{"slug": "docker", "name": "Docker", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "Platform for building, shipping and running applications in Linux containers.", "recommenders": 36, "commenters": 107, "warners": 18, "score": 29.168, "rising": 4.15, "first": "2025-11-05", "latest": "2026-10-30", "why": "Liked for keeping dev dependencies off the host machine, for sandboxing AI coding agents, and for simple self-hosting and deployment.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 36, "neutral": 53, "compare": 5, "warn": 21}, "spark": [1, 3, 9, 1, 2, 2, 1, 2, 3, 3, 0, 9], "listed": true, "loved": ["Self-hosting", "Host isolation"], "caveat": "macOS experience", "short_quote": "I'm able to easily run the latest version of Docker.  They care about my use case, make my life as a sysadmin easier, so I use their software.", "icon": true, "domain": "docker.com", "github_repo": null, "official_url": "https://www.docker.com", "pricing": "freemium", "aliases": ["Docker"], "verdict": [{"text": "Liked for keeping dev dependencies off the host machine,", "cites": [{"id": 803263600, "item_id": 50203975, "url": "https://news.ycombinator.com/item?id=50203975", "by": "vbezhenar", "date": "2026-10-23", "stance": "recommend", "quote": "I always felt uneasy installing various things onto my host and docker just solved that uneasiness.", "excerpt": "What made Docker unique IMO is not the container technology itself. I used chroot 20 years ago and it worked just fine. Yes, no network namespaces; no process namespaces, but I don't even think these are that important. What made Docker unique were there things: 1. Dockerfile concept. Building images layer by layer. Caching layers. Everything in a single file. It made possible to iterate on image quickly. It made pos", "context": "", "use_case": "deploying software in containers", "switched_from": "", "story": "Docker is weird"}, {"id": 746913312, "item_id": 46682082, "url": "https://news.ycombinator.com/item?id=46682082", "by": "K0IN", "date": "2026-01-19", "stance": "recommend", "quote": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system.", "excerpt": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system. Vscode.", "context": "", "use_case": "test databases, running apps", "switched_from": "", "story": "Ask HN: What non-LLM tools have meaningfully improved your dev productivity?"}, {"id": 763909440, "item_id": 47744340, "url": "https://news.ycombinator.com/item?id=47744340", "by": "raw_anon_1111", "date": "2026-04-12", "stance": "recommend", "quote": "I do everything inside Docker containers", "excerpt": "I do consulting work with AWS + backend development and since agentic coding became a thing, I have started doing more internal admin websites - completely vibe coded. I never build/install/run websites or npm packages directly on my computer. I do everything inside Docker containers and have Claude debug websites using Docker + playwright + headless chrome and just give Claude temporary JWT tokens.", "context": "AWS and backend consultant doing vibe-coded admin sites", "use_case": "sandboxing builds and websites", "switched_from": "", "story": "Ask HN: Has anyone reconsidered Antivirus software after recent security news?"}]}, {"text": " for sandboxing AI coding agents,", "cites": [{"id": 803198578, "item_id": 50199911, "url": "https://news.ycombinator.com/item?id=50199911", "by": "smashed", "date": "2026-10-22", "stance": "recommend", "quote": "I chose to build straight on top of docker and agents are simply fully sandboxed by default.", "excerpt": "Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1] Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate ac", "context": "", "use_case": "sandbox base for agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 800993185, "item_id": 50062074, "url": "https://news.ycombinator.com/item?id=50062074", "by": "entropie", "date": "2026-10-12", "stance": "recommend", "quote": "I use nixos and use a little wrapper that wraps Codex CLI in Docker.", "excerpt": "I used codex the first time yesterday and quickly decided I need to sandbox it and came up with a pretty easy and straightforward solution (I think). I use nixos and use a little wrapper that wraps Codex CLI in Docker. Run codex-box /path/to/project and it starts or reuses a container with only that project bind-mounted, keeping login and history in a separate volume. It uses tmux for detaching and reattaching https:", "context": "NixOS user", "use_case": "sandboxing Codex CLI", "switched_from": "", "story": "Codex CLI installs a persistent, self-updating background daemon by default"}]}, {"text": " and for simple self-hosting and deployment.", "cites": [{"id": 751459476, "item_id": 46966217, "url": "https://news.ycombinator.com/item?id=46966217", "by": "digiown", "date": "2026-02-10", "stance": "recommend", "quote": "install docker, and run it", "excerpt": "Proxmox is probably overkill for beginners. You'll know it when you want it. I recommend docker-compose based tools, especially dockge [1]. It drastically cuts down on the surface of weird things you have to deal with. Just put up a reasonable distro (I recommend Debian here, since Fedora tends to get some SELinux issues which would confuse beginners), install docker, and run it. You don't have to touch anything else", "context": "", "use_case": "running self-hosted services", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 745133104, "item_id": 46570819, "url": "https://news.ycombinator.com/item?id=46570819", "by": "aristofun", "date": "2026-01-10", "stance": "recommend", "quote": "it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "excerpt": "Yes, it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "context": "", "use_case": "deploying apps on a VPS", "switched_from": "", "story": "Ask HN: Should I learn Docker to deploy my app in VPS?"}, {"id": 782894449, "item_id": 48930903, "url": "https://news.ycombinator.com/item?id=48930903", "by": "SMFloris", "date": "2026-07-15", "stance": "recommend", "quote": "What I use and really recommend is using systemd +/- docker.", "excerpt": "IMO, kubernetes is overkill for a small non-homogeneous home cluster. What I use and really recommend is using systemd +/- docker. It just becomes so darn simple. Do not go the compose route (that route is filled with sadness of the incomplete stacks because db container failed silently kind) - instead aim to decompose the compose files and write a separate systemd service file for each of them, you can then assign l", "context": "", "use_case": "homelab containers", "switched_from": "", "story": "Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes"}]}, {"text": " The most common complaint is a poor experience on macOS,", "cites": [{"id": 782233024, "item_id": 48889564, "url": "https://news.ycombinator.com/item?id=48889564", "by": "rh94", "date": "2026-07-13", "stance": "warn", "quote": "Docker Mac expirience is pretty bad especially the x86 is just painful", "excerpt": "Yeah docker Mac expirience is pretty bad especially the x86 is just painful, and to your comment (about security), it should not really matter in practice, in fact we used both, but goal really is to run secure sandboxes that are processes without performance impact.", "context": "", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 782230720, "item_id": 48889420, "url": "https://news.ycombinator.com/item?id=48889420", "by": "plextoria", "date": "2026-07-13", "stance": "warn", "quote": "I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos.", "excerpt": "Thank you! A project like this was on my wishlist for a long time. Colleagues looked at me like I'm weird when I was saying containers without a VM should be possible on macOS. I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos. I wonder if some of the macOS sandboxing features can be used instead of relying solely on the JIT", "context": "switched to a Linux laptop", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 761282321, "item_id": 47580145, "url": "https://news.ycombinator.com/item?id=47580145", "by": "fabianlindfors", "date": "2026-03-30", "stance": "warn", "quote": "We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac.", "excerpt": "We have been trying to solve the same problem (and a bunch of other ones) with https://specific.dev as well. We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac. Our approach is having our CLI handle port assignments (and pass any connection details/ports along as env vars) and that way being able to spin up \u201cisolated\u201d copies of the local dev environment. Ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Coasts \u2013 Containerized Hosts for Agents"}]}, {"text": " followed by a root daemon and firewall changes that create security footguns.", "cites": [{"id": 803308912, "item_id": 50206807, "url": "https://news.ycombinator.com/item?id=50206807", "by": "enriquto", "date": "2026-10-23", "stance": "warn", "quote": "Why doesn't docker respect unix filesystem permissions?  I use docker on a shared server, i can delete docker images of other users.  This is bonkers.", "excerpt": "> I'm happy to answer any questions you may have. Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers. Is it a defect of a particular docker setup (following standard instructions on ubuntu), or it's an intrinsic feature of docker itself?", "context": "", "use_case": "shared server containers", "switched_from": "", "story": "Docker is weird"}, {"id": 792041729, "item_id": 49502608, "url": "https://news.ycombinator.com/item?id=49502608", "by": "lucideer", "date": "2026-08-30", "stance": "warn", "quote": "taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS", "excerpt": "I don't think this is as widely known as you believe: I use dockerd via colima so it's not a limitation I've encountered - if I had, I likely would've switched to podman wholesale instead of compromising my system. Either way though, I would hope it's self-evident to most that taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS is generally not desira", "context": "", "use_case": "containers", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 792037089, "item_id": 49502318, "url": "https://news.ycombinator.com/item?id=49502318", "by": "drnick1", "date": "2026-08-30", "stance": "warn", "quote": "it will silently overwrite iptables rules and punch holes in your firewall.", "excerpt": "> I always make my user part of the docker group I don't, and I migrated to Podman because Docker is poorly designed and full of footguns. For example, it it will silently overwrite iptables rules and punch holes in your firewall.", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 803370097, "item_id": 50210631, "url": "https://news.ycombinator.com/item?id=50210631", "by": "freedomben", "date": "2026-10-23", "stance": "warn", "quote": "Docker takes a wrecking ball to the firewall rules", "excerpt": "This is the primary selling point of podman to me actually: If you run any non-standard firewall rules (in my case I use virt-manager to run a handful of VMs using a bridge so each VM can get an IP directly on my router's subnet), some stuff may suddenly break because Docker takes a wrecking ball to the firewall rules.", "context": "", "use_case": "containers", "switched_from": "", "story": "Docker is weird"}]}], "praise": [{"label": "Self-hosting", "summary": "Commenters use it, often with Compose or systemd, as an easy way to run self-hosted services and small apps.", "quotes": [{"id": 751459476, "item_id": 46966217, "url": "https://news.ycombinator.com/item?id=46966217", "by": "digiown", "date": "2026-02-10", "stance": "recommend", "quote": "install docker, and run it", "excerpt": "Proxmox is probably overkill for beginners. You'll know it when you want it. I recommend docker-compose based tools, especially dockge [1]. It drastically cuts down on the surface of weird things you have to deal with. Just put up a reasonable distro (I recommend Debian here, since Fedora tends to get some SELinux issues which would confuse beginners), install docker, and run it. You don't have to touch anything else", "context": "", "use_case": "running self-hosted services", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 745133104, "item_id": 46570819, "url": "https://news.ycombinator.com/item?id=46570819", "by": "aristofun", "date": "2026-01-10", "stance": "recommend", "quote": "it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "excerpt": "Yes, it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "context": "", "use_case": "deploying apps on a VPS", "switched_from": "", "story": "Ask HN: Should I learn Docker to deploy my app in VPS?"}, {"id": 782894449, "item_id": 48930903, "url": "https://news.ycombinator.com/item?id=48930903", "by": "SMFloris", "date": "2026-07-15", "stance": "recommend", "quote": "What I use and really recommend is using systemd +/- docker.", "excerpt": "IMO, kubernetes is overkill for a small non-homogeneous home cluster. What I use and really recommend is using systemd +/- docker. It just becomes so darn simple. Do not go the compose route (that route is filled with sadness of the incomplete stacks because db container failed silently kind) - instead aim to decompose the compose files and write a separate systemd service file for each of them, you can then assign l", "context": "", "use_case": "homelab containers", "switched_from": "", "story": "Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes"}]}, {"label": "Host isolation", "summary": "Keeps apps, test databases and dependencies from cluttering or conflicting on the host.", "quotes": [{"id": 803263600, "item_id": 50203975, "url": "https://news.ycombinator.com/item?id=50203975", "by": "vbezhenar", "date": "2026-10-23", "stance": "recommend", "quote": "I always felt uneasy installing various things onto my host and docker just solved that uneasiness.", "excerpt": "What made Docker unique IMO is not the container technology itself. I used chroot 20 years ago and it worked just fine. Yes, no network namespaces; no process namespaces, but I don't even think these are that important. What made Docker unique were there things: 1. Dockerfile concept. Building images layer by layer. Caching layers. Everything in a single file. It made possible to iterate on image quickly. It made pos", "context": "", "use_case": "deploying software in containers", "switched_from": "", "story": "Docker is weird"}, {"id": 746913312, "item_id": 46682082, "url": "https://news.ycombinator.com/item?id=46682082", "by": "K0IN", "date": "2026-01-19", "stance": "recommend", "quote": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system.", "excerpt": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system. Vscode.", "context": "", "use_case": "test databases, running apps", "switched_from": "", "story": "Ask HN: What non-LLM tools have meaningfully improved your dev productivity?"}, {"id": 801792848, "item_id": 50112053, "url": "https://news.ycombinator.com/item?id=50112053", "by": "eddythompson80", "date": "2026-10-16", "stance": "recommend", "quote": "docker isolation is nice just as a management boundary.", "excerpt": "docker isolation is nice just as a management boundary. It's nice to be sure applications don't accidently shit all over each other. Like an application that decides to clear /tmp because reasons, or 2 random ones that both store temp state in a /tmp/state.dat for some odd reason. My favorite is applications that conflict on ports. So you go to change the port an application is listening on, the docs say PORT env var", "context": "", "use_case": "isolating applications", "switched_from": "", "story": "What I self-host"}]}, {"label": "Agent sandboxing", "summary": "Used as a sandbox for AI coding agents such as Codex and Claude.", "quotes": [{"id": 803198578, "item_id": 50199911, "url": "https://news.ycombinator.com/item?id=50199911", "by": "smashed", "date": "2026-10-22", "stance": "recommend", "quote": "I chose to build straight on top of docker and agents are simply fully sandboxed by default.", "excerpt": "Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1] Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate ac", "context": "", "use_case": "sandbox base for agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 800993185, "item_id": 50062074, "url": "https://news.ycombinator.com/item?id=50062074", "by": "entropie", "date": "2026-10-12", "stance": "recommend", "quote": "I use nixos and use a little wrapper that wraps Codex CLI in Docker.", "excerpt": "I used codex the first time yesterday and quickly decided I need to sandbox it and came up with a pretty easy and straightforward solution (I think). I use nixos and use a little wrapper that wraps Codex CLI in Docker. Run codex-box /path/to/project and it starts or reuses a container with only that project bind-mounted, keeping login and history in a separate volume. It uses tmux for detaching and reattaching https:", "context": "NixOS user", "use_case": "sandboxing Codex CLI", "switched_from": "", "story": "Codex CLI installs a persistent, self-updating background daemon by default"}, {"id": 763909440, "item_id": 47744340, "url": "https://news.ycombinator.com/item?id=47744340", "by": "raw_anon_1111", "date": "2026-04-12", "stance": "recommend", "quote": "I do everything inside Docker containers", "excerpt": "I do consulting work with AWS + backend development and since agentic coding became a thing, I have started doing more internal admin websites - completely vibe coded. I never build/install/run websites or npm packages directly on my computer. I do everything inside Docker containers and have Claude debug websites using Docker + playwright + headless chrome and just give Claude temporary JWT tokens.", "context": "AWS and backend consultant doing vibe-coded admin sites", "use_case": "sandboxing builds and websites", "switched_from": "", "story": "Ask HN: Has anyone reconsidered Antivirus software after recent security news?"