Nobody thinks about Docker backups when everything is working. The dashboard loads. The media server streams. The reverse proxy behaves. The database container has a cute little green “healthy” status. Life is good. Then one day you run an update, delete the wrong volume, lose a disk, break a Compose file, or discover that the “temporary” container from six months ago was actually storing something important. That is when Docker stops feeling magical and starts feeling like archaeology. This post is a practical guide to backing up Docker containers on a Linux home server . Not enterprise disaster recovery. Not Kubernetes. Not a 40-page policy document. Just a realistic backup plan for a homelab running Docker Compose, bind mounts, named volumes and a few services that became more important than expected. The main idea is simple: You do not really back up containers. You back up the things needed to recreate them, plus the data they would destroy your weekend by losing. ...

SSH is usually the front door of a Linux home server. Last updated: May 27, 2026 And if that door is reachable from the network, something will eventually knock on it. Sometimes it is you. Sometimes it is a script from the other side of the planet trying admin , root , test , ubuntu , oracle , minecraft , and whatever else is in its boring little dictionary. This is where Fail2ban is useful. Fail2ban watches logs for repeated failed login attempts and temporarily bans the source IP address using firewall rules. It is not magic, and it is not a replacement for proper SSH hardening, but it is a very useful extra layer for a Linux home server. This post is a beginner-friendly guide to Fail2ban for SSH on a Linux home server . The goal is not to build an enterprise security platform. The goal is to reduce brute-force noise, protect SSH, and avoid locking yourself out of your own machine. If you are building a secure Linux box, also see my Linux Home Server Security C...

Running Lynis on a Linux home server is easy. Knowing what to fix first is the useful part. Last updated: May 27, 2026 You run one command, wait a little, and suddenly your server has a hardening score, warnings, suggestions, and a long list of things you probably ignored for too long. That is exactly why Lynis is useful. It is also why you should not treat the report like a checklist that must be fixed blindly in one evening. This post is a practical Lynis hardening checklist for Linux home servers . It is written for small homelabs, old desktops, mini PCs, laptops used as servers, cheap VPS boxes and Docker hosts running useful services at home. The goal is not to get a perfect Lynis score. The goal is to understand what matters, fix the high-value issues first, and avoid breaking a working server in the name of “security”. Lynis is an open-source security auditing and hardening tool for Linux, Unix and macOS systems. It scans the machine and gives suggestions to improv...

Docker is one of the best and worst things that can happen to a homelab. Best, because it makes self-hosting ridiculously easy. Worst, because it also makes it ridiculously easy to expose random containers, run things as privileged, mount dangerous volumes, forget updates, and pretend that “it is inside a container” means “it is safe”. It does not. Containers are useful. Containers are convenient. Containers are not magic security boxes. This post is a practical Docker security guide for homelab beginners . Not enterprise Kubernetes theory. Not compliance paperwork. Just the things I would check on a Linux home server running Docker, especially if that server is always on and slowly collecting services like a digital junk drawer. The goal is simple: Stop exposing random containers and understand what your Docker host is actually doing.

Cheap home servers are great. Last updated: May 21, 2026 You take an old Dell , Lenovo, ThinkCentre, NUC, laptop, Raspberry Pi or whatever was cheap enough not to hurt the wallet, throw Linux on it, add Docker, maybe some file sharing, maybe a media server, maybe a few scripts, and suddenly it becomes “production”. Production in quotes, of course. Because at home, production usually means: if it dies, someone complains; if the disk fills, something stops working; if SSH gets exposed by mistake, the internet starts knocking; if updates are forgotten for six months, the box becomes a tiny museum of old packages. So this is my practical Linux home server security checklist . Not enterprise paranoia. Not “install 47 tools and build a SOC in the kitchen”. Just sensible hardening for a cheap homelab machine that is always on and probably doing more than it should. The goal is simple: make the server boring. Boring is good. Boring means patched, firewalled, backed...

Updated in 2026: this article was originally written in 2020 and focused mainly on Prospector and Bandit. The updated version keeps that original idea, but adds a more modern Python static analysis workflow using Ruff, Bandit, Mypy and Pylint. Python scripts are dangerous when they become invisible. Not dangerous in a movie-hacker way. Dangerous in the boring real-world way. A small script starts as a quick helper. Then it ends up running from cron. Then it touches backups, logs, Docker containers, firewall data, API keys, file permissions, or some random directory on a Linux server. Months later, nobody remembers exactly what it does, but everyone hopes it keeps working. That is where Python static code analysis is useful. Static analysis checks code before you run it. It can catch common bugs, insecure patterns, style problems, type mistakes, unused imports, dangerous function calls and other issues that are easy to miss when a script is small and “just works”. In the or...

I first wrote about OpenCanary years ago, and that old version badly needed an update. The tool is still useful, but the way I would deploy it in a home lab today is different: newer Ubuntu versions, Python 3, Docker as an option, cleaner logging, and no copy-pasted example credentials that look like something someone might actually reuse. This guide is the updated version: how I would set up an OpenCanary honeypot on Ubuntu in 2026 for a small home network or homelab. The goal is not to trap random people on the internet. The goal is to create a quiet internal warning system: a fake service that should never be touched, so any connection to it deserves attention. Important: this is a defensive security guide. Run OpenCanary only on systems and networks you own or have permission to monitor. Do not expose a honeypot to the public internet unless you understand the logging, legal, abuse and maintenance implications. If you are building a Linux home server security setup fro...