Docker Multi-Stage Builds — Practical Guide for Homelab
Master Docker multi-stage builds to shrink production images from 1.2GB to under 50MB. Covers Go, Python, and Node.js patterns with real Dockerfiles and build cache strategies.
Security
CrowdSec Docker Deployment — Collaborative IPS for Your Homelab
Deploy CrowdSec with Docker Compose and Traefik to protect your homelab services with collaborative threat intelligence. Covers the LAPI agent, bouncers, collections, custom scenarios, and remediation pipeline with real configs.
Vaultwarden Docker Deployment — Self-Hosted Password Manager Guide
A staged Vaultwarden setup with explicit HTTPS, signup and recovery boundaries.
Pi-hole and Unbound — Recursive DNS with Ad Blocking for the Homelab
A staged native Linux resolver workflow with explicit privacy limits, client tests, and rollback.
Self-Hosted AI — Deploy Ollama and Open WebUI in Your Homelab
Deploy Ollama and Open WebUI on your homelab hardware for private, self-hosted AI inference. Covers Docker Compose setup, GPU acceleration, model management, remote access, and production hardening tips.
Systemd Service Hardening — Lock Down Linux Services in Your Homelab
Hardening systemd service units in your homelab isn’t just for production servers — it’s how you prevent one compromised service from taking down your entire host. This guide covers sandboxing, capability drops, filesystem isolation, and resource limits with real unit files you can use today.
Docker Container Security — Non-Root Users, Capabilities, and Runtime Hardening
Hardening Docker containers in your homelab isn’t optional — it’s how you prevent container escapes and privilege escalation. This guide covers non-root users, capability drops, read-only filesystems, and seccomp profiles with real Compose configs.
Cloudflare Tunnel with Docker — Expose Homelab Services Securely
Run Cloudflare Tunnel in Docker to expose homelab services through Cloudflare’s edge. No open firewall ports, automatic HTTPS, and per-service ingress rules via a single cloudflared container.
Docker Socket Proxy — Restrict API Access and Verify the Policy
Configure documented socket-proxy endpoint controls, keep the proxy private, and test permitted and denied requests.
Windows Server 2025 Secondary Domain Controller — Add DC02 to Existing AD
Step-by-step guide to adding DC02 as a secondary Windows Server 2025 domain controller: preparation, AD DS promotion, DNS, Global Catalog, replication checks, SYSVOL validation, and client failover testing.