DEV Community: SelfHost Pilot

WireGuard Split Tunneling on Blocked Networks (udp2raw)

SelfHost Pilot — Wed, 30 Sep 2026 03:43:16 +0000

Your WireGuard tunnel works fine at home, then dies the moment you join a hotel, campus, cafe or mobile-carrier network. Below I show how to prove the network is the problem, hide WireGuard inside traffic those networks allow, and use split tunneling so only the traffic that needs the tunnel goes through it. I assume you already have a server running from my WireGuard server setup guide.

WireGuard split tunneling: what it actually does

On Linux, AllowedIPs is not a filter on top of your routing. wg-quick turns every AllowedIPs entry into a route on the tunnel interface. It is an allow-list: put a network in AllowedIPs and only that network goes through the tunnel.

WireGuard split tunneling means listing the networks that should go inside the tunnel in AllowedIPs; everything else stays on your normal connection. The AllowedIPs list is the split tunnel.

AllowedIPs = 0.0.0.0/0 is the full tunnel. The popular 0.0.0.0/1 plus 128.0.0.0/1 trick does not exclude anything, because those two halves still cover all of IPv4. To exclude a host or subnet, add a more specific route so longest-prefix match sends it through your normal gateway:

PostUp = ip route add 198.51.100.0/24 via 192.168.1.1 PreDown = ip route del 198.51.100.0/24 via 192.168.1.1

Set Table = off in [Interface] if you want to manage routing yourself. Only add a DNS line if you want the tunnel's resolver.

Per-app splitting depends on the platform:

Platform	Per-app split tunneling	What to use
Linux	No	AllowedIPs, extra routes, `Table = off`, or the Amnezia client
Android	Yes, official app	"Excluded Applications" (`ExcludedApplications` in the config)
iOS	No	On-Demand rules instead
Windows / macOS	Not in the official app	Tunnel follows AllowedIPs; Amnezia client for per-app routing

Why WireGuard stops working on some networks

WireGuard was built to be fast, not hidden. The handshake initiation is always exactly 148 bytes, the response 92 bytes and the cookie 64 bytes, and every packet starts with a fixed 4-byte message type. For deep packet inspection, that shape is trivial to fingerprint.

Networks usually break it in one of three ways: they drop all UDP (common on hotel and campus Wi-Fi), throttle UDP until the tunnel crawls, or allow only TCP 80 and 443.

Before you change anything: three quick checks

First, run sudo wg show. If "latest handshake" is empty, your packets are not getting through, and it is not a key typo when the same config works at home.

Second, connect your laptop to your phone's hotspot. If the tunnel comes up instantly, the server is fine and the network is at fault.

Third, test UDP and TCP 443 separately while tcpdump watches the server:

on the server

sudo tcpdump -ni any 'udp port 51820 or tcp port 443'

on the client, from the blocked network

echo test | nc -u -w1 203.0.113.2 51820
nc -vz -w3 203.0.113.2 443

If nothing arrives on UDP but the TCP 443 attempt shows up, you are on a TCP-only network.

Then try the cheapest fix. Many networks only filter UDP 51820 or unknown high ports. Set ListenPort = 443 in the server config from my WireGuard setup guide, open UDP 443 in the firewall and update the client Endpoint. No extra software.

Finally, rule out MTU. If the handshake works but nothing loads, run ping -M do -s 1400 <server-ip>. If it fails, reduce the size until it passes and lower the tunnel MTU to match.

Fix 1: udp2raw, WireGuard in a fake TCP connection

udp2raw (MIT) uses raw sockets to wrap UDP in encrypted FakeTCP, UDP or ICMP. In faketcp mode on port 443, firewalls see an ordinary TCP connection. It adds AES-128-CBC encryption, HMAC-SHA1 authentication and anti-replay protection, and it survives Wi-Fi changes.

Server:

[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server private key>
MTU = 1342
PreUp = udp2raw -s -l 203.0.113.2:443 -r 127.0.0.1:51820 -k "shared secret" -a >/var/log/udp2raw.log 2>&1 &
PostDown = killall udp2raw || true

[Peer]
PublicKey = <client public key>
AllowedIPs = 10.8.0.2/32

Client:

[Interface]
Address = 10.8.0.2/24
PrivateKey = <client private key>
MTU = 1342
PreUp = udp2raw -c -l 127.0.0.1:50001 -r 203.0.113.2:443 -k "shared secret" -a >/var/log/udp2raw.log 2>&1 &
PostUp = ip route add 203.0.113.2 via 192.168.1.1
PreDown = ip route del 203.0.113.2 via 192.168.1.1
PostDown = killall udp2raw || true

[Peer]
PublicKey = <server public key>
Endpoint = 127.0.0.1:50001
AllowedIPs = 0.0.0.0/0

Both ends drop to MTU 1342 because udp2raw cannot carry payloads as large as plain WireGuard; go lower if any link in the path is smaller. On the server, -r 127.0.0.1:51820 forwards into your real WireGuard listener. The -a flag adds the iptables rules udp2raw needs, and forgetting it is the most common mistake.

That PostUp route fixes a gotcha from the project wiki: with 0.0.0.0/0 in AllowedIPs the client needs an exception for the server's public IP, or the tunnel tries to carry its own traffic and loops. Replace 192.168.1.1 with your real gateway.

Honest limits: it needs root, and the last tagged release is 20230206.0 (February 2023). The repo still gets commits but moves slowly, so build from source. Advanced DPI can fingerprint the FakeTCP handshake. ICMP mode is a last resort. Fake TCP has no congestion control, so expect a bit more latency and jitter.

