https://www.blog-des-telecoms.com/tags/self-hosting/Recent content in Self-Hosting on Mathias WOLFFHugofr-FR<a href="https://www.blog-des-telecoms.com">Blog des télécoms</a> © 2009 - 2026 by <a href="https://www.linkedin.com/in/mathias-wolff-47a7941/">Mathias WOLFF</a> is licensed under <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/">CC BY-NC-SA 4.0</a><img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg" style="max-width: 1em;max-height:1em;margin-left: .2em;"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg" style="max-width: 1em;max-height:1em;margin-left: .2em;"><img src="https://mirrors.creativecommons.org/presskit/icons/nc.svg" style="max-width: 1em;max-height:1em;margin-left: .2em;"><img src="https://mirrors.creativecommons.org/presskit/icons/sa.svg" style="max-width: 1em;max-height:1em;margin-left: .2em;">Wed, 19 Aug 2026 10:09:33 +0200https://www.blog-des-telecoms.com/en/blog/caddy-paquet-source-host-gate-podman/Wed, 19 Aug 2026 14:00:00 +0200https://www.blog-des-telecoms.com/en/blog/caddy-paquet-source-host-gate-podman/<p>Your services platform runs on rootless Podman, and you need a public entry point to terminate TLS and handle ACME. The question is where to put it. I choose to keep Caddy outside Podman, as a host service installed from Caddy&rsquo;s signed official APT repository.</p> <!-- more --> <h2 id="caddy-in-podman">Caddy in Podman?<a href="#caddy-in-podman" class="post-heading__anchor" aria-hidden="true">#</a> </h2> <p>No. The boundary is simple: <code>scripts/deploy.sh</code> runs rootless as <code>podman</code>, and it must never acquire root authority over a public TLS service. If Caddy lived in Podman, the rootless application deployment could, by construction, rewrite the configuration of the public entry point. That is exactly the privilege confusion I want to avoid.</p>