Hacker News Reader

To each their own but running that much stuff without proxmox would drive me insane. Especially the native stuff straight on the machine.

View on HN

With some small systemd configs each native app is essentially a container these days. The overhead of unique kernels per app would really restrict what could fit on a small box like this

DynamicUser and ProtectSystem keep me sane.

Much prefer LXC + IaC to rebuild them, but much of a sameness

Like the other person said, proxmox allows containers or full VMs, and the base OS takes less than 2 GB RAM.

My jellyfin LXC idles at a few hundred megs of ram, shares the base debian kernel, and if anyone does ever break in, they don't get access to anything else, anywhere else on my server. (All media is also mounted read-only to the jellyfin LXC.)

I really, really like it, just set it up recently. Everything in its right place.

Reply on news.ycombinator.com