Docker Compose Tips

Docker Compose Tip #93: The ambassador pattern for environment-specific dependencies

An app connects to Redis at localhost:6379 in every environment, but Redis never actually lives at the same place twice: a local container in dev, a managed instance in staging, a different managed instance in prod. Something has to resolve that difference, and the easiest place to put it is scattered if ENV == "prod" branches in the app’s own config. The ambassador pattern puts it in one disposable container instead. ...

Docker Compose Tip #92: Compose now tells you when an attribute does nothing

deploy.update_config, credential_spec, ports[].mode: host: every one of these is valid against the compose-spec schema, and none of them has ever done anything to a plain docker compose up. They’re Swarm-only. Before Compose 5.6.0, a file carrying any of them loaded without complaint, and whatever behavior you expected from reading the spec just never showed up, with no hint why. What changed Load a file with one of these attributes now, and Compose says so: ...

Docker Compose Tip #91: Providers now take part in the image phase

A provider managing containers on a remote or non-Docker runtime has always been able to declare build: or image: on its service, but getting the actual image bytes to wherever that runtime lives was left entirely to the provider: push to a registry it can reach, or shell out to docker save/scp and hope it matches what Compose actually resolved. Tip #61 covered provider services for exactly this kind of external dependency: databases, tunnels, Kubernetes intercepts. Compose 5.6.0 adds the piece that tip didn’t have yet: a provider can now opt into the same image phase every other service goes through. ...

Docker Compose Tip #90: Seeing your service graph with docker compose alpha viz

depends_on reads fine when a Compose file has two or three services. Past that, tracing who starts after whom means scrolling between blocks and holding the chain in your head. docker compose alpha viz reads the same file and prints the graph instead. docker compose alpha viz What it prints Against a two-service file (web depending on db), the default output is a minimal Graphviz digraph: digraph "myapp" { layout=dot; "db" [style="filled" label=<<font point-size="15">db</font>>]; "web" [style="filled" label=<<font point-size="15">web</font>>]; "web" -> "db"; } Add --image, --ports, and --networks and each node’s label grows to match: ...

Docker Compose Tip #89: What cap_drop actually takes away from root

Run this from a container whose process is uid 0: services: hardened: image: alpine cap_drop: - ALL command: sh -c "touch /tmp/f && chown 2000:2000 /tmp/f && echo OK" docker compose run --rm hardened chown: /tmp/f: Operation not permitted Tip #29 listed which cap_add values pair with which workload. This is the part worth sitting with: cap_drop: ALL just took a privilege away from uid 0, not from some non-root user it was supposedly protecting against. ...