Pocketdesk, self-healing homelabs, and running your own GitHub
This week: Pocketdesk puts your desktop on your phone with no account or cloud, a self-healing homelab that knows when not to act, and running Forgejo as a second Git home.
Homelab Highlights
A show about homelab infrastructure, self-hosted tools, community discoveries, and the practical operational lessons that matter, released three times a week.
Latest Episodes
GameVault 2 goes Linux, hot-file tiering for Unraid, and a Brother printer reborn on a Pi
GameVault 2 public beta brings a Linux client, Unspin plugin automates hot-file tiering on Unraid, and a native ARM driver revives a Brother DCP-150C printer on a Raspberry Pi. Plus a Proxmox UEFI vulnerability heads-up, JellyPi for Pi-based Jellyfin, and a free open-source iOS app for managing Unraid and the *arr stack.
Tailscale SSH trouble, native Dolby Vision on a mini PC, and proving backups actually boot
This week: unpatched Tailscale SSH flaws that let a hacked device reach root, native Dolby Vision Profile 7 FEL on an Intel N100 mini PC via LibreELEC/Kodi, PBP for automated Proxmox restore testing, Bambu Open Network for Home Assistant printer control, CodeNomad 1.0 self-hosted coding agent workspace, and a detailed migration from Proxmox to Nix.
Node.js patch day, EcoFlow pulls the plug, and a receipt printer that runs the family
Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools. Today: Node.js ships critical security patches, EcoFlow asks an open-source Home Assistant integration to stop, Unraid and YunoHost both push PHP fixes, Pangolin 1.25 adds mTLS and redirects, a new DDoS mitigation tool called NetDeflect, and a Raspberry Pi receipt printer that runs the family.
LiteLLM ships a stealer, PHP needs patching, and a house that heats itself
LiteLLM 1.107.0 shipped a credential stealer and backdoor. PHP php2shell RCE requires immediate upgrade. eMudhra CA certs leaked. Plus MuckScraper 1.0, Jellyfin tuner plugin, and a 3D digital twin for home heating.
pug.sh Analytics, Deco VLAN Fix, and Homelab Diagram Update
Explore pug.sh self-hosted analytics, learn why Promtail is EOL and how to migrate to Grafana Alloy, fix TP-Link Deco VLANs, and see a six‑diagram homelab redesign.
HACS moves in, dead Macs get jobs, and a wall clock cuts the cord
This week: HACS becomes part of Home Assistant core, FLODE visualizes automations without its own editor, Let's Encrypt shortens cert lifetimes, and a Docker backup reality check. Plus, a dead-screen M1 MacBook becomes a 24/7 NVR, and an Echo Wall Clock cuts the Amazon cord.
11 SaaS replacements' real RAM costs, dual-GPU Minisforum build
This episode covers a real-world RAM cost breakdown for replacing 11 SaaS apps with self-hosted alternatives, a dual-GPU Minisforum build for local LLMs, a new Nextcloud photo rating app, and two Immich tools for storage optimization and TV slideshows.
GitLab's 10.0 RCE, UniFi Goes Matter-Aware, and an AI That Refused to Port a Game
Today on Homelab Highlights: GitLab's critical unauthenticated RCE, active exploitation of a WordPress plugin, UniFi's new Matter support, Docker security updates, Withings API changes, and a community story about AI and reverse engineering.
Let's Encrypt 64‑Day Certs, AnyDesk Linux Exploit
Let's Encrypt cuts TLS cert lifetimes to 64 days, AnyDesk Linux flaw yields root access, AhsayCBS backup flaws deploy miners, and a voice‑coded blog feature.
Podman App Store Eases Home Lab, Local LLMs Shine
Homelab Highlights covers a Podman app store that eases container use, local LLM tricks via Discord, a TLS certificate hijack, and the latest self‑hosted user survey.
MiniStack Web Console Launches, ZFS Tips, Jellyfin Tradeoff
Explore a new web UI for MiniStack, ZFS best practices on Proxmox, Jellyfin vs Plex remote access, a Proxmox file‑level restore portal, and a security flaw in MCP AI agent communication.
GitLab's critical AI Gateway patch and Homarr v2
GitLab has patched a critical command execution flaw in the self-hosted AI Gateway, fixed in versions 19.2.4, 19.3.2, and 19.4.1. Microsoft shipped wslc for running Linux containers in WSL without Docker Desktop. An open-source tool generates subtitles with ElevenLabs speech-to-text and Gemini for about nine cents per 90-minute video. Sucuri details a self-healing WordPress backdoor that rebuilds itself after cleanup. And Homarr v2 arrives with Custom Widgets, a community Workshop, Integration Requests, and optional MCP support.
