cpuguy83

27 ms·

391.
by cpuguy83 4y ago
I agree that Dockerfile has some constraints, but I'm not sure I get the "magic" part. It's also not like it's a full language. Run a command, set an env var. There's some additional flags to set for optimizati
392.
by cpuguy83 4y ago
It comes with both an apparmor profile and an SELinux profile. What gets used depends on what's on the system... and I guess you need to actually set the flag on dockerd to enable SELinux.
393.
by cpuguy83 4y ago
I don't have a lot of faith in Windows Hello either. My 6 year old daughter was able to log into my admin account. They weren't even trying to do that, just opened the laptop and it's all like "Hello, Brian!" and lo
394.
by cpuguy83 5y ago
But that's state on disk, not process state. It should not affect startup time in buildkit. I'm not experienced enough with Bazel to comment on that.
395.
by cpuguy83 5y ago
Docker does handle snapshots of running processes. It's called checkpoint/restore, it utilizes the CRIU tooling to do this. In terms of doing this in a CI env like actions where you may have different types of machines serving you
396.
by cpuguy83 5y ago
You don't just execute a .wasm file, it requires a runtime which will JIT compile the code into machine code and handle the (wasi) system interfaces (e.g. read, write, stat, etc).
397.
by cpuguy83 5y ago
Except the default seccomp policy is not used for Kubernetes containers. I didn't really think about this vector where you CLONE_NEWUSER in a container... definitely on systems that allow unprivileged users to do this it is a problem.
398.
by cpuguy83 5y ago
Most containers would not have CAP_NET_ADMIN and not be able to access nftables.
399.
by cpuguy83 5y ago
Wait, you can get a 3090?
400.
by cpuguy83 5y ago
Oh yeah no I could see the flickering at 60. Worse the higher the resolution got.
401.
by cpuguy83 5y ago
Remember 60hz CRTs? That was unbearable for me.
402.
by cpuguy83 5y ago
"I forgot about it so it must not be great". It's an amazing machine. It's an incredibly expensive machine, but still amazing. > Do you think the current Apple trajectory has any meaningful room for that? Are you upse
403.
by cpuguy83 5y ago
"And not breached" is the key there. Passwords are breached all the time, usually without notification. See services like 1Passwords Watchtower, or look manually at lists like haveibeenpwned.
404.
by cpuguy83 5y ago
Now that's interesting. This is something that breaks go's cache (for cgo).
405.
by cpuguy83 5y ago
Here's the G1: https://www.androidpolice.com/2021/09/23/the-first-android-p... Here's cnet's review (literally just the first link I pulled from Google). "But still, the G1 doesn't qu
406.
by cpuguy83 5y ago
This is not how history went. Android being worked on is very different from Android being anything at all like what it ended up being. It literally took years before Android was in the same league.
407.
by cpuguy83 5y ago
That's just it, craft. They took the time to craft the system to fit a certain profile which people found desirable and it changed the industry.
408.
by cpuguy83 5y ago
I think you are mis-remembering history. People were in awe of how responsive the system was. Things like the pins dropping on the google maps app seemed faked, bo way they could do it.
409.
by cpuguy83 5y ago
Android didn't do anything (in the ballpark) for several years either.
410.
by cpuguy83 5y ago
There is a runtime between the metal and the language. The runtime is what makes it really nice for writing network services in. It's also what makes it really terrible for lower level things.
411.
by cpuguy83 5y ago
Hopefully you are doing this securely :) BTW, no need to expose DOCKER_HOST, you can connect to docker over ssh, e.g. `DOCKER_HOST=ssh://1.2.3.4`.
412.
by cpuguy83 5y ago
It is workload dependent. My general way of thinking about it is containing a unit of work. Sometimes that is a single process, others it is a bunch of things. Sometimes I may want to run a database separate from my application code, someti
413.
by cpuguy83 5y ago
Before Monterey's virtualization framework there was the hypervisor framework. It is a lot lower level and would be what the virtualization framework is built on top of.
414.
by cpuguy83 5y ago
The US system doesn't typically have choice either except to get another employer... who probably has the same insurance company anyway. In addition to not being able to choose insurance company, we also have a limited selection of doc
415.
by cpuguy83 5y ago
Wasm is a compile target. You can use tools like wasmtime to handle isolation and linking in wasi (the system interface). In that sense, wasmtime is an alternative to runc for wasm/wasi. In no way is any of this a replacement for a hig
416.
by cpuguy83 5y ago
Instead of, as an example, coding a plugin in lua, you code it in whatever you want and compile to wasm (that supports wasm as a compile target). In that sense it would be replacing lua.
417.
by cpuguy83 5y ago
They are completely different things, and where available should be used together. SELinux is a policy system where policy is enforced via labels. Labels are applied to processes which classify what the process is. Labels are applied to fil
418.
by cpuguy83 5y ago
I've been using Edge with 1P for the last couple of weeks. I agree, it used to be terrible. Now it is better than Safari's 1P extension.
419.
by cpuguy83 5y ago
In this case you wrap the loop in an anonymous function if you need it to be cleaned up within the scope of the loop. Or move the functionality to another function.
420.
by cpuguy83 5y ago
Yeah seemed like a replacement for other motion sensing... but then how localized can this actually be?

More ›