Windows computer. Install natively or in Docker?

[rob51 0]

I'm trying to decide if I want to move my Emby server install from a regular Windows install to a Docker container within Windows.  The only reason would be to limit further intrusion if my Emby server were compromised from the Internet.

I created a separate non-admin user and run Emby Portable as that user via a service (created with NSSM).  Ideally that user will have full permissions to C:\Emby, write permissions to a transcoding temp folder, and read-only permissions to my media.  The biggest issue with compartmentalizing my "EmbyServer" user with those permissions is... I cannot.  Even if I only give EmbyServer read permissions to my media, it still has write permissions because of the dynamic Authenticated Users group.  See attached photos.  I can't just willy-nilly start removing that permission from folders (especially roots of drives) because that will break some other programs.  So as it stands now, if my server is compromised, even that basic user EmbyServer can cause some damage.  This can be fixed if I move to Docker, but I'd really rather not.

I'm a new Emby user having come over from a decade+ of Plex.  Has anyone had their Emby server compromised?  If so, was it a bug or something you did or didn't do with your home firewall?

-----------------------

Further info: I front Emby app with pfSense.  I use my own domain and SSL is managed with ACME.  Emby is piped through a reverse proxy haproxy with very curated permissions.

• Requests have to match my https://embyserver.mydomain.com exactly, or they are denied.
• Run it on a high port
• If any IP tries to login more than 45 times in a few minutes, I block them.
• Prevent long URL path hunting
• and more

 

[Abobader 3516]

Hello rob51,

** This is an auto reply **

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[rob51 0]

4 times, not 45 times!  I can't seem to edit that post.

[Luke 43115]

Quote

install to a Docker container within Windows

Hi, just be aware, we have not been testing our docker container on windows at all, so we really have no idea how that would go.