Docker on Ricky

Articles

Wed, 10 Jun 2026 10:59:53 +0800

Linux 系统误将 chmod 权限改成了 000，如何恢复?

#include <sys/stat.h>

int main() {
 chmod("/usr/bin/chmod", 0755);
 return 0;
}

ubuntu@ubuntu:~$ which chmod
/usr/bin/chmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27 2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
-rwxr-xr-x 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod
ubuntu@ubuntu:~$ sudo chmod 000 /usr/bin/chmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27 2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
---------- 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod
ubuntu@ubuntu:~$ cat main.c
#include <sys/stat.h>

int main() {
 chmod("/usr/bin/chmod", 0755);
 return 0;
}

ubuntu@ubuntu:~$ gcc ./main.c
ubuntu@ubuntu:~$ sudo ./a.out
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27 2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
-rwxr-xr-x 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod

Laptops all have built-in security tokens these days

macOS

https://github.com/yubico/libfido2

Replace Watchtower with WUD: Build a Controlled Docker Auto-Update Plan

Sun, 11 Jan 2026 15:22:11 +0800

Replace Watchtower with WUD: Build a Controlled Docker Auto-Update Plan

WUD (What’s Up Docker)

services:
 wud:
 image: getwud/wud:latest
 container_name: wud
 restart: unless-stopped
 ports:
 - "3000:3000"
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock
 - ./store:/store
 environment:
 - TZ=Asia/Shanghai

 # Local Docker watcher
 - WUD_WATCHER_LOCAL_SOCKET=/var/run/docker.sock

 # Key: do not watch any containers by default
 - WUD_WATCHER_LOCAL_WATCHBYDEFAULT=false

 # Scan every 12 hours
 - WUD_WATCHER_LOCAL_CRON=0 */12 * * *

 # Auto update + prune old images after update
 - WUD_TRIGGER_DOCKER_AUTO_PRUNE=true # Equivalent to `watchtower --cleanup`

Monitor only (no auto update)

labels:
 - "wud.watch=true"

Appears in the WUD UI
Shows update hints
Does not auto-restart

Monitor + auto update (Watchtower equivalent)

labels:
 - "wud.watch=true"
 - "wud.trigger.include=docker.auto"

Docker Containers Can't Access the Internet? NAT Configuration Guide for nftables

Wed, 03 Sep 2025 09:03:00 +0800

Docker Containers Can’t Access the Internet? NAT Configuration Guide for nftables

Use LinuxServer.io Docker Images to Turn Desktop Apps into Web Apps

Fri, 01 Aug 2025 15:52:00 +0800

Gluetun: Route Docker Containers Through a VPN, Disconnect on No Network

Fri, 01 Aug 2025 15:51:00 +0800

Gluetun: Route Docker Containers Through a VPN, Disconnect on No Network

Gluetun

OpenVPN

services:
 gluetun:
 image: qmcgaw/gluetun
 container_name: gluetun
 restart: unless-stopped
 cap_add:
 - NET_ADMIN
 devices:
 - /dev/net/tun:/dev/net/tun
 ports:
 - 8888:8888/tcp # HTTP proxy
 - 8388:8388/tcp # Shadowsocks
 - 8388:8388/udp # Shadowsocks
 volumes:
 - /home/user/gluetun:/gluetun
 environment: # Fill in based on your VPN provider's OpenVPN config
 - VPN_SERVICE_PROVIDER=protonvpn
 - VPN_TYPE=openvpn
 - OPENVPN_USER= # OpenVPN username
 - OPENVPN_PASSWORD= # OpenVPN password
 - SERVER_COUNTRIES=United Kingdom # Set server country, separated by commas
 networks: # (Optional) fixed IP for the Gluetun container
 network:
 ipv4_address: 172.27.0.5

networks: # (Optional) fixed IP for the Gluetun container
 network:
 driver: bridge
 ipam:
 config:
 - subnet: 172.27.0.0/16
 gateway: 172.27.0.5

