Security

Docker Supply Chain Security — SBOM, Image Signing, and Verification

Practical guide to securing your container supply chain in the homelab: generate SBOMs with Syft, sign images with Cosign, scan for vulnerabilities with Grype, and enforce Docker Content Trust.

acme.sh Let's Encrypt Certificates for Homelab Docker Services

Automate Let’s Encrypt SSL/TLS certificates in your homelab using acme.sh and Docker. Includes DNS-01 wildcard certs, auto-renewal, and integration with Traefik, Nginx Proxy Manager, and Caddy.

Linux auditd Security Auditing — Monitor Proxmox and Docker Activity

Configure Linux auditd to watch container starts, file changes, and Proxmox host activity. Includes auditctl rules, ausearch queries, and Docker integration for comprehensive homelab security auditing.

Docker nftables Firewall Backend — Native Firewall for Containers

Migrate Docker from iptables to the native nftables firewall backend. Configure docker daemon.json for nftables on Debian 13, test port publishing, and troubleshoot common migration issues.

Docker Hardened Images — Verify Compatibility Before Migration

Compare exact image digests, inspect migration requirements, and test application recovery before adopting a hardened image.

Gluetun VPN Gateway — Route Docker Containers Through WireGuard

Route specific Docker containers through a WireGuard VPN while keeping the rest of your stack on the local network. Full Gluetun Docker Compose setup with kill switch, qBittorrent integration, and Traefik compatibility.

Docker Image Security Hardening — Multi-Stage Builds and Distroless

Harden your Docker images with multi-stage builds, distroless base images, and runtime security options. A practical guide to reducing image size and CVEs in your homelab.

Fail2ban Docker Deployment — SSH and Service Protection for Homelab

Protect your homelab from brute-force attacks with Fail2ban. Deploy on bare-metal for SSH and configure custom jails for Docker containers using Traefik and Nginx logs with email alerting.

Linux Kernel CVE-2026-31431 — Verification and Remediation for Docker Hosts

Verify host-kernel patch status for CVE-2026-31431, review Docker runtime restrictions, and validate remediation without assuming every container is exploitable.

HAProxy Docker Load Balancer — Homelab Reverse Proxy Guide

Step-by-step guide to deploying HAProxy with Docker Compose for TCP/HTTP load balancing in your homelab — SSL termination, health checks, stats monitoring, and backend failover with real configuration files.