Docker on Margrop Blog

Docker Pulls Keep Timing Out? How to Choose, Configure, and Verify Chinese Registry Mirrors

Wed, 15 Jul 2026 19:30:00 +0800

The short answer When Docker image pulls fail on a mainland China network, the image is not necessarily missing and DNS is not always the culprit. More often, the public registry path is congested, a mirror is temporarily unavailable, or the configuration was edited but Docker was never restarted. My practical recommendation is simple: open status.anye.xyz first and treat it as a “weather report” for Docker mirrors; select a recently healthy HTTPS endpoint; edit the correct daemon configuration for your operating system; validate the JSON; restart Docker; and finally verify with a real pull of a small image.

You Bought an Overseas VPS and a Domain. Now What? 12 Things That Make a Public IP Worth Owning

Sat, 11 Jul 2026 13:30:00 +0800

The short answer

An overseas VPS by itself is a powered, connected room without a memorable street address. A top-level domain by itself is only a sign. Put the domain on Cloudflare DNS and point carefully chosen records at the VPS, and you finally own the sign, the map, the storefront, and a standards-based public entrance.

The result is much more useful than “a place to host a blog.” It is a small, always-on piece of Internet infrastructure where you control the code and the migration path: websites, APIs, webhooks, status pages, monitoring, controlled file sharing, password management, remote-access relays, automation jobs, and a personal AI gateway can all grow from the same foundation.

A public IP is also a door facing a busy street. Automated scanners may try the handle shortly after the server appears. This guide therefore covers both the useful projects and the services that should never be exposed directly.

Take Back Your Remote Desktop: Deploying an All-in-One RustDesk Server Safely

Fri, 10 Jul 2026 22:00:00 +0800

The short version

RustDesk is an open-source remote desktop application designed with self-hosting in mind. When two clients can reach each other directly, screen and input traffic can use a peer-to-peer path. When that direct path fails, a relay server forwards the encrypted traffic. Hosting the server yourself does not eliminate servers; it puts device registration, relay routing, keys, accounts, and logs back under your control.

This guide uses the community-maintained lejianwen/rustdesk-server-s6 image to place the RustDesk OSS hbbs and hbbr services together with a community API and web administration layer in one container. It is a convenient option for homes, labs, and small teams, but it is not an official RustDesk all-in-one distribution. Evaluate the community image, pin a tested tag or digest, back up its persistent data, and rehearse upgrades and rollbacks before treating it as production infrastructure.

Every address in this article uses example.com. No real IP address, private domain, hostname, device ID, account, key, token, cookie, or private registry is shown. The screenshots come from public official or community project pages.

I Put Docker in a Control Room: Portainer CE 2.39.4 Deployment, Daily Use, and Real Traps

Fri, 10 Jul 2026 15:30:00 +0800

Bottom line first

Portainer does not replace Docker. It is a control room for a Docker host. Docker Engine remains the machinery; Portainer organizes containers, images, networks, volumes, and Compose stacks into a web dashboard.

I ran an isolated deployment of portainer/portainer-ce:2.39.4, initialized it, connected the local Docker environment, inspected the dashboard, filtered a disposable container, and created a demonstration stack. The installation is one docker run command. The important lessons are broader: persist /data, understand that /var/run/docker.sock is highly privileged, and never expose the management interface to an untrusted network without protection.

This article contains no complete IP address, real host name, private domain, administrator password, token, cookie, private registry address, or production container name. The screenshots use disposable names, and the container address is redacted.

Stop Sprinkling API Keys Everywhere: My Self-Hosted NewAPI Relay Station

Fri, 10 Jul 2026 15:30:00 +0800

TL;DR

NewAPI is not a free-model trick and it is not a mysterious proxy. In my setup, it is the front desk for AI usage: every app talks to one endpoint, while the gateway routes requests to authorized upstream providers and handles tokens, quotas, groups, model limits, logs, and usage accounting. For a personal deployment, the big win is not “one more dashboard”; it is no longer scattering upstream keys across every client, script, and agent.

This post explains why I wanted a self-hosted model relay, what people usually misunderstand, how to deploy a minimal Docker Compose version, why I add persistent storage, and how to use one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. It also includes an agent-driven setup prompt with strict boundaries. No private address, complete machine name, private domain, or real secret is included.

The Self-Hosted Web Clipboard I Kept Is Just One Text Box

Fri, 10 Jul 2026 15:30:00 +0800

Short version

After trying many cross-device clipboard and note tools, the one I kept for personal use is almost embarrassingly small: minimalist-web-notepad. When you open it, there is essentially one text box. It supports plain text only. There is no account system, no rich text editor, no image upload, no folder tree, no dashboard, and no collaboration layer.

