Helmut10001

I get your point and this is likely also not what you mean, but I am very happy with a simple git tracking approach that I use across Proxmoxes and VMs [1].

[1]: https://du.nkel.dev/blog/2026-05-16_rootless_docker_virtiofs...

Yeah, I ran into the same wall when setting the system up. I then reverted to the standard mount utility, which also supports id-mapping. But it is really not that known. See the links in the article that point to the source of the idea.

    > Network file systems can cause UID/GID mismatches and add network overhead. With VirtIO-FS, I use the Linux kernel's Virtual File System to translate the hypervisor's UID to the guest's unprivileged UID. This avoids exposing the host file structure. I utilize the `X-mount.idmap` fstab option for this. Documentation on this specific implementation is not easy to find. It builds upon the idmapped mounts feature introduced by Christian Brauner in Linux 5.12 [1] and its later integration with util-linux v2.39 into the standard `mount` utility [2].

    [1]: https://github.com/brauner/mount-idmapped + https://docs.kernel.org/filesystems/idmappings.html
    [2]: https://github.com/systemd/systemd/releases/tag/v254

Thanks for the feedback! I agree. I do have a comment on this, to explain my choice:

> Podman vs Docker You may point to Podman here because Podman is natively rootless and doesn't require a daemon and additional workarounds to run rootless. I agree. However, Docker in rootless user nesting is also robust and possible, and I decided to stick to the docker-compose.yml because it is still the industry (and homelab) standard. This minimizes the time I need to translate examples or templates. Docker in rootless and Podman are mostly interchangeable at this level. Both run processes in isolated Linux namespaces on your host VM (not the Hypervisor!).

This is not 100% and may change anytime. I guess, for me, at this time, the difference between Docker in rootless and Podman is just too small, and the time needed to migrate all my docker-compose.yml's too much, to make the jump. Overall, it is not a critical decision for this architecture, more a choice.

Regarding Debian is similar, I just stick with what I am familiar with. Debian also never lost me.

I found it pretty reliable and use it across all my docker projects, development and production.

Install docker (systemd daemon) in a separate rootless Linux namespace (user). I wrote this down here [1]. Zero trust & separation of concerns.

[1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

I have my phone always in Do Not Disturb. That's it.

It is not possible to zoom in, as far as I can see (mobile, but tested desktop). [Edit] This allows zooming [1].

[1]: https://2b2tatlas.com/map

I invested quite a bit in enterprises level homelab equipment 2020 to 2025 (about 10k). Happy I made it before the big bang. Eg. my SAS he8 drives will last at least till 2035. But what then? I want my children to be free, too.

Yes, manual. It is very rare to find automatic cars of that age in Europe.

Electronics don't usually last for more than 30 years. Pre-2007 cars can be driven for that long because they had minimal electronics and relatively oversized manufacturing. This was because managers hadn't yet taken charge of reducing material thickness to the absolute minimum.

Our VW T4 from 2002 has 300k km on it. I consider this half it's total possible mileage, if not less. I wish they would still build reliable cars like these today.

What I found pretty great with docker is isolating individual docker systemd instances in rootless linux namespaces (i.e. users). I wrote about this here [1]. This lets you easily create multiple services on one VM that are quite isolated from each other. This system of doing things has worked reliably for me for quite some time, even for the 'bigger' services (gitlab, nextcloud, mailcow-dockerized etc.).

[1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...

I had the feeling they didn't really answer the questions, that is why the goblins appeared. They simply "retired the “Nerdy” personality" because they couldn't fix it and went on.

I added an Zenko Scality CloudServer S3-compatible Storage backend to a selfhosted Grist [1] instance. This allowed me to create forms with attachements in Grist (e.g. users can upload photos). I experimented with several and settled on Zenko Scality CloudServer [2]:

- MinIO [3] is somewhat deprecated and not really open source anymore. Its future is unsure.

- GarageHQ [4] looks pretty great and I wished I could have used this, but it is not yet feature-complete with S3 protocol and specifically missing the versioning feature (I reported this [5])

- Zenko Scality works out of the box; it is a bit too "big" for my context (aimed at thousands of parallel users) and uses 500MB memory; but it does the job for now.

