• 0 Posts
  • 111 Comments
Joined 2 years ago
cake
Cake day: July 29th, 2023

help-circle
  • mlg@lemmy.worldtoSelfhosted@lemmy.worldDocker security
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    1 month ago

    How I sleep knowing Fedora + podman actually uses safe firewalld zones out of box instead of expecting the user to hack around with the clown show that is ufw.

    I could be wrong here but I feel like the answer is in the docs itself:

    If you are running Docker with the iptables or ip6tables options set to true, and firewalld is enabled on your system, in addition to its usual iptables or nftables rules, Docker creates a firewalld zone called docker, with target ACCEPT.

    All bridge network interfaces created by Docker (for example, docker0) are inserted into the docker zone.

    Docker also creates a forwarding policy called docker-forwarding that allows forwarding from ANY zone to the docker zone.

    Modify the zone to your security needs? Or does Docker reset the zone rules ever startup? If this is the same as podman, the docker zone should actually accept traffic from your public zone which has your physical NIC, which would mean you don’t have to do anything since public default is to DROP.






  • Ubuntu and Docker.

    Really? Netplan alone disqualifies Ubuntu as a “friendly stable starter distro”, and I can guarantee you that your guide will somehow become outdated with a single new Ubuntu release, or some poor soul who accidentally selected an LTS release.

    Docker doesn’t matter as much, but there’s a reason beyond just FOSS licensing why podman exists.

    Would highly recommend Debian instead.

    I started on Ubuntu similar to this many years ago and both the server and desktop experience was not fun at all.



  • A lot already have actually, writing was on the wall back when they dropped the version names which was also around the time a lot of the original Android hardware OEMs gave in which left us with carriers giving you the option between Samsung, Google, and Motorola.

    Then they abused Trump’s first term to ban Huawei for spyware since it was competing too well.

    The frontend UI sucks, the backend ART sucks, the process pausing system can’t hold most of your app views because reasons, Samsung removed OEM unlocking, Google has a stranglehold on decade old RCS with only google messages supporting such a protocol (wtf???), AOSP is functionally dead, Gapps has been eating the left side of your homepage for years, etc etc.

    I’m thinking about getting some handheld and making it into a PDA, like those upcoming DS-like consoles, and then maybe just get a pocket modem for phone/internet.



  • I kinda hate to agree with the other suggestions here, but entry level and even dedicated NAS products are pretty expensive for providing something you can very easily DIY for significantly cheaper even with the latest hardware.

    Was in a similar boat and just ended up taking an old HP desktop and added some cheap HDDs. I ended up playing around with proper Fedora for some LVM cache tricks and running some other services, but the common suggestion for this is SnapRAID and Nextcloud.



  • There’s more *arr tools that aren’t aggregator automation tools than there are aggregator automation tools.

    Also It was only funny when using an existing words like "sonar, “radar”, “lidar”. Jellyseerr is dumb, even Jackett was pushing it.

    I guess it makes it somewhat easier to associate them as part of a group of software, but now we have stuff like Homarr that is entirely unrelated, but still a useful tool.


  • mlg@lemmy.worldtoSelfhosted@lemmy.worldProxmox or Docker?
    link
    fedilink
    English
    arrow-up
    6
    ·
    4 months ago

    Proxmox or even just lazy old KVM GUI for anything that needs to be deployed manually in a VM (Home Assistant, WIndows VM, etc.). Otherwise you can even just spin up whatever manual service you want to run on an LXC container or bare metal host with the correct security settings with systemd and selinux if you want to be extra careful.

    Docker/Podman (the superior one lol) is just an automated deployment system in container form (like Ansible). It great for automated deployment without having to manually configure the installation process and worry about upgrades, changes, etc. You can even easily create your own images on the fly just for the purpose of having it run a single service inside a container.

    Proxmox equivalent would be like using Terraform/OpenTofu to deploy VMs to do the same thing. Its possible, but just not that common because of the reduced overhead with containers, and well supported deployment images with docker/podman specifically.

    Generally speaking, I’ve seen proxmox used more in lab environments were you want to emulate something like a complete network of machines whereas docker/podman has become the defacto server deployment platform.

    You’re just much more likely to find software with a published docker container and default docker compose script than the same thing in Terraform or even K8s/K3s.






  • Pentagon wasted tax money on facebook bots to convince people in East Asia that the chinese covid vaccine was poison, so no one is really buying the “China human rights abuses are what allow China to succeed” idea anymore.

    Especially since you can just as easily point to Japan’s infrastructure projects which achieved the same thing under US supervision post WWII, meaning said human rights violations aren’t even a supposed cost if there’s less evidence of it that of UAE literally pirating in immigrants to build their lavish towers and stadiums.

    Of which the US fully supports, so this just goes back to the blame game of who is worse.

    Yes, China has some shady ideas of what is considered acceptable behavior and work output from citizens, but the point is that they are using it to rapidly grow their infrastructure, unlike NA which take a decade for a single transit system to get approved all while car OEMs are pumping out dumpsterfire vehicles of whose parts are overwhelmingly made in China.



  • Kind of a lazy question, but are any of these protocols substantial over 802.11, especially if you just use p2p/adhoc/mesh modes?

    I haven’t touched mobile networks in a while so I’ve forgotten a lot, but iirc the main concern of mesh networks was efficient routing (which has been solved with some cool algorithms) and power efficiency for devices transmitting (again could have sworn 802.11 and even bluetooth can already achieve this).

    Zigby particularly stood out as annoying to me as it includes its own 2.4ghz physical layer stack which uses the same range as WiFI, which is already overcrowded as hell and relies on some CSMA/CA magic to make even the most apartment crowded area of APs function decently.