just bought synology nas few days ago and setting it up.... whoa so much information that I can't digest gives me headache. Thank you I just didn't get anything out of watching well made video (totally on me) I might have to watch several more times repeatedly..
Frank, this is by far “THE BEST” video out there on TH-cam. You have a gift of explaining complex topics in a way that is simple to understand! Loved every minute of it!
I've got a whole mess of stuff running on Docker on an old Intel NUC machine I have. I am SO glad to hear you talk about the importance of docker compose. I... knew it, from just the way I am, but had no real reason, other than "can change it and try again". And I may move things like photoprism, qbit, *arr, plex, all from that machine onto the DS1522+. Hopefully, my docker compose setups for each will make that easy. I am SO glad to see the DSM allows it, too! (Instead of it being an afterthought...) It's too bad, though, you can't create "stacks", though, like "media", "photos", "databases" with multi-setup docker compose YAML files. Or can you? Now that I type it, I think you can....since the image location is in the dc.yaml, NOT in the UI when using Projects!
Great video. It really gave an insight on how to practically use Container Manager on my Synology NAS. However I won't be using it for pihole. I'll run that on my Raspberry Pi 4B so it will remain active for all of my other devices when I have to shutdown my NAS.
The tech GOAT is back at it again, thanks for the tutorial! I had a question though. How do the persistant volumes work? I recently setup a container (mbentley/omada-controller) and created folders for DATA/LOGS/WORK. The container runs fine and I was able to setup my Omada Controller, but I see no data/files at all in any of the mapped volumes (DATA/LOGS/WORK). Is this because I don't have a compose file?
hahaha, thank you! If there is no data on the NAS itself (in the Docker folders that you mapped), the mapping isn't working. Either it's not mapped to the correct location on the NAS (/volume1/docker/[folder]), or the container folder (will be something with a forward slash in it - /data for example) isn't the correct path. Once the container runs, there should be some sort of data in at least one of the folders above. There could be some that are delayed (for example, no logs until logs occur, etc), but data should exist somewhere.
@@WunderTechTutorials Thanks for the reply! I believe I figured it out. I was following someone else's tutorial last night, and they had the mapping completely wrong. I didn't realize the left side of the colon (:) is the created path, while the right side is the actual path within the system. Would the best way to donate be the SUPER THANKS? Or do you have a "buy me a coffee" link. Thanks for your content!
I haven't personally done it, but I believe that you can. How easy it is would be harder to comment. From what I can tell from Google, Docker Compose might be your best option.
Hey Frank, as usual, great video! If I already have all of my containers running in Portainer on Synology, is there a good reason to migrate them back to Container Manager? I have a few stacks running multiple containers from the same docker compose file.
Thanks for the great info! I wonder about which users have access to view/use/modify the Container Manager app? In Control Panel -> Application Privileges this package does not appear, and I haven't found any documentation that mentions this. Some containers setup login credentials using plaintext environment variables, so I'm trying to think through the implications...
I'm not exactly sure what the default user is, but I am fairly certain it's NOT root (since you can specify that). I know certain containers allow you to specify the UID/GID to run the container as a specific user, but that's really container-specific. As for the credentials, it's really container-specific as well. Some allow you to pass the credentials in through a secrets file, but it's very different based on the container, etc (and I haven't used Synology + a secrets file...generally a Portainer thing for me).
@@WunderTechTutorials Thanks for the reply :) I was actually thinking about which DSM users would have access to open the Container Manager app other than admins?
@@AnomalyMP Oh, my apologies. Should be the admins only! As far as who can access the actual application Docker is hosting, it'll be anyone on the local network (but you can limit it with Synology's firewall if you'd like).
*Thank you very much for your Video!, Unfortunately, the Synology Drive has a major problem:* It does not map the NAS access rights to the clients: If, for example, a user on the NAS has read-only access to a folder, he can change the folder content on his client. Synology Drive *does not* synchronize this content, but because it allows the user to do this, this is an extremely bad problem because it leads to many misunderstandings and problems. (e.g. a user changes a document but the team does not know anything about it. *It's a nightmare,* because the user says for example: "I've checked and updated the contract, you can sign it and send it to the customer." *Of course, Synology Drive must map NAS access-rights to the synced folders on the Clients (which is a simple to program code). Otherwise very bad things can happen.*
I will be honest in saying that I never thought of that scenario and it's definitely a valid one. My only concern is that I'm not exactly sure how they'd fix it since the user will have read/write permissions on the local folder and they can't (or at least shouldn't) modify the permissions of the local files. However, an indicator on the file letting the user know that it's read-only would definitely be helpful!
