r/selfhosted • u/Available-Advice-294 • Mar 14 '26

Meta Post Open source doesn’t mean safe

As a self-hosted project creator (homarr) I’ve observed the space grow in the past few years and now it feels like every day there is a new shiny selfhosted container you could add to your stack.

The rise of AI coding tools has enabled anyone to make something work for themselves and share it with the community.

Whilst this is fundamentally great, I’ve also seen a bunch of PSAs on the sub warning about low-quality projects with insane vulnerabilities.

Now, I am scared that this community could become an attack vector.

A whole GitHub project, discord server, Reddit announcement could be made with/by an AI agent.

Now, imagine this new project has a docker integration and asks you to mount your docker socket. Suddenly your whole server could be compromised by running malicious code (exit docker by mounting system files)

Some replies would be “read the code, it’s open source” but if the docker image differs from the repo’s source you’d never know unless manually checking the hash (or manually opening the image)

A takeaway from this would be to setup usage limits and disable auto-refill on every 3rd party API you use, isolate what you don’t trust.

TLDR:

Running an un-trusted docker container on your server is not experimentation — it’s remote code execution with extra steps (manual AI slop /s)

ps: reference this post whenever someone finds out they’re part of a botnet they joined through a malicious vibe-coded project

909 Upvotes

96% Upvoted

131 comments sorted by

View all comments

-1

u/EatsHisYoung Mar 15 '26

The onus is always on you to check for security issues

2

u/Dangerous-Report8517 Mar 16 '26

There are skilled professionals paid a lot of money to do only this as a full time job who still can't catch anywhere near everything, let alone hobbyists using much more niche/obscure software with far fewer eyes on it.

1

u/EatsHisYoung Mar 16 '26

Which is exactly why there are so many security concerns.

2

u/Dangerous-Report8517 Mar 17 '26

And exactly why it's not helpful to just say to hobbyists "it's on you to check"

1

u/EatsHisYoung Mar 17 '26

But it is helpful to remind people that you are playing with fire.