Lab
How-to videos with reproducible steps and environments.
Upgrading Jellyfin from 10.11.11 to 12.0 in Docker requires copying the /config volume first, because 12.0 rewrites the database. In this lab you take the copy with a helper container, migrate, read version 12.0.0 from the API and confirm that going back only works by restoring that copy.
To upgrade Gitea 1.27 to 28 with Docker, stop the container, back up the /data volume, delete the legacy egress keys from app.ini and change GITEA_TAG to 28.0.0. In this lab 28 starts with 13 migrations and 0 errors, and the repository and webhook created on 1.27.3 keep working.
OpenBao is the MPL 2.0 secrets manager that keeps Vault's API. In this lab you run it in Docker with the 2.6.2 image and Raft storage, initialise it with 5 keys, unseal it with 3, store and read a secret in KV v2 and take a Raft snapshot as a backup.
llama-server, the llama.cpp server, serves a GGUF model with the same API as OpenAI. In this lab you run it in Docker with the server-v0.5.0 image, it downloads Qwen3.5 0.8B from Hugging Face into a volume, requires an API key and answers /v1/chat/completions on CPU only.
The MinIO pull access denied error appears because minio/minio no longer exists on Docker Hub. In this lab you confirm the 404 in its API, run cgr.dev/chainguard/minio with Docker Compose, fix the file access denied error with chown 65532 and create a bucket and an object with the Chainguard mc client.
To migrate MinIO to Garage, run Garage v2.4.1 next to MinIO in the same Compose project, create a key and the target bucket, copy with rclone sync and verify with rclone check --download. In this lab, 300 objects arrive with 0 differences and the imported MinIO key keeps reading them from Garage.
DNS (the Domain Name System) is the Internet's address book: it translates names like jacar.es into IP addresses. A recursive resolver walks the hierarchy —root, top-level domain and authoritative server— and caches the answer. In this lab you see it live with dig and run your own DNSSEC-validating resolver.
An agentic VM brings together on one machine the runtime that keeps several coding agents alive, a context all of them read and a remote way in. This lab builds it on Ubuntu with herdr, installs Claude Code, Codex, OpenCode and OpenClaw, and gives them one shared MCP memory.
A private Docker registry stores and serves your own container images without depending on Docker Hub. In this lab you run registry:3 with TLS, signed by your own CA that the client trusts, and htpasswd authentication: an anonymous push fails and, after docker login, you push and pull back an alpine image over HTTPS.
A multi-stage Docker build chains several FROM stages inside one Dockerfile: one compiles with the full toolchain, and the final, minimal stage (Alpine, scratch or distroless) copies only the resulting binary with COPY --from=build. The production image ends up far smaller, with a much smaller attack surface.
A HEALTHCHECK tells Docker how to check whether a container is truly working, not just still running; docker inspect and docker ps surface that state as healthy or unhealthy. Restart policies decide what happens when the process fails: no, on-failure, always, or unless-stopped, and Compose can wait for a service to turn healthy before starting the next one.
Docker secrets management means never leaving tokens or passwords in a Dockerfile's ARG, ENV, or COPY, because they get baked into the image forever. This lab demonstrates the real leak with docker history and fixes it with a BuildKit --secret, a read-only file mount, a scoped env-file, and Compose's native secrets.
Traefik with Docker is a reverse proxy that reads the Docker socket and turns each container's labels into automatic routing rules. In this lab you bring it up alongside two backends and use curl to prove each hostname reaches the right container, without editing a single routes file.
Pi-hole is a DNS resolver that acts as a sinkhole: it filters every query on your network before it reaches the internet and blocks ad and tracking domains from its lists, answering 0.0.0.0 instead of forwarding them. In this lab you run it in Docker and prove it live with dig.
A Docker volume stores data outside the container, in a location Docker itself manages. To back it up, a throwaway alpine container mounts the volume and a host folder, then packs the data into a .tar.gz with tar. Restoring reverses the process: extract that file into a fresh volume and confirm the data comes back intact.
Docker Compose describes a multi-container application in a single YAML file: which services to run, how they talk to each other over the network, and which data persists in named volumes. In this lab you define an Nginx web service and a Redis cache, connect them by service name, and confirm it all works with curl.
A container is ephemeral, but its data doesn't have to be. A Docker volume lives outside the container, managed by Docker itself, while a bind mount uses a host path directly. In this lab we create a named volume, write data from one container, remove that container entirely, and read the same data back from a brand-new one.
Docker attaches every container to a default bridge network, but that network only works by IP: it resolves no names. Create a user-defined network with docker network create and Docker turns on an internal DNS server, so containers reach each other by name and stay isolated from every other network.
Install Portainer on Docker step by step: a persistent volume, the container serving the UI on port 9443, and verified web access. Every step is checked.