Fix 2: AmneziaWG, the obfuscated WireGuard fork

If the handshake starts and then dies, or WireGuard stays blocked for weeks, the network is fingerprinting the protocol. AmneziaWG is a fork of WireGuard-Go (MIT, with a GPL-2.0 kernel module). It keeps the same ChaCha20-Poly1305 cryptography and speed but changes how the traffic looks.

The padding values S1-S4 randomize packet sizes, so the fixed sizes of 148, 92 and 64 bytes disappear. Before each handshake it sends junk packets: Jc sets how many (4 to 12 is recommended), and each one gets a random size between Jmin and Jmax. Version 2.0 added dynamic headers (H1-H4) and signature packets (I1-I5) that can imitate a QUIC initial. Version 3.1 encrypts the low-entropy header fields with ChaCha20 and requires S1-S4 to be at least 12.

The catch: both ends must run AmneziaWG, because it does not talk to stock WireGuard. Clients cover Windows, macOS, Linux, Android and iOS via the Amnezia VPN app (4.8.12.7+) or the native AmneziaWG clients. Expect it to run slightly slower than stock WireGuard, and keep Jmax below your MTU so junk packets do not fragment.

Fix 3: wstunnel, when only HTTPS gets out

wstunnel (Rust, BSD-3-Clause, actively developed) wraps UDP inside WebSocket or HTTP2 traffic on port 443.

server

wstunnel server wss://0.0.0.0:443 --restrict-to 127.0.0.1:51820

client

wstunnel client -L "udp://51820:localhost:51820?timeout_sec=0" wss://203.0.113.2:443

Point the WireGuard client Endpoint at 127.0.0.1:51820. If you run a full tunnel, add the same server-IP route exception. If Nginx already uses port 443, run wstunnel on a local port and proxy WebSocket traffic to it, the same pattern as in my Nginx reverse proxy guide.

The tradeoff: TCP brings head-of-line blocking and the double-TCP problem, so under packet loss it is slower than udp2raw or AmneziaWG. That is another reason to split-tunnel instead of pushing everything through it.

Split tunneling while the tunnel is fragile

An obfuscated tunnel is slower and more fragile than plain WireGuard, so push less through it. Most of my clients on hotel Wi-Fi only need their Nextcloud, Matrix server or office subnet, so I route just that:

`[Peer]
PublicKey = <server public key>
Endpoint = 127.0.0.1:50001
AllowedIPs = 10.8.0.0/24, 192.168.50.0/24

no DNS line in [Interface]: your local resolver keeps working`

With WireGuard split tunneling like this, browsing and video calls use the normal connection. Only private traffic goes through udp2raw or wstunnel. The server's public IP is outside AllowedIPs here, so there is no routing loop.

One honest note: respect your employer's network policy and your local law. These are your own tools for your own server, which is the whole point of self-hosting.

Which fix should you use?

Match your symptom to the fix:

Everything works except UDP 51820: move WireGuard to UDP 443 first. No extra software.
UDP is blocked entirely (hotel, campus, some carriers): udp2raw in faketcp mode on TCP 443.
The handshake starts and then dies, or WireGuard has been blocked for weeks: the network is fingerprinting the protocol, so use AmneziaWG.
Only TCP 443 gets out: wstunnel.
You only need one subnet or one service: use WireGuard split tunneling and skip obfuscation entirely.

Frequently asked questions

Does split tunneling break WireGuard's privacy?

No. WireGuard split tunneling only decides which traffic enters the tunnel, and that traffic stays fully encrypted. Everything else travels normally.

Can I use udp2raw with the official WireGuard app on my phone?

Not on a normal phone. udp2raw needs root and raw sockets, which regular phone apps do not get, so on mobile use the Amnezia app with AmneziaWG instead.

Is AmneziaWG safe and audited?

Largely, yes. AmneziaWG keeps WireGuard's ChaCha20-Poly1305 cryptography and only changes how packets look, and the code is open source. Check the Amnezia repositories for the current audit status.

Will a VPN bypassing a blocked network get me banned?

It can. On an employer or campus network, bypassing controls may breach an acceptable use policy, so read the rules before you tunnel around them.

If you would rather not fight MTU values and iptables rules from a hotel lobby, I can do it for you. Since 2020 I have deployed 30+ self-hosted Nextcloud, Jitsi, Matrix and VPN setups for small clients. Take a look at my self-hosting and VPN setup services and send me your server details.

Portainer 3.0 Drops the Community Edition: What Self-Hosters Should Run Instead

SelfHost Pilot — Mon, 28 Sep 2026 06:54:19 +0000

Three clients messaged me this week asking some version of "did Portainer just
kill Community Edition?" Not exactly, but if you run Portainer CE on a homelab
box or a client's Docker host, your upgrade path just changed.

Here's what happened with Portainer, why RustFS hitting 1.0 matters if you
self-host S3 storage, and the Navidrome update you should back up before
touching.

Portainer 3.0 drops the Community Edition

On 11 September 2026, Portainer CEO Neil Cresswell published a post on the
official Portainer blog titled "Portainer 3.0 is coming, and here's what it means for you." I
read it twice, since I run Portainer for half my Docker clients, and the
framing was blunt.

Portainer 2.45 LTS is the last release in the 2.x line, and Portainer 3.0
ships as a Kubernetes-first STS release with no separate Community Edition
build. CE stays on 2.x and does not get 3.x features. Free access continues
through the existing 3 Nodes Free program, not as a community-built release.

