evertheylen

Running systemd inside a container + automatic SELinux integration

I rely on podman for my "devcontainers": https://github.com/evertheylen/probox. If anyone can point me to the weak points in my setup I'd appreciate it!

If you're looking for a language that aims to solve the "two-language problem" like Mojo, but want something more open, more mature and less influenced by VC funding, check out Julia: https://julialang.org/

This is cool! But AFAIK bun promises to be a one-stop-shop for all your JS/TS dev needs, while Perry is "just" a compiler from Typescript to native executables.

Yes! But I'm assuming it will prevent me from upgrading to Postgres 19 in the future.

From what I can find Postgres 17 [1] introduced incremental backups to pg_basebackup, refined in 18, but nowhere near the full featureset of pgBackRest. Is that what you meant? Having builtin incremental replication to a S3-compatible storage would be great.

[1] https://www.postgresql.org/docs/release/17.0/#:~:text=pg%5Fb...

Ah, sad to read this. Does anyone know of good alternatives?

Lots of cool new ideas like:

- Async is first‑class

- Optimistic primitives (createOptimistic, createOptimisticStore)

- A more predictable scheduler

- And much more!

It's just OpenStreetMap, see https://wiki.openstreetmap.org/wiki/How_to_contribute

Maintaining a data center is much more about solving real-world challenges. The cloud requires expertise in company-specific APIs and billing systems. A data center requires knowledge of Watts, bits, and FLOPs. I know which one I rather think about.

I find this to be applicable on a smaller scale too! I'd rather setup and debug a beefy Linux VPS via SSH than fiddle with various propietary cloud APIs/interfaces. Doesn't go as low-level as Watts, bits and FLOPs but I still consider knowledge about Linux more valuable than knowing which Azure knobs to turn.

Not really, I used it to develop against a "real" postgres database for a node backend app. It worked fine and made it pretty easy to spin up a development/CI environment anywhere you want. Only when inserting large amounts of data you start to notice it is slower than native postgres. I had to stop using it because we required the postgis extension (although there is some movement on that front!).

Here in Belgium I have the impression there's steady progress towards such a system: https://wero-wallet.eu

This is actually how GTFS (a standard format for public transit data) works: https://gtfs.org/documentation/schedule/reference/#stop_time... . Especially sleeper trains can get weird with 30+ hours. But I don't think it's wise to show that to the user

If you're on Linux, I've tried to build an easy yet secure way to isolate your system from your coding projects with containers. See https://github.com/evertheylen/probox

Interesting to see Marko and Solid topping the performance metrics. Ryan Carniato* was a core team member of Marko and started Solid. I wouldn't be surprised if SolidStart can eventually lower its bundle size further.

*) https://github.com/ryansolid

Great piece of software. For me its killer feature is automatically passing through exposed ports in a container, so you don't have to recreate the container with different -p options. (See https://evertheylen.eu/p/probox-intro/#network)

I always like to see new projects using containers. Two questions:

- how is your devbox.json file different from a Dockerfile/Containerfile?

- does your project attempt to provide any isolation security-wise?

To add to the article: systemd integration works in the other way too! Running systemd in a Docker container is a pain. It's much easier in Podman: https://developers.redhat.com/blog/2019/04/24/how-to-run-sys...

(Most people use containers in a limited way, where they should do just one thing and shouldn't require systemd. OTOH I run them as isolated developer containers, and it's just so much easier to run systemd in the container as the OS expects.)

Yeah props to the `pasta` tool, it solves a specific problem really well.

Nice script! I considered a similar approach that's based on "magic" files in the filesystem before, but it was difficult to get the security right. In your case I believe a malicious script can just overwrite .podman/env and it will be sourced by the host the next time you start the container.

I'm happy to discuss this more, feel free to reach out at evertheylen@gmail.com. I'm particularly interested in trying automated ways to try to break out of a container (like https://github.com/brompwnie/botb), this would benefit any containerization project.

I actually run code-server (derivative of VSCode) inside the container! But I agree that there can be many gotchas, which is why I try to collect as much feedback as possible.

I agree with you that VMs would provide better isolation. But I do think containers (or other kernel techniques like SELinux) can still provide quite decent isolation with a very limited performance/ease-of-use cost. Much better than nothing I'd say?

If you are on Linux, I'm writing a little tool to securely isolate projects from eachother with podman: https://github.com/evertheylen/probox. The UX is an important aspect which I've spent quite some time on.

I use it all the time, but I'm still looking for people to review its security.

I do too, but I found it non-trivial to actually secure the podman container. I described my approach here [1]. I'm very interested to hear your approach. Any specific podman flags or do you use another tool like toolbx/distrobox?

[1] https://evertheylen.eu/p/probox-intro/

Another approach I wrote to protect your system from untrusted dependencies (for Linux devs): https://evertheylen.eu/p/probox-intro/

Happy to hear other people's thoughts!

Just VSCode, or more specifically, code-server (https://github.com/coder/code-server)

Why don't we embrace proportional (i.e. not monospace) fonts more for coding? IMHO, they are a big step up when it comes to legibility. I personally switched after I noticed reading stuff in the sidebar (which is usually in a proportional font) felt more comfortable than reading code.

You can't use it for a terminal of course, and occasionally I find comments relying on monospace alignment. Other than that I see no downside to proportional fonts.

I use Input, which gives more room to special characters and is pretty nice overall: https://input.djr.com/

Fully agree, that's why my python script is ultimately just a simple wrapper for podman but it makes my life a lot easier anyway.

toolbx is not actually intended to provide any security or isolation, see e.g. https://github.com/containers/toolbox/issues/183

If any developers are looking to isolate different dev projects from each other using containers, I wrote a tool for it (using podman), maybe someone finds it useful or can thrash its security.

Find the code on https://github.com/evertheylen/probox or read my blog post on https://evertheylen.eu/p/probox-intro/

This sounds enticing! I use multiple dispatch in JS but I wrote my own library for it. Could you give an example of how one would use proxies to do multiple dispatch?