ive tested both hydrus and monbooru’s ram consumption, and these were the results:
❯ ps aux | grep hydrus ghost_u+ 38817 0.0 0.0 3748 2204 ? S 21:45 0:00 /usr/bin/bwrap --args 40 – hydrus_client ghost_u+ 38832 0.0 0.0 3852 1356 ? S 21:45 0:00 /usr/bin/bwrap --args 40 – hydrus_client ghost_u+ 38833 4.2 3.5 4824044 261588 ? Sl 21:45 0:09 python3 /app/bin/hydrus_client ghost_u+ 39613 0.0 0.0 231268 2420 pts/0 S+ 21:48 0:00 grep --color=auto hydrus
❯ docker stats monbooru --no-stream CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS 0a46831f9470 monbooru 0.00% 19MiB / 7.047GiB 0.26% 13.6MB / 54.3MB 14.4GB / 5.51GB 20
well, i dont think it’s the same. docker offers an easier way to install and store this kinds of apps. for example i installed the arr stack which takes a bit of time configuring it, ive done it before but not with docker and i lost my data on reinstall, i know you can keep it but its not the same. docker stores all the dependencies there. you just docker compose up on a new system and you got the same app.
regarding flatpak, also another issue. flatpak is distro agnostic, it’s not about being the shiny hype thing, but offering a solution to the linux ecosystem where devs needed to provide different package manager options. could there be another thing? yeah, but that could happen with apt too theoretically.
So, how do I use iptables to open ports for docker apps? Usually I install a thing that requires for example port 8080, and I open the port 8080. Does docker respect iptables?
this is my compose file for monbooru, ive added some comments to show you what each thing does, if you want to change the port simply change the the first 8080. all of these value:value mean that the first value is your machine, and the second one inside the container. that’s it, create a folder named monbooru, create a file named docker-compose.yml, add the thing i gave you below and save it. with your terminal cd into the directory where the compose file lives and do docker compose up -d and it will download the image and it’ll be runnin. believe me, i used to prefer to not use docker because i thought, ohh i have to learn to use docker, but honestly i wish i knew it was this simple long before so i wouldnt have done so many installs of some apps where i’ll lose my data
services: monbooru: container_name: monbooru image: ghcr.io/leqwin/monbooru:latest ports: - "127.0.0.1:8080:8080" user: "1000:1000" security_opt: - no-new-privileges:true - label:disable cap_drop: - ALL volumes: - /PATH/TO/YOUR/GALLERY:/gallery - ./config:/config #this one - ./data:/data #and this one make the app data live next to the compose file, so that you can move the folder and the data stays there - ./models:/models #use this if you add autotaggers, otherwise delete it, i'd try it without them first environment: - MONBOORU_SERVER_BIND_ADDRESS=0.0.0.0:8080 healthcheck: test: ["CMD-SHELL", "curl --fail --silent --max-time 5 http://localhost:8080/health || exit 1"] interval: 30s retries: 3 start_period: 10s timeout: 5s restart: unless-stoppedCan you set up docker in a way that it does not mess with my firewall?
Docker automatically opens ports your containers need through iptables. Because of this, it bypasses rules set by
ufw, which is great.Podman does not do this afaik, and since it only runs rootless it’s a lot less risky as well.