I was about to install Pihole following your written tutorial in your webpage. Then, I saw your TH-cam video version that you used two networks (the bridge and the mcvlan). but in the compose version for DSM 7.2 in your webpage with container manager you do not mention nor add this bridge network and just used the macvlan "ph_network". Is there any reason not using the ph_bridge in the compose file? Also, I suggest if (just if) you have Ubiquiti Unifi devices, to do an Add-on video setting up Pihole with UDM Pro/SE gateway for example, as I pretty sure the DNS Server setup per under each VLAN is not working, instead I have to setup the DSN Server into DNS Server Setup into Internet Options WAN rather than per VLANS. I have spent months and payed with firewall rules and I cannot get it working per VLAN, as directly into the WAN is not recommended. I really hope you can take a look.
I spent about 3 hours trying to get the bridge network interface working with Docker Compose and it just won't work. The sad part is, I don't even know why because it works on other devices with Docker Compose. The second you add it to the Compose file, it tries to use it as the primary network interface and runs into issues. I am hoping it's a Synology bug and will try the compose file again after future updates. I think for now if you want it, you have to use Synology's GUI. With that said, it could certainly just be the compose file I created, but I don't think so. For UniFi, I do have a Dream Router that I have access to for tutorials but I use pfSense. I am not a fan of how UniFi handles their firewall rules and find them to be incredibly complicated for what you're actually doing. When pfSense is simpler from a firewall perspective, you know something is off, but the whole In/Out/Local thing just seems confusing to me. Again though, it could just be me. I do use UniFi for my Switches/AP's (and love them), but don't have a configured firewall to test with. Maybe in the future if they revamp the firewall section!
I installed a few containers but I need to open the ports of externally. I port forwarded on my router but port is still closed? Do you got a video on what I'm missing? I tried adding the router and stuff like that also. It tests ok but still not open. Even disabled firewall to test. Nada
I have firewall disabled, even enabled it and did the allow rule. Oddly enough I somehow got my qBitorrent docker container to work a while back and I remember it took me like 10 days to figure it out, now I am trying to do a game server, but can't for the life of me figure out what I did to make qBitorrent work. I am not behind a double nat, I did port forward on my router. My head is hurting trying to figure this out... I honestly didn't think you'd reply, also don't feel obligated to help but if you did have a video on how to install something like a torrent client (qbitorrent) and have those ports open so that others can seed off you etc. or even a gaming server so others can connect to it that would be great. I setup a Palworld server, but none of my friends can connect, only local lan, its driving me nuts. @@WunderTechTutorials
When you're setting the file paths, you mention the default "./etc-pihole" is the root directory - it's not, it means from where the process started("./"). On the assumption that docker starts in docker/pihole(in this case), can't you just literally leave this alone and it should work? Your only task is to make the folders as you've done.
The only way that I've done it in the past in terms of boot order is by using both containers in the same Docker Compose file. With that said, if it's currently working as expected, I don't think you'd have to change anything.
How does this video, basically ignoring Portainer, compare to today's Terramaster video where Portainer seems to put Container Manager in the back seat in terms of usage? Sorry, just trying to dive into the details a little and I feel a little conflict with Portainer vs Container Manager vs Docker Compose vs...........
The short answer is that Portainer is an incredible tool for Docker container management. My comment about why it's better than Container Manager is basically that Container Manager is built on top of DSM, while Portainer is built for Docker management. It's really just that. The downside of installing Portainer on a Synology is that you need to do it through the command-line interface. If you're comfortable there, it's not difficult at all. In terms of why I think TOS needs to ditch it - the actual Docker GUI they have is not good and Portainer is installed in their package center. Synology's is actually good, and while it's not as good as Portainer, it's 75% there which is enough to make it a suggested, usable option.
