RAM-only VPN: guide to using fast and secure, yet volatile RAM-disks for Docker container hosting reddit / selfhosted ---------------------------------------------------------------------- CoinsHost · 2023-11-17 16:32 When you're working with Docker containers, sometimes you don't need to keep data around for long, or maybe you need really fast access to your data, or you want to make sure that if someone messes with your server, your data vanishes for good. That's where RAM-disks can be super useful. [This RAM-only VPN guide](https://coin.host/blog/why- and-how-to-use-ram-disk-for-docker-containers-on-ubuntu-a- comprehensive-guide) shows how to use RAM-disks for hosting your Docker containers, making things faster and more secure, especially when you don't need to hang onto your data forever. ---------------------------------------------------------------------- ElevenNotes · 2023-11-17 19:03 Wait till you learn about Alpine Linux diskless mode. ---------------------------------------------------------------------- retrodaredevil · 2023-11-17 19:21 Is there any reason to not just instead use docker volumes that are configured to use tmpfs? I feel like you could get a more reproducible setup by using docker volumes here, and you wouldn't have to do any configuration outside of a docker compose file. I generally try to avoid docker volumes, except for tmpfs file systems. ---------------------------------------------------------------------- geek_at · 2023-11-17 20:20 Was gonna say the same. I've been running my file and compute servers over a Alpine USB ramdisk for years. I did use drives though but encrypted of course. Loved the fast boot and low latency IO of the system ---------------------------------------------------------------------- phein4242 · 2023-11-17 20:36 Still vulnerable for https://en.m.wikipedia.org/wiki/Cold_boot_attack ---------------------------------------------------------------------- NekoLuka · 2023-11-17 20:42 A cold boot attack is however very unlikely since it's almost impossible to pull off... ---------------------------------------------------------------------- phein4242 · 2023-11-17 20:43 Depends on the adversary and the popularity of the vpn server. ---------------------------------------------------------------------- ElevenNotes · 2023-11-17 22:53 Same, all my bare metal container nodes run diskless including all blockchain nodes. All Alpine. It's been a blast and easy as pie. Friends complain about broken SD cards on the raspbian and I have some RPi run Alpine diskless since years from the same SD. ---------------------------------------------------------------------- Skaronator · 2023-11-17 23:33 Depends on the platform. At least Ryzen Pro, Epyc and Xeons memory is fully encrypted ---------------------------------------------------------------------- isleepbad · 2023-11-18 00:13 This is a good idea. I have two pi's that are my redundant DNS servers and both run SDs. Will have to switch to alpine diskless now ... ---------------------------------------------------------------------- ElevenNotes · 2023-11-18 05:44 Just don't forget the host OS stores everything in RAM including itself. Depending on what you do and how much storage your containers use you need a big enough RPi. A 500MB container image will use 500MB RAM, it's best to have 4GB or 8GB RPi for that purpose. ---------------------------------------------------------------------- mirisbowring · 2023-11-18 08:48 And do you have a startup scripts that installs the necessary packets? ---------------------------------------------------------------------- ElevenNotes · 2023-11-18 09:44 You use LBU for that. You can backup all changes you made that will be added to RAM at startup. ---------------------------------------------------------------------- blind_guardian23 · 2023-11-18 10:02 lol no, thats marketing. There is no way to protect guests from hosts. ---------------------------------------------------------------------- Adorable_Rooster_576 · 2023-11-18 10:40 amd sev; intel tdx, sgx ---------------------------------------------------------------------- blind_guardian23 · 2023-11-18 10:50 thats bs tailored for cloud-providers so they can pretend they cant access your memory or data. there is no way to work on encrypted data, if you put the key next to your lock its fine, just dont pretend ITS more secure. ---------------------------------------------------------------------- Adorable_Rooster_576 · 2023-11-18 11:20 you clearly don't know how these technologies work ---------------------------------------------------------------------- blind_guardian23 · 2023-11-18 11:22 because you say so? or do you know how computer work? ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-18 12:23 It seems you dont know mate. With physical access to the Servers they got the encryption key. Its the same as putting your password on the monitor ---------------------------------------------------------------------- Adorable_Rooster_576 · 2023-11-18 13:21 encryption keys are stored on the cpu chip and never leave it. how is physical access is supposed to help you with that? are you going to disassemble the cpu and read its internal state? ---------------------------------------------------------------------- eric_glb · 2023-11-18 13:50 Nice article, thanks! ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-18 13:55 All downfall attacks can do it. And if the server is patched you need Hardware access to downgrade it. ---------------------------------------------------------------------- Adorable_Rooster_576 · 2023-11-18 14:05 there is no perfect security, new vulnerabilities will always be discovered, for any somewhat complex system. side channel attacks are not easy to execute in practice and they get fixed as well. if the adversary downgrades the server you will be able to detect this during attestation. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-18 14:14 Sure you will detect it, the point is => every hoster """"could""'""" get your Data. But we talk here about theory, just if its possible or not. In the Real World, no hoster cares about your Data and doesnt Touch your Server if nothing is broken. My Statement is => its possible, but you probably have a higher chance beeing hit by a bus than, someone Hardware hacking / exploiting your shit ---------------------------------------------------------------------- Adorable_Rooster_576 · 2023-11-18 14:26 well then we mostly agree on things, except "Its the same as putting your password on the monitor" - it's not the same. while these technologies are not perfect, they significantly increase the bar for the adversary to gain access to your data. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-18 14:29 Fair enough, thats true. ---------------------------------------------------------------------- bloody_ass_ · 2023-11-18 14:39 RemindMe! 3 days ---------------------------------------------------------------------- bloody_ass_ · 2023-11-18 14:44 RemindMe! 3 Days ---------------------------------------------------------------------- RemindMeBot · 2023-11-18 14:45 I will be messaging you in 3 days on [**2023-11-21 14:44:17 UTC**](htt p://www.wolframalpha.com/input/?i=2023-11- 21%2014:44:17%20UTC%20To%20Local%20Time) to remind you of [**this link **](https://www.reddit.com/r/selfhosted/comments/17xiymd/ramonly_vpn_g uide_to_using_fast_and_secure_yet/k9rp260/?context=3) [**CLICK THIS LINK**](https://www.reddit.com/message/compose/?to=Remin dMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2F selfhosted%2Fcomments%2F17xiymd%2Framonly_vpn_guide_to_using_fast_and_ secure_yet%2Fk9rp260%2F%5D%0A%0ARemindMe%21%202023-11- 21%2014%3A44%3A17%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)] (https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete %20Comment&message=Delete%21%2017xiymd) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remind mebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?t o=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside %20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Yo ur Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot& subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](ht tps://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot %20Feedback)| |-|-|-|-|