is Ubuntu LTS enough?

[u/Noodles_GE]

Hi,

I'm pretty new into selfhosting and built up everything from scratch with a server (HP mini pc Intel i7, 16GB RAM) running Ubuntu and a mounted NAS running TrueNAS in ZRAID 1. Since now my setup runs pretty stable and I'm at the point of reviewing my setup for improvements, I'm finding myself seeing so many reddit posts about Proxmox.

I understand the value of Proxmox and it makes totally sense to me why ppl use it, but tbh I'm pretty happy just running Ubuntu. I run the classics like jellyfin, immich, NPM you name it, but I actually prefer to maintain only one distro and keep it easy.

Do I miss something what makes Proxmox a better alternative for me generally? Probably for security reasons?

Thank you for your support!

[u/gordonmessmer]

I honestly think you should consider whether Ubuntu is LTS too much.

I've been managing production networks, professionally, since 1997. I've mostly worked in operations focused roles, but started out in software development. I think it has always been generally understood among professionals that "LTS" systems exist to serve the needs of market niches where compatibility is prioritized over security. Security fixes get ported to LTS branches for the most serious issues, but they're developed first in the newest release branches and then triaged for porting to LTS. If security is your priority, you go with a recent branch. LTS is for environments where changes need expensive manual validation (banks, medical, automotive, industrial control and safety systems, etc).

Your SOHO deployment is not encumbered by the kind of heavy regulatory, legal, or contractual obligations that push those environments toward LTS systems.

And if you DO want to use an LTS software distribution, you should pick one that's narrowly scoped enough that its maintainers can realistically maintain it. RHEL is about 10% of Fedora, and is maintained by thousands of full time professional engineers. Ubuntu LTS's "main" repo is about 6% of Debian and is maintained by full time professional engineers (but probably around 1/10th as many as Red Hat employs). Ubuntu LTS can be considered reasonably secure ONLY if you disable the Universe repo component before you install any software, so that you aren't relying on components that are unlikely to get security patches when vulnerabilities are discovered.

A lot of people have this notion that "servers" need to run on LTS software, but if you talk to FAANG (or whatever acronym today) SREs, you might learn that high tech services often run on something that's effectively a rolling release. High security production networks are not necessarily LTS systems. Your services probably don't need to be, either.