Operating System
Introduction
The operating system sits between the hardware and everything else, managing the processor, memory, storage, and networking so applications don't have to. This is the host OS the server itself runs; inside the containers it runs, most images ship a minimal Alpine Linux underneath rather than the host distribution at all.
Comparison
For a public stack, the operating system choice comes down to two mainstream Debian-family options: Debian itself, and Ubuntu, its most widely used derivative. Both run everything this stack needs — Docker, Coolify, and virtually all server software — so the difference is less about capability and more about who maintains it, how fast things change, and what's behind it commercially.
Debian vs Ubuntu
Debian is one of the oldest and most stable Linux distributions, maintained entirely by a volunteer community rather than a company. Trixie (Debian 13) is the current stable release. It prioritises stability over having the newest packages, and security patches keep coming for years without requiring a disruptive OS upgrade — it's available as a first-class option on Infomaniak Public Cloud, and is well-supported everywhere this stack needs it to be.
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| Various (DFSG) | — | Active | — | Unlimited | ✅ |
Ubuntu is a Debian derivative with a larger user base and a shorter release cadence, backed by Canonical's commercial support and services. It doesn't offer anything Debian doesn't already cover for a public stack, but some packages and pieces of documentation specifically assume it, which makes it a reasonable substitute where that matters.
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| Various (DFSG) | Proprietary components | Active | — | Unlimited | ✅ |
Conclusion
Debian is the recommended base for this stack. For infrastructure that's meant to keep running quietly for years with minimal intervention, fewer surprises over the newest features is exactly the right trade-off — and absent a specific reason to reach for Ubuntu instead, Debian is preferred by default.
Updates
OS updates should be applied regularly — security patches, kernel fixes, package updates. Most of the time this is safe and quick, and a kernel update just needs a reboot to actually take effect; a server left running a stale kernel indefinitely isn't actually patched, just told it is. Coolify-managed services restart automatically after a reboot, so this doesn't need to be treated as riskier than it is.
Firewall
Inbound traffic should be restricted to only the ports actually in use — 22 (SSH), 80 (HTTP, for Let's Encrypt challenges), 443 (HTTPS). This can be enforced at the provider level, at the OS level (ufw), or both; provider-level is generally simpler, since traffic gets blocked before it ever reaches the server. That's also what's actually implemented here — this project's security group is defined in OpenTofu (security.tofu) rather than configured by hand, so the rule set lives in version control the same way everything else provisioned does.