Containers - Ken Muse

Pinning VS Code Extensions to Fight Supply Chain Attacks

Thu, 30 Apr 2026 00:00:00 -0400

Pin VS Code extension versions in dev containers to prevent supply chain attacks. Treat extension updates like dependency upgrades -- deliberate and reviewed.

Rootless Docker and Its Hidden Security Trade-Offs

Thu, 23 Apr 2026 00:00:00 -0400

Explore how rootless Docker uses user namespaces, why kernel developers have concerns about the attack surface, and what unconfined flags really disable.

How Docker Uses Root Privileges

Thu, 16 Apr 2026 00:00:00 -0400

Trace how Docker's daemon, socket, image builds, and BuildKit all rely on root-level Linux kernel privileges.

Building Container Isolation From the Linux Kernel Up

Thu, 09 Apr 2026 00:00:00 -0400

Build container isolation from scratch with Linux namespaces and cgroups to understand the kernel features Docker uses.

Pre-Caching Docker Images on GitHub Runner Custom Images

Wed, 17 Dec 2025 00:00:00 -0500

Discover how to improve GitHub Actions performance and drastically cut the time and bandwidth required to use Docker images in your workflows.

How I Avoided Shai-Hulud's Second Coming (Part 1)

Wed, 26 Nov 2025 00:00:00 -0500

Simple security practices that protected my dev environment from the Shai-Hulud supply chain attack -- and how you can use them too.

Understanding IPv6: From GitHub's IPs to Kubernetes and ARC

Sat, 08 Nov 2025 00:00:00 -0500

Learn how IPv6 affects your DevOps workflows, from GitHub's IP ranges to Kubernetes networking, Docker containers, and the latest ARC improvements.

Adding Help (man) to Buildroot Packages

Fri, 22 Aug 2025 00:00:00 -0400

A step-by-step guide to adding configurable man page support to custom Buildroot packages, extending the GitHub CLI package with comprehensive documentation.

Creating a CodeQL Image for ARC With Python 2

Thu, 24 Jul 2025 00:00:00 -0400

Add Python 2 support to your CodeQL Docker image using multistage builds (and some Docker tricks) to support security scanning in ARC.

Creating a CodeQL Image for ARC

Sat, 19 Jul 2025 00:00:00 -0400

Learn how to build a custom Docker image with CodeQL pre-installed for GitHub ARC runners, eliminating download times and ensuring consistent analysis.

Creating a Custom Buildroot Package For Binaries

Fri, 11 Jul 2025 00:00:00 -0400

A step-by-step guide to creating your first custom Buildroot package for a binary package containing an installable GitHub CLI.

Speeding Up the Buildroot Toolchain

Sat, 05 Jul 2025 00:00:00 -0400

Speed up your Buildroot builds with prebuilt toolchains, SDK reuse, and CI/CD caching. Enjoy faster results and less frustration!

Configuring Buildroot for Crafting Images

Wed, 25 Jun 2025 00:00:00 -0400

Learn how to use Buildroot's menu system to create and configure a minimal, Bash-only image for Docker.

Building OCI Images With Buildroot

Sat, 21 Jun 2025 00:00:00 -0400

Build Docker images and OCI packages easily with Buildroot. Learn to automate, customize, and simplify your image creation process.

Building OCI Images Without Using Docker

Fri, 13 Jun 2025 00:00:00 -0400

Learn what's in an Open Container Image and how to build your own images without Docker using some common command line tools.

Calling Docker From Inside a GitHub Job Container

Sat, 24 May 2025 00:00:00 -0400

Learn to run Docker commands inside a GitHub Actions job container and understand the magic behind how Actions creates and manages job and service containers.

Authenticating Docker in Docker Containers in Kubernetes

Sat, 17 May 2025 00:00:00 -0400

Discover how to securely authenticate Docker-in-Docker containers inside Kubernetes to enable private registry access.

What's New in GitHub Actions Runner Controller

Mon, 31 Mar 2025 00:00:00 -0400

The new version of Actions Runner Controller has performance fixes, improved configurability, and a new approach to metrics. This post reviews those changes.

Managing Pod Resource Requests and Limits in Kubernetes

Thu, 02 Jan 2025 00:00:00 -0500

In Kubernetes, we cannot manage resources at the pod level and must resort to setting requests and limits on containers. Learn how that's changing.

