YANTR
The self-hosted app store for your hardware.
Find popular server apps in one place and install them with a single command. Yantr runs alongside your existing OS — no re-imaging and no vendor lock-in.
curl -fsSL https://yantr.org/install.sh | bash
Native Linux · Rootless Podman + Quadlet systemd · Step-by-step guide →
Yantr vs Umbrel
Your machine stays yours. Yantr is just the app layer.
Umbrel-style platforms are great when you want a dedicated appliance. Yantr is for the machines you already use: a laptop, Raspberry Pi, old PC, new workstation, or home server running its normal OS.
Install it. Use it. Remove it.
No re-imaging, no dedicated OS layer, no appliance lock-in. Yantr runs beside your existing apps and files.
Latest app versions
Pull current upstream images and check for updates when you want, instead of waiting on a curated OS release cycle.
App, not OS
Keep Ubuntu, Debian, Fedora, Arch, or your existing Linux server setup. Yantr adds an app store, not a replacement operating system.
Custom environments
Tune environment variables per app deployment so advanced setups do not get boxed into fixed presets.
Multiple installs
Deploy the same app more than once for testing, family, clients, separate projects, or clean isolated workspaces.
Update on demand
Self-update Yantr, check for the latest app versions, and recreate app containers only when you decide.
System isolation
Run your laptop, old PC, or server normally while self-hosted apps live in separate Podman stacks.
Super lightweight
No full appliance layer. Yantr stays small so your hardware can spend its resources on the apps you run.
Runs everywhere
Laptop, Raspberry Pi, old PC, new PC, home server, or VPS. If it runs Linux, Yantr fits there.
Security & Architecture · Podman vs Docker
Rootless by design. Why Podman beats Docker for homelabs.
Most container managers run Docker with a monolithic root daemon. While convenient, giving Docker root means any container breach can compromise your entire host. Yantr is built from the ground up on 100% rootless Podman — eliminating root privileges, daemon crashes, and host firewall tampering.
| Capability / Metric | Traditional Docker | Yantr + Rootless Podman |
|---|---|---|
| Privilege Model Execution context & permissions |
Runs as root (dockerd)
The |
100% Rootless
Containers run inside user namespaces with unprivileged UIDs. |
| Security Blast Radius Impact of container escape / zero-day |
Host Root Compromise
Container breakout grants full root control of the host OS and files. |
Zero Host Root Permissions
Breakout is trapped in unprivileged user sandbox; cannot touch host root. |
| Engine Architecture Process management model |
Monolithic Daemon
If |
Daemonless (fork / exec)
Direct execution via |
| Service Management Boot, restarts, and supervision |
Proprietary Supervision
Docker bypasses systemd; handles its own restarts and process monitoring. |
Native systemd Quadlet
Containers are first-class systemd user units ( |
| Host Firewall & Network iptables / nftables interaction |
Bypasses UFW Rules
Directly modifies root iptables, often silently exposing internal ports publicly. |
Zero Firewall Tampering
Isolated user network namespace (pasta / slirp4netns); host firewall stays safe. |
| Host Filesystem Impact Storage location & permissions |
Root-owned /var/lib/docker
Pollutes root filesystem; requires |
100% User-Space Storage
Named volumes in |
| Idle Resource Overhead Memory & CPU consumption |
Always-On Daemon
Monolithic daemon consumes CPU and RAM constantly, even with 0 apps running. |
Zero Daemon Overhead
No background daemon process. Hardware resources go strictly to your apps. |
| Docker Socket Emulation For Glances, Portainer, Beszel |
Dangerous Root Socket
Mounting |
Safe User Socket Translation
Automatically translates to user |
Zero Host Root Privileges
Containers run inside Linux user namespaces. Even if a containerized service runs as UID 0, the kernel maps it to an unprivileged host UID. A breached container cannot access host root or read /etc/shadow.
Daemonless Architecture
Docker relies on a central dockerd daemon that acts as a single point of failure. Podman uses direct fork/exec with conmon. If Yantr updates or stops, your running stacks continue without interruption.
Native systemd Quadlet
Containers are native systemd services. Auto-start on boot with user lingering enabled, manage lifecycles with standard systemctl --user, and stream live logs with journalctl --user.
Firewall Safe (No UFW Bypass)
Docker famously overrides root iptables rules, exposing ports directly to the internet past your UFW firewall. Rootless Podman networks strictly inside user namespaces — never altering host firewall rules.
Safe Docker Socket Translation
Homelab tools like Glances, Portainer, and Beszel that ask for docker.sock are automatically routed to your unprivileged user Podman socket. You get full Docker compatibility with zero host root risk.
User-Space Named Volumes
No root-owned files in /var/lib/docker. Data lives in user storage (~/.local/share/containers/) with automatic SELinux :z context labeling. Clean ownership, zero sudo to back up or clean.
Features
Everything you need to self-host
A robust set of built-in capabilities to run apps effortlessly.
Community
Built in the open
by the community
Every app, fix, and improvement comes from contributors like you.
System Requirements
Runs on the box you already own.
Scales when you outgrow it.
Yantr uses 140 MB RAM at idle
Leaving the rest of your system resources for your apps.
Minimum specs
Just enough to boot the core and a couple basic apps. Perfect for an old laptop or Raspberry Pi 4.
Recommended
For a comfortable daily-driver homelab running heavy media, sync, and dev workloads side by side.
Known to run reliably on
FAQ
Frequently asked questions
Quick answers about safety, compatibility, and day-to-day use.
Why does Yantr use Podman instead of Docker?
Docker runs as a monolithic root daemon (dockerd). Anyone with access to the Docker group effectively has passwordless root control over your host. Podman runs completely rootless in unprivileged user namespaces without any background daemon. It integrates directly with Linux systemd (via Quadlet), doesn't tamper with host firewall rules, and leaves zero footprint on your host OS.
What is 'rootless' and why is it better for my homelab?
Rootless means Yantr and all deployed containers run under your standard, unprivileged user account without sudo. The Linux kernel maps container UID 0 to an unprivileged host UID. Even in the worst-case scenario of a container escape vulnerability, the attacker is trapped inside an unprivileged sandbox and cannot access host system files, read credentials, or install rootkits.
Does Yantr replace my operating system?
No. Yantr runs on top of your existing Linux setup using rootless Podman and systemd Quadlet. Your host OS remains unchanged.
Why use Yantr instead of manual Podman Compose?
Yantr applies Compose changes atomically: every step succeeds together, or nothing is changed. That reduces broken deployments and partial updates.
Do I need Podman experience to use Yantr?
Not much. Yantr handles app installation, updates, and compose management through a simple interface while still using standard Podman and named volumes under the hood.
Where is my data stored?
Your app data stays in standard named Podman volumes on your own machine or server. This keeps ownership clear and migration straightforward.
Can I access apps remotely?
Yes. Yantr is local-first, and you can securely expose apps with tools like Tailscale or Cloudflare Tunnel when you need remote access.
Is Yantr free? Can I see the source?
Yes. The source is public on GitHub. Personal and homelab use is free. Commercial use is not allowed — see the PolyForm Noncommercial License.
App Catalog
All apps
Browse self-hosted apps you can run with Yantr.