Systemd & Containers
Use systemd for native hosts or rootless containers for isolated deployments.
Rootless Podman
podman run --name fluxheim --replace \
-p 8080:8080 \
-v ./fluxheim.toml:/etc/fluxheim/fluxheim.toml:ro \
-v ./site:/srv/site:ro \
-v fluxheim-cache:/var/cache/fluxheim \
ghcr.io/valkyoth/fluxheim:v1.8.0Container mounts
| Mount | Recommended mode |
|---|---|
| Config | Read-only bind mount. |
| Static content | Read-only bind mount. |
| ACME state | Persistent writable volume. |
| Disk cache | Persistent writable volume sized for the cache policy. Give each storage-bin replica its own local or RWO volume; use shared RWX storage only with verified cross-node locking and orchestration-level single-writer enforcement. |
| Secrets | Container secret or credentials directory, not a public file. |
Systemd flow
fluxheim --config /etc/fluxheim/fluxheim.toml --check-config
sudo systemctl restart fluxheim
sudo systemctl status fluxheim
journalctl -u fluxheim -n 100 --no-pagerZero-downtime upgrades
Systemd socket activation keeps the public listener available while Fluxheim validates the replacement and drains existing connections. Containers need a stable front proxy, load balancer, or orchestrator because directly published host ports cannot be replaced without a listener gap.
Read the complete upgrade contractProduction checklist
- Pin release versions or image digests.
- Mount config and content read-only.
- Keep ACME and cache state on persistent volumes.
- Validate config against the profile you plan to run.
- Keep health checks and rollback commands ready before changing traffic.