Overspark

It can be run as root, but it doesn’t have to, as it is only accessing the host network, not any user-specific network. Crossing the boundaries from host network to user-specific networks is left to the reverse proxies running as those specific users.

Port 80 and 443 can normally only be bound as root, but you can work around that with either firewall rules or by using something like this in your sysctl config:

net.ipv4.ip_unprivileged_port_start = 80  

You can use the per-user reverse proxies as a bridge between the host network and the user-specific internal network. So for a user coming from outside the path looks like this:

User -> main reverse proxy on main IP and port 80/443 -> user-specific proxy listening on main IP with port 8080 and proxying to user-specific internal network -> destination container listening on user-specific internal network.

And for a container running as a different user the path will be the same, but the user-specific reverse proxy will be listening on port 8081 and higher for example.

The solution to this can be multiple reverse proxies. Each user runs it’s own reverse proxy (if you actually need one, otherwise you let the container bind directly to a port on the host system). Then you run one main reverse proxy on port 80/443 that proxies to those other ports based on hostname.

The upside of this construction is that containers running as different users can’t directly access each others internal networks, which is much better for security, as those networks often contain barely protected services, which is why you’re using a reverse proxy in the first place.

Edit: there are different options with custom networks and such, but they’re even more complicated so I wouldn’t advise them.

Yeah that’s completely normal, looks absolutely fine to me. For more info on how linux uses memory I suggest reading https://www.linuxatemyram.com/

To add: that link suggests looking if your swap usage is changing. Linux is quite happy to stuff some memory that isn’t actually used in swap. If it was right about it not being used you should see the swap usage not changing much, so your SSD isn’t really being used either apart from the initial swap-out. If your swap usage keeps fluctuating wildly there is more going on which might warrant further investigation.

I recently had a local issue where I could barely reach B2 as well. It turned out that one of their endpoints was on a DNS blocklist I use. Once I manually unblocked that everything started to work again. Not saying you’re having the same issue but it could be a lot of things between you and B2, careful triage is needed to find the root cause.

Built my own server to be completely silent since it lives in my living room. Based on an Intel i3-12100 with some NVMe and 5x SATA SSD’s, and running tons of containers. Does about 18W most of the time and it could have been lower with a different motherboard.

All the UniFi stuff (gateway, switches, APs) uses just under 50W though, so there’s little sense in spending more money on the server to shave off a few watts.

Servers are terrible for homelab use. They’re unwieldy, consume way too much power and as you’ve found they’re very noisy. My vote goes to selling the thing and getting a mini PC, an (old) laptop or building something quiet and frugal yourself. In the last case you might be able to reuse some parts you already have. But if cost is important almost nothing beats second hand mini PC’s in value for money.

SnapRAID offers an additional benefit over real RAID-like systems: it functions as a short-term backup. If you sync it daily like I do, that means that if you accidentally delete a bunch of files (old enough to have been synced, I.e. older than one day in my case) you can restore them from the SnapRAID parity.

The reverse is also true of course: if you lose a disk you also lose today’s changes to that data. So it’s most suited to large collections of rarely changing stuff like photos and videos and music IMHO.

Official Podman Quadlet files? Me likey!

I’ve been using IPv6 for more than 20 years, and I can’t say that about nuclear fusion.

Depends. There are a few things I update by hand, but as long as you have proper backups it’s generally safer to run the latest versions of things automatically if you don’t mind the possibility of breakage (which is very rare in my experience). This is in the context of self-hosting of course, not a business environment.

Yeah only for :latest containers, that’s true. It automatically runs a daily service to check whether there are newer images available. You can turn it off per container if you don’t want it.

One of the nice things about it is that I have containers running under several different users (for security reasons) so that saves me a lot of effort switching to all these users all the time.

Podman automatically updates my containers for me.

A recommendation for Moonrise Kingdom based on Mickey 17? The genres might match, but those are totally different movies.

The point is signaling to other people that it’s not worth their time. I sort by new so I often see these slop posts as well, but other readers very quickly downvote it into oblivion so if a post is older than say 15 minutes I generally will know not to read it even if it sounds interesting at first glance. A mod will come by later to actually delete it if that’s warranted, but until then downvotes suffice.

Yes, those go to the “unsubscribe” folder, so I read them less often than my normal mail.

Regardless of which e-mail service you end up using, I find that an incredible simple rule to filter all e-mail with the word “unsubscribe” in it’s body to another folder saves your sanity. It’s still a folder you should go through a few times a week to read all the newsletters and shit you’re subscribed to, and sometimes the occasional false positive, but your inbox will mostly contain e-mail you actually want to read. I have another rule that filters mail from specific senders that I want to read immediately to my Inbox before it hits the unsubscribe rule, but those exceptions are uncommon enough (I only have 7 after years of doing this) to not take much work.