A maintenance build, 2.45.1 LTS, shipped on 17 September 2026 with security
fixes and no new features. Portainer 3.0.0 arrives as an STS (short-term
support) release, with a new 3.x LTS line later. Docker, Swarm and Podman
still work in 3.x, but Portainer calls them "secondarily ordered" in the UI,
and they won't get new capabilities in the policy engine, GitOps engine or
observability layer. Every new product in the family, including Portainer-Run,
Portainer-IDP, the Portainer-Command MCP gateway, Portainer-Operations and
Portainer-AiGrid, is Kubernetes-only. See Linuxiac's
writeup and heise online's
coverage for outside takes.

Why Portainer made the call

Cresswell's reasoning: keeping one codebase fully featured across
Docker/Podman, Swarm and Kubernetes stopped being realistic. Policy
management, the operations API and the internal auth model each had to be
built three times, once per substrate. There's an AI-agent angle too.
Portainer argues Docker and Swarm have no equivalent of Kubernetes network
policies, pod security standards or admission controllers, the primitives
you'd want to sandbox autonomous agents. That's why the new lineup only
targets Kubernetes.

After the backlash, Cresswell clarified: "We are not abandoning Docker," and
"nothing that works today gets ripped out of 2.x or the Docker environments in
3.x." He said that if Docker support ever reaches end of life, users will hear
about it well in advance with a migration path. Worth stating plainly: the
free tier going forward is a Portainer Business licence tied to an account,
not a community-maintained build. The Portainer lifecycle
docs track the support timeline.

What this means if you run Docker at home

Option	What you get	Where it breaks down
Stay on Portainer 2.45 CE	Security patches and back-ports while the LTS line
is supported	No new features, and no fixed end-of-life date has been

announced

Move to Portainer 3.x free tier| Kubernetes-first policy engine, GitOps and
observability, free via 3 Nodes Free| Docker becomes second-class in the UI
and stops getting new capabilities

Docker-first alternatives| Docker-only tools: Dockge, Komodo, Arcane, Coolify,
Dokploy| You give up Portainer's Kubernetes option if you ever need it

What I would actually run

For a single box, I run Dockge, the lightweight Compose stack manager from the
Uptime Kuma author, holding a couple of stacks on a VM I built with my own
Proxmox guide. It's MIT
licensed, it edits compose files directly, and it starts in seconds on a
Raspberry Pi. Mine sits behind my own reverse
proxy, never
exposed.

When I manage several client boxes and want GitOps, I reach for Komodo
instead. It's GPL-3.0, it handles multi-server Docker deployments, and Dockge
compose files port to it unchanged. Once you're juggling stacks across hosts,
networking is what bites, which is why I still hand clients my Docker
networking guide before
they scale up. Arcane suits anyone wanting a modern Go-based UI, and Coolify
or Dokploy cover git-push-to-deploy with automatic SSL.

None of this is urgent: if your homelab runs Portainer 2.45 CE today, nothing
breaks tomorrow.

RustFS 1.0 is out, and MinIO left a gap

On 18 September 2026, RustFS announced 1.0.0, an
Apache-2.0 licensed, Rust-based, S3-compatible object storage system pitched
as a drop-in replacement for MinIO and Amazon S3. It reports around 32,000
GitHub stars and 2.7 million instances deployed since February 2024, with the
source opened in July 2025.

1.0 covers erasure coding, tiering and S3 Tables with a built-in Iceberg REST
catalog, speaks S3, WebDAV, Swift, FTP/FTPS and MCP, and ships IAM, OIDC, KMS,
server-side encryption and mTLS, plus distributed deployment and self-healing
nodes. RustFS claims it's 2.3x faster than MinIO for 4KB objects; I haven't
verified that myself.

When MinIO adopted AGPL for parts of its stack in 2025, plenty of self-hosters
went looking for a permissively licensed alternative, and that's the gap
RustFS is filling. If your files live in Nextcloud instead of Google
Drive, it's the
sort of S3 endpoint your backup jobs would point at. My hard rule for anything
storage-related at version 1.0: never point your only backup target at it.
Test a full restore before you trust it with anything you can't afford to
lose.

Quick note: Navidrome 0.64

Navidrome 0.64.0 landed on 12 September 2026 with an experimental Jellyfin
Music API, so Jellyfin-oriented clients like Finamp and Jellify can now talk
to a Navidrome server. It also adds a new artwork pipeline with blurred
placeholders and a diagnostic CLI. Full notes are on the Navidrome releases
page.

Before you upgrade: every internal ID was re-encoded to a single canonical
128-bit base62 format, and the migration touches every table, so back up your
database first and expect clients that cache item IDs to re-sync. The release
also fixes a SQL injection via the artist role sort and filter parameters, a
share-ownership spoofing issue, and plugin SSRF guard bypasses, so it's worth
doing despite the migration risk.

Check who is behind the repo

The selfh.st weekly newsletter reported
on 18 September 2026 that BookOrbit, a suddenly popular self-hosted app,
turned out to be run by the developer behind Booklore, an app that vanished
earlier in 2026 after being called out over code quality, contributor
treatment and licence issues. Before you hand a new project your data, check
the maintainer's history and the licence, not just the feature list.

FAQ

Is Portainer Community Edition being discontinued?

Not immediately. Portainer 2.45 LTS is the last release in the 2.x line, and
Portainer 3.0 ships as a Kubernetes-first STS release with no separate CE
build. The 2.45 LTS line keeps getting security fixes while it's supported,
but no fixed end-of-life date has been announced.

