new hash.
Authentik 2026.8 only accepts X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-For when the connection comes from a network listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS. If your reverse proxy sits outside the default private ranges, Authentik treats the request as HTTP and login breaks. Add the proxy's IP or network to that variable and restart.
Grafana Tempo 3.1 stores distributed traces and queries them with TraceQL. In Docker Compose one container in monolithic mode is enough, with no Kafka, using Alloy as the OpenTelemetry collector and Grafana to explore them. Since 3.1 it writes vParquet5 blocks and supports arithmetic in TraceQL metrics; coming from 2.x, the config has to be migrated.
The UPGRADE PROBLEM: Found an invalid featureCompatibilityVersion document error appears because mongo:latest has pointed at MongoDB 9.0 since 1 October 2026, and 9.0 only opens data at FCV 8.0 or 8.3. Go back to your previous image, move to mongo:8.3, set the FCV to 8.3 and only then switch to 9.0.
The Jellyfin 12 dashboard error r.map is not a function appears when /web/ConfigurationPages returns HTML or an empty body instead of JSON, and the web client keeps that answer in IndexedDB for 24 hours. Fix the reverse proxy, then delete the jellyfin-query-cache key and the browser's cached files.
The gitea/act_runner image has been frozen at v0.6.1 since 30 April 2026; the runner now lives in gitea/runner and is at 5.2.4. The jump keeps your registration, but three changes break jobs: ${VAR} in config.yaml, the valid_volumes wildcard and jobs without runs-on.
The unexpected argument '--frozen-lockfile' found error appears because npm install -g pnpm now installs pnpm 12, rewritten in Rust, and its CLI no longer takes a space-separated value. Replace --frozen-lockfile false with --no-frozen-lockfile, and pin pnpm in your Dockerfile and in packageManager so the next major does not surprise you.
npm 11.19 ships two defences against compromised packages: allowScripts, which makes you approve each dependency's install scripts, and min-release-age, which ignores versions published less than N days ago. Together they would have stopped August 2026's ChainDrop worm, which spread through a preinstall hook and fresh patch releases.
Since Caddy 2.11.6, request headers are capped at 16 KiB and anything larger gets 431 Request Header Fields Too Large. Raise the cap with max_header_size in the servers block. The same release silently drops headers that contain a dot, cuts stalled uploads after 60 s and stops inheriting client_auth from a wildcard site.
You upgrade Nginx Proxy Manager to 2.16.0 by changing the image tag and recreating the container. It ships no database migrations, and in my test it kept every host, certificate and access list. Back up data and letsencrypt first: rolling back to 2.15 by swapping only the image leaves any path you protect with the new feature unprotected.
Gitea 28 shows You cannot import from disallowed hosts when you migrate or mirror from a private IP, such as another container on your Docker network. A hostname is no longer enough: add the source IP or subnet with its port to [migrations] ALLOWED_HOST_LIST, for example 172.31.105.0/24:3000, and the migration goes through.
Promtail lost support on 2 March 2026 and its replacement is Grafana Alloy. The alloy convert command translates the configuration and inherits the positions file, but it silently changes multiline and rereads the history of Docker containers. Here I migrate a real setup and check with LogQL that no line is lost or duplicated.
Docker Desktop 4.94, released on 5 October 2026, uses the local logging driver for new Linux containers: it rotates and compresses with no setup. In my test, 3 million lines took 454.5 MB with json-file and 15.5 MB with local. Docker Engine on Linux still defaults to json-file, so on a server you have to change it yourself.
The pull access denied for minio/mc error appears because MinIO deleted that image from Docker Hub in September 2026, and it stops the whole compose stack even though only the bucket-creation container uses it. Swap it for pgsty/silo, the Chainguard image or aws-cli, or drop the service if your buckets already exist.
The Error loading configuration file: /config/config/encoding.xml message in Jellyfin 12.0 and 12.1 comes from the EncoderPreset xsi:nil line that 10.11 writes by default. The server starts, but transcoding falls back to defaults and QSV is gone. Jump to 12.2 before migrating, or change that line to auto.
To upgrade Nextcloud 34 to 35 in Docker, back up the database and the volume, switch the image to nextcloud:35 and let the container start run occ upgrade. You can only move one major version at a time. What breaks are apps with no release for 35, and going back to 34 means restoring the backup.
Vaultwarden 1.37.3 supports single sign-on over OpenID Connect through SSO_ENABLED, SSO_AUTHORITY and a client registered in your provider. With Pocket ID you sign in with a passkey, but the master password is still required because it is what encrypts the vault. SSO_SIGNUPS_ALLOWED decides whether SSO may create new accounts.
WSL containers is the WSL 3.0.1 feature that ships wslc.exe, a CLI with Docker syntax to build and run Linux containers on Windows without installing another engine. It has been stable since 29 September 2026, but it does not read compose.yaml yet, so Docker Desktop is still needed for Compose projects.
