Alt account of @Badabinski

Just a sweaty nerd interested in software, home automation, emotional issues, and polite discourse about all of the above.

  • 0 Posts
  • 61 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2024

help-circle




  • Each VM can be sized appropriately for the demands of the container. With docker desktop, you can’t have a container use all of your system cores without making the VM have access to all of your cores all the time always. One of the biggest benefits (imo) of running containers on a Linux workstation is that if you don’t define a CPI limit, a container can use all the compute/memory on your system. You just can’t do that with Docker desktop. This also affects multi threaded container builds when you’re using buildkit.

    Being able to spin up a vm to build a container with all cores accessible to it, and then run the actual container with a smaller number of cores would make container builds so much faster.

    EDIT: I’ve looked, and it appears that podman desktop also does 1 big VM, rather than having 1 VM per container.
















  • Wireguard was written with the explicit goal of having sane, secure defaults. I totally feel you w.r.t. openvpn or ipsec, since it’s easy to do something wrong. Wireguard is much easier because it simply refuses to give you the choice to do things incorrectly.

    w.r.t. the certificate thing, you could set up a reverse proxy and do HSTS to ensure nobody can load up a rogue CA on your devices. HSTS has the issue that SSH has (trust on first use or whatever it’s called), but you just need to make sure nobody is MITM you for that first connecting and then you’ll be good to go. This would let you use a self-signed certificate if you do desired.