Tag
garak 0.17 is NVIDIA's LLM vulnerability scanner: it fires prompt injection, jailbreak, encoding and data-leak probes at your model and counts the failures. Against gemma3 1B on Ollama, on CPU, prompt injection succeeded 66.67% to 93.33% of the time, and a defensive system prompt did not stop it.
To upgrade Gitea 1.27 to Gitea 28 with Docker, stop the container, dump PostgreSQL and the /data volume, remove the legacy egress keys from app.ini and change the tag. In my test a wildcard BLOCKED_DOMAINS entry that was valid on 1.27 stopped 28 from starting, and webhooks to public hosts started going out again.
If your server imports mcp.server.fastmcp, upgrading the mcp package to version 2 breaks it: FastMCP was renamed MCPServer. You have two destinations, MCPServer or FastMCP 4, and both require moving host and port to run(), building MCPError from a code and a message, and replacing ctx.elicit, which fails on 2026-07-28 connections.
Gatus is an uptime monitor you configure with YAML files instead of a web interface. With Docker Compose, the v5.37.0 image and a volume for SQLite, it checks HTTP, TCP, certificates and DNS TXT records, and alerts through a webhook. In my test it alerted on an nginx outage after 30 seconds, the time three 10-second checks take.
The pull access denied for minio/minio error appears because MinIO removed its Docker Hub images in September 2026, and quay.io has required an account since the 24th. Point your compose file at cgr.dev/chainguard/minio, at the pgsty/silo fork or at an image built from source: your existing data keeps working.
Open WebUI 0.11.4 installs from a two-service docker-compose.yml: Ollama runs the models and the slim Open WebUI image, which on arm64 downloads 176 MB against 1.49 GB for the full one, serves the interface. This guide creates the admin account, chats with a local model and turns on tool approval.
CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector, with a public container escape exploit since 22 September 2026. You are affected if your kernel is 6.10 or later without the fix, or a 6.1 or 6.6 branch that received the backport. Patch and reboot; until then, isolate untrusted workloads with gVisor.
To migrate from MinIO to RustFS 1.0 with Docker, run RustFS next to MinIO, import the users with mc admin cluster iam, copy the buckets with rclone sync --metadata and compare them with rclone check --download. In my test 4,012 objects arrived identical; versions, tags and public access had to be redone by hand.
Ollama 0.34.1 through 0.34.4 reject with HTTP 400 any request to /api/chat or /api/generate that carries typical_p in options, even at 1.0. The fix is to drop the field in the client, go back to 0.34.0, use the /v1 endpoint, or move to 0.40.0, which only logs a warning.
A RabbitMQ quorum queue deletes each message once it is acknowledged and fsyncs before accepting it; a stream keeps it for rereading. On RabbitMQ 4.3.6, with 1 KB messages, the quorum queue moved 45,156 msg/s and the stream, over its own protocol, 281,330 msg/s, using 9 KB of memory per million messages against 20.5 MB.
To install OpenBao with Docker, run the openbao/openbao:2.6.2 image with Raft storage on a volume, initialise it with bao operator init and unseal it with three of the five keys. OpenBao is the MPL 2.0 fork of HashiCorp Vault and keeps its API, so your applications read secrets the same way.
Docker Compose 5.3.0, released on 2 July 2026, adds init containers through the pre_start key: steps that run in ephemeral containers, in order, before the service starts. Use them for migrations, volume permissions and generated configuration. Compose 2.40.3 rejects the whole file, and every step must be idempotent because it runs again.
To migrate Langfuse v3 to v4 with Docker Compose, first upgrade ClickHouse to 26.4 while still on v3, back up PostgreSQL and ClickHouse, start v4 in dual write mode, backfill the history and cut over to events_only once every SDK is compatible. I tested it with 45,931 traces and three Python SDK versions.
File Browser was archived on 31 August 2026 and its v2.63.23 carries at least 8 published vulnerabilities that will never be patched. After testing the alternatives in Docker on the same folder, FileBrowser Quantum is the drop-in replacement, copyparty the lightweight pick for sharing large files, and Filestash the right one when your data lives in S3, SFTP or SMB.
Paperless-ngx 3 suggests title, tags, correspondent and dates with an LLM and answers questions about your documents, all locally with Ollama. You upgrade from 2.20.15 by changing the image tag. On CPU, Gemma 4 E4B took 25.8 s per suggestion and used about 7 GiB, provided you dodge a bug with reasoning models.
