Selfhosted

60426 readers

401 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Dedicated service user or not ? (jlai.lu)

submitted 11 months ago by mat@jlai.lu to c/selfhosted@lemmy.world

18 comments fedilink hide all child comments

Hi all !

As of today, I am running my services with rootless podman pods and containers. Each functional stack gets its dedicated user (user cloud runs a pod with nextcloud-fpm, nginx, postgresql...) with user mapping. Now, my thought were that if an attack can escape a container, it should be contained to a specific user.

Is it really meaningful ? With service users' home setup in /var/lib, it makes a lot of small stuff annoying and I wonder if the current setup is really worth it ?

you are viewing a single comment's thread
view the rest of the comments

[–] fishinthecalculator@lemmy.ml 2 points 11 months ago (1 children)

Companies do run multiple containers/pods on the same host. That is what Kubernetes does

[–] sugar_in_your_tea@sh.itjust.works 0 points 11 months ago

Sure, but those will usually be pieces of an app on the same host, not whole apps. Like for an inventory management app, you might have the auth server and its database on one host, the CRUD app and its database on another, and the report server, its database, and a replica of the CRUD db on another. And I use the term "host" broadly enough to include VMs on the same physical hardware. And these hosts will have restricted communication between each other.

At least, that's how I've seen it done.

Self-hosters will generally run multiple full apps on one host. It's a different setup.