}]}, {"label": "Reproducibility", "summary": "Gives consistent, predictable build and runtime environments for teams and CI.", "quotes": [{"id": 789296353, "item_id": 49331022, "url": "https://news.ycombinator.com/item?id=49331022", "by": "speleding", "date": "2026-08-17", "stance": "recommend", "quote": "Put it in a docker container if you want to ensure it is perfectly reproducible.", "excerpt": "If your app is not too large you can do CI/CD perfectly fine from your laptop. Put it in a docker container if you want to ensure it is perfectly reproducible. You still need Github as the origin repo to pull from, but the \"git part\" of GitHub seems to be (almost) always up and running. (We use \"capistrano\" for this)", "context": "", "use_case": "reproducible CI/CD", "switched_from": "", "story": "Incident with Github.com"}, {"id": 745106704, "item_id": 46569169, "url": "https://news.ycombinator.com/item?id=46569169", "by": "ghoshbishakh", "date": "2026-01-10", "stance": "recommend", "quote": "I use it always to set up my dev environment so that the team can have a consistent environment to work on.", "excerpt": "Should you learn - yes. Do you really need it - probably not now, but eventually yes. I use it always to set up my dev environment so that the team can have a consistent environment to work on.", "context": "", "use_case": "consistent dev environments", "switched_from": "", "story": "Ask HN: Should I learn Docker to deploy my app in VPS?"}, {"id": 741141585, "item_id": 46321349, "url": "https://news.ycombinator.com/item?id=46321349", "by": "lrvick", "date": "2025-12-18", "stance": "recommend", "quote": "Vanilla docker/buildkit works just fine", "excerpt": "You do not need a custom buildkit frontend to do reproducible builds with any modern container build system, including docker. Vanilla docker/buildkit works just fine as we use it in Stagex with just makefiles and Containerfiles which makes it super easy for anyone to reproduce our images with identical digests, and audit the process. The only thing non default we do to docker is have it use the containerd backend th", "context": "", "use_case": "reproducible container builds", "switched_from": "", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}]}, {"label": "Works everywhere", "summary": "Reported to install easily and work out of the box, including on older LTS distros.", "quotes": [{"id": 792089569, "item_id": 49505598, "url": "https://news.ycombinator.com/item?id=49505598", "by": "0xbadcafebee", "date": "2026-08-31", "stance": "recommend", "quote": "Docker works out of the box everywhere.", "excerpt": "First they should try making a solution that works as well as Docker. Every time I use Podman or Podman Desktop I run into the most basic problems. Docker works out of the box everywhere.", "context": "", "use_case": "containers", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 780571121, "item_id": 48785695, "url": "https://news.ycombinator.com/item?id=48785695", "by": "rsyring", "date": "2026-07-04", "stance": "recommend", "quote": "I'm able to easily run the latest version of Docker.  They care about my use case, make my life as a sysadmin easier, so I use their software.", "excerpt": "I think you are taking an overly simplistic and dismissive view. There's no confusion. I understand Podman's position. I'm simply saying that position keeps them from gaining enough users to really compete with Docker. I run LTS Ubuntu versions for core stability. That usually doesn't keep me from getting the latest version of software that it makes sense to keep updated. Case in point...Docker! So, on my \"old\" versi", "context": "sysadmin running LTS Ubuntu", "use_case": "containers on LTS Ubuntu", "switched_from": "", "story": "Podman v6.0.0"}, {"id": 745096800, "item_id": 46568550, "url": "https://news.ycombinator.com/item?id=46568550", "by": "uberman", "date": "2026-01-10", "stance": "recommend", "quote": "Imho, yes.", "excerpt": "Imho, yes. Installing docker is generally simple. Docker desktop on windows or just follow the steps in the docks for linux. Reading and using a simple dockerfile is also dead simple. Understanding compose and port and volume mapping is a bit trickier but not daunting. Once you have the basics of understanding a dockerfile you can switch to doing container based development in vscode and you will never go back to wri", "context": "", "use_case": "container-based development and deployment", "switched_from": "", "story": "Ask HN: Should I learn Docker to deploy my app in VPS?"}]}, {"label": "Ecosystem", "summary": "Containers are seen as the de facto deployment unit, with a lot of tooling built around them.", "quotes": [{"id": 803282368, "item_id": 50205148, "url": "https://news.ycombinator.com/item?id=50205148", "by": "kqr", "date": "2026-10-23", "stance": "recommend", "quote": "the Linux container had become the de facto standard unit of deployment. There is so much tooling written under that assumption", "excerpt": "The momentum, I think, matters a lot more than the other two. Makefiles already allowed you to build layered things with caching. Artifact repositories have also long been a thing. But the argument I used for advocating Docker in environments where people were not fans of it was that the Linux container had become the de facto standard unit of deployment. There is so much tooling written under that assumption, and if", "context": "advocated Docker in environments", "use_case": "deployment", "switched_from": "", "story": "Docker is weird"}, {"id": 803263600, "item_id": 50203975, "url": "https://news.ycombinator.com/item?id=50203975", "by": "vbezhenar", "date": "2026-10-23", "stance": "recommend", "quote": "I always felt uneasy installing various things onto my host and docker just solved that uneasiness.", "excerpt": "What made Docker unique IMO is not the container technology itself. I used chroot 20 years ago and it worked just fine. Yes, no network namespaces; no process namespaces, but I don't even think these are that important. What made Docker unique were there things: 1. Dockerfile concept. Building images layer by layer. Caching layers. Everything in a single file. It made possible to iterate on image quickly. It made pos", "context": "", "use_case": "deploying software in containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803310224, "item_id": 50206889, "url": "https://news.ycombinator.com/item?id=50206889", "by": "smcleod", "date": "2026-10-23", "stance": "recommend", "quote": "we quickly started to shift to Docker", "excerpt": "Back in 2012 we used to give talks about how we ran all our CI builds in LXC containers, that came about because a bunch of us came from the BSD / Solaris world of jails and it just felt natural. The folks at infracoders / DevOps meetups would think we were a bit \"out there\", then what do you know - 2013 rolls around and we quickly started to shift to Docker (too early some might say), but not long after shifting fro", "context": "", "use_case": "CI builds, containerisation", "switched_from": "LXC", "story": "Docker is weird"}]}], "caveats": [{"label": "macOS experience", "summary": "Several commenters call Docker on Mac slow or painful, and one switched to a Linux laptop over it.", "quotes": [{"id": 782233024, "item_id": 48889564, "url": "https://news.ycombinator.com/item?id=48889564", "by": "rh94", "date": "2026-07-13", "stance": "warn", "quote": "Docker Mac expirience is pretty bad especially the x86 is just painful", "excerpt": "Yeah docker Mac expirience is pretty bad especially the x86 is just painful, and to your comment (about security), it should not really matter in practice, in fact we used both, but goal really is to run secure sandboxes that are processes without performance impact.", "context": "", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 782230720, "item_id": 48889420, "url": "https://news.ycombinator.com/item?id=48889420", "by": "plextoria", "date": "2026-07-13", "stance": "warn", "quote": "I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos.", "excerpt": "Thank you! A project like this was on my wishlist for a long time. Colleagues looked at me like I'm weird when I was saying containers without a VM should be possible on macOS. I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos. I wonder if some of the macOS sandboxing features can be used instead of relying solely on the JIT", "context": "switched to a Linux laptop", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 761282321, "item_id": 47580145, "url": "https://news.ycombinator.com/item?id=47580145", "by": "fabianlindfors", "date": "2026-03-30", "stance": "warn", "quote": "We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac.", "excerpt": "We have been trying to solve the same problem (and a bunch of other ones) with https://specific.dev as well. We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac. Our approach is having our CLI handle port assignments (and pass any connection details/ports along as env vars) and that way being able to spin up \u201cisolated\u201d copies of the local dev environment. Ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Coasts \u2013 Containerized Hosts for Agents"}]}, {"label": "Root security", "summary": "The rootful daemon ignores Unix permissions and raises security concerns.", "quotes": [{"id": 803308912, "item_id": 50206807, "url": "https://news.ycombinator.com/item?id=50206807", "by": "enriquto", "date": "2026-10-23", "stance": "warn", "quote": "Why doesn't docker respect unix filesystem permissions?  I use docker on a shared server, i can delete docker images of other users.  