WireGuard

services:
 gluetun:
 image: qmcgaw/gluetun
 container_name: gluetun
 restart: unless-stopped
 cap_add:
 - NET_ADMIN
 devices:
 - /dev/net/tun:/dev/net/tun
 ports:
 - 8888:8888/tcp # HTTP proxy
 - 8388:8388/tcp # Shadowsocks
 - 8388:8388/udp # Shadowsocks
 volumes:
 - /home/user/gluetun:/gluetun
 environment:
 - VPN_SERVICE_PROVIDER=protonvpn # Fill in based on your VPN provider's WireGuard config
 - VPN_TYPE=wireguard
 - WIREGUARD_PRESHARED_KEY= # Preshared key
 - WIREGUARD_PRIVATE_KEY= # Private key
 - WIREGUARD_ADDRESSES= # Set IPv4 and IPv6 addresses, separated by commas
 - SERVER_COUNTRIES=United Kingdom # Set server country, separated by commas
 networks: # (Optional) fixed IP for the Gluetun container
 network:
 ipv4_address: 172.27.0.5

networks: # (Optional) fixed IP for the Gluetun container
 network:
 driver: bridge
 ipam:
 config:
 - subnet: 172.27.0.0/16
 gateway: 172.27.0.5

Let containers use Gluetun’s VPN connection

If the service and Gluetun are in the same docker-compose, add network mode: network_mode: “service:gluetun”
If the service is in a different docker-compose from Gluetun, add network_mode: “container:gluetun”
Open Gluetun’s docker-compose file and re-add the service ports you need (e.g. 8080)
Start Gluetun first, then start services that should use Gluetun’s VPN connection
The container’s public IP should match the VPN server you selected

Build a Private Object Storage with Traefik v3 and MinIO in Docker

Tue, 06 Aug 2024 12:26:26 +0800

Container security fundamentals

Wed, 04 Oct 2023 09:06:00 +0800

Faster Multi-Platform Builds: Dockerfile Cross-Compilation Guide

Mon, 04 Sep 2023 10:31:54 +0800

Faster Multi-Platform Builds: Dockerfile Cross-Compilation Guide

method

docker buildx create --use
FROM --platform=linux/amd64 debian / FROM --platform=$BUILDPLATFORM debian
variables

BUILDPLATFORM — matches the current machine. (e.g. linux/amd64)
BUILDOS — os component of BUILDPLATFORM, e.g. linux
BUILDARCH — e.g. amd64, arm64, riscv64
BUILDVARIANT — used to set ARM variant, e.g. v7
TARGETPLATFORM — The value set with --platform flag on build
TARGETOS - OS component from --platform, e.g. linux
TARGETARCH - Architecture from --platform, e.g. arm64
TARGETVARIANT

example

before

FROM golang:1.17-alpine AS build
WORKDIR /src
COPY . .
RUN go build -o /out/myapp .

FROM alpine
COPY --from=build /out/myapp /bin

after

FROM --platform=$BUILDPLATFORM golang:1.17-alpine AS build
WORKDIR /src
ARG TARGETOS TARGETARCH
RUN --mount=target=. \
 --mount=type=cache,target=/root/.cache/go-build \
 --mount=type=cache,target=/go/pkg \
 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /out/myapp .

FROM alpine
COPY --from=build /out/myapp /bin

Elasticsearch Study Notes

Thu, 06 Oct 2022 11:30:59 +0800

Elasticsearch Study Notes

Install the Chinese analyzer plugin

docker exec -it elasticsearch bash
$ elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v8.4.1/elasticsearch-analysis-ik-8.4.1.zip

Dev Tools
- The content field is text. Use ik_max_word for indexing and ik_smart for searching. The former generates as many tokens as possible, while the latter generates coarser-grained tokens.

PUT /words
{
 "mappings": {
 "properties": {
 "content": {
 "type": "text",
 "analyzer": "ik_max_word",
 "search_analyzer": "ik_smart"
 },
 "age": {
 "type": "integer",
 "index": false
 }
 }
 }
}

{
 "acknowledged": true,
 "shards_acknowledged": true,
 "index": "words"
}

Build a Lightweight Docker Image for Your Go App? | IT Man

Mon, 25 Jul 2022 17:33:47 +0800

Build a Lightweight Docker Image for Your Go App? | IT Man

go build

# default
$ go build -o test1 main.go
$ du -sh test1
14M test1


# You can add `-ldflags "-s -w"` during compilation to reduce the binary size by stripping some link and debug info. Details:
# -a: force rebuilding all dependencies
# -s: drop symbol table info; stack traces in panic will lose file/line info
# -w: drop DWARF debug info; you cannot debug with gdb
# If you don't need the symbol table, you can just use "-s"
# Note: it is not recommended to use -w and -s together
$ go build -ldflags "-s -w" -o test2 main.go
$ du -sh test2
11M test2

upx(`brew/yum install upx`)

$ upx test2
 Ultimate Packer for eXecutables
 Copyright (C) 1996 - 2020
UPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020
 File size Ratio Format Name
 -------------------- ------ ----------- -----------
 11490768 -> 4063248 35.36% macho/amd64 test2
Packed 1 file.

