41–50 of 63 posts
This seems absurd. Just apt install irssi. Why Docker for such a simple self contained tiny app?
Earlier quoted context omitted.
I love watching this in tech, the pendulum swings, this is static linking in another dress, Soon everyone adopts this, and then someone complains “why is there 500 libc libraries on my machine” or “there was critical bug and I had to update 388 containers - and some maintainers didn’t update and it’s a giant mess!” Then someone will invent dynamic underlying container sharing (tm) and the pendulum will swing the othe…
We need a static linux distro, because i prefer to have a portable app that works on all linux distros.
I find part of the fun of dockerising small apps is in trying to get the image as small as possible with as few files in it as I can. This one looks like it still contains a lot of stuff that's not needed. For example, my exim image https://hub.docker.com/r/grepular/exim4 is built like this: https://gitlab.com/grepular/docker-exim4/-/blob/main/Dockerf... - The final image only contains the necessary executables, shar…
Wonder if you could go smaller if you used debian:stable-slim and used exim-daemon-light. Also dropping SUID if you don’t absolutely need it.
Earlier quoted context omitted.
Poor mans abstraction. Docker swarm makes a cheap node pool from random hardware. Compose makes all your apps and config live in git. You don't _need_ docker, but if you are already set up for it then it's a boon. Adding an app for me to be very available across a fleet of hardware with ceph backed storage is a one-liner.
> Adding an app for me to be very available across a fleet of hardware with ceph backed storage is a one-liner. But irssi is a chat client: About Irssi is a modular text mode chat client. It comes with IRC support built in.[0] 0 - https://irssi.org/
Earlier quoted context omitted.
I run a ton of apps like this. Look at it the other way. Why muck up my OS with a bunch of tiny apps? Who knows what version I’ll pull in my repo today. Chances are good it’s outdated with weird patches. The docker image is built by the devs. All the proper dependencies are baked into the image. It’s going to run exactly as intended every time, no surprises. And I can pick up the docker file and my configs and run it…
I love watching this in tech, the pendulum swings, this is static linking in another dress, Soon everyone adopts this, and then someone complains “why is there 500 libc libraries on my machine” or “there was critical bug and I had to update 388 containers - and some maintainers didn’t update and it’s a giant mess!” Then someone will invent dynamic underlying container sharing (tm) and the pendulum will swing the othe…
My god, we've discovered a genuine perpetual motion machine.
> this is static linking in another dress
Although static linking usually seems to result in small binaries that just run on the target machine while this needs all the Docket machinary (and the image sizes can get horrendous)
I find part of the fun of dockerising small apps is in trying to get the image as small as possible with as few files in it as I can. This one looks like it still contains a lot of stuff that's not needed. For example, my exim image https://hub.docker.com/r/grepular/exim4 is built like this: https://gitlab.com/grepular/docker-exim4/-/blob/main/Dockerf... - The final image only contains the necessary executables, shar…
Earlier quoted context omitted.
I run a ton of apps like this. Look at it the other way. Why muck up my OS with a bunch of tiny apps? Who knows what version I’ll pull in my repo today. Chances are good it’s outdated with weird patches. The docker image is built by the devs. All the proper dependencies are baked into the image. It’s going to run exactly as intended every time, no surprises. And I can pick up the docker file and my configs and run it…
I love watching this in tech, the pendulum swings, this is static linking in another dress, Soon everyone adopts this, and then someone complains “why is there 500 libc libraries on my machine” or “there was critical bug and I had to update 388 containers - and some maintainers didn’t update and it’s a giant mess!” Then someone will invent dynamic underlying container sharing (tm) and the pendulum will swing the othe…
Earlier quoted context omitted.
I ran irssi for years. I agree... Maybe being paranoid about security?
I don't think it's being paranoid. It's a remotely controlled parser. Fuzzing has turned up some of bugs in irssi and weechat over the years. Things like malformed color codes, DCC filenames, or even basic protocol messages led to crashes. I personally use weechat inside nsjail on a raspberry pi (isolated rpi is enough here, but just for fun): https://github.com/google/nsjail/tree/master/configs
What's the difference?
Earlier quoted context omitted.
Containers are not the best option for security. VMs and/or a MAC are better.
What do you mean by "MAC"?
Earlier quoted context omitted.
I don't think it's being paranoid. It's a remotely controlled parser. Fuzzing has turned up some of bugs in irssi and weechat over the years. Things like malformed color codes, DCC filenames, or even basic protocol messages led to crashes. I personally use weechat inside nsjail on a raspberry pi (isolated rpi is enough here, but just for fun): https://github.com/google/nsjail/tree/master/configs
so the application crashes inside the container, and the container is restarted, vs the application crashes outside the container and it is restarted. What's the difference?
A good book on this was "Hacking: The Art of Exploitation".
My argument though is that irssi is that old, I think automatic file receiving (DCC) is off by default and it has sensible defaults and a long history of being reliable(?)