Tag
Before upgrading Karakeep to 0.34, look for accounts whose email differs only in case: the migration lowercases every email except those, and they become unreachable with Incorrect email or password. One UPDATE in SQLite fixes it. On top of that, everyone signs in again and the Chrome container moves to a new image.
Audiobookshelf 2.37.1 installs with a one-service docker-compose.yml and four folders: audiobooks, podcasts, config and metadata. This guide starts it with Docker, adds a LibriVox audiobook and an RSS podcast, fixes the metadata, creates a limited user and checks through the API that listening progress is stored per user.
The Plugin 'mysql_native_password' is not loaded error appears because MySQL 8.4 disables that authentication method and 9.x removes it, and mysql:lts is now 9.7.4. Start 8.4 with --mysql-native-password=ON, convert every account to caching_sha2_password with ALTER USER, then move to 9.7.
Wallos 5.8.3 is a subscription and expense tracker you host yourself. I installed it with Docker, loaded 7 subscriptions in euros (EUR 104.14 a month), connected a local ntfy for alerts and restored a backup. Here is the setup, plus the block I hit when alerting an internal server.
The unknown storage type file error appears because OpenBao 2.7 removed the file backend, and the server stops as soon as it reads that configuration. Stop the container, back up the volume, migrate the data to PebbleDB with the 2.7.2 bao operator migrate and change the storage block: your unseal keys and token stay the same.
Infisical is an open-source secrets management platform you install with Docker Compose (Postgres, Redis and a backend) and whose CLI hands each secret to your containers. I installed v0.166.2, created a project with three environments, and an app read its key through infisical run. On an unlicensed instance, only 4 of the 57 plan flags are on.
NetBird 0.82 removed the MySQL engine, and the server stops with the error the MySQL store engine is no longer supported. Roll back to the 0.81.5 image, move the data to PostgreSQL with the netbird-mysql-migrate tool from that same version, because 0.82 no longer ships it, and only then upgrade by pinning the 0.82.0 tag.
Open Archiver v0.6.0 is an AGPL-3.0 platform that archives mail from IMAP, Google Workspace, Microsoft 365, PST, EML and mbox, and indexes it with Meilisearch. I installed it with Docker Compose on 7 October 2026, archived 8 messages from a throwaway IMAP server, imported an mbox and a zip of EML files, and search found text inside a .docx attachment.
Vaultwarden 1.37.5 stops with Error loading config if your .env sets a rate limit or a database timeout to 0, or if a purge schedule is not a valid cron. Fix each variable the log names; out-of-range numbers do not stop it, but they are silently replaced by defaults.
Pinchflat-ngx is a community fork of Pinchflat, the self-hosted YouTube downloader whose repository has had no commits since December 2025. On 7 October 2026 I installed it with Docker Compose, pointed the old Pinchflat volume at the new image and downloaded two Creative Commons videos into a Jellyfin-ready folder, NFO files included.
Moving from Grafana 12.4.12 to 13.2.3 in Docker, my two dashboards kept working, but a script that queried Prometheus by numeric id started returning 404. Grafana 13 disables the by-id data source APIs by default, and the fix is to call by uid. Here is the procedure, with a grafana.db backup and a rollback.
Paperclip is an open-source platform, under the MIT licence, that runs teams of AI agents like a company: tasks, budgets and heartbeats. You self-host it with one Docker Compose file on port 3100, but the first-run wizard asks for a Claude or OpenAI subscription. I tried an agent on a local 0.8B model and it answered wrongly.
Dockhand is a web interface for managing Docker with Compose stacks, Git deploys, vulnerability scanning and SQLite. This guide installs version 1.0.51 with Docker Compose and a socket proxy, deploys a stack and scans an image with Grype. Its BSL 1.1 licence is free at home but paid inside a company.
To upgrade Uptime Kuma 1.23 to version 2 with Docker, stop the container, archive the data directory and switch the image to louislam/uptime-kuma:2.5.9, because latest still points to 1.23.17. The first start aggregates the history into new tables and deletes the raw heartbeats: do not interrupt it, and keep the backup to roll back.
The No vector extension found error appears when Immich v3 starts on the old tensorchord/pgvecto-rs image, because version 3 no longer supports pgvecto.rs. Switch the Postgres image to ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0, let Immich migrate to VectorChord, and you keep smart search and faces.
