3 ms·

Why do you need to update docker? I kept my box running for more than 1 year without upgrading docker. I upgrade my images but it hardly takes 15 minutes for me

Why do you need to update docker? I kept my box running for more than 1 year without upgrading docker. I upgrade my images but it hardly takes 15 minutes for me, in let's say a month. >>> if the company is respecting privacy It's very rare to see companies doing it, and moreover it is hard to trust them to even maintain a unique stance as years pass by.

motorest 1y ago
> Why do you need to update docker? For starters, addressing security vulnerabilities. https://docs.docker.com/security/security-announcements/ https://docs.docker.com/security/security-announcements/ > I kept my box running for more than 1 year without upgrading docker. You inadvertently raised the primary point against self-hosting: security vulnerabilities. Apparently you might have been running software with known CVEs for over a year.
- danparsonson 1y ago
  Much of this risk is mitigated by hiding everything behind Wireguard or similar. None of my self-hosted stuff is publicly exposed but I can reach it from anywhere. You can go one step further and run some kind of gateway OS (e.g. opnSense) on a separate cheap VPS, route everything through that, then firewall your main server off completely.
buran77 1y ago
It doesn't matter if you upgrade Docker or not. All tech, self hosted or not, fails for three reasons: 1) You did something to it (changed a setting, upgraded software, etc.) 2) You didn't do something to it (change a setting, upgrade a software, etc.) 3) Just because. When it does you get the wonderful "work-like" experience, frantically trying to troubleshoot while the things around your house are failing and your family is giving you looks for it. Self host but be aware that there's a tradeoff. The work that used to be done by someone else, somewhere else, before issues hit you is now done by you alone.
- mr_mitm 1y ago
  And if you're security conscious like me and want to do things the "right way" just because you can (or should be able to), you now have to think about firewall rules, certificate authorities, DNS names, notifications, backup strategies, automating it in Ansible, managing configs with git, using that newfangled IPv6, ... the complexity piles up quickly. Coincidentally, I just decided to tackle this issue again on my Sunday afternoon: https://github.com/geerlingguy/ansible-role-firewall/pull/114 https://github.com/geerlingguy/ansible-role-firewall/pull/11... Sometimes it's not fun anymore.
  - deleted 1y ago
    [deleted]
- ndriscoll 1y ago
  Besides 2 of my hard drives failing over the last 30 years, I can't recall ever encountering 2) or 3). I also can't really even imagine the mechanism by which a self-hosted solution could fail without you touching it or without a hardware failure. Software does not rot.
aucisson_masque 1y ago
> if the company is respecting privacy It's very rare to see companies doing it, and moreover it is hard to trust them to even maintain a unique stance as years pass by. Indeed, no one can predict the future but there are companies with bigger and stronger reputation than other. I pay for instance for iCloud because it’s e2e in my country and pricing is fair, it’s been like that for years and so I don’t have to set up baikal server for calendar, something for file archieving, something else for photo and so on. I’d be surprised apple did willingly something damaging to user privacy, for the simple reason that they paid so much ads on privacy, they would instantly loose a lot of credibility. And even stuff you self host, yes you can let it be, not update it for a year but I wouldn’t do that because of security issue. Somethings like navidrome (music player), it’s accessible from the web, no one want to launch a vpn each time you listen to music and so it got to be updated or you may get hacked. And no one can say that the navidrome maintainer will still be there in the coming years, could stop the project, be sick, die… it’s not a guarantee that others take back on the project and provide security update.

motorest 1y ago

> Why do you need to update docker? For starters, addressing security vulnerabilities. https://docs.docker.com/security/security-announcements/ https://docs.docker.com/security/security-announcements/ > I kept my box running for more than 1 year without upgrading docker. You inadvertently raised the primary point against self-hosting: security vulnerabilities. Apparently you might have been running software with known CVEs for over a year.

danparsonson 1y ago
Much of this risk is mitigated by hiding everything behind Wireguard or similar. None of my self-hosted stuff is publicly exposed but I can reach it from anywhere. You can go one step further and run some kind of gateway OS (e.g. opnSense) on a separate cheap VPS, route everything through that, then firewall your main server off completely.

buran77 1y ago

It doesn't matter if you upgrade Docker or not. All tech, self hosted or not, fails for three reasons: 1) You did something to it (changed a setting, upgraded software, etc.) 2) You didn't do something to it (change a setting, upgrade a software, etc.) 3) Just because. When it does you get the wonderful "work-like" experience, frantically trying to troubleshoot while the things around your house are failing and your family is giving you looks for it. Self host but be aware that there's a tradeoff. The work that used to be done by someone else, somewhere else, before issues hit you is now done by you alone.

mr_mitm 1y ago
And if you're security conscious like me and want to do things the "right way" just because you can (or should be able to), you now have to think about firewall rules, certificate authorities, DNS names, notifications, backup strategies, automating it in Ansible, managing configs with git, using that newfangled IPv6, ... the complexity piles up quickly. Coincidentally, I just decided to tackle this issue again on my Sunday afternoon: https://github.com/geerlingguy/ansible-role-firewall/pull/114 https://github.com/geerlingguy/ansible-role-firewall/pull/11... Sometimes it's not fun anymore.
- deleted 1y ago
  [deleted]
ndriscoll 1y ago
Besides 2 of my hard drives failing over the last 30 years, I can't recall ever encountering 2) or 3). I also can't really even imagine the mechanism by which a self-hosted solution could fail without you touching it or without a hardware failure. Software does not rot.

aucisson_masque 1y ago

> if the company is respecting privacy It's very rare to see companies doing it, and moreover it is hard to trust them to even maintain a unique stance as years pass by. Indeed, no one can predict the future but there are companies with bigger and stronger reputation than other. I pay for instance for iCloud because it’s e2e in my country and pricing is fair, it’s been like that for years and so I don’t have to set up baikal server for calendar, something for file archieving, something else for photo and so on. I’d be surprised apple did willingly something damaging to user privacy, for the simple reason that they paid so much ads on privacy, they would instantly loose a lot of credibility. And even stuff you self host, yes you can let it be, not update it for a year but I wouldn’t do that because of security issue. Somethings like navidrome (music player), it’s accessible from the web, no one want to launch a vpn each time you listen to music and so it got to be updated or you may get hacked. And no one can say that the navidrome maintainer will still be there in the coming years, could stop the project, be sick, die… it’s not a guarantee that others take back on the project and provide security update.