Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.

I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)

Also, this is documented:

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.

https://docs.docker.com/engine/security/#docker-daemon-attack-surface

You wouldn’t download a plagarism machine!

The way I read it, it is fine if you do not allow password authentication in general?

I am also happy there. Their non-mail services also support open standards, so you can use them In software that supports it. The Contacts and calendar support Cal/CardDav and the files WebDav.

My only minor gripe with them is no Jmap support, but almost no providers do.

Just out of curiosit, what do you gain from unmounting the fs? Depending on your reasoning, it might he an option to use a zfs filesystem, set it up so automatic jobs rarely run and then set a somewhat agressive disk spin down policy. That way fs info would be handled by the arc, not the disks and they would only spin up when an actual file is accessed.

At least I assume it would work this way. Look-Ahead reads or your explorer generating previews, etc. might well make thta option fail.

I had an issue setting up immich for my parents, whre the fs would stall too long for it to successfully get files. Missing media was just getting displayed as a grey box with a “missing media” text on them.

Just mentioning the words “fertility monitor” in the post (or these comments) would probably have helped. I (and I assume those who downvoted) have never heared of the brand names in the article and do not even know what broad category of devices you were talking about.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.

For my threat model I’m not really concerned with people gaining physical access to my phone, it’s more the surveillance capitalism I’ve got a problem with. So I’d like to be able to keep showing notification contents to myself without showing them to Google.

If properly implemented google should not see your notification “only” metadata (origin, app, timestamp).

I do not use play services on my main profile in Graphene. Here is what works for me:

Email: currently use the Proton app. I’m open to switching to a separate client, but the feature to mark read directly from the notification […]

I use FairEmail and get reliable push notifications for all my e-mail accounts. I do not have proton however, as far as I know you need the subscription to access mail via IMAP.

Calendar: also Proton, also open to other clients. Reliability here is important for obvious reasons.

I think other clients will be difficult here. Proton does not support CalDav (the open standard to sync calendars between devices using numerous applications). Proton also does not support unified push. Getting notifications here will be difficult. However, I would suggest you should try to use the protonmail app in a user profile without play services and see if you get reliable notifications. Some apps have theri own push service implemented when Googles service is unavailable (it will be more battery intensive though). If that does not work, my suggestion would be to use a diffeerent calendar service supporting CalDav (like a small selfhosted Nextcloud instance) and sync that via the android app DavX5.

Messaging: Facebook Messenger

I (have to) use Whatsapp which works okayish with notifications when battery optimization is disabled. I suspect Facebook messenger could work the same, so I would, again, suggest to just try it.

Molly is the go-to? That talks to regular Signal, correct?

Yes, Molly is a compatible fork of the official Signal client. They support Unified push but that requires running a small server to receive your Signal messages. I do however also get reliable notifications without that (more battery intensive).

Emergency/weather alerts:

I guess it depends on the country you are in. But emergency alerts via CellBroadcast are supported in Graphene and do not require Goole Play.

Microsoft Authenticator:

Have you checked if that works at all? The last time I have tried to set it up on a profile without GooglePlayServices it refused to work at all. My suggestion would be to have it on a separate profile with play services (it is healthier to separate work and private life anyways).

Smart home degoogling is Coming Soon™, if there’s anything I need to keep in mind there. Can home assistant consolidate everything or does it work through vendor apps? (Schlage deadbolts, ecobee thermostat, WiZ lightbulbs, Kasa switches if it matters.)

If a device is supported in homeassistant it should be consolidated. I would suggest looking up the ecosystem and homesssistant for details.

I’m guessing call, SMS, and MMS are a dedicated channel with the cell service and are not push notifications, but please correct me if I’m wrong.

Yes, afaik those are separate. They have worked reliably for me without any intervention or Google.

It seems like scheduled notifications e.g. alarms and timers are also not push notifications. I tried a test timer and it worked.

Yes, Googles service is only required for stuff that happens remotely and whose timing you device cannot know about in advance.

What country are you in? In my experience transit apps are somewhat localized.

I have an HDD at my parents place and manually bring over snapshots when I visit. Off site does not necessarily mean cloud.

You can test that on this site:

https://no-sct.badssl.com/

I don’t know why you are being downvoted. You are right, Syncthing does not support local sync.

From the changelog:

Packaging

• Debian Bullseye and Ubuntu Focal packages are no longer built

Are you maybe running Focal?

Not free, but Brics CAD oficially supports a few distros.

Something went wron with that link.

I assume fo collaboration and such.

Does the issue only occour for live photos? If so it might also be an issue with video codecs 🤷‍♂️.

And of course encrypting the drive the files are on.