381–390 of 430 posts
Earlier quoted context omitted.
If an agent fires up NPM, takes a boatload of memory, is that memory released back to the OS after NPM shuts down in the VM?
In principle yes, in practice it's complicated, using something called "balloon drivers" https://en.wikipedia.org/wiki/Memory_ballooning
I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…
I'd like to see real numbers that compare Docker Desktop for macOS before microVMs to post-microVMs. I stopped using Docker on macOS because host file system performance was so slow, even with all of the caching hacks piled on top of it, that it made the whole thing effectively unusable for development. Directionally the post shared sounds great, but it seems "too good to be true" that we'd have a performant microVM…
Earlier quoted context omitted.
Whoah. I took for granted it'd work on Linux.
It does, for whatever reason the marketing page doesn’t advertise it but the docs have Linux instructions: https://docs.docker.com/ai/sandboxes/ I’ve been using this pretty extensively for a few months on Mac and Linux and have been super happy with it.
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
Earlier quoted context omitted.
But how? Normally the TLS handshake and encryption/decryption happen in user space. Even the kernel doesn’t know anything about it.
There is a transparent proxy installed (along with the necessary certificates on the VM.) For an example, see https://docs.microsandbox.dev/networking/tls
How do you solve the issues of private key sharings that are stored in cwd .env? I haven’t found a satisfactory way to preserve them while letting the agent have access.
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
Gondolin looks interesting. It sounds like a TypeScript wrapper that achieves the same thing as my setup: Docker & Kata Containers 4 (KVM/QEMU backend) for microVMs, iron-proxy for egress and secrets, and dnsmasq for internal network name resolution (workaround for a Docker/Kata incompatibility).
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
I havent used nor gondolin neither docker's solution, but curious to know what gondolin is missing (evaluating both for my personal use)? is it only the DX or something else, if DX, can you what exactly is missing? thanks