4 ms·

>Yeah, of course, a single-node container tool is easier to run than a Kubernetes cluster. >>comparing even to plain Docker – not to even mention Kubernetes >

by nix23 4y ago

>Yeah, of course, a single-node container tool is easier to run than a Kubernetes cluster. >>comparing even to plain Docker – not to even mention Kubernetes >Why do I need to rebuild without Bluetooth support? Because you don't need it? Or you don't want it, but cannot deactivate it in bios? Security and Kernel-size >> services gonna start because it will be different each time Please read and don't make your own interpretation like with docker -> kubernetes

cassianoleal 4y ago
> Because you don't need it? Or you don't want it, but cannot deactivate it in bios? Security and Kernel-size Just blacklist the kernel modules, then. Or even plain delete them from disk.
- A4ET8a8uTh0 4y ago
  You don't have to blacklist or delete anything if it is not there to begin with, which is the point of OP.
  - nix23 4y ago
    It's kind of crazy, people always say bloat here bloat there, but then come up with blacklisting....ahhh the forgotten "art" of just having the code you need on your machine ;)
    - mbreese 4y ago
      I get the sentiment, but there is also something to be said for having a consistent and stable starting configuration. Yes, you might end up removing Bluetooth modules from servers, but you know exactly what the starting kernel config is. When you have completely custom kernels for each server, you’ll spend half of your time just figuring out what the starting configuration is. Compiling kernels is really a lost art that many people have never done. It’s probably best to avoid too much of that in production until it’s absolutely necessary.
      - nix23 4y ago
        >It’s probably best to avoid too much of that in production until it’s absolutely necessary. Well yes, being organized is always important, like a customer of mine wanted all Linux server with GUI and installed all of them as "Desktop-Role" aka preempt-kernel. Gui-Server...bleh..but Customer is King, but i could at least change he's mind about the kernel so Gui-Server-Role it was.
  - nequo 4y ago
    If you blacklist it, it is also not there since it’s not loaded, and you get the added benefit of not having to recompile the kernel every time there’s an update.
    - nix23 4y ago
      It's there but not loaded. A slimmed-down kernel make the difference from ~100MB (kernel) + 32MB (Modules) to 2MB (Kernel + Modules), faster load, or for smaller devices, and overall less potential attack surface.
      - cassianoleal 4y ago
        Surely you don't reduce 132Mb of kernel+modules to 2Mb just by disabling bluetooth.
        deleted 4y ago
        [deleted]
        nix23 4y ago
        >>A slimmed-down kernel The magic of reading....
        cassianoleal 4y ago
        I think you're missing my point. By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different. That was not the point of this thread, so back at ya: > The magic of reading....
        nix23 4y ago
        It should be clear that Bluetooth is not 90% of the kernel size...that's why i wrote "slimmed down" which means disable/not-compile everything not needed (like just one of 3 firewalls, filesystems, network-stacks etc). >By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different. Yes, but you don't do that by blacklisting modules right? Because that was your solution ;)
  - cassianoleal 4y ago
    If you need to rebuild the kernel to disable it, it means it was there to begin with. Otherwise it's just an implementation choice: recompile kernel, or blacklist+delete modules.
WesolyKubeczek 4y ago
> Security and Kernel-size Oh yeah, since we care about security so much, let's have a whole fucking C compiler suite on every machine because what if we need to recompile the kernel to mitigate a potential problem that might not even be there!? If you really care that much, you delete the modules and run depmod. It's fast and you don't need to have a compiler on hand.
- nix23 4y ago
  You can configure "world" too, and you can compile your kernel/world and packages from a jail or vm, with or without poudriere. But why so aggressive? No one attacks your substitute religion.
  - WesolyKubeczek 4y ago
    I know, when you run out of any arguments of merit, you call the other side "aggressive". But the truth is, you have nothing to say. Okay, you can set up a whole container so you can recompile your kernel to your heart's delight. Fine. How does it scale? How do you distribute your new shiny kernel to hundreds of machines and keep track which is running which? What if you make a mistake, is it easy to roll back? How easy is it? Also, need I remind you that a world where you don't have to (but can if you really really want to) compile things to get the results you want is infinitely better than a world where you have to compile things?
    - nix23 4y ago
      >How do you distribute your new shiny kernel to hundreds Like you distribute a iso or a image, is that really so impossible for you? >How does it scale? As much as you want. >What if you make a mistake, is it easy to roll back? See you don't even know zfs or be's..or hell version's??...your a evangelist and i don't like them. >I know, when you run out of any arguments of merit Seams like you run out of arguments, again you can create your own image of freebsd without compiler, nfs, zfs whatever you want. But your are probably happy having the cruise-ship for the fishing side trip. Have fun with your religion.
- 4y ago

by nix23 4y ago

cassianoleal 4y ago

> Because you don't need it? Or you don't want it, but cannot deactivate it in bios? Security and Kernel-size Just blacklist the kernel modules, then. Or even plain delete them from disk.

