Post B4uimkkDkCnXJbM2b2 by jessew@mk.cpluspatch.com
(DIR) More posts by jessew@mk.cpluspatch.com
(DIR) Post #B4ugPzaMCTRQm5lBSq by Stellar@mk.absturztau.be
0 likes, 0 repeats
I DONT WANT YOUR FUCKING PROJECT INSIDE A FUCKING docker compose I WANT TO FUCKING GIT CLONE AND RUN IT. FUCK YOU.turns out you can just read the docker compose yaml file and do it yourself, oh i install redis and add some environment variables was that so hard
(DIR) Post #B4uhtZ0XgCYqzGfkwa by Stellar@mk.absturztau.be
0 likes, 0 repeats
redis and gunicorn and django and ASGI and Celery? this could have been a symphony project.
(DIR) Post #B4uiPM2pPaWW37tueO by Stellar@mk.absturztau.be
0 likes, 0 repeats
hold on what the fuck is this
(DIR) Post #B4uiSuxq2QqXDeGY3U by mook@possum.city
0 likes, 0 repeats
@Stellar@mk.absturztau.be fuck docker, install your webapp in a chroot like an adult
(DIR) Post #B4uiTCpzaLGWeWjXKC by Stellar@mk.absturztau.be
0 likes, 0 repeats
@mook@possum.city that's what i'm doing
(DIR) Post #B4uihxQn9FmhDKypZw by jessew@mk.cpluspatch.com
0 likes, 0 repeats
@Stellar@mk.absturztau.be the reason devs like docker is that it makes it orders of magnitude easier for the dev to support every single linux distro and library combo (which users insist on), and you don't have to spend hours and hours of your completely unpaid time to find out why the specific build of glibc on debian 7.2 breaks your app or somethingthis is a really common scenario, it's why docker and containers in general exist at all
(DIR) Post #B4uiiqUESADTxw0r4q by mook@possum.city
0 likes, 0 repeats
@Stellar@mk.absturztau.be there's was this weird controversy on the arch wiki over the article on installing nginx in chroot, because 'chroot isn't designed for security' which was just, if someone found a way to break out of a chroot that would be major news
(DIR) Post #B4uimGvsaIIYr4ZvbU by Stellar@mk.absturztau.be
0 likes, 0 repeats
@mook@possum.city there are tons of chroot escape exploits everywhere, there are tons of capture the flag games where you escape a chroot jail
(DIR) Post #B4uimkkDkCnXJbM2b2 by jessew@mk.cpluspatch.com
0 likes, 0 repeats
@Stellar@mk.absturztau.be also there's very little performance overhead since a container isn't a VM but just an isolated processit uses more storage but that's not a big issue
(DIR) Post #B4uio6OUjlKYkXpsOW by Stellar@mk.absturztau.be
0 likes, 0 repeats
@jessew@mk.cpluspatch.com yeah but a container inside a lxc inside a proxmox is fucking gross
(DIR) Post #B4uj3TsZhaeDvoEr5c by jessew@mk.cpluspatch.com
0 likes, 0 repeats
@Stellar@mk.absturztau.be it is gross but to be fair most software assumes you're running it on a shared host, things like lxc aren't used by that many peoplei can tell you i stopped supporting "build from source" on my biggest 2-year project and now only offer nix and docker builds because it became such a burden to support from-source builds that it was better to just drop it
(DIR) Post #B4ujBfKR19BRl2AlP6 by mook@possum.city
0 likes, 0 repeats
@Stellar@mk.absturztau.be oh i'm stupid... the exploits i'm seeing are more related to outdated versions of sudo, like that shit does get patched pretty quickly
(DIR) Post #B4ujEhZr75E1bIpjXc by Stellar@mk.absturztau.be
0 likes, 0 repeats
@mook@possum.city i'm not using a chroot its a LXC, kinda like a container but not really and a bit older
(DIR) Post #B4ujH177RpnilsUok4 by Stellar@mk.absturztau.be
0 likes, 0 repeats
@jessew@mk.cpluspatch.com i think docker is a huge bloated slow mess that eats too much ressources
(DIR) Post #B4uk2DWT86ekrorNU8 by Stellar@mk.absturztau.be
0 likes, 0 repeats
i don't want to jump the shark, i might tcpdump to double check, but if its true. lmao. they are not very transparent that their "AI Failure Detection" solution would be to just send screenshots of your camera to chatgpt. https://www.obico.io/failure-detection.htmlthousands of users of this software who wouldn't know that their 3d printer is sending its feed to OPEN AI. the yankee monarchy's lapdog.
