Docker Compose vs Kubernetes: Secure Homelab Choices

Last year I moved my homelab from a single Docker Compose stack to a K3s cluster. It took a weekend, broke half my services, and taught me more about container security than any course I've taken. Here's what I learned about when each tool actually makes sense — and the security traps in both. The real question: how big is your homelab? I ran Docker Compose for two years. Password manager, Jellyfin, Gitea, a reverse proxy, some monitoring. Maybe 12 containers. It worked fine. The YAML was readable, docker compose up -d got everything running in seconds, and I could debug problems by reading one file. Then I hit ~25 containers across three machines. Compose started showing cracks — no built-in way to schedule across nodes, no health-based restarts that actually worked reliably, and secrets management was basically "put it in an .env file and hope nobody reads it." That's when I looked at Kubernetes seriously. Not because it's trendy, but because I needed workload isolation, proper RBAC,