Docker and Container Runtime Management

Use docker, docker compose, and lazydocker to manage container execution, services, and local debugging. The containerize guide builds, publishes, and signs Python images; trivy scans them for vulnerabilities.

On Linux, Docker and Compose are host prerequisites. On macOS, the global mise config installs Colima, Lima, and the Docker CLI with Compose and Buildx (Colima). Nothing here starts a daemon or VM. Inspect docker context ls before choosing a runtime and pass docker --context <context> on consequential commands; do not change the persistent default just to run a task. Container runs execute project code; reuse authority for the requested workload and resolve missing scope before running untrusted images or consequential workloads. Preserve existing volumes and containers.

Runtime Selection

• Linux: use the existing Docker-compatible engine; host daemon installation is outside user-space mise setup.
• macOS: use Colima instead of Docker Desktop; read colima for its context, socket, memory, and mount behavior.

Workflow

1. Verify daemon health and storage budget: confirm the daemon is responsive and check storage footprint before launching workloads. Run dot doctor --headroom before large pulls or builds.

   docker info --format 'Server={{.ServerVersion}} Driver={{.Driver}} Containers={{.Containers}} Images={{.Images}}'
   docker system df

2. Manage Compose stacks: resolve the Compose file and project name first. Use a unique name for a new disposable stack; reuse an existing project's name only when operating that stack is in scope. up --wait exits non-zero when a service fails to start or stays unhealthy, while up -d succeeds once containers start; a one-shot service that exits 0 also fails --wait unless another service depends on it with condition: service_completed_successfully.

   docker --context <context> compose -p <project> -f <compose-file> up --wait --wait-timeout 120
   docker --context <context> compose -p <project> -f <compose-file> ps
   docker --context <context> compose -p <project> -f <compose-file> logs --since 15m --tail 100 <service>
   docker --context <context> compose -p <project> -f <compose-file> down

3. Clean up task resources: use docker run --rm <existing-image-or-approved-digest> <command> for ephemeral runs, and follow resource cleanup for task-created volumes, networks, images, and builders.

Gotchas

• The Linux engine comes from the distro: Docker and Buildx can lag upstream (Debian ships Buildx 0.13), so check docker buildx version before using a newer build flag such as --check.
• Exit 137 is SIGKILL, not proof of OOM: check .State.OOMKilled and the memory limit first; on macOS, Colima's VM budget also applies.

Task guides

• colima: Run Docker on macOS through Colima: VM start, socket, memory limits, and mounts.
• containerize: Build, scan, sign, and verify Python container images with Trivy and Cosign.
• cosign: Sign, verify, and attest image digests with keyless Sigstore.

Documentation

• Docker Documentation · Docker Compose Reference
• Lazydocker
• Releases: Docker Engine
• Companion skills: cloud-run (deployment), trivy (scanning), airflow (local Airflow).