Using A Kubernetes Native Sidecar With GitHub ARC

Fri, 20 Dec 2024 00:00:00 -0500

Explore how to modernize the Docker-in-Docker support in GitHub Actions Runner Controller (ARC) using the latest Kubernetes feature: native sidecars.

Taking Advantage of Kubernetes Native Sidecars

Thu, 19 Dec 2024 00:00:00 -0500

Kubernetes has a powerful feature that can help you build more robust deployments. Learn about native sidecars, the problems they solve and how to use them.

Exploring The Three Flavors of GitOps

Sat, 14 Dec 2024 00:00:00 -0500

Discover the world of GitOps, where Git becomes your source of truth for deployments and learn the three models for defining your GitOps practices.

Testing Kubernetes Operators and Controllers With Minikube

Fri, 27 Sep 2024 00:00:00 -0400

Sometimes you need to try out a modified image or custom chart you're creating in Kubernetes. Minikube can make that process easier.

Implementing Private VS Code Extensions for Dev Containers

Fri, 20 Sep 2024 00:00:00 -0400

Learn how to implement private Visual Studio code extensions that are designed to support a specific development container or Codespaces environment.

Planning Kubernetes Cloud Deployments

Sat, 27 Jul 2024 00:00:00 -0400

Understanding resource allocation is a critical skill for successful Kubernetes cluster deployments. Learn how the cloud providers reserve Kubernetes resources.

Understanding Kubernetes Resource Consumption

Fri, 19 Jul 2024 00:00:00 -0400

Surprised that you can't fit as many pods on a node as you thought? It turns out that there's a lot more to the story of how Kubernetes allocates resources.

The Ultimate Debugging Hack for Developers

Fri, 12 Jul 2024 00:00:00 -0400

Developers usually want to be able to directly connect to a system and start their debugger. What if there's a better way to get the information you need?

Scaling ARC on a Schedule

Wed, 03 Jul 2024 00:00:00 -0400

The Actions Runner Controller (ARC) can't configure the minimum runner count based on a schedule. Learn to use native `CronJob` resources for the task!

The Top 5 Things To Know About ARC

Fri, 21 Jun 2024 00:00:00 -0400

Actions Runner Controller (ARC) is a powerful way to manage ephemeral, self-hosted GitHub runners. There are five keys that can make you successful using it.

The Importance of Kubernetes Logs

Thu, 13 Jun 2024 00:00:00 -0400

If you really want to master your Kubernetes environment, it begins with understanding the value of a logging and how to implement good logging practices.

The Magic of Scaling and Auto-Scaling

Thu, 06 Jun 2024 00:00:00 -0400

Scaling systems is a journey. It's not just about adding more resources. It's about understanding the bottlenecks and how to overcome them.

Strategies for Upgrading ARC

Thu, 30 May 2024 00:00:00 -0400

Understand the best practices for upgrading Actions Runner Controller and minimizing downtime, including when (and if) you can skip a release.

Building Base Images for ARC

Thu, 09 May 2024 00:00:00 -0400

If you're using Actions Runner Controller, the provided base image may not be enough. Learn what's needed in your image to make your workflows run smoothly.

Building GitHub Runner Images With an Action Archive Cache

Fri, 29 Mar 2024 00:00:00 -0400

If you want to make images for GitHub Actions Runner Controller (ARC) that are fast and network-friendly, learn how to include an Action archive cache.

Building GitHub Actions Runner Images With A Tool Cache

Thu, 28 Mar 2024 00:00:00 -0400

If you want to make an efficient image for GitHub Actions Runner Controller (ARC), you need to first understand how to prepopulate the runner's tool cache.

What Is ARC Doing & How Does It Interact With Kubernetes?

Sat, 16 Mar 2024 00:00:00 -0400

Understanding ARC begins with understanding what it does (and does not do) to create runners on Kubernetes. In this post, I explore the basics of the process.

The New DevContainer initializeCommand

Fri, 08 Mar 2024 00:00:00 -0500

The dev container specification was updated to better define the behavior of initializeCommand. Learn what changed and why your scripts should be idempotent.

Getting User Input When Starting a Dev Container

Fri, 09 Feb 2024 00:00:00 -0500

Sometimes you just need a little human interaction. Thankfully, there is a way to get user input that works with most of the dev container implementations.

