DevOps

Using Docker Desktop at work without a license. Use Rancher Desktop instead. It's essentially like what Oracle did with the Oracle JDK. To my knowledge they haven't gone after anyone but it is technically a license violation to use it for work without a license. I could not (easily) find a way to install Docker on Mac without using Docker Desktop but Rancher Desktop worked fine.

Also, podman exists as a drop in replacement for Docker for the curious. I haven't tried it myself though so this isn't a recommendation.

The biggest footgun I encounter every time I set up a raspberry pi or other linux host for a side project is forgetting that Docker doesn't do log rotation for containers' logs by default, which results in the service going down and seeing a sweat inducing ENOSPC error when you ssh in to check it out.

You can configure this by creating /etc/docker/daemon.json and either setting up log rotation with log-opts or using the local logging driver (it defaults to json) if you're not shipping container logs anywhere and just read the logs locally. The local driver compresses the logs and automatically does log rotation:

{
  "log-driver": "local",
  "log-opts": {
     "max-size": "10m",
     "max-file": "3"
  }
}

Be really careful when building images that require secrets for build configuration. Secrets can be passed in as build args, but you MUST UNSET THEM IN THE DOCKERFILE and then repass them in as environment variables at runtime (or else you are leaking your secrets with your image).

Also, image != container. Image is the thing you publish to a registry (e.g. dockerhub). Container is an instance of an image.

• Docker swarm does not respect its own compose spec, exposes services on all interfaces and bypasses firewall rules [1], [2]
• 1 million SLOC daemon running as root [1]
• Buggy network implementation, sometimes requires restarting the daemon to release bridges [1]
• Requires frequent rebuilds to keep up to date with security patches [1] [2] [3]
• No proper support for external config files/templating, not possible to do graceful reloads, requires full restarts/downtime for simple configuration changes [1]
• Buggy NAT implementation [1]
• Buggy overlay network implementation, causes TCP resets [1]
• No support for PID limits/fork bomb protection [1], no support for I/O limits [2]
• No sane/safe garbage collection mechanism, docker system prune --all deletes all unused volumes - including named volumes which are unused because the container/swarm service that uses them is stopped at that particular moment for whatever reason. Eats disk space like mad [1] [2]
• Requires heavy tooling if you're serious about it (CI, container scanning tools, highly-available registry...) [1], Docker development and infrastructure is fully controlled by Docker Inc. [1] [2] [3] [4] [5] [6]