Docker may be enough isolation for a small home server
A setup with Plex, Emby, or Jellyfin can either keep using Docker on a directly installed Debian server or move to Proxmox with separate . The Docker option separates internal-only services and internet-facing services with different VLANs, different , separate , and firewall rules.
The Proxmox option puts the internal side and external side into separate and then applies a similar network split. The practical conclusion is that Debian plus Docker is usually enough for this kind of home lab, and may add more complexity than benefit.
Both designs still need some openings for . Full separation is also limited if the external service needs to read files from an internal NFS share that holds the storage.
Key points
- The setup is about home media services such as Plex, Emby, or Jellyfin.
- Docker on Debian was judged good enough for normal home lab use.
- VLANs, , and firewall rules can separate private and public services.
- Proxmox with gives stronger separation but adds management work.
- NFS storage sharing can weaken a clean split between internal and external services.