cpuguy83

11 ms·

121.
by cpuguy83 2y ago
None of this has anything to do with Dockerfile but the tools used within. Nix provides the tooling to do reproducible builds. Meanwhile docker is a wrapper around the tools you choose. Also just to note, docker does allow you disable netwo
122.
by cpuguy83 2y ago
Yes buildkit can do this. You can also use buildkit to create a bootable VM, just that nobody is doing it. You can use estargz to fetch just the pieces you need from a dependency rather than the entire depdency as well. Really all of the th
123.
by cpuguy83 2y ago
IIRC seem to recall they changed the infra and software on the devices and it just wasn't possible.... take that marketing messaging as you will.
124.
by cpuguy83 2y ago
Locking them down also makes supporting them *FAR* simpler.
125.
by cpuguy83 2y ago
Because they are also maintaining all those build time dependencies, including dealing with CVE's, back porting patches, etc.
126.
by cpuguy83 2y ago
It's attempt to provide a much more efficient and harder to misuse implementation to a project used in tons of places.
127.
by cpuguy83 2y ago
And yet the GPU costs about as much as the whole Mac Mini and wouldn't even come close to fitting inside one.
128.
by cpuguy83 2y ago
That would be impossible to know. The main thing with io_uring is it makes it so you don't need to context switch (ie make system calls) to perform a number of operations.
129.
by cpuguy83 2y ago
io_uring cve's: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=io_uring seccomp is used for defense in depth. If someone managed to escalate privileges through some means the seccomp policy will still prevent th
130.
by cpuguy83 2y ago
Both Docker and containerd have started to block io_uring in the default profile for about a year now due to too many security issues with it.
131.
by cpuguy83 2y ago
Agree on smart devices, but I also have 3 kids and just want to have clean floors every day. Also, Roomba is absolute trash compared to any other brand. Replaced my Roomba with a different brand a few months ago and it's a totally diff
132.
by cpuguy83 2y ago
... Or do some other flags to statically link to cgo.
133.
by cpuguy83 2y ago
If you import net or os then you'll automatically link to libc unless you disable cgo or set the "netgo" and "osusergo" build tag respectively.
134.
by cpuguy83 2y ago
Somewhat fresh kitty user (a few weeks now). What's your ssh issue? Also saw Wezterm pop up last week and definitely decided I'll give it a go here soon.
135.
by cpuguy83 2y ago
You could wrap it in another struct and use a custom MarshalJSON implementation.
136.
by cpuguy83 2y ago
True this is file corruption.
137.
by cpuguy83 2y ago
Anecdotally and absolutely not production experience here, but I've had a Synology device running btrfs for 7 or 8 years now. Only issue I ever had is when I shipped it cross country with the drives in it, but was able to recover just
138.
by cpuguy83 2y ago
fs corruption due to power loss happens on ext4 because the default settings only journal metadata for performance. I guess if everything is on batteries all the time this is fine, intolerable on systems without battery.
139.
by cpuguy83 2y ago
I don't think we can compare reading json to writing a bespoke, secure hashing algorithm across a broad set of languages.
140.
by cpuguy83 2y ago
But then every single client needs to support this. sha256 support is already ubiquitous.
141.
by cpuguy83 2y ago
For that matter, dagger (dagger.io) provides an sdk in multiple languages and gives you the full power (and then some extra on top) of buildkit.
142.
by cpuguy83 2y ago
This is what buildkit is. Granted go has the only sdk I know of, but the api is purely protobuf and highly extensible.
143.
by cpuguy83 2y ago
sha256 has been around a long time and is highly compatible. blake3 support has been proposed both in the OCI spec and in the runtimes, which at least for runtimes I expect to happen soon. I tend to think gzip is the bigger problem, though.
144.
by cpuguy83 2y ago
It's complicated. If you are using the containerd backed image store (opt-in still) OR if you push with "build --push" then yes. The default storage backend does not keep compressed layers, so those need to be recreated and d
145.
by cpuguy83 2y ago
Given dreams I've had, I'd say I'm the most creative while sleeping.
146.
by cpuguy83 2y ago
Especially with the loud noise suppression.
147.
by cpuguy83 2y ago
Wait... global warming... shakes fist at the future
148.
by cpuguy83 2y ago
It is absolutely not from scratch. It is definitely reusing docker code (or at least it used to).
149.
by cpuguy83 2y ago
+1 for Arc
150.
by cpuguy83 2y ago
No both use the exact same techniques to achieve so called "rootless" which is generally considered to be insecure. Rootless docker stores images for the user executing it and that is all, same as podman.

More ›