Syncthing: your own Dropbox with no cloud in the middle

why your files don't need a middleman

every time you save something to dropbox, google drive, or icloud, you're trusting a company to hold your data, encrypt it the way they decide to, and not get breached, subpoenaed, or quietly change their terms of service. syncthing skips all of that. it syncs files directly between your own devices, laptop to phone to home server, with no cloud account, no third party server, and no subscription. just your stuff, moving between things you own.

what syncthing actually is

syncthing is open source software that creates an encrypted connection between devices you control and keeps folders in sync across them. no central server sits in the middle reading your files. it's peer to peer, it's free, and it's been around long enough to be boring in the best way, which in security terms means stable and well tested.

running it in docker makes it even easier to manage, because you're not installing anything directly on your system, you're just spinning up a contained instance you can update or tear down cleanly.

spinning it up

here's the basic command to get a syncthing container running:

docker run -d \
  --name syncthing \
  -p 8384:8384 \
  -p 22000:22000 \
  -v /path/to/config:/var/syncthing/config \
  -v /path/to/sync:/var/syncthing/sync \
  syncthing/syncthing

breaking that down: -d runs it in the background. -p 8384:8384 exposes the web gui you'll use to manage everything. -p 22000:22000 is the port devices actually use to sync with each other. the two -v lines map a config folder and a sync folder from your machine into the container, so your settings and files survive even if you rebuild the container later.

lock the gui before you do anything else

this is the step people skip and immediately regret. syncthing's web interface ships wide open, no password, no login. if that gui is reachable on your network, or worse, exposed to the internet, anyone who finds it can see your synced folders and devices. as soon as the container is up, go to the gui, set a username and password under settings, and if you don't need remote access, make sure port 8384 isn't forwarded on your router at all. that port should only be reachable from inside your own network.

connecting your devices

syncthing identifies devices by a long random device id instead of an account or email. to link two devices, you add each one's id to the other, both sides have to approve the connection, and from there you choose which folders to share. the connection between devices is encrypted in transit using tls, so even if someone's sniffing traffic on the same network, they're not reading your files.

this is also where the privacy upside shows up. there's no company holding a copy of your files on a server somewhere. your data only exists on devices you personally approved.

sync is not a backup, don't confuse the two

here's the part that actually matters for defending your data long term. syncthing keeps files identical across devices. if you delete a file on one device, or if ransomware encrypts a file on one device, that change syncs everywhere, instantly. sync is not protection against mistakes, it's just mirroring.

a real backup means versioned, offline, or offsite copies that a live sync can't touch. syncthing does have a built in file versioning option that keeps old copies for a while, which helps, but it's not a substitute for an actual backup strategy. pair this setup with something like restic, borg, or even a simple external drive that isn't always connected, so one bad sync event can't wipe out everything at once.

the takeaway

self hosting your own sync setup cuts out the company in the middle, keeps your files encrypted between devices you control, and costs nothing but a little setup time. just remember the two defender basics here: lock that gui down before it's exposed, and never let sync be the only copy of anything you care about. secure the access point, then back up like the sync isn't there at all.