@glizzyguzzler@piefed.blahaj.zone
glizzyguzzler
member since 20 Jun 2025 06:26
posts
comments
- on Why use Proxmox over Podman or Docker? in c/selfhosted@lemmy.world · 8h ago
-
on Where to start with setting up my own server? in c/selfhosted@lemmy.world · 4d ago
For distro I’d recommend God’s Chosen Stock Debian. You want prioritize smooth upgrade paths from one major version to another since the server should last a long ass time, and Debian is that. Debian has the eyes on it to make it chill and if there are things to do they’re caught and noted (and more often something is set up to just do it for you).
So no, distro doesn’t matter as long as you can get your software going. But you’re not going to beat the insane stability of Debian. Any OS based on it is just an echo, which may even involve custom kernels which add more work for the specific distro maintainers and may slow critical security updates.
I run no GUI but you can def have one. I just SSH in. I do everything in containers (Docker 1st and I’m moving to Podman - but Podman is too heavy a lift to start, Docker compose files are always right there, use em) and LXC containers run by Incus (it has a web gui as well!).
I’ve been looking at “games on whales” https://games-on-whales.github.io/ to stream games from a beefy server to weaker computers and tablets. Might be a good route for your games without having to directly game on the server.
I have a 4 core 7th gen Intel CPU and it seems fine with doing x265 transcoding on multiple streams, but I’ve never tried finding out how many 4K ones it can do at once. I have 32 GB of RAM (I bought cheapo laptop RAM before the true AI shitshow, praise be, stuck them in with a DIMM board cooked up by China). I had 16 before that, and it was fine. But I just kept adding services.
An LLM will eat your RAM, you’d want 32 GB to be able to run a 16 GB one. But a GPU will be much, much faster. LLMs are just matrix math - that’s why they’ll never be able to think for real - and GPUs are sicko good at that kinda math (cause screens are a matrix!). I don’t fuck with LLMs though, no ethics in that whole shitshow.
Good luck!
-
on spiderule in c/onehundredninetysix@lemmy.blahaj.zone · 6d ago
Valid, it’s why the fear is irrational 😔 no fear of mosquitoes though, it’s scorched earth for them (rational fear of west Nile)
-
on spiderule in c/onehundredninetysix@lemmy.blahaj.zone · 6d ago
(I am irrationally scared of spidoodlers)
-
on seepy weepy eepy sleepy. DAY 62 [OC, brainmde] in c/onehundredninetysix@lemmy.blahaj.zone · 12 Sep 2026
😔 I ain’t built for near the equator
-
on seepy weepy eepy sleepy. DAY 62 [OC, brainmde] in c/onehundredninetysix@lemmy.blahaj.zone · 11 Sep 2026
Do wonder what ambient temp do you need to be able to go full wrap and not die of heat stroke? Cause I abs cook with any amount of blanket at like 23.5C
-
on My Homelab Got Hacked - A Postmortem – Phunky Cafe in c/selfhosted@lemmy.world · 7 Sep 2026
The real takeaway is to run your containers ALL as read-only. There’s no way to run executables like this as read-only. They’d download to /tmp but not have executable access and womp womp.
Many things aren’t read-only friendly, but so far I’ve found all containers can be beat into read-only mode! (Heimdall is one of the worst, shout out to it)
-
on Podman: Issues with multiple users running containers simultaneously in c/selfhosted@lemmy.world · 5 Sep 2026
So the sudo echo does echo as sudo but doesn’t carry over? Makes sense damn I hate bash! Any way to keep the >>? Or do you need to tee? Cause the >> is pretty cool
-
on Podman: Issues with multiple users running containers simultaneously in c/selfhosted@lemmy.world · 5 Sep 2026
The best way to run Podman is root with UserNS to dole out UID/GID protection. Running Podman as root allows you to share networks between containers while having the containers run under different users. If you go rootless, you’d need to run under one user to share the user’s network space with all the containers you want.
