While you can run HA as a container. I think it's a mistake - Its more complicated and has reduced features.

I would instead recommend people use HAOS instead - either running on dedicated hardware OR as a VM. Just dont run it from an SD card if you go down the Raspberry Pi/SBC route - it will kill the card from IO cycles.

I have an IOT VLAN on my network that all the IOT bits sit in, including WIFI devices. What internet access it gets (if any) depends on the device profile.

I tried splitting things up into multiple VLANs but a whole lot of things assume just a flat network, so things stop working if you get too fancy.

> it will kill the card from IO cycles.

It might not. I have a Raspberry Pi 2 that has been running a weather station for over 12 years, and it has been on the original SD card. I have other RPi's doing dumb things around the house and I have never had an SD card failure.

YMMV and all that.

HA in particular creates a lot of log churn. It's not a 100% certainty, but after running for 4 years I finally had to copy the SD image to a new one because it had become unwritable.

Dirty power kills my raspis faster then write cycles. I've been really surprised with the stability once I moved by Pis to my UPS

Yeah, I haven't had issues with SD cards in a long time. Many years ago (maybe 10), I think they weren't quite as good and I probably skimped too much when buying a card. RPi 1 also had power regulation issues. Now I only use higher tier cards and make sure there's enough free space for wear leveling and operations.

My friend bought an ODROID and an SD card at the recommendation of some tech YouTuber for Home Assistant. Within 3 years the SD card was dead, and I had to help him re-set-up all of his stuff (this time, with a more resilient storage medium and remote backups).

YMMV certainly applies but I feel like the warning is important.

I wouldn't put running a weather station in the same class of disk activity as running Home Assistant. It is writing a fairly large amount of logs, plus statistics for every attribute/sensor for every device. The more devices you have, the more you will be writing.

There are regularly threads from people with "I restarted HA and now I get this weird boot error message", and it's because their SD card died.

You do you, but it's common enough of a problem that I think it's worth calling out as a "Don't do this".

I run HA on another RPi, so I am familiar.

On the weather station I wrote to the SD card 1,068,266 database records, along with all the nginx logs, etc...

> it's common enough of a problem

It's probably survivorship bias, where everyone complains about SD card corruption, while those with no issues really don't say anything. Well, except my comments today.

Fair point on survivorship bias. But, I think SD card being flash memory is technically expected to fail over time, with that failure compounded by the number of write cycles. These cycles are a spec of the SD card. If a section/page of the flash is being overwritten more frequently than the other, then surely it'll fail faster than an SD card whose erase/write cycles are distributed uniformly across all the sections/pages.

I go the container route, and have only had one issue: allowing HA to access my system's Bluetooth adapter. I had some ESP32s lying around, so I used ESPHome to make a Bluetooth proxy, which solved that issue.

I don't run addons though, which might be part of it.

Interesting. I also run HA in a container and getting it to pick up my Zigbee dongle was so easy I don't even remember how I did it.

I haven't tried BT, but my HA box lives underneath a couch with a big steel pull-out bed so I don't imagine it would work very well anyway.

The host I run HA on is Ubuntu server. If memory serves me right, the Bluetooth issue was related to apparmor and dbus restrictions on docker

I haven't done it either. But it should just be a case of passing the device to the container. You might need to disable the host from using it and pass admin rights to the container too.

But it was also quite easy to pass a USB device to the HAOS VM in Proxmox.

Add-ons (now apps) can't be done without HAOS. It's one of those non-obvious things.

There's other things I forget which are also more difficult/annoying to manage on the container version.

I have a rather large docker compose stack so my first experiments with HA were as running it there.

That lasted maybe a week before I went and ran it as a VM instead.

Yeah, I ended up buying a dedicated mini PC ($100 refurb) to install HAOS on. HA is pretty much useless without being able to run add-ons. I run everything on k8s in my home server, I don't have a VM system set up and didn't want to bother just for HA. It's funny, the pattern of a central application that uses docker containers to add plugins seems like a perfect fit for a Kubernetes Operator. I suppose it still misses out on some of the advantages of running everything "on metal" for integrating with physical components like USB dongles.

It's kind of silly since they're just containers it runs anyways. I'm sure there's other reasons. At least running it as a VM isn't too hard. Pretty easy to use their image and run from that.

Apps/add-ons is just another container, so you can add them manually in the compose file.

Yep, I run esphome in a separate stack w/o issues.

> I go the container route, and have only had one issue: allowing HA to access my system's Bluetooth adapter

Even without running in a container, I had huge problems with Bluetooth on Linux (it would just ... stop then not reappear or it would only talk to half the devices but a different set of devices every other day, etc.)

(This isn't specifically a HASS problem, mind; I've had countless problems with Linux Bluetooth since 2003 over many different iterations of hardware, OS and dongle.)

> I used ESPHome to make a Bluetooth proxy, which solved that issue.

Same. It's a great solution.

What router and associated configuration software are you using? I have a Eero mesh network that leaves a lot to be desired for a fiddler like me.

I'm using OPNSense for the router, on their dedicated hardware - DEC750 iirc.

The switches are mostly Mikrotik, with some Unifi switches.

The wifi APs are all Unifi - they are all PoE and wired into the same network, no mesh. Even between buildings I ran fibre.

For the switching and routing, were I to do it again now I might go all Unifi. They recently implemented some much needed updates to make doing things like firewall rules and routing based on device much easier. I have a complicated set of rules in OPNsense to route IOT VLAN traffic out via a VPN connection, which require static IP assignments via DHCP, but under the new Unifi network I could do it with a few clicks and being able to use device attributes rather than a static IP.