The quay.io/minio/minio 401 UNAUTHORIZED error is not a credentials problem: MinIO took public access away from that repository in September 2026 and it fails for every tag. Switch the image to cgr.dev/chainguard/minio or pgsty/silo in Compose, Kubernetes or Helm; the AIStor image on Quay still pulls, but without a license it refuses every request.
Traefik logged plugin integrity check failed because its plugin catalog served one zip and validated another. It hit Pangolin's Badger v1.8.0 and Sablier v1.3.1. Traefik fixed it on 30 October 2026: if you pinned the zip hash, remove that line or pin the new hash.
Authentik 2026.8 only accepts X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-For when the connection comes from a network listed in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS. If your reverse proxy sits outside the default private ranges, Authentik treats the request as HTTP and login breaks. Add the proxy's IP or network to that variable and restart.
The UPGRADE PROBLEM: Found an invalid featureCompatibilityVersion document error appears because mongo:latest has pointed at MongoDB 9.0 since 1 October 2026, and 9.0 only opens data at FCV 8.0 or 8.3. Go back to your previous image, move to mongo:8.3, set the FCV to 8.3 and only then switch to 9.0.
The Jellyfin 12 dashboard error r.map is not a function appears when /web/ConfigurationPages returns HTML or an empty body instead of JSON, and the web client keeps that answer in IndexedDB for 24 hours. Fix the reverse proxy, then delete the jellyfin-query-cache key and the browser's cached files.
The gitea/act_runner image has been frozen at v0.6.1 since 30 April 2026; the runner now lives in gitea/runner and is at 5.2.4. The jump keeps your registration, but three changes break jobs: ${VAR} in config.yaml, the valid_volumes wildcard and jobs without runs-on.
Since Caddy 2.11.6, request headers are capped at 16 KiB and anything larger gets 431 Request Header Fields Too Large. Raise the cap with max_header_size in the servers block. The same release silently drops headers that contain a dot, cuts stalled uploads after 60 s and stops inheriting client_auth from a wildcard site.
To install Talos Linux without touching hardware, talosctl cluster create docker brings up a two-node Kubernetes cluster in containers. On real machines or Proxmox three things change: you boot an Image Factory ISO, push the configuration with apply-config and run bootstrap exactly once. Everything is operated through an API, with no SSH.
Gitea 28 shows You cannot import from disallowed hosts when you migrate or mirror from a private IP, such as another container on your Docker network. A hostname is no longer enough: add the source IP or subnet with its port to [migrations] ALLOWED_HOST_LIST, for example 172.31.105.0/24:3000, and the migration goes through.
Docker Desktop 4.94, released on 5 October 2026, uses the local logging driver for new Linux containers: it rotates and compresses with no setup. In my test, 3 million lines took 454.5 MB with json-file and 15.5 MB with local. Docker Engine on Linux still defaults to json-file, so on a server you have to change it yourself.
The pull access denied for minio/mc error appears because MinIO deleted that image from Docker Hub in September 2026, and it stops the whole compose stack even though only the bucket-creation container uses it. Swap it for pgsty/silo, the Chainguard image or aws-cli, or drop the service if your buckets already exist.
The Error loading configuration file: /config/config/encoding.xml message in Jellyfin 12.0 and 12.1 comes from the EncoderPreset xsi:nil line that 10.11 writes by default. The server starts, but transcoding falls back to defaults and QSV is gone. Jump to 12.2 before migrating, or change that line to auto.
To upgrade Nextcloud 34 to 35 in Docker, back up the database and the volume, switch the image to nextcloud:35 and let the container start run occ upgrade. You can only move one major version at a time. What breaks are apps with no release for 35, and going back to 34 means restoring the backup.
Stirling-PDF 3.0.0 upgrades in Docker by changing the image tag: users, settings, API keys and watched folders survive. But 3.0 adds a 1,000 PDFs per month meter for the API and automations, which answers with a 402 error once it runs out, and it needs a new volume for /storage.
To upgrade Gitea 1.27 to Gitea 28 with Docker, stop the container, dump PostgreSQL and the /data volume, remove the legacy egress keys from app.ini and change the tag. In my test a wildcard BLOCKED_DOMAINS entry that was valid on 1.27 stopped 28 from starting, and webhooks to public hosts started going out again.
Gatus is an uptime monitor you configure with YAML files instead of a web interface. With Docker Compose, the v5.37.0 image and a volume for SQLite, it checks HTTP, TCP, certificates and DNS TXT records, and alerts through a webhook. In my test it alerted on an nginx outage after 30 seconds, the time three 10-second checks take.
