AkihiroSuda

6 ms·

1.
by AkihiroSuda 11mo ago
There is also elfconv (by my colleague): an AOT binary translator that directly converts Linux ELF to Wasm. https://yomaytk.github.io/elfconv-demo/ The Wasm port of the Linux kernel sounds quite interesting as it may p
2.
qemu-wasm(ktock.github.io)
3 points by AkihiroSuda 2y ago|0 comments
3.
by AkihiroSuda 2y ago
> endpoint: tcp://${{ secrets.BUILDKIT_HOST }}:9999 This should be protected with mTLS ( https://docs.docker.com/build/drivers/remote/ ) or SSH (`endpoint: ssh://user@host`) to avoid pote
4.
by AkihiroSuda 3y ago
> Also, buildx won't commit the intermediate layers during the build. So if something fails, you can't just grab the previous intermediate layer and do `docker run --entrypoint /bin/bash` on that layer to poke around.
5.
by AkihiroSuda 3y ago
> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles, while available in Docker, aren't enabled by defaul
6.
by AkihiroSuda 3y ago
> It requires non official tooling Rootless Docker has been merged into the official since Docker 19.03, and graduated from experimental since Docker 20.10. The "tooling" is available in the official apt/dnf repo too: - h
7.
by AkihiroSuda 3y ago
Just merged #9054. Sorry for that we had to revert #8789, but we are looking forward to seeing that PR submitted again with an alternative abstraction interface.
8.
Show HN: Usernetes: Rootless Kubernetes (Generation 2)(github.com)
2 points by AkihiroSuda 3y ago|0 comments
9.
by AkihiroSuda 4y ago
Nope. https://rootlesscontaine.rs/#non-examples-of-rootless-contai...
10.
by AkihiroSuda 4y ago
Set `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80`
11.
by AkihiroSuda 4y ago
Not really recently. Both were implemented almost simultaneously in circa June 2018. https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/podman&#
12.
by AkihiroSuda 4y ago
> The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).
13.
by AkihiroSuda 4y ago
> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootles
14.
by AkihiroSuda 4y ago
> Docker-engine doesn't support running as a user other than root. Podman does. Docker engine does.
15.
by AkihiroSuda 4y ago
Slirp networking does not need any suid bit or special capability.
16.
by AkihiroSuda 4y ago
The filesystem performance degradation was resolved in kernel 5.11 which added support for rootless overlayfs. The network performance is caused by slirp (usermode TCP/IP) but it is being resolved too : https://github.com&#x
17.
by AkihiroSuda 4y ago
> I guess rootless is some of the work that Docker (company) wanted to keep proprietary and out of this open-source project. Rootless mode for Docker is completely FLOSS, and its main contributor (me) has even never worked for Docker (co
18.
Don’t use Docker run –net=host – Don’t use spec.hostNetwork(medium.com)
5 points by AkihiroSuda 6y ago|0 comments
19.
by AkihiroSuda 6y ago
Podman 2.1 supports CNI networks (`podman network create`), so it might be worthful now
20.
by AkihiroSuda 6y ago
Podman already supports `podman volume create`, though it doesn't support volume plugins.
21.
by AkihiroSuda 6y ago
Docker has been supporting rootless mode since 19.03
22.
Show HN: VPN-ish proxy for Docker/Kubernetes networks(norouter.io)
1 points by AkihiroSuda 6y ago|1 comments
23.
by AkihiroSuda 6y ago
VPN-ish proxy that seamlessly brings clients into remote Docker/Kubernetes networks. No public IP is required. No privilege is required. The only requirement is shell accessibility (`docker exec`, `kubectl exec`). - GitHub: https:&#x2
24.
by AkihiroSuda 6y ago
> Why can't you update the Docker image to also support ARM? You theoretically could switch your backend to run ARM Linux. However, this would take months No need to take months. `docker buildx` can build multi-arch images without u
25.
by AkihiroSuda 6y ago
> The downside is that V2 doesn’t support all the controllers that were implemented for cgroups V1 (e.g. devices, net_cls, net_prio,etc.). device controller is present since kernel 4.15. > Adoption status Docker/Moby supports FU
26.
by AkihiroSuda 6y ago
"guiTAR is a generic archive tool, written in GTK+/Gnome, supporting plain tarballs, tar.gz, tar.bz2, slp, zip, lzh, arj, and rar format. " https://www.freshports.org/sysutils/guitar/ http:/&#
27.
by AkihiroSuda 6y ago
Look forward to 5G :)
28.
by AkihiroSuda 6y ago
I agree that the phone should be encrypted (in conjunction with aind), but people are likely to set weak passcode like "1234" (or finger pattern) because they want to open email/phone/twitter/maps/payment apps
29.
by AkihiroSuda 6y ago
overlayfs isn't necessary either :)
30.
by AkihiroSuda 6y ago
Anbox is for desktop, aind is for cloud (and edge). The biggest advantage of running Android on cloud/edge I think is anti-theft. Also, it will be soon able to run multiple aind pods on Kubernetes with distinct UID mappings. (I need to

More ›