This is bonkers.", "excerpt": "> I'm happy to answer any questions you may have. Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers. Is it a defect of a particular docker setup (following standard instructions on ubuntu), or it's an intrinsic feature of docker itself?", "context": "", "use_case": "shared server containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803309872, "item_id": 50206867, "url": "https://news.ycombinator.com/item?id=50206867", "by": "coldtea", "date": "2026-10-23", "stance": "neutral", "quote": "Docker is a service daemon running as root", "excerpt": ">Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers. Same reason a Postgres root can delete tables of other users. It could, but it would be a shim on top of Docker to respect them. Docker is a service daemon running as root, and the images of other users are just entries created by the other users in its registry, not se", "context": "", "use_case": "container management", "switched_from": "", "story": "Docker is weird"}, {"id": 792041729, "item_id": 49502608, "url": "https://news.ycombinator.com/item?id=49502608", "by": "lucideer", "date": "2026-08-30", "stance": "warn", "quote": "taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS", "excerpt": "I don't think this is as widely known as you believe: I use dockerd via colima so it's not a limitation I've encountered - if I had, I likely would've switched to podman wholesale instead of compromising my system. Either way though, I would hope it's self-evident to most that taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS is generally not desira", "context": "", "use_case": "containers", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}]}, {"label": "Firewall rules", "summary": "Docker silently rewrites iptables rules, which can break custom networking.", "quotes": [{"id": 803370097, "item_id": 50210631, "url": "https://news.ycombinator.com/item?id=50210631", "by": "freedomben", "date": "2026-10-23", "stance": "warn", "quote": "Docker takes a wrecking ball to the firewall rules", "excerpt": "This is the primary selling point of podman to me actually: If you run any non-standard firewall rules (in my case I use virt-manager to run a handful of VMs using a bridge so each VM can get an IP directly on my router's subnet), some stuff may suddenly break because Docker takes a wrecking ball to the firewall rules.", "context": "", "use_case": "containers", "switched_from": "", "story": "Docker is weird"}, {"id": 792037089, "item_id": 49502318, "url": "https://news.ycombinator.com/item?id=49502318", "by": "drnick1", "date": "2026-08-30", "stance": "warn", "quote": "it will silently overwrite iptables rules and punch holes in your firewall.", "excerpt": "> I always make my user part of the docker group I don't, and I migrated to Podman because Docker is poorly designed and full of footguns. For example, it it will silently overwrite iptables rules and punch holes in your firewall.", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}]}, {"label": "Fiddly to manage", "summary": "Some find it hard to manage outside a day job or a constant fight for advanced setups.", "quotes": [{"id": 771824064, "item_id": 48239004, "url": "https://news.ycombinator.com/item?id=48239004", "by": "tencentshill", "date": "2026-05-22", "stance": "warn", "quote": "Docker is a nightmare to manage if it's not part of your day job to do so.", "excerpt": ">To get set up with Jellyfin, I highly recommend using Docker Compose. It makes setup trivial! 90% of home Plex users dropped out right there. Docker is a nightmare to manage if it's not part of your day job to do so.", "context": "", "use_case": "home media server setup", "switched_from": "", "story": "Plex's Lifetime Pass is (basically) dead"}, {"id": 753844096, "item_id": 47115256, "url": "https://news.ycombinator.com/item?id=47115256", "by": "einarfd", "date": "2026-02-22", "stance": "warn", "quote": "But you kind of have to fight docker the whole way.", "excerpt": "I\u2019ve been building sandboxing for Claude code workloads. So I can let it run wild without breaking my computer. Originally I used docker, but I\u2019m now in the process of jettisoning that, and switching to qemu. For my use case I want ssh access and being able to use docker in docker. This allows for things like test containers and docker compose. You can get all of that working with docker. But you kind of have to figh", "context": "building sandboxing for Claude Code workloads", "use_case": "sandboxing Claude Code workloads", "switched_from": "", "story": "NanoClaw Moved from Apple Containers to Docker"}, {"id": 747069826, "item_id": 46691864, "url": "https://news.ycombinator.com/item?id=46691864", "by": "replete", "date": "2026-01-20", "stance": "warn", "quote": "though docker has its frustrating behaviours", "excerpt": "It's a practical approach, I used vagrant many years ago mostly successfully. I also explored the docker-in-docker situation recently while working on my own agentic devcontainer[0]- the tradeoffs are quite serious if you are building a secure sandbox! Data exfil is what worries me most, so I spent quite some time figuring out a decent self-contained interactive firewall. From a DX perspective, devcontainer-integrate", "context": "", "use_case": "devcontainer sandbox", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}]}, {"label": "Disk space", "summary": "One user reports running out of disk space and needing frequent reboots to reclaim it.", "quotes": [{"id": 779737552, "item_id": 48733597, "url": "https://news.ycombinator.com/item?id=48733597", "by": "elAhmo", "date": "2026-06-30", "stance": "warn", "quote": "now with Docker I have to restart regularly as I frequently get notes about 'no more disk space'", "excerpt": "I used to be in this camp, maybe not 150+ days but with month+ uptimes, but now with Docker I have to restart regularly as I frequently get notes about 'no more disk space' and the only way to reclaim is is to reboot.", "context": "", "use_case": "", "switched_from": "", "story": "Have You Restarted Your Computer This Week?"}]}, {"label": "Docker Hub logins", "summary": "A paying user complains that OAuth logins expire within hours, which breaks image fetching for CI.", "quotes": [{"id": 747785888, "item_id": 46736618, "url": "https://news.ycombinator.com/item?id=46736618", "by": "wcallahan", "date": "2026-01-23", "stance": "warn", "quote": "my oAuth logins to Docker expire within hours now", "excerpt": "I suspect the timing of this and comments is not coincidental. I pay for Docker licenses, even though not meeting the criteria for business size requiring it, as I wanted reliable image fetching for my self hosted container CI/CD pipelines failing docker hub image fetches. But as of now, my oAuth logins to Docker expire within hours now, and I\u2019ve been left with no choice but to scatter in search of diffuse container ", "context": "runs self-hosted container CI/CD", "use_case": "container image fetching in CI/CD", "switched_from": "", "story": "What Has Docker Become?"}]}], "who": [{"by": "Terr_", "context": "home desktop user", "url": "https://news.ycombinator.com/item?id=50299437", "date": "2026-10-30"}, {"by": "kqr", "context": "advocated Docker in environments", "url": "https://news.ycombinator.com/item?id=50205148", "date": "2026-10-23"}, {"by": "steezeburger", "context": "professional software engineer", "url": "https://news.ycombinator.com/item?id=50119583", "date": "2026-10-16"}, {"by": "diebillionaires", "context": "self-hoster", "url": "https://news.ycombinator.com/item?id=50112542", "date": "2026-10-16"}, {"by": "VCFundedGenYer", "context": "self-hosting since 2020", "url": "https://news.ycombinator.com/item?id=50110306", "date": "2026-10-15"}, {"by": "caivi", "context": "AI-powered forward engineer looking for work", "url": "https://news.ycombinator.com/item?id=50081293", "date": "2026-10-14"}, {"by": "entropie", "context": "NixOS user", "url": "https://news.ycombinator.com/item?id=50062074", "date": "2026-10-12"}, {"by": "stego-tech", "context": "self-hosts services", "url": "https://news.ycombinator.com/item?id=49966336", "date": "2026-10-05"}, {"by": "devdoshi", "context": "solo work", "url": "https://news.ycombinator.com/item?id=49352009", "date": "2026-08-18"}, {"by": "sidfer", "context": "job seeker, CS student", "url": "https://news.ycombinator.com/item?id=49261025", "date": "2026-08-11"}, {"by": "danielnexaaly", "context": "AI-assisted technical operator", "url": "https://news.ycombinator.com/item?id=49251761", "date": "2026-08-10"}, {"by": "emanuelecz", "context": "self-taught AI engineer", "url": "https://news.ycombinator.com/item?id=49224408", "date": "2026-08-08"}], "tags": ["for self-hosters", "for sandboxing AI agents", "for teams", "for Linux users"], "use_cases": ["containers", "deployment", "self-hosting services", "running self-hosted services", "development environments", "containers on macos"], "compared": [{"slug": "podman", "name": "Podman", "co": 49, "switched_from": 0, "switched_to": 14}, {"slug": "firecracker", "name": "Firecracker", "co": 4, "switched_from": 0, "switched_to": 2}, {"slug": "docker-compose", "name": "Docker Compose", "co": 8, "switched_from": 0, "switched_to": 