Docker Compose 5.5 changes the digest it uses to decide whether a container's image has changed. On the containerd image store, containers that Compose 2.40 or a pulling 5.4 up labelled with the index digest are recreated once on the first up, with no real change. up --dry-run lists them beforehand.
n8n 3.0 is not out yet: n8n plans it for October 2026 and the stable release is 2.39.6. To prepare a Docker install, open Settings > Migration Report, replace the removed nodes, pin the defaults that change, move binaryData to storage and try the v3-nightly image on a copy.
OpenClaw 2026.9.4 installs with Docker Compose from the official GHCR image, which ships for amd64 and arm64. To run it without a cloud API, connect it to a llama-server on the compose file's internal network. Publish port 18789 on 127.0.0.1 only, because the repository's compose file opens it on every interface.
Jellyfin 12.0 came out on 8 September 2026 and rewrites the database on startup, so there is no way back without a backup. In Docker, the safe path is to stop the container, copy /config, remove third-party plugins, change the tag to 12.0, migrate and run a full library scan.
MinIO images no longer pull from Docker Hub, and the quay.io copy is frozen in 2025. To migrate from MinIO to Garage with Docker, run Garage v2.5.0 next to MinIO, copy the buckets with rclone sync, verify them with rclone check, and switch endpoint, keys and region in your clients.
There are four ways to install llama.cpp: the llama.app script, which drops a 15 MB llama binary into ~/.local/bin; Homebrew; the server-v0.4.1 Docker image; or CMake. I tested them on 14 September 2026 on Linux arm64 with Gemma 4 E2B, in the terminal with llama cli and as an OpenAI-compatible API.
To install Forgejo with Docker, use the codeberg.org/forgejo/forgejo:16.0 image, which since 10 September 2026 is 16.0.4 and fixes a critical remote code execution flaw. Put it behind Caddy with REVERSE_PROXY_TRUSTED_PROXIES set to the proxy's IP, and register Forgejo Runner 13 against the instance's public URL.
Jellyfin is a GPL-2.0 media server that asks for no account and no subscription. You install it from the official compose file, which publishes port 8096 and mounts three separate volumes for configuration, cache and media. The stable release in August 2026 is 10.11.11, and hardware transcoding is included.
Karakeep is a self-hosted bookmark manager that stores links, notes, images and PDFs, archives the whole page with monolith and videos with yt-dlp, and tags everything with a language model. It installs from a three-container compose file, and tagging works with either a hosted model or a local Ollama.
Pangolin is an identity-aware tunneled reverse proxy you install on a VPS with Docker Compose. The Newt connector opens the connection outward from your network to the server, so nothing at home listens for inbound traffic, and Traefik issues the Let's Encrypt certificates at the other end.
Immich installs from two files you download from its latest release, docker-compose.yml and .env, plus one docker compose up -d. The server listens on port 2283, the mobile app uploads your camera roll on its own, and your backup has to include the database, not just the photos.
Pocket ID is an OpenID Connect provider that accepts passkeys and nothing else, so it stores no passwords at all. You deploy it with one container, one port and one env file, it demands HTTPS because WebAuthn needs a secure context, and it puts your self-hosted apps behind single sign-on.
Komodo is a Rust web application that manages containers, compose stacks and image builds across as many servers as you want. You install it with an official compose file that starts MongoDB, the Core server on port 9120 and the Periphery agent, then add each extra machine with an onboarding key.
Dockge edits your compose files and leaves them untouched on disk; Portainer is the mature all-round console, with roles and GitOps reserved for Business Edition, free up to three nodes; Komodo deploys from Git across several servers with nothing held back for paying users, at the cost of a database and one agent per machine.
The Portainer Agent is a container you deploy on each remote machine, exposing port 9001 over TLS. The Portainer server connects to it and manages that host as one more environment, without exposing the Docker socket to the network or maintaining permanent SSH tunnels.
Firecrawl is an open-source API that turns any web page into clean Markdown, ready for a language model. With scrape and crawl endpoints plus schema-guided JSON extraction, it gives your AI agent reliable web data. This guide covers its formats, how to self-host it with Docker and when it beats a scraper of your own.
Deploying an AI agent to production means turning your local script into a containerised service, with external state, observability and managed secrets. In this guide you package an agent inside a minimal Docker image, expose an HTTP endpoint with FastAPI and add health checks, retries and rate limits so it survives real traffic.
