K3s (and k8s for that matter) expect you to build a hierarchy of yaml configs, mostly because spinning up docker instances will be done in groups with certains traits applying to whole organization, certain ones applying only to most groups, but not all, and certain configs being special for certain services (http nodes added when demand is higher than x threshold).

But I wonder why you want to cluster navidrome or pihole? Navidrome would require a significant load before service load balancing is required (and non-trivial to implement), and pihole can be put behind a round-robin DNS forwarder, and also be weird to implement behind load balancing.

I don’t think anyone here disagrees that port scanning is bad, nor that you even filed an aws ticket. And congrats on your live service.

But your answers to comments are weird, like this is not only your first server or vps experience with a public interface, but your first time exposing anything to the public web. And even if that’s true, there’s a first time for everyone.

But man, doubling down and insisting that “port scanning is unauthorized traffic” betrays a certain naivete about how tcpip works.

What you are seeing is not only normal, but AWS can’t do anything about it because that’s how IP source and destination sockets work.

Oh, OK. I moved to mikrotik 8 years ago and haven’t looked back.

OpenWRT on a 5009? Why? You’ll lose the switch/cpu integration and a whole lot of speed, not to mention features…

Port scanning is not authorized traffic.

Lol what

I think you should read the terms of your AWS contract. How do you think aws moves instances if not for agents gathering metrics?

And this case is Mandiant, so you’re fine.

Are you sure you’re ready for AWS?

Umm…

You know how that works, right? Like, if you don’t want to expose ports, just… don’t expose them. But you can’t prevent port scanning.

I would love to see the support request from AWS for this.

Edit: also, I think “script kiddy” is a bit of a stretch here.

deleted by creator

And poettering is an absolute good guy here.

You obviously weren’t actually around when he was granted mini-king status and acted like a jackass to literally anyone who objected to pulse or systemd. As a result, redhat, canonical, and Debian had to eat criticism over pushing these before they were ready… because of “superstar” poettering.

Poettering is a disrespectful clown.

At the time, canonical was throwing its weight around and essentially bullying Debian upstream repos. Around this time, there was a mass exodus of the Debian leadership over this kind of thing.

The old guard of Debian wasn’t as… enthusiastic about systemd either, but look what they use now.

Yeah, I was going say this is a weird post to make in 2025, even for the gov…

It’s true, and it was a huge pain in the ass:

https://answers.launchpad.net/ubuntu/+question/223855

I think so. I lost count of the little things, it really was death by a thousand paper cuts.

I was a pretty rabid fan of Ubuntu, still have an x86 and ppc CD of 5.04 somewhere.

But by the time snaps started appearing, and then Ubuntu pro, Ubuntu decided to revert some of my customized configs in /etc after an upgrade, I had had enough. When snaps were reinstalled after an upgrade in 2021, I just flipped over to Debian, which has come a long way in being usable out of the box.

This thinking is so dangerous… Help others when they need it, it makes the world better.

The problem with NOT helping a racist jerk in distress:

1. Not all USA residents are racist jerks.
2. Racism and being a jerk are generally learned behaviours, not innate.
3. How do you tell a racist jerk from a non-racist, non-jerk?
4. Sometimes being a good example encourages a person to not be a racist jerk.
5. A racist jerk might help you one day.
6. Etc

The lesson is that we’re all people.

Wave after wave of my own men until the killbots reached their preset kill limit.

I was at this point until about 3 years ago. Switched to debian, wont look back.

Or mir, or pulseaudio before it was ready, or deprecating ffmpeg for half a year… Etc etc

Sure, yes. Obviously we want better quality paving, marked crossings, and safe places to use scooters.

However, it was pretty clear from the article that these injuries are due in large part to:

1. Unrestricted speeds on scooters and
2. A lack of helmet awareness with kids riding these scooters.

I’m not saying the infrastructure being improved wouldn’t help, but you can upgrade it (the infrastructure) as much as you like, but head injuries will still occur unless kids start wearing helmets.

That’s your takeaway from this? Alarming rise in head injuries aren’t related to lack of helmet culture, but infrastructure?

Agree. The person who wrote the article is Avery Pennarun, co-creator of tailscale. I’ve heard him in interview ; he’s very smart, both technically, and in high picture thinking.

But… Missing the point that VC money is cursed because they don’t care if your product is good, successful or a boon to others, is a bit naive.

Docker runs fine nested in lxc with uid/gid mapping.

The difficulties of running docker in lxc are particular to proxmox, I ran docker in lxc on proxmox for years, but I’m glad I moved incus; much more sensible approach.