I love docker, and backups are a breeze if you're using ZFS or BTRFS with volume sending. That is the bummer about docker, it relies on you to back it up instead of having its native backup system.
this post was submitted on 12 Dec 2024
45 points (81.7% liked)
Selfhosted
40645 readers
297 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (donβt cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
What are you hosting on docker? Are you configuring your apps after? Did you used the prebuild images or build yourself?
I use the *arr suite, a project zomboid server, a foundry vtt server, invoice ninja, immich, next cloud, qbittorrent, and caddy.
I pretty much only use prebuilt images, I run them like appliances. Anything custom I'd run in a vm with snapshots as my docker skills do not run that deep.
This why I don't get anything from using docker I want to tweak my configuration and docker is adding an extra level of complexity
What application are you trying to tweak?
load more comments
(2 replies)
I should also say I use portainer for some graphical hand holding. And I run watchtower for updates (although portainer can monitor GitHub's and run updates based on monitored merged).
For simplicity I create all my volumes in the portainer gui, then specify the mount points in the docker compose (portainer calls this a stack for some reason).
The volumes are looped into the base OS (Truenas scale) zfs snapshots. Any restoration is dead simple. It keeps 1x yearly, 3x monthly, 4x weekly, and 1x daily snapshot.
All media etc.. is mounted via NFS shares (for applications like immich or plex).
Restoration to a new machine should be as simple as pasting the compose, restoring and restoring the Portainer volumes.
I don't really like portainer, first their business model is not that good and second they are doing strange things with the compose files
load more comments
(1 replies)
Docker is good when combined with gVisor runtime for better isolation.
What is gVisor?
gVisor is an application kernel, written in memory safe Golang, that emulates most system calls and massively reduces the attack surface of the kernel. This is important since the host and guest share the same kernel, and Docker runs rootful. Root inside a Docker container is the same as root on the host, as long as a sandbox escape is used. This could arise if a container image requires unsafe permissions like Docker socket access. gVisor protects against privilege escalation by only using root at the start and never handing root over to the guest.
Sydbox OCI runtime is also cool and faster than gVisor (both are quick)
I like reminding people that with every new technology, the old one is still around. The new gets most of the attention, but the old is still kicking. (We still have wire wrapped programs kicking around.)
You are all good. Spend your limited attention on other things.
Yeah, when I got started I initially put everything in Docker because that's what I was recommended to do, but after a couple years I moved everything out again because of the increased complexity, especially in terms of the networking, and that you now have to deal with the way Docker does things, and I'm not getting anything out of it that would make up for that.
When I moved it out back then I was running Gentoo on my servers, by now it's NixOS because of the declarative service configuration, which shines especially in a server environment. If you want easy service setup, like people usually say they like about Docker, I think it's definitely worth a try. It can be as simple as "services.foo.enable = true".
(To be fair NixOS has complexity too, but most of it is in learning how the configuration language which builds your operating system works, and not in the actual system itself, which is mostly standard except for the store. A NixOS service module generates a normal systemd service + potentially other files in the file system.)
nixos definitely gives a try
I ditched nix and install software only through portage. If needed, i make my own ebuilds.
This has two advantages:
- it removes all the messy software: i am not going to install something if I can't make the ebuild becayse the development was a mess , like everything TS/node
- i can install, rollback, reinstall, upgrad and provision (configuration) everything using portage
- i am getting to know gentoo and portage in great details, making the use of my desktop and laptop much much easier
I donβt like docker. Itβs hard to update containers, hard to modify specific settings, hard to configure network settings, just overall for me Iβve had a bad experience. Itβs fantastic for quickly spinning things up but for long term usecase and customizing it to work well with all my services, I find it lacking.
I just create Debian containers or VMs for my different services using Proxmox. I have full control over all settings that I didnβt have in docker.