Docker rootless and Watchtower and some general questions about Docker

Don_Camillo
2023-01-20T01:34:49Z

I finally decided to accepted that my interest in working and playing with computers and servers is worth to spend some money on. So I ditched my old box in the corner and with it all my fights with my ISP, their NAT, dynamic DNS and all that and got myself a VPS and 1 TB storage solution for less than I would have paid a static IP with my ISP.
Best decicion ever :-)

So I'm getting into Docker a bit, just because it's just so easy to get Nextcloud running. I used native Caddy as a reverse proxy, because if I got this "machine" there I will use it for other things as well, so make it right from the beginning. And I used native b.c I did not yet understand bridge/host mode and installing caddy native seems easier.
Then I fought for one day with CIFS and the nextcloud gui to get the semantics right to get my storage solution accepted as external storage.
Then I set up Jellyfin with Docker because why not. As well through caddy.
Then I fucked something up and was like, fuck it, lets start again this time for real :-P
I wiped my VPS clean (chose ubuntu again) set up and hardend ssh + sudo installed Docker, and then I found out about docker rootless and in the docker docs it's mentioned that it is/might be more secure, so I set up docker rootless and installed all the rest again.
And then I was like, hmm, do these Docker Images/Containers update themself? Like snap did?
It seems not, so I looked for a solution and found watchtower. And now I wasted another day trying to get watchtower to run, and I just can not.

I tried so many variations of the run command now most recently I tried:

docker run \
--name watchtower \
-v ${DOCKER_SOCKET_PATH}:/var/run/docker.sock \
containrrr/watchtower

time="2023-01-20T01:17:41Z" level=error msg="Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?"
time="2023-01-20T01:17:41Z" level=info msg="Waiting for the notification goroutine to finish" notify=no

/run/user/1000/docker.sock exists, I own it, i tried connecting to it through docker -e and containrrr/watchtower --host "unix:///run/user/1000/docker.sock"
I dont now what to try more and I'm at my end with my ddg-fu as well.

And now while proofreading this, I read everything again and decided to try something again and it just worked...

docker run \
--name watchtower \
-v /run/user/1000/docker.sock:/var/run/docker.sock \
containrrr/watchtower

seems like the environment variable was not set. But I'm shure I tried that before and it did not work... ghost in a machine :-)

So thats where I'm at. I have to say it was a lot of fun and doing and learning all that tingled my brain in a funny way :-)

But now I have some questions for my much more experienced Tildes-friends:

Do I even need watchtower? because I'm not actually interested to connect to my server regularly to do the updates/maintenance.

Was switching to docker rootless even a good idea? it seemed so reading the docker installation docs, but just now I read the Archwiki and there it seems it has some heavy security implications, so I made the security situation acutally worse by thinking making it better.

How do I get this watchtower thing to fucking work? (only if I actually need it)

I very much appreciate all further/other advise, tricks, recomendations, questions and discussion as well :-)

Comments URL: https://tildes.net/~comp/144c/docker_rootless_and_watchtower_and_some_general_questions_about_docker

Votes: 4

Comments: 7