$ upx --brute test2
$ du -sh test2
4.6M test2

UPX compression options

Docker Introduction

Fri, 17 Sep 2021 14:11:03 +0800

Docker

Concept

VM vs Container

VM - Base on OS
Container - Base on Application (Linux Kernel: Namespace and Cgroup)

Client to Server

Docker daemon - containerd, docker-containerd-shim, docker-runc
Docker client - cli command

docker cli -> docker daemon -> containerd -> runc -> namespace & cgroup

Image

Snapshots

Container

Read-Only processes on image

Hub / Registry

Store images

References

Docker commands

Dockerfile

ARG dist="/tmp/password"
ARG projectDir="/password"

FROM golang:1.16-alpine3.14 AS builder
RUN apk add build-base upx
ARG dist
ARG projectDir
WORKDIR ${projectDir}
COPY . .
RUN go build -trimpath -o main cmd/main.go
RUN upx -9 -o ${dist} main

FROM scratch
ARG dist
ENV TZ=Asia/Taipei
COPY --from=builder ${dist} /usr/local/bin/password

Dockerfile1

FROM alpine
CMD ["nc","-l","12345"]

Dockerfile2

FROM alpine
CMD ["echo","DOCKER"]

docker build command

docker build . -t program

docker build . -f Dockerfile -t test_mysql

docker build . -t hello:v1.1 --build-arg dist=/tmp/hello --build-arg projectDir=/hello

docker build

. docker/status
echo -e "${GREEN}Before build${RESET}"
docker image ls
docker build . -f docker/Dockerfile1 -t test1
docker build . -f docker/Dockerfile2 -t test2

docker image

. docker/status
echo -e "${GREEN}After build${RESET}"
docker image ls

docker run AND rm

. docker/status
echo -e "${GREEN}Run container1${RESET}"
docker run -d --name container1 test1
echo -e "${GREEN}Run container2${RESET}"
docker run -d --name container2 test2
echo -e "${GREEN}List alive containers${RESET}"
docker ps
echo -e "${GREEN}List all containers${RESET}"
docker ps -a
echo -e "${GREEN}Remove alive container${RESET}"
docker rm -f container1
echo -e "${GREEN}List all containers${RESET}"
docker ps -a
echo -e "${GREEN}Remove exit container${RESET}"
docker rm container2
echo -e "${GREEN}List all containers${RESET}"
docker ps -a

docker pull AND rmi

. docker/status
echo -e "${GREEN}List all image${RESET}"
docker image ls
echo -e "${GREEN}Pull alpine image${RESET}"
docker pull alpine
echo -e "${GREEN}List all image${RESET}"
docker image ls

docker rmi

. docker/status
echo -e "${GREEN}Remove alpine image${RESET}"
docker rmi alpine
echo -e "${GREEN}List all image${RESET}"
docker image ls

prune

docker system prune -f --volumes

docker history

. docker/status
echo -e "${GREEN}History of test1${RESET}"
docker history test1
echo -e "${GREEN}History of mysql:8${RESET}"
docker history mysql:8

Docker remote

Edit service file

# /lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375

Restart service

systemctl daemon-reload
systemctl restart docker

Specify DOCKER_HOST

. docker/status
echo -e "${GREEN}List images on 192.168.185.9${RESET}"
DOCKER_HOST=192.168.185.9:2375 docker images

Docker-compose

version: "3"

services:
 svn:
 image: zeyanlin/svn
 environment:
 - LDAP_HOSTS=${LDAP_HOSTS}
 - LDAP_BASE_DN=${LDAP_BASE_DN}
 - LDAP_BIND_DN=${LDAP_BIND_DN}
 - LDAP_ADMIN_PASS=${LDAP_ADMIN_PASS}
 ports:
 - 8000:80
 - 3690:3690
 depends_on:
 - ldap
 ldap:
 image: zeyanlin/openldap
 environment:
 - LDAP_DOMAIN=${LDAP_DOMAIN}
 - LDAP_ADMIN_PASS=${LDAP_ADMIN_PASS}
 ports:
 - 389:389
 - 636:636
 php:
 image: zeyanlin/phpldapadmin
 environment:
 - LDAP_HOSTS=${LDAP_HOSTS}
 ports:
 - 80:80
 depends_on:
 - ldap