RSA panic explained, Zimbra exploited, and a $92 homelab
A viral headline about breaking RSA faster than ever turns out to apply only to blind-signature RSA, not the padded RSA behind standard TLS certificates. Then a roundup of active threats: unauthenticated code execution attacks against Zimbra Collaboration Suite, a high-severity DTLS leak fixed in OpenSSL, Cloudflare's multi-year push toward hybrid post-quantum TLS certificates, and new audio playback options in Plex Web. Plus, a look at Copyparty's WebDAV timestamp quirk on macOS, and a community build where a simple RAM upgrade spiraled into a 22-core, 128 GB ECC TrueNAS machine for roughly ninety-two dollars net.
Carbonato hijacks Docker daemons, plus a local Roborock win
This week on Homelab Highlights: researchers break down the Carbonato botnet, which compromises exposed Docker daemons and repurposes the open-source Hermes Agent framework for Telegram-based command and control. We cover actively exploited SharePoint and MikroTik RouterOS flaws, a Rust-built Distributed-JBOD storage project for pooling mismatched drives, and a community debate on whether Claude Code earns its place alongside n8n. Our tool highlight is Local Roborock Server, now out of beta with fully offline vacuum control, and our community highlight documents three weeks running a Minisforum N5 Max as a single-box NAS, media, and local AI machine.
Lighter turns a Mac Mini into a Frigate server, plus Roundcube and WordPress exploits
Homelab Highlights for 2026-09-25: Lighter is a Rust container engine that turns an Apple Silicon Mac into a real Home Assistant and Frigate server with Neural Engine detection and hardware video decode. In the feed, active exploitation of a patched Roundcube pre-auth SQL injection and a WordPress unauthenticated RCE exploited within hours of disclosure, plus four self-hosted services worth running. Tool highlight: a hands-on test of four AI agent memory SDKs that all failed a simple contradiction test. Community highlight: disabling Proxmox KSM cut idle power by nine to ten watts on one homelab box.
Ubuntu container escape exploit and Spinifex's AWS-on-your-hardware
Homelab Highlights for 2026-09-23: an exploit for an unpatched Ubuntu kernel flaw that enables container escape to host root, the MikroTrick vulnerability chain hitting internet-exposed MikroTik routers, new Plex audio enhancements, a major HA-arr-stack-card update, Filewright for AI-assisted photo organization, a tool dive into Spinifex, the open-source AWS-compatible cloud for your own hardware, and a community story about moving from Claude Code to open-source models.
Fluado's one-week Big Tech exit and a Gitea patch
Homelab Highlights for September 21, 2026: Fluado's founder details moving 17 US Big Tech dependencies in about a week to Hetzner, Forgejo, self-hosted Supabase, Scaleway, and Mattermost. Gitea users are urged to patch a file-read flaw that can chain into remote code execution, an Aqara FP300 owner updates sensors over Matter and Thread without an Aqara hub, and Youtarr 1.84.0 adds watched-status sync, cleanup rules, and whole-channel downloads. Plus: whether one Deviceside PSU5 can power two TEAC floppy drives, and a platform engineer's overly-documented homelab README.
tapflow for mobile testing, Unbound DNS flaw, and open-source tracker
This episode covers tapflow for self-hosted mobile simulator access, a critical Unbound DNS vulnerability, the l0destar open-source vehicle tracker, and a community project archiving Minor League Baseball data.
Pangolin 1.23 HA, Cloudflare AI Scraping, and a Portable Homelab
Pangolin 1.23 adds high availability clustering. Cloudflare updates AI crawler controls. A community story on downsizing a homelab for a move.
Red Heron's Gitea RCE Campaign and Blockbusterr v2.0
Red Heron exploits Gitea RCE, CISA adds 5 flaws to its KEV catalog, and Blockbusterr v2.0 adds rule-based media discovery for homelabs.
Vaultisse for Physical Books and Claude's PCB Design
This episode covers Vaultisse, a self-hosted app for tracking physical book collections, and a hobbyist's successful attempt to design a printed circuit board using Claude's Fable 5 model.
nanoCron's Container Scheduling and AI Coding Pace
This episode covers nanoCron, a new container-native cron alternative with JSON config and resource-aware scheduling, and a developer's reflection on Claude Code's impact on cognitive pacing and mental fatigue.
Crawler Costs, Agent Swarms, and a Web-Based Video Tool
This episode covers the massive resource cost of abusive crawlers on public services, Google DeepMind's research on cheating AI agents, OpenAI's undisclosed wiki incident, and a client-side video compression tool using FFmpeg and WebAssembly.
Kubernetes v1.37 Scales to Zero, 1Password Backlash, BGP Hijack
Kubernetes v1.37 brings scale-to-zero to beta, 1Password faces backlash over a Linux foundation donation, a BGP hijack pushes malware, plus Docker's SBX AI Evaluation Kit and smart home controller updates.
