I probably wouldn't have chosen Debian. It'd probably be easier to use a RHEL spinoff like Alma or Rocky Linux.
Overall, very nice!
> Podman vs Docker You may point to Podman here because Podman is natively rootless and doesn't require a daemon and additional workarounds to run rootless. I agree. However, Docker in rootless user nesting is also robust and possible, and I decided to stick to the docker-compose.yml because it is still the industry (and homelab) standard. This minimizes the time I need to translate examples or templates. Docker in rootless and Podman are mostly interchangeable at this level. Both run processes in isolated Linux namespaces on your host VM (not the Hypervisor!).
This is not 100% and may change anytime. I guess, for me, at this time, the difference between Docker in rootless and Podman is just too small, and the time needed to migrate all my docker-compose.yml's too much, to make the jump. Overall, it is not a critical decision for this architecture, more a choice.
Regarding Debian is similar, I just stick with what I am familiar with. Debian also never lost me.
I just couldn't get the ids to work. But I've not tried the specific thing they do here.
I attempted to port my homelab quadlet setup to a disposable VM on proxmox with the state folder mounted via virtiofs and after losing a weekend I realised that it essentially wasn't compatible with rootless podman id mapping and I gave up.
But maybe I missed something...
> Network file systems can cause UID/GID mismatches and add network overhead. With VirtIO-FS, I use the Linux kernel's Virtual File System to translate the hypervisor's UID to the guest's unprivileged UID. This avoids exposing the host file structure. I utilize the `X-mount.idmap` fstab option for this. Documentation on this specific implementation is not easy to find. It builds upon the idmapped mounts feature introduced by Christian Brauner in Linux 5.12 [1] and its later integration with util-linux v2.39 into the standard `mount` utility [2].
[1]: https://github.com/brauner/mount-idmapped + https://docs.kernel.org/filesystems/idmappings.html
[2]: https://github.com/systemd/systemd/releases/tag/v254I think I may have complicated things by using linuxserver.io images which already require some id mapping trickery on the rootless podman side as they expect to run as root...