336
my homeserver mapped (thelemmy.club)
submitted 5 months ago by to c/selfhosted@lemmy.world
50 comments fedilink hide all child comments
 

i love selfhosting :3

Proxmox: Debian Container 1: Pihole blocking more than 2.6M domains Debian Container 2: Docker containers: traefik, Joplin Server and Homarr. Traefik connects to Cloudflare and mijndomein Debian Container 3: Docker container: Jellyfin containing three folders for media TrueNAS CE VM: Two Drives configured with RAID and Nextcloud (+Memories)
you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 5 months ago (7 children)

Security is the first thing that comes to mind. Compartmentalization prevents or at least makes it considerably harder for compromised services to screw up all the others.

Another thing would be that it might be easier to manage backups and snapshots.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 5 points 5 months ago (6 children)

    From my understanding, it's helpful that each VM will have its own IP so ports can be opened only on specific VMs, increasing overall security.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 5 points 5 months ago* (last edited 5 months ago) (5 children)

    Am I doing something wrong? All my services are grouped in docker compose files. Containers that have to communicate internally - a server and it's db for example - are on their own private docker network. A reverse proxy has its ports 80 and 443 open and it is on an external docker network. Services that I need to access from the outside are on this network and they do not have any ports open. Except for the torrent client, which has a UDP port open.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 5 months ago (3 children)

    It's strong, but splitting services into separate VMs is stronger than just using separate docker containers. This is especially true for the torrent client.

    I'm not a netsec professional, this is just my understanding of best practices.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 5 months ago

    Soooo this is not really true unless you don't trust your kernel. While a VM is more isolated from the host, since a container shares kernel space, that doesn't make it less secure. I.E. isolation does not equal security.

    Actual sandbox escape vulnerabilities happen in VMs as frequently as they do in Docker, and while all VMs have a full systems that many exfiltrations can hit (due to a full suite of services running), many docker containers are locked to a user space with only one process running.

    @kureta@lemmy.ml if you are running separate Docker networks in compose, I would not recommend switching to VMs. If that kind of isolation is a requirement, add another server and use different SSH keys for it.

  • permalink
  • fedilink
  • source
  • parent