Kubernetes Storage Migrations, Security Cameras for Birds, and the Update Dilemma
Kubernetes v1.37 automates storage migrations. A homelab project turns security cameras into bird identifiers. Plus, balancing container updates and supply chain security.
Meta's AI Agent Disruption and Critical Gitea Patch
Meta's scrapped AI agent plan caused a 40% incident spike. Plus, critical patches for Gitea and Ubiquiti, and a mysterious new AI coding model.
Building a Container by Hand, MinIO's End of Life, and Walgit
This episode covers building a Linux container by hand for learning, Docker's Extended Lifecycle Support for the archived MinIO project, the Walgit single-binary Git server, Nextcloud Hub as an alternative to Microsoft 365, and a speculative essay on LLM security risks.
Self-Hosted Agent Factories and Plex Rollbacks
This episode covers a detailed walkthrough for building a self-hosted, sandboxed AI agent factory, advice on rolling back a problematic Plex container, a look at the Floppy media tracker, and a community story about the unexpected costs of an AI experiment.
Self-Hosted Agentic Factory, Plex Container Bug, and Floppy Media Tracker
This episode covers a blueprint for a self-hosted, sandboxed AI agentic software factory, a Plex container update bug, Backblaze hard drive reliability data, Spotify's Soloist client, Debian's AI contribution vote, the Floppy media tracker, and a viral AI agent's Cloudflare bill.
Docker's Zero-CVE Push, Fairphone Camera, and Quantization Rules
Docker expands its Hardened Images program, a Fairphone 6 camera works on PostmarketOS, and the local AI community calls for standardized specs.
Nextcloud updates, RustDesk on Wayland, and a 50TB data scare
This episode covers Nextcloud Hub maintenance updates, RustDesk's new unattended Wayland access, a cautionary tale of 50TB of data stuck in a defunct cloud, the NoteDiscovery notes app update with plugins, a community toolkit for Dell T110 II ECC reporting, and a quick tip on monitoring Docker container restarts.
Self-Hosted AI Software Factory, Hotio Plex Bug, and Floppy Media Tracker
A self-hosted AI software factory blueprint, a Hotio Plex container bug, the Floppy media tracker, and the real cost of letting AI agents build.
Black Hat BMC Vulnerabilities and a Nextcloud Developer Workshop
Black Hat research reveals critical BMC vulnerabilities affecting homelab servers. Plus, a Nextcloud developer workshop and Docker's take on AI governance.
Keyv NPM Attack, NutriTrace v1.1.0, and AI Code Review Risks
This episode covers the active Shai-Hulud NPM supply chain attack targeting Keyv, the NutriTrace v1.1.0 release with in-app updates, Flowise AI's shutdown, Docker's supply chain incident stats, and a study on the risks of using AI for code review.
Docker OIDC, KEDA scale-to-zero, and Shotcut hardware encoding
Docker adds OIDC for GitHub Actions. A homelab operator shares a KEDA scale-to-zero blueprint. Shotcut improves hardware encoding. Plus VictoriaMetrics memory fix.
OpenAI's Hugging Face hack and Docker's AI sandbox
This episode covers the details of OpenAI's breach of Hugging Face via a JFrog zero-day, Docker's new sandbox for securing AI coding assistants, the self-hosted music tool Aurral, and a practical tip for automating against backend APIs instead of brittle UI scraping.
Caddy-NetBird integration, Chrome on ARM64, and AI coding harnesses
This episode covers integrating Caddy and NetBird for secure remote access, Google Chrome's native ARM64 Linux build, a federated approach to self-hosted email, Minecraft's new 16GB memory recommendation, and a user-tested AI coding harness setup.
Xray-core Tunnels Under Pressure and Mini PC Price Shifts
This episode covers a detailed account of running self-hosted tunnels using Xray-core's Reality protocol under aggressive ISP inspection, a fundamental community discussion on always-on Plex servers, and the changing economics of mini PC hardware for home servers.
DVinyl 3.0's Rewrite, Docker's Quote Bug, and Nextcloud Patches
This episode covers DVinyl 3.0's complete TypeScript rewrite, a long-standing Docker CLI parsing bug for environment files, Nextcloud's July maintenance updates, a security camera with a leaked GitHub token, and AI-assisted Plex projects from the community.
Dockerfile security shifts, TreeSize's subscription push, and USBridge-Remote
Dockerfile security shifts after TanStack, TreeSize pushes subscriptions, USBridge-Remote for remote access, and the environmental cost of GPUs for homelabs.
Nextcloud's Community Awards and a Dell OptiPlex Windfall
Nextcloud launches its inaugural Community Awards for its 10th anniversary. A homelabber scores free Dell OptiPlex Micro PCs from a corporate refresh. Self-Host Weekly shares new Insider perks and covers Linus Torvalds's stance on AI in Linux kernel development.