As for your issue, I can’t really divine what the problem is from the errors. I avoid nginx because it’s coded to not play well with user abstraction and changing the user with the files it wants to write to etc. Gotta write into a ton of random folders! So not sure exactly what is up. But with Podman root it is easy to run as root
0internally and make nginx think it has all the control it could ever want.Try this setup (it is in Podman Quadlet format, apologies I don’t know the compose versions). It runs the container as root
0internally, externally it runs as some random UID/GID - secure! It uses Volumeidmapto map the internal root0user to1001for write access to the Volume.Note that in Debian 13 symlinks are broken and won’t work with
idmap, just point to the original source. If you need symlinks, I have an alternate UserNS that maps internal user root0to external user1001directly. You’d drop theidmapin Volume then and use that. You lose some extra security - now the container is running as external user1001instead of some random UID/GID - but that’s a pretty minor hit as long as your external user doesn’t have access to tons of things.# Volumes to mount -> the @ is essential for saying "1001 is absolute and external" basically. 0 is internal. size of 1. You can map 1001 to 0 and 1002 to 1 with @1001-0-2, etc., etc., etc. Volume=/mnt/something:/etc/nginx/wants/to/write/here:rw,noexec,nosuid,nodev,Z,idmap=uids=@1001-0-1;gids=@1001-0-1 # Run as user running the container UserNS=auto # [use this if req symlink b/c idmap does NOT work with symlinks] -> I tested and it is fixed in at least Podman v5.8.3, so Debian 14 will work with idmap and symlinks directly ! drop the idmap if using ! # UserNS=auto:uidmapping=0:@1001:1,gidmapping=0:@1001:1 # Security time NoNewPrivileges=true # https://man7.org/linux/man-pages/man7/capabilities.7.html DropCapability=all ReadOnly=true ReadOnlyTmpfs=True # These capabilities are needed for linuxserver's s6 "launcher" thing #AddCapability=CAP_CHOWN #AddCapability=CAP_DAC_OVERRIDE #AddCapability=CAP_FOWNER #AddCapability=CAP_SETGID #AddCapability=CAP_SETUID # Needs this if the container tries to bind below port 1024. I'm not sure if it is needed if it only tries to bind internally. #AddCapability=CAP_NET_BIND_SERVICE # TempFS for ReadOnly fixes I've used for nginx - may not be relevant for you. These are from getting Frigate running. PodmanArgs=--tmpfs /usr/local/nginx/conf:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/logs:size=40M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/client_body_temp:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/proxy_temp:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/fastcgi_temp:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/uwsgi_temp:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /usr/local/nginx/scgi_temp:size=1M,rw,noexec,nosuid,nodev PodmanArgs=--tmpfs /etc/letsencrypt:size=1M,rw,noexec,nosuid,nodevRoot Podman and UserNS=auto needs a
containersuser to pull uid/gid from.# Root Podman needs a `containers` "user" (not really a user, just a reserved uid/gid space) sudo echo "containers:2147483647:2147483648" >> /etc/subuid sudo echo "containers:2147483647:2147483648" >> /etc/subgidThe documentation for Podman is critically lacking in the “hobbyist” space. Hope this helps.
