Guides
Reverse proxies, remote access, backups that restore, identity, updates, storage layout and hardware. The cross-cutting parts you have to get right once, then stop thinking about.
Getting started
Docker Compose conventions that survive year two
One directory per service, bind mounts under one root, pinned tags, and why latest is a data-loss risk.
PlatformShould you run Docker in an LXC container or a VM on Proxmox?
VM for stacks you would miss, LXC only for low-spec or throwaway ones. No live migration, a shared kernel, and two feature flags explain why.
Getting startedYour first self-hosted server: the decisions that are hard to undo
The OS, the disk layout, remote access and backups are hard to undo. Everything else is an afternoon.
Getting startedWhen not to self-host
Five categories where self-hosting is a bad trade, one decision test, and the cases where it genuinely wins.
Access and networking
DNS, subdomains and split horizon for self-hosters
The naming scheme decision, wildcard records, split-horizon resolution, and the rebinding protection that breaks all of it.
NetworkingWhy doesn't UFW block Docker's published ports?
Docker rewrites the packet in the nat table, so it goes to FORWARD and never meets UFW. Publish nothing, bind 127.0.0.1, or filter on the container port.
NetworkingWhy can't my Docker container resolve DNS?
Docker drops loopback resolvers on the default bridge and swaps in 8.8.8.8. The container's resolv.conf names the cause.
NetworkingHow do you stop Docker networks clashing with your LAN or VPN subnet?
Why a new stack can swallow your VPN's subnet, why the 31st network fails, and the one daemon.json block that fixes both.
NetworkingWill your reverse proxy survive Let's Encrypt's 45-day certificates?
Caddy, Traefik and NPM renew in time on defaults. Old acme.sh, 60-day cron jobs and a lowered Traefik duration break.
NetworkingHow does a Docker container reach a service on the host in Linux?
Name not found, connection refused or a timeout: each is a different layer. How to tell which, and the fix for each.
NetworkingRemote access without port forwarding
Four routes into your home network, what CGNAT does to three of them, and the mistake almost everyone makes first.
NetworkingReverse proxy and TLS, done properly
One proxy in front of everything: the ACME challenge decision, the headers that matter, and working Caddy and Traefik config.
Data, backup and recovery
Backups that actually restore
The difference between a backup and a sync, append-only repos, snapshot ordering, and a restore rehearsal with a number attached.
DataBacking up a running database without corrupting it
Torn reads, WAL files, pg_dump versus snapshots, and why a filesystem snapshot is safe when a copy is not.
DataMoving a self-hosted service to a new machine
The six-step move, the file ownership trap that breaks most migrations, and the keys you must bring with you.
DataShould self-hosted apps share one Postgres container or each run their own?
Eight apps' Postgres requirements side by side. Their own compose files pin 14, 16 and 18, so one shared server couples every upgrade.
StorageStorage layout: ZFS, btrfs, mdadm, or just one disk
The write hole, the resilver window, the RAM appetite, and one recommendation per situation.
DataHow do you upgrade Postgres to a new major version in Docker Compose?
Postgres 14 ends on 12 November 2026. The dump and restore that works, the 18 mount path change, and the checksum mismatch that blocks pg_upgrade.
Running it day to day
Why does my Docker container get permission denied on a bind mount?
The container's uid does not own the host folder. Why named volumes hide it, why Docker makes root-owned folders, and the fix in order.
PlatformWhy doesn't depends_on wait for my database in Docker Compose?
depends_on waits for a started container, not a ready database. The healthcheck that fixes it has two traps, and a reboot ignores all of it.
PlatformWhy aren't my .env variables reaching the container in Docker Compose?
.env fills in the compose file; env_file and environment feed the container. Five traps measured, from the stray $ to a restart that keeps old values.
PlatformWhy does my Docker container fail with exec format error?
The image was built for another CPU, or the entrypoint script has no shebang. One inspect command tells them apart, and a stale local tag is the usual culprit.
PlatformWhat does Docker exit code 137 mean, and was it out of memory?
137 is SIGKILL, not out of memory. A docker stop timeout produces the same code, and the OOMKilled flag misleads in two cases.
OperationsDo Diun, Watchtower and docker compose pull count against Docker Hub's pull limit?
HEAD checks are free and up-to-date pulls cost nothing. watch_repo and GET-based scripts are what hit the limit.
PlatformWhy does Docker say port is already allocated?
Another running container owns that exact address and port. Stopped ones hold nothing. How to find the holder in two commands.
OperationsThe minimum viable monitoring stack
Tier one is an off-box uptime check, disk alerting and one channel you read. Most homelabs stop there.
OperationsA security baseline for a home server
Nine things, in order of what actually gets people compromised. Plus the popular advice you can skip.
IdentitySingle sign-on for self-hosters: the honest state of it
Three mechanisms, one of which actually works. Plus the account-linking trap and the lockout you have not planned for.
OperationsAn update strategy that does not lose data
Notify, do not auto-update. Pin tags, snapshot before upgrading, and know which projects cannot be rolled back.
PlatformWhat is filling /var/lib/docker, and what is safe to delete?
Logs, dangling images, build cache, volumes or the containerd store. How to tell which, and which prune deletes what.
Hardware and cost
Choosing hardware for a home server
Three builds, real prices, and why CPU cores are the last thing you should pay for.
HardwareGPUs, transcoding and local AI: what hardware you actually need
Quick Sync handles your 4K streams for 10 W. A model that fits in VRAM is a different purchase entirely.
HardwareMini PC, NAS or used enterprise gear
Watts, dollars per year and drive bays, for the three shapes a home server comes in.
HardwareWhat a home server actually costs to run
The five-year arithmetic, and the point at which self-hosting stops losing money.