I don’t think mounting the socket read-only does what you think it does: https://news.ycombinator.com/item?id=17983623

It’s a horrible idea unless you absolutely trust Traefik to be bulletproof.

I don’t like having to give Traefik access to my /var/run/docker.sock, or is that no longer the case?

Yeah that sounds even better. What service do you use?

Realized today that borgbackup failed for almost 2 months straight on one of my servers (was a simple case of a lock being stuck). Finally setup push notifications via Pushover to notify on success/fail.

Would be awesome if you’d share your solution for the next person encountering the same issue :)

What exact GPU model? Kernel version? Have you tried it with SELinux disabled temporarily?