Mounting Files as Volumes

Fri, 02 Feb 2024 00:00:00 -0500

Kubernetes and containerized systems mount drives and folders as volumes, but there is another option. Learn how to mount a file and treat it like a drive.

Understanding Container Image Layers

Sat, 27 Jan 2024 00:00:00 -0500

To master containers, it's important to understand the concept of layers. In this post, I'll explain how layers work and the basis behind their implementation.

More Best Practices for Deploying GitHub ARC

Thu, 11 Jan 2024 00:00:00 -0500

There are some common issues that lead to teams struggling to set up ARC, and nearly all can be avoided with these recommendations.

Best Practices for Deploying GitHub ARC

Fri, 05 Jan 2024 00:00:00 -0500

There are some common issues that lead to teams struggling to set up ARC. Nearly all of them can be avoided with these recommendations.

Why You Should Use Dedicated Clusters For GitHub ARC

Sat, 30 Dec 2023 00:00:00 -0500

I recommend using a dedicated Kubernetes cluster with GitHub Actions Runner Controller (ARC) to get the best performance and security. This post explains why.

The Two GitHub ARCs (and Why You Should Only Use One)

Sat, 16 Dec 2023 00:00:00 -0500

Many teams want to have GitHub self-hosted runners on Kubernetes using ARC, but aren’t aware there are two different versions. This post attempts to explain.

Enabling GitHub ARC Metrics

Sat, 09 Dec 2023 00:00:00 -0500

Learn to enable metrics in GitHub's Actions Runner Controller (ARC) and get visibility into the processing queue and the performance of jobs and runners.

Automatic SSH Commit Signing With 1Password

Fri, 10 Nov 2023 00:00:00 -0500

Learn how to automate SSH commit signing with 1Password and dotfiles to enable others to verify the authenticity of your Git commits.

Understanding the SLA of ARC

Sat, 04 Nov 2023 00:00:00 -0400

If you're trying to increase availability by using GitHub Actions Runner Controller. In this post, I'll explain why you can't exceed the 99.9% SLA of GitHub.

Windows Runners on Actions Runner Controller

Thu, 26 Oct 2023 00:00:00 -0400

GitHub's Actions Runner Controller (ARC) does not officially support Windows containers for runners. With a little bit of work, we can make it possible.

Automatic SSH Commit Signing With Dotfiles

Thu, 19 Oct 2023 00:00:00 -0400

I previously talked about how dotfiles can improve the development experience. By automating the processing of setting up your environment, you are free to focus on more important things. One of the more mundane tasks for developers is setting up commit signing and verification. By doing this, others can verify that you are the author of a specific commit. It just requires some setup, especially if you want automatic support in your dev containers. For these examples, I’m going to use SSH-based commit signing. It’s a common approach, and it doesn’t require sharing a private key between environments.

The Image Factory Pattern

Thu, 28 Sep 2023 00:00:00 -0400

Looking to maintain virtual machine or Docker images in the most efficient way possible? Use the Image Factory pattern to automate creation and distribution!

Improving Dev Container Feature Performance

Thu, 01 Jun 2023 00:00:00 -0400

Dev container features provide a quick way to add functionality. The tradeoff for the ease of use is often speed. Learn the tricks to preserving performance.

Dubious Ownership With Static Web Apps

Thu, 11 May 2023 00:00:00 -0400

Git's safe directory configuration helps to protect users, but it can create challenges. This is especially true when using Hugo with Azure Static Web Sites.

Implementing Docker Layer Caching in GitHub Actions

Thu, 09 Feb 2023 00:00:00 -0500

Learn how to use the Docker BuildKit gha, inline, and registry layer caching with GHCR, and GitHub Actions to improve build performance.

Implementing Docker-from-Docker for Non-Root Users

Tue, 31 Jan 2023 00:00:00 -0500

Dive deeper into dev container Features and Linux scripting to create an entrypoint for the non-root users.

Improving Docker-From-Docker With Features

Thu, 26 Jan 2023 00:00:00 -0500

Sometimes scripting in containers just isn't enough. If you need modular, reusable components for repeatable practices, you may need to implement a Feature.

Intro to Dev Container Features

Sat, 21 Jan 2023 00:00:00 -0500

Explore the basics of the specification and how it lets you create reusable components for your dev containers.

Docker-from-Docker in Alpine Dev Containers

Thu, 05 Jan 2023 00:00:00 -0500

In this post, we'll see if we can run some Docker commands from inside our Alpine dev container using Docker-from-Docker and a bit of configuration.

