3 ms·
> This is surprising ... as it just provides marginal privacy improvements. Diskless does not mean SSH-less or network-less. The "data" can be pulled / pushed
by ignoramous 1y ago
> This is surprising ... as it just provides marginal privacy improvements.
Diskless does not mean SSH-less or network-less. The "data" can be pulled / pushed just the same, which is to say, Diskless, in this case, is no better than verifiably read-only partitions (like on ChromeOS & Android, for example).
- mtlynch 1y agoSorry, I don't know what you mean. When I said it provides marginal privacy improvements, I meant the caching, not the disklessness. Diskless does provide privacy improvements, as it drastically reduces the odds of something accidentally persisting to storage.
- kees99 1y agoDiskless (edit: with OS in initramfs) is indeed a golden standard against local persistence, but requires quite a bit of extra RAM - few GB for "latest Ubuntu LTS". With regards to preventing accidental persistence, disk with only dm-verity partitions is as good, with extra advantage of only adding a little bit of extra RAM usage (/tmp, /var/run, ...) For that matter, even something as sloppy as booting with rootfs wich can't be remounted rw (iso9660, squashfs, etc..) and is the only mounted fs, is also perfectly good against accidental persistence.
- toast0 1y agoYou could run from NFS and not need much extra ram. Plus you save like $25/node by not having a local disk.
- kees99 1y agoYes, rootfs-on-NFS also qualifies as "diskless", I stand corrected.
- ChocolateGod 1y agoYou could go the extreme and boot off Google Drive (or any other fuse FS). https://ersei.net/en/blog/fuse-root https://ersei.net/en/blog/fuse-root
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]