(DIR) Post #B4uk7bKI3XN68ljMsC by mook@possum.city
0 likes, 0 repeats
@Stellar@mk.absturztau.be i just think there's never an fool proof barrier to a dedicated hacker, and so you gotta have layers: run a container inside a chroot, inside an LVMan attacker also doesn't need root to cause problems, if someone has www-data access your kinda fucked already
(DIR) Post #B4ukELAUWtty3QMRdI by mook@possum.city
0 likes, 0 repeats
@Stellar@mk.absturztau.be but LXC looks cool i should use that
(DIR) Post #B4um1OgSLbPv6LGgpk by yama@tech.lgbt
1 likes, 0 repeats
@Stellar If i get myself a 3d printer, that shit will never have internet access. Hell if i get a 2d printer it will be a USB only with 0 internet hardware
(DIR) Post #B4um6krFKfJhJwrzkG by Stellar@mk.absturztau.be
0 likes, 0 repeats
@yama@tech.lgbt my 3d printer has no "cloud" or internet features, i'm looking for a self-hosted good proxy for my friends to see and use it remotely. i can't just reverse proxy the printer's UI unfortunately because its a websocket and too unsecure
(DIR) Post #B4us1FvVVRKlfMckd6 by jessew@mk.cpluspatch.com
0 likes, 0 repeats
@Stellar@mk.absturztau.be that's literally untrue though, docker doesn't eat any resources, it's not a VMprocesses spawned via docker use exactly the same amount of memory than non-docker things because containers are just standard processes with strict isolation rules
(DIR) Post #B4us1GJG58Kgr1jieO by jessew@mk.cpluspatch.com
0 likes, 0 repeats
@Stellar@mk.absturztau.be here i'll cite a research paper from IBMhttps://web.archive.org/web/20180721215315/https://domino.research.ibm.com/library/cyberdig.nsf/papers/0929052195DD819C85257D2300681E7B/$File/rc25482.pdftldr identical performance to native in every way except networking, which is a bit slower (almost the same as a VM through KVM)
(DIR) Post #B4us1GeApN3xttWQFc by aura@gts.foxsnuggl.es
0 likes, 0 repeats
@jessew @Stellar alternatively, namespaces(7) is a fun read too https://man7.org/linux/man-pages/man7/namespaces.7.htmlnetworking can also be made near-native with eBPF magic, but it's unlikely to matter for most workloads anyway, you're probably hitting socket exhaustion and conntrack issues way before you'd notice the raw performance impact of a veth pair + bridge
(DIR) Post #B4us1H6B9FSrIkcmu0 by Stellar@mk.absturztau.be
0 likes, 0 repeats
@jessew@mk.cpluspatch.com @aura@gts.foxsnuggl.es but have you considered i don't really like the logo
(DIR) Post #B4uukLQU6Zvbf8k0oq by aura@gts.foxsnuggl.es
0 likes, 0 repeats
@Stellar @jessew that's okay, you can pick a less shit container runtime too, they really don't do anything but configure and start a linux process for you
(DIR) Post #B4v2VU2UbCnLfHwZVI by kimapr@ublog.kimapr.net
0 likes, 0 repeats
@jessew @Stellar Fun fact: if you forward a docker container port to localhost and then access that port it’ll route all connections through a userspace proxy written in Go. This proxy that just blindly forwards raw data is less efficient than fucking Forgejo.
(DIR) Post #B4v2VUFFpl0GIrulOa by Stellar@mk.absturztau.be
0 likes, 0 repeats
@kimapr@ublog.kimapr.net @jessew@mk.cpluspatch.com source?
(DIR) Post #B4v3mJN1cPzNSA8TUe by kimapr@ublog.kimapr.net
0 likes, 0 repeats
@Stellar @jessew my vps does [see pic] when 1 grillion zillion connections occur.https://github.com/docker/docs/issues/17312https://github.com/moby/moby/issues/47537
(DIR) Post #B4vLAiUFaOP9WOjptA by ivan@possum.city
0 likes, 0 repeats
@mook @Stellar@mk.absturztau.be At that point it sounds like you're just looking for a VM. Security isn't really the point of containers.
(DIR) Post #B4vLAihMncteB4sJKi by mook@possum.city
0 likes, 0 repeats
@ivan @Stellar@mk.absturztau.be or LXC inside of a VM also if you're in a VPS you gotta do some kind of container
(DIR) Post #B4vLAivtvaWSu9fuzI by Stellar@mk.absturztau.be
0 likes, 0 repeats
@mook@possum.city @ivan@possum.city proxmox host LXC directly on it next to other vms
(DIR) Post #B4wl2kCa7M32USIDgm by ivan@possum.city
0 likes, 0 repeats
@mook @Stellar@mk.absturztau.be WHY