Runtime

Drop a bash or python service into a compose.yaml and it exits immediately on up. The container starts, sees no stdin, prints nothing, and stops. The fix is the Compose equivalent of docker run -it: tty: true and stdin_open: true. What each flag does The two flags map directly to the docker run flags everyone has typed a thousand times: stdin_open: true ⇔ docker run -i — keep STDIN open even when not attached. tty: true ⇔ docker run -t — allocate a pseudo-TTY. services: shell: image: alpine command: sh stdin_open: true tty: true Set both for an interactive shell. Set only tty: true for a process that wants a terminal (for color output, line-buffered logs) but doesn’t read from stdin. stdin_open: true alone is rare — almost always paired with tty. ...

docker compose up streams logs from every service in a single terminal. That works fine for two or three services. With a stack that includes a chatty proxy, a healthcheck loop, or a model server printing tokenizer warnings every second, the signal-to-noise ratio drops fast. attach: false tells Compose to keep the service running but stop streaming its logs to the foreground. Per-service in the Compose file Mark the noisy service: ...

Linux isolates containers using kernel namespaces. Sometimes you need the opposite: two containers that can see each other’s processes or share memory. The pid and ipc directives give you that escape hatch. Sharing a PID namespace pid: service:<name> lets a container see and act on processes inside another service: services: app: image: myapp debugger: image: alpine pid: service:app cap_add: - SYS_PTRACE command: sleep infinity The debugger container’s ps, strace, and /proc all reflect app’s processes. Combined with cap_add: SYS_PTRACE, you can attach strace or gdb to a running production-style container without baking debug tools into its image. ...

CPU and memory limits (Tip #16) cover the obvious resources. Two more options solve specific problems: ulimits for kernel limits and shm_size for shared memory. ulimits: kernel resource limits ulimits controls per-container limits the Linux kernel enforces: open file descriptors, processes, locked memory, and others. services: api: image: myapi ulimits: nofile: soft: 65536 hard: 65536 nproc: 4096 soft is the default, hard is the maximum the process can raise itself to. For most simple cases, set them equal. ...

Both entrypoint and command define what runs when a container starts. They look similar, but they play different roles, and confusing them leads to surprising behavior. The mental model When a container starts, Docker runs: <entrypoint> <command> entrypoint is the executable command is the default arguments passed to it If the image’s Dockerfile has ENTRYPOINT ["python"] and CMD ["app.py"], the container runs python app.py. Overriding from Compose Both can be overridden in Compose: ...