I posted my compose here [6]. Since then (~months ago), it works really well and I am happy with Zenko Scality S3.

    [1]: https://github.com/gristlabs/grist-core
    [2]: https://github.com/scality/cloudserver
    [3]: https://www.min.io/
    [4]: https://garagehq.deuxfleurs.fr/
    [5]: https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/166
    [6]: https://github.com/scality/Zenko/discussions/1779#discussioncomment-15869532

The comparison pictures look like there is more dust in the air today. They don't explain this effect, so I assume it is related to time of day the photo was taken, or camera settings, not actual dust accumulation compared to 1972. However, the direct comparison gives the impression they want people to interpret like the air is getting dirtier?

You mean via WebDav? That is definitly an option, but then it is not possible anymore to mix working file directories within Nextcloud. E.g. I have a long list of ignored files for nextcloud [1], such as .git folder etc.

I would need to create a separate file tree, splitting my work between nextcloud maintained files and working files. That feels cumbersome. On Windows, I could directly add my whole drive to nextcloud as a virtual file system.

[1]: https://gist.github.com/Sieboldianus/280afdb2f994fae6e5f6b18...

I found virtual files support also somewhat critical. This is not really stable on Linux yet and makes using Nextcloud with 8TB and Million of files pretty difficult.

I think nowadays the only safe and sane way is running Windows isolated as a VM (e.g. QEMU on proxmox). I did this with my gaming server. The VM sits on ZFS which I can snapshot before any Microsoft stuff happens, to revert any action. I can cut off the network card virtually and shutdown the guest whenever I get tired of it. I could even disguise the CPU/QEMU config, so that the anti-cheat from Star Citizen didn't recognize it was running in a virtualized environment. Pair this with Moonlight+Sunshine and you can game without issues on any remote client. Why I prefer Windows for gaming? It is just (still) the default and provides the least barrier and setup effort for most games.

I use ZFS even on consumer devices, these days. Parity checks all the way!

Thanks for the details. I agree and had the same experience, trying to figure out if an AMB motherboard supports ECC or not. It is almost impossible to know ahead of trying it. At least we have ZFS now for parity checks on cold storage.

Interesting, I was not aware! Do you have a statistics for the bit flips in RAM %? My feeling would be its the majority of bit flips that happen, but I can be wrong.

I don't understand why ECC memory is not the norm these days. It is only slightly more expensive, but solves all these problems. Some consumer mainboards even support it already.

I don't browse US newspapers that often, but I regularly observe blocked ones, particularly smaller ones. Non-deterministic, e.g.: New York Daily News, Chicago Tribune, Baltimore Sun, Dallas Morning News, Virginian-Pilot. Beyond that, a lot of CA and San Francisco Government and local utility services are geo-restricted (which I think, from a security standpoint, makes at least somewhat sense..).

Btw. asking once is enough ^^

This is somewhat counterintuitive: The US is the only country I know where most newspapers and government services use strict geoblocks to prevent me from accessing US sites in Europe. Conversely, I've never had any problems accessing European sites from the US. I know this is for a different set of reasons (likely GDPR cookie law or similar), but it's funny that anyone thinks blocks like this are relevant. Most people I know use VPNs these days to make their traffic appear to come from whatever country they need.

For anyone, this is the reference post from the bot [1].

[1]: https://github.com/crabby-rathbun/mjrathbun-website/blob/83b...

I agree. I think some of us would rather deal with small, incremental problems than address the big, high-level roadmap. High-level things are much more uncertain than isolated things that can be unit-tested. This can create feelings of inconvenience and unease.

It looks like using Chocolatey [1] saved me from this attack vector because maintainers hardcode SHA256 checksums (and choco doesn't use WinGuP at all).

[1]: https://chocolatey.org/

Could electrical resistance be measured in train tracks to monitor sudden drops, such as fractures, before they cause loss of life?

Yes, this is also how JupyterBook [1] does it (I think v1 uses Myst Markdown parser). I found this to work excellent!

[1]: https://jupyterbook.org/

Interestingly, there are about 100 events of this severity (G4) per cycle, and a single cycle lasts 11 years. This means there are about nine G4 events on average per year.