0}, {"slug": "dagger", "name": "Dagger", "co": 5, "switched_from": 0, "switched_to": 1}, {"slug": "postgresql", "name": "PostgreSQL", "co": 7, "switched_from": 0, "switched_to": 0}, {"slug": "kubernetes", "name": "Kubernetes", "co": 7, "switched_from": 0, "switched_to": 0}, {"slug": "claude-code", "name": "Claude Code", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "codex", "name": "Codex", "co": 6, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 803281952, "item_id": 50205122, "url": "https://news.ycombinator.com/item?id=50205122", "by": "shykes", "date": "2026-10-23", "stance": "recommend", "quote": "So now Docker is this cool experience I share with lots of people around the world", "excerpt": "I feel grateful for having seen from the inside one of those rare \"hypergrowth\" moments, it's a terrifying and exhausting experience but I would do it all over again without hesitation. I also feel lucky that people are still using my work, that it endures without me, and that it generates (mostly) positive reactions. There was a time where Docker had a lot of haters, which was hard on me. But with time I've noticed ", "context": "creator of Docker", "use_case": "containers", "switched_from": "", "story": "Docker is weird"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50202681", "title": "Docker is weird", "mentions": 9}, {"url": "https://news.ycombinator.com/item?id=49156682", "title": "Ask HN: Who wants to be hired? (August 2026)", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=46568318", "title": "Ask HN: Should I learn Docker to deploy my app in VPS?", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=50109715", "title": "What I self-host", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=48762098", "title": "Podman v6.0.0", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=49499854", "title": "Omarchy: Any User Process Can Escalate to Root", "mentions": 3}], "sentiment_by_month": {"2025-11": {"neutral": 3, "recommend": 1}, "2025-12": {"recommend": 3, "compare": 1, "neutral": 1}, "2026-01": {"compare": 2, "recommend": 9, "neutral": 5, "warn": 3}, "2026-02": {"neutral": 6, "recommend": 1, "warn": 1}, "2026-03": {"compare": 1, "neutral": 6, "recommend": 2, "warn": 3}, "2026-04": {"recommend": 2, "warn": 1}, "2026-05": {"neutral": 4, "recommend": 1, "warn": 3}, "2026-06": {"recommend": 2, "compare": 1, "warn": 1}, "2026-07": {"neutral": 10, "recommend": 3, "warn": 2}, "2026-08": {"neutral": 8, "recommend": 3, "warn": 2}, "2026-09": {"neutral": 2, "warn": 1}, "2026-10": {"neutral": 8, "warn": 4, "recommend": 9}}, "quotes": [{"id": 804790993, "item_id": 50299437, "url": "https://news.ycombinator.com/item?id=50299437", "by": "Terr_", "date": "2026-10-30", "stance": "neutral", "quote": "I can put most software-development stuff into a rootless Docker container to deter supply-chain attacks", "excerpt": "Recently I've been musing about how to harden my home desktop setup, and perhaps Qubes is still something to look into. At present, I still feel a little pang of paranoia/guilt whenever I use sudo from the same account I do most of my web-browsing on. I can put most software-development stuff into a rootless Docker container to deter supply-chain attacks--I'm not sure how that compares to Qubes virtualization--but if", "context": "home desktop user", "use_case": "isolating dev work", "switched_from": "", "story": "Partitioning my digital life into security domains (2011)"}, {"id": 804011808, "item_id": 50250738, "url": "https://news.ycombinator.com/item?id=50250738", "by": "the__alchemist", "date": "2026-10-26", "stance": "warn", "quote": "I don't think they're a great solution, as it complicates software distribution.", "excerpt": "I agree - the model I use for why containers (Docker etc) exist is to abstract over Linux ABI incompatibility. I don't think they're a great solution, as it complicates software distribution. I should be able to distribute an executable and have it just work.", "context": "", "use_case": "abstracting Linux ABI differences", "switched_from": "", "story": "Oldest GUI application that still runs on Windows 11"}, {"id": 803418624, "item_id": 50213664, "url": "https://news.ycombinator.com/item?id=50213664", "by": "cloudyporpoise", "date": "2026-10-23", "stance": "neutral", "quote": "I still prefer building code through Docker but that's about all I use it for.", "excerpt": "I see less and less of a need for Docker when running simple linux hosts and building with terraform \\ ansible. For any codebase with dep management it is great and I still prefer building code through Docker but that's about all I use it for.", "context": "", "use_case": "building code with dependencies", "switched_from": "", "story": "Docker is weird"}, {"id": 803389936, "item_id": 50211871, "url": "https://news.ycombinator.com/item?id=50211871", "by": "zbentley", "date": "2026-10-23", "stance": "recommend", "quote": "Rootless docker, last I used it, behaved sensibly", "excerpt": "I think there's two questions there: Q: Why not have container builds and runs be invoking-user-specific by default? A: As the adjacent commenter pointed out, this would be an overlay on fundamentally rootful behavior. It would also remove a lot of \"works on my machine, works anywhere\", since different user accounts running/building containers could be restricted in different ways on different computers, so my \"docke", "context": "", "use_case": "running containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803370097, "item_id": 50210631, "url": "https://news.ycombinator.com/item?id=50210631", "by": "freedomben", "date": "2026-10-23", "stance": "warn", "quote": "Docker takes a wrecking ball to the firewall rules", "excerpt": "This is the primary selling point of podman to me actually: If you run any non-standard firewall rules (in my case I use virt-manager to run a handful of VMs using a bridge so each VM can get an IP directly on my router's subnet), some stuff may suddenly break because Docker takes a wrecking ball to the firewall rules.", "context": "", "use_case": "containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803310224, "item_id": 50206889, "url": "https://news.ycombinator.com/item?id=50206889", "by": "smcleod", "date": "2026-10-23", "stance": "recommend", "quote": "we quickly started to shift to Docker", "excerpt": "Back in 2012 we used to give talks about how we ran all our CI builds in LXC containers, that came about because a bunch of us came from the BSD / Solaris world of jails and it just felt natural. The folks at infracoders / DevOps meetups would think we were a bit \"out there\", then what do you know - 2013 rolls around and we quickly started to shift to Docker (too early some might say), but not long after shifting fro", "context": "", "use_case": "CI builds, containerisation", "switched_from": "LXC", "story": "Docker is weird"}, {"id": 803309872, "item_id": 50206867, "url": "https://news.ycombinator.com/item?id=50206867", "by": "coldtea", "date": "2026-10-23", "stance": "neutral", "quote": "Docker is a service daemon running as root", "excerpt": ">Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers. Same reason a Postgres root can delete tables of other users. It could, but it would be a shim on top of Docker to respect them. Docker is a service daemon running as root, and the images of other users are just entries created by the other users in its registry, not se", "context": "", "use_case": "container management", "switched_from": "", "story": "Docker is weird"}, {"id": 803308912, "item_id": 50206807, "url": "https://news.ycombinator.com/item?id=50206807", "by": "enriquto", "date": "2026-10-23", "stance": "warn", "quote": "Why doesn't docker respect unix filesystem permissions?  I use docker on a shared server, i can delete docker images of other users.  