Selfhosted

61236 readers

214 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

334

my homeserver mapped (feddit.nl)

submitted 3 months ago by blinfabian@feddit.nl to c/selfhosted@lemmy.world

50 comments fedilink hide all child comments

i love selfhosting :3

you are viewing a single comment's thread
view the rest of the comments

[–] kureta@lemmy.ml 5 points 3 months ago* (last edited 3 months ago) (2 children)

Am I doing something wrong? All my services are grouped in docker compose files. Containers that have to communicate internally - a server and it's db for example - are on their own private docker network. A reverse proxy has its ports 80 and 443 open and it is on an external docker network. Services that I need to access from the outside are on this network and they do not have any ports open. Except for the torrent client, which has a UDP port open.

[–] jimerson@lemmy.world 4 points 3 months ago (2 children)

It's strong, but splitting services into separate VMs is stronger than just using separate docker containers. This is especially true for the torrent client.

I'm not a netsec professional, this is just my understanding of best practices.

[–] Fmstrat@lemmy.world 2 points 3 months ago

Soooo this is not really true unless you don't trust your kernel. While a VM is more isolated from the host, since a container shares kernel space, that doesn't make it less secure. I.E. isolation does not equal security.

Actual sandbox escape vulnerabilities happen in VMs as frequently as they do in Docker, and while all VMs have a full systems that many exfiltrations can hit (due to a full suite of services running), many docker containers are locked to a user space with only one process running.

@kureta@lemmy.ml if you are running separate Docker networks in compose, I would not recommend switching to VMs. If that kind of isolation is a requirement, add another server and use different SSH keys for it.

[–] kureta@lemmy.ml 2 points 3 months ago (1 children)

I am also just a hobbyist, so that was a genuine question. Thanks for the answer.

[–] jimerson@lemmy.world 2 points 3 months ago

Same here! Good luck with your setup!!

[–] jol@discuss.tchncs.de 2 points 3 months ago

Same. One single docker compose, and a dozen images. I get to take advantage of publicly available docker images too which makes managing and updating things a breeze.