Docker Engine 29.8 can render docker-default from a daemon-configured Go
template.
Document the supported template data, safe file placement, daemon
configuration, and verification so administrators do not treat the
template as a directly loadable profile.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Explain how Engine 29.7.0 can run containerd inside dockerd, how to
enable and verify the experimental mode, and how external clients can
connect to its endpoint.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Keep the legacy-link reference while warning that default-bridge links
and legacy-link environment variables are scheduled for removal in
Docker Engine 30.0.
Document the environment variable escape hatch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
<!--Delete sections as needed -->
## Description
Added back the attribute `external` in the `/reference/compose/secrets`
section with a warning that this attribute is only available for Docker
Swarm. Additionally, I added a small toy reference example to the
section "Defining and using Secrets in compose files" and moved the
section outside of the "Examples" section. The reason why I did this is
because I noticed the Examples are all runnable steps that showcase
concrete usage of secrets, the example I added is just a
skeleton/reference to how they should be used in conjunction with
`docker secret create...`, not a true able-to-run example like the ones
below. I also changed the hyperlink from
`/reference/compose-file/legacy-versions.md` to
`/reference/compose-file/secrets.md`.
A few caveats that I wasn't sure about when writing this:
- I'm not sure if using the "[!NOTE]" in the attributes list is the
approach maintainers and writers might favor and I can change it
accordingly
- I'd love to hear feedback on moving "Defining and using secrets in
compose files" outside of "Examples" due to my reasoning above
Edit:
I'm also not opposed to making a fully working example using compose,
stack and secrets and putting the section back under `Examples`
<!-- Tell us what you did and why -->
## Related issues or tickets
#25491
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
tmpfs is backed by host memory and that usage is charged to the
container's memory cgroup. A large `tmpfs-size` (or a host-mounted
tmpfs) does not give you RAM outside `--memory`, and filling the mount
can still OOM the container.
Called that out in the intro and limitations, with a pointer to the
runtime metrics page.
Fixesmoby/moby#47967
---------
Signed-off-by: Dean Chen <862469039@qq.com>
The example used --restart unless-stopped, but the sentence next to it
read like the container would stay down when dockerd came back.
Signed-off-by: Dean Chen <862469039@qq.com>
The steps above already link the Notary service guide. The production
section still said to wait for an official stable release.
Fixes#25145
Signed-off-by: Dean Chen <862469039@qq.com>
- Problem: the prune-everything section said the default removes all unused images. Live docker system prune only removes dangling images unless -a is passed.
- Fix: say unused containers/networks plus dangling images by default, and that unused tagged images need -a/--all.
- Verification: docker 29.1.3 — default warning lists "all dangling images"; docker system prune -a lists "all images without at least one container associated to them". Closed#17488 wanted to change the example to include -a and went stale; this only corrects the default-behavior sentence.
- Problem: the pruning guide said docker system prune --volumes removes all unused volumes, and the example warning still said "all volumes" / "all build cache".
- Fix: match Docker 29.1.3 CLI help and confirmation text: --volumes prunes unused anonymous volumes; named volumes need docker volume prune --all.
- Verification: compared live `docker system prune --help` and the `docker system prune --volumes` warning (answered n) on 29.1.3.
When something else (e.g. a CNI) rewrites packets to a container IP
before host netfilter, Docker's unpublished-port protection still
applies. `DOCKER-USER` never sees that as "published" traffic.
Added a short note under the iptables DOCKER-USER section pointing at
port publishing / `nat-unprotected`.
Fixes#25676
---------
Signed-off-by: Dean Chen <862469039@qq.com>
The pruning guide said all unused volumes are removed by default.
CLI actually keeps unused named volumes unless --all is set.
Signed-off-by: Dean Chen <862469039@qq.com>
