> error pulling image configuration: download failed after attempts=6: tls: failed to verify certificate: x509: certificate is not valid for any names, but wanted to match docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com

First blaming tailscale, dns configuration and all other stuff. Until I just copied that above URL into my browser on my laptop, and received a website banner:

> El acceso a la presente dirección IP ha sido bloqueado en cumplimiento de lo dispuesto en la Sentencia de 18 de diciembre de 2024, dictada por el Juzgado de lo Mercantil nº 6 de Barcelona en el marco del procedimiento ordinario (Materia mercantil art. 249.1.4)-1005/2024-H instado por la Liga Nacional de Fútbol Profesional y por Telefónica Audiovisual Digital, S.L.U. https://www.laliga.com/noticias/nota-informativa-en-relacion-con-el-bloqueo-de-ips-durante-las-ultimas-jornadas-de-laliga-ea-sports-vinculadas-a-las-practicas-ilegales-de-cloudflare

For those non-spanish speakers: It means there is football match on, and during that time that specific host is blocked. This is just plain madness. I guess that means my gitlab pipelines will not run when football is on. Thank you, Spain.

Comments URL: https://news.ycombinator.com/item?id=47738883

Points: 335

# Comments: 146

Comments URL: https://news.ycombinator.com/item?id=47732384

Points: 6

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47679882

Points: 4

# Comments: 2

Comments URL: https://news.ycombinator.com/item?id=47676678

Points: 3

# Comments: 2

Comments URL: https://news.ycombinator.com/item?id=47676639

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47673147

Points: 3

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47665931

Points: 1

# Comments: 0

    The iOS app is available now: https://apps.apple.com/us/app/dockertab/id6759782246
    
    The Android version is currently in the testing phase. 

    I'd love to hear your feedback at support@dockertab.app

Comments URL: https://news.ycombinator.com/item?id=47663862

Points: 2

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47648638

Points: 29

# Comments: 9

Comments URL: https://news.ycombinator.com/item?id=47647566

Points: 2

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47635393

Points: 1

# Comments: 0

On first start it:

* Generates config

* Creates a pre-auth key

* Allows a client to connect within a few minutes

For non-Docker setups, there is also a simple install script: hwdsl2/headscale-install

That script is intended for a one-command VPS setup. It installs and configures Headscale with sensible defaults.

This follows the same approach as some of my earlier projects (e.g. docker-ipsec-vpn-server, setup-ipsec-vpn), focusing on making things work out of the box with minimal maintenance.

I’ve also been experimenting with related projects in the same space:

* docker-wireguard

* docker-openvpn

Feedback is welcome, especially from others running Headscale.

Comments URL: https://news.ycombinator.com/item?id=47634187

Points: 1

# Comments: 1

dangerously is an open source tool that spins up an isolated container and runs Claude Code inside it — file system changes are restricted to your project directory.

The new version detects your docker-compose.yml and spins up your full service stack alongside Claude Code, so the agent can test against real dependencies — databases, queues, whatever your app needs.

npm install -g dangerously

Comments URL: https://news.ycombinator.com/item?id=47631444

Points: 8

# Comments: 0

Lately, I have been trying to understand the security aspect of docker containers, and what I have realized is that all docker containers share the host's kernel. Any zero day vulneerability in the kernel can be used to gain access to the host os.

In order to deal with this, I did some research turns out Amazon has open sourced the core technology behind their serverless technology lambda. But in its current state its very hard to setup, let alone run anything securly. This technology is called firecracker microvm's

It started off as a go library, for creating process pools to just do a simple firecracker spawn, turned into a full fledged host side daemon.

deploying a microvm through an image is now as simple as running

`herd deploy --image postgres:latest -p 5432:5432 -e POSTGRES_PASSWORD=postgres`

with boot times ~500ms

That brings us to today. I am looking for people to test this out and provide some feedback, I have been warned/cautioned by a lot of friends that building in isolation is a recipe for disaster.

PS: it only works on linux, macos doesn't have the required isolation, and I stopped caring about winslop.

Comments URL: https://news.ycombinator.com/item?id=47630810

Points: 4

# Comments: 2

Comments URL: https://news.ycombinator.com/item?id=47616379

Points: 7

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47613861

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47599233

Points: 3

# Comments: 0

The main problem it solves: rebuilding the same environment every time you switch machines or update a container. All OpenCode state (sessions, settings, MCP configs, plugins) lives in a bind mount outside the container. Rebuild or update the image, your state comes back.

*On the API key cost angle:*

If you pay for Claude Max or Pro, you can use those credentials directly instead of a separate Anthropic API key. One env var enables it. The plugin reads from the credentials file OpenCode stores on your host. This removes a layer of cost if you're already paying for a subscription.

Note: this may be outside what Anthropic's ToS covers. The README is explicit about that.

It supports 10+ AI providers (Anthropic, OpenAI, Gemini, Groq, Bedrock, Azure, Ollama, and more). The Claude subscription feature is optional. Set any provider key and it works.

oh-my-openagent is also included as an optional plugin (`ENABLE_OH_MY_OPENAGENT=true`). It turns OpenCode into a coordinated multi-agent system with parallel execution and specialized agents.

GitHub: https://github.com/coderluii/holycode Docker Hub: https://hub.docker.com/r/coderluii/holycode

Comments URL: https://news.ycombinator.com/item?id=47584308

Points: 2

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47577577

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47573707

Points: 2

# Comments: 0