That is exactly why it works as a lightweight self-hosted web clipboard. It is good for moving a short command from one device to another, dropping a temporary note into a browser, reading or writing a tiny text value with curl, or keeping a disposable piece of text for a few minutes. It is not a knowledge base. It is not a password vault. It is a piece of scratch paper on the network.

This post uses the ahfeil/minimalist-web-notepad:latest image with Docker Compose. It also includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26, plus two operating modes: manual automatic execution and agent-driven configuration. No private network address, private domain, full machine name, or real secret is shown in this article.

Do Not Just Copy QingLong Into BaiHu: A Real Safe Migration Drill

Thu, 09 Jul 2026 10:30:00 +0800

Bottom line first

Migrating from QingLong Panel to BaiHu Panel is not a directory-copy exercise. I ran a real migration drill in an isolated Docker environment: a fresh QingLong instance with sample environment variables, scripts, labels, and cron jobs; then a fresh BaiHu instance; then an actual conversion and verification pass.

The reliable migration unit is not the whole QingLong data directory. It is a set of assets: script files, environment variables, scheduled tasks, tags, enabled/disabled state, and task-variable relations. QingLong uses numeric IDs; BaiHu uses string IDs and relation tables. QingLong commands such as task daily_check.py also need to become executable BaiHu commands such as python /app/data/scripts/qinglong-migrated/daily_check.py.

This article contains no full private IP address, private registry address, host name, token, cookie, or production secret. The screenshots come from a disposable lab, and the variables are redacted sample data.

Should QingLong Panel Still Face the Public Internet? After the 2026 Bypass, I Would Start With BaiHu

Thu, 09 Jul 2026 10:00:00 +0800

Bottom line first

QingLong Panel used to be the default answer for many self-hosted scheduled-script setups. It can run scripts, manage environment variables, show logs, synchronize repositories, and wrap crontab-like workflows in a friendly web UI. But the critical QingLong issues publicly discussed in early 2026 changed the risk calculation: a task scheduler panel is not just another web admin page. It often holds scripts, secrets, notification tokens, and execution privileges. If authentication can be bypassed, the attacker is not merely viewing a dashboard; they may be standing in front of a machine that can run jobs.

For new lightweight deployments, I would now evaluate BaiHu Panel first. BaiHu is a Go + Vue3 automation task scheduling platform focused on low overhead and high performance. Its public README describes Docker / Docker Compose deployment, Mise-based runtime management, repository task synchronization, logs, notifications, and secret handling. It is not a perfect one-to-one replacement for every QingLong workflow, but it is a better starting point for many personal script-hosting cases.

If you must keep using QingLong temporarily because of old jobs, migration cost, or compatibility constraints, do not expose it directly to the public Internet. Put a protection layer in front of it: VPN, zero-trust access, reverse-proxy Basic Auth, an allowlist, WAF rules, or equivalent access control. This article includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. They deploy BaiHu by default, require an explicit switch to deploy QingLong, and put either panel behind Caddy Basic Auth.

Docker Container Crash Loop After v3.7.0? You're Missing One Word: serve

Thu, 02 Jul 2026 19:30:00 +0800

TL;DR

After upgrading Siyuan (SiYuan Note) from v3.6.x to v3.7.0, the Docker container entered an infinite restart loop. docker logs showed Error: unknown flag: --accessAuthCode. The root cause: v3.7.0 introduced a CLI subcommand architecture. The old top-level flags now require a serve subcommand. The fix is adding one word — 'serve' — to the beginning of the command array in docker-compose.yml. Seven characters. From crash loop to running.

This article covers the complete troubleshooting process, one-command fix scripts for Windows 11, Ubuntu 26.04, and macOS 26, plus both manual and AI Agent approaches. All scripts use only Docker CLI and SSH — no third-party services required.

Docker Images, No More Begging: Build Your Own 13 GB Private Registry From Scratch

Fri, 26 Jun 2026 12:30:00 +0800

TL;DR

My home server runs a single registry:2 container that currently holds 13 GB of cached blobs across 95 repositories. Every NAS, Proxmox node, Mac, and Windows machine on my LAN pulls through it. A cold start of alpine:3.19 finishes in under a second, with zero traffic going out to the public Docker Hub.