Edit: This approach works well because most Docker containers are built assuming they’ll run as root
0. That’s why Linuxserver uses the S6 overlay thing to jump from root0to something else. The container can be built to run as any user though, if you look at the Dockerfile for the container you’re using, you’ll see what user they’re declaring it will run as (and likely what user owns all the files). Root0usually gets around that problem - unless they “cleverly” code it to try to prevent you from running the container as root0(I’ve run into this before! It was Heimdall from the Linuxserver people).Edit2: I’ve noticed you said no Volumes, so drop that. But you can still use the UserNS mapping to run it as root internally which should fix the internal permissions issues. The tmpfs stuff is if you declare
ReadOnlyfor extra security - it’s a great idea - but nginx is extra difficult in that regard. Disregard it while you get going.# Run as user running the container UserNS=auto # Security time NoNewPrivileges=true # https://man7.org/linux/man-pages/man7/capabilities.7.html DropCapability=all # These capabilities are needed for linuxserver's s6 "launcher" thing #AddCapability=CAP_CHOWN #AddCapability=CAP_DAC_OVERRIDE #AddCapability=CAP_FOWNER #AddCapability=CAP_SETGID #AddCapability=CAP_SETUID # Needs this if the container tries to bind below port 1024. I'm not sure if it is needed if it only tries to bind internally. #AddCapability=CAP_NET_BIND_SERVICEEdit3: Use
sudo podman top nginx user huser group hgroup groups hgroupsto see the internal user/host user (huser) mappings easily for debug.USER HUSER GROUP HGROUP GROUPS HGROUPS root 2147485695 root 2147485695 105 105Here’s an output from my frigate container. Internally (USER) it is root, externally (HUSER) it’s some random UID. I’ve also mapped the internal group (GROUPS) 105 to the external group (HGROUPS) 105 so that it has render access.
-
on Eepy rule in c/onehundredninetysix@lemmy.blahaj.zone · 4 Sep 2026
Gotta get it extra firm
-
on Eepy rule in c/onehundredninetysix@lemmy.blahaj.zone · 3 Sep 2026
?? Why avoid when it gets you a cozy comfy pillow ??
-
on What 32-bit hardware are you still selfhosting on? in c/selfhosted@lemmy.world · 1 Sep 2026
I’ve got a pi zero w doing shairport-sync https://github.com/mikebrady/shairport-sync , which makes the pi pretend to be an AirPlay receiver. I combine it with the cheapest DAC I can get (used to be Adafruit before they ditched theirs sadly, now it’s https://shop.pimoroni.com/products/audio-dac-shim-line-out ) and bam old speakers are airplay compatible. The Pi is on Trixie and everything.
It’s fantastic that it can do the airplay2 and everything without skipping a beat. Great coding from the dev of it (Mike Brady)!
-
on Skyrim belongs to the rules in c/onehundredninetysix@lemmy.blahaj.zone · 31 Aug 2026
I’m imagining a spinning raccoon saying that
-
on Skyrim belongs to the rules in c/onehundredninetysix@lemmy.blahaj.zone · 31 Aug 2026
This is completely legitimate opossum fact, hold no doubt in your heart
-
on the glizzard king and his henchmen rule in c/onehundredninetysix@lemmy.blahaj.zone · 29 Aug 2026
🫡
-
on Bi-Radial Butt Rule in c/onehundredninetysix@lemmy.blahaj.zone · 23 Aug 2026
Heheh,… toot
-
on gacha in c/femcelmemes@lemmy.blahaj.zone · 23 Aug 2026
BOOBAHS
-
on guess what this is? solution in body in c/onehundredninetysix@lemmy.blahaj.zone · 22 Aug 2026
Hello, yes, I’d like all my farmland to look like circles from high altitude photos, thanks!
-
on Twin Peaks rule in c/onehundredninetysix@lemmy.blahaj.zone · 21 Aug 2026
-
on Cake Rule in c/onehundredninetysix@lemmy.blahaj.zone · 21 Aug 2026
Install incus on your OS of choice to manage LXCs and VMs, it’s ideal!
No need to chain yourself to an OS that is rolling on the free branch, get stability and control!
As for LXCs vs Podman containers, seems it is preference of control. LXCs are little OSes you need to keep up to date, containers need to be rebuilt to keep up to date. (I think only Linuxserver images actually rebuild just for base OS updates, hopefully the reverse proxy and authentication images too)
Podman brings some nice networking, read-only features, and user abstraction with it, I think that helps it push ahead.
That said, LXCs are little OSes and that flexibility can be very useful. For instance, incus is able to make an LXC with a unique Mac from an Ethernet adapter - I haven’t cooked how to do that with Podman yet. So I run my DNS from there so it doesn’t mess with my server’s DNS port.