this post was submitted on 26 Oct 2023
67 points (93.5% liked)

Selfhosted

60734 readers
225 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
67
Is it time to switch to podman? (lemmy.ml)
submitted 2 years ago by beta_tester@lemmy.ml to c/selfhosted@lemmy.world
46 comments fedilink hide all child comments
 

I keep reading about podman, yet it doesm't FEEL as mature to me as docker for a normal user like me. What's your opinion? Did you already switch or do you keep waiting for ... for what? When will you switch?

you are viewing a single comment's thread
view the rest of the comments
[–] vegetaaaaaaa@lemmy.world 6 points 2 years ago* (last edited 2 years ago)

You technically can bind ports <1024 to unprivileged containers. echo 'net.ipv4.ip_unprivileged_port_start=0' | sudo tee /etc/sysctl.d/50-unprivileged-ports.conf; sudo sysctl --system. Though this will allow any user to bind ports below 1024, so it's not very clean.

Another workaround is to redirect port 80 to 8080 (or other) through iptables and have your proxy listen on this port. sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080. Same thing for 443.

As far as I know granting the CAP_NET_BIND_SERVICE capability to /usr/bin/podman does not work.

Also podman-compose implementation is still incomplete, and I prefer using systemd units to start and manage containers. Check man podman-generate-systemd