Privacy Tool Spotlight: FreshRSS
At the cat lab, it has been a banner year for moving away from surveillance capitalism ecosystems and toward privacy-respecting alternatives. From operating systems and office suites to streaming platforms, home automation, and security cameras, the goal stays simple. We want tools that respect your personal boundaries and your data.
One area that often gets overlooked is the humble RSS reader. RSS is a simple way to subscribe to websites, blogs, news outlets, and more so new posts come straight to you instead of you hunting them down across the web. We're not going to lie about it. We're information junkies. From the top headlines to tech news, we're constantly scanning our feeds for interesting information. And let's not forget the "I Can Has Cheezburger?" feed.
Plenty of tools can pull those feeds together, but they often come at a price. As we say, if it's free, your life experiences are the fee. These platforms log which articles you click, how long you spend reading them, and which topics hold your attention. That data gets used to build advertising profiles, train recommendation engines, or refine engagement algorithms.
We wanted to stop yet another information leak in our daily routines. What felt like a simple need quickly grew more complicated once we started looking at the options. With different operating systems and different ways to read feeds, nothing quite fit. Then we found a simple Docker project that covered most of what we needed: FreshRSS.
What is FreshRSS?
FreshRSS is a lightweight, open-source RSS feed aggregator that you run on your own hardware. That could be a home server, a NAS, or even a Raspberry Pi. Instead of handing your subscriptions and reading habits to a third-party company, FreshRSS acts as your own private news server.
It is web based, so you can open a clean dashboard in any browser and read everything in one place. It pulls articles from the blogs, news sites, podcasts, and YouTube channels you choose and presents them without clutter. Because it supports standard RSS APIs, it also works with multiple privacy-focused RSS readers such as NetNewsWire, Feeder, or any app that supports the FreshRSS or Google Reader API. You can keep using the apps you already like while your data stays under your control. Best of all, it is an easy and lightweight Docker solution.
Why Make the Switch to FreshRSS?
FreshRSS gives you a private way to follow the sites you care about without handing your reading habits over to someone else. It runs on your own hardware, stays out of the way of your content, and works with the devices and apps you already use. Here are the main reasons it fits into a privacy-focused setup:
- Total Data Privacy: Your subscription list and reading history stay on your own hardware. No third-party ad networks, trackers, or data brokers can see what you read or when you read it.
- No Algorithms or Ads: You get a clean, direct feed of content in simple chronological order. You see every post from the sites you choose, without sponsored posts or engagement algorithms deciding what appears.
- Long-Term Ownership: Commercial services change their rules, add paywalls, or shut down without warning. Hosting your own reader means your setup stays available for as long as you want it.
- Web Based and Multi-Device Friendly: Access FreshRSS from any browser on your network, then connect privacy-focused apps like NetNewsWire or Feeder. Its built-in API keeps your read status synced everywhere without sending your habits to outside companies.
- Multiple User Accounts: FreshRSS supports more than one account, so different people in your household can keep their own subscriptions and reading progress separate while still sharing the same self-hosted instance.
Pairing FreshRSS with a secure Docker setup gives you a private, distraction-free news hub that protects your data without adding much maintenance to your routine.
Our Docker Compose
In our post Let’s Ship It: Your First Docker Container with Compose we showed how to host Wikipedia on your network with a simple Kiwix Docker Compose file. FreshRSS is just as easy to set up in a similar way.
If you already run Docker, this is all you need to get started. Copy the file below, adjust the timezone and the folder paths to match your system, then start the container. The first part of the file sets up the FreshRSS service itself. The rest adds optional security hardening, resource limits, and a health check. You can leave those in or strip them out if you prefer a simpler setup.
Below is our Docker Compose script, and you'll notice a few useful features.
