Because imo... that is the answer. We have seen so many stupid closed ecosystems of home automation stuff come and go, I dunno why you'd mess with anything else at this point. In fact I just got another email reminder that Google is turning off the old Works with Nest stack. Remember Nest? Yeah...
I totally get how that's off-putting, but the real recommended way to run home assistant is to install Home Assistant OS on dedicated hardware. Which also can be off-putting.
Either way, it's my favourite software that I regularly interact with (unless you count Linux).
I think the issue is more the attitude towards security and system stability that is implied by such installation methods, which is apaprently endemic to the entire "JS ecosystem". That attitude being "who cares about security or stability?"
When It's my system and I don't want to mess with it, just set stuff up and have it run trouble free and do the things I want (and only I want), then I do care about such things and agree that JS has no place other than sacrificial toy boxes that get insulated from "real" computing like they was a modem with its phone number posted at the payphones by the 2600 meetup.
They provide a pretty locked down image that also loads a ton of plugins in dockers. It's nice and well designed. And you don't have to expose it to the internet if you don't have to.
The installation described is legacy and only supported for historical purposes.
I agree that Hue has totally gone down the toilet but the criticism of Home Assistant isn't justified. And if you go for the Ikea one as recommended in the article, it's just going to be a matter of time until their shareholders will want to see those sweet recurring bucks too. You need a truly open ecosystem to avoid that from happening.
The "Supervised" installation (i.e. installing Home Assistant on top of an existing Linux install) is doable, but not preferred.
You don't give it root on your desktop linux system you do all your sensitive stuff on of course. That makes zero sense. Home assistant really runs great even on a cheap raspberry pi if you don't have a VM- or dockerserver.
also, your faith in "VM" insulation appaears greater than mine. if i dont trust a VM i dont trust the host running the VM.
others have different opinions and that's ok. my systems run to my standards, however quirky they may be. im stating opinion here, not attempting to inscribe Sysadmin Commandments. them's written on the wall of the bathroom stall.
edit: just for reference, the last cpu i could say i trusted was before speculative execution was a feature. since then its more about risk mitigation. i'm not paranoid, there's people worse than me, and they're nuts. I'm just cautious and lazy.
Companies are always going to want more and enshittification is pretty much inevitable.
The reason Ikea isn't in such a hurry because their Tradfri range is a very minor part of their business whereas for Signify (not Philips! They sold it years ago) Hue is their bread and butter product.
Real virtualization is a bit more airtight, though. There have been some escape exploits but they all abused drivers that you wouldn't use heedless (shared folders, VGA, PCIe passthrough), not the virtualization layer. But that's a distinction without a different, really, so good on you for being careful!
This isn't some binary you downloaded from a Russian forum. VM isolation is more than enough.
Yes there are security concerns with any home automation system, but if you run HA locally and only access it via a VPN like Tailscale you're probably safer than if you used any of the big name cloud first smart home providers. Even if you access it over the Nabu Casa site, because everything is ostensibly Local first your attack surface is always going to be quite minimal.
As for "curl | sudo sh", yeah it looks scary, but it is not worse than downloading a .deb and then doing "sudo dpkg -i your.deb", or installing any downloaded binary on your machine for that matter. You may say something about signatures, but often, the public key you have to trust is on the same website you downloaded the .deb. In all these cases, TLS is the only thing protecting you. Going through a file you don't audit doesn't change anything, and in practice, almost no one does the audit, and few linux boxes have AV scanners.
Don't trust it? Run it a VM, container, or dedicated hardware, this is actually what they are suggesting.
so thanks for keeping it around :)
You can extend the container image with your own Dockerfile.