Fast Start Dev Containers

Thu, 29 Sep 2022 00:00:00 -0400

In last week’s article, Using the Docker Cache, we learned that we can take advantage of the Docker cache to reduce our build times. There’s another advantage to using that cache. We can reduce the time it takes to spin-up a dev container!

It’s almost Halloween, so you’re probably thinking “this must be some kind of witchcraft!”. Almost. It’s a configuration setting in the devcontainer.json file. If you’re referencing a Dockerfile and building an image dynamically, you can take advantage of the build.cacheFrom setting. This is passed to the docker build process as the --cache-from parameter. By providing a value, we enable the development environment to use cached layers. For example:

Using the Docker Cache for Faster Builds

Thu, 22 Sep 2022 00:00:00 -0400

Did you know that Docker has multiple built-in caches for making if faster and easier for you to build images? If not, you’ve been missing out on some performance possibilities! Modern docker builds rely on Buildkit, a feature of Docker that enables high-performance builds. This includes support for storing and consuming layers by using caches.

Caches are different from the pull-through functionality commonly discussed in other blogs. Instead of needing you to setup your own Docker registry, they enable you to read and write layer details in a way that enables faster builds. If you weren’t aware of this – no worries! Surprisingly, most people aren’t. And even fewer people realize these caches work with other tools, such as dev containers and GitHub Actions. Part of the reason is that it’s tough finding a good explanation of these caches or how to use them. Hopefully today we can resolve part of that problem.

Waiting for Docker Compose Up

Thu, 15 Sep 2022 00:00:00 -0400

If you’ve worked with Docker Compose in the past, you may have used a number of tricks to make sure that the containers were stable and running before moving on to further steps. For example, you might periodically ping the service. If the attempt fails, you simply sleep and retry until you get the expected results.

A short time ago, the Docker team offered an easier approach to solving this problem. Just wait for it. More to the point, they added the --wait command. This ensures that docker compose up waits for your services to be healthy before returning control to the caller. This can be helpful, especially if you’re using Compose to automate other processes.

Forcing Dev Containers To Use AMD64

Thu, 01 Sep 2022 00:00:00 -0400

While there are many things to like about Apple’s laptops, one of the more frustrating aspects is the number of applications and images that are not designed to support ARM processors. Over the last few years, we’ve seen ARM chips suddenly surge into mainstream laptops and servers. It makes sense – the chipsets offer high performance at a low cost.

Sadly, not all containers and applications have been updated to support the additional architecture. This means that we often have to accommodate these tools. Dev containers add an additional challenge. They limit what build arguments we can provide, preventing us from taking control of parts of the process (such as the architecture). For example, while I can include the current Azure CLI in my arm64 images, the consistently fails to work because portions of the package target Intel/AMD chipsets. I have to rely on amd64.

Marking Workspaces Safe with Dotfiles

Thu, 18 Aug 2022 00:00:00 -0400

There's a great way to use dotfiles to eliminate the "detected dubious ownership in repository" message in every dev container automatically.

Avoiding Dubious Ownership in Dev Containers

Thu, 11 Aug 2022 00:00:00 -0400

Getting the message "detected dubious ownership in repository" in your dev container? Learn how to eliminate this error.

Dev Containers and AWS Credentials

Wed, 03 Aug 2022 00:00:00 -0400

Did you know it's possible to share your AWS credentials between your host computer and your Dev Containers? Once again we explore the power of Docker mounts!

Dev Containers and node_modules

Wed, 27 Jul 2022 00:00:00 -0400

There's a trick you can use with dev containers and Docker volumes to make it easier to manage your node_modules folder.

Publishing Images With GitHub Actions

Thu, 09 Jun 2022 00:00:00 -0400

Learn how to publish OCI and Docker images to Azure and GHCR using GitHub Actions and OIDC.

Running Hugo in macOS Dev Containers

Thu, 05 May 2022 00:00:00 -0400

Learn how to create optimized containers that work well for both ARM64 and AMD64 platforms.

Deploying to Azure from Private Container Registries

Thu, 17 Mar 2022 00:00:00 -0400

How to use private registries and GitHub Container Registry with services like Azure Container Instances, Azure App Services, and Azure Container Apps.

Azure Container Solutions

Mon, 07 Mar 2022 00:00:00 -0500

Understand the different Azure containerization options and how to pick the right one for your job.

