π Cosmos 0.11.0 - All in one secure Reverse-proxy, container manager with app store and authentication provider, and integrated VPN now has a Docker backup system + Mac and Linux clients available
Cosmos 0.11.0 is out with a new backup system to export all your docker containers! The Linux and Mac clients are also out for some early testing, please share your feedback!
The new backup system works by reading the list of containers on your server and exporting a single compose file, with all the setup you need to recreate (in case of crash) or migrate your server.
The backup system triggers on every docker change, including changes you've made outside of Cosmos (ex. Portainer, etc...).
It outputs to a single file in your config folder, which you can backup with various strategy to keep a history of your docker containers state!
As a reminder, this exists alongside the existing features:
App Store π¦π± To easily install and manage your applications, with simple installers, automatic updates and security checks
Customizable Homepage π πΌ To access all your applications from a single place, with a beautiful and customizable UI
Reverse-Proxy ππ Targeting containers, other servers, or serving static folders / SPA with automatic HTTPS, and a nice UI
VPN ππ To securely access your applications from anywhere, without having to open ports on your router.
Container manager ππ§ To easily manage your containers and their settings, keep them up to date as well as audit their security. Includes docker-compose support!
SmartShield technology π§ π‘ Automatically secure your applications without manual adjustments (see below for more details). Includes anti-bot and anti-DDOS strategies.
β
As always, eager to get some feedback on this release, here's the rest of the changelog:
- Docker export feature for backups on every docker event
- Disable support for X-FORWARDED-FOR incoming header (needs further testing)
- Compose Import feature now supports skipping creating existing resources
- Compose Import now overwrite containers if they are differents
- Added support for cosmos-persistent-env, to persist password when overwriting containers (useful for encrypted or password protected volumes, like databases use)
- Fixed bug where import compose would try to revert a previously created volume when errors occurs
- Terminal for import now has colours
- Fix a bug where ARM CPU would not be able to start Constellation
Hey! I've been recently getting into VPN and 2fa and could you give me a eli15 for this? How does this work?
I currently have my entire server port forwarded and reverse proxied on port 80 and a duckdns domain, with homepage running on port 80. After implementing this, will port 80 be taken over by cosmos?
Iβve tried a number of these βstacksβ and some have great communities and others not so much. But the peeps with Cosmos are amongst the very best. Extremely helpful. Cosmos and YAMS are the best IMHO.
Does it support Podman or is it just Docker? If it's just Docker, please consider Podman support as it's open source and most secure by default thanks to running as a user instead of as root yet is almost completely compatible with Docker.
Thank you for this! Does this include volume data or do we have to manually back that up ourselves?
I'm wondering what the full process of recovery looks like, as if it's a compose file of all containers, I imagine this would restore brand new services unless we handle the volumes right? Or does it also back up volume data as well?
It does not include volume data, but backing up volumes is a planned feature too, it's just a lot more difficult of a feature to develop :p
Basically backing up volumes is easy without Cosmos, it's just a folder, but backing up your container is much harder, that's why I added it in priority
The readme is all about security and holes and other bad things that hackers/miscreants/bots can do and how Cosmos can prevent them, but the example run command has this which pretends none of those things actually exist:
--privileged -v /:/mnt/host
Any sort of security lapse/hole in Cosmos or the software it builds upon gives a miscreant/bot/hacker full read/write access to the entire host system!
It's ironic as the readme has many bolded statements about how cosmos protects docker containers from one another in case one is breached, but makes the bold assumption that the Cosmos container itself is completely secure.
Mounting '/' from the host is a bad suggestion. Yes, the readme says it's optional, but holy heck don't make it the suggested method as many of the folks using Cosmos are doing so because they don't understand security and they'll use the suggested run command. They don't know this is a BAD suggestion.
Cosmos is a fully fledged server management platform, as such it requires those access to the host server in order to operate.
