docker

My dev script still called docker-compose in eleven places. Compose v1 has been EOL since June 2023; only a symlink kept it alive.

TL;DR: The dev script still called docker-compose, deprecated since mid-2023, and only survived thanks to a Docker Desktop compatibility symlink masking the problem. Compose v2 turned the command into a docker CLI subcommand, so it's now two words. Swapping the hyphen for a space across all call sites is a tiny commit that prevents CI breakage.

A half-remembered Mbps-to-bytes formula left the 3proxy bandlim cap at 5 Mbps instead of 40. The manual said bits all along.

TL;DR: A 3proxy bandwidth cap configured at 40 Mbps actually limited traffic to 5 Mbps because bandlim expects bits per second, not bytes, so the fix was changing 5000000 to 40000000. The same commit trimmed a GoAccess dashboard to three panels, surfacing the URL table immediately. Lesson: verify unit conversions against the manpage.

I tore out my self-built GoAccess stack for 3proxy's built-in admin counters, then realized counters can't answer which URLs eat the bandwidth.

TL;DR: The author deleted a self-built GoAccess dashboard for 3proxy, replacing it with the built-in admin directive and secure-mode counters. That answered how much traffic, but not which URLs or hosts consumed it. GoAccess returned properly: stripped fractional timestamps, filtered ADMIN lines, and nginx proxying WebSocket with explicit upgrade headers and longer read timeouts.

A time-based bandwidth cap on a home LAN using Squid delay pools: bytes vs bits, the acl time trap, container TZ, and a second unlimited pool.

One Compose service driven by FORGEJO__ env vars: built-in loopback SSH, push-to-create, LFS, and a healthcheck that tells the truth.

I published a proxy port on loopback and a process on the same host still got refused. Docker filters by door, not by who is knocking.

Five hours of 'healthy' while the browser inside the container had been dead since minute one. Notes on user, HOME, and shallow healthchecks.

The fallback fired, the article shipped, and the real failure was one clipboard probe returning 410 Gone. Diagnosis before fallback, now a written rule.

TL;DR: A clipboard probe returned HTTP 410, exposing that an automated fallback had silently routed around a Qwen generation failure. The fallback fired on exit code 1 without diagnosing the cause, so the pipeline looked green while the primary path rotted. Now every failure triggers a doctor script first, and exit codes are disambiguated.

An hourly wave of 504s looked like an attack. The logs pointed at a dormant rate limit and a PHP-FPM pool out of workers.

TL;DR: Hourly 504 waves looked like a DDoS but were actually PHP-FPM worker exhaustion, worsened by request_terminate_timeout killing slow requests. Nginx rate limiting never fired because Cloudflare hid real client IPs, collapsing everyone into one $binary_remote_addr bucket. Fixes: enable Cloudflare caching, tune PHP-FPM pool settings, and rotate container logs with copytruncate.