This is bonkers.", "excerpt": "> I'm happy to answer any questions you may have. Why doesn't docker respect unix filesystem permissions? I use docker on a shared server, i can delete docker images of other users. This is bonkers. Is it a defect of a particular docker setup (following standard instructions on ubuntu), or it's an intrinsic feature of docker itself?", "context": "", "use_case": "shared server containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803282368, "item_id": 50205148, "url": "https://news.ycombinator.com/item?id=50205148", "by": "kqr", "date": "2026-10-23", "stance": "recommend", "quote": "the Linux container had become the de facto standard unit of deployment. There is so much tooling written under that assumption", "excerpt": "The momentum, I think, matters a lot more than the other two. Makefiles already allowed you to build layered things with caching. Artifact repositories have also long been a thing. But the argument I used for advocating Docker in environments where people were not fans of it was that the Linux container had become the de facto standard unit of deployment. There is so much tooling written under that assumption, and if", "context": "advocated Docker in environments", "use_case": "deployment", "switched_from": "", "story": "Docker is weird"}, {"id": 803263600, "item_id": 50203975, "url": "https://news.ycombinator.com/item?id=50203975", "by": "vbezhenar", "date": "2026-10-23", "stance": "recommend", "quote": "I always felt uneasy installing various things onto my host and docker just solved that uneasiness.", "excerpt": "What made Docker unique IMO is not the container technology itself. I used chroot 20 years ago and it worked just fine. Yes, no network namespaces; no process namespaces, but I don't even think these are that important. What made Docker unique were there things: 1. Dockerfile concept. Building images layer by layer. Caching layers. Everything in a single file. It made possible to iterate on image quickly. It made pos", "context": "", "use_case": "deploying software in containers", "switched_from": "", "story": "Docker is weird"}, {"id": 803198578, "item_id": 50199911, "url": "https://news.ycombinator.com/item?id=50199911", "by": "smashed", "date": "2026-10-22", "stance": "recommend", "quote": "I chose to build straight on top of docker and agents are simply fully sandboxed by default.", "excerpt": "Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1] Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate ac", "context": "", "use_case": "sandbox base for agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 802604914, "item_id": 50162807, "url": "https://news.ycombinator.com/item?id=50162807", "by": "gojkoa", "date": "2026-10-20", "stance": "neutral", "quote": "The agents are running inside a docker container", "excerpt": "This is a minimal boilerplate so that part was excluded but in the real setup this was extracted from we use AWS SSO from the CLI to authenticate against AWS (short-lived tokens) and the keys for other things are in the AWS SSM parameter store as secure strings (encrypted), locked down with IAM so that agents can only access specific (test) keys while developing. The agents are running inside a docker container (this", "context": "", "use_case": "isolating coding agents", "switched_from": "", "story": "Show HN: Lights-on software factory boilerplate for Claude Code"}, {"id": 801913329, "item_id": 50119583, "url": "https://news.ycombinator.com/item?id=50119583", "by": "steezeburger", "date": "2026-10-16", "stance": "recommend", "quote": "you can't act like k8s and docker are overkill and fiddly simply because you haven't found a need for them yet.", "excerpt": "How is it a waste of time to health check your self hosted services? I use these services. I need them to work and be available. Bookmark manager, media server, my note taking app, a book server for friends, a few Discord bots I run, I've ran long running game servers for friends and a couple of little apps, home automation with CV ran on premise. We're obviously doing different things and have different priorities, ", "context": "professional software engineer", "use_case": "self-hosting services", "switched_from": "", "story": "What I self-host"}, {"id": 801800672, "item_id": 50112542, "url": "https://news.ycombinator.com/item?id=50112542", "by": "diebillionaires", "date": "2026-10-16", "stance": "recommend", "quote": "i love docker and exposing my services publicly", "excerpt": "to each their own i guess. i love docker and exposing my services publicly. and fortunately i bought 64gb 3 years ago :)", "context": "self-hoster", "use_case": "self-hosting services", "switched_from": "", "story": "What I self-host"}, {"id": 801792848, "item_id": 50112053, "url": "https://news.ycombinator.com/item?id=50112053", "by": "eddythompson80", "date": "2026-10-16", "stance": "recommend", "quote": "docker isolation is nice just as a management boundary.", "excerpt": "docker isolation is nice just as a management boundary. It's nice to be sure applications don't accidently shit all over each other. Like an application that decides to clear /tmp because reasons, or 2 random ones that both store temp state in a /tmp/state.dat for some odd reason. My favorite is applications that conflict on ports. So you go to change the port an application is listening on, the docs say PORT env var", "context": "", "use_case": "isolating applications", "switched_from": "", "story": "What I self-host"}, {"id": 801764896, "item_id": 50110306, "url": "https://news.ycombinator.com/item?id=50110306", "by": "VCFundedGenYer", "date": "2026-10-15", "stance": "neutral", "quote": "lots of things started becoming available in Docker", "excerpt": "I stared self hosting in 2020 when Raspberry Pis were super cheap (not anymore :( ) and lots of things started becoming available in Docker. Haven't ever considered going back to the cloud. I love taking back full control.", "context": "self-hosting since 2020", "use_case": "self-hosting", "switched_from": "", "story": "What I self-host"}, {"id": 801300691, "item_id": 50081293, "url": "https://news.ycombinator.com/item?id=50081293", "by": "caivi", "date": "2026-10-14", "stance": "neutral", "quote": "Technologies: Opencode / Codex / Jcode, Tmux, Docker", "excerpt": "Location: Minneapolis, MN, USA Remote: Yes Willing to relocate: No Technologies: Opencode / Codex / Jcode, Tmux, Docker, Python, Node, TypeScript, Ansible, Postgres, Supabase/Neon/Render, automated CI / CD test pipelines, Sentry, FastAPI, Express/Hono R\u00e9sum\u00e9/CV: https://drive.google.com/file/d/1swpa5LInVdPEtjhhwxFWGsge8K5... Email: christopherisler1@gmail.com Portfolio: https://github.com/chrisisler - AI-powered forw", "context": "AI-powered forward engineer looking for work", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (October 2026)"}, {"id": 800993185, "item_id": 50062074, "url": "https://news.ycombinator.com/item?id=50062074", "by": "entropie", "date": "2026-10-12", "stance": "recommend", "quote": "I use nixos and use a little wrapper that wraps Codex CLI in Docker.", "excerpt": "I used codex the first time yesterday and quickly decided I need to sandbox it and came up with a pretty easy and straightforward solution (I think). I use nixos and use a little wrapper that wraps Codex CLI in Docker. Run codex-box /path/to/project and it starts or reuses a container with only that project bind-mounted, keeping login and history in a separate volume. It uses tmux for detaching and reattaching https:", "context": "NixOS user", "use_case": "sandboxing Codex CLI", "switched_from": "", "story": "Codex CLI installs a persistent, self-updating background daemon by default"}, {"id": 800546866, "item_id": 50034179, "url": "https://news.ycombinator.com/item?id=50034179", "by": "Cort3z", "date": "2026-10-10", "stance": "warn", "quote": "So much software I love keeps doing this. redis, docker, now bitwarden.", "excerpt": "I hate this. So much software I love keeps doing this. redis, docker, now bitwarden. I was so happy with bitwarden. Been a premium subscriber for many years. I have helped convert many people, including whole companies, to use this. Now they are doing us such a disservice. We need a completely free, no-nonsence, alternative. I wonder if it is possible to do a ipfs/torrent version without a central authority to perman", "context": "", "use_case": "", "switched_from": "", "story": "Bitwarden Dual License Model"}, {"id": 800509921, "item_id": 50031870, "url": "https://news.ycombinator.com/item?id=50031870", "by": "pjmlp", "date": "2026-10-10", "stance": "neutral", "quote": "Agents take more time than building Docker images.", "excerpt": "Since nowadays I use WSL to run immutable containers, and not really classical Linux Desktop, it isn't something that bothers me. Agents take more time than building Docker images.", "context": "", "use_case": "building container images", "switched_from": "", "story": "WSL3 Performance is about 5-60% faster than WSL2 depending on the workload"}, {"id": 799461378, "item_id": 49966336, "url": "https://news.ycombinator.com/item?id=49966336", "by": "stego-tech", "date": "2026-10-05", "stance": "neutral", "quote": "hosting media to friends and family on Docker", "excerpt": "Man, I\u2019ve felt this way for decades now. It\u2019s a constant fight just to accomplish basic utility without divulging everything short of your genetic code to hundreds of \u201cpartners\u201d in the process. It\u2019s at the point that I spend more time trying to get relatives off tech entirely instead of helping them utilize it to improve their lives, for the simple reason tech doesn\u2019t improve life right now, at least not for a lot of", "context": "self-hosts services", "use_case": "running self-hosted services", "switched_from": "", "story": "\"I'm Embarrassed on Behalf of the Tech Industry\""}, {"id": 797195281, "item_id": 49824705, "url": "https://news.ycombinator.com/item?id=49824705", "by": "dawnerd", "date": "2026-09-24", "stance": "warn", "quote": "I was tired of docker slowing my Mac down with some really heavy client projects", "excerpt": "I\u2019ve been using it daily since it came out. At first it was because I was tired of docker slowing my Mac down with some really heavy client projects. But now I use it as an easier ssh client w/ file editing. I really don\u2019t like using vim/nano. Keeping everything in the same ide, huge for me.", "context": "", "use_case": "local development", "switched_from": "", "story": "VSCode's SSH Agent Is Bananas (2025)"}, {"id": 