Viewing profile — AkihiroSuda

There is also elfconv (by my colleague): an AOT binary translator that directly converts Linux ELF to Wasm. https://yomaytk.github.io/elfconv-demo/ The Wasm port of the Linux kerne…

> endpoint: tcp://${{ secrets.BUILDKIT_HOST }}:9999 This should be protected with mTLS ( https://docs.docker.com/build/drivers/remote/ ) or SSH (`endpoint: ssh://user@host`) to avo…

> Also, buildx won't commit the intermediate layers during the build. So if something fails, you can't just grab the previous intermediate layer and do `docker run --entrypoint /bi…

> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles,…

> It requires non official tooling Rootless Docker has been merged into the official since Docker 19.03, and graduated from experimental since Docker 20.10. The "tooling" is availa…

Just merged #9054. Sorry for that we had to revert #8789, but we are looking forward to seeing that PR submitted again with an alternative abstraction interface.

Gen2 was rewritten from scratch for simplification. Gen2 containerizes kubeadm inside Rootless Docker to eliminate the painful "hard way" scripts of Gen1. This is similar to rootle…

Nope. https://rootlesscontaine.rs/#non-examples-of-rootless-contai...

Set `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80`

Not really recently. Both were implemented almost simultaneously in circa June 2018. https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/p…

> The biggest problem with Docker is that its containers are effectively running as root. Both Docker and Podman support rootless mode (and rootful mode).

> Because of its daemonless architecture, Podman can perform truly rootless operations. Daemonless isn't really relevant to rootless. containerd/buildkitd/dockerd have been support…

> Docker-engine doesn't support running as a user other than root. Podman does. Docker engine does.

Slirp networking does not need any suid bit or special capability.

The filesystem performance degradation was resolved in kernel 5.11 which added support for rootless overlayfs. The network performance is caused by slirp (usermode TCP/IP) but it i…

> I guess rootless is some of the work that Docker (company) wanted to keep proprietary and out of this open-source project. Rootless mode for Docker is completely FLOSS, and its m…

Podman 2.1 supports CNI networks (`podman network create`), so it might be worthful now

Podman already supports `podman volume create`, though it doesn't support volume plugins.

Docker has been supporting rootless mode since 19.03

VPN-ish proxy that seamlessly brings clients into remote Docker/Kubernetes networks. No public IP is required. No privilege is required. The only requirement is shell accessibility…

> Why can't you update the Docker image to also support ARM? You theoretically could switch your backend to run ARM Linux. However, this would take months No need to take months. `…

> The downside is that V2 doesn’t support all the controllers that were implemented for cgroups V1 (e.g. devices, net_cls, net_prio,etc.). device controller is present since kernel…