I mean, the linked article does a pretty good explanation?
adam
joined 2 years ago
Didn't even think 4k80 was generally available yet?
You've not factored in egress costs. Which on Amazon can add up quite quickly.
There's a couple of caveats with it, but I think neither are worse than your proposed flow.
- After putting things in an album you'll need to manually run the migration job to have immich reorganise into album folders.
- Images in multiple albums will only be migrated to the path of the newest album.
Immich does support folders?
https://immich.app/docs/administration/storage-template/
With this you can store your photos in whatever structure you want.
Docker will have only exposed container ports if you told it to.
If you used -p 8080:80 (cli) or - 8080:80 (docker-compose) then docker will have dutifully NAT'd those ports through your firewall. You can either not do either of those if it's a port you don't want exposed or as @moonpiedumplings@programming.dev says below you can ensure it's only mapped to localhost (or an otherwise non-public) IP.
Documentation people don’t read
Too bad people don’t read that advice
Sure, I get it, this stuff should be accessible for all. Easy to use with sane defaults and all that. But at the end of the day anyone wanting to using this stuff is exposing potential/actual vulnerabilites to the internet (via the OS, the software stack, the configuration, ... ad nauseum), and the management and ultimate responsibility for that falls on their shoulders.
If they're not doing the absolute minimum of R'ingTFM for something as complex as Docker then what else has been missed?
People expect, that, like most other services, docker binds to ports/addresses behind the firewall
Unless you tell it otherwise that's exactly what it does. If you don't bind ports good luck accessing your NAT'd 172.17.0.x:3001 service from the internet. Podman has the exact same functionality.
But... You literally have ports rules in there. Rules that expose ports.
You don't get to grumble that docker is doing something when you're telling it to do it
Dockers manipulation of nftables is pretty well defined in their documentation. If you dig deep everything is tagged and natted through to the docker internal networks.
As to the usage of the docker socket that is widely advised against unless you really know what you're doing.
Much like what happened in the original Minecraft, Voyager is entering a region where the simulation breaks down.
He was selling the vaccine passports that he was issued to anti-vaxxers.
If buying isn't owning then piracy isn't stealing.