Choosing the base layer for a home server

Everything above the base layer is portable. You can move a media server to another machine in an afternoon and nobody notices. The base layer is not: changing it means moving storage, network configuration and every service at once, offline, with no rollback except the backup you took first. It is the hardest thing in this index to change your mind about.

So the question is not which platform is best. It is how much machinery you want between your applications and the disks, and what that costs in memory and attention every month for the next five years.

The default: Debian plus Docker, and nothing else#

Install Debian stable, install Docker Engine, write compose files. Docker Engine is Apache-2.0, idles around 120 MB with containerd before a single container starts, upgrades cleanly through apt, and scores 2 on ops load. Every guide you will read assumes it, so you spend your evenings on applications rather than on translating instructions.

Two costs before you commit. Anyone in the docker group is effectively root on the host. And Docker writes its own iptables chains, so a container published with -p 8080:80 is reachable even when ufw says that port is denied. Bind to an interface (-p 127.0.0.1:8080:80) and put a proxy in front.

That default is wrong in two situations.

You are consolidating machines, or you want a rollback before every risky change. Then Proxmox VE, and accept what it costs: 2 GB of RAM for the host before guests get any, 8 GB as a starting point plus roughly 1 GB per TB of pool if you use ZFS, and an ops load of 4. Upgrades have a required order and a pve8to9 pre-flight check. In exchange you get VM and container snapshots, ZFS replication to a second node without writing send scripts, and a normal Debian underneath when something needs fixing over SSH.

The host has other users, or you want boot ordering that works. Then Podman with Quadlet. Forty megabytes idle, no daemon, and ~/.config/containers/systemd/app.container becomes a real systemd unit with dependency ordering, restart policy and journald logging. The tradeoff: podman compose shells out to an external provider, so compose files leaning on depends_on conditions or profiles behave in ways their authors never tested.

Should a homelab run Kubernetes#

Usually not. A single-node cluster asks you to operate a control plane, a CNI, an ingress controller, a storage class and a certificate controller to run the same containers a compose file already runs, each with its own upgrade cadence. The genuine exception is career: Kubernetes is a job skill and practicing it at home is a real reason. If that is your reason, run it somewhere that is not also serving your family's photos.

If you have three or more Docker hosts and are tired of SSHing into each one, Komodo is the middle path. It is one Rust binary plus an agent per host, and it thinks in compose files rather than manifests. Be clear that it brings MongoDB with it, which is a real database service on your home server, and that v2 changed both the image tag and the schema.

The mistakes people actually make#

• Leaving the Proxmox enterprise repository enabled. A fresh install ships pve-enterprise.sources pointing at a subscription-only host, so every apt update fails and people conclude the free version is crippled. Disable that file and enable pve-no-subscription from download.proxmox.com. Proxmox 9 uses deb822 format, so one-line edits from 7.x guides do not apply.
• Publishing a management UI. Portainer mounts the Docker socket, which is root on the host, so keep it on the LAN. Its setup token expires five minutes after first start.
• Editing stacks in two places. A stack created in Portainer's editor lives in /data/compose and diverges silently from the copy in your git repo. Whichever ran last wins. Pick one source of truth.
• Assuming rootless containers can bind 443. They cannot, without setcap cap_net_bind_service=ep on rootlesskit or an ip_unprivileged_port_start sysctl. And without loginctl enable-linger, the whole thing stops when you log out.
• Running Proxmox on a consumer SSD. pmxcfs and ZFS metadata generate constant small synchronous writes. Wearout climbs several percent a month on DRAM-less QLC drives. Check Node > Disks for the Wearout column.

What to read next#

Start with Your first self-hosted server, which is about exactly the decisions that are hard to undo, then Choosing home server hardware and Mini PC vs NAS vs used enterprise for what to buy. Proxmox vs TrueNAS and Unraid vs TrueNAS settle the NAS question; Docker vs Podman and Portainer vs Komodo settle the runtime and management ones. Before your first compose file, read Docker Compose conventions, then price it with What a home server costs to run and Stack planner.