Manual · Chapter 1
Start here
This manual assumes you have never run a home server, never used Docker, and are not sure what a container is. None of that is a problem. It does assume you can install a program and are willing to read.
What a home lab is #
A home lab is one computer in your house that stays on, and runs the services you would otherwise rent from somebody else.
That is the whole idea. Instead of paying Google to hold your photos, a program called Immich holds them, on a disk you own, in your house. Instead of paying Spotify for music you already bought, Navidrome serves it to your phone. Instead of Dropbox, Nextcloud. Instead of 1Password, Vaultwarden. Somebody wrote each of those, and gave it away, and they are genuinely good.
The catch has always been that running them is a systems administration job. Each one wants a database, a configuration file, a port, a folder, a password, and an opinion about networking. Get one wrong and you have either a service that does not start or — much worse — a service quietly exposed to the internet.
A container, in one paragraph. A container is an application packed with everything it needs to run, so it cannot fight with anything else on the machine. You do not install Jellyfin; you run the Jellyfin container. It brings its own libraries, its own versions, its own everything. Docker (or Podman) is the program that runs containers. Compose is a file format that describes a set of containers and how they fit together. Ultralab writes compose files; Docker runs them.
Why bother #
Four honest reasons, and one honest reason not to.
- Money. Photo storage, music, a password manager, cloud files and a document scanner add up to real money every month, indefinitely, for as long as you want to keep your own things.
- It stays yours. Nobody changes the terms, raises the price, kills the product, or trains something on your photographs.
- It keeps working. A media server on your own network works when the internet is down, and does not need an account to play a film you own.
- You learn something real. The skills are the same ones people are paid for.
And the reason not to: you become the person who fixes it. When the disk fills at eleven at night, that is you. Ultralab exists to make that job small, but it cannot make it nobody's.
What Ultralab is #
Ultralab is one screen for the whole thing. It is not a replacement for Jellyfin or Immich — it installs them, keeps them straight, and tells you the truth about what they are doing.
Concretely, it:
- Holds a catalogue of 56 applications, arranged by what you would want one for.
- Writes the compose file for any of them, with the passwords generated and kept out of the file, and the image pinned to an exact version.
- Will run any of them in a Sandbox first — a completely separate world with none of your files in it — so you can look before you commit.
- Reads out, before you install anything, every folder it will touch and whether it can write there.
- Keeps a catalogue of your media, finds duplicate files, and shelves them into the layout Jellyfin expects.
- Enrols VPN devices so you can reach the lab from outside without opening a single port to the internet.
- Saves the whole shape of your lab as a Build you can swap, try, or hand to somebody else.
What it is not #
This list matters more than the last one. A tool that overpromises wastes your evening; one that says what it will not do lets you plan around it.
| Ultralab does not | Because | Use instead |
|---|---|---|
| Format, partition or mount disks | Your Linux installer is better at it, and a control plane that got it wrong would destroy data | Your distribution's installer, or mkfs and /etc/fstab |
| Do RAID or ZFS | Same reason. It reads what the host has and reports it | mdadm, ZFS, or the motherboard |
| Play or transcode media | That is Jellyfin's job and Jellyfin is good at it | Jellyfin, from the catalogue |
| Identify what a film is | The catalogue is filenames and checksums. No scraper, no model, nothing leaves the machine | Jellyfin's own metadata, once it is shelved |
| Send internet mail | A home connection is refused by every large mail provider. It will check yours and tell you | A VPS with a clean reverse-DNS record, or a mail provider |
| Apply firewall rules from Windows | The rules belong on the Linux host or the router, applied on purpose | Export the ruleset and apply it there |
| Back up your files | It backs up its own catalogue. Your photographs are a different job | Duplicati from the catalogue, to somewhere this machine cannot reach |
What machine you need #
Less than people tell you. Memory is the thing that actually decides, which is why Ultralab's Plans page scores every suggested lab against your machine's memory and says Fits, Tight or Beyond.
| Machine | Realistically runs |
|---|---|
| Raspberry Pi 4/5, 4 GB | Ad-blocking DNS, a VPN door, uptime monitoring, file sharing. Not photos. |
| Old laptop or mini PC, 8 GB | Jellyfin and the media shelf, file sharing, passwords, backups. Immich if you are careful. |
| N100 mini PC, 16 GB sweet spot | Photos, media, documents, passwords, dashboards, monitoring — most of it at once. |
| Desktop or server, 32 GB+ | Everything, plus room to try things in the Sandbox while the rest keeps running. |
Disk matters more than the processor. Photos and video are large and permanent. Whatever you buy, assume you will want twice it. And whatever you buy, one disk is not a backup — see chapter 6 before you trust anything to it.
Linux, ideally. Ultralab runs on Windows and does everything except start containers — on Windows it writes the compose file and hands you the command. If the machine that will run the containers is Linux, run the Linux binary there and everything works end to end. If you only have Windows, the scripts archive turns it into a Linux lab host inside WSL2; see chapter 2.
The things people worry about #
"Am I going to expose my house to the internet?"
Not by using Ultralab. Nothing it does opens a port to the outside world. Installing an application publishes a port on your own network, which is not the same thing at all. To reach the lab from outside you enrol a VPN device, and then your phone is on your home network rather than your home network being on the internet.
The usual way households get broken into is forwarding a port on the router so some application's admin page is reachable from anywhere. Ultralab will not help you do that, and says so in several places.
"What if I install something that wrecks my files?"
This is the fear the Sandbox exists for. It runs an application in a separate world: its own folders, its own storage, its own network, every port moved out of the way, and none of your files mounted into it. It cannot damage your photos because it cannot see them.
And before you install anything anywhere, What will this do? lists every folder it will mount, whether it can write there, and anything it has been handed that the Sandbox could not have contained.
"I do not know what any of these applications are."
That is what the aisles are for. Stop paying for it lists everything that stands in
for a subscription, and each card says which one. Search for the thing you pay for —
dropbox, spotify, 1password — and it will find what
replaces it.
"What happens when I get bored of it?"
Your files are ordinary files in ordinary folders. Ultralab does not use a database format only it can read, does not rename things behind your back, and does not need to be running for your photographs to exist. Uninstall it and the folders are still folders.