Known limitations
Current user-visible limitations and unsupported combinations.
Check these limits before choosing a setup. See supported features for the full runtime comparison.
| Area | Limitation |
|---|---|
| Docker Swarm | Shared volumes and ingress state use one NFS storage node. Routes using the local CA are not available on Swarm. See multi-node Swarm. |
| Bind mounts | Local development bind mounts are supported by Podman Compose and Docker Compose only, not Swarm or remote targets. |
| Volume files | Atomic mutation of files in owned volumes is unavailable on Swarm. |
| Remote commands | Status, logs, and reviewed deployments use the SSH daemon. Remote exec has no stdin, TTY, or interactive shell support. |
| AI agents | A remote host enforces an agent's limits. On your own machine they are a guardrail: an agent with an unrestricted shell can run the container engine itself. mm_exec output is not redacted. See agents. |
| Compose secrets | Docker Compose has no native persistent secret store. Delivery uses a private operation file; non-default UID/GID/mode and unreconstructable rollback are rejected. |
| Job secrets | Compose jobs reuse their service's environment and secret mounts. Swarm jobs are unsupported. Build secrets use a separate BuildKit path. |
| Local services | Ingress, dashboard, Mailpit, and access-gate components require HAProxy with Linux systemd, or macOS with Docker Desktop and Docker Compose. Other macOS engines such as Colima, Windows, and remote/clustered service orchestration are not supported. On macOS, launchd agents start at login, so local HTTPS is unavailable while you are logged out. |
| Managed secret backends | OpenBao and Vault can run locally with Docker Compose or rootless Podman Compose. Managed Swarm and remote lifecycle operations are unsupported. These are development setups, not production high-availability services. |
| Local TLS | Fedora/RHEL trust support has no dedicated live runner. Unknown trust-store layouts fail closed. |
| Non-Unix private files | Unix-equivalent owner-only permission enforcement is unavailable, so features requiring that guarantee fail closed. |
mm reports unsupported combinations before applying a change.