Docker Knowledge Base

Operating rules for self-hosted Docker stacks on this host. No per-container documentation yet — this is the rulebook to follow when adding a new stack.

Host facts

Fact	Value
Docker mode	Rootless (unprivileged-docker, uid 1121), fuse-overlayfs
Docker root	/mnt/newhome/unprivileged-docker/.local/share/docker (ext4)
Compose	Docker Compose v5
Timezone	America/Los_Angeles (set TZ explicitly per stack)
Stack dirs	/mnt/newhome/unprivileged-docker/<stack>/
Agent skill	.opencode/skills/docker-stack-setup/SKILL.md

Read in this order

1. Storage tiers — where state may live, and why.
2. New container rules — the setup checklist and hard bans.
3. Compose conventions — naming, ports, networks, secrets, logging, health, upgrades.

Templates: templates/docker-compose.yml and templates/.env.example.

Per-container notes will be added under docs/containers/ once a stack is deployed; until then the rulebook is the only source of truth.

Golden rules

• Databases and write-heavy state go on ext4 (/mnt/newhome/...), never on btrfs COW.
• Irreplaceable data goes on the mirrored NAS (/mnt/nas/...).
• Rebuildable hot data goes on NVMe btrfs (/mnt/nvmesrv/...).
• Compose files live on ext4, one directory per stack, .env mode 0600.
• No 0.0.0.0 port publishing by accident, no privileged, no Docker socket mounts, no docker system prune --volumes.
• Snapshot ≠ database backup. Live databases need an application-level dump.