I built the same Go and Python app on Wolfi, Alpine, distroless and Debian slim. For Go, chainguard/static and distroless/static leave 3.1 and 3.3 MB compressed with zero CVEs. For Python, Alpine gives the smallest image (24.2 MB) if every dependency ships a musl wheel; Debian slim weighs twice as much and Trivy reports 204 findings.
OpenObserve 1.0 is a single binary that stores logs, metrics and traces, and its AGPL edition ships SLOs with burn-rate alerts. With Docker Compose, Vector and the v1.0.4 image I had it ingesting nginx logs within minutes; the SLO and its alert worked after four traps that this guide explains.
ArtCraft's Crafting Apps are twelve open-source creative apps written in Rust, licensed MIT or Apache 2.0, that you can also drive from a CLI and over MCP. I tested them on 13 October 2026 on Linux arm64: PhotoCraft 0.8.2 and PdfCraft 0.7.1 work from the terminal, over MCP and in the browser, but they are still early alpha.
Stirling-PDF 3.0.0 upgrades in Docker by changing the image tag: users, settings, API keys and watched folders survive. But 3.0 adds a 1,000 PDFs per month meter for the API and automations, which answers with a 402 error once it runs out, and it needs a new volume for /storage.
To upgrade Gitea 1.27 to Gitea 28 with Docker, stop the container, dump PostgreSQL and the /data volume, remove the legacy egress keys from app.ini and change the tag. In my test a wildcard BLOCKED_DOMAINS entry that was valid on 1.27 stopped 28 from starting, and webhooks to public hosts started going out again.
Gatus is an uptime monitor you configure with YAML files instead of a web interface. With Docker Compose, the v5.37.0 image and a volume for SQLite, it checks HTTP, TCP, certificates and DNS TXT records, and alerts through a webhook. In my test it alerted on an nginx outage after 30 seconds, the time three 10-second checks take.
The pull access denied for minio/minio error appears because MinIO removed its Docker Hub images in September 2026, and quay.io has required an account since the 24th. Point your compose file at cgr.dev/chainguard/minio, at the pgsty/silo fork or at an image built from source: your existing data keeps working.
Open WebUI 0.11.4 installs from a two-service docker-compose.yml: Ollama runs the models and the slim Open WebUI image, which on arm64 downloads 176 MB against 1.49 GB for the full one, serves the interface. This guide creates the admin account, chats with a local model and turns on tool approval.
To migrate from MinIO to RustFS 1.0 with Docker, run RustFS next to MinIO, import the users with mc admin cluster iam, copy the buckets with rclone sync --metadata and compare them with rclone check --download. In my test 4,012 objects arrived identical; versions, tags and public access had to be redone by hand.
A RabbitMQ quorum queue deletes each message once it is acknowledged and fsyncs before accepting it; a stream keeps it for rereading. On RabbitMQ 4.3.6, with 1 KB messages, the quorum queue moved 45,156 msg/s and the stream, over its own protocol, 281,330 msg/s, using 9 KB of memory per million messages against 20.5 MB.
Docker Compose 5.3.0, released on 2 July 2026, adds init containers through the pre_start key: steps that run in ephemeral containers, in order, before the service starts. Use them for migrations, volume permissions and generated configuration. Compose 2.40.3 rejects the whole file, and every step must be idempotent because it runs again.
File Browser was archived on 31 August 2026 and its v2.63.23 carries at least 8 published vulnerabilities that will never be patched. After testing the alternatives in Docker on the same folder, FileBrowser Quantum is the drop-in replacement, copyparty the lightweight pick for sharing large files, and Filestash the right one when your data lives in S3, SFTP or SMB.
CrowdSec 1.8 adds bot detection to its WAF, still in alpha, which serves every visitor a page with a proof of work and a browser fingerprint. You enable it with the appsec-bot-challenge collection and its configs in the AppSec acquisition, always behind a compatible bouncer such as OpenResty 1.2.3.
Docker Compose 5.5 changes the digest it uses to decide whether a container's image has changed. On the containerd image store, containers that Compose 2.40 or a pulling 5.4 up labelled with the index digest are recreated once on the first up, with no real change. up --dry-run lists them beforehand.
n8n 3.0 is not out yet: n8n plans it for October 2026 and the stable release is 2.39.6. To prepare a Docker install, open Settings > Migration Report, replace the removed nodes, pin the defaults that change, move binaryData to storage and try the v3-nightly image on a copy.
Open Storage for Proxmox is a GPL-3.0 storage plugin you install on every Proxmox VE node. It creates one zvol per disk on TrueNAS 25.10, publishes it over iSCSI or NVMe/TCP through the API, with no SSH, and adds ZFS snapshots and clones. The current release is 2.1.23~beta3.
n8n is not open source: its Sustainable Use License limits you to your own internal business purposes and forbids charging people to access a hosted instance. Activepieces publishes its core under MIT but keeps agents, projects and API access outside it. Windmill compiles to AGPLv3 from source, yet the distributed Community Edition is not open.
