A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (donβt cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Are you using docker compose scripts? Backup should be easy, you have your compose scripts to configure the containers, then the scripts can easily be commited somewhere or backed up.
Data should be volume mounted into the container, and then the host disk can be backed up.
The only app that I've had to fight docker on is Seafile, and even that works quite well now.
using docker compose yeah. I find hard to tweak the network and the apps settings it's like putting obstacles on my road
Its networking is a bit hard to tweak, but I also dont find I need to most of the time. And when I do, its usually just setting the network to host and calling it done.
Docker as a technology is a misguided mess but it is an effective tool.
Podman is a much better design that solves the same problem.
Containers can be used well or very poorly.
Docker makes it easy to ship something without knowing anything about System Engineering which some see as an advantage, but I don't.
At my shop, we use almost no public container images because they tend to be a security nightmare.
We build our own images in-house with strict rules about what can go inside. Otherwise it would be absolute chaos.
I use podman using home-manager configs, I could run the services natively but currently I have a user for each service that runs the podman containers. This way each service is securely isolated from each other and the rest of the system. Maybe if/when NixOS supports good selinux rules I'll switch back to running it native.
I can recommend NixOS. It's quite simple if your wanted application is part of NixOS already. Otherwise it requires quite some knowledge to get it to work anyways.
One day I will try, this project seems interesting!
I love docker, and backups are a breeze if you're using ZFS or BTRFS with volume sending. That is the bummer about docker, it relies on you to back it up instead of having its native backup system.
What are you hosting on docker? Are you configuring your apps after? Did you used the prebuild images or build yourself?
I use the *arr suite, a project zomboid server, a foundry vtt server, invoice ninja, immich, next cloud, qbittorrent, and caddy.
I pretty much only use prebuilt images, I run them like appliances. Anything custom I'd run in a vm with snapshots as my docker skills do not run that deep.
I should also say I use portainer for some graphical hand holding. And I run watchtower for updates (although portainer can monitor GitHub's and run updates based on monitored merged).
For simplicity I create all my volumes in the portainer gui, then specify the mount points in the docker compose (portainer calls this a stack for some reason).
The volumes are looped into the base OS (Truenas scale) zfs snapshots. Any restoration is dead simple. It keeps 1x yearly, 3x monthly, 4x weekly, and 1x daily snapshot.
All media etc.. is mounted via NFS shares (for applications like immich or plex).
Restoration to a new machine should be as simple as pasting the compose, restoring and restoring the Portainer volumes.
I like reminding people that with every new technology, the old one is still around. The new gets most of the attention, but the old is still kicking. (We still have wire wrapped programs kicking around.)
You are all good. Spend your limited attention on other things.
Docker is good when combined with gVisor runtime for better isolation.
What is gVisor?
gVisor is an application kernel, written in memory safe Golang, that emulates most system calls and massively reduces the attack surface of the kernel. This is important since the host and guest share the same kernel, and Docker runs rootful. Root inside a Docker container is the same as root on the host, as long as a sandbox escape is used. This could arise if a container image requires unsafe permissions like Docker socket access. gVisor protects against privilege escalation by only using root at the start and never handing root over to the guest.
Sydbox OCI runtime is also cool and faster than gVisor (both are quick)
Yeah, when I got started I initially put everything in Docker because that's what I was recommended to do, but after a couple years I moved everything out again because of the increased complexity, especially in terms of the networking, and that you now have to deal with the way Docker does things, and I'm not getting anything out of it that would make up for that.
When I moved it out back then I was running Gentoo on my servers, by now it's NixOS because of the declarative service configuration, which shines especially in a server environment. If you want easy service setup, like people usually say they like about Docker, I think it's definitely worth a try. It can be as simple as "services.foo.enable = true".
(To be fair NixOS has complexity too, but most of it is in learning how the configuration language which builds your operating system works, and not in the actual system itself, which is mostly standard except for the store. A NixOS service module generates a normal systemd service + potentially other files in the file system.)
nixos definitely gives a try
I ditched nix and install software only through portage. If needed, i make my own ebuilds.
This has two advantages:
I donβt like docker. Itβs hard to update containers, hard to modify specific settings, hard to configure network settings, just overall for me Iβve had a bad experience. Itβs fantastic for quickly spinning things up but for long term usecase and customizing it to work well with all my services, I find it lacking.
I just create Debian containers or VMs for my different services using Proxmox. I have full control over all settings that I didnβt have in docker.
What do you mean it's hard to update containers?
For real. Map persistent data out and then just docker compose pull && up. Theres nothing to it. Regular backups make reverting to previous container versions a breeze
Use portainer + watchtower
the old good way is not that bad