exec1

5 ms·

1.
Isolating Docker inside a development VM(msimkunas.lt)
2 points by exec1 2y ago|0 comments
2.
by exec1 3y ago
It doesn’t take much effort to remain relatively safe on the internet so you don’t have to resort to dedicated hardware just for banking. Don’t install sketchy apps that you don’t need and stop clicking on every link that you see – that’s p
3.
by exec1 3y ago
I’m using this setup for my own projects but I suppose this setup could work in a work context as well if we’re talking about a work laptop with all of the project files already on it. In that case, I don’t see how spinning up a local VM an
4.
by exec1 3y ago
I’ll definitely have to try this. SSHFS didn’t work well for me when sharing files from the host to the guest but it might just work when sharing from the guest
5.
by exec1 3y ago
More specifically, I’m having trouble seeing the issue with this approach if you’re, say, working on a laptop that has your project files and decide to spin up a local VM, place the files inside it and share them with the host via NFS/
6.
by exec1 3y ago
I am the author. :) I’ve clarified my use case at the top of the article. I’m not connecting to remote VMs or anything of the sort, all of this is happening in a local VM so the data exfiltration point does not seem to apply (unless I misun
7.
by exec1 3y ago
Yeah, I hear you. I try to avoid pulling NPM packages that I don’t know so I’m not really interested in containing software for security purposes. Of course, there’s also the question of dependencies. If I’m working on a project that I trus
8.
by exec1 3y ago
Fair enough. I have clarified my use case at the top of my article to reflect my threat model. I don’t use the VM to run tricksy software I don’t trust so the sandboxing argument doesn’t really apply in my case (or rather it doesn’t apply a
9.
by exec1 3y ago
An addendum: if you’re worried about the guest setting up a malicious git hook that your host would then execute, then your threat model is obviously very different from mine. Perhaps I should have clarified that I’m running code that I tru
10.
by exec1 3y ago
Path mapping on PhpStorm was very tricky for me as well (I’m running Docker containers inside my VMs so I had to set up correct mapping in PhpStorm if I wanted to run tests from the IDE) and I’m only talking about regular file paths here (n
11.
by exec1 3y ago
Correct me if I’m wrong, but isn’t it a bit pointless to worry about data exfiltration when we’re already talking about mounting (and, by extension, sharing) directories?
12.
by exec1 3y ago
I wonder how well would this work for things like node_modules?
13.
by exec1 3y ago
This doesn’t work for me because I find the Ubuntu desktop experience to be quite horrible. It’s very janky way too often. I very much prefer working with headless Ubuntu instances since this is where Linux excels for my use cases. For GUI
14.
by exec1 3y ago
My use case is rather specific (web development) and my recommendation is of course not intended to cover all possible use cases. However, if you’re working on web projects and need VMs to isolate your development toolset then this is the a
15.
by exec1 3y ago
If I understand you correctly, then yes, I have eventually decided that I should only compromise on performance where it hurts less, e.g. for IDE access. If you’re running your application on a web server inside the VM for example, then thi
16.
by exec1 3y ago
Not Windows specifically. I work on a macOS host so NFS works fine. However, I want to keep my options open for working on a Windows host if necessary and I wanted to keep to the toolset that already exists on the platform. I want to isolat
17.
by exec1 3y ago
I've never thought about using Syncthing for this, thanks for the idea!
18.
by exec1 3y ago
Also, while I’m at it – if you’re using VMs for isolating potentially insecure things then your threat model is obviously different. I should have mentioned that I’m using VMs mainly for practical reasons, e.g. for easily spinning up Ubuntu
19.
by exec1 3y ago
PhpStorm has the Jetbrains Gateway which allows running the IDE on the VM and connecting to it using a client on the host. However, I found this to be a rather clunky approach when working on a local VM. I could imagine it working well if y
20.
by exec1 3y ago
> Passing through the FS to the host is a no-go because of subtle executable things like git-hooks that could enable sandbox escape. Could you please expand on this? I’m having trouble understanding this.
21.
by exec1 3y ago
It isn't if you’re more interested in better performance during runtime. I can tolerate a certain delay when my IDE writes to a file on the host but I need the best performance when my app is running. Edit: the point here is about shif
22.
by exec1 3y ago
Depends on your requirements, I guess. I wanted a solution that would allow me to work with Linux ACLs and symlinks as well as get me the best possible performance so going native was basically the only choice. I started from this and then
23.
by exec1 3y ago
Also, regarding VirtioFS: this is indeed something I have not yet tried. I’m wary of this though because this requires installing additional drivers on Windows and I usually prefer using tools that are already at my disposal (e.g. Samba on
24.
by exec1 3y ago
The point I was trying to make in the article was more about reversing the direction of mounts so that instead of mounting a host directory on the guest you share a directory from the guest and mount it with a client on the host. You can ac
25.
by exec1 3y ago
Is TRAMP similar to SSHFS?
26.
by exec1 3y ago
I didn’t know about Guestfish, thanks for the reference! Yes, virtio-fs is an option but I should have added that one of my goals was to not lock myself into a platform… I want to have the possibility of running my VMs on Windows as well an
27.
by exec1 3y ago
Are you referring to bidirectional syncing built into Jetbrains IDEs? If so, I have mixed feelings about it. I gave this setup a go with PhpStorm. Host-to-VM sync is pretty seamless but you always have to manually sync changes from the gues
28.
Keep your files inside your VM(msimkunas.lt)
85 points by exec1 3y ago|71 comments