In this particular case it wasn’t Docker that gave me the headaches, it was OpenWRT and wrapping my head around tagged VLANs.

Once you have the VLANs working on the router and the tagged interfaces up on the server, pointing a Docker network or an LXC at the eth0.100 interface is equally easy.

Now, when I first got the camera I was considering adding a secondary network card to the server and plugging the camera into that, so it would be directly hardwired into the machine running the NVR. If I had done that I was given to understand that taking ownership of a physical NIC would have been much easier with LXC than with Docker.

(We’ll never know because I couldn’t find the PCI network card.)

They’re already using Alma. There are more complaints not just the compile flag.

I think Wayland deserves some blame for taking the hard line on security. Every other security policy software lets you move the slider between max security or no security at all. But not Wayland, mommy knows best. Honestly, Wayland and Gnome deserver each other, both projects have the same insufferable approach where they think their users are idiots.

I mean, it wasn’t, but X11 also took like 20 years to get to where Xorg took over, and then Xorg has been puttering for another 15. Dunno what it is with Linux graphics that lends itself to such long development cycles. …I mean I do know, it’s some of the worst possible stacks that benefits the least from the bazaar approach.

Everything uses an app now

Speaking of which, that’s an issue in itself. The vast majority of “apps” are basically webviews. And yet I’ve seen banks deprecate their website in favor of app-only access, which firmly locks them (and us) into the Google and Apple ecosystem, even when the website and the bank UI are one and the same.

I guess they won’t learn until there’s a major outage. I’ve had apps installed from Play that refused to start and were unusable for a whole week because Google fucked up something accidentally about the dev’s account. If that were to happen to a bank’s app they’d understand the issue. Especially if it’s one of the banks that are exclusively online, like Revolut.

I’m honestly terrified to use ZFS. Roast me if you must. It has got to be the most arcane filesystem ever. I’ve tried learning it but it looks like a million obscure gotchas just waiting to fuck up your shit. Someone will post an error and people are like “ha ha you fucker yeah you didn’t shprutzle your cache vdevs sideways. Noob mistake. Oh your data is ruined btw”.

I mean look at that shit, “scrub repaired 0b with 5 errors”. I feel like Richmond looking at the server lights in IT Crowd. “Is it good that it’s doing that? Is it bad? I feel like I should be telling someone.”

There are a bunch of sites like apkmirror etc. that do that but eventually the large ones started enshittifying their service. On apkmirror for example you used to be able to just download the apk’s, now they’ve invented a special “format” that can only be installed through their app. Needless to say that was the end of that, I’m not keen on giving install capability to any more apps than I absolutely have to. (Zero is the ideal answer in case you’re wondering, but in practice it’s usually one, the system file manager. Any other app can download apk’s to /Downloads or go fuck itself.)

I don’t know about FOSS stores but banks have been known to make apps and publish them on alternate stores (Samsung, Huawei, Amazon) if there are enough users. Off the top of my head, Revolut and ING Turkey have apps on the Huawei app store right now.

IMO this needs a regulatory push. If the EU encourages or requests EU-based app stores with relevant twists (regional for example), they will appear, and Google will have to accept them, and the banks will put their apps there.

No app developer wants to deal with Google Play, it’s ass and a pain in the. If a company has a local audience (like a national bank) and they get a store that caters specifically to that country and it’s easier to publish (and cheaper) than Google Play, they will use it.

Local stores don’t have to accept all apps, either. They can be regulated stores that are only open to certain entities in that country like banks, government apps, telecom, utility, public transport etc. That would take care of the most immediate needs for their citizens and liberate those from Google’s control.

Hetzner + a HDD backup would basically get you to 3-2-1.

As a rule of thumb I’d keep the SSDs for live data and HDDs for backup.

Hetzner supports multiple good backup tools so you have options, and their prices are decent.

But please stick to Restic (or Borg) because they’re actually designed for backup and have built-in encryption, compression, deduplication, integrity, recovery etc. Don’t use “sync” tools like rsync.

Please, please, please assume that any of the SSDs and HDDs and cloud storage can dissapear at any time. Sit down and run some scenarios on paper, see what you’d do in each case.

Also a good idea is to sit down and categorize all your data on a scale of “how much my life would be over if I lost this”.

Sometimes super-essential data can be very small. For example a list of things to do in case of untimely demies (a “digital will”) can be a single text file that can be easily stored (encrypted) with family members. EncryptPad is a cross-platform text editor that uses open, standard encryption and can use a simple password.

If you need an extra form of backup media for ultra-essential data, Blu Ray optical discs are still an option. They are specifically designed for this and an USB optical writer is cheap.

Last but not least, store your “cold” backups in proper storage enclosures. For HDDs I like Orico padded boxes, for Blu Ray’s use a “CD wallet”.

I would second this. They key as a beginner I think is to choose a distro with a reasonable release cycle, give yourself some room to breathe.