This isn’t a one-line “install Docker and run a container” tutorial. I’ll show you the production-grade deployment script I actually run, walk through the Docker v2 auth flow, and call out the four reverse-proxy pitfalls that turn every docker login into a 401 mystery. You’ll leave able to: ① bring up an authenticated registry in 10 minutes; ② explain why the WWW-Authenticate header is sacred; ③ describe the whole thing to a non-technical family member without losing accuracy.

Stop Letting Agents Burn Tokens: Wiring Headroom into NewAPI, OpenClaw, and HermesAgent

Sat, 20 Jun 2026 12:30:00 +0800

TL;DR

I did not replace NewAPI, and I did not point OpenClaw or HermesAgent at an unproven gateway. The actual design is simpler: place Headroom in front of NewAPI, then move only the already validated OpenAI-compatible providers to http://<headroom-host>:8787/v1. The original NewAPI endpoint stays available. Long agent context now goes through Headroom first, gets compressed, then continues to NewAPI for the same routing and model management as before.

The rule that kept the rollout boring was: test first, edit second; migrate only OpenAI-compatible providers that pass; leave non-OpenAI fallbacks alone. This post is both a write-up and a runbook you can hand to an Agent or follow manually.

I dockerized AnythingLLM and the container turned into a wound-up squirrel — restarting forever until I handed it that magic 1000:1000

Wed, 17 Jun 2026 20:30:00 +0800

TL;DR

AnythingLLM, Mintplex Labs’ “stuff-anything-in-a-LLM” desktop, ships an official Docker image. In the happy path one docker run is all you need. But the in-container user anythingllm is picky: the host directory you bind-mount has to be owned by 1000:1000, otherwise it can’t write its own SQLite file, the Prisma migration step on startup crashes, and the container enters a restart-crash-restart loop. The fix takes under a minute: chown -R 1000:1000 /your/data/dir, then docker compose up -d again, and it dutifully listens on 3001.

I’ll also explain why Prisma’s file:../storage/anythingllm.db relative path is a footgun, give you a Portainer-ready stack file, and finish with a Q&A on the most common gotchas.

PhotoPrism Stuck for 5 Minutes on First Boot? A Postmortem on PHOTOPRISM_INIT=intel

Sat, 13 Jun 2026 08:30:00 +0800

TL;DR (The Short Version)

The PHOTOPRISM_INIT: "intel" line in PhotoPrism’s Plus Docker image is not just a flag to enable Intel hardware acceleration at runtime — it’s a one-shot system-level installer that runs apt-get dist-upgrade against archive.ubuntu.com and then installs 8 Intel/VA-API packages before the main process is allowed to start. On a fresh container this takes 5–10 minutes (sometimes more), during which nothing inside the container listens on port 2342.

Meanwhile: docker ps says Up, Portainer is green, ss -ltn on the host shows :2342 LISTEN — but your browser gets ERR_CONNECTION_RESET / Connection reset by peer. Because host-side docker-proxy accepts the connection and then tries to forward to a port inside the container that has no listener, the kernel sends back an RST.

Fix: just remove or empty that one line. If you already pass /dev/dri/renderD128 via devices:, the host’s drivers and userland libraries are perfectly usable from the container — there’s nothing to “install” in there.

The Portainer 500 Error That Wasn't the YAML — A Two-librespeed_default-Network Story

Sat, 13 Jun 2026 08:00:00 +0800

The short version

You update a stack in Portainer. The browser slaps you with a red 500 Internal Server Error. You assume the YAML is wrong, fix the indentation, swap the quotes, drop the image tag. You hit Update again. Same 500. And again. And again.

The real culprit is buried at the deepest level of the HTTP response body: network librespeed_default is ambiguous (2 matches found on name). Two networks with the same name exist in the same Docker engine—two IDs, two Created timestamps, two com.docker.compose.config-hash labels, but a single shared name. Compose asks the engine to look up that name; the engine refuses to pick between them; compose up fails; Portainer wraps the error as a 500 and returns it to your browser.

The fix is embarrassingly simple: delete one of the two orphan networks (docker network rm <id> or click Remove in Portainer’s Networks page), then re-run Update the stack with the exact same content. It just works.

This post is a real debugging session: a stack update that was supposed to be a 30-second mount-path change turned into a 1-hour investigation. All private details (internal addresses, registry URLs, volume paths, container names, credentials) have been replaced with <PLACEHOLDER>. Only public source code, official docs, and the error text itself are preserved.