Will Portainer 3.x work with Docker?

Yes. Docker, Swarm and Podman still work in 3.x, but Portainer places them as
secondarily ordered in the UI and says they won't get new capabilities in the
policy engine, GitOps engine or observability layer, since every new feature
is built Kubernetes-first.

Is RustFS a safe MinIO replacement yet?

RustFS 1.0 reached general availability on 18 September 2026 with erasure
coding, tiering, site replication and an Apache-2.0 licence. It's promising,
but after a fresh 1.0 I wouldn't move a sole backup target to it without
testing a full restore first.

My take

Nothing here means you need to touch your Docker setup today. If you're on
Portainer 2.45 CE and it works, update to 2.45.1 LTS and move on. If you're
starting fresh, or planning GitOps across multiple boxes, look at Dockge or
Komodo before committing to Portainer 3.x, unless you're actually planning to
run Kubernetes. RustFS gets the timing right, but the maturity isn't proven,
so treat 1.0 as promising rather than trusted with your only copy of anything.
This week's to-do list: update Portainer to 2.45.1 LTS, back up your Navidrome
database before upgrading, and test a restore on anything you point at RustFS.

ServerPilot Alternatives: CyberPanel, aaPanel, CloudPanel

SelfHost Pilot — Wed, 23 Sep 2026 03:38:38 +0000

ServerPilot alternatives in 2026: the short answer

The three ServerPilot alternatives worth using in 2026 are CyberPanel, aaPanel
and CloudPanel. Each has a free edition you install on your own VPS.
ServerPilot is still alive and still works well, but it charges per server and
per app, so the bill grows every time you add a client site.

A control panel is a web dashboard that installs and manages your web server,
PHP, databases and SSL. I have moved client sites from ServerPilot to all
three panels below. New to this? Start with what self-hosting
means.

What ServerPilot actually costs in 2026 (and what it doesn't do)

ServerPilot costs $5 to $20 per server plus $0.50 to $2 per app each month, on
top of your cloud bill. It is a SaaS that manages a server you rent from
DigitalOcean, AWS, Google Cloud, UpCloud or Linode.

Plans are billed hourly, with a 14-day free trial and no card needed:

Economy: $5/server + $0.50/app per month
Business: $10/server + $1/app per month
First Class: $20/server + $2/app per month

It installs Nginx in front of Apache (for .htaccess rules), PHP-FPM, MySQL,
multiple PHP versions, AutoSSL, automated security updates, an iptables
firewall and one-click WordPress, with app isolation.

It is a PHP-only tool: no email server, no DNS management and no one-click
Node.js or Python. Economy has almost no monitoring. Logs and server metrics
start at Business; per-app and MySQL metrics need First Class.

CyberPanel: free, full-featured and fast on OpenLiteSpeed

Verdict: CyberPanel is the best free pick if you need email, DNS and a
file manager in one panel for mostly WordPress sites.

It is open source and built on OpenLiteSpeed, a free web server. The free tier
includes unlimited domains, SSL, DNS, mail, FTP, a file manager, MySQL,
backups, a Docker manager, a WordPress manager, a firewall and cron.

Where CyberPanel wins

Websites and client email live on one box for $0.
Updates ship very often, so security fixes land fast — and you cannot safely skip them.

Where CyberPanel hurts

OpenLiteSpeed is not a drop-in replacement for Apache. Some .htaccess rewrite rules need hand-tuning.
Paid LiteSpeed Enterprise is billed per server. The free Starter licence caps you at 1 domain and 2GB RAM. Site Owner is $11/month (5 domains) and Web Host Lite is $28/month (unlimited domains).

aaPanel: the most features for a one-time price

Verdict: aaPanel is the right choice for a cPanel-style dashboard with
multiple users, if a China-based project is acceptable.

It is the international edition of BT Panel, with 200+ releases since 2017
and, by its own site's claim, installs on 3,000,000+ servers. The free-for-
life edition has no domain limit and includes mail, FTP, MySQL, a file manager
with a code editor, cron and Docker.

Where aaPanel wins

Pro is a lifetime licence, not a subscription. 2026 promotions ran at about $399.
Pro adds sub-accounts for shared-hosting setups, an Nginx WAF (web application firewall), file protection, bulk mail and the WP Toolkit.

Where aaPanel hurts

The free panel has an account and telemetry tie-in. Flag this if a client has data-residency or supply-chain rules.
English docs lag behind the Chinese ones.
Some Pro features are per-seat extras.

CloudPanel: free, minimal and the lightest of the three

Verdict: CloudPanel is the closest free replacement for ServerPilot,
because it does hosting well and deliberately skips everything else.

It has no paid tier, no email server, no DNS server and no web file manager.
You upload files over SFTP instead.

Where CloudPanel wins

The memory footprint is tiny. Its docs say a properly optimised 4GB RAM server can carry roughly 10–15 busy websites.
You get PHP (many versions), Node.js and Python sites, per-site databases and users, auto-renewing Let's Encrypt, a reverse proxy and Varnish-style caching.
It runs on Ubuntu, Debian, Rocky Linux 9 and AlmaLinux 9, on x86 or ARM64.

Where CloudPanel hurts

It refuses to install if Apache, Nginx or MySQL is already present, so you must start from a fresh OS.
The minimum is 1 core, 2GB RAM and 10GB disk, but I would not go below 2 cores.

