this post was submitted on 15 Jul 2025
33 points (94.6% liked)

Selfhosted

49627 readers
429 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
CannaVet@lemmy.world
Loki@lemmy.world
HybridSarcasm@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
33
Dedicated service user or not ? (jlai.lu)
submitted 6 days ago by mat@jlai.lu to c/selfhosted@lemmy.world
18 comments fedilink hide all child comments
 

Hi all !

As of today, I am running my services with rootless podman pods and containers. Each functional stack gets its dedicated user (user cloud runs a pod with nextcloud-fpm, nginx, postgresql...) with user mapping. Now, my thought were that if an attack can escape a container, it should be contained to a specific user.

Is it really meaningful ? With service users' home setup in /var/lib, it makes a lot of small stuff annoying and I wonder if the current setup is really worth it ?

you are viewing a single comment's thread
view the rest of the comments
[–] jlh@lemmy.jlh.name 0 points 5 days ago (2 children)

It's not going to make a meaningful difference in your threat model and it will cause a lot of hassle for extra configuration and broken docker images, so I wouldn't bother.

There is some nice tooling for transparent user name spaces coming down the pipeline in Kubernetes which will be a nice 0-effort security upgrade, but if you don't have the tooling, I would say it's not worth it.

https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/

[–] Mubelotix@jlai.lu 1 points 3 days ago

Unfortunately it's right that containers break. Mastodon for instance will not run under a non priviledged user

[–] mat@jlai.lu 1 points 5 days ago (1 children)

I guess I will try with a k3s on my workstation, but for a single NAS, I am not sure any kubernetes distribution is useful for now :)

[–] jlh@lemmy.jlh.name 0 points 5 days ago

Kubernetes is great for single nodes! It definitely is more advanced than docker compose, but it's actually not hard at all if you read through the documentation. It definitely makes running containers easier in the long run.

Here is my git repo for my big Kubernetes cluster at home: https://codeberg.org/jlh/h5b/src/branch/main/argo/custom_applications

It started out as just a NFS server and a Kubernetes server running on Proxmox in 2021.