Docker appliance recommendations? reddit / selfhosted ---------------------------------------------------------------------- cp8h · 2023-11-15 21:15 I currently have a Docker setup that I’m really happy with consisting of a NUC running minimal Ubuntu server. I only run 5 containers but kinda need them to be pretty reliable (i.e. my whole home becomes pretty annoying to use if HA has downtime): * HomeAssistant * ESPHome * MQTT * Scrypted * Static nginx instance My desire for reliability is at odds with my stronger desire to avoid spending time on maintenance - I work in front of computers the last thing I want to do is fix my own IT woes! Therefore to avoid having to perform manual updates etc I have a small cron task that weekly: * Does a full unattended apt upgrade * runs “docker compose pull” and “docker compose up -d” for all containers. This is all done with via a YOLO SLA approach with no continual backups and no rollback possibilities 🤦‍♂️ This is the bit that scares me - everything has been (surprisingly) fine for around 18 months but I am fully aware one bad update could really ruin my day especially with no downgrade path. I was wondering if anyone could recommend a more appliance based system that I could use to essentially monitor, upgrade and manage both the host OS and containers. My googling isn’t turning up much unfortunately. Ideally I’d like features such as: * Docker compose support * Automated backups (preferably with S3 support) * Unattended container upgrades * Container health monitoring. * Rollback support if an upgrade goes bad * A nice web UI I don’t care if this is software/hardware, free/paid (within reason) I just want something really simple that is designed for reliability and uptime. Many thanks ---------------------------------------------------------------------- EndlessHiway · 2023-11-15 21:30 Why not keep what you have and start backing up your docker containers and data? ---------------------------------------------------------------------- thekrautboy · 2023-11-15 21:34 > Therefore to avoid having to perform manual updates etc I have a small cron task that weekly: > Does a full unattended apt upgrade > runs “docker compose pull” and “docker compose up -d” for all containers. Terrible idea. Very recent discussion about automatically updating: https://www.reddi t.com/r/selfhosted/comments/17vmcdn/are_there_any_concernsrisks_to_usi ng_watchtower/ > This is all done with via a YOLO SLA approach with no continual backups and no rollback possibilities Then why are you doing it? You say you dont want to waste time off work fixing IT problems at home, yet this will lead to exactly that. > I just want something really simple that is designed for reliability and uptime. No software in the world can protect you from yourself. Its up to you to configure and maintain it. Yes there are things that can be more hands-off than others. But nothing exists that is plug-and-play and you never do anything about it at all. Maybe you should simply buy a off-the-shelf NAS unit, configure a backup system and run your things off there. Try /r/Synology /r/QNAP and such. ---------------------------------------------------------------------- Gel0_F · 2023-11-15 22:07 If everything works and stable why do automatic weekly updates? You can limit update to monthly or 6-weekly. You can backup settings / docker ahead of it and then spend more time to ensure that it went right. ---------------------------------------------------------------------- ZaxLofful · 2023-11-16 01:24 Just use a NUC! ---------------------------------------------------------------------- thundranos · 2023-11-16 07:07 Why not run your os in a vm on proxmox and backup the vm to another storage and perform periodic snapshots to obs? ---------------------------------------------------------------------- tenekev · 2023-11-16 10:04 I don't think such a thing exists. It clashes with the idea of selfhosting. You can shoestring a solution that will do what you ask but it won't be an appliance/application that someone else maintains. Weekly unattended apt and docker updates are actually worse than manual ones. I update maybe once a month. Watchtower takes care or checking and downloading new updates but I'm the one to redeploy containers with the new image. The closest thing that comes to mind is [Portainer](https://docs.portainer.io/start/intro). It offers point 1, 4, 6. The Business edition has update checking built into the UI. The Community edition lacks update checking but you can substitute it (and improve on it IMO) with [Watchtower](https://github.com/containrrr/watchtower). Watchtower can check and download updates while you just click redeploy. For backups, try [Nautical Backup](https://github.com/minituff/nautical-backup) This leaves only rollbacks unaddressed. But realistically, on a hands- off box, you won't need it and if you do, copying over from the backup will be enough. ---------------------------------------------------------------------- cp8h · 2023-11-16 12:16 Thanks Nautical backup looks really interesting I’ll have a go at adding that to my