Tag
The Portainer Agent is a container you deploy on each remote machine, exposing port 9001 over TLS. The Portainer server connects to it and manages that host as one more environment, without exposing the Docker socket to the network or maintaining permanent SSH tunnels.
A healthcheck is a command Docker runs periodically inside the container to decide whether the service is healthy; its state moves from starting to healthy or unhealthy. Combined with a restart policy (no, always, on-failure or unless-stopped) and with depends_on and the service_healthy condition, it stops an application from starting before its database.
Kubernetes won the orchestration battle, but Docker Swarm stays maintained inside Docker Engine and makes real sense for small teams without dedicated SRE, self-hosted stacks on 1-5 VPS, and edge mini-clusters. In those contexts, Swarm's minimal learning curve and low operational cost outweigh Kubernetes's advanced features.
You install Portainer with Docker Compose by writing a single compose.yaml file and running two commands. Portainer CE 2.40 STS supports Docker Compose v2 natively, enables HTTPS on port 9443 out of the box, and manages Docker Engine, Swarm, Kubernetes and ACI from one panel. It runs on Ubuntu 24.04 or Debian 13.
Kubernetes 1.35 has reached feature freeze, and three items matter. CEL-based admission policies go stable, replacing admission webhooks with expressions evaluated inside the control plane and removing an external failure point. Dynamic Resource Allocation goes stable for GPUs, NPUs and other accelerators. The new KubeletConfigSource API pushes kubelet configuration without restarting the node.
gVisor isolates containers by inserting Sentry, a kernel written in Go, between the container process and the real host kernel, shrinking the system-call surface a hostile tenant can reach. Its OCI-compatible runsc runtime drops in where runc used to sit. Use systrap mode, the default since 2023: portable, no special hardware required.
Fly.io has spent years selling the idea that deploying an application across several regions should be almost as simple as pushing an image and writing one config line. After several real projects on the platform, here is an honest read on what it delivers, what is missing, and who it is worth choosing over more classic options.
Wolfi turned three as a public project and has become the base for Chainguard container images and much of the industry chasing clean software supply chains. A field-tested review of what it offers against Alpine and Debian slim.
Kubernetes 1.34 ships with Dynamic Resource Allocation (DRA) graduating to stable, scheduler improvements, and CEL-based mutating admission policies that replace webhooks. A practical rundown of what is safe to upgrade now, what can wait, and what actually changes for teams running production clusters.
Six months after containerd 2.0 reached general availability there is enough real-world mileage to judge the migration from the 1.x branch in production. We cover what changes in the config file, what breaks on Kubernetes and Docker Swarm, and when planning the jump actually pays off.
Kubernetes 1.32 Penelope shipped in December and has been running in clusters for several months. It is a good time to look at which changes have aged well, which created extra work, and what lessons to carry into the jump to 1.33.
Kubernetes 1.33 (Octarine) lands April 23. In-place pod resize moves to beta and ships on by default, sidecar containers finally reach GA, and several endpoint and security deprecations arrive that operators should review before upgrading from 1.32.
cAdvisor is still embedded in kubelet and covers surface metrics, but falls short for production Kubernetes. The modern minimum stack pairs it with kube-state-metrics, node-exporter, Prometheus, and Grafana as a base, eBPF for deep network and syscall visibility, and OpenTelemetry for application context.
Containerising SCADA makes sense for the upper architecture layers: HMI, historians, and data gateways. PLCs still control hardware with hard determinism. The biggest risk is cultural: applying DevOps patterns without adapting to OT context causes incidents. NIS2 requires managing containers as any other critical infrastructure asset.
Podman is the Docker alternative with no central daemon and no root privileges required. Each container runs as a direct child process of the launching user, with rootless support since version 1.0 in 2019. If a container escapes, it does not gain host root. When Podman makes sense and what real differences to expect.
Trivy and Grype are the two leading open-source tools for container image scanning in CI/CD pipelines. Both detect CVEs in OS packages and language dependencies with less than 5% coverage difference. Trivy stands out for IaC scanning; Grype natively integrates the SBOM workflow with Syft.
nerdctl is a Docker-compatible CLI that talks directly to containerd, the standard Kubernetes runtime since dockershim was removed in 2022. It adds rootless support by default, encrypted images with ocicrypt, lazy-pulling, and native CNI. It fits best where containerd already runs, though Docker Engine still wins on advanced Compose and Swarm.
Kubernetes 1.28 introduces native sidecar containers in alpha via KEP-753: adding restartPolicy Always to initContainers ensures correct startup and shutdown ordering. It fixes Jobs that never terminate. Istio, Linkerd, and observability agents like Fluent Bit are the primary beneficiaries.
To install Docker on Ubuntu 24.04 LTS, add Docker's official repository instead of using Ubuntu's packages, then install Docker Engine: the dockerd daemon, the command-line client, and the Compose and Buildx plugins. The repository line needs a GPG key stored under /etc/apt/keyrings, because apt-key add is retired on 24.04, and it carries the noble codename from /etc/os-release.
Traefik is a reverse proxy that automatically discovers Docker containers through labels and renews TLS certificates via Let's Encrypt without manual work. To install it with Docker Compose, define its static configuration in traefik.yml, generate basic-auth credentials for the dashboard, and start the container connected to a dedicated Docker network.
Docker Compose is Docker's official tool for defining and running multi-container applications with a YAML file: one command spins up every service, network, and volume it describes. On Ubuntu 20.04 it is installed by downloading the standalone binary from GitHub, though Docker recommends moving to the v2 CLI plugin, since v1 is no longer maintained.
To install Docker on Ubuntu 20.04, add Docker's own repository (not Ubuntu's, which tends to lag behind), import its GPG key, install the docker-ce package, and add your user to the docker group so you can run containers without sudo. Running docker run hello-world at the end confirms the daemon works.