A4ET8a8uTh0 4y ago
You don't have to blacklist or delete anything if it is not there to begin with, which is the point of OP.
- nix23 4y ago
  It's kind of crazy, people always say bloat here bloat there, but then come up with blacklisting....ahhh the forgotten "art" of just having the code you need on your machine ;)
  - mbreese 4y ago
    I get the sentiment, but there is also something to be said for having a consistent and stable starting configuration. Yes, you might end up removing Bluetooth modules from servers, but you know exactly what the starting kernel config is. When you have completely custom kernels for each server, you’ll spend half of your time just figuring out what the starting configuration is. Compiling kernels is really a lost art that many people have never done. It’s probably best to avoid too much of that in production until it’s absolutely necessary.
    - nix23 4y ago
      >It’s probably best to avoid too much of that in production until it’s absolutely necessary. Well yes, being organized is always important, like a customer of mine wanted all Linux server with GUI and installed all of them as "Desktop-Role" aka preempt-kernel. Gui-Server...bleh..but Customer is King, but i could at least change he's mind about the kernel so Gui-Server-Role it was.
- nequo 4y ago
  If you blacklist it, it is also not there since it’s not loaded, and you get the added benefit of not having to recompile the kernel every time there’s an update.
  - nix23 4y ago
    It's there but not loaded. A slimmed-down kernel make the difference from ~100MB (kernel) + 32MB (Modules) to 2MB (Kernel + Modules), faster load, or for smaller devices, and overall less potential attack surface.
    - cassianoleal 4y ago
      Surely you don't reduce 132Mb of kernel+modules to 2Mb just by disabling bluetooth.
      - deleted 4y ago
        [deleted]
      - nix23 4y ago
        >>A slimmed-down kernel The magic of reading....
        cassianoleal 4y ago
        I think you're missing my point. By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different. That was not the point of this thread, so back at ya: > The magic of reading....
        nix23 4y ago
        It should be clear that Bluetooth is not 90% of the kernel size...that's why i wrote "slimmed down" which means disable/not-compile everything not needed (like just one of 3 firewalls, filesystems, network-stacks etc). >By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different. Yes, but you don't do that by blacklisting modules right? Because that was your solution ;)
- cassianoleal 4y ago
  If you need to rebuild the kernel to disable it, it means it was there to begin with. Otherwise it's just an implementation choice: recompile kernel, or blacklist+delete modules.

WesolyKubeczek 4y ago

> Security and Kernel-size Oh yeah, since we care about security so much, let's have a whole fucking C compiler suite on every machine because what if we need to recompile the kernel to mitigate a potential problem that might not even be there!? If you really care that much, you delete the modules and run depmod. It's fast and you don't need to have a compiler on hand.

nix23 4y ago
You can configure "world" too, and you can compile your kernel/world and packages from a jail or vm, with or without poudriere. But why so aggressive? No one attacks your substitute religion.
- WesolyKubeczek 4y ago
  I know, when you run out of any arguments of merit, you call the other side "aggressive". But the truth is, you have nothing to say. Okay, you can set up a whole container so you can recompile your kernel to your heart's delight. Fine. How does it scale? How do you distribute your new shiny kernel to hundreds of machines and keep track which is running which? What if you make a mistake, is it easy to roll back? How easy is it? Also, need I remind you that a world where you don't have to (but can if you really really want to) compile things to get the results you want is infinitely better than a world where you have to compile things?
  - nix23 4y ago
    >How do you distribute your new shiny kernel to hundreds Like you distribute a iso or a image, is that really so impossible for you? >How does it scale? As much as you want. >What if you make a mistake, is it easy to roll back? See you don't even know zfs or be's..or hell version's??...your a evangelist and i don't like them. >I know, when you run out of any arguments of merit Seams like you run out of arguments, again you can create your own image of freebsd without compiler, nfs, zfs whatever you want. But your are probably happy having the cruise-ship for the fishing side trip. Have fun with your religion.
4y ago