Docker-Compose

Docker Compose Tip #92: Compose now tells you when an attribute does nothing

deploy.update_config, credential_spec, ports[].mode: host: every one of these is valid against the compose-spec schema, and none of them has ever done anything to a plain docker compose up. They’re Swarm-only. Before Compose 5.6.0, a file carrying any of them loaded without complaint, and whatever behavior you expected from reading the spec just never showed up, with no hint why. What changed Load a file with one of these attributes now, and Compose says so: ...

Docker Compose Tip #91: Providers now take part in the image phase

A provider managing containers on a remote or non-Docker runtime has always been able to declare build: or image: on its service, but getting the actual image bytes to wherever that runtime lives was left entirely to the provider: push to a registry it can reach, or shell out to docker save/scp and hope it matches what Compose actually resolved. Tip #61 covered provider services for exactly this kind of external dependency: databases, tunnels, Kubernetes intercepts. Compose 5.6.0 adds the piece that tip didn’t have yet: a provider can now opt into the same image phase every other service goes through. ...

Docker Skills, Part 3: docker-compose-patterns in Depth

depends_on only guarantees a container has started. It says nothing about whether the process inside is actually ready to take traffic, and a database container that’s up but still replaying its init scripts will happily accept a connection from a service that then fails on its first query. docker-compose-patterns, the skill that fires when the task is service wiring rather than image builds, spends a good part of its rules closing that exact gap. ...

Docker Compose Tip #90: Seeing your service graph with docker compose alpha viz

depends_on reads fine when a Compose file has two or three services. Past that, tracing who starts after whom means scrolling between blocks and holding the chain in your head. docker compose alpha viz reads the same file and prints the graph instead. docker compose alpha viz What it prints Against a two-service file (web depending on db), the default output is a minimal Graphviz digraph: digraph "myapp" { layout=dot; "db" [style="filled" label=<<font point-size="15">db</font>>]; "web" [style="filled" label=<<font point-size="15">web</font>>]; "web" -> "db"; } Add --image, --ports, and --networks and each node’s label grows to match: ...

Docker Compose Tip #89: What cap_drop actually takes away from root

Run this from a container whose process is uid 0: services: hardened: image: alpine cap_drop: - ALL command: sh -c "touch /tmp/f && chown 2000:2000 /tmp/f && echo OK" docker compose run --rm hardened chown: /tmp/f: Operation not permitted Tip #29 listed which cap_add values pair with which workload. This is the part worth sitting with: cap_drop: ALL just took a privilege away from uid 0, not from some non-root user it was supposedly protecting against. ...