• 0 Posts
  • 41 Comments
Joined 1 year ago
cake
Cake day: June 28th, 2023

help-circle








  • If the service is already running it has to be stopped as a system service and run as a user service. In order to ensure that the service inherits all the correct permissions / acls / se linux policies the service needs to be launched from the limited permissions context.

    With the systemd approach you’re not just passing a control handle around. You’re ensuring the process is running under an appropriate security context.

    If you want to let multiple users manage the user systems service, I would probably go with sudo and systemd user files. You could create a group which has sudo access etc. The important idea is that an unprivileged user controls an unprivileged service.





  • There is a lot here but I think the most important thing is that docker containers should always be disposable. Don’t put any data into the container ever.

    All of your data and configuration should be done in volumes. Local disk to inside the container is all you really need.

    By doing this you make updating any given docker container easy as just pulling the newest tagged version of the container. If you are using docker and not podman you can use tools like watchtower to do this automatically.

    As for what distro, it depends on your goals. Do you want to learn and improve your skills? Stick with Fedora or Rocky or Debian or openSUSE. I recommend learning the command line as you go, but if you want a nice UI openSUSE has Yast which is a very robust tool.

    If you want to just have a home NAS but don’t want to learn that’s a different question. In this case if you’re getting a proprietary NAS anyway you could just get one that supports docker (like synology) and kill 2 birds with 1 stone.