docker Three Docker Networks, Fixed Subnets, One Reason: Firewall Rules That Don't Move frontend, socket, and backend are declared with fixed CIDR blocks on vmi2633427 for a reason that has nothing to do with routing and everything to do with what a firewall rule can trust.
docker Don't Give Your Reverse Proxy Root on the Host Traefik needs to know which containers exist and what labels they carry — it does not need exec, write, or image management. tecnativa/docker-socket-proxy is the difference between those two things.
traefik The TLS Handshake Nobody at Home Sees: Full vs Full-Strict Behind Cloudflare Traefik on vmi2633427 issues no certificates and holds no ACME credentials — the browser's cert and the origin's cert are two entirely different documents, and closing the gap between them is one flag in Cloudflare's dashboard.
