Networking

Docker Networking Explained: Bridge, Host, and Macvlan Networking is the part of Docker that trips up most self-hosters. Your containers need to talk to each other, to the host, and to the outside world — and Docker gives you several ways to wire that up. The three modes you’ll actually use: bridge (the default), host (skip Docker’s network layer entirely), and macvlan (give containers their own IP on your LAN). Each has tradeoffs, and picking the wrong one leads to hours of debugging. ...

One of the most common security mistakes in self-hosting is accidentally exposing services to the internet. That Redis instance you spun up for testing? It might be listening on 0.0.0.0 with no password. Your database? Possibly reachable by anyone. Let’s fix that. Why Exposed Ports Matter Every open port is a potential entry point. Some services — like databases and cache servers — were never designed to be exposed publicly. They often have no authentication by default. ...

Remote access to your self-hosted services is essential. Whether you’re checking on your media server from a coffee shop or managing your homelab while traveling, a VPN creates a secure tunnel back to your network. But which VPN should you run? The three dominant options — WireGuard, OpenVPN, and Tailscale — take very different approaches. This guide compares all three so you can make the right choice for your setup. ...

Tailscale is brilliant — it creates a zero-config mesh VPN using WireGuard that just works. But it routes all coordination through Tailscale’s servers. If you want that same magic while keeping full control, Headscale is the answer. Headscale is an open-source, self-hosted implementation of the Tailscale coordination server. Your devices still use the official Tailscale client, but they talk to your server instead of Tailscale’s cloud. Same great UX, complete sovereignty. ...

Want to securely access your home server and self-hosted services from anywhere? WireGuard is a modern, fast, and easy-to-configure VPN that’s perfect for home server setups. In this guide, I’ll walk you through setting up WireGuard from scratch. Why WireGuard? WireGuard has become the go-to VPN solution for self-hosters because: Fast: Uses state-of-the-art cryptography and minimal code Simple: Configuration files are just a few lines Lightweight: Runs efficiently on even low-power devices Secure: Modern encryption (ChaCha20, Curve25519, BLAKE2) Cross-platform: Works on Linux, Windows, macOS, iOS, Android Compared to OpenVPN or IPsec, WireGuard is significantly easier to set up and maintain. ...