Before any panel install, I run two checks on the new VPS:

free -h
systemctl list-units --type=service | grep -E 'apache2|nginx|mysql'

The first shows RAM; the second should print nothing. If it lists a service,
reinstall the OS. My NGINX reverse proxy
guide covers
custom proxy setups.

Side-by-side comparison

ServerPilot is the only option here with no free tier; the other three cost
nothing to start.

Panel| Cost (2026)| Built-in email| File manager| Reverse proxy / caching|
Best for

---|---|---|---|---|---

ServerPilot| $5/server + $0.50/app| No| No (SFTP only)| Nginx in front of
Apache| Hands-off PHP and WordPress hosting

CyberPanel| Free (open source)| Yes| Yes| OpenLiteSpeed with LSCache|
WordPress plus client email

aaPanel| Free; Pro lifetime about $399| Yes| Yes| Nginx; WAF on Pro| Multi-
user hosting

CloudPanel| Free (no paid tier)| No| No (SFTP only)| Built-in reverse proxy
and page caching| PHP, Node.js and Python apps

$0 vs $38 a month: a real cost example

Three client VPS with 8 apps cost $38 a month on ServerPilot Business and $0
on CloudPanel.

(3 servers × $10) + (8 apps × $1) = $38/month
$38 × 12 = $456/year

CloudPanel handles a setup this size comfortably, and CyberPanel on
OpenLiteSpeed is also $0. The 1-domain, 2GB RAM cap applies only to the free
Starter LiteSpeed licence.

In rupees, $38 is over ₹3,000 a month, while many of my Indian clients pay
₹400–₹800 for a Contabo or Hetzner box. Panel fees that cost more than the
server itself are the biggest reason people leave ServerPilot.

Count your hours too: the migration is a weekend if you do it yourself, or one
to two days of paid work.

Pick the panel that fits the apps you actually run, not the one with the
longest feature list.

Other ServerPilot-style tools worth knowing

If you would rather pay for a hosted dashboard:

RunCloud: no free tier since 2024. Pricing runs about $8–9/month for single-server Basic, $15 for Pro and $45 for Business, and it feels the most like ServerPilot.
Ploi: a genuinely usable free tier (1 server, 1 site, 5 deployments a month), then €8/$10 Basic, €13/$16 Pro and €30/$36 Unlimited. Its MCP server lets Claude, ChatGPT or Cursor drive your servers.
SpinupWP: WordPress only. It costs $12/month (Essentials) or $19/month (Advanced) for one server with unlimited sites, plus about $1/month per extra server.
Laravel Forge: roughly $12, $19 and $39 a month, billed per account rather than per server. It also handles Rails, Go, Node and Python.

Which one I would install for your case

The right panel depends on email, app types and who needs a login:

WordPress plus client email on one VPS: CyberPanel.
Reselling cheap hosting with a login per customer: aaPanel Pro, if supply-chain rules allow it.
Mixed PHP, Node.js and Python apps on a 2–4GB box: CloudPanel.
You never want to SSH in and are happy to pay monthly: Ploi or RunCloud.
A Laravel or multi-language dev team: Laravel Forge.

My Proxmox beginner guide covers spinning up a throwaway VM, and the WireGuard VPN
guide
keeps panel logins off the public internet.

Frequently asked questions

Is CyberPanel really free?

Yes. CyberPanel on OpenLiteSpeed is free and open source with unlimited
domains. You only pay if you move to a paid LiteSpeed Enterprise licence,
which starts at $11/month.

Do I need a control panel at all if I know Linux?

No, but once you pass two or three sites a panel saves real time. It mostly
automates SSL renewals, per-site users and safe client logins.

What is the closest thing to ServerPilot?

RunCloud is the closest paid replacement and CloudPanel the closest free one.
CloudPanel sticks to hosting like ServerPilot, and it also runs Node.js and
Python.

Can I migrate from ServerPilot without downtime?

Yes, if you build the new server beside the old one. Copy files and databases,
test through your hosts file, and lower the DNS TTL (how long resolvers cache
records) a day early. Switch DNS, run a final database sync, then cancel
ServerPilot.

Final Thoughts

ServerPilot is still a good product, but charging per server and per app hurts
small budgets. CloudPanel replaces it for most of my clients. If you need
email, choose CyberPanel, and for multi-user hosting, choose aaPanel.

If you want help setting up Nextcloud, Jitsi, Matrix or Moodle, or a careful
panel migration off ServerPilot, get in touch
here. Before any work starts, I will
tell you honestly which panel fits.

Docker Networking Explained: A Practical 2026 Guide

SelfHost Pilot — Wed, 16 Sep 2026 03:43:16 +0000

The first time I ran two containers on the same host and expected them to see
each other, I got "connection refused" for an hour. Both were up, both worked
alone, and pinging one by name from the other did nothing. In Docker, name
resolution is not automatic. It depends on which network the containers are
on.

I have deployed 30-plus Nextcloud, Jitsi, Matrix, and Moodle stacks for
clients, and almost every networking ticket traces back to four problems:
containers in one project that cannot talk, a service that answers curl
locally but not from a laptop, a database port open to the internet even
though UFW blocks it, and host mode copied from a tutorial without knowing
what it gives up.

How Docker Networking Actually Works

Every container gets its own network namespace, Linux's way of giving a
process its own interfaces, routes, and IP address. Docker links that
namespace to the host with a virtual ethernet (veth) pair: one end inside the
container, the other plugged into a bridge on the host, like a virtual switch.