I just followed these instructions to install pihole with the compose file. It went fine and is up and running, but when I try to update my Gravity adlists, I get a "connection refused" error on each one. Anybody know how to debug this?
Basically, you can run tons of different services inside of Docker. Hard to explain in a message like this, but this video dives a little deeper into why you might want to run Docker: th-cam.com/video/cJvx7sKbiAI/w-d-xo.html
anyone know why my Minecraft server when i start it up says its healthy soon as i join it has now saying warning unhealthy but unsure how to check why its unhealthy
@@WunderTechTutorials thanks for replying , great video by the way but na cant see anything that stands out, only thing i can maybe think of is that in the Minecraft logs some plugins could be the issue, being some are old so maybe with the new container manager its just thinking its unhealthy when its not, as it did not do this in the old docker manager only when i updated to this new container manager, or at least did not noticed until this new update, but i mean it still running and everything seems fine, so im just going to leave it and see what happens lol,
THERE IS SOMETHING I’M NOT GETTING AND IT’S MAKING ME FURIOUS… Why is it that, instead of providing adequate and detailed, easy to follow documentation and videos, based on its products Synology relies on people like yourself to create TH-cam videos at YOUR expense and YOUR time - whilst they benefit from the generation of a larger customer base leveraged off of the back of people like you rendering their hardware useful..??? WHY ARE WE PAYING $YNOLOGY ??? WE SHOULD BE PAYING YOU …I guess it’s no longer a mystery what the ‘S’ stands for in Synology
Hello, not sure but a couple of days again I posted a question concerning Docker security - see NasCompares - th-cam.com/video/q6EWb5Uf4UA/w-d-xo.htmlfeature=shared, but looking through the comments I see that post was deleted? Anyway, can you provide any insight concerning this issue??
It's hard for me to comment on that because it's a huge topic with tons of different scenarios. In summary: 1. Don't give containers root permissions. In all of the tutorials I create, I avoid this, but if you have done it in the past, consider removing it. 2. Don't expose services to the outside internet if you don't have to. Even services that you do have to - learn what you're doing and see if there are any ways to increase the security (like potentially utilizing a reverse proxy for authentication, etc). This is just general info and I admit that, but it's hard to give a suggestion when the article stated that 22,000+ containers were compromised. Without knowing what they are or what they do, best practices are your best form of protection.
Thanks for your quick response! I understand and you make a good point. I enjoy your videos they are very informative. Keep up the great work!!@@WunderTechTutorials
No beginners guide is going to show that. Every container is accessed differently - you need to look up how to access whatever container you're using on the correct port(s).
I finally feel like I have somewhat of a grasp on containers. Thank you.
Just wanted to say thank you :) U saved me on the volume thing, was stuck on this one ....
OMG what a great tutorial. It was a pleasure to watch and i learned a lot! thank you Frank!
Thanks, Avi! Appreciate you watching!
very good video, nice calm voice and perfectly to understand as a non native speaker :)
just bought synology nas few days ago and setting it up.... whoa so much information that I can't digest gives me headache. Thank you I just didn't get anything out of watching well made video (totally on me) I might have to watch several more times repeatedly..
It's definitely a lot at first, but you'll slowly get it! Let me know if you have any questions!
Frank, this is by far “THE BEST” video out there on TH-cam. You have a gift of explaining complex topics in a way that is simple to understand! Loved every minute of it!
Thank you, Tony! I really appreciate you watching!
Well done!!! This made me truly understand, how docker containers work. Well deserved thumbs-up and abo!!!
Thanks! Glad it helped!
Thanks a lot, I find the defines for my container with your video.
Massive solid and clean pitch. Thank you.
I can tell I should have got into NAS and docker in my 20's when I still had brain cells. In my late 30's I am barely keeping up with this.
You can do it! Definitely confusing early on but once it clicks, I promise it'll all make sense.
@@WunderTechTutorials
[INSERT ROB SCHNEIDER MEME HERE]
Better in your 30s than in your 40's...trust me, it gets worse.
Perfect information and very good expaind, good job.
Thank you! Your videos are always so good and full of great insight!
Thanks for explaining the mac/vlan. Appreciated it.
