caplam

i am making progress. I use openarc and have loaded a qwen3 model using igpu from my core ultra. I use openwebui as gui. As i begin with ai i can see that i have a ton to learn to make a better usage (how to choose a model, system prompt, skills, agent, knowledge base,....) but it looks promising. There is valuable information on openwebui communities. You should try openarc and explore their github. Another option would be to go with openvino model server but i find their documentation quite confusing, even the name of the different components are confusing

can't answer as i lack some details about your setup but i'd look at network source in the vm settings. For example if you are using bridging for your unraid network interface, you would want to have br0 as your network source in your vm settings.

i plan to buy a B70 too. But for the moment i try to build an ai stack with the igpu and the npu of my core ultra 285HX. I tried several solutions with ipex-llm, ollama-intel. But it's very limited ipex-llm is no more under dev; ollama-intel seems to be compiled with an old version of ollama and is not able to load recent models. This week i found Openarc. Looks very promising but for me it's a steep learning curve. It's based on openvino and models from huggingface. So far the container runs and i've been able to connect openwebui. The drivers are correctly loaded and the available devices are correctly reported (CPU,iGPU,NPU) But i have not been able to download a model. Apparently you need to install huggingface-cli tool to manage models. I'm still looking for better alternatives to run local ai on intel hardware.

I don't expose unraid itself of course. Unraid and other management interfaces are behind a vpn whenever i need access outside of my lan. I expose things like plex, jellyfin, nextcloud, immich,.... and for those when compatible i use authentik for managing user authentication. All those services are in a dmz behind a reverse proxy sitting on my opnsense router. If you decide to host those services for your family members they need to be exposed because if not what is the utility of a nextcloud instance accessible only inside your lan ? Of course i have still work to do enforce better security (for example some of my older containers may not use docker secrets). I have also have to review my docker networks to ensure they are bound to only the interface i want. My post was more about that subject. Things you can't control despite doing things right when you setup an exposed service. Vulnerabilities can be introduced by the image and the way way it's built. And if i understood correctly you can build an image locally (without modifying the dockerfile) and it will be more up to date than the one on the public registry. From what i've read so far you would need to clone the repo of the app and replace the image in your compose file with build. That each time you execute compose up the image is built locally with the most up to date base image and dependency packages. But i need to read more about the subject and also figure out which vulnerabilities are the most dangerous; because some require access to the host others don't,...

you can't have that. Docker returns only running containers because to be attached to a network a container needs to be running.

Unraid is a great way to start with docker containers. It's easy as with some plugins unraid can take care of backup and updates automatically. But some apps require the use of several services with dependencies and unraid alone is not sufficient to manage updates. You can manage that with compose plugin and watchtower and some docker labels When you have many services running it 's not so efficient. To enhance my experience i started to use portainer but the way it manages compose files is a pain (at least for me) I recently discovered dockhand and arcane. They are both apps for managing containers, stacks and images. And you can define where you want your compose files to reside. My preference is for dockhand for the gui but it's a pain when you need to control stacks on another host through the hawser agent: for example you define a stack on the dockhand host and the compose file resides here until it's deployment. Then it's created on the remote host or the existing compose file on the remote host is updated. That makes it impossible to simply run a docker command on the remote host in a container that need an init for example. With arcane it's better handled but imho dockhand has the best gui. Both these 2 apps have vulnerability scanning of images which is great but wtf the number of vuln found in most of the images i run. I have to say that lsio images are those with the fewest vulns. I'm still in the process of understanding the way those vulns impact the security of my homelab but for now it's quite scary as i publish many of the services i use for my family members. So for now i'm in the process of trying to improve my security posture. Until now i've always used prebuilt images. I'm curious to know if many of you build their own images and if so how do you implemented it in your homelab. How do you build new image for an app according to the result of a scan ? What do you have to modify in a compose file to use ownbuilt images instead of prebuilt ? How to manage dependencies ? Can all these steps be automated ? I hope to have some hints to move forward.

you can use vlan in unraid and don't have an address on br0.x interface. You simply have to define ip assignment to none for the sub interface. But i guess in that case containers in that vlan can't use a bridge. I use it to define macvlan network. One thing that came into my mind is that by default docker listen to all host interfaces so if you define a bridge in a vlan interface and you expose a port in a docker on another bridge you have to restrict listening interface when you define the bridge. It's done with the "com.docker.network.bridge.host_binding_ipv4" option in the bridge ipam driver. custom networks bridge have the advantage of simplifying communication between containers. If you have several containers running in the same custom network they can communicate with each others by their name. For example if you have a server that need a database you can define the database host as postgres:5432 You can define firewall rules for your containers see docker docs (iptables).

thanks. I'll do that but i need time to evaluate because i have so much containers and docker networks. I got it working before i saw your answer. When i tried with eth0 as network source and e1000 for network type it worked. It's strange; when i install the same vm in proxmox it's ok with virtio network.