That bridge is docker0 by default. Outbound traffic is translated by NAT to
the host's IP, the same trick your home router uses, and publishing a port
with -p sets up the reverse rule. That one mechanism explains most of the
surprises below.

Docker's Network Drivers, Compared

Docker Engine 29.x ships six network drivers; five matter in practice.

Driver	What it does	Use it when
bridge	Private network on the host, NAT to reach outside	Default choice for

almost every single-host setup

host| Container shares the host's namespace, no NAT| The app needs raw
throughput or binds ports dynamically

overlay| VXLAN network spanning multiple hosts| You run Swarm across more than
one server

macvlan| Own MAC address and a real IP on your LAN| The container must look
like a physical device

ipvlan| Containers share the parent's MAC, separate IPs| Your switch limits
MACs per port

none| No networking at all| Rare, for isolated batch jobs

New to containers? My Docker for beginners
guide covers the earlier mistakes.

The Default Bridge Is Not Good Enough

Installing Docker creates a default bridge called docker0 on subnet
172.17.0.0/16 with gateway 172.17.0.1. Every container started without
--network lands there.

The catch: it has no DNS between containers, so you cannot reach one by name.
The old answer, the --link flag, was deprecated years ago and should not
appear in new work; Docker's docs now treat the default bridge as legacy.

Create your own instead:

docker network create --driver bridge --subnet 172.20.0.0/16 mynet
docker run -d --name app --network mynet nginx
docker run -d --name db --network mynet postgres:16

Any network you create is a user-defined network, and Docker runs an embedded
DNS server at 127.0.0.11 inside every container attached to it. It maps
container names and aliases to their current IPs and forwards everything else
upstream. That is the biggest reason to abandon the default bridge.

docker exec -it app ping -c2 db
docker exec -it app nslookup db 127.0.0.11

Containers Talking to Containers (Compose)

This is why Compose usually just works. docker compose up creates a user-
defined bridge per project named <project>_default, so embedded DNS is live
immediately and every service is reachable by its service name.

If services cannot reach each other, check two things: they live in the same
Compose file and start together, and they connect by service name rather than
localhost. A web app should talk to db:5432, not 127.0.0.1:5432, because
inside a container localhost is the container itself.

One pattern I use often: give the database a network with no way out.

services:
  web:
    image: myapp:latest
    networks: [frontend, backend]
    ports:
      - "127.0.0.1:8080:80"
  db:
    image: postgres:16
    networks: [backend]

networks:
  frontend:
  backend:
    internal: true

internal: true means containers on backend cannot reach the internet and
nothing outside can reach them. The database can talk to web; nothing can
talk to the database directly.

Ports, UFW, and the Security Mistake Everyone Makes

This one surprises experienced admins. You configure UFW, block 5432 from
outside, run docker run -p 5432:5432 postgres, and Postgres is still
reachable from the internet. UFW never saw the decision.

Publishing a port is DNAT, and Docker writes its own rules into the DOCKER
and DOCKER-USER iptables chains, ahead of your regular firewall rules. It is
documented, expected behavior rather than a bug.

Three fixes, simplest first:

Bind to localhost: -p 127.0.0.1:5432:5432. Nothing outside the host can reach it. Put a reverse proxy in front for anything public; my NGINX reverse proxy guide covers that.
Add rules to the DOCKER-USER chain, evaluated before Docker's forwarding rules.
Use the ufw-docker tool if you want UFW to stay in charge.

For anything holding real data I use option one on nearly every client server.

When to Use Host Mode (and When Not To)

With network_mode: host the container gives up its own network namespace and
shares the host's. No veth pair, no NAT, lower latency. Fair for Home
Assistant, some Pi-hole setups, and services where NAT overhead measurably
matters.

The cost: ports: is ignored and the app binds host ports directly, so two
host-mode containers cannot both want 8080, and you lose isolation. Default to
bridge; use host mode only for a measured reason, such as multicast device
discovery.

Giving a Container a Real LAN IP with Macvlan

Macvlan gives a container its own MAC address and a real IP on your LAN, so
your router sees it as a separate physical machine. That matters for Home
Assistant when it must see Z-Wave or Zigbee devices over multicast, and for
Pi-hole when every device should use it as their DNS server by IP.

docker network create -d macvlan \
  --subnet=192.168.1.0/24 --gateway=192.168.1.1 \
  -o parent=eth0 macnet

docker run -d --name pihole --network macnet --ip 192.168.1.50 pihole/pihole

The gotcha: the host cannot talk to its own macvlan containers by default,
because traffic from the parent interface back to a macvlan child on the same
interface is dropped by the kernel. The fix is a macvlan shim, a small host
interface bridged into the same network, created with ip link add. Skip it
and the container works from every device except the one running Docker.

IPvlan is similar, but containers share the parent's MAC, which helps where
your switch limits MACs per port. Overlay is the multi-host option, tunneling
traffic with VXLAN on UDP 4789, and rarely worth the complexity outside Swarm.
IPv6 is off by default and must be enabled in /etc/docker/daemon.json. And
on rootless Docker in 2026, networking now defaults to gvisor-tap-vsock
instead of slirp4netns, a slower path than rootful Docker.

