Do you host all services just from your root account with docker or do you seperate the services between user accounts with rootless docker?
Do you use podman or docker?
It’s easier to just host everything from root with normal docker, but seperating services into special user account is probably way saver, at least as far as i know. Do you think ist worth going the extra step or do you just trust docker and your containers to not get exploited?
Last but not least do you use an automatic update service for your host system and your containers?
+1 for rootless Podman. Kubernetes YAMLs to define pods, which are started/controlled by systemd. SELinux for added security.
Also +1 for not using auto updates. Using the
latesttag has bit me more times I can count, now I only use it for testing new stuff. All the important services have at least the major version as tag.