How to use GUI to configure isolated containers?

    I started to use containers using the manual on omv-extras and implemented the basic appuser scenario. Everything OK.


    Now I want to take security to the next level, because I want to use containers that will use the internet (e.g. transmission, nextcloud). The manual gives a good guidance for a setup with dedicated container users to isolate the containers. I am struggling to set things up with the GUI and have to use the CLI to get it right. For example I changed ownership of the `${PATH_TO_APPDATA}/transmission` and `${PATH_TO_DATA}/transmission` from root to the transmission (container) user.


    I prefer to use the GUI only, since I am a very infrequent user and like to rely on OMV settings in the GUI only. I know I cannot avoid to use the CLI to create a container user that is not a member of the users group. However, I would like to configure all other stuff in the GUI as much as I can. Is it possible to use the GUI to enforce the transmission container can only acces the persistent folders? If yes, how?

    I don't really understand what you are asking. Sorry.


    If you want to associate 2 accounts with one container in the compose then I don't think that is possible (unless image is designed that way).


    If you want to create a user for each container then that is fine and then you will need to probably change owner for each container path (sudo chown user:group /path/to/folder).


    I think this is overkill. Better is to only used trusted containers/images


    If not familiar with chown - be careful. If you chown system folders accidentally you can screw your system up

    OMV 7 (latest) on N100 Minipc (16GB) and RPI5 (8GB). OS on SD card. System ext4 on SSD. Data BTRFS on HDDs

    It is the second option, I wanted to create a dedicated user for each container, as described in the manual as the better security option vs using a generic appuser for all containers.

    But you are probably right with regards to the overkill. I am only using images from linuxserver, so the likelihood that those will be compromised is pretty low. I will stick to the appuser variant for now. Thank you for your advise.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login