Toolship: A more secure workstation
1–10 of 59 posts
Re: Toolship: A more secure workstation
#2I dream of situation where I'd be developing software on plain Debian Stable with nothing else needed. It is already an immense platform so it does feel bit ridiculous that I'd truly need much more than that.
Re: Toolship: A more secure workstation
#3WSL is quite good for this type of thing.
Re: Toolship: A more secure workstation
#4I would also recommend looking into NixOS reproducible builds, which allows declaratively specifying the entire system configuration and precisely defining which packages are installed, their versions, and dependencies. The OS remains immutable and consistent. A quite powerful tool for creating a secure and minimalistic workstation environment.
Re: Toolship: A more secure workstation
#5You might enjoy https://github.com/jessfraz/dotfiles/blob/master/.dockerfunc I think she had an article about this as well.
Re: Toolship: A more secure workstation
#6WSL is quite good for this type of thing.
WSL probably is good but I believe it still has access to the whole Windows file system.
Linux on ChromeOS is probably better because its file system is separate. Files and directories must be explicitly shared from the main OS.
I think both have the ability to open windows on the main desktop so you can run graphical IDEs and the like in the VM which is nice.
Re: Toolship: A more secure workstation
#7I would also recommend looking into NixOS reproducible builds, which allows declaratively specifying the entire system configuration and precisely defining which packages are installed, their versions, and dependencies. The OS remains immutable and consistent. A quite powerful tool for creating a secure and minimalistic workstation environment. https://nixos.org/
You can also use Nix/Home Manager to manage your Mac (what the author is using). I used NixOS for a few months as a VM and then eventually just switched back to my Mac. Couldn't stand all of the hacks that were needed to get software to behave the way Nix expected them (i.e., JIT binaries not dynamically linked to /nix/store).
Re: Toolship: A more secure workstation
#8I was nodding along until it became clear the Docker containers were being run as root...
Re: Toolship: A more secure workstation
#9I think if I were going to the trouble of dockerizing and isolating all my tools, I wouldn’t want to rely on someone else’s registry of dockerfiles.
This reminds me a lot of the cycle of sandboxing:
Re: Toolship: A more secure workstation
#10I was nodding along until it became clear the Docker containers were being run as root...
Since the author of this post is making efforts to bind mount specific directories, is that still a legit risk? root inside the container isn’t essentially the same root on host. But yes, UID and GID mappings along with user namespacing will be better.