setup. ---------------------------------------------------------------------- cp8h · 2023-11-16 12:18 Thanks Nautical backup looks really neat and minimal (something I’ve been annoyed with in the past) I’ll have a go at implementing it to see if that can remove some of the fears ---------------------------------------------------------------------- Morgennebel · 2023-11-16 15:17 Check out Cosmos Server. ---------------------------------------------------------------------- winston161984 · 2023-11-16 18:24 CasaOS can give you the nice web interface - along with terminal access in the browser and one click container updates. ---------------------------------------------------------------------- ervwalter · 2023-11-16 18:42 I accomplish what you are looking for more or less, but it's not an appliance--it's a system of tools that I setup myself and maintain (which I enjoy). But it sounds like you want to avoid doing that. My solution includes: * A small Proxmox cluster so that if any single host dies, VMs can move to another host. This cluster approach is only necessary to protect against hardware failure--if that isn't something you care to protect against initially, you can do all of the rest with only a single Proxmox host * On that proxmox cluster, a few VMs. I run these are VMs because that makes it super easy to snapshot each VM before making experimental changes (i.e. trivial rollback) and super easy to backup each VM to my NAS (again easy rollback for unplanned problems that get introduced without me noticing right away) * A VM for Home Assistant. I prefer Home Assistant OS to running it in a docker container myself. It is easier for me to manage this way. * A VM for just scrypted. Scrypted is easier to deploy if you can put it in network host most which could in theory interfere with other docker containers, so I keep it on an isolated VM. Extra VMs are easy with proxmox so there is little downside. * A VM running docker where most everything else runs. Docker containers are managed via portainer using docker-compose files * Docker compose files (called "stacks" in portainer) life in a private github and when I make changes it github, they portainer pulls them down and updates the running containers with the new compose file. * I run the Renovate bot on my github repo which notices when my containers are out of date and creates a Pull Request with a recommended upgrade. I can either manually approve those or create rules to auto merge them. * Because all the docker-compose files are in a git repo, rolling back after a problematic upgrade is usually trivial (unless the data got converted as part of an upgrade which might require restoring a VM backup in the worst case) * A VM running ubuntu I use for development (connected to remotely with Visual Studio Code). This is also the linux VM that I use to launch ansible playbooks to remotely do things like apt upgrades on the other VMs (HA excluded). * One of the containers I run is uptime-kuma which monitors general health of all my other services and notifies me via telegram and email if a VM or container dies or starts to look unhealthy. * Another container I run is homepage which is a dashboard that lets me get to all my services and also has widgets to surface more health information. This is not at all turnkey and took some time to put together, but I find it to be relatively low ongoing maintenance now that it is setup. And I have pretty good high availability and great rollback/recovery support in the event that something goes sideways with an upgrade or some configuration change I make manually. ---------------------------------------------------------------------- cp8h · 2023-11-16 19:43 This sounds like a great setup 👍 thanks for sharing. Upfront setup time is absolutely on the table if it means lower ongoing maintenance. I especially like your concept of using github to manage “approval based” upgrades. How do you manage upgrading each VM guest OS and proxmox itself? ---------------------------------------------------------------------- ervwalter · 2023-11-16 20:35 Once a month or so on a weekend, I use ansible to run 'apt update' and 'apt upgrade -y' on every linux machine (first the VMs, then the proxmox hosts). I have another ansible playbook that will reboot the VMs automatically so I don't have to do each one individually. Proxmox hosts I reboot one at a time so that they aren't all down at the same time. Then if everything seems to still be working smoothly (it almost always is since most of the OS-level updates don't interact with my docker containers), I forget about it for another month or so. In the rare cases where there is some problem, I start troubleshooting. ---------------------------------------------------------------------- VirtualP1rate · 2023-11-16 22:01 I have a docker compose file I keep in a github repo. I has everything I need in it. I can grab any server off the shelf slam an OS on it, mount my nfs share, git clone, docker compose up and I am done. I am in the boat where I keep everything in a compose file instead of multiple files. It works for me, I love it.