avsm
Joined 16 years ago
Karma
1,560
Submissions
256
Member since
Sep 17
anil.recoil.org
hacker @ocaml
faculty @cambridge computer laboratory
fellow @pembroke college cambridge
hacker @openbsd
View on Hacker NewsRecent submissions
Comment · 8 days ago
I'm glad to hear that DfD's repo is still the piñata!!! Congrats on the Docker sandbox launch as well, great to see it integrated now.
Comment · 8 days ago
I am having a blast working on environmental science these days, and we’re long overdue a beer next in SF!
Am firing up Dagger to give it a try on our geospatial workflows for the first time just now; it’s got the same attention to CLI detail as Docker 1.0 did :-)
Comment · 9 days ago
(Unikernel cofounder here)
When acquiring our company, Solomon took us to a remote farm in France for a week for an offsite, fed us fantastic food and wine, and the first prototype of that Docker for Mac VM was working by the end of the week! It took a few months to hack together the shell. There's a video of Solomon and the pinãta launch party on my blog ;-) https://anil.recoil.org/notes/cacm-docker-cover#getting-invo...
There was a whole other slice of work we did for project Piñata too in the form of datakit (https://github.com/moby/datakit) that was well ahead of its time. I was looking at this archived code again just last week while thinking about agentic git workflows!
Comment · 27 days ago
> Docker Linux have not been using microVMs for a decade.
You sure could. Kata containers have been around for a long time; I remember putting them into production back in 2017 or so (and dealing with filesystem forwarding issues). https://lwn.net/Articles/755230/
Comment · 27 days ago
For the nostalgia seekers, I uploaded the OG Docker for Mac beta video: https://crank.recoil.org/w/3re5G972kkqjzzujxHQ3E6
I do think this was well ahead of its time. Under the hood, we designed a Linux distro called LinuxKit (https://github.com/linuxkit/linuxkit) which ran every process in its own mount namespace (including the init process), and had a deterministic build with hashes. As far as I can tell, it's still pretty hard to get this experience even with Nix in 2026.
The boot time was also quick enough to be entirely in parallel and so not be noticeable (the 'bounce time' of the application on Mac was one bounce!)
Comment · 2 months ago
OCaml (the language I use in the post) is an extremely memory safe language, but there are plenty of higher level logic issues that spring up.
LLMs are extremely good at finding corner-case vulnerabilities in C bindings even within a memory safe language; see for example the fixes in an OCaml crypto library here: https://discuss.ocaml.org/t/the-series-of-mirage-crypto-rele...
Comment · 2 months ago
Custom infrastructure; I use my site as a playground for various things over the years. It ran as the first MirageOS unikernel for many years, and recently it's been running on a zero-allocation OxCaml webserver https://anil.recoil.org/notes/oxcaml-httpz to help me get to grips with the new extensions.
Comment · 2 months ago
There's a full terminal implementation of Bonsai as well. I actually use it in my personal workflow these days to manage my contacts database! https://anil.recoil.org/notes/aoah-2025-9
Comment · 3 months ago
Fun is, by far, the biggest reason I can identify why I work on some open source projects and not others these days! I think it was also true in the past, but to a lesser extent. Docker circa 2015 never felt like a job at all and the early Dockercons werre a thing of legendary entertainment!
A couple of things have possibly conspired to make more established projects less fun in the past few years:
- we're getting older; as maintainers age, I find it's just harder to make time to go to hackathons and socialise with the younger generation, much as I would love to. Too much real life stuff on. The pandemic also established a 'before/after' and conferences just haven't been the same level since for me. I'm not sure if I changed or the conferences did.
- obviously LLMs, since they add a layer of interferences between both the demands on my maintainer time (LLM generated PRs) but also how much I need to interact with other people to solve a problem. I made plenty of online friends over the past three decades figuring stuff out together over some obscure library, but group debugging seems less important now if you can chuck it at Fable.
Comment · 3 months ago
yep, I host two separate Tangled knots; one for my personal use and another for work at the Cambridge Computer Science department. Having large git repos on a server near me is great, and because I can sync the bare git repos it’s easy to run a local forge as well.
Comment · 4 months ago
I looked at this last year when it came out in Tahoe: https://anil.recoil.org/notes/apple-containerisation and this looks like more of the same.
They've now added a WSL-style virtual machine layer, but there's no x86 container story (Apple's killing Rosetta) so I imagine some qemu shimming will be required.
There's still no equivalent to VPNKit or GVisor for networking so you'll be bridging I think. See: https://cacm.acm.org/research/a-decade-of-docker-containers/ for how Docker for Mac does this
I can't spot any support for dynamic memory ballooning to prevent the hypervisor from gobbling up too much memory. We've had this in Xen since forever! https://xenproject.org/blog/ballooning-rebooting-and-the-fea...
And, most obviously: NO SUPPORT FOR MACOS. This is the single feature that only Apple can do, and they're choosing not to implement it deliberately, and it's so stupid given the pains we all have to go through to implement CI for macOS. In the land of OCaml, we were forced to implement a custom ZFS snapshotter to get reasonably cost effective macOS CI for our package repository: https://tarides.com/blog/2023-08-02-obuilder-on-macos/. This was fun to build, but it sucks to have to maintain it.
Also, I'm really curious what the GPU passthrough story here is for LLMs, since the Apple Silicon -> Linux kernel support is gated on Asahi's support, but that's been lagging beyond M2 due to the efforts of reverse engineering.
Do better for your developers, Apple. This is a half-baked sweep across third-party software without addressing the core needs around your own operating system.
Comment · 5 months ago
Nice work! Did you ever open any open source any of it? Looking at your OCaml wishlist from back in 2017, some stuff has improved and some is on its way:
- Support for read-only BigArrays (or sections) : we're starting to switch to just using bytes/string in OCaml 5+ now, since the larger allocations go into malloc'ed pools and do not relocate, so they can be used as part of an FFI (without the Bigarray C value overhead)
- More support for floating-point numbers (exceptions, representation exploration): OxCaml has some of this now! https://oxcaml.org/documentation/miscellaneous-extensions/sm...
- Syntax for extended BigArray indexing: now supported in OCaml https://ocaml.org/manual/5.4/indexops.html#ss:multiindexing
- LaCaml remains too low-level (non-functional) and unreadable: still remains the case, but OxCaml's got initial support for SIMD https://oxcaml.org/documentation/simd/intro
- BigArray and floating-point I/O remains difficult (we would like: I/O to channels, efficient representation retrieval): much easier now with OCaml effects to build custom fast serialisers (see https://github.com/ocaml-multicore/eio)
- Native top-level: ocamlnat is (I think) shipped in OxCaml, but you can also run a wasm toplevel
Comment · 5 months ago
I must confess to also using agents to do most of my OxCaml annotations: https://github.com/avsm/ocaml-claude-marketplace/tree/main/p...
There's not that much downside since the annotations only change the performance characteristics of the program, and the static type system rejects inconsistent annotations.