primeval_god

If you enable the debug option the plugin should print the commands it uses to the system log when a button is clicked. This is expected behavior. At this time dockerman does not correctly display the update status of containers created by other plugins such as compose and the update button it provides cannot be used to update such containers..

PGID and PUID have to be supported by the container. In the compose file above i see that the environment section for each container has empty PGID and PUID entries. Did you add those in or were they there already? If they were already there then you just need to assign the correct values to them.

Yes. The unraid os does not make use of users and groups the way generic linux distros do. For docker purposes you should use the user nobody "PUID, PGID 99 and 100"

You should look into the swappiness setting. It controls how aggressively memory is swapped out.

Yes swap is slower than ram and leaning on it to much will bog a system down. Using swap as insurance to prevent applications for crashing if they temporarily reach the limits of system ram is a good use case. However if you have multiple applications that are just eating up extra ram all the time its possible that are misconfigured somehow. Additionally you mention that you have the swap on raid 5, how so? If you mean your swapfile is in your main array I would recommend against that. Ideally swap should be on a fairly fast pool drive, and it doesnt really benefit from redundancy.

What kind of roadblocks have you run into?

In general the safest and recommended option is to only expose services hosted on unRAID locally and not directly to the internet. Then use a VPn to connect to your local nextwork and services. Another option is to use vlans in some manner to ensure that your exposed service does not have access to your local network.

I am by no means a docker expert but i will try and answer your questions. I am not certain i know exactly how to answer your question here, as i think it could be refereeing to multiple things. If you are talking about what they call "rootless" containers then no I dont believe that feature is used. If you are talking about privileged containers then yes generally speaking containers are run with privileged mode disabled unless they really need it. Two questions in one here. If a container were to be hacked then yes something could be installed within the container. Escaping the container and running something on the host system would be much harder. I wont say impossible and unRAID is not meant to be a high security platform, however generally speaking the assumption is that programs cannot break out of a container. Exposing the docker socket inside a container can be risky and is generally not something that should be done. Generally if an application needs to use the docker socket i recommend pairing it with a docker socket proxy that limits what docker features it can access.

You can just remove the volume section as it serves no purpose on unRAID when you are using bind mounts to the app data folder for all your volumes. I dont know much about macvlan networking, the only thing strange i see networking wise in your compose file is the ports specifier under nextcloud. I believe ports is only used to create a host port mapping on a bridge type network. If you are using macvlan i dont think the ports serves a purpose as all the container ports are exposed directly on its assigned ip address.

If it says it is i would guess that it is. I forked this plugin from the original quite some time ago, but the core code remains roughly the same. I believe it runs its main script on the 'started' event.

Dont try and manipulate iptables manually, its complicated and not worth while in general (particularly because docker uses iptables and doesnt play nice with user defined stuff). You can achieve better isolation using docker's networking capabilities, however you will not be able to do so using unRAIDs web interface as it does not support setting up more complex network layouts. You will either have to use something like compose, portainer, or docker cli commands. What you likely want to do is put is put the nextcloud and mariadb containers on a separate internal docker bridge network with no port mappings. Then your swag container would connect to both your proxynet network and the network that the other containers are on.

Generally no, right now it needs work for unRAID 6.12.0 compatibility. If you would like to fork the plugin go ahead, but i have no use for compose on unRAID without a web-ui component and i am not keen on maintain such a thing. You can try, the only reason this plugin exists is because unRAID does not provide official compose support. The main reason for no recent updates to the underlying compose version is because no one has brought it up and i havent thought about it in some time.

So far as i know even not even the underlying template format supports multiple networks.

Yes an update to this plugin is planned, but no eta. Yes, however I believe the current recommendation is to not include the version line in compose files unless you have a reason to restrict the file to a specific compose file version. https://docs.docker.com/compose/compose-file/04-version-and-name/

The unRAID Dockerman interface doesnt have a way to add multiple networks to a single container. To do so you would need to use the docker network command on the cli. Alternatively you could manage the specific containers via something other than dockerman, such as compose or portainer.

Knowing exactly zero about the tools or devices you are working with i would do the following. Use the user.scripts plugin to create and schedule the execution of a script. Make that script launch your desired command in a docker container with sshpass installed such as this for example https://hub.docker.com/r/javieraviles/sshpass#! (litterally the first one that came up in a search, not an endorsement of the container).

There is not. unRAID users are not users in the linux sense. unRAID only really supports user access control at the share level through SMB.

If you want to put files into the bind mount directory it has to be done at runtime. You would need to put the files somewhere else in the image, then have a script that runs when the container starts to copy them to the bind mount directory if they are not already there.

Bind mounting gives the docker container access to a folder from the host not the other way around. When you mount the host path /mnt/user/appdata/unraid_testing/ to /apps in the container you are mounting unraid_testing over the apps folder essentially hiding the existing folder in the container. If unraid_testing had files in it they would be accessible inside the container and if something in the container where then to place a file in /apps it would be accessible from the host unraid_testing folder.

Its a known issue. The unRAID webui allows specifying webui and icons via labels but then caches them and doesnt update them when the labels change. I think somewhere further back in this thread someone mentioned being able to locate and delete the files the UI is using to cache the values.

Going to have to disagree on this point. 7" and 8" tablets with <= 1080p resolutions are painful to navigate the gui on.

No I never did. I ended up not using a reverse proxy or wss for connections. Instead i went the old way of directly exposing the urbackup client port to the internet. So far as i can tell wss is not actually compatible with basic auth in a reverse proxy situation.

Anyone know how to resolve issues with the container failing while installing nvidia drivers? Steam | [ /etc/cont-init.d/60-configure_gpu_driver.sh: executing... ] Steam | **** Found NVIDIA device 'Tesla P4' **** Steam | Installing NVIDIA driver v530.30.02 to match what is running on the host Steam exited with code 1 If i spin up the container using bash as an entrypoint and then run /etc/cont-init.d/60-configure_gpu_driver.sh the script seems to complete correctly. Any idea what i am doing wrong?

A single ZFS disk as part of an unRAID Array (rather than a ZFS pool) would not offer any additional protection over a BTRFS drive.

Plans yes, but I have not had time to setup a test machine and address the PHP changes.