Containers share a kernel, so a container is not a security boundary by default. This is the practical hardening that makes one act like a boundary — minimal pinned images, a signed and scanned supply chain, dropped capabilities and seccomp, and a Kubernetes securityContext that actually holds.
Docker
-
Container Security in 2026: The Threat Model, the Supply Chain, and a Pod That Can't Hurt You -
Immich: Self-Hosted Google Photos Deploying and running Immich as a self-hosted photo and video library: Docker Compose setup, PostgreSQL with pgvecto.rs, machine learning face recognition and CLIP semantic search, hardware transcoding, external library mounting, and a solid backup strategy.
-
NGINX Unit: The Application Server Nobody Talks About A deep-dive into NGINX Unit — the language-agnostic application server with a REST API-driven configuration model that eliminates uWSGI, Gunicorn, and separate process managers. Covers architecture, live config reloads, Python/PHP/Go/Node/Java setup, TLS, routing, Docker, and Kubernetes, plus an honest assessment of its archived status and when it still makes sense to use.
-
LocalStack: AWS Development Without the Cloud Bill A deep technical guide to LocalStack 2026 — running 110+ AWS services locally, integrating with Terraform, CDK, and CI pipelines, understanding the fidelity gaps that matter, and the major structural changes that ended the free community edition.
-
Computer Use and Browser Agents: How They Actually Work, What Breaks, and How to Run Them Safely The agent-drives-a-browser category explained: Anthropic Computer Use vs DOM-driven stacks, the real failure modes, and the sandbox patterns you need before putting any of this near production.
-
LiteLLM and Model Routing: The Proxy Pattern for Multi-Provider LLM Apps One OpenAI-compatible endpoint, many backends. How LiteLLM's proxy pattern works, how to configure routing, fallbacks, cost controls, and observability, and when a self-hosted gateway beats managed alternatives.
-
.NET Framework 4.8 + IIS + SQL Server: A Modern Development and Deployment Workflow for Legacy Apps A practical, end-to-end guide to working productively on a .NET Framework 4.8 / IIS / SQL Server app in 2026 — workstation setup, isolated local development with Docker Windows containers, per-developer databases, web.config transforms, build pipelines, Web Deploy / Octopus deployment patterns, and the realistic modernization on-ramp.
-
Compiling OpenAccess and OAScript on Non-RHEL Linux: A Deep Dive A comprehensive guide to building OpenAccess and OAScript from source on SLES 15, Ubuntu, and other non-RHEL Linux distributions — covering the SI2 Docker build environment, GLIBC compatibility strategies, OAScript's Tcl build system in detail, and producing portable shared libraries.
-
Containerization and Virtualization: Every Platform Compared A comprehensive comparison of every major virtualization and containerization platform — Docker, LXC, KVM, VMware, VirtualBox, Proxmox, Singularity, Podman, and more. What each does, when to use it, and how to choose.
-
Pyroscope: Continuous Profiling in Production Pyroscope brings always-on profiling to production systems — flame graphs for CPU hotspots, memory leaks, and goroutine issues, correlated with your traces and metrics.
-
Score: Developer-Centric Workload Specification Score lets developers write a single score.yaml that deploys to Docker Compose locally and Kubernetes in production — without rewriting config for each environment.
-
Alloy: The OpenTelemetry Collector from Grafana Grafana Alloy replaces Grafana Agent, Grafana Agent Flow, and promtail with a single programmable OpenTelemetry collector. Here's how it works, how to deploy it, and how to build real pipelines with it.
-
Kavita: Self-Hosted Reading Server for Manga, Comics, and Ebooks Kavita is an actively developed, self-hosted reading server that handles manga, comics, light novels, and ebooks with automatic series organization, cross-device progress sync, and OPDS support.
-
Miniflux: Minimal Self-Hosted RSS Miniflux is a single-binary, PostgreSQL-backed RSS reader that trades feature bloat for speed and simplicity. Here's how to deploy it, configure it, and get the most out of it.
-
Stirling PDF: Self-Hosted PDF Swiss Army Knife Run 50+ PDF operations locally with Stirling-PDF — merge, split, OCR, convert, compress, sign, and redact without sending a single byte to the cloud.
-
Wallos: Take Control of Your Subscription Sprawl Wallos is a self-hosted subscription tracker that shows you exactly what you're paying for, when it's due, and how much it costs — without sending your financial data anywhere.
-
Trivy: Container and IaC Vulnerability Scanning A complete guide to Trivy — scanning container images, filesystems, Terraform, Kubernetes clusters, and generating SBOMs with a single tool.
-
Home Network Monitoring with ntopng and LibreNMS Build a complete home network monitoring stack using ntopng for deep traffic analysis and LibreNMS for SNMP-based device health — with Grafana dashboards tying everything together.
-
Immich Deep Dive: AI-Powered Photo Management for Your Homelab A complete guide to deploying and running Immich — self-hosted Google Photos with AI-powered face recognition, smart search, and hardware-accelerated machine learning.
-
Immich: Self-Hosted Google Photos That Actually Competes A complete guide to deploying Immich — the best self-hosted photo and video library — covering Docker Compose setup, hardware-accelerated transcoding and ML, mobile backup, storage management, and keeping a library of hundreds of thousands of photos running smoothly.
-
Jellyfin vs Plex vs Emby: The Self-Hosted Media Server Showdown A deep, honest comparison of Jellyfin, Plex, and Emby: feature sets, hardware transcoding setup for Intel/NVIDIA/AMD, client ecosystems, metadata management, and a clear recommendation for each use case.