Hello, I struggle with networking particularly for vm. At a time macvlan and bridging were causing issues. So I disabled bridging. (Bonding is also disabled). I htink it was around unraid 6.8 In this config all was good for my vm and my dockers. I have one active vm (several others are down but are ok if enable them) I wanted to create a new vm but I’m unable to have it obtaining an ip. If setting a static ip it doesn't work either. When I create a vm I’m offered the choice of vibr0 or eth0 ( I have also eth0.x as I have enabled vlans) None of these options are ok. So I looked at the xml config of working vm and for the network I have that: <interface type='direct' trustGuestRxFilters='yes'> <mac address='52:54:00:11:1d:57'/> <source dev='vhost0' mode='bridge'/> <target dev='macvtap0'/> <model type='virtio-net'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> All my vm have the same network controller definition. Only mac_address and target dev differ. Note that the source dev is vhost0 in xml but in gui it’s vibr0. What network source should i use for my new vm? What is the correct xml definition for the network interface.

Hello, I have a ssd pool with 2 ssd for docker and vms. This pool holds also my nextcloud data. I want to install one (even several as i will configure a distributed setup) vm for security onion. I have room for a basic vm but security onion is quite storage hungry. Inside this vm the storage space is managed with lvm; and there is mainly 2 partititions "/" and "/nsm" What i plan to do is to allocate space for creating the vm on the ssd mirror pool and a second space which i'll mount to "/nsm" partition. For that second space i need to add a pool. I'm a newcomer to zfs but want to try it. I'll dedicate a small sas das i have (8bays). And to populate that das i have 6 sas hdd and 2 sas ssd. All professionnal grade. Considering the main use of that pool will be to be mounted in the vm as /nsm partition; and that partition holds pcap files, zeek files and elastic search files, i'm looking for the best layout possible given the hardware i have. For that particular usage ram is not a problem (i have 200G free fro now). i should not need l2arc. At first i was thinking about a raidz2 pool with 6 hdd (4Tb per unit) and a mirror of 2 ssd (800G per unit) as special vdev for small files and metadata. I'd like to know if there are better options.

interesting topic. I don't have need for bcache for the array. I'm happy with it as it is. Despite of the downsides the versatility it provides in the ability to mix disks is what made me choose unraid in the first place. But i have a need for a vm to have a large and fast volume. Too large to hold it on a ssd and too fast to rely only on hdd. It doesn't need to on the array. How could i setup such a volume ? I was thinking about lvm volume with bcache or another type of cache (completly outside of the array). The glitch is i have room for another hdd but not for a ssd. Could i use a vdisk on a existing ssd to act as cache for a lvm volume on a new hdd?

i rebooted the backup server (192.168.2.52) and it's now working. I found examples in the forum of the same symptom.

I can also add that using pcie x16 slot doesn't doesn't desactivate 1 nvme and yes 9300-8e is running fine in the ms01 (but take care of airflow) Perhaps you should correct you posts. It might lead to unaware users plugging the wrong ssd. in the wrong slot. edit: your photo shows a U.2 nvme ssd. This is the good ssd but be careful on the switch position if you change it for a nvme m.2. This has nothing to do with a sata ssd.

Hello, For almost 2 years I've been using luckybackup to backup some shares from one unraid server to another. Today my backup server doesn't accept connection from my main server. The config didn't change. The ssh key from main server is in the authorized key on backup server and didn't change. I wonder if there has been a recent change in ssh on unraid. Here is my log: Jan 7 17:55:52 hades sshd-session[355622]: Postponed keyboard-interactive for root from 192.168.2.50 port 53748 ssh2 [preauth] Jan 7 17:55:52 hades unix_chkpwd[355625]: password check failed for user (root) Jan 7 17:55:52 hades sshd-session[355624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.50 user=root Jan 7 17:55:54 hades sshd-session[355622]: error: PAM: Authentication failure for root from 192.168.2.50 Jan 7 17:55:54 hades sshd-session[355622]: Failed keyboard-interactive/pam for root from 192.168.2.50 port 53748 ssh2 Jan 7 17:55:54 hades sshd-session[355622]: Postponed keyboard-interactive for root from 192.168.2.50 port 53748 ssh2 [preauth] Jan 7 17:55:54 hades unix_chkpwd[355688]: password check failed for user (root) Jan 7 17:55:54 hades sshd-session[355687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.50 user=root Jan 7 17:5 it's almost as if backup server wants only password and not key.

you have to declare networks in your compose file In the example below i use 2 networks for the immich server eth0.30 is macvlan network in my dmz vlan immich is a bridge network only immich server is in the eth0.30 network. All the other containers are in immich network. you also have to declare the type of network at the end of the file at the same level as services. In my case networks are created outside of the compose file hence the external: true statement. But you can't manage them inside the file. I advise you to read docker networking docs. services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # file: hwaccel.transcoding.yml # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro - ${EXTERNAL_PATH}:/usr/src/app/external # env_file: # - .env ports: - 192.168.30.10:2283:2283 # expose: # - "2283" depends_on: - redis - database restart: always healthcheck: disable: false networks: eth0.30: ipv4_address: 192.168.30.10 immich: networks: eth0.30: external: true name: eth0.30 immich: external: true