this post was submitted on 05 Aug 2024
49 points (96.2% liked)

Selfhosted

40329 readers
395 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
 

Before I dabbled a bit with Docker. I wanted to dabble a bit with Podman because it seemed quite interesting. I reinstalled Pi OS Lite on my Pi 3B+ and installed Podman. Then I figured out what to run and started digging through the documentation. Apparently Docker containers work quite similar and even Docker compose can be used. Then I came across the auto update function and stumbled upon quadlets to use auto update and got confused. Then I tried reading up on Podman rootless and rootful and networking stuff and really got lost.

I want to run the following services:

  • Heimdall
  • Adguard Home
  • Jellyfin
  • Vaultwarden
  • Nextcloud

I am not sure a Pi is even powerful enough to run these things but I am even more unsure about how to set things up. Do I use quadlets? Do I run containers? How do I do the networking so I can reach the containers (maybe even outside my home)?

Can someone point me in the right direction? I can't seem to find the needed information.

all 38 comments
sorted by: hot top controversial new old
[–] Nibodhika@lemmy.world 12 points 3 months ago (2 children)

Use docker, once you're comfortable with it then switch to Podman. Podman has a few more complications, so it's easier to get the base thing running using the most common tool, and work from there.

[–] tmpod@lemmy.pt 2 points 3 months ago

This is a good suggestion. Docker is more mature and has more resources, so it's better to learn the ins and outs of containers. After getting comfortable with it, you can move to Podman and have a much better time tackling its peculiarities regarding permissions and rootless.

I used Docker for years and only recently decided to give Podman a try, porting my Lemmy instance to it.

[–] MightyCuriosity@sh.itjust.works 1 points 3 months ago

Yeah this might be the smartest way. I thought I could do both at the same time but it's probably more than I can chew.

[–] PrivateNoob@sopuli.xyz 10 points 3 months ago* (last edited 3 months ago)

I'm a pretty Podman novice guy too but I'm running quadlets since it automatically creates and runs these containers just like the other services would be with systemd. In terms of networking I can usually access to my container via publishing a port and using the PC's IP where the container is running, and this is the default network that Podman uses initially.

I have a Jellyfin quadlet config, that may help you. I've had numerous sufferings to make a working one, but here you go (These 3 files are in ~/.config/containers/systemd/jellyfin):

Description=Jellyfin Media Server
After=network.target

[Container]
Image=lscr.io/linuxserver/jellyfin:latest
PublishPort=8096:8096
Volume=jellyfin-config.volume:/config:Z
Volume=jellyfin-cache:/cache:Z
Volume=/home/USERNAME/media/storage1/Filmek:/data/Filmek:Z,U
Volume=/home/USERNAME/media/storage1/Sorozatok:/data/Sorozatok:Z,U

[Service]
Restart=on-failure

[Install]
WantedBy=default.target
[Unit]
Description=Jellyfin Cache Volume

[Volume]
[Unit]
Description=Jellyfin Config Volume

[Volume]

Please do ask questions if you have any. ^^

[–] tekeous@usenet.lol 8 points 3 months ago* (last edited 3 months ago) (2 children)

Podman is quickly becoming shit as Red Hat continues to remove features and recommend you use Kubernetes. I ended up removing it from my servers and switching to Debian from Fedora because I don’t like Red Hat mucking about with our open source community software.

I still run Docker.

[–] KLISHDFSDF@lemmy.ml 24 points 3 months ago (1 children)

As someone who's been wanting to test (and maybe move to Podman) in the future but hasn't really spent any time on it, what features have Red hat removed from Podman?

[–] tekeous@usenet.lol -1 points 3 months ago (5 children)

My major beef is we used to be able to run a Podman generate command to make a user systemd file and auto start and stop containers with that. Even entire clusters of pods with one easy command and then just use the system level start and stop. They removed it in favor of “quadlet”which works fine for single containers, but for a compose, they literally just use Kubernetes syntax and the official documentation says just use Kubernetes. Well, what the fuck is Podman for then?

The biggest problem everyone ever has with Podman is it’s frustratingly obedient to SELinux. Docker just kind of makes its own permissions and opens its own ports and steamrolls past whatever security you have. Podman will refuse to read or write a directory for stupid reasons until you’ve gone round and round with SELinux, and then just when you have it working, when the container updates it locks the directory all over again(in my case, updating a Minecraft server to latest version would crash the server and lock the data directory). Red Hat continues to insist SELinux is cool and this is working as intended. Again, Docker just doesn’t give a shit and barges into the directory without a problem.

[–] poVoq@slrpnk.net 16 points 3 months ago* (last edited 3 months ago)

There are .pod files for Quadlet now, which do what you want. No Kubernetes involved.

My impression is really the opposite. Podman is constantly being improved and nice features get added all the time.

If you don't like SELinux, just disable it. Nothing to do with Podman.

[–] Findmysec@infosec.pub 7 points 3 months ago

Now look here chap, Quadlet admittedly works fine. I personally just k3s anyway but .pod files work too.

Isn't being obedient to SELinux a good thing? You could set it to permissive if you want, but MAC systems are essential for security and I personally wouldn't go without them

[–] nottelling@lemmy.world 2 points 3 months ago

Every complaint here is PEBKAC.

It's a legit argument that Docker has a stable architecture while podman is still evolving, but that's how software do. I haven't seen anything that isn't backward compatible, or very strongly deprecated with notice.

Complaining about selinux in 2024? Setenforce 0, audit2allow, and get on with it.

Docker doing that while selinux is enforcing is an actual bad thing that you don't want.