The Docker Container Is Running, the Port Is Dead: A Complete Walkthrough of a Silent Host-Bind Failure

Sat, 13 Jun 2026 07:30:00 +0800

TL;DR:

docker ps says everything is fine. docker inspect’s HostConfig.PortBindings clearly says 203.0.113.14:3001:3000. But on the host, no docker-proxy is listening, the iptables nat/DOCKER chain has no DNAT rule, and NetworkSettings.Networks and Ports are both empty {}. This “container alive, port dead” state is what happens when libnetwork silently rolls back the endpoint creation because the target interface wasn’t up at attach time — and Docker doesn’t bother to tell you that the port publish never actually happened. The fix is a single 30-second command: docker network connect <net> <ctr>.

From 5m14s to 0.6s: How I Rebuilt My Docker Hub Mirror After Hitting Three Walls

Sat, 13 Jun 2026 07:20:00 +0800

TL;DR

My home lab had a registry:2 pull-through cache fronting Docker Hub for years, and it was fine. Then one day pulling a 5 MB alpine:3.19 took 5 minutes and 14 seconds. This post is the full forensic log of how I traced the slowdown, evaluated 8 candidate mirrors with real measurements (not vibes), and finished with a 5-line bash script on cron that auto-fails-over when the primary mirror goes down. Every number in this article was captured on my own hardware, in my own network, at one specific moment in time.

If you also self-host a Docker Hub mirror, or your team runs an internal registry, the Q&A at the bottom will probably save you 3 hours of pain.

Stop Using Old Methods! Deploying the Latest Docker CE on Ubuntu 26.04 LTS with Ultra-fast Mirror Setup

Tue, 26 May 2026 10:00:00 +0800

Foreword

With the official release of Ubuntu 26.04 LTS (Resolute Raccoon), developers and system administrators worldwide are upgrading their development, testing, and production environments to this long-term support version. However, setting up Docker—the cornerstone of modern containerization and microservices architecture—on a brand-new LTS release can sometimes present unexpected friction.

If you are still relying on legacy commands like apt-get install docker.io, or copy-pasting outdated tutorials meant for Ubuntu 20.04 or 22.04, you are likely to run into issues. These issues range from outdated software packages to APT repository format mismatches (especially with the widespread adoption of the new DEB822 format), or network timeouts when pulling images from container registries in restricted environments.

This article provides a comprehensive, step-by-step, and highly detailed guide to installing Docker Community Edition (Docker CE) on Ubuntu 26.04 LTS. We will delve into modern DEB822 repository configurations, non-root system privilege separation, systemd service tweaks, and advanced network acceleration (both HTTP/HTTPS proxies and private registry mirrors).

New Chrome Could Not Log In to Bitwarden, but Old Machines Still Worked: A Vaultwarden Compatibility Trap

Mon, 18 May 2026 10:05:00 +0800

TL;DR

The failure looked like a Chrome or Bitwarden extension problem: newly installed computers could not log in to a self-hosted Vaultwarden instance, while existing computers continued to work with the same Bitwarden 2026.4.1 browser extension. The actual root cause was server-side compatibility: the clients were using a newer prelogin endpoint, while the Vaultwarden server was still running vaultwarden/server:1.35.4-alpine, which did not provide /identity/accounts/prelogin/password.

Existing machines were likely protected by an already established login state and local cache. They did not prove that the full first-login API path was still compatible. The correct fix was to back up the Vaultwarden data, upgrade the server image to 1.36.0 or newer, and confirm from logs that the prelogin endpoint no longer returned 404.

All domains, paths, usernames, and deployment details in this article are sanitized. Examples use placeholders such as vault.example.com and /opt/vaultwarden; no internal network or private information is included.

When Docker Networks Collide with the Home LAN: Moving Auto-Allocated Subnets Back to 172

Mon, 13 Apr 2026 08:00:00 +0800

This post records a very practical Docker networking failure: the number of containers kept growing, Docker’s auto-assigned user-defined bridge networks eventually started landing in 192.168.x.x, and those networks began colliding with the real home LAN. The symptoms were not dramatic at first. Nothing looked “broken” in the usual sense. Containers were still running, the host was still alive, and the dashboard still looked normal. But parts of the home network became unreliable, and once I dug into it on my NAS, the root cause turned out to be the Docker network allocation strategy rather than any single bad container.

The fix was straightforward in principle, but important in practice: I moved Docker’s automatic network pool to 172.16.0.0/12, migrated the existing 192.168.* networks onto the 172 private range, and made sure future networks created through Portainer, Dockhand, or plain docker compose would follow the same rule.