Debian is too slow, their release cycle is basically 2 years. You could use Testing or Unstable instead of Stable but they’re not officially meant for public consumption and come with no guarantees. It’s great as a minimalist, rock-solid foundation for a server where stability is paramount but not great for any purpose with a faster pace of technology.

Arch-based distros on the other hand are extremely fast (“rolling distro”). Most of them sit in the range between “drinking from the firehose” (release packages as fast as they come in) to something like 2 weeks for a “slow” distro like Manjaro.

Distros like Mint, Fedora, Ubuntu, PopOS have ~6 month release cycles so you end up with reasonably recent packages but not too recent to catch all the new bugs.

I’ve always felt that Manjaro holds an untenable position on the Arch derivative spectrum. It’s a weird mix of difficult (inherited from Arch) and fragile setup out of the box.

The best way to use it is to accept all the decisions that were put into that setup and not tinker with it… but that runs counter to everything that Arch stands for. So it keeps attracting exactly the wrong kind of user, who will tinker and get frustrated, and eventually break it, and then go around telling everybody that it sucks.

IMO it works well for two types of users:

• A person who’s desktop-savvy but not particularly Linux savvy, who doesn’t have root rights. Provided someone else handles stuff like the initial install, adding apps, and running the updates for them.
• Someone’s who’s an experienced Linux user and appreciates the “Archiness” but has grown tired of babysitting their daily driver distro and wants shit to “just work” for the most part. But can also fix it if something happens.

It’s a rather specific niche.

He agreed and they’re now in the legal process of setting up the non-profit

Sort of. He said he was open to the general idea but raised a bunch of provisions and then ghosted everybody. I don’t think there’s been any further communication for the last few months.

It’s nice to see so many options in the Arch space.

I particularly like that they run the gamut between sink-or-swim and mommy-knows-best, so there’s something for everybody.

I like to call it “Arch for the lazy”.

It takes all sorts.

Not requiring a service running in root context.

I don’t think I’ve ever understood the distinction in this argument.

Isn’t systemd exactly that, a service running in root context?

I mean yeah you can technically run podman containers by hand as a non-privileged user but nobody does that, let’s be serious. Everybody uses systemd for management and autostart.

I really don’t understand how running a container through docker as a non-privileged user and dropping all caps is any different from doing the same through systemd + podman.

Tons of other services do that, ssh, CUPS etc.

If anybody can explain the difference I’d appreciate it.

It’s licensed Apache 2.0, which has been acknowledged as FOSS by the EFF.

AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.

Again, using the AUR as the standard for evaluating any Arch-based distro is really not cool.

Leaving that aside, the exact thing you’ve mentioned can happen on vanilla Arch, if the AUR package you are trying to install is based on Arch packages that you haven’t received yet. So you’d have to upgrade your system every time you’re trying to update or install an AUR package to be sure.

since Manjaro delays the upstream updates, this AUR package will break if its updated.

It won’t break, it will either succeed compiling or not with the older packages. If it succeeds, no harm done. If it doesn’t, you still have the previous version.

The unlikely corner case is that the new AUR package version relies on new API/features that only exist in newly released Arch packages and you absolutely must have the latest version right now. But then you’re using the wrong distro for that.

I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet.

Manjaro ships critical updates out of band, without waiting for regular batch updates.

It doesn’t “bypass your firewall”… it lets you shoot yourself in the foot. You’re asking it to open ports without specifying an explicit network interface so it opens them on all interfaces. Which includes opening up the firewall, because what’s the point of putting up a service and blocking it in the firewall.

Also, doing it by hand would be incredibly tedious. Docker automatically adjusts the rules to match the ports and interfaces to its private container netmasks, and brings them up or down as needed when the containers start/stop.

All you have to do is bind ports to localhost or to a private interface if you don’t want the service to be publicly exposed.

Beginners get bitten by this because they say ports: 9999:9999 instead of ports: 127.0.0.1:9999:9999/tcp like they should. Unfortunately most examples out there use the terse version and never explain why it’s bad.

I found myself trying to install upstream Arch packages.

You realize that’s how you broke, right? It’s like installing Debian packages on Ubuntu.

It relied on AUR some, which also messed things up.

How does it rely on AUR?

3rd party repos or AUR didn’t work, as its not in sync with upstream arch.

What 3rd party repos?

AUR works perfectly fine… when it works. AUR is a mess of its own. It’s chock full of malware as we speak and it’s not accepted as a reference on Arch or any other Arch-based distro. Saying an Arch distro “doesn’t work with AUR” is completely irrelevant at the best of times.

Not to mention the cert thing. Manjaro really did let certs expire many times. When I was new to linux, that took me forever to figure out.

Did you spend a lot of time reading the webpage, or?.. Because that’s the only cert that expires, the mirros and the forums never did. What exactly were you figuring out?

The website cert is the one that expires. It doesn’t impact anything else about the distro. The package mirrors are on different hosts (and certs). It’s a good distro, wish they’d sort out the kerfuffle with the founder (who’s the one holding them back).