I am also using an SLZB-MR1 for a ZigBee controller and Matter over Thread border router. I've got a bunch of IKEA and Mercator ZigBee light bulbs/fixtures that act as ZigBee routers. It's a strong enough mesh I rarely have issues with the ~180 devices on the net.

> While you can run HA as a container. I think it's a mistake

Just because you CAN run something in a container, does not mean you should.

HAOS exists because it is a docker run time. It is a whole ecosystem, not just the home assistant software itself.

A few years ago I was checking out of a reasonably up-scale hotel in Barcelona early in the morning.

They punch numbers into one of those wireless hand terminals. I tap my card, enter the pin and then before I can react to what the screen is now saying they've punched the 'Accept Conversion' button and submit it. By the time I realise what has happened, it's too late and has started printing the reciept.

I insisted they reverse it and redo the transaction without that - the staff didn't understand and didn't care they'd cost me another 10-15%. It really adds up for a week long stay.

I once asked a cashier about this and they said it saved me money. They said representatives from the large national bank had done a presentation and noted how this is the best option for foreigners. I think they truly believe they are being helpful. Closest thing to legalized robbery.

I had the exact same thing happen to me at a hotel in China. I could not get the person at the checkin desk to understand the problem so I ended up having to just eat the extra cost. Very frustrating, it was not a small amount of money.

What the fuck? Why are they tapping the terminal before you've confirmed the transaction?

In my experience, staff will do this if they are pressed for time, or when tourists don't know how to read or operate the payment systems and linger.

Well, it’s an unwise strategy to use on me if they’re feeling pressed for time. I will get enjoyment from putting my foot down for as long as is needed to reach a resolution.

That’s a 20+ minute decision they just made to try to save a few seconds.

Instagram did a similar thing for me back in 2016-ish.

A family member had been sharing some photos they were taking, but only on Instagram.

So I signed up an account, verified via email and phone number. I wasn't initially able to find the family member's account. A week later after I got the spelling of their username right, Instagram popped up "Your account has been suspended". They then sent me an email saying I needed to take a photo of myself holding government ID, and a piece of paper with a hand-written code they supplied, plus a close-up photo of said government ID. No way was I supplying all that just to be able to browse some photos.

A selection of times it's been previously posted:

(2018, 222 comments) https://news.ycombinator.com/item?id=17135841

(2022, 166 comments) https://news.ycombinator.com/item?id=30595026

(2024, 139 comments) https://news.ycombinator.com/item?id=39136472 - by the same submitter as this post.

My desk has 2x 27" and 1x 43" Dell monitors. Unfortunately the new work MacBook only supports two external displays so one of those 27 sits idle.

What used to be nice is now a case of constantly shuffling windows, not made easy by MacOSs janky window handling.

I've been looking for a second 43" to replace the 27"s but the high price and sub-par quality of the 43 is making me wait.

I am also finding it difficult to find monitor arms that will carry such large and heavy screens. The 43 is already at the limit of the one reasonably priced arm I found and a definite struggle to mount.

good news: that seat design is available and some airlines use it.

> some airlines use it.

and there lies the rub.

I've run into this a bunch too.

Just this week I wanted Claude Code to plan changes in a sub directory of a very large repo. I told it to ignore outside directories and focus on this dir.

It then asked for permission to run tree on the parent dir. Me: No. Ignore the parent dir. Just use this dir.

So it then launches parallel discovery tasks which need individual permission approval to run - not too unusual, as I am approving each I notice it sneak in grep and ls for the parent dir amongst others. I keep denying it with "No" and it gets more creative with what tool/pathing it's trying to read from the parent dir.

I end up having to cancel the plan task and try again with even more firm instructions about not trying to read from the parent. That mostly worked the subsequent plan it only tried the once.

Did you ask it why it insisted on reading from the parent directory? Maybe there is some resource or relative path referenced.

I'm not saying you should approve it or the request was justified (you did tell it to concentrate on a single directory). But sometimes understanding the motivation is helpful.

If we define face scanning as specifically doing facial-recognition over multiple cameras, stores and/or time, then it's quite clear and simple.

A store could easily have security cameras operating without issue. They don't need to do any more smarts on it.

It's where you draw the line on smarts that's the thing.

- Person-shaped-object crossed from public-area to private area (eg through a staff-only door) without a corresponding door swipe event.

- Person-shaped-object appears to take an object off a shelf and put it in their bag/pocket.

- Specifically tracking a person over multiple cameras in one visit as they navigate the store, without associating with an identity

- Using facial recognition to recognise the same person over multiple visits/stores, and being able to track their activity over all of those visits.

There could be arguments for some of these being permitted without it being a total invasion of privacy.

I agree but unless the industry is forced they are not implementing this in a privacy friendly way. They rather collect as much data as possible.

One of the major advantages for Wireguard over OpenVPN (for me) is that it's quite difficult for random port scans to detect it.

With OpenVPN it's hanging out there responding to everyone that asks nicely that yes, it's OpenVPN.

So anyone with a new exploit for OpenVPN just has to pull up Shodan and now they've got a nice list of targets that likely have access to more private networks.

Wireguard doesn't respond at all unless you've got the right keys.

Also, fwiw - we're approaching 11 years since it was announced, and 5 years since it was accepted into the Linux/BSD kernels.

> With OpenVPN it's hanging out there responding to everyone that asks nicely that yes, it's OpenVPN.

I believe asing UDP mode and a ta.key go a long way towards making OpenVPN invisible to port scans. Double check docs for details.