Have It Your Way - The Magic of dotfiles

Thu, 20 Jan 2022 00:00:00 -0500

Have your favorite configurations follow you in your Dev Containers by creating a dotfiles Git repository.

Containers and the WSL2 File System

Wed, 22 Dec 2021 00:00:00 -0500

Learn how to optimize your development container performance by working in the right filesystem in WSL2.

Dev Containers, Codespaces, and Bicep, Oh My!

Thu, 16 Dec 2021 00:00:00 -0500

Learn how to create a dev container for editing and deploying Bicep templates to Azure.

Using Development Containers

Tue, 19 Oct 2021 00:00:00 -0400

Learn how to implement development environments using infrastructure-as-code with Dev Containers, Codespaces, and Gitpod!

Automating SQL Server 2019 Docker Deployments

Sat, 07 Mar 2020 00:00:00 -0500

In a previous article, I walked through deploying to SQL Server 2017 containers and provided an overview of deploying DACPACs and BACPACs in containers. Since that time, SQL Server 2019 has been released; this requires a few changes to the approach. In this article, we’ll look at what changes you need to make to deploy to a 2019 container.

Let’s start with the code, then examine what’s changed.

 1FROM mcr.microsoft.com/mssql/server:2019-latest
 2
 3# Elevate to root to install required packages
 4USER root
 5RUN apt-get update \
 6 && apt-get install unzip libunwind8 libicu55 -y
 7
 8# Install SQLPackage for Linux and make it executable
 9RUN wget -progress=bar:force -q -O sqlpackage.zip https://go.microsoft.com/fwlink/?linkid=2113331 \
10 && unzip -qq sqlpackage.zip -d /opt/sqlpackage \
11 && chmod +x /opt/sqlpackage/sqlpackage \
12 && chown -R mssql /opt/sqlpackage \
13 && mkdir /tmp/db \
14 && chown -R mssql /tmp/db
15
16# Lower the privilege
17USER mssql
18
19# Add the DACPAC to the image
20COPY site.bacpac /tmp/db/db.bacpac
21
22# Configure external build arguments to allow configurability.
23ARG DBNAME=Database
24ARG PASSWORD
25
26# Configure the required environmental variables
27ENV ACCEPT_EULA=Y
28ENV SA_PASSWORD=$PASSWORD
29
30# Launch SQL Server, confirm startup is complete, deploy the DACPAC, then terminate SQL Server.
31# See https://stackoverflow.com/a/51589787/488695
32RUN ( /opt/mssql/bin/sqlservr & ) | grep -q "Service Broker manager has started" \
33 && /opt/sqlpackage/sqlpackage /a:Import /tsn:. /tdn:${DBNAME} /tu:sa /tp:$SA_PASSWORD /sf:/tmp/db/db.bacpac \
34 && rm -r /tmp/db \
35 && pkill sqlservr \
36 && rm -r /opt/sqlpackage

To begin with, you will need to use a SQL Server 2019 image, such as 2019-latest. There is a complete list of images, which includes specific releases of SQL Server that you can use. Microsoft documents installing and connecting to SQL Server 2019 on Docker if you want to learn more about working with the containerized version of SQL Server. The Microsoft docs site also provides a guide to configuring Docker containers. The default Linux image is based on Ubuntu, but official RHEL images are also available.

Data DevOps: Deploying SQL Server DACPACs to Docker

Mon, 31 Dec 2018 00:00:00 -0500

In order to truly optimize the workflow and create a culture of DevOps, we need to be able to quickly build and deploy databases. To automate this process, we need to rely on improving our ability to utilize infrastructure as code. In this post, I’m going to show you how to use sqlpackage to automate the process of deploying a DACPAC to SQL Server 2017 on a Linux container.

What is a DACPAC?

If you’re not familiar with the terms, DACPACs are a way of encapsulating the definition of a SQL Server database for automated deployment. Essentially, it’s a ZIP file (or, more specifically, an Open Packaging Convention document) which contains the details of the schema and an optional set of pre-deployment and post-deployment scripts to be executed. The benefit of this model is that it uses state-based deployments to update the schema of the database. Think of this as desired state configuration for your database schema. Rather than manually creating migration scripts, you can instead focus on defining the end state and allowing DACFx (Database Application Framework) to determine how to best apply the migration.