cpuguy83

54 ms·

691.
by cpuguy83 7y ago
Same with swarm, it's just using IPVS at L4. Does not provided anything at L7, it's up to you to provide such a service on the cluster.
692.
by cpuguy83 7y ago
Swarm comes with overlay networking, you can install network plugins for whatever you need.
693.
by cpuguy83 7y ago
I don't know, I think consumer macs (non-pro) could easily go arm sooner than that. Or who knows, maybe they'll just wait for risc-v to to mature to make any sort of switch.
694.
by cpuguy83 7y ago
Error handling is, to me, the most important thing when writing any code. Promoting "if err != nil { return }" even more by giving it a keyword seems like a dangerous road to walk down. Are we proposing solutions to make developer
695.
by cpuguy83 7y ago
How is it harder to prove? It's completely provable and even a huge complaint of developers of the platform. Everyone expects free/0.99 apps and it costs way more to produce and support them. Apps, before we had an app store, were
696.
by cpuguy83 7y ago
I would say the anti-trust case/ruling has certainly curtailed abusive behavior, though.
697.
by cpuguy83 7y ago
At the same time, it was Bell Labs that invented the transistor and other incredibly important things. What would the world have been like without a Bell Labs?
698.
by cpuguy83 7y ago
I think you would have a hard time proving this, because software prices are much (much) cheaper than they were pre-app store.
699.
by cpuguy83 7y ago
This is absolutely untrue. There are things that can be done to enhance the defaults that docker currently provides (b/c defaults are hard to change when you have millions of users), but a process running in a default docker container
700.
by cpuguy83 7y ago
There are fairly few vulnerabilities discovered in docker itself. The last one was in runc, the underlying container executor... these are very hard to get right. This is kind of a stinky one, though because docker runs in the root context
701.
by cpuguy83 7y ago
Good news, there is a lot of work on that front, including an official "rootless" distribution: https://get.docker.com/rootless The main thing about it is cgroups are disabled and it requires userspace networking.
702.
by cpuguy83 7y ago
You are right, I was thinking about this in the wrong context.
703.
by cpuguy83 7y ago
The bug reported here is because Docker sanitizes the symlinks within a path to ensure that nothing is trying link to something outside a given path, then it operates on the filesystem. This filesystem is shared with the containerized proc
704.
by cpuguy83 7y ago
No, the vulnerability is within the API for `docker cp`, specifically.
705.
by cpuguy83 7y ago
The problem is checking for it and then operating on it. The check and the operation would need to prevent anything else from operating on it during that time. This is why the the proposed patch to docker is pausing the container during the
706.
by cpuguy83 7y ago
This is definitely true, but as you say orchestration frameworks were a dime a dozen at the time, and Kubernetes, when launched at Dockercon, was barely that. Of course we actively chose to not collaborate on it, even after it matured a bit
707.
by cpuguy83 7y ago
Compose existed before k8s, and was created by a small company that Docker acquihired.
708.
by cpuguy83 7y ago
You once told me that if we (the company) don't succeed it will absolutely be our own fault. So many avenues to (huge) success, shutdown hard by the wrong attitudes towards the rest of the market.
709.
by cpuguy83 7y ago
I still rather like some of the output beam (libchan), just that GRPC came along and it's all history now. But yes agreed this was all completely frustrating at the time, and completely depressing now.
710.
by cpuguy83 7y ago
Container's root most certainly does map to host root unless you've enabled user namespaces (which is painful). However, root in a container does have many privileges dropped and seccomp policies applied (assuming you haven't
711.
by cpuguy83 7y ago
VM does not mean extra CPU usage. Since there is no emulation involved (assuming VT-x is supported) you should be getting native or mostly native performance.... not to say that WSL2 will be better on CPU usage, however I don't think o
712.
by cpuguy83 7y ago
Neither Darwin or the BSD's (though I'm no BSD expert, I could be mistaken) have a stable system call ABI either. Linux seems to be pretty unique in this regard.
713.
by cpuguy83 8y ago
WSL is Windows Subsystem for Linux, and it is part of Windows. https://docs.microsoft.com/en-us/windows/wsl/install-win10 It translates Linux system calls into Windows. This allows you to run a Linux userspac
714.
by cpuguy83 8y ago
Here in Seattle you are charged a fee to use store bags. It's not even an optional fee, the store must charge you and it goes towards offsetting the cost to recycle.
715.
by cpuguy83 8y ago
Many reasons to choose go over rust. First and foremost, Rust was not 1.0 and was still making breaking changes when Kubernetes came around. Other things like the situation with async/coroutines is still it great in rust. Go is, syntac
716.
by cpuguy83 8y ago
For me the only reason I'd want this is actually touch-id with webauthn, but it's not supported :( Works on Chrome as I found out today.
717.
by cpuguy83 8y ago
There are problems with HIPPA for sure. In fact I trust my doctor's patient portal less than most things I log into.
718.
by cpuguy83 8y ago
There's a new-ish (from Feb) LWN article about container's as an object in the kernel: https://lwn.net/Articles/780364/ Reception still doesn't seem great.
719.
by cpuguy83 8y ago
To be fair, this is how people build applications. "Oh there is this library let me just pull that in"
720.
by cpuguy83 8y ago
They mean it pokes holes in the firewall which are difficult to filter.

More ›