Selfhosted

41798 readers

788 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

How do you host your container services? (sh.itjust.works)

submitted 2 years ago by Jerry1098@sh.itjust.works to c/selfhosted@lemmy.world

7 comments fedilink hide all child comments

Do you host all services just from your root account with docker or do you seperate the services between user accounts with rootless docker?

Do you use podman or docker?

It's easier to just host everything from root with normal docker, but seperating services into special user account is probably way saver, at least as far as i know. Do you think ist worth going the extra step or do you just trust docker and your containers to not get exploited?

Last but not least do you use an automatic update service for your host system and your containers?

top 7 comments

sorted by: hot top controversial new old

[–] ShittyKopper@lemmy.w.on-t.work 1 points 2 years ago* (last edited 2 years ago)

Rootful Podman & podman-compose. Waiting on the version of Podman that supports passt to hit Debian Bookworm or backports to attempt rootless. Deployed with Ansible except a few manual parts like creating the Postgres databases themselves.

No auto updates or notifications so far, as there seems to be a couple incompatibility issues left with Watchtower & Podman. Although since I switched CrowdSec to monitor journald instead of the Podman socket I don't really have a reason to keep the daemon running, and I think that's for the best.

[–] tupcakes@lemmy.world 1 points 2 years ago

Nomad, consul, and gluster. Not as easy as a simple docker compose, but definitely not as annoying as kubernetes.

[–] witten@lemmy.world 1 points 2 years ago (1 children)

I use rootless Podman, because security. A container breakout exploit will only impact that one Unix user. Plus no Docker daemon to worry about.

I don't seperate services into separate users, although maybe I should. The main impediment with separation is that you give up the conveniences of container networking / container DNS and have to connect everything on the host instead. I don't know if that's even possible (conveniently) with a service like Traefik that's supposed to introspect running containers. Also, with separation by Unix user, there's not one convenient place to SSH in and run podman ps or docker ps to see all containers. Maybe not a big deal?

Auto-update of containers: No, I don't, because updates somtimes break things and I want to be there in case something goes wrong. The one exception is I auto-update the containers I develop myself as the last implicit deployment step of a CI pipeline.

[–] oranki@sopuli.xyz 1 points 2 years ago

+1 for rootless Podman. Kubernetes YAMLs to define pods, which are started/controlled by systemd. SELinux for added security.

Also +1 for not using auto updates. Using the latest tag has bit me more times I can count, now I only use it for testing new stuff. All the important services have at least the major version as tag.

[–] sunbeam60@lemmy.one 1 points 2 years ago

Docker and a Synology NAS. Everything is accessed though a wireguard VPN.

[–] hitagi@ani.social 1 points 2 years ago

I use rootless docker and dump everything in the home directory. I do manual updates and receive weekly email notifications via newreleases.io

[–] supersheep@lemmy.world 0 points 2 years ago

Currently, I’m just using my root account with Docker and update everything manually. I have dockcheck-web installed to check whether any updates are available (https://github.com/Palleri/DCW). From the outside everything is only accessible using Wireguard and connections have to go through a Caddy proxy in order to reach a container. Curious what other peoples setup is.