"--privileged -v /:/mnt/host" is not as bad of a thing as you would think in that context, in fact it is equivalent to running a daemon like you would with any other alternative (CasaOS, Umbrel, etc..) those are just requirement for Cosmos to run with the same level of exposure as those alternatives who are not docker containers.
My only alternative would have been to make Cosmos a daemon and not a container, but then it would make install and maintenance harder
I understand your point, and yes ideally it would run as an isolated container, but it's just not possible to have a supervisor software managing your server running in an isolated container with no container, it is contradictory
I propose as alternative to run Cosmos with lower privilege, in which case some features will not work but the default is to run cosmos with the privileges it requires for all features to work as expected.
And the bottom line, the security benefits behind Cosmos for your average home-server outweigh by far this "--privileged -v /:/mnt/host". Slight reminder than a very large portion of people running alternatives like Casa, Umbrel, etc... Also expose those root daemon without even HTTPS or anything!
I think you're missing the point. My issue is sharing / with the container as root. I understand some parts of Cosmos require --privileged. That is not my issue.
To be super repetitive, my issue is the combination of --privileged with -v /:/mnt/host
The very next statement in your documentation after this says:
in this command, -v /:/mnt/host is optional and allow to manage folders from Cosmos, you can remove it if you don't want it but you will have to create your container's bind folders manually.
If it's optional, then don't give it in the sample command that 99% of users will run. You can't tell me that it's not a risk.
And saying "other programs have risks, too" is pretty cowardly defense against suggesting users do something as unsafe as mapping their entire host file system to Cosmos when Cosmos doesn't need it.
I have been checking out Cosmos and I really like it. A lot more functionality than CasaOS and the fact you have automatic updates for your store's apps is great. Most the apps I tried out from the app store on CasaOS were out of date and hard to update without knowledge of Docker.
Installed this on my VPS a couple of days back. Look and feel fantastic and functionality like a swiss army knife. I temporarily had to turn off my container and turn back npm on. I definitely want to spend time this week to make this up and running.
Is there any guidance on if a subdomain is preferred over the domain ? For the first time, I used my main domain. And it somehow broke my existing let's encrypt certificate. I purged the folders and did a clean reinstall, this time on a subdomain. Works but somehow the certificate broke again. (Too many certificates or something like this)
Could this be because I clicked "new certificate" while I had temporarily turned off my NPM containers to try Cosmos ?
Thanks. For VPS then can I ignore the domain field during setup, and do a reverse proxy later to the cosmos container (via cosmos reverse proxy) to access it via the web ?
Docker is an important ingredient in the mix, to isolate the applications completely, and make things much more streamlined than traditional VM, but I understand if it's not for everyone
Wait, just to be clear, is this basically like what Truenas' apps does, but standalone? Cause holy shit I was looking for something like this for a while. Does it support mounting network drives via NFS?
So Cosmos is basically just a pre-configured docker app "store"? How do you decide which containers go into the apps menu? Why does the descriptions in Github feel like it uses boldtext for some fearmongering?
If it weren't a Docker/Portainer replacement and were solely responsible for security, I would use it. Multiple applications are needed to have all the good security measures that you have implemented in one application.
Docker is an important ingredient in the mix, to isolate the applications completely, and make things much more streamlined than traditional VM, but I understand if it's not for everyone!
noob question but would I be able to install this on a free-tier VPS and use it to manage content on a seedbox (without root access) and services on my local network?
You need root access to manage docker containers that's (almost) unavoidable. Also Cosmos does not support managing remote docker instances.
On the other hand, a good (and secure) pattern is to use Constellation (the integrated VPN) on 2 servers with cosmos installed on each. you can connect them together. One of the servers (the seedbox) is the main server running services but it is not exposed on the internet and the only way to access it is to connect to the VPN on the other VPS
If you are experiencing any performance issue, feel free to document them to me so I can investigate your setup and potentially fix any shortcomings :)