Engine Operations

Give build runners and service hosts separate rules, reclaim continuously with age and label filters instead of during incidents, budget the build cache rather than wiping it, and keep --volumes out of automation.

Choose on failure coupling. A shipping driver inside dockerd puts a remote system on every container's write path; bounded local files read by a host collector keep that write local and logs readable on the host, at the cost of an agent.

It is framed, not corrupted. A container created without a TTY has stdout and stderr multiplexed into one stream, each chunk preceded by an 8-byte header holding the stream number and payload length. The docker CLI demultiplexes it.

docker top runs the host's ps against the container's processes, and docker diff lists files added, changed or deleted in the container's writable layer since the image. Both run entirely on the host, so they work on a distroless image that contains no shell and no tools.

The script ships in docker-ce-rootless-extras and installs a per-user Docker Engine: a systemd user unit for dockerd and a socket under $XDG_RUNTIME_DIR. It requires the newuidmap tools and subordinate UID/GID ranges for the user.

Docker's ssh:// endpoint runs the local ssh client to execute docker system dial-stdio remotely and pipes the Engine API over it. It needs a non-interactive key login, a trusted host key, a remote Docker CLI, and daemon-socket access there.

Docker log drivers deliver in blocking mode by default, so a stalled driver back-pressures the container's writes to stdout and can stall the application. mode=non-blocking inserts a memory ring buffer, sized by max-buffer-size (1 MB default), that drops messages instead.

Trust is per trust store, and the container has its own. The host bundle dockerd verified against is not inside the image, and a JVM reads its own cacerts keystore rather than the operating system's, so the CA must be added in both places in the image.

Restarting dockerd stops every container on that host unless live-restore is already on, and a bad key stops the daemon entirely. Render and validate the file from configuration management, canary one host, then roll in batches with a rollback that works without Docker.