Hacker News Reader

Plus the additional huge attack surface of docker, docker hub and k8s

It's a home server, not an enterprise network. Security is a trade-off.

I would assume the administrator cares enough about their own data to want to do it properly.

It provides 25 services. If I were going to deploy 25 machines to provide 25 services, that would not reduce the attack surface... of my house server.

With no segregation, you crack one service you get access to all 25 services and their data.

With segregation, you crack one service you get access to just that container/physical service.

Linux has had support for multiple users for quite some time now. Popping a standard service process doesn’t get you any more than the privileges of the running user, which is usually scoped to that service alone.

Install Ubuntu, Postgres+apache2, then su to www-data and try read some data from the postgres data directory to see what I mean.