Puppeteer
Running Puppeteer in CI is harder than it should be. Headless Chrome needs specific system dependencies, and those dependencies vary across base images, CI environments, and Chrome versions. This guide covers the working configurations — not the ones that look right but fail at runtime. Why Puppeteer Fails in CI The
Testing
Docker Compose is the standard way to run multi-service integration tests locally and in CI. Use docker compose up --wait with healthchecks to ensure services are ready before tests run. Run tests against the composed services from the host or from a test runner container. Always clean up with
Testing
Flaky tests that pass locally but fail in CI. Tests that corrupt shared state and cause downstream failures. Debugging sessions that end with "works on my machine." These problems share a root cause: your tests are fighting over shared, mutable environments. Ephemeral test environments solve this by treating
Testing
Testcontainers starts real Docker containers in tests, replacing mocks and in-memory fakes. The basics — starting a single Postgres or Redis container — are covered in the official docs. The advanced features are what scale: multi-container networks, Docker Compose module integration, parallel test execution, custom wait strategies, and resource reuse
Trivy
Trivy is a fast, comprehensive open-source vulnerability scanner from Aqua Security that scans container images, filesystems, Git repositories, Kubernetes manifests, and IaC files. This guide covers local scanning, GitHub Actions integration, SBOM generation, and managing findings with .trivyignore. Key Takeaways Trivy scans more than just OS packages. It detects
Testing
Coolify has emerged as the leading self-hosted alternative to platforms like Heroku and Render. It runs on your own servers — a single Hetzner VPS, a bare-metal box, or a small cluster — and gives you Heroku-style deployment workflows without the per-seat pricing or data sovereignty concerns. For
Testing
Every system call a container makes is an attack surface. seccomp (Secure Computing Mode) lets you define exactly which syscalls a container is allowed to make — and kill or log anything outside that list. The challenge is writing profiles that are tight enough to restrict attacker behavior but permissive enough
Testing
MailHog is an open-source local SMTP server that captures all outgoing emails and exposes them via a web UI and HTTP API. No signups, no internet connection required, and no risk of emails reaching real users. This guide covers running MailHog in Docker, asserting on captured emails via its
Chaos Engineering
Pumba is a chaos testing tool for Docker containers. It kills containers, pauses them, and injects network failures using Linux tc (traffic control) — directly on your Docker host or inside Docker Compose environments. If you run microservices locally with Docker Compose or test in Docker-based CI environments, Pumba is
Security Testing
Trivy is an open-source vulnerability scanner that covers container images (OS packages and application dependencies), Kubernetes manifests, Terraform, Dockerfiles, and secrets. It's fast, requires no setup beyond installation, and produces structured JSON or table output. Use Trivy in CI to block builds with critical vulnerabilities before they
Testing
Shipping a container image without testing it is like deploying code without running tests. The image might contain known CVEs in its base layer, misconfigured file permissions, unnecessary packages that expand your attack surface, or missing dependencies that cause runtime failures. All of these are detectable before the image ever
Integration Testing
Mocking database calls in Python tests creates a false sense of security. testcontainers-python spins up real PostgreSQL, Redis, and MongoDB containers via Docker during your pytest run, giving you genuine integration coverage without managing external services. Key Takeaways testcontainers-python integrates with pytest through fixtures. Define containers in conftest.