# The name of the Docker project.
# This prefix is used for all resources (networks, volumes) created by this file.
name: freshrss
services:
freshrss:
image: freshrss/freshrss:latest # "latest" tracks upstream; pin a version tag for reproducible deployments
container_name: freshrss # Fixed name (easier for reverse proxy configs); omit if scaling beyond 1
restart: unless-stopped # Auto-restart on crash/host reboot; won't restart if you `docker stop`
ports:
- "8080:80" # Change to another port if there's a conflict (everybody wants to use 8080)
environment:
TZ: America/Los_Angeles # Change to your timezone (e.g. America/Los_Angeles, America/Chicago, America/New_York)
CRON_MIN: "0,30" # Refresh feeds at minute 0 AND 30 of each hour (twice/hour)
volumes:
- /home/${USER}/freshrss/data:/var/www/FreshRSS/data # Persistent config, database, and feed data
- /home/${USER}/freshrss/extensions:/var/www/FreshRSS/extensions # User-installed extensions survive image updates
# Security
security_opt:
- no-new-privileges:true
- apparmor:docker-default # Enforce AppArmor profile
# Capabilities
cap_drop:
- ALL # Remove all 38 Linux capabilities by default; re-add only what's needed below
cap_add:
- NET_BIND_SERVICE # Apache master binds port 80
- CHOWN # Entrypoint script fixes data/ permissions
- SETUID # Apache workers drop from root to www-data (uid)
- SETGID # Apache workers drop from root to www-data (gid)
# Resource limits
deploy:
resources:
limits:
cpus: "1" # Max CPU allocation (prevents starving the host)
memory: 512M # Hard memory ceiling; OOM-kills if exceeded
pids: "256" # Cap max processes/threads to prevent fork-bomb DoS
# Health check (official)
healthcheck:
test: ["CMD", "cli/health.php"] # Verifies web UI responds and is a valid FreshRSS page
timeout: 10s # Max time per check before it's considered failed
start_period: 60s # Grace period after container start (first-run setup can be slow)
start_interval: 11s # How often to check during the start_period
interval: 75s # How often to check once healthy
retries: 3 # Consecutive failures before marking unhealthy
# Logging
logging:
driver: json-file # Default driver; writes structured JSON logs to the container's log file
options:
max-size: "10m" # Rotate log file once it exceeds 10 MB
max-file: "3" # Keep at most 3 rotated files (total max disk usage ≈ 30 MB)
Note that the resource limits under deploy.resources may or may not be enforced depending on your Docker version and the specific tools you use. Treat them as optional guidance rather than guaranteed limits.
To get running, create the data and extensions folders on your host using the paths shown in the volumes section, save this file as docker-compose.yml, and run docker compose up -d. Once the container is up, open your browser to http://localhost:8080 (or the port you chose) and finish the FreshRSS setup. From there you can add feeds, create additional user accounts if needed, and connect any compatible reader app.
Clients
Since we like to avoid extra apps for multiple reasons, we mostly enjoy FreshRSS through its native web client. With the Grid View extension installed, the layout works especially well on desktop and tablets. It offers multiple themes and other simple customizations so the reading experience stays clean and flexible without much setup.
For those who prefer a dedicated app, several privacy-focused options connect directly to FreshRSS and keep your read status in sync. NetNewsWire works well on Mac and iOS, while Capy Reader is a solid choice for Android and GrapheneOS. Either way, you stay in control of the experience while your feeds and reading habits remain on your own hardware.
Our Take
This started as a fun experiment and turned into one of the more satisfying pieces of our self-hosting setup. We often underestimate how many different preferences exist even within a small group. Some people want a clean web interface, others prefer a dedicated app, and a few just want their feeds available on every device without extra accounts or tracking. FreshRSS handled those differences more easily than we expected while keeping everything private and under our control.
We have not covered every feature it offers in this post. If the idea of owning your news feed appeals to you, the FreshRSS project site is worth a closer look for the full list of options and extensions. For us, the real win is simpler. We can stay informed without constantly feeding data about our interests and habits back to someone else. That quiet shift has made the tool feel like a natural part of the broader move toward tools that respect personal boundaries.
Remember: We may not have anything to hide, but everything to protect.
