The generally don't containerize things because I'm too old and crusty, but segregating over several users is basically how it's been done for ages, and while it may not be particularly useful in your case, I consider it a reasonable best practice that costs you nothing.
Af an attack can escape a container a lot of companies worldwide are going to need to patch a 0-day. I do not expect that to be part of my threat model for self-hosted services.
Woah, no. Sure escaping via a kernel bug or some issue in the container runtime is unexpected, but I "escape" containers all the time in my job because of configuration issues, poorly considered bind mounts, or the "contained" service itself ends up being designed to manage some things outside of the container.
Might be valid to not consider it with the services you run, but that reasoning is very wrong.
Companies don't typically host multiple containers on the same host. So having a different user for them is less important than securing the connection between machines, since a given biat isn't particularly interesting. Attackers will still try to break out, so they have a backup.
As a self-hoster, you typically do the opposite. You run multiple services on the same host, and the internal network isn't particularly secure. So you should be focusing more on mitigating issues, and having each service run as an unprivileged user is one fairly easy way to do that.
Companies do run multiple containers/pods on the same host. That is what Kubernetes does
What kind of annoying things are you dealing with?
You don't have to put the user home in /var/lib either if that helps at all.
If you're already running rootless, I'd keep doing that unless there's a really good reason not to.
You shouldn't have any user home for your services, you shouldn't even allow them to login at all. They should only have group access to resources they need, and containers should restrict what directories they have access to.
It's always effort vs risk.
Since it's a do once and forget kind of thing I'd rate effort rather low.
As for risk in the worst case scenario a single service being compromised means all of them are with the attacker getting access to everything those services can access, including all the credentials. Will you make an effort to be on top of all the updates for all services?
As far as I'm concerned: At home all containers for each service get a separate user. At work every container does.
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!