Comment

Comment by do_not_redeem

> The inscrutable iptables rules?

You mean the list of calls right there in the shell script?

> Who will know about those undocumented sysctl edits you made on the VM?

You mean those calls to `sysctl` conveniently right there in the shell script?

> your app needs to programmatically spawn other containers

Or you could run a job queue and push tasks to it (gaining all the usual benefits of observability, concurrency limits, etc), instead of spawning ad-hoc containers and hoping for the best.

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton