3 ms·

Don't use linuxserver images. My feeling is they were done by someone who doesn't understand docker very well. Frequent use of supervisor, lack of logs on stdou

Don't use linuxserver images. My feeling is they were done by someone who doesn't understand docker very well. Frequent use of supervisor, lack of logs on stdout, weird automagic config approach. It may feel convenient if someone did homelab without docker, but will bite you in the long run.

jjeaff 3y ago
hmm, are you sure about that? the whole reason I use the linuxserver offerings is that they all follow the same pattern of not using root privileges in the container and also factoring the uid and group id out as compose variables so you can match them to other containers if needed.
- radlad 3y ago
  I think both are true - LinuxServer images are usually well maintained, and they all use a common format, so once you know how to configure one, it's easy to configure the rest. But they make a lot of decisions that are not "best practices" in Docker - such as running multiple processes per container, under a supervisor. IMO, they are great for single-machine home deployments.
- dzikimarian 3y ago
  Yes their images are standardized, which helps if you want "linuxserver experience" and don't care about actual image. Try to understand what actually happens on container startup and you're stuck in three layers of base images that they use as framework, with hooks on each layer. Wanna inherit some image and eg. copy something into config dir? Nope. Config dir is overwritten by symlink, by script on some layer. Actual config dir is moved somewhere to fit their internal convention. Their framework allows them to quickly add new applications and keep them updated. But it's pain to work with. I guess if you're willing to learn it and you're 100% sure, you're not going to modify image or configure application beyond of what they exposed - you might be okay using it. Otherwise just get official image.
chatmasta 3y ago
They work great for stateless services that you don't modify for your use case. I've had a wireguard server and client container, both based on linuxserver/wireguard, in a fairly weird setup within Nomad, running in production for over a year with no issues. The trick was to isolate the weirdness in the wgconf files, the permissions of the containers, and their shared netns (a nomad group, in this case, with its netns configs tweaked by a startup script). The Dockerfile is simply FROM linuxserver/wireguard:latest. (It's wrapped in a Dockerfile so its rebuilds are limited to when we rebuild our images (every commit), but AFAIU the linuxservers setup, it can also pull in wireguard updates at runtime.)

jjeaff 3y ago

hmm, are you sure about that? the whole reason I use the linuxserver offerings is that they all follow the same pattern of not using root privileges in the container and also factoring the uid and group id out as compose variables so you can match them to other containers if needed.

radlad 3y ago
I think both are true - LinuxServer images are usually well maintained, and they all use a common format, so once you know how to configure one, it's easy to configure the rest. But they make a lot of decisions that are not "best practices" in Docker - such as running multiple processes per container, under a supervisor. IMO, they are great for single-machine home deployments.
dzikimarian 3y ago
Yes their images are standardized, which helps if you want "linuxserver experience" and don't care about actual image. Try to understand what actually happens on container startup and you're stuck in three layers of base images that they use as framework, with hooks on each layer. Wanna inherit some image and eg. copy something into config dir? Nope. Config dir is overwritten by symlink, by script on some layer. Actual config dir is moved somewhere to fit their internal convention. Their framework allows them to quickly add new applications and keep them updated. But it's pain to work with. I guess if you're willing to learn it and you're 100% sure, you're not going to modify image or configure application beyond of what they exposed - you might be okay using it. Otherwise just get official image.

chatmasta 3y ago

They work great for stateless services that you don't modify for your use case. I've had a wireguard server and client container, both based on linuxserver/wireguard, in a fairly weird setup within Nomad, running in production for over a year with no issues. The trick was to isolate the weirdness in the wgconf files, the permissions of the containers, and their shared netns (a nomad group, in this case, with its netns configs tweaked by a startup script). The Dockerfile is simply FROM linuxserver/wireguard:latest. (It's wrapped in a Dockerfile so its rebuilds are limited to when we rebuild our images (every commit), but AFAIU the linuxservers setup, it can also pull in wireguard updates at runtime.)