Using Cloudflare Workers to Solve Docker Image Pull Issues

Mon, 10 Jun 2024 14:16:26 +0800

Due to certain reasons, Docker images cannot be pulled normally in China. The method I wrote last year for accelerating image pulls is also no longer functional. Where there’s a will, there’s a way (not really). So I’ve written a new tutorial to solve the Docker image pull issue using Cloudflare Workers.

This article uses Cloudflare Workers to solve the problem of being unable to pull images. I won’t go into too much detail about Cloudflare here, and Cloudflare Workers is also a free service. If you’re not familiar with it, you can check out previous articles like “cloudflare加快github下载”. If you don’t want to follow this guide, you can reply with “jsdc” in the background to get the public service address I’ve set up.

[Transfer] How to set up xiaoya’s docker and tvbox configuration

Tue, 30 Apr 2024 21:18:55 +0800

Article source: https://xiaoyaliu.notion.site/xiaoya-docker-69404af849504fa5bcf9f2dd5ecaa75f How to set up xiaoya’s docker To get the latest information about Xiaoya, please follow Xiaoya’s tg channel https://t.me/xiaoyaliu If you have any difficulties in using it, you can come here to find me or others for help https://t.me/PlutoPlayer Table of contents What do you need to install xiaoya’s docker The soft routing box is similar to n1, etc., with openwrt environment (can be configured with one click on the terminal) NAS and other devices have docker plug-ins (it is impossible or difficult to log in to the terminal and requires graphical self-configuration) Cloud servers are also commonly known as vps (can be configured with one click on the terminal) How to install Install under openwrt or vps, call up the terminal command line The left side of the openwrt control panel (find “TTY Terminal” under “System” or “Services”)

How to Connect to the Host Machine's MySQL Server from Inside a Docker Container

Thu, 30 Sep 2021 13:08:50 +0800

The blogger recently encountered a situation where they copied a database from a server onto the host machine’s MySQL server, wanting to use the local database to test the correctness of their code. However, the project programs are all deployed with a single click via Docker, so it’s necessary to access the local database from within the Docker container. During the exploration, they encountered problems and found solutions.

Enable Automatic Startup for Docker Services and Containers After Reboot

Tue, 06 Apr 2021 14:39:32 +0800

After rebooting the operating system, I found that the Docker service did not start and the containers did not start either. How do you make them start automatically after reboot?

Solve Two Problems

Enable automatic restart for the Docker service

systemctl enable docker.service

Deploy Your Own Bitwarden Password Management Server

Wed, 17 Feb 2021 20:20:06 +0800

Many people are not comfortable storing their passwords online with services like LastPass. Even though the official claim is that passwords are encrypted and the server cannot see user passwords, some still feel uneasy. In that case, you can deploy the open-source Bitwarden to set up your own password management server.

Prerequisites: A VPS server and a domain name with the IP address already resolved to the server.

How to Build an Open Source Web Flowchart Tool Diagrams.net (formerly draw.io)

Sat, 30 Jan 2021 17:59:08 +0800

ProcessOn are now well-known web 流程图, UML drawing tools. However, ProcessOn is a paid service with too many free-tier restrictions. So, is there a free option available?

Yes, it’s Diagrams.net. Completely free with powerful features~

Installing Docker on CentOS 7 and Configuring Aliyun Mirror Source

Fri, 29 Jan 2021 11:40:18 +0800

Docker Version

Since Docker version 1.13, Docker has adopted a timeline-based versioning approach, dividing releases into Community Edition (CE) and Enterprise Edition (EE). Docker CE is the free community edition, while Docker EE is the paid enterprise version.

Python3 web environment, including third-party and self-built

Sun, 24 Jan 2021 13:07:30 +0800

I needed to use the Python3 Web environment because of some family matters, so I collected them. The environment of the third-party website is very simple to use, but the shortcomings are also obvious. The last Python code cannot be saved. Python3 environment provided by third-party websites So I built an environment myself, and after struggling for a long time, I finally used Docker to build it, and it was done in just a few lines of code.

【Transfer】The latest method of half-washing Synology

Tue, 19 Jan 2021 18:10:53 +0800

I recently built a new NAS. After installing it, I found that the semi-whitewashing solution provided before no longer worked. Previous Posthttp://blog.lixx.vip/黑群晖（synology）nas-6-22-折腾记-半洗白/ Mainly because Synology’s new version of Docker 18.09.0-0506 has closed the installation of DDSM Download old version of Docker *Old version of Docker download address (Docker-x64-17.05.0-0401.spk): DDSM’s PAT download address (DSM_VirtualDSM_15284.pat): It can also be downloaded at 我的网盘 You need to uninstall the newly installed Docker in the package center, and then install the downloaded old version