[–] possiblylinux127@lemmy.zip 1 points 3 months ago

SElinux is needed for a secure system. It takes time to properly set up but it adheres to least privilege nicely

[–] PrivateNoob@sopuli.xyz 1 points 3 months ago

Well that can be understandable, but AFAIK podman generate still works, so if you can't do something with Quadlet, then you can stays with generate until then. For example, I'm using Quadlet and now podman generate too since my Rocky 9 podman can't be upgraded to podman 5 which means no pod support for you.

[–] possiblylinux127@lemmy.zip 1 points 3 months ago (1 children)

For those who are out of the loop, why is podman shit? It is rootless and crazy fast.

[–] nottelling@lemmy.world 0 points 3 months ago (1 children)

It isn't. It's architecture changes pretty significantly with each version, which is annoying when you need it to be stable. It's also dominated by Redhat, which is a legit concern since they'll likely start paywalling capabilities eventually.

[–] possiblylinux127@lemmy.zip 1 points 3 months ago* (last edited 3 months ago) (1 children)

I have never seen any of those things. Podman is fast and rootless with almost no overhead. It has good compatibility with docker as well.

Also it would make zero sense to paywall podman as Kubernetes exists. Anyway RHEL is payed anyway.

[–] nottelling@lemmy.world -1 points 3 months ago

Just cause you've never seen them doesn't make it not true.

Try using quadlet and a .container file on current Debian stable. It doesn't work. Architecture changed, quadlet is now recommended.

Try setting device permissions in the container after updating to Debian testing. Also doesn't work the same way. Architecture changed.

Redhat hasn't ruined it yet, but Ansible should provide a pretty good idea of the potential trajectory.

[–] akash_rawal@lemmy.world 6 points 3 months ago

For me the value of podman is how easily it works without root. Just install and run, no need for sudo or adding myself to docker group.

I use it for testing and dev work, not for running any services.

[–] elephantium@lemmy.world 6 points 3 months ago (1 children)

I use podman at work, mostly just a Docker replacement. My biggest problem with it is typing "pdoman" in commands by mistake.

[–] thesmokingman@programming.dev 7 points 3 months ago (1 children)

Just alias pdoman=podman. I do that with all my common typos.

[–] onlinepersona@programming.dev 5 points 3 months ago (1 children)
[–] kaotic@lemmy.world 3 points 3 months ago

It’s crazy how much I actually use this tool. 99% of the time, it can figure out exactly what I was trying to accomplish.

[–] exu@feditown.com 5 points 3 months ago (1 children)

I use podman mainly because it's very easy to manage using systemd services. Unfortunately, the command for generating these service files, podman-generate, is deprecated and won't receive new features.

Auto updating is done just using a simple tag and enabling a systemd timer to do it regularly for you.

It's easiest to start with the rootful mode, you won't have additional settings to set and no issues with permissions, UIDs and networking.

For networking, I always create a network per service I want to run. For example Nextcloud and its database would go in one network and you'd only forward the port for the webinterface for outside access.

In addition to networks I also use pods, this basically groups the containers together to start/stop them as one. If you use this, you have to set your port forwarding here.

[–] poVoq@slrpnk.net 5 points 3 months ago* (last edited 3 months ago) (1 children)

Podman-generate was replaced by Quadlet .container files, which works better.

And a Pod also has it's own virtual network, why manually create one?

[–] exu@feditown.com 2 points 3 months ago

I haven't taken the time yet to switch my Ansible playbooks to Quadlet, so can't comment on that.

I only skimmed the manpages, thanks for the info.

[–] possiblylinux127@lemmy.zip 4 points 3 months ago* (last edited 3 months ago)

The pi 3B+ is not powerful enough for all that. I would get a used minipc as even a old one will run circles around the old Broadcom CPU.

Podman is similar to docker except for the fact that it is daemonless and rootless by default. To expose things on lower ports you will need to battle permissions. Also podman has pods like kubernetes.

[–] Decronym@lemmy.decronym.xyz 4 points 3 months ago* (last edited 3 months ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
IP Internet Protocol
UDP User Datagram Protocol, for real-time communications
VPN Virtual Private Network

3 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #908 for this sub, first seen 6th Aug 2024, 12:35] [FAQ] [Full list] [Contact] [Source code]

[–] lavafroth@lemmy.dbzer0.com 2 points 3 months ago

Not related to containers but I've had quite a lot of success using NixOS as the host OS. Setting up services like jellyfin is as simple as adding services.jellyfin.enable = true; to the config file.

[–] chevy9294@monero.town -1 points 3 months ago (2 children)

I switched from Docker to Podman, because Podman is more secure (if rootless) but it was just hard to autostart containars. You have to start one by one because they don't have a central service like docker. And watchtower and nextcloud AIO don't work on Podman. So I switched back to docker.

[–] poVoq@slrpnk.net 7 points 3 months ago (1 children)

Its actually much easier to autostart containers with Podman, as it has full Systemd integration, so you can handle them like any other service. All you need to do is write a simple .container file for the Podman built-in Quadlet service, which closely follows the normal Systemd .service file syntax.

[–] chevy9294@monero.town 1 points 3 months ago (1 children)

Yes but you have to do that for each service if I understand correctly.

[–] poVoq@slrpnk.net 2 points 3 months ago

Only once during the initial setup, afterwards its all managed by Systemd. Once you know about it, it takes like one minute max.?

[–] ryannathans@aussie.zone 2 points 3 months ago

You create a pod and bring the pod up

[–] TheBigBrother@lemmy.world -5 points 3 months ago

My humble POV it's to stick with whatever do the work.