Oh yes. Sorry, I worded that poorly. Thank you for clarifying.

If this doesn’t work I’m gonna be so mad.

I feel like your threat model is not realistic. It is way more likely that you will be running malicious and/or vulnerable code that was packaged appropriately by the actual package maintainer than for a CA compromise to allow an attacker to inject a malicious package during a MITM attack while retrieving an OCI image from a container repository.

Like, yes, you shouldn’t 100% trust your ISP or your DNS server, but if you’re that paranoid, you shouldn’t trust your distro’s repository either. You should be building everything from source.

That’s because package managers are designed to use mirrors. You have to verify a digital signature because the package isn’t necessarily coming from the package maintainer’s repo.

Docker pulls come from the registry, not a mirror. There is no such thing as a mirror in docker. The registry is something you decide on, and if you don’t trust it, you shouldn’t use it. If the registry itself is compromised, that’s essentially like the private key of a package manager getting compromised. Same risk.

The two biggest registries are Docker Hub and GitHub. If either of them were compromised, it wouldn’t take very long for them to mitigate it. The damage would likely be very small.

Oh, they can also mitigate it 100% on their side. With a package manager, your computer will trust a compromised key until the package manager removes it, which may be too late.

Not that I’m fond at all of Getty, but the fact that people are using AI slop instead of real photographs is disappointing.

Absolutely love the part where he said they don’t use AI and then that they do use AI.

I love how instead of saying, “no,” he said “please don’t ask us to do that.” What a fucking pussy.

Isn’t 50k deaths like five times 9/11?

Ok, but also

If I lost that much money, I would not be in business anymore.

DDG is just a people pleaser. 🤷‍♂️

Omg dude, you can still use coreutils on Ubuntu:

sudo apt-get remove coreutils-from-uutils --allow-remove-essential

You can also opt out before you upgrade:

/etc/apt/preferences.d/uutils:

Package: coreutils-from-uutils
Pin: release a=*
Pin-Priority: -10

NO ONE IS FORCING YOU TO SWITCH!

It sounds like you just wants Nextcloud and maybe Immich. So here’s my suggestion:

If you don’t have a domain yet, buy a domain. Preferably through Cloudflare because their API is good, and you’ll need that. Point an apex A record at your public IP address.

Set up something like Kubuntu on the box itself. Make sure it has a static IP address (you can also do DHCP reserved through your router, which is safer), and forward ports 80 (TCP), 443 (TCP), and 51820 (UDP) to that box.

Now comes the magic. Install docker through the official installation docs for Ubuntu (don’t use Ubuntu’s packages). Create a folder in your home directory called “services”. Inside this folder, you’re going to set up a folder for each service you need. The first one you should set up is “nginx-proxy-manager”. Inside each folder you’ll have a “docker-compose.yml” file. Inside that file, set up your docker compose stack. Nginx Proxy Manager’s is pretty simple. Just one service. But change the network mode to “host” (network_mode: host), and remove the ports section.

https://nginxproxymanager.com/setup/

Now, from a terminal, in that folder, run docker compose up -d. Get used to that command, you’ll run it a lot. Then go to localhost:81, and create an account for NPM. Use a real email address, because that’ll be your contact email for Let’s Encrypt ssl. Go into the ssl settings and create a certificate. You’ll need an api key from Cloudflare, or whatever other place you bought your domain from. It needs access to change the dns settings for your domain. Use this format to create your certificate:

example.com, *.example.com

And use the dns challenge option where you’ll put your api key.

[continuing in next post]

Important Edit:

One thing I forgot to mention, don’t use Docker volumes. Use a bind mount to mount a real directory inside the folder. It should look something like this:

    volumes:
      ./data:/data

NOT like this:

    volumes:
      data:/data

That way, when you back up that folder, it backs up all your data with it. If you use a docker volume (the one without the “./“), you’ll need to back those up separately. This is important for all of the mounts on every one of your services, especially the database services.

That redacted word better not be “is”.

Literally no one is forcing you to switch. Just keep using coreutils.

We’re also excellent marksman. If you sharpen a particularly straight stick, you can throw it at your dreams from a distance, hopefully wounding your dreams.

I’m pretty sure it’s just a fuzzy context match.

I’m sorry, I must have not said this loud enough. JUST KEEP USING COREUTILS.

Every once in a while, you should run these commands in each services folder:

docker compose pull
docker compose up -d

# check if everything is still good

docker system prune -a

You should also back up your services folder regularly. That’s beyond the scope of this Lemmy comment, though

If you have anything open to the internet (not using that local only access list), you need to be very vigilant about updating it frequently. If you’re not, you could have vulnerabilities that are exploitable.

By setting it up where NPM is blocking access to everything that isn’t local, you won’t really need to pay much attention to it. Just do the updates every few months and you’ll be fine.

All of my Docker containers had updates available within minutes. :)