Docker is no longer the best choice for homelabbers

Published Jul 29, 2026, 11:30 AM EDT Nick Lewis is an editor at How-To Geek. He has been using computers for 20 years --- tinkering with everything from the UI to the Windows registry to device firmware. Before How-To Geek, he used Python and C++ as a freelance programmer. In college, Nick made extensive use of Fortran while pursuing a physics degree. Nick's love of tinkering with computers extends beyond work. He has been running video game servers from home for more than 10 years using Windows, Ubuntu, or Raspberry Pi OS. He also uses Proxmox to self-host a variety of services, including a Jellyfin Media Server, an Airsonic music server, a handful of game servers, NextCloud, and two Windows virtual machines. He enjoys DIY projects, especially if they involve technology. He regularly repairs and repurposes old computers and hardware for whatever new project is at hand. He has designed crossovers for homemade speakers all the way from the basic design to the PCB. Nick enjoys the outdoors. When he isn't working on a computer or DIY project, he is most likely to be found camping, backpacking, or canoeing. Docker Compose is one of the most popular tools in the homelabber's software arsenal, and for good reason. You get one YAML file and run one command (docker compose up), and your service will usually magically start running. However, that doesn't mean that Docker Compose is the end-all be-all. I've never been a heavy Docker user, and I generally prefer alternatives to Docker Compose for most of my homelabbing setups. There are four big factors that pushed me in that direction. Root is a security vulnerability Self-hosting requires care about security The standard Docker approach relies on a central daemon that runs as root. Every Compose stack you deploy relies on that process. Unfortunately, that also creates a potential attack avenue—if a container is compromised and an attacker is able to break out, that breakout presents a larger risk to your system than if the container were running unprivileged. If you are exposing services to the internet—such as reverse proxies, media servers, or dashboards—you should consider Podman’s rootless, daemonless model. Podman runs containers directly without a background daemon, and those containers don't need root privileges to function. There is rootless Docker, but I've found it sometimes introduces problems with "off the shelf" compose files. The only potential tradeoffs are that networking might be slower, and that some jobs require a bit of extra work to make them run correctly. However, I've never found the networking issue to be a significant problem, and a little bit of inconvenience is well worth the security gains. Compose is difficult to troubleshoot Visibility matters When you use Compose, containers sit apart (under the Docker daemon) from your operating system's service manager, which means you need to use a completely different set of commands to manage those containers. That separation creates an unnecessary barrier to entry, especially considering that there are alternatives that don't have that drawback. Take Quadlet, which is packaged with Podman, for example. Quadlet handles each container as a regular systemd service. In practice, you create several small container files rather than one huge YAML. Podman handles the container, but systemd can handle supervising it just like any other application or service running on your machine. That means you get full visibility with the usual systemctl or journalctl commands for your containers without the extra steps Docker requires. I didn't adopt Docker early in my self-hosting career largely because I couldn't be bothered to learn another separate app and set of commands. Timely updates matter for security Running compose down and pulling a new image isn't as convenient as an auto update A list of installed Podman images. Docker Compose can be used to update images, but it requires manually pulling and then running compose up again. It has no native way to schedule or automate updates. In order to get that functionality, homelabbers have historically relied on something like Watchtower (or newer replacements) to handle that shortcoming. However, that is just adding another moving part that can fail, all in order to solve a simple problem. One of the strengths of Podman in particular is that it has the ability to handle all of that automatically. Podman relies on a systemd timer rather than a separate container, which is nice if you're worried about taking the "simplest" approach. Critically, Podman's auto update will also automatically roll back to the previous working version if the container fails to start, as it occasionally will. YAML is convenient but a GUI is better Convenience is king Credit: CasaOS Docker Compose is pretty great when it works correctly. It can turn a 3-hour setup process into a 5-minute setup process, and the hard part is copy-pasting. However, if something isn't configured correctly in a Docker Compose file, auditing a YAML for problems is every bit as exciting as reading assembly. Platforms like CasaOS, Cosmos, Runtipi, and a few others change out the manual YAML approach for a GUI-based approach instead, complete with an app store, an updater, and even a reverse proxy. Of course, many of these platforms use Compose under the hood, but they bury the tedious part so you never have to edit a file manually. If you've just purchased a mini PC and your only goal is to get Jellyfin or Immich running as quickly as possible, the convenience is probably worth the bit of control you lose, especially if you're not comfortable using a command-line interface. Compose has some drawbacks For many homelab setups, Compose is still a reasonable choice. If you're happy with it, don't change. However, if you're concerned about root access, don't want to contend with YAML files, prefer a GUI, or want management that is more integrated with your system's default setup, then there are some alternatives you should consider. Podman (which packages Quadlet) is better for security, and I'd argue it is easier to maintain and troubleshoot. If you want something that is really simple to use, check out CasaOS, Cosmos, or Runtipi—they use Docker Compose in the background, but you don't have to interact with it manually.