Three Fixes for the Errors I See Most

A container name will not resolve. Compare networks with docker network inspect mynet. Containers on the default bridge, or split across two Compose projects, will never resolve each other. Test from inside: docker exec -it app nslookup db 127.0.0.11.
Connection refused although the process is running. Usually not a networking problem. Check the bind address inside the container with netstat -tlnp. If the app listens on 127.0.0.1 instead of 0.0.0.0, it only accepts connections from itself, and no port mapping can fix that.
TLS handshakes hang over a VPN. Usually an MTU mismatch. Containers default to 1500 while WireGuard tunnels typically run at 1420. Set "mtu": 1420 in /etc/docker/daemon.json or per-network with driver_opts, then restart the containers.

Frequently Asked Questions

Do I need a custom Docker network?

Yes, for anything beyond a standalone container. The default bridge has no DNS
between containers, so a user-defined bridge is the standard fix for name-
based service discovery.

What is 127.0.0.11 in Docker?

It is the embedded DNS server Docker runs inside containers on a user-defined
network. It resolves container names and aliases to their current IPs and
forwards other lookups upstream.

How do I stop a container port from being public?

Bind it to localhost, for example -p 127.0.0.1:8080:80, and put a reverse
proxy in front of anything that must be public. That avoids the trap where
Docker's iptables rules bypass UFW.

Does host networking make Docker faster?

It removes NAT and the veth pair, lowering latency and CPU overhead slightly,
but the difference is rarely noticeable for typical self-hosted apps. It also
disables port mapping and isolation, so it is a tradeoff, not a free upgrade.

Final Thoughts

Most Docker networking problems come down to one root cause: not knowing which
network a container is actually on, or assuming a port is private when Docker
has quietly made it public. Create your own networks, check bind addresses,
and most of this stops being mysterious.

Setting up Nextcloud, Jitsi, Matrix, or Moodle and want a second pair of eyes
on the networking before go-live? Feel free to reach out. This is what I fix
for clients every week.

DeepSeek V4.1 Flash: MIT Open Weights, But Can You Self-Host It?

SelfHost Pilot — Mon, 14 Sep 2026 03:35:04 +0000

DeepSeek dropped a new model this week, and my inbox has three variations of
the same question: "this is open weights, right, can I run it on my server?"
Short answer: technically yes, practically no. Let me walk through why.

What is DeepSeek V4.1 Flash

DeepSeek V4.1 Flash is a 552-billion-parameter, MIT-licensed mixture-of-
experts model released on 10 September 2026, which DeepSeek says beats GPT-5.6
Sol and Claude Opus-5.0 on several agentic coding benchmarks while activating
only 8-16 billion parameters per token. Weights are public on Hugging
Face, and the
official write-up is on DeepSeek's
site and the API docs
changelog.

Starting today, 14 September 2026, DeepSeek is also rerouting all
deepseek-v4-pro API traffic to V4.1-Flash, and phasing V4-Pro out entirely.
If you were calling the Pro endpoint, you are already on this new model
whether you asked for it or not.

The architecture, in plain words

This is not just a bigger version of the old V4-Flash. DeepSeek rebuilt the
internals. It uses a new "Causal Encoder-Decoder" (CED) design: a 40-layer
transformer split into a 20-layer causal encoder and a 20-layer decoder. There
are 384 routed experts plus 1 shared expert per MoE layer, and only 6 routed
experts fire per token.

It is natively multimodal, meaning it reads images directly without a bolted-
on vision encoder. Context window is 1 million tokens, with output up to 384K
tokens. Reasoning effort is a dial you can turn from 1 to 100, so you trade
speed for depth on demand.

The KV cache work is genuinely clever: about 890 bytes per token, roughly a
quarter of the old V4-Flash and an eighth of the SSD storage, using Compressed
Sparse Attention 2, FP4 (E2M1) KV caching, SWA Bounded Replay, and a
196-billion-parameter "Engram" memory module accessed sparsely. DeepSeek
claims a 437x cache reduction versus the original V1 model. It was trained
from scratch on 45 trillion tokens, with context extended to 1M around the
34T-token mark. If you've followed the Qwen3 architecture
previews, this is the same industry trend: shrink the active compute, keep
the total knowledge huge.

Where it actually wins (and where it doesn't)

The benchmark numbers are real, but they are mixed, not a clean sweep. Here is
the comparison that matters for coding and agent work, all at max reasoning
effort.

Benchmark	DeepSeek V4.1 Flash	GPT-5.6 Sol	Claude Opus-5.0
DeepSWE v1.1	74.2	73.0	74.0
Terminal-Bench 2.1	90.6	88.8	89.1
AutomationBench	54.8	45.8	50.3
Agent's Last Exam	31.8	26.7	28.6
Terminal-Bench 4.0	31.2	n/a	51.8
ProgramBench	20.3	n/a	37.0
NL2Repo-Bench	64.0	n/a	75.3
ExploitGym	15.3	33.7	n/a

So it genuinely leads on Terminal-Bench 2.1, AutomationBench, Agent's Last
Exam, CyberGym (88.1 vs Sol's 84.5), and coding contests (Codeforces rating
3471, GPQA Diamond 90.9). But on the newer, harder Terminal-Bench 4.0 and
ProgramBench, Opus-5.0 beats it by a wide margin, and on exploit-writing
(ExploitGym) GPT-5.6 Sol is well ahead. Independent testers on
flowtivity.ai
also found it failed a Rubik's Cube simulation stress test that other coding
models handle fine. This is not a model that beats everyone at everything. It
is strong on specific agentic tasks and weaker on longer, messier real-world
repo work.

The self-hosting reality

Here is the part that matters most for this blog. Yes, the weights are on
Hugging Face under MIT licence. No, that does not mean you can run this on
your homelab box.