The pull access denied for minio/minio error appears because MinIO removed its Docker Hub images in September 2026, and quay.io has required an account since the 24th. Point your compose file at cgr.dev/chainguard/minio, at the pgsty/silo fork or at an image built from source: your existing data keeps working.
To migrate from MinIO to RustFS 1.0 with Docker, run RustFS next to MinIO, import the users with mc admin cluster iam, copy the buckets with rclone sync --metadata and compare them with rclone check --download. In my test 4,012 objects arrived identical; versions, tags and public access had to be redone by hand.
To install OpenBao with Docker, run the openbao/openbao:2.6.2 image with Raft storage on a volume, initialise it with bao operator init and unseal it with three of the five keys. OpenBao is the MPL 2.0 fork of HashiCorp Vault and keeps its API, so your applications read secrets the same way.
To migrate Langfuse v3 to v4 with Docker Compose, first upgrade ClickHouse to 26.4 while still on v3, back up PostgreSQL and ClickHouse, start v4 in dual write mode, backfill the history and cut over to events_only once every SDK is compatible. I tested it with 45,931 traces and three Python SDK versions.
File Browser was archived on 31 August 2026 and its v2.63.23 carries at least 8 published vulnerabilities that will never be patched. After testing the alternatives in Docker on the same folder, FileBrowser Quantum is the drop-in replacement, copyparty the lightweight pick for sharing large files, and Filestash the right one when your data lives in S3, SFTP or SMB.
n8n 3.0 is not out yet: n8n plans it for October 2026 and the stable release is 2.39.6. To prepare a Docker install, open Settings > Migration Report, replace the removed nodes, pin the defaults that change, move binaryData to storage and try the v3-nightly image on a copy.
Jellyfin 12.0 came out on 8 September 2026 and rewrites the database on startup, so there is no way back without a backup. In Docker, the safe path is to stop the container, copy /config, remove third-party plugins, change the tag to 12.0, migrate and run a full library scan.
MinIO images no longer pull from Docker Hub, and the quay.io copy is frozen in 2025. To migrate from MinIO to Garage with Docker, run Garage v2.5.0 next to MinIO, copy the buckets with rclone sync, verify them with rclone check, and switch endpoint, keys and region in your clients.
To install Forgejo with Docker, use the codeberg.org/forgejo/forgejo:16.0 image, which since 10 September 2026 is 16.0.4 and fixes a critical remote code execution flaw. Put it behind Caddy with REVERSE_PROXY_TRUSTED_PROXIES set to the proxy's IP, and register Forgejo Runner 13 against the instance's public URL.
n8n is not open source: its Sustainable Use License limits you to your own internal business purposes and forbids charging people to access a hosted instance. Activepieces publishes its core under MIT but keeps agents, projects and API access outside it. Windmill compiles to AGPLv3 from source, yet the distributed Community Edition is not open.
Jellyfin is a GPL-2.0 media server that asks for no account and no subscription. You install it from the official compose file, which publishes port 8096 and mounts three separate volumes for configuration, cache and media. The stable release in August 2026 is 10.11.11, and hardware transcoding is included.
k3s and k0s are Kubernetes distributions you install on a conventional Linux host you keep administering; Talos Linux is an immutable operating system with no shell and no package manager, driven by an API, running upstream Kubernetes. They are not layers: you pick one, and node count decides which.
k3s is a conformant Kubernetes distribution that fits in a 68 MiB binary and installs with one command. It ships containerd, Flannel, CoreDNS, Traefik, ServiceLB and local storage already wired, keeps its state in SQLite, and has a node serving in three seconds.
Karakeep is a self-hosted bookmark manager that stores links, notes, images and PDFs, archives the whole page with monolith and videos with yt-dlp, and tags everything with a language model. It installs from a three-container compose file, and tagging works with either a hosted model or a local Ollama.
Pangolin is an identity-aware tunneled reverse proxy you install on a VPS with Docker Compose. The Newt connector opens the connection outward from your network to the server, so nothing at home listens for inbound traffic, and Traefik issues the Let's Encrypt certificates at the other end.
Immich installs from two files you download from its latest release, docker-compose.yml and .env, plus one docker compose up -d. The server listens on port 2283, the mobile app uploads your camera roll on its own, and your backup has to include the database, not just the photos.
Pocket ID is an OpenID Connect provider that accepts passkeys and nothing else, so it stores no passwords at all. You deploy it with one container, one port and one env file, it demands HTTPS because WebAuthn needs a secure context, and it puts your self-hosted apps behind single sign-on.
