Yantr：以无根 Podman 容器替代 Umbrel 的自托管应用平台

The Problem with Umbrel & Friends

Platforms like Umbrel want to be your OS. Dedicate a machine, surrender the environment, live by their rules.

Yantr is an app, not an OS. It runs as a single rootless container on the machine you already have — laptop, Raspberry Pi, old PC, home server. Your host stays untouched. Your files stay put. Yantr manages rootless Podman stacks alongside everything else.

┌──────────────────────────────────────────┐
│            Your Operating System         │
│                                          │
│  ┌──────────────┐   ┌─────────────────┐  │
│  │    Yantr     │   │   Your existing │  │
│  │  (container) │   │   apps & files  │  │
│  └──────┬───────┘   └─────────────────┘  │
│         │ Podman user socket             │
│  ┌──────▼────────────────────────────┐   │
│  │  Jellyfin · n8n · Nextcloud · …   │   │
│  │      (isolated Podman stacks)     │   │
│  └───────────────────────────────────┘   │
└──────────────────────────────────────────┘

🛡️ Rootless by Design: Why Podman Over Docker

Most homelab platforms and container managers rely on Docker running as a root-level daemon. While popular, Docker's monolithic architecture introduces critical security vulnerabilities, host filesystem modifications, and single-point-of-failure risks.

Yantr was built from day one to run 100% rootless on Podman. Here is how they compare:

Key Architectural Advantages

1. True Rootless Isolation (Zero Host Root Privileges)

Under standard Docker, the container engine runs as root. Granting a user access to the Docker socket or docker group is practically identical to granting passwordless sudo. If any web app or container has a zero-day exploit or escape vulnerability, the attacker gains root control of the physical host.

Under rootless Podman, Yantr runs entirely inside Linux user namespaces (subuid and subgid). Even if an app runs as "root" (UID 0) inside its container, the Linux kernel maps that UID to an unprivileged user ID on the host. If an attacker breaches the container sandbox, they have zero host root permissions: they cannot read /etc/shadow, cannot overwrite host binaries, and cannot install system-wide rootkits.

2. Daemonless Architecture (No Single Point of Failure)

Docker requires dockerd running continuously in the background. If the Docker daemon crashes, hangs, or restarts during a package update, all running containers can be killed or lose network connectivity. Furthermore, the idle daemon constantly consumes memory.

Podman is daemonless. It uses a direct fork/exec model managed by lightweight conmon (container monitor) processes. There is no central daemon to crash. If Yantr itself is stopped, restarted, or updated, all of your background applications (Nextcloud, Jellyfin, Vaultwarden, AI models) continue running uninterrupted.

3. Native Linux systemd Integration (Quadlet)

Docker fights your operating system with its own restart policies and proprietary supervisors.

Yantr embraces the native Linux init system using systemd Quadlet (.container declarations in ~/.config/containers/systemd/):

• Auto-starts on boot via standard Linux user lingering (loginctl enable-linger).
• Native administration: Control Yantr using standard systemctl --user {status,restart,stop} yantr.
• Unified system logging: Stream live container logs directly with journalctl --user -u yantr -f.
• Native cgroups v2: Clean per-service resource limits and process tracking managed directly by the kernel.

4. Untouched Host Networking & Firewall Safety

Docker notoriously rewrites host iptables and nftables rules directly. On Linux distros like Ubuntu or Debian, Docker often punches holes right through UFW (Uncomplicated Firewall) without warning, accidentally exposing internal database ports or admin panels to the public internet.

Rootless Podman executes network routing strictly within an isolated user network namespace (via pasta or slirp4netns). It never modifies host firewall rules. Your host firewall configuration stays 100% intact and trustworthy.

5. Transparent Docker Socket Emulation Without Root Risk

Many popular homelab tools (such as Glances, Beszel, Portainer, or Arcane) expect /var/run/docker.sock. On Docker, mounting this socket hands the container keys to the kingdom.

Yantr automatically detects and routes Docker socket requests to Podman's unprivileged user socket (/run/user/$UID/podman/podman.sock). The apps function with complete Docker compatibility, but without giving them root privileges on your host machine.

🚀 Quick Start

One-line installation on Linux (automatically configures rootless Podman and systemd Quadlet):

curl -fsSL https://cdn.jsdelivr.net/gh/besoeasy/yantr@latest/install.sh | bash

The script is also in the repo root as install.sh. The one-liner above resolves @latest to the newest tagged release via jsDelivr, so users always get a released installer — never whatever is sitting on main.

Run as your normal user — never with sudo. Yantr is rootless-only by design. Installed as root it would attach to a rootful Podman service, so every app it deploys would hold full host root — exactly what the architecture above exists to prevent. The installer refuses to run as root.

Or run manually with rootless Podman:

podman run -d \
  --name yantr \
  --network host \
  --security-opt label=disable \
  -e HOST_PODMAN_SOCKET=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/podman/podman.sock \
  -v ${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/podman/podman.sock:/run/podman/podman.sock \
  -v yantr_data:/data:z \
  -v /:/host:ro \
  -v /sys:/sys:ro \
  ghcr.io/besoeasy/yantr:latest

HOST_PODMAN_SOCKET tells Yantr where the socket lives on the host, which is the path it hands to apps mounting /var/run/docker.sock (Portainer, Homarr, Glances). Without it Yantr has to ask the Podman API at runtime, and apps that need the socket can fail to deploy.

The two read-only /host and /sys binds are what back the host dashboard: filesystem usage and hardware temperatures. CPU, memory, load, uptime, disk I/O and per-interface network are read straight from /proc, which needs no mount because those files are not PID- or network-namespaced. Skip the binds and everything still works — those two tiles just report as unavailable.

Open http://localhost:5252 and create your operator account on first visit.

📦 App Catalog

A curated app catalog, one-click deploy.

Browse all in apps/ · Add your own via the authoring guide

✨ What Makes It Different

Zero OS footprint — Yantr never writes to your host. Every app is a Podman Compose stack with named volumes. Uninstall and nothing is left behind.

Automatic Docker socket translation — Apps requesting /var/run/docker.sock (such as Glances, Beszel, Arcane, or Portainer) are automatically routed to your rootless Podman socket with zero configuration.

Full environment control — Edit env vars per deployment. No fixed presets, no platform lock-in. Deploy the same app twice for testing, family, or clients.

No dependency hell — Python, Node, CUDA, whatever — each app brings its own runtime inside its container. Nothing conflicts.

Built-in networking — Port conflict detection and Cloudflare Tunnel for public exposure.

Volume browser — Inspect and manage your app data directly from the browser.

REST API — Every action (install, update, remove, logs) is a JSON endpoint. Scriptable and CLI-friendly.

Star History

License

Yantr is source-available under the PolyForm Noncommercial License 1.0.0.

• Personal, hobby, and homelab use: yes
• Study, change, and share the source under the same terms: yes
• Schools, charities, and other noncommercial orgs: yes
• Commercial use (sell it, host it as a paid product, run a business on it): no

The source stays public. The short version is at the top of LICENSE.