- 12.3: daemon.json has no top-level cgroup-driver key; use exec-opts
native.cgroupdriver (values cgroupfs/systemd) per official dockerd reference
- 12.2: USER namespace is not enabled by default; requires userns-remap
(aligns with 18.1)
- 14.1: cgroup v1 deprecation and kubelet default-fail happen in v1.35, not
v1.36 (per kubernetes.io cgroups doc)
- 15_etcd: maintenance window updated after etcd v3.7.0 release (2026-07-08)
to 3.6/3.7
- 3.9.6: fix dangling sentence order in registry migration note
- tools: add 'from __future__ import annotations' so PEP 604 annotations run
on Python 3.9 (fixes npm test)
Renders Mermaid to SVG via the workflow's Chrome, pandoc --mathml, assembles a
single self-contained responsive HTML reader, and attaches <repo>-<tag>.html to
the GitHub Release next to the PDF. Non-blocking (continue-on-error).
The app and django compose demos used ADD for plain local files, but the
book's in-text versions of the same examples (11.3_usage.md, 11.6_django.md)
and its own guidance (7.2/7.3, appendix best_practices) all use COPY. Align
the demos with the documented practice.
Follow-ups to the 9 secret-hardening commits (each verified against
docs.docker.com / vendor docs; one outright new bug found and fixed):
- 11.6: eb5e4397 changed settings.py to a hard os.environ lookup but the
web service never receives POSTGRES_PASSWORD (only db does; DATABASE_URL
is set but never read) -> step-6 'docker compose up' crashed with
KeyError. Pass the var to web; harden the leftover literal password in
the 配置详解 snippet that contradicted the new guidance two lines down;
blank line after the inserted sentence (bold heading merged into the
paragraph); dev/prod table no longer claims dev uses 明文 passwords
- 11.8: FAQ still told readers to check passwords in .env after the same
file banned passwords in .env -> point at secrets/db_password.txt;
backup sidecar env vars updated to tiredofit/db-backup 4.x interface
(DB01_* + DB01_PASS_FILE + DB01_BACKUP_INTERVAL - the unprefixed DB_*
names are ignored by current :latest; verified against upstream README)
- demo/wordpress: compose now references secrets files that ship nowhere
-> add README with the creation commands from 11.8; demo/django: align
with the hardened 11.6 (env-injected password, passed to web too)
- 04_image multistage demos: go build without go.mod fails on module-mode
Go (reproduced by reviewer on go1.26) -> add 'go mod init helloworld'
matching the 7.17 doc pattern in all three Dockerfiles
- 21.7: init script reworked init-db.sql -> init-db.sh per the official
image's env-reading .sh hook - removes the baked 'secure_password' AND
the CREATE DATABASE myappdb collision with POSTGRES_DB that aborted
first-boot init (ON_ERROR_STOP); compose passes APP_DB_PASSWORD;
microservices init.sql mount annotated schema-only (POSTGRES_USER:
appuser would collide with CREATE USER); Dockerfile-redis healthcheck
now authenticates via REDISCLI_AUTH read from redis.conf (plain
redis-cli ping gets NOAUTH against requirepass - same class as the
compose sibling eb5e4397 already fixed); dev-container dev/dev creds
annotated local-only
- 19.3: Grafana admin password 'admin' sat directly under the newly added
security warning -> env-injected like the rest of the stack
This 7-line file was never in SUMMARY.md and its content is a strict
subset of the current 17.1_coreos_intro.md. It looks like a draft
that survived the chapter rename to NN.M_topic.md convention.
Removed so the directory only contains files reachable from the ToC.
The other appendix entries (附录四 best_practices, 附录五 debug,
附录六 resources, 附录八 learning_roadmap) all use H2. glossary.md
was the lone H1, which broke the table-of-contents nesting in
GitBook. Demoted to H2 to align.
§7.3 of this book explicitly recommends COPY over ADD for simple
file copies ("在大多数情况下，你应该使用 COPY，而不是 ADD"). The intro
Compose example showed ADD without needing tar extraction or URL
download, contradicting the canonical guidance. Switched to COPY
so the first Dockerfile readers see matches the rule the book
teaches a few chapters later.
Docker Engine 29.0.0 was released 2025-11-10 per docs.docker.com release
notes, not 2025-11-11 (off by one day). Also bring docker/login-action
reference in 18.6 up to v4 to match the 21.2 example (v4 has been current
since 2026-03-04).
The "节点周期" subsection listed `Pending`/`Running`/`Terminated` as
node phases, but those are **Pod** phases (pod.status.phase). Kubernetes
nodes use Conditions (Ready/MemoryPressure/DiskPressure/PIDPressure)
not phases; there is no "Terminated" node state. Removed the
misleading subsection and clarified the surviving "节点状态" section
with an explicit note distinguishing Pod phases from node conditions,
and added the eviction behavior when a node becomes Unknown.
The cAdvisor compose examples in 19.3.3 use `privileged: true`, which
contradicts the minimum-privilege / cap_drop=all guidance in chapter 18.
Add an explicit trade-off note before the first cAdvisor snippet
explaining the inconsistency and pointing to 18.4 for capability-based
hardening alternatives (cap_add: [SYS_ADMIN] + device_cgroup_rules
instead of full privileged mode).
This addresses the Round 1 review finding about pedagogical conflict
between the monitoring and security chapters.
yeasy
