I run an Angie-based WebDAV container for uploading media to directories used by services such as Jellyfin and Navidrome. The container creates its web-server user and group with the UID and GID of a host user. I built two containers from essentially the same Dockerfile and configuration, changing only ports, UID/GID values, and storage paths.
The first container responds to a simple directory refresh, which generates a PROPFIND request, almost instantly. The second takes about five seconds and briefly uses nearly two CPU cores, even though nothing is being uploaded, downloaded, or modified. Both containers run on the same host and have similar memory usage and process counts:
```text
NAME CPU % MEM USAGE
upload.service1.example.com 33.03% 34.96MiB
upload.service2.example.com 199.08% 34.38MiB
```
What could cause two otherwise identical containers to behave so differently?
2 Answers
Before finding the cause, it would be worth verifying the behavior across repeated requests rather than relying on a single `docker stats` snapshot. Check the request and authentication logs, compare the exact mounted paths and permissions, and inspect the container processes while the slow PROPFIND is running. CPU percentages can vary with timing and traffic, but consistent slowness for the same request points to a configuration difference rather than Docker itself.
The difference was the cost setting for HTTP Basic Authentication. Both services used bcrypt password hashes in an htpasswd file, but the first used `htpasswd -B -C 7`, while the second used `htpasswd -B -C 17`. The cost-17 setting is the maximum and makes each password verification dramatically more computationally expensive. Since authentication runs on every request, even a simple PROPFIND can consume substantial CPU and take several seconds. Lowering the bcrypt cost to a more reasonable value made the second container responsive again.
The request was consistently slow, and the actual difference turned out to be the bcrypt cost in the htpasswd files. The container with cost 17 was recomputing a very expensive password hash for every authenticated request.