SearXNG is a free, privacy-respecting metasearch engine that aggregates results from more than 70 services without tracking or profiling you. With Docker you bring it up in a container alongside Valkey, set a secret_key in settings.yml and in minutes you have your own private search engine listening on port 8080.
Headscale is a free, self-hosted implementation of the Tailscale control server: it gives you a private WireGuard mesh network without depending on Tailscale's cloud or its plan limits. This guide brings it up with Docker Compose in its version 0.29.2, prepares the config.yaml file, registers the first node and adds a web panel with headscale-ui.
Home Assistant Container is the local home-automation platform installed as a Docker container: an official image, port 8123 and host-mode networking to discover devices. This guide brings it up with docker-compose, covers the first boot and backups, and makes clear it does not include the Supervisor add-on store.
Gitea is a self-hosted Git service written in Go, lightweight and a single binary, an alternative to GitHub and GitLab. With Docker you install it from a docker-compose.yml alongside PostgreSQL: it publishes the web interface on port 3000 and Git over SSH on port 22, and is configured with GITEA__ variables. It ships Actions for CI and webhooks.
Vaultwarden is a Bitwarden-compatible password server written in Rust and released under the AGPL-3.0 license that barely uses any RAM. This guide brings it up with Docker Compose, publishes it behind a reverse proxy with HTTPS (mandatory for the browser encryption to work), protects the /admin panel with an ADMIN_TOKEN and closes off registration.
wg-easy is the simplest way to self-host a WireGuard VPN: a single container that bundles the server and a web panel to create clients in one click. This guide brings it up with Docker Compose in its version 15, completes the first-run setup wizard on port 51821 and connects your first device with a QR code.
Nginx Proxy Manager is an open-source reverse proxy that puts a web interface over Nginx and Certbot, so you create proxy hosts and request Let's Encrypt certificates with a few clicks. With Docker it installs as a container next to its database, exposes ports 80, 443 and 81, and spares you from editing Nginx config files by hand.
AdGuard Home is a free, open-source DNS server that blocks ads and trackers across your whole network from a single container. This guide brings it up with Docker Compose, fixes the port 53 conflict, walks through the setup wizard and turns on encrypted DNS and DNS rewrites.
Pi-hole is a DNS server that blocks ads and trackers across your whole network. With Docker you install it from a single docker-compose.yml: version 6 embeds the web panel into the pihole-FTL binary, exposes DNS on port 53 and the admin UI on port 80, and is configured with FTLCONF_-prefixed variables.
changedetection.io is an open-source tool that watches web pages and alerts you when they change: prices, stock, versions or official notices. This guide installs it with Docker Compose, adds a Playwright browser container for JavaScript sites, creates watches with CSS or XPath filters and sends notifications to ntfy or Gotify.
IT-Tools bundles more than eighty developer utilities (JWT, hashes, cron expressions, colour converters) into a single web app that runs entirely in your browser. With Docker you bring it up from one docker-compose.yml, it listens on port 80 and stores nothing: with no server and no database, it needs no volume either.
Gotify is a self-hosted push notification server written in Go and released under the MIT license that gathers messages from your scripts and services in one place. This guide brings it up with Docker Compose on port 80, creates an application with its token and sends the first message through its REST API with curl.
ntfy is a free, open-source HTTP-based push notification service that lets you send alerts to your phone or desktop with a simple PUT or POST request to a topic. This guide runs your own ntfy server with Docker Compose, publishes and subscribes to topics, and adds authentication and access control.
Dashy is a self-hosted start page, written in Vue, that gathers all your services onto a single page with status checking, widgets, themes and icons. With Docker you bring it up with a single docker-compose.yml and one image, lissy93/dashy; all its configuration lives in a conf.yml file that you edit by hand or from its visual interface.
Heimdall is a self-hosted application dashboard, maintained by LinuxServer.io and written in PHP with Laravel, that gathers the links to all your services on a single elegant page. With Docker it installs as one container using the LinuxServer image and the /config volume, with no external database, and it supports enhanced apps that show live status.
Homarr is a service dashboard for your homelab that you configure by dragging and dropping, with no YAML files to edit. With Docker you bring it up with a single docker-compose.yml, it listens on port 7575 and stores everything in its own SQLite database; you only need a 64-character encryption key before you start it.