Great explanation Thank you very much!
I've got a whole mess of stuff running on Docker on an old Intel NUC machine I have. I am SO glad to hear you talk about the importance of docker compose. I... knew it, from just the way I am, but had no real reason, other than "can change it and try again". And I may move things like photoprism, qbit, *arr, plex, all from that machine onto the DS1522+. Hopefully, my docker compose setups for each will make that easy. I am SO glad to see the DSM allows it, too! (Instead of it being an afterthought...) It's too bad, though, you can't create "stacks", though, like "media", "photos", "databases" with multi-setup docker compose YAML files. Or can you? Now that I type it, I think you can....since the image location is in the dc.yaml, NOT in the UI when using Projects!
Definitely agree - this is the exact scenario where Docker Compose shines!
Great video. It really gave an insight on how to practically use Container Manager on my Synology NAS. However I won't be using it for pihole. I'll run that on my Raspberry Pi 4B so it will remain active for all of my other devices when I have to shutdown my NAS.
Thank you so much for this awesome tutorial!
Simple ,to the point information, just as I like it. Keep up the good work!
Thanks a lot for the explanation
Excellent run through thank you
Very useful, thanks!
as always, awesome!
Great content as always
Thank you so much!
The tech GOAT is back at it again, thanks for the tutorial! I had a question though. How do the persistant volumes work? I recently setup a container (mbentley/omada-controller) and created folders for DATA/LOGS/WORK. The container runs fine and I was able to setup my Omada Controller, but I see no data/files at all in any of the mapped volumes (DATA/LOGS/WORK). Is this because I don't have a compose file?
hahaha, thank you! If there is no data on the NAS itself (in the Docker folders that you mapped), the mapping isn't working. Either it's not mapped to the correct location on the NAS (/volume1/docker/[folder]), or the container folder (will be something with a forward slash in it - /data for example) isn't the correct path.
Once the container runs, there should be some sort of data in at least one of the folders above. There could be some that are delayed (for example, no logs until logs occur, etc), but data should exist somewhere.
@@WunderTechTutorials Thanks for the reply! I believe I figured it out. I was following someone else's tutorial last night, and they had the mapping completely wrong. I didn't realize the left side of the colon (:) is the created path, while the right side is the actual path within the system. Would the best way to donate be the SUPER THANKS? Or do you have a "buy me a coffee" link. Thanks for your content!
@@JBehrMusic Glad you figured it out! I have a Ko-Fi link on my website but it's definitely not necessary. Thank you for the support!
Great Job. Can i delay start of a container? As one of them is dependent on the other. Example: GluetunVPN and Deluge.
I haven't personally done it, but I believe that you can. How easy it is would be harder to comment. From what I can tell from Google, Docker Compose might be your best option.
I have this error message "Bind mount failed: '/volume1/docker/pihole/etc-dnsmasq.d' does not exists"
How can I fix it
You will have to create the folder.
Hey Frank, as usual, great video! If I already have all of my containers running in Portainer on Synology, is there a good reason to migrate them back to Container Manager? I have a few stacks running multiple containers from the same docker compose file.
Thank you! Short answer, if they're all running and you're happy with it, no need to change it. This is just another option!
Thanks for the great info! I wonder about which users have access to view/use/modify the Container Manager app? In Control Panel -> Application Privileges this package does not appear, and I haven't found any documentation that mentions this. Some containers setup login credentials using plaintext environment variables, so I'm trying to think through the implications...
I'm not exactly sure what the default user is, but I am fairly certain it's NOT root (since you can specify that). I know certain containers allow you to specify the UID/GID to run the container as a specific user, but that's really container-specific.
As for the credentials, it's really container-specific as well. Some allow you to pass the credentials in through a secrets file, but it's very different based on the container, etc (and I haven't used Synology + a secrets file...generally a Portainer thing for me).
@@WunderTechTutorials Thanks for the reply :) I was actually thinking about which DSM users would have access to open the Container Manager app other than admins?
@@AnomalyMP Oh, my apologies. Should be the admins only! As far as who can access the actual application Docker is hosting, it'll be anyone on the local network (but you can limit it with Synology's firewall if you'd like).
how would you auto update Pi-hole running in a docker container on the NAS?
