THAT OLD LAPTOP is a home server.

that laptop in your drawer with the cracked hinge and the battery that lasts eleven minutes isn't garbage. it's a perfectly good little server that can run your own cloud instead of renting one from a company that mines your data for a living. this post walks through turning it into a docker homelab and, more importantly, how to keep it locked down once it's live.

why this matters for privacy

every time you use a hosted note app, photo backup, or password manager, you're trusting someone else's server with your stuff. self-hosting flips that. you control the data, the access logs, and who gets in. a homelab isn't just a hobby project, it's one of the more practical privacy moves a regular person can make, because the fewer companies holding your data, the fewer breaches you have to worry about.

the command, broken down

curl -fsSL get.docker.com | sh && docker ps

curl -fsSL get.docker.com reaches out to docker's official install script and pulls it down quietly. the -f stops it from printing garbage on a failed request, -s keeps it silent, -S still shows real errors, and -L follows redirects since that url bounces to the actual script.

the | sh part pipes that script straight into your shell to run it. this is convenient, but it's also worth knowing that piping a remote script into your shell means you're trusting the source completely. for a first-time install that's a reasonable tradeoff since it's docker's own domain, but it's a good habit to peek at what a script does before running it on anything that matters. you can do that with:

curl -fsSL get.docker.com -o install.sh
less install.sh
sh install.sh

the && docker ps only runs if the install succeeded, and it lists running containers. on a fresh install it'll come back empty, which just confirms docker is alive and listening.

setting it up without leaving the door open

an old laptop repurposed as a server is still a computer sitting on your network with a screen shut most of the time, which means you'll forget about it. that's exactly the kind of machine that gets neglected on patches. before you install anything else, do these:

sudo apt update && sudo apt upgrade -y
sudo ufw enable
sudo ufw allow ssh

that updates the system and turns on a basic firewall that blocks everything except ssh by default. any container you expose later, you allow explicitly, not by accident.

docker specific traps to avoid

docker containers are isolated, but "isolated" doesn't mean "safe by default." a few things people miss:

don't run containers as root unless you have to. a lot of images default to it, and if something inside gets compromised, root in the container can sometimes mean more access to the host than you'd like. check an image's docs for a non-root option.

don't publish ports you don't need. every -p flag in your docker run command opens a door from your network into that container. if a service only needs to talk to other containers, use docker's internal networking instead of exposing it externally.

keep images updated. a container built from an old base image can carry old vulnerabilities forever if you never rebuild it. run:

docker image ls
docker pull <image>
docker compose pull && docker compose up -d

to refresh things instead of letting containers sit untouched for a year.

protecting your homelab long term

if you're exposing anything to the internet, put it behind a reverse proxy with automatic https instead of forwarding raw ports, and use a vpn like wireguard or tailscale so you're the only one who can reach your admin panels. change default passwords on every service the moment you spin it up, not "later." and back up your container volumes somewhere off that machine, because a homelab with no backup is just a very elaborate way to lose your files.

the takeaway

an old laptop plus docker is a real privacy upgrade, not just a fun weekend project. the same one liner that gets you started is also a good reminder to slow down and understand what scripts you're running, what ports you're opening, and what you're exposing to the internet. build it, lock it down, and that dead laptop becomes the most useful thing in the house.