796770817, "item_id": 49798176, "url": "https://news.ycombinator.com/item?id=49798176", "by": "stevefan1999", "date": "2026-09-22", "stance": "neutral", "quote": "For me I went Docker and Kubernetes.", "excerpt": "Indeed. I still remember deploying GAE apps with Java WAR and Python Django as a kid 13 years ago. Then Heroku and now fly.io and Render. For me I went Docker and Kubernetes. Back then GAE has a really good free tier, so I used it to deploy a HTTP proxy to bypass school network", "context": "", "use_case": "deployment", "switched_from": "", "story": "Python Workers are now generally available"}, {"id": 795260963, "item_id": 49703810, "url": "https://news.ycombinator.com/item?id=49703810", "by": "jacobgold", "date": "2026-09-14", "stance": "neutral", "quote": "The Docker containers keep each session isolated", "excerpt": "Since you asked, the answer is that I built and use an agent multiplexer called Clor https://clor.com I have a $200/mo Claude subscription and a $200/mo Codex subscription, and I'm signed in to both. The Docker containers keep each session isolated, so dev servers, browser testing, etc. can work without conflicts. It includes `/ask-claude` and `/ask-codex` skills that I use very frequently to have the Claude or Codex", "context": "", "use_case": "isolating agent sessions", "switched_from": "", "story": "GPT-5.6 Luna vs. GPT-6 Astra: Is a $1.20 Model Good Enough for Code Review?"}, {"id": 792106147, "item_id": 49506634, "url": "https://news.ycombinator.com/item?id=49506634", "by": "Schlagbohrer", "date": "2026-08-31", "stance": "neutral", "quote": "running in a docker container", "excerpt": "I have found the Pi agent harness, running in a docker container, with Qwen3.8-27B in back in LM Studio, to be amazing and i use it daily. Just last weekend I used it to do PDF editing which previously would have required me to download really shady software online to do. I have never tried OpenClaw so maybe I am missing out but considering how much my agent can modify the Pi environment to work better, I am happy wi", "context": "", "use_case": "sandboxing agent", "switched_from": "", "story": "OpenClaw 2.0, Accidentally"}, {"id": 792089569, "item_id": 49505598, "url": "https://news.ycombinator.com/item?id=49505598", "by": "0xbadcafebee", "date": "2026-08-31", "stance": "recommend", "quote": "Docker works out of the box everywhere.", "excerpt": "First they should try making a solution that works as well as Docker. Every time I use Podman or Podman Desktop I run into the most basic problems. Docker works out of the box everywhere.", "context": "", "use_case": "containers", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 792041729, "item_id": 49502608, "url": "https://news.ycombinator.com/item?id=49502608", "by": "lucideer", "date": "2026-08-30", "stance": "warn", "quote": "taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS", "excerpt": "I don't think this is as widely known as you believe: I use dockerd via colima so it's not a limitation I've encountered - if I had, I likely would've switched to podman wholesale instead of compromising my system. Either way though, I would hope it's self-evident to most that taking glaring security holes in a single app (docker) & transforming them into glaring security holes in an entire OS is generally not desira", "context": "", "use_case": "containers", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 792037089, "item_id": 49502318, "url": "https://news.ycombinator.com/item?id=49502318", "by": "drnick1", "date": "2026-08-30", "stance": "warn", "quote": "it will silently overwrite iptables rules and punch holes in your firewall.", "excerpt": "> I always make my user part of the docker group I don't, and I migrated to Podman because Docker is poorly designed and full of footguns. For example, it it will silently overwrite iptables rules and punch holes in your firewall.", "context": "", "use_case": "", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 789632145, "item_id": 49352009, "url": "https://news.ycombinator.com/item?id=49352009", "by": "devdoshi", "date": "2026-08-18", "stance": "neutral", "quote": "And docker if I need isolation for CI/CD.", "excerpt": "upvote for WAL + object storage (a very powerful combination I am finally seeing more adoption of) and a lot of interesting historical details. I'm fortunate I don't rely on any forge for my solo work except for backups. In my personal stack I just have a log and content-addressed object kv storage, which can project to git if needed, or can be committed to git as files. And docker if I need isolation for CI/CD. The ", "context": "solo work", "use_case": "CI/CD isolation", "switched_from": "", "story": "Cursor launches Origin, GitHub alternative"}, {"id": 789296353, "item_id": 49331022, "url": "https://news.ycombinator.com/item?id=49331022", "by": "speleding", "date": "2026-08-17", "stance": "recommend", "quote": "Put it in a docker container if you want to ensure it is perfectly reproducible.", "excerpt": "If your app is not too large you can do CI/CD perfectly fine from your laptop. Put it in a docker container if you want to ensure it is perfectly reproducible. You still need Github as the origin repo to pull from, but the \"git part\" of GitHub seems to be (almost) always up and running. (We use \"capistrano\" for this)", "context": "", "use_case": "reproducible CI/CD", "switched_from": "", "story": "Incident with Github.com"}, {"id": 788176406, "item_id": 49261025, "url": "https://news.ycombinator.com/item?id=49261025", "by": "sidfer", "date": "2026-08-11", "stance": "neutral", "quote": "", "excerpt": "Location: Rio de Janeiro, Brazil (UTC\u22123) Remote: Yes Willing to relocate: Yes Technologies: TypeScript (strict) \u00b7 React \u00b7 Next.js \u00b7 Node.js \u00b7 Python \u00b7 SQL/PostgreSQL \u00b7 Supabase \u00b7 Docker \u00b7 GitHub Actions/CI \u00b7 Azure \u00b7 LLM APIs (Anthropic, OpenAI) \u00b7 RAG \u00b7 agent architectures \u00b7 Cursor/Claude Code in the daily loop R\u00e9sum\u00e9/CV: https://sidneyferreira.com - https://aifield.tech \u2014 https://github.com/sidfer Email: ferreirasidn", "context": "job seeker, CS student", "use_case": "containers", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 788028176, "item_id": 49251761, "url": "https://news.ycombinator.com/item?id=49251761", "by": "danielnexaaly", "date": "2026-08-10", "stance": "neutral", "quote": "Technologies: Linux, JavaScript/Node.js, Git, Docker", "excerpt": "Location: Herning, Denmark (UTC+2) Remote: Yes Willing to relocate: Not listing relocation availability at this time Technologies: Linux, JavaScript/Node.js, Git, Docker, HTTP/APIs, browser automation, MCP, Caddy, Stripe, Codex CLI, Claude Code, Qwen Resume/CV: https://www.linkedin.com/in/daniel-abildgaard-376032190/ Portfolio: https://nexaaly.com/bug-hunt/sample/ and https://github.com/AccessNexaaly Email: access@ne", "context": "AI-assisted technical operator", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 787590535, "item_id": 49224408, "url": "https://news.ycombinator.com/item?id=49224408", "by": "emanuelecz", "date": "2026-08-08", "stance": "neutral", "quote": "Redis, Celery, Docker", "excerpt": "Location: Gipuzkoa, Spain (CET) Remote: Yes, remote only Willing to relocate: No Technologies: Python, FastAPI, LangGraph, MCP, RAG, Postgres/pgvector, Redis, Celery, Docker, LLM evals, TypeScript, Next.js R\u00e9sum\u00e9/CV: https://www.emanuelecz.dev/emanuele-czofei-cv.pdf Email: emanuelecz06@gmail.com Self-taught AI engineer, two years building, four months at a startup. Strongest at the unglamorous half: retrieval that re", "context": "self-taught AI engineer", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 787493192, "item_id": 49218324, "url": "https://news.ycombinator.com/item?id=49218324", "by": "ragequittah", "date": "2026-08-07", "stance": "recommend", "quote": "Most of the stuff I use is free and excellent.", "excerpt": "Most of the stuff I use is free and excellent. Linux, Firefox, libreoffice, xcp-ng, bottles, steam, playnite, opnsense, docker, dockhand, immich, freshrss, obsidian, tailscale, calibre, caddy, docker, pi-hole, signal, audiobookshelf I could probably keep going for a long while. I'm very glad most good software creators I've come across do not have your mindset.", "context": "", "use_case": "", "switched_from": "", "story": "Improving GPT-5.6 Sol in ChatGPT\u2014and expanding access for free users"}, {"id": 787382947, "item_id": 49211434, "url": "https://news.ycombinator.com/item?id=49211434", "by": "SlavikCA", "date": "2026-08-07", "stance": "neutral", "quote": "OpnSense router -> Traefik -> Docker container.", "excerpt": "I have 5Gbps fiber at home. LAN is mostly 10Gbps. I'm hosting few hobbyist public websites. One is the library of hymns, songs, ... - mostly PDF, MP3, MIDI. OpnSense router -> Traefik -> Docker container. That Docker container runs on NAS, which is connected via 1Gbps port. Suddenly, last week I started to get over 1000 RPS. Was it scanner, parser, crawler, DDOS? I can't tell, as user agent was default Mac OS. It was", "context": "", "use_case": "running website", "switched_from": "", "story": "The web server deployment model breaks at hobby