Topic
#docker
Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.
Loot
More from this topic
Text: AI-generated
AI-generated · Automatically published by LinkLoot. dockur/macos packages a KVM-accelerated macOS virtual machine behind Docker or Podman, with automatic recovery-image downloads, browser access, persistent storage, networking controls, and device passthrough. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. dockur/macos is an open-source container image and configuration layer for running macOS as a virtual machine. Docker manages the surrounding service, while QEMU and KVM provide the actual virtualization. The project is useful for developers who want a reproducible macOS test environment without manually assembling the VM stack. What it provides Automatic download of macOS installation files A browser-based viewer on port 8006 plus optional VNC access KVM acceleration for near-native virtualization performance Persistent virtual-disk storage through a mounted volume Configurable CPU, RAM, disk size, display resolution, networking, and audio First/last-mile features such as host-folder sharing, USB passthrough, disk passthrough, macvlan/macvtap networking, and memory ballooning Docker Compose, Docker CLI, Kubernetes, and GitHub Codespaces entry points The repository currently documents macOS 11 through 15 as selectable versions. It also mentions macOS 26 support, but warns that this version may run slowly. Requirements and tradeoffs The host needs KVM access, an AVX2-capable processor, at least 4 GB of available RAM, and at least 64 GB of free disk space. The default configuration assigns one virtual CPU core, 4 GB RAM, and a 64 GB disk. Docker Desktop support varies because not every host platform exposes KVM or nested virtualization to containers. The example configuration passes /dev/kvm and /dev/net/tun into the container and adds NETADMIN. Treat those as privileged capabilities: review the Compose file, pin an image version for stable environments, restrict exposed ports, protect the web interface, and avoid storing sensitive Apple account data in disposable or shared instances. The project has not been independently tested by LinkLoot. Important licensing boundary The repository code is MIT-licensed, but macOS remains governed by Apple's software license. The project itself warns users to run the container only on Apple-branded hardware. Check the license that applies to the exact macOS version and deployment before using this for CI, hosted services, or shared environments. Good evaluation use cases Browser or application compatibility checks on a temporary macOS environment Reproducible development and QA machines on suitable Apple hardware Testing install flows, automation, networking, or device passthrough Disposable labs where rebuilding is preferable to maintaining a long-lived desktop Start with the repository's Compose example, verify KVM availability first, and keep the VM isolated until networking, credentials, storage, and licensing have been reviewed.
Free
Review open
A self-hosted security research workbench that turns Codex or Claude Code agents into focused, de-duplicated vulnerability scans. open-kritt is a self-hosted security research platform for developers and bug-bounty teams that want AI agents to inspect code in smaller, repeatable workflows instead of asking one model to audit an entire repository at once. It lets you build prompt-based scan workflows, run them with Codex or Claude Code, validate findings with post-scripts, rank severity, and de-duplicate results before review. Why it is useful: It is aimed at practical code-security work: scoped scans, reusable workflows, findings, ranking, and proof-building rather than generic chat. It supports model access through Codex, OpenAI, Anthropic, or OpenRouter, so teams can choose the provider path that fits their setup. The project is open source under AGPL-3.0 and includes a local Docker Compose stack plus a repository-local ./kritt CLI. Use it carefully. The project documentation states that tool-enabled scan agents run as root inside disposable containers with writable repository copies and direct internet access. The backend is unauthenticated by default. That makes open-kritt best suited for a dedicated VM or isolated Docker host, with scoped credentials and network controls, especially when scanning untrusted or private repositories. A good first evaluation path is to read the threat model, clone the repository on an isolated machine, run ./kritt setup, configure one model-access option, and scan a small non-sensitive repository before connecting private code.
Free
Review open
A practical self-hosting resource for exposing Docker apps inside a private Tailnet instead of opening router ports, reverse proxies, and public subdomains by default. What this is ScaleTail is a collection of ready-to-run Docker Compose stacks that attach common self-hosted apps to a Tailscale tailnet through a sidecar container. The useful idea is simple: make private tools reachable from your own devices without turning every dashboard, password vault, document archive, or admin panel into a public web service. Best use case Use this when you run services such as Vaultwarden, Paperless-ngx, Jellyfin, Immich, Pi-hole, AdGuard Home, Home Assistant, Open WebUI, Portainer, or Uptime Kuma and want remote access without a new router port, reverse-proxy rule, or public DNS entry for every app. Workflow Create a reusable Tailscale auth key in the Tailscale admin console. Pick the ScaleTail template matching your service. Review the Docker Compose file before running it, especially volumes, environment variables, and exposed ports. Bind the app container to the Tailscale sidecar network stack with the template's networkmode: service: pattern. Start the stack with Docker Compose and confirm the service appears in your Tailnet. Use Tailscale Serve for private Tailnet access. Only use Funnel when the service is intentionally public. Security notes ScaleTail reduces accidental public exposure, but it does not replace Docker hardening, backups, patching, or least-privilege access controls. Treat every template as code: inspect the image source, tags, volume mounts, environment variables, and update policy before production use. Keep admin panels, password managers, document stores, and local AI interfaces private unless you have a strong reason to expose them publicly. Do not confuse Tailscale Serve with Funnel: Serve is private to the Tailnet, while Funnel publishes a service to the public internet. Quick decision table Need Use ScaleTail? Caveat --- --- --- Private remote access to homelab apps Yes Requires Tailscale and Docker Compose Public webhook endpoint Maybe Funnel can be public; harden it carefully Full site publishing No Use a normal deployment and security model Multi-service homelab on one host Yes Still plan backups, updates, and separation Source check The Tarnkappe article explains the privacy angle, the Serve/Funnel distinction, and why ScaleTail fits self-hosted Docker services that should not be exposed publicly by default. The ScaleTail GitHub repository confirms that the project provides Docker Compose sidecar configurations for connecting self-hosted apps to a Tailnet. Tailscale's own Docker documentation provides the official baseline for running Tailscale with containers.
Free
Review open
Blog
Related reads
AI & Automation
Run AI coding agents in Docker Sandboxes before they touch your laptop
Docker's latest agent-isolation guidance points developers to Docker Sandboxes, SBX, and Sandbox Kits for running coding agents inside dispo…
Tools & Apps
Find Docker Content Trust before Notary v1 shuts down
Docker is retiring Docker Content Trust and the notary.docker.io Notary v1 service, with brownouts before the December 8, 2026 shutdown. Tea…
Tools & Apps
SwarmWright turns multi-agent AI into a topology you can inspect before it runs
The Show HN launch frames SwarmWright as a self-hosted multi-agent workbench where markdown agents operate inside an explicit graph instead …
Tools & Apps
Agent Sandbox packages terminal coding agents inside locked-down Docker containers
A new GitHub project called Agent Sandbox wraps terminal coding agents in restricted Docker containers, aiming to give developers an easier …