Auch bekannt als:

  • 0 Posts
  • 15 Comments
Joined 11 months ago
cake
Cake day: June 22nd, 2024

help-circle




  • There are different ways to run container. I run them via podman-systemd services. For me, the main benefits of running a container over an executable on the host system are the following:

    • not everything I want to self-host is packaged for my distro, but they all have container images available
    • operating system updates are independent from application updates, application updates are independent from each other. One broken dependency won’t kill my entire stack
    • all containers are running without root privileges and with restricted access to the host system. One vulnerable application won’t give access to my entire system
    • I can have all my config in one directory (~/.config/containers/systemd/), instead of having them across multiple /etc/* directories
    • volume bind mounts make it easy to declaratively mount any folder anywhere, so I can keep my directory structure how I like it
    • cockpit offers a great UI to visualize my hosted applications



  • To get a TLS certificate from Let’s Encrypt, they need to verify that you are in control of your domain. For regular domains, this can be done via HTTP, for wildcard certificates they require you to create a DNS record with a special token to verify ownership of the domain.

    This means that in order to automatically obtain a TLS certificate, caddy needs to interact with the API of your domain registrar to set up this record. Since there are many different providers, this isn’t built into caddy itself and you require a version that includes the corresponding caddy-dns module. Caddy modules need to compiled into the binary, so it’s not always trivial to set up (in my case I have a systemd timer that rebuilds a local container image whenever a new version of the docker.io/caddy:builder image is available).