The checkpoint is around 510 GB. That alone rules out almost every consumer
setup. But the bigger issue is something people misunderstand about sparse MoE
models: even though only 8-16B parameters are active per token, all 552B
parameters still need to sit in memory (VRAM, ideally), because the router can
send any token to any of the 384 experts. "Sparse" saves you compute, not
memory. You cannot page experts in and out from disk fast enough to keep up
with real inference speed.

For comparison, the previous-generation V4-Flash was 304B total, about 13B
active, a 166.9 GB download, and it fit on 2x H200 GPUs. This new model is
bigger, not smaller. Industry estimates from Yotta
Labs put the practical floor at a full 8-GPU node, not the 2x H200
that used to be enough. According to
mindstudio.ai,
DeepSeek has not published an official minimum-VRAM number, community GGUF and
AWQ quantizations were still pending at launch, and the early local runs
people reported were on multi-GPU servers or rented cloud GPUs, not gaming
rigs or single-box homelabs. There's also a good technical rundown of the KV
cache work on NYU Shanghai's
blog
if you want the deeper math.

In my lab, the practical cutoff for "can I run this on hardware I own" has
always been: does it fit on one or two consumer or prosumer GPUs after
quantization. This model doesn't get close. Even a heavily quantized version
would need well over 128 GB of fast memory just for weights, before you add KV
cache for a 1M-token context. That is enterprise GPU cluster territory, not a
Proxmox box in a spare room (my Proxmox
guide assumes normal
hardware, not 8-GPU nodes).

What I'd actually do

If you want to use V4.1-Flash today, use DeepSeek's API. Pricing is genuinely
cheap: roughly $0.15 per million input tokens off-peak (up to $0.30 at peak),
$0.60 per million output tokens, and as low as $0.003 per million for cache-
hit input. That is why they're killing V4-Pro, which cost about 4x more for
less capability.

For actual self-hosting on hardware a freelancer or small team can own, I'd
still point people toward smaller open models that fit on 1-2 GPUs, the kind I
covered in the Muse Glimmer writeup or the monthly open-source repos
roundup. If you're routing API calls to a model like this from your
own infrastructure, put it behind a private tunnel rather than exposing keys
on a public box; my WireGuard setup
guide
covers that, and if you're storing outputs or logs, something like Nextcloud
instead of Google Drive keeps that data under your control too.

My verdict

DeepSeek V4.1 Flash is a real technical achievement and the licence is
genuinely open. But "open weights" and "self-hostable" are two different
promises, and this release only keeps the first one for most of us. Unless you
have access to an 8-GPU enterprise node, you are using this model through
DeepSeek's API like everyone else, cheap pricing and all. That's not a bad
outcome, just don't let the word "open" fool you into thinking it belongs on
your home server.

Matrix vs Slack: Self-Hosted Team Chat in 2026

SelfHost Pilot — Thu, 10 Sep 2026 12:03:27 +0000

Your team needs chat. The question is: who should own the conversation — a
company in San Francisco, or you?

Slack is easy. Everyone knows Slack. But every year, more businesses are
asking the same question: why are we paying forever for something we could
run ourselves?

Matrix is the answer for a growing crowd. Let's compare them honestly — no
hype, no jargon walls.

What you actually pay

Slack's pricing is simple and painful: the paid plans start around $8.75 per
person per month. A team of 20 people? That's about $175 a month, every
month, forever. The free plan exists, but it hides your history after 90
days — which makes it useless for real work.

Matrix is open source. The software costs nothing. You pay for a small server
(a $5–10 VPS works fine for a small team) and a domain you probably already
own. For a 20-person team, that's roughly $10 a month total — about 94%
less.

Who owns your data?

With Slack, every message sits on Slack's servers. Your contracts, your plans,
your honest internal conversations — all readable by a company you don't
control, under laws you don't choose.

With Matrix, the server is yours. Your data lives on hardware you control,
in a country you choose. If privacy matters to your clients — and it should —
that's a difference you can sell.

What Matrix actually involves

Let's be honest: self-hosting Matrix isn't a Saturday-afternoon project for a
beginner. Here's what a real setup includes:

Installing Synapse (the Matrix server) with Docker
Setting up a domain and HTTPS certificates
Turning on registration the right way (so strangers can't join your server)
Configuring backups — a chat history you can't restore is a chat history you never had
Updating it regularly (like every self-hosted thing, updates are homework)

None of it is magic. It's the same work any serious IT setup needs — just done
once, properly.

Where Slack still wins

Fair is fair. Slack has polish Matrix is still catching up on:

It just works — zero setup, instant invites
Better mobile apps in some areas
A huge marketplace of integrations
Your whole team already knows it

If you're a three-person startup shipping next week, Slack is fine. You're
paying for speed and convenience — and that's a legitimate choice.

Where Matrix wins

Cost — near zero per user, forever
Privacy — your server, your rules, your jurisdiction
Interoperability — Matrix connects to other Matrix servers and even bridges to Slack, Teams, and WhatsApp
No vendor lock-in — the protocol is open; nobody can switch your service off

The honest verdict

Pick Slack if you want zero effort and don't mind renting your conversation
history.

Pick Matrix if you're past 10–15 people, care about privacy, or simply hate
the idea of a monthly bill that grows as your team grows.

And if the setup part scares you — that's fair too. It's real work. The good
news: it's exactly the kind of work I do for a living. I set up Matrix servers
for businesses — properly, with backups, monitoring, and documentation in
plain English. If you'd rather have it done right the first time, my inbox is
open.