Env

LDAP_HOSTS=ldap
LDAP_DOMAIN="knowhow.fun"
LDAP_BASE_DN="dc=knowhow,dc=fun"
LDAP_BIND_DN="cn=admin"
LDAP_ADMIN_PASS="123qwe"

Docker Security Best Practices: Cheat Sheet

Fri, 20 Aug 2021 23:14:30 +0800

Docker Security Best Practices: Cheat Sheet

Image Security

Use Trusted Images

Unprivileged User

FROM base_image
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

User ID Namespace

Segregate namespaces to prevent container privilege escalation from affecting the host.

To mitigate this risk, configure your host and the Docker daemon to use a separate namespace with the --userns-remap option.

Container Runtime Security

Forbid New Privileges

For enhanced security, it is recommended to explicitly forbid the addition of new privileges after container creation using this option: --security-opt=no-new-privileges.

docker-compose yaml problem

Mon, 19 Jul 2021 15:40:36 +0800

issue

# ./docker-compose up -d
Creating network "gogs_default" with the default driver
Creating gogs_mysql_1 ... done
Creating gogs_gogs_1 ... error

ERROR: for gogs_gogs_1 Cannot create container for service gogs: invalid port specification: "133342"

ERROR: for gogs Cannot create container for service gogs: invalid port specification: "133342"
ERROR: Encountered errors while bringing up the project.

services:
 gogs:
 ports:
 - 2222:22

YAML supports so-called “base-60 floating-point numbers,” which is useful for time calculations.

Therefore, 2222:22 is interpreted as 2222 * 60 + 22, which is 133342.

Docker Tips: Using Docker Config

Mon, 14 Sep 2020 11:13:23 +0800

Docker Tips: Using Docker Config

FROM nginx:1.13.6
COPY nginx.conf /etc/nginx/nginx.conf

Using the Docker CLI, we can create a config from this configuration file, we name this config proxy.

$ docker config create proxy nginx.conf
mdcfnxud53ve6jgcgjkhflg0s

$ docker config inspect proxy
[
 {
 "ID": "x06uaozphg9kbnf8g4az4mucn",
 "Version": {
 "Index": 2723
 },
 "CreatedAt": "2017-11-21T07:49:09.553666064Z",
 "UpdatedAt": "2017-11-21T07:49:09.553666064Z",
 "Spec": {
 "Name": "proxy",
 "Labels": {},
 "Data": "dXNlciB3d3ctZGF0YTsKd29y...ogIgICAgIH0KICAgIH0KfQo="
 }
 }
]

Use a Config

$ docker network create --driver overlay front
$ docker service create --name api --network front lucj/api
$ docker service create --name proxy \
 --network front \
 --config src=proxy,target=/etc/nginx/nginx.conf \
 --port 8000:8000 \
 nginx:1.13.6

Service Update

When the content of a configuration needs to be modified, it’s a common pattern to create a new config (using docker config create), and then to update the service order to remove the access to the previous config, and to add the access to the new one. The service commands are--config-rm and --config-add.

How to deploy on remote Docker hosts with docker-compose

Wed, 25 Mar 2020 19:30:54 +0800

How to deploy on remote Docker hosts with docker-compose

Manual deployment by copying project files, install docker-compose and running it

$ scp -r hello-docker user@remotehost:/path/to/src
$ ssh user@remotehost
$ pip install docker-compose
$ cd /path/to/src/hello-docker
$ docker-compose up -d

Using DOCKER_HOST environment variable to set up the target engine

$ cd hello-docker
$ DOCKER_HOST="ssh://user@remotehost" docker-compose up -d

Using docker contexts

$ docker context create remote ‐‐docker "host=ssh://user@remotemachine"
remote
Successfully created context "remote"

$ docker context ls
NAME DESCRIPTION DOCKER ENDPOINT KUBERNETES ENDPOINT ORCHESTRATOR
default * Current DOCKER_HOST… unix:///var/run/docker.sock swarm
remote ssh://user@remotemachine

$ cd hello-docker
$ docker-compose ‐‐context remote up -d