• 1 Post
  • 39 Comments
Joined 2 years ago
cake
Cake day: March 10th, 2024

help-circle

  • Mora@pawb.socialtoSelfhosted@lemmy.worldWhat's gluetun?
    link
    fedilink
    English
    arrow-up
    2
    ·
    19 days ago

    meaning if you disconnect from VPN for whatever reason, the other containers don’t suddenly send data over non-VPN network.

    Is that 100% certain? I think I can recall stories from 15 years ago, where torrent clients had kill switches and they still leaked data.










  • Absolutely, it is not necessary if the proxy can reach the service in other ways (e.g. a shared network). Some non-http services don’t like to be proxied though. Some constellations where the proxy is not on the same host as the containers may also make it necessary. My answer was based on the possibility to not have the same inside/outside port, not necessarily the need though😉




  • Unless I am missing some obvious setting: Restricted Kubernetes doesnt work like that. You have to run the container with a non-root UID (usually something upwards of a million). Non-root users however can’t reserve ports below 1025. Nextcloud builds on the default php-apache image which comes with the default apache ports.conf (Listen 80).

    So now this has to be overwritten either by making a custom build (which may require creating a custom build pipeline) or by mounting a new config file (e.g. via ConfigMap) else it wont start. Both are an additional update risk which now has to be documented and checked before updating in addition to changes from the normal nextcloud changelog.

    Similiar issues probably appear with rootless docker/podman unless you add extra capabilities, which is not possible in restricted kubernetes settings.