The Miner in ps Wasn’t Ollama, It Was a Container
A miner showed as user 'ollama' in ps, so I blamed the Ollama service for three days. It was a Postgres container whose UID collided with the host account.
Tag Docker
Docker Compose .env Changes Need Container Recreation
Editing .env on a running container does nothing — Compose reads it once at start. And $ in a secret gets interpolated away, silently truncating tokens.
Don’t Panic Over Docker’s Exec Artifacts
A monitor flagged runc --process /tmp/runc-process as suspicious. It's Docker's transient exec artifact — here's why I patched the detector, not the runtime.
fail2ban Bans That Quietly Do Nothing on Docker Ports
A fail2ban jail reported bans while the wp-login brute force continued, because Docker-published ports traverse FORWARD, not INPUT. The fix is DOCKER-USER.
Crypto Miner in Docker: The Postgres Port I Forgot to Close
A 381% CPU spike on my VPS was a crypto miner in a Docker container — not where I first looked. The three-day misdiagnosis, root cause, and fix.