Step-by-step Docker MACVLAN and IPVLAN guide — give containers real LAN IPs for Pi-hole, Home Assistant, Scrypted. Host communication fix, Proxmox gotcha, multi-network Compose examples.
Complete Proxmox VE PCIe passthrough guide — GPU for Jellyfin transcoding, NVMe direct access, SAS HBA for NAS VMs. Kernel configs, vfio-pci, IOMMU groups, and working Proxmox VM settings.
Practical Docker container resource limits guide for homelabs — CPU quota/pinning, memory hard/soft limits, swap control, block I/O throttling, cgroup v2 differences, and Docker Compose examples.
Complete Linux sysctl kernel tuning guide for homelab servers. Network buffers, BBR congestion control, OOM management, fs.inotify limits, and Docker-specific sysctl configs.
VLANs separate layer-2 networks. Once a router has interfaces in those networks, firewall policy decides which routed connections are allowed. NAT does not grant permission through the firewall. This guide describes a staged RouterOS 7 lab workflow. It replaces the earlier universal paste-in script with explicit configuration fields and verification gates. Adapt each stage to the installed release and current configuration. Verification status Area Evidence and limits Documentation review Official MikroTik references reviewed on October 31, 2026. Examples Proposed lab settings, not a captured RB5009 or home-router deployment. Commands Read-only RouterOS inventory commands; no live parser or device execution performed. Runtime VLAN filtering, DHCP, firewall isolation, recovery, and WiFi mapping remain untested for this revision. 1. Preserve access and inventory the router Have a working console or separate recovery path before touching the bridge carrying management traffic. Save a configuration export and an appropriate protected backup outside the router, and document how to recover them. Exports can omit secrets and are not a complete substitute for a recovery plan. ...
Keeping Docker containers updated is the kind of chore you automate once and forget about — until a container silently runs a four-month-old image with five CVEs because you forgot to docker compose pull && up -d. Watchtower solves this. It watches your running containers, checks for new images, and restarts them with the latest tag — all on a cron schedule. But a naive “update everything” setup will break your database container and nuke your uptime. ...
Publishing a Docker port can make it reachable even when UFW says incoming traffic is denied. Docker routes published bridge-network traffic through NAT and forwarding rules; UFW’s host INPUT policy does not provide the access control you might expect. This guide separates two jobs: limiting where a port is published, and filtering which clients can reach it. Binding to a LAN address reduces exposure, but does not make UFW’s host-input rules control forwarded container traffic. ...
If your Docker homelab has more than three web services, you need a reverse proxy. Without one, every container exposes its own port, you manage certificates by hand (or skip HTTPS entirely), and changing a service’s URL means editing Nginx configs and reloading. Traefik solves all of this. It watches the Docker socket, discovers new containers automatically, provisions Let’s Encrypt certificates for any hostname you define via Docker labels, and handles middleware (auth, rate limiting, headers) without touching a static config file. ...
Use a small, complete stack to learn the deployment workflow. Then add only the networking, storage, and secret-handling features the application needs. Group services by ownership and lifecycle. A Compose project can contain several services, and you can operate on one service without restarting the whole project. Fixed container names are optional and can cause collisions or prevent scaling; service names are usually sufficient. Verification status Area Evidence and limits Technical review Official Docker documentation reviewed on October 31, 2026. Static checks Bash syntax and embedded Compose YAML checked. Runtime Docker unavailable in this review environment; no Compose CLI validation, image pull, HTTP request, or resource test executed. Example scope Disposable static HTTP lab on Linux, not a captured production stack. 1. Start with one complete project This demo uses BusyBox’s HTTP server and wget probe, a read-only content mount, loopback publishing, log rotation, and explicit resource limits. Use Bash and have curl installed on the host. ...
If you run Proxmox VE, you’ve got two container runtimes at your fingertips — LXC (built into Proxmox) and Docker (nested in an LXC or VM). Both are “containers” in the broad sense, but they solve different problems. Picking wrong means performance you don’t need or isolation you don’t have. This post walks through the decision criteria, backed by configs from an existing homelab running Proxmox 8.x with VLAN segmentation. ...