Watchtower
*Thank you very much for your Video!, Unfortunately, the Synology Drive has a major problem:* It does not map the NAS access rights to the clients: If, for example, a user on the NAS has read-only access to a folder, he can change the folder content on his client. Synology Drive *does not* synchronize this content, but because it allows the user to do this, this is an extremely bad problem because it leads to many misunderstandings and problems. (e.g. a user changes a document but the team does not know anything about it. *It's a nightmare,* because the user says for example: "I've checked and updated the contract, you can sign it and send it to the customer."
*Of course, Synology Drive must map NAS access-rights to the synced folders on the Clients (which is a simple to program code). Otherwise very bad things can happen.*
I will be honest in saying that I never thought of that scenario and it's definitely a valid one. My only concern is that I'm not exactly sure how they'd fix it since the user will have read/write permissions on the local folder and they can't (or at least shouldn't) modify the permissions of the local files.
However, an indicator on the file letting the user know that it's read-only would definitely be helpful!
Awesome
I was about to install Pihole following your written tutorial in your webpage. Then, I saw your TH-cam video version that you used two networks (the bridge and the mcvlan). but in the compose version for DSM 7.2 in your webpage with container manager you do not mention nor add this bridge network and just used the macvlan "ph_network". Is there any reason not using the ph_bridge in the compose file? Also, I suggest if (just if) you have Ubiquiti Unifi devices, to do an Add-on video setting up Pihole with UDM Pro/SE gateway for example, as I pretty sure the DNS Server setup per under each VLAN is not working, instead I have to setup the DSN Server into DNS Server Setup into Internet Options WAN rather than per VLANS. I have spent months and payed with firewall rules and I cannot get it working per VLAN, as directly into the WAN is not recommended. I really hope you can take a look.
I spent about 3 hours trying to get the bridge network interface working with Docker Compose and it just won't work. The sad part is, I don't even know why because it works on other devices with Docker Compose. The second you add it to the Compose file, it tries to use it as the primary network interface and runs into issues. I am hoping it's a Synology bug and will try the compose file again after future updates. I think for now if you want it, you have to use Synology's GUI. With that said, it could certainly just be the compose file I created, but I don't think so.
For UniFi, I do have a Dream Router that I have access to for tutorials but I use pfSense. I am not a fan of how UniFi handles their firewall rules and find them to be incredibly complicated for what you're actually doing. When pfSense is simpler from a firewall perspective, you know something is off, but the whole In/Out/Local thing just seems confusing to me. Again though, it could just be me.
I do use UniFi for my Switches/AP's (and love them), but don't have a configured firewall to test with. Maybe in the future if they revamp the firewall section!
I installed a few containers but I need to open the ports of externally. I port forwarded on my router but port is still closed? Do you got a video on what I'm missing? I tried adding the router and stuff like that also. It tests ok but still not open. Even disabled firewall to test. Nada
Are you using Synology's firewall by any chance? If so, did you create an allow rule?
I have firewall disabled, even enabled it and did the allow rule. Oddly enough I somehow got my qBitorrent docker container to work a while back and I remember it took me like 10 days to figure it out, now I am trying to do a game server, but can't for the life of me figure out what I did to make qBitorrent work.
I am not behind a double nat, I did port forward on my router. My head is hurting trying to figure this out... I honestly didn't think you'd reply, also don't feel obligated to help but if you did have a video on how to install something like a torrent client (qbitorrent) and have those ports open so that others can seed off you etc. or even a gaming server so others can connect to it that would be great. I setup a Palworld server, but none of my friends can connect, only local lan, its driving me nuts.
@@WunderTechTutorials
When you're setting the file paths, you mention the default "./etc-pihole" is the root directory - it's not, it means from where the process started("./"). On the assumption that docker starts in docker/pihole(in this case), can't you just literally leave this alone and it should work? Your only task is to make the folders as you've done.
Yes, you are correct. You can.
How could I manage the boot order of the containers everytime that I restart my nas? I need to load first pi-hole and then unbound.
The only way that I've done it in the past in terms of boot order is by using both containers in the same Docker Compose file. With that said, if it's currently working as expected, I don't think you'd have to change anything.
can you please explain how to SSH to docker container on Synology NAS ??