-
Monitoring Your Homelab with Prometheus and Grafana: The Complete Stack Build a production-grade homelab monitoring stack from scratch: Prometheus with Node Exporter and cAdvisor, Grafana dashboards, alerting with Alertmanager, and long-term storage with VictoriaMetrics.
-
Nextcloud: Your Own Google Drive (That You Actually Control) A complete guide to deploying Nextcloud: Docker Compose setup, performance tuning with Redis and APCu, external storage backends, Nextcloud Office for collaborative editing, mobile sync, and maintaining a fast, reliable installation.
-
Paperless-ngx: Building a Document Management System That Actually Works A deep dive into Paperless-ngx: deploying it with Docker Compose, building an automated scanning pipeline, mastering tags and correspondents, and integrating with your homelab storage.
-
Vaultwarden: Running Your Own Password Manager A complete guide to deploying Vaultwarden — the lightweight Bitwarden-compatible server — with HTTPS via Traefik, automated backups, admin hardening, and migrating from LastPass or 1Password.
-
Ephemeral Environments: Preview Deployments, Branch Environments, and Testing in Isolation Ephemeral environments spin up a complete, isolated copy of your application for every branch or pull request — automatically. This guide covers the patterns, tooling, and trade-offs for building preview deployments that actually improve your development workflow.
-
Linux Namespaces and cgroups: The Kernel Primitives That Make Containers Possible A deep dive into the Linux kernel features that underpin every container runtime — namespaces for isolation and cgroups for resource control. Understanding these makes you a better operator and demystifies what Docker and Kubernetes are actually doing.
-
Automating Homelab Tasks with n8n: Visual Workflow Automation Self-Hosted A practical guide to self-hosting n8n for homelab automation — covering installation with Docker Compose, core concepts, real workflow examples for server health checks, Docker update notifications, and Home Assistant integrations, plus tips for AI-powered workflows with local LLMs.
-
Container Image Hardening: Distroless, Multi-Stage Builds, and Vulnerability Scanning A practical, in-depth guide to reducing your container attack surface through distroless base images, multi-stage builds, Trivy vulnerability scanning, and CI/CD integration — covering everything from Dockerfile patterns to Kubernetes securityContext settings.
-
Docker Compose for Homelab: Multi-Service Stacks Done Right A deep-dive into Docker Compose for homelabbers and self-hosters — covering Compose file anatomy, environment management, networking, healthchecks, real-world stack examples, and production-readiness tips that scale from a Raspberry Pi to a full rack.
-
Local Development Environments: Dev Containers, Nix Flakes, and Reproducible Setups A comprehensive guide to eliminating 'works on my machine' problems using Dev Containers, Nix flakes, and mise — covering everything from simple devcontainer.json configs to full Nix-based reproducible environments, docker-compose service integration, CI parity, and real-world examples by stack.
-
Nextcloud: Your Self-Hosted Google Workspace Replacement A comprehensive guide to replacing Google Workspace with a self-hosted Nextcloud stack — covering files, calendar, contacts, Collabora office editing, and migration from Google services, with complete Docker Compose configs and hardening tips.
-
Podman vs Docker: Rootless Containers, Pods, and the Case for Switching A deep technical comparison of Podman and Docker covering the daemonless architecture, rootless containers, Kubernetes-native pods, systemd Quadlets, and a practical migration guide for sysadmins and developers ready to make the switch.
-
The Self-Hosted Media Server Stack: Jellyfin, the *arr Apps, and Full Automation A complete guide to building a fully automated, self-hosted media library using Jellyfin, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, and Jellyseerr — everything you need to run a home streaming setup that rivals Netflix without subscriptions, ads, or disappearing content.
-
Uptime Kuma: Self-Hosted Status Pages and Alerting Done Right A practical guide to Uptime Kuma — the self-hosted uptime monitoring tool with a beautiful UI, 90+ notification integrations, and built-in status pages that replaces UptimeRobot, StatusCake, and Pingdom for homelabbers and DevOps engineers.
-
Monitoring and Observability: From the Golden Signals to a Complete Self-Hosted Stack What to measure and why — RED, USE, the Four Golden Signals, percentiles, and error budgets — then a production-grade, self-hosted stack built on Prometheus, Grafana, Loki, and Alertmanager. Full Docker Compose, configs, alert rules, dashboards, and integration tips for any VPS or homelab.
-
OpenClaw: The Complete Guide to Self-Hosted AI Agents Everything you need to know about OpenClaw — the open-source, self-hosted AI agent that connects your messaging apps to real-world actions. Covers its origins and confusing rename history, the architecture, deployment on Docker, Mac mini, and a VPS, running it against local models with Ollama, the SOUL.md policy system, the serious security incidents you must understand before deploying, and an honest comparison against Claude Code.
-
Traefik: The Complete Guide to the Cloud-Native Reverse Proxy A comprehensive deep-dive into Traefik — the modern cloud-native reverse proxy and load balancer. Covers core architecture, Docker auto-discovery with labels, automatic HTTPS via Let's Encrypt, the full middleware ecosystem, routing rules, ForwardAuth and SSO, observability, HTTP/3, and the tips and tricks that make it the go-to proxy for home labs and production Kubernetes clusters alike.
-
Docker Best Practices for Local Development Container optimization, volume mounts, multi-stage builds, and common pitfalls to avoid.