User accounts are a reasonable isolation mechanism for reasonably trustworthy server software.
this post was submitted on 26 Jun 2023
6 points (100.0% liked)
Selfhosted
40347 readers
332 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
Run everything in docker containers. Much easier to manage than virtual machines and lighter on resources.
In any case I wouldn't host on a machine I use daily (i.e. a personal computer). Worst case is an attacker wiping your machine or encrypting everything and holding your data hostage. If that happened to one of my servers I'd just shrug and reimage.
If performance is paramount or you have a low resource device like a rPi then containers are fine. If you have something with decent processing power I say go the extra mile and setup a simple VM using Qemu. A few distros offer cloud images so you don't have to install from an ISO.
Personally, I would prefer docker containers as I can move them to a new server or even create backups very easily.
Backups are easily done with virtual machines as well. Taking, moving and restoring such backups is in fact much easier than moving docker containers between hosts as you don't have to differentiate between volumes and locally mounted directories for example. That being said, depending on the use case, containers can be a nice and lightweight solution to separate applications on a userspace level
I have my Docker stuff in a VM. Much more reliable than bare metal OS
One thing I think about is isolation. Do you want/need to strongly isolate the software and its data from the host operating system?
You want so isolate the things you host from one another (security, making updates easier etc). So if you host just one thing you can do so on the host directly. If you host multiple services you may seek some separation method.
VMs is one method, but it wastes a lot of resources, especially RAM. A more elegant way is containers. Both the docker/podman route as well as the LXC way are quite polular.
I feel like putting it in a VM is probably overkill. I just have everything running in Docker containers and it's pretty good like that.
If you use a full VM you'll lose plenty of performance and I don't think it'll cope really well with domain names. If you really want to go the "keep everything separated" route use container software, like Docker. It'll use the same kernel as the host, so no weird networking rerouting/bridging etc.. I don't have any experience with containers, since I run all of my "homelab" bare metal on a Pi, and with this approach I never faced any issues. Containers could be useful if you were running something unorthodox like Gentoo and you need to run software that won't work on it, even if compiled to run, but it exist as a package on another distro. Then you can just spin up a container for that distro, install the software et voilà, you're ready to go. AFAIK there shouldn't be a package for lemmy on any distro, so just clone the source code and compile it, it should be fairly distro-agnostic. Maybe you could compile it in a container to keep your host clean of compile dependencies, but other than that, there's no real gain. I like to compile stuff, so having a shitload of dependencies already there is pretty handy for me, but for a production system, it's better to keep it clean.