It's explained here: www.wundertech.net/how-to-use-docker-on-a-synology-nas/
@@WunderTechTutorials many thanks
СПАСИБО :)
How does this video, basically ignoring Portainer, compare to today's Terramaster video where Portainer seems to put Container Manager in the back seat in terms of usage? Sorry, just trying to dive into the details a little and I feel a little conflict with Portainer vs Container Manager vs Docker Compose vs...........
The short answer is that Portainer is an incredible tool for Docker container management. My comment about why it's better than Container Manager is basically that Container Manager is built on top of DSM, while Portainer is built for Docker management. It's really just that.
The downside of installing Portainer on a Synology is that you need to do it through the command-line interface. If you're comfortable there, it's not difficult at all. In terms of why I think TOS needs to ditch it - the actual Docker GUI they have is not good and Portainer is installed in their package center. Synology's is actually good, and while it's not as good as Portainer, it's 75% there which is enough to make it a suggested, usable option.
I just followed these instructions to install pihole with the compose file. It went fine and is up and running, but when I try to update my Gravity adlists, I get a "connection refused" error on each one. Anybody know how to debug this?
Did you add any lists or is this right after the default setup?
@@WunderTechTutorials It looks like I needed to open 443/tcp in my firewall. Then the list update successfully.
i can't even get mine fixed. it's in permanent repair status. can't re-install it or repair it at all
great video. i use watchtower for updates
What is docker and why would i need it ?? Until today I'm using my Synology only as a backup target for my computers...
Basically, you can run tons of different services inside of Docker. Hard to explain in a message like this, but this video dives a little deeper into why you might want to run Docker: th-cam.com/video/cJvx7sKbiAI/w-d-xo.html
@@WunderTechTutorials Thank you for your quick answer.
anyone know why my Minecraft server when i start it up says its healthy soon as i join it has now saying warning unhealthy but unsure how to check why its unhealthy
Is anything mentioned in the Docker logs?
@@WunderTechTutorials thanks for replying , great video by the way
but na cant see anything that stands out, only thing i can maybe think of is that in the Minecraft logs some plugins could be the issue, being some are old so maybe with the new container manager its just thinking its unhealthy when its not, as it did not do this in the old docker manager only when i updated to this new container manager, or at least did not noticed until this new update, but i mean it still running and everything seems fine, so im just going to leave it and see what happens lol,
I am using watchtower to update my containers automatically.
THERE IS SOMETHING I’M NOT GETTING AND IT’S MAKING ME FURIOUS…
Why is it that, instead of providing adequate and detailed, easy to follow documentation and videos, based on its products Synology relies on people like yourself to create TH-cam videos at YOUR expense and YOUR time - whilst they benefit from the generation of a larger customer base leveraged off of the back of people like you rendering their hardware useful..???
WHY ARE WE PAYING $YNOLOGY ??? WE SHOULD BE PAYING YOU
…I guess it’s no longer a mystery what the ‘S’ stands for in Synology
Hello, not sure but a couple of days again I posted a question concerning Docker security - see NasCompares - th-cam.com/video/q6EWb5Uf4UA/w-d-xo.htmlfeature=shared, but looking through the comments I see that post was deleted? Anyway, can you provide any insight concerning this issue??
It's hard for me to comment on that because it's a huge topic with tons of different scenarios. In summary:
1. Don't give containers root permissions. In all of the tutorials I create, I avoid this, but if you have done it in the past, consider removing it.
2. Don't expose services to the outside internet if you don't have to. Even services that you do have to - learn what you're doing and see if there are any ways to increase the security (like potentially utilizing a reverse proxy for authentication, etc).
This is just general info and I admit that, but it's hard to give a suggestion when the article stated that 22,000+ containers were compromised. Without knowing what they are or what they do, best practices are your best form of protection.
Thanks for your quick response! I understand and you make a good point. I enjoy your videos they are very informative. Keep up the great work!!@@WunderTechTutorials
a begginers guide that doesnt show how to actually access these containers
No beginners guide is going to show that. Every container is accessed differently - you need to look up how to access whatever container you're using on the correct port(s).