AkihiroSuda
Joined 10 years ago
Karma
63
Submissions
44
Member since
Jan 22
Software engineer at NTT Corp.
https://github.com/AkihiroSuda
View on Hacker NewsRecent submissions
Comment · 1 year ago
There is also elfconv (by my colleague): an AOT binary translator that directly converts Linux ELF to Wasm.
https://yomaytk.github.io/elfconv-demo/
The Wasm port of the Linux kernel sounds quite interesting as it may potentially help improving the syscall compatibility of elfconv.
Comment · 2 years ago
> endpoint: tcp://${{ secrets.BUILDKIT_HOST }}:9999
This should be protected with mTLS (https://docs.docker.com/build/drivers/remote/) or SSH (`endpoint: ssh://user@host`) to avoid potential cryptomining attack, etc.
Comment · 2 years ago
> Also, buildx won't commit the intermediate layers during the build. So if something fails, you can't just grab the previous intermediate layer and do `docker run --entrypoint /bin/bash` on that layer to poke around.
`buildg debug` (Dockerfile debugger based on BuildKit) to rescue: https://github.com/ktock/buildg
Comment · 2 years ago
> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles, while available in Docker, aren't enabled by default and often require extra setup.
Seccomp has been enabled by default since 2015: https://github.com/moby/moby/pull/18780
It is true that Rootless isn't enabled by default but its "extra setup" can be done with a single command (`dockerd-rootless-setuptool.sh install`)
Comment · 2 years ago
> It requires non official tooling
Rootless Docker has been merged into the official since Docker 19.03, and graduated from experimental since Docker 20.10.
The "tooling" is available in the official apt/dnf repo too: - https://download.docker.com/linux/ubuntu/dists/jammy/pool/st... - https://download.docker.com/linux/centos/9/x86_64/stable/Pac...
Comment · 3 years ago
Just merged #9054.
Sorry for that we had to revert #8789, but we are looking forward to seeing that PR submitted again with an alternative abstraction interface.
Comment · 3 years ago
Comment · 3 years ago
Set `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80`
Comment · 3 years ago
Not really recently. Both were implemented almost simultaneously in circa June 2018.
https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/podman/commit/19f5a504ffb14709...
Rootless Docker wasn't merged/released until Docker 19.03, though , but still it is already nearly 4 years old.
Comment · 3 years ago
> The biggest problem with Docker is that its containers are effectively running as root.
Both Docker and Podman support rootless mode (and rootful mode).
Comment · 3 years ago
> Because of its daemonless architecture, Podman can perform truly rootless operations.
Daemonless isn't really relevant to rootless.
containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootless codes have been mutually ported over across containerd/buildkitd/dockerd and Podman.
Comment · 4 years ago
> Docker-engine doesn't support running as a user other than root. Podman does.
Docker engine does.
Comment · 4 years ago
Slirp networking does not need any suid bit or special capability.