3 ms·
In the age of LLM agents, still going for Docker/Podmam on anything besides local development box seems like a weird choice. Docker has poor tooling for networ
by Jnr 27d ago
In the age of LLM agents, still going for Docker/Podmam on anything besides local development box seems like a weird choice.
Docker has poor tooling for network level security between the containers, has issues with different runtimes per container, etc.
It is just a bit primitive if you want to expose multiple services to the internet on the same server. One of those apps will get compromised and then all the others will follow.
If you want a decent self hosted server, ask your frontier LLM agent of choice to configure kubernetes (on something like k3s) with mandatory userns mapping so nothing runs as root on the host, default deny firewall so inter-container communication is as locked down as possible, and if your router supports, set up VLANs so none of the containers can access your other devices on the LAN. Use something like backrest to handle backups, alertmanager and Grafana for monitoring, Keel for auto updates. Also consider separating ingress for public and internal services and use Tailscale with split DNS to acces the internal entrypoint. Set up Crowdsec as WAF and subscribe to their free blocklists to filter out bots. Ask it to set this all up using Ansible, so it can be maintained.
While this would be extremely time consuming to set up and maintain by hand, an agent can do and test it in a few hours.
- hamdouni 27d agoSkip kubernetes and deploy to bare server
- crabmusket 27d ago> has issues with different runtimes per container Could you be more specific about that? > One of those apps will get compromised and then all the others will follow... Per their security docs, containers are rootless but I don't see anything about VLAN isolation. https://cloudinabottle.org/docs/how_it_works/security.html https://cloudinabottle.org/docs/how_it_works/security.html
- Jnr 27d agoKubernetes supports multiple pluggable container runtimes per node. Can be quite useful when requiring some virtualization or running certain docker-in-docker scenarios for CI/CD workers. Maybe it can be done with Docker as well these days, but with kubernetes it is out of the box support. Perhaps you could manually set up some VLANs and set up Docker networking to use those, but that has to be custom setup, none of that is a standard feature of Docker. So instead of having to reinvent the wheel for each of those problems, you can just take kubernetes instead. And while it is a lot to learn, LLMs can make it a lot easier to do. For years I was running docker-compose stacks for self hosted things, but I replaced that once LLM agents became a bit less stupid. :)
- deleted 27d ago[deleted]
- wseqyrku 27d ago> Docker has poor tooling for network level security between the containers Aha so LLMs have better tooling for network level security, cloudboy?
- Jnr 27d agoYes, kubernetes makes it much easier to configure proper firewall through network policies. Docker has networks but there is no good options to limit it beyond those and it is extremely basic and basically leaves everything open between your proxy and app.