scale"}, {"id": 787002293, "item_id": 49187643, "url": "https://news.ycombinator.com/item?id=49187643", "by": "codeprimate", "date": "2026-08-05", "stance": "neutral", "quote": "run Docker daily", "excerpt": "Location: Bellingham, WA Remote: Yes Willing to relocate: No Technologies: Ruby, Rails, PostgreSQL, Sidekiq, Hotwire, JavaScript, Python, AWS, Docker, MCP, LLMs, RSpec R\u00e9sum\u00e9/CV: https://www.linkedin.com/in/patrick-morgan/ GitHub: https://github.com/codeprimate Email: contact at bellingham.dev I have been shipping software for twenty years, most of it Rails, and what I own has always run wider than the code I write. ", "context": "senior engineer, twenty years shipping software", "use_case": "daily development", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 786628449, "item_id": 49164278, "url": "https://news.ycombinator.com/item?id=49164278", "by": "darkurtpanke", "date": "2026-08-03", "stance": "neutral", "quote": "C++., Docker, FreeBSD", "excerpt": "Location:Cape town. Remote: Yes. Obviously. I don\u2019t do office culture. I prefer quiet dark room with a 4K monitor and a mechanical keyboard. Willing to relocate: Only if the relocation involves a data center, a hackerspace, or a country with no extradition treaties. Otherwise, no. Technologies:Go, Rust, C, C++., Docker, FreeBSD, and I once fixed a mainframe. Don\u2019t ask how. MongoDB, I\u2019ve written my own key value store", "context": "systems programmer seeking work", "use_case": "", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 784895413, "item_id": 49055963, "url": "https://news.ycombinator.com/item?id=49055963", "by": "faangguyindia", "date": "2026-07-26", "stance": "neutral", "quote": "Yeah, I use Docker to compile Rust, but it's pretty fast", "excerpt": "I mostly use Go + SQLite for all the things I used to use Rails, JavaScript, or Python for. I find python django wastes too much resources, just look at memory usage. One of my web app backend (go) is serving approx 100 req/s right now and i look at pprof i see it's not bottlenecked by CPU but mostly IO and i love this. Writing concurrent code in Go is easy, the code i wrote 10yrs ago still compiles with no issue! Th", "context": "", "use_case": "compiling Rust", "switched_from": "", "story": "Some more things about Django I've been enjoying"}, {"id": 784842416, "item_id": 49052651, "url": "https://news.ycombinator.com/item?id=49052651", "by": "emerongi", "date": "2026-07-25", "stance": "recommend", "quote": "As a developer, I use docker/podman. Works great.", "excerpt": "Sprites seems like a solid lifestyle business for a few friends, not a startup that has taken funding. As a developer, I use docker/podman. Works great. The new massive market that will open up, where grandma and grandpa are making apps, will be taken up by Lovable (and the like). Non-devs will not be using sprites. You\u2019re capturing some small percentage of existing developers. Make sure to return all the funding you", "context": "developer", "use_case": "development environments", "switched_from": "", "story": "Fly.io CEO Kurt Mackey is stepping down"}, {"id": 783501585, "item_id": 48968849, "url": "https://news.ycombinator.com/item?id=48968849", "by": "Vedor", "date": "2026-07-19", "stance": "neutral", "quote": "self-hosting Immich via Docker on Raspberry Pi 4", "excerpt": "You can, I am self-hosting Immich via Docker on Raspberry Pi 4 with small SSD and it's nothing but good experience so far (but I keep the photos backed up elsewhere just in case, I use Immich mostly to share curated sets of photos)", "context": "", "use_case": "running Immich", "switched_from": "", "story": "The death and rebirth of my home server"}, {"id": 782894449, "item_id": 48930903, "url": "https://news.ycombinator.com/item?id=48930903", "by": "SMFloris", "date": "2026-07-15", "stance": "recommend", "quote": "What I use and really recommend is using systemd +/- docker.", "excerpt": "IMO, kubernetes is overkill for a small non-homogeneous home cluster. What I use and really recommend is using systemd +/- docker. It just becomes so darn simple. Do not go the compose route (that route is filled with sadness of the incomplete stacks because db container failed silently kind) - instead aim to decompose the compose files and write a separate systemd service file for each of them, you can then assign l", "context": "", "use_case": "homelab containers", "switched_from": "", "story": "Rebuilding My Homelab with Compose, Ruby, IPv6, and No Kubernetes"}, {"id": 782233024, "item_id": 48889564, "url": "https://news.ycombinator.com/item?id=48889564", "by": "rh94", "date": "2026-07-13", "stance": "warn", "quote": "Docker Mac expirience is pretty bad especially the x86 is just painful", "excerpt": "Yeah docker Mac expirience is pretty bad especially the x86 is just painful, and to your comment (about security), it should not really matter in practice, in fact we used both, but goal really is to run secure sandboxes that are processes without performance impact.", "context": "", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 782230720, "item_id": 48889420, "url": "https://news.ycombinator.com/item?id=48889420", "by": "plextoria", "date": "2026-07-13", "stance": "warn", "quote": "I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos.", "excerpt": "Thank you! A project like this was on my wishlist for a long time. Colleagues looked at me like I'm weird when I was saying containers without a VM should be possible on macOS. I switched to a Linux laptop because I couldn't stand the experience of working with Docker on macos. I wonder if some of the macOS sandboxing features can be used instead of relying solely on the JIT", "context": "switched to a Linux laptop", "use_case": "containers on macOS", "switched_from": "", "story": "Ask HN: What Are You Working On? (July 2026)"}, {"id": 763909440, "item_id": 47744340, "url": "https://news.ycombinator.com/item?id=47744340", "by": "raw_anon_1111", "date": "2026-04-12", "stance": "recommend", "quote": "I do everything inside Docker containers", "excerpt": "I do consulting work with AWS + backend development and since agentic coding became a thing, I have started doing more internal admin websites - completely vibe coded. I never build/install/run websites or npm packages directly on my computer. I do everything inside Docker containers and have Claude debug websites using Docker + playwright + headless chrome and just give Claude temporary JWT tokens.", "context": "AWS and backend consultant doing vibe-coded admin sites", "use_case": "sandboxing builds and websites", "switched_from": "", "story": "Ask HN: Has anyone reconsidered Antivirus software after recent security news?"}, {"id": 761282321, "item_id": 47580145, "url": "https://news.ycombinator.com/item?id=47580145", "by": "fabianlindfors", "date": "2026-03-30", "stance": "warn", "quote": "We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac.", "excerpt": "We have been trying to solve the same problem (and a bunch of other ones) with https://specific.dev as well. We\u2019ve tried to stay away from Docker as much as we can though because of the still pretty bad experience on Mac. Our approach is having our CLI handle port assignments (and pass any connection details/ports along as env vars) and that way being able to spin up \u201cisolated\u201d copies of the local dev environment. Ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Coasts \u2013 Containerized Hosts for Agents"}, {"id": 751459476, "item_id": 46966217, "url": "https://news.ycombinator.com/item?id=46966217", "by": "digiown", "date": "2026-02-10", "stance": "recommend", "quote": "install docker, and run it", "excerpt": "Proxmox is probably overkill for beginners. You'll know it when you want it. I recommend docker-compose based tools, especially dockge [1]. It drastically cuts down on the surface of weird things you have to deal with. Just put up a reasonable distro (I recommend Debian here, since Fedora tends to get some SELinux issues which would confuse beginners), install docker, and run it. You don't have to touch anything else", "context": "", "use_case": "running self-hosted services", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 746913312, "item_id": 46682082, "url": "https://news.ycombinator.com/item?id=46682082", "by": "K0IN", "date": "2026-01-19", "stance": "recommend", "quote": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system.", "excerpt": "Docker starting test DBS, getting apps quickly to run without setting up all deps on my system. Vscode.", "context": "", "use_case": "test databases, running apps", "switched_from": "", "story": "Ask HN: What non-LLM tools have meaningfully improved your dev productivity?"}, {"id": 745133104, "item_id": 46570819, "url": "https://news.ycombinator.com/item?id=46570819", "by": "aristofun", "date": "2026-01-10", "stance": "recommend", "quote": "it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "excerpt": "Yes, it\u2019s still the cheapest and easiest way to deploy small to not so small apps DIY style.", "context": "", "use_case": "deploying apps on a VPS", "switched_from": "", "story": "Ask HN: Should I learn Docker to deploy my app in VPS?"}]}