Gabriel Garrido

Spent most of yesterday and today doing a write up on #podman rootless containers in light of the #copyfail exploit.

I use containers for all sorts of things, and I run most of my infrastructure on Podman using rootless containers. For a while I had been meaning to do a write up on how you can use features in Podman to practice defense in depth for containerized workloads.

Copy Fail proved to be a great example to use when talking about containers, user namespaces, Linux capabilities, and more! I did not find much information specific to containers so I decided to dust-up the blog with my own exploration.

https://garrido.io/notes/podman-rootless-containers-copy-fail/

Great interview with L.M. Sacasas, author of one of my favorite sites, The Convivial Society.

> The underlying question has to do with our vision for human flourishing: What is the good that we are after? If our vision for human flourishing is to optimize the self as a node in the technologized market network and serve that system to become efficient consumers and producers, the tools that help you get there are of a certain sort. But if human flourishing consists in relationship, in the assortment of skills that sometimes were labeled arts — the art of dying, the arts of memory — then they’re not skills to be optimized, or techniques to be applied, but rather arts and virtues to be cultivated.

https://connectivetissue.substack.com/p/achieving-independence-for-the-sake

Just salvaged a couple of SCOBYs from a SCOBY hotel that I had left unattended for 9 months. Safe to say that's a new record for me!

The top-most was in pretty bad shape and went straight to the compost bin along with the following three or four SCOBYs. I am hopeful that remaining ones will be viable once they go through one or two kombucha cycles. They were still fully submerged, but could easily have contaminated.

Unfortunately there aren't enough homebrewers around to share the spare SCOBYs that accumulate so easily.

#fermentation

Great blog and series of articles on privilege dropping and separation when using Go.

https://log.0x21.biz/posts/go-privdrop/

@joshrivers@techhub.social @rasmus91@fosstodon.org @jwildeboer@social.wildeboer.net Thanks for sharing. I agree with what you're saying about using containers over not using them at all, but I wonder if there is a misunderstanding about Podman here.

Both Docker and Podman run OCI containers, and what you're attributing to Docker also "just works" with Podman. In most cases they can be used interchangeably, to the extent that you could alias docker to podman and you might not notice unless your container needs access to host Docker socket to interact with the Docker daemon.

The point is mostly that Podman makes it easier to run containers in a more isolated fashion out of the box thanks to fundamental design differences, which can be preferable both for production hosting (e.g running services on a server) or running services/environments on a workstation.

There is no shortage of opinions of Board's of Canada latest album. Went through my first listen during an unfathomably long boat trip, and I'm just grateful for the experience of it all. Everything and all the things.

https://boardsofcanada.bandcamp.com/track/you-retreat-in-time-and-space

#listening

Discovered Synth History by way of seeing their latest print issue at a book store.

Some personal highlights include Q&A with Alessandro Cortini:
https://www.synthhistory.com/post/interview-with-alessandro-cortini

Also, learning that Adam Granduciel of The War on Drugs carries his own filter coffee kit when on tour. Can't help but do the same on most of my travels:
https://www.synthhistory.com/post/the-war-on-drugs-recommends-tour-edition

Three brief Q's with Ryuichi Sakamoto:
https://www.synthhistory.com/post/three-questions-with-ryuichi-sakamoto