Jessie Frazelle

1) in addition to the excellent recommendations already mentioned: Brendan Gregg has a lot of good stuff about monitoring and performance analysis https://brendangregg.com/ https://github.com/brendangregg Also Jess Frazelle (lots of good stuff, esp around containerization): https://blog.jessfraz.com/ https://github.com/jessfraz

Bryan is an O.G. systems engineer who worked at Sun and who's given many great talks and worked on lots of cool projects, and Jessie rose to prominence as a core docker developer and prolific and talented blogger/speaker, among other things. Both are well-known engineers with major contributions to open and closed source systems infrastructure. Steve Tuck I don't know yet, unfortunately. Here are some more links if you're interested: https://blog.jessfraz.com/ https://www.youtube.com/results?search_query=bryan+cantrill * Edit: Rephrased from "O.G. Sun Engineer", I don't know how accurate "O.G. systems engineer is", it's all relative anyway. For reference, I I'd consider Jess an "O.G. containerization engineer" :)

I don't know about "best". But here's some I always check in on: Jessie Frazelle: https://blog.jessfraz.com/ Joshua Stein: https://jcs.org/ Jim Fisher: https://jameshfisher.com/ (I just noticed they all have first names starting with 'J', weird coincidence, right?).

https://blog.jessfraz.com/ is my favorite depiction of pure passion for software. Deep dives, home hacking, intros to topics… Jess is great

If you want to learn more about container security I recommend https://blog.jessfraz.com/ and https://github.com/projectatomic/bubblewrap

I recommend this: https://blog.jessfraz.com/

Worth mentioning Jess Frazelle was running desktop applications in docker a while ago. Not a full desktop, but also quicker to rebuild individual apps. https://blog.jessfraz.com/post/docker-containers-on-the-desktop https://github.com/jessfraz/dockerfiles

Another really good read about containers, jails and zones. https://blog.jessfraz.com/post/containers-zones-jails-vms/

As people are again asking about vm/jails/docker/... https://blog.jessfraz.com/post/containers-zones-jails-vms/ It is great article. Bottom line, jails are "in kernel" primitives. Containers are not (or at least they werent when I last checked).

I really love Jesse Frazelle's[1] blog. She posts things about low-level (firmware/open-hardware/system) security. Her work is already well known here on HN[2]. A few more of my fav: The grugq (NatSec, Tradecraft, OpSec): https://gru.gq/ Pinboard (aka Maciej Cegłowski): https://idlewords.com/ Adam Aelkus: https://aelkus.github.io/ Bert Hubert: https://berthub.eu/ ____ [1] https://blog.jessfraz.com/ [2] https://news.ycombinator.com/from?site=jessfraz.com

Source: https://blog.jessfraz.com/post/born-in-a-garage/ In the same post, the author writes: "If you want to read more about some of the deep technical problems we will be solving check out my ACM Queue articles" followed by some links. The first, on open-source firmware, even appears to be freely available: https://queue.acm.org/detail.cfm?id=3349301 So that may help get the necessary context for this company launch.

Something to be aware of (and a general comment about k8s in general) is that k8s is not suitable for use in hostile multi-tenant scenarios like the one that you're describing. Once an attacker escapes from the container (see HN archives for lots of examples of this), they can p0wn the entire cluster. Jessie Frazelle has a great post on this: https://blog.jessfraz.com/post/hard-multi-tenancy-in-kubernetes/ There are expensive ways to deal with this today, e.g., running each user isolated in a separate VM. Hopefully we will have better solutions in the near future.

This is somewhat similar to Jessie Frazelle's setup: https://blog.jessfraz.com/post/ultimate-linux-on-the-desktop/ The talk and slides at the end of that post are worth the time if this sort of thing is interesting to you.

I use WireGuard on my router (ER-L) and Pi-Hole on the router as well, with a primary DNS on my Synology which uses Pi-Hole's Docker image [1]. Docker runs on Raspberry Pi, so I recommend you look into that route. Jessfraz wrote a howto on running WireGuard in Docker [2] [1] https://github.com/pi-hole/docker-pi-hole [2] https://blog.jessfraz.com/post/installing-and-using-wireguard/

You are almost certainly talking about Jessie Frazelle: https://blog.jessfraz.com/

In this post the author links to one of her previous posts[0], where she wrote: > As a proof of concept of unprivileged containers without cgroups I made binctr. Which spawned a mailing list thread for implementing this in runc/libcontainer. Aleksa Sarai has started on a few patches and this might actually be a reality pretty soon! Does anybody know if this made it into runc/libcontainer? I'm not an expert on these technologies but would love to read through docs if it has been implemented. [0] https://blog.jessfraz.com/post/getting-towards-real-sandbox-containers…

https://blog.jessfraz.com/ seems to suggest she did not, in fact, quit the industry. (Good, it would only make the problem worse, no?)

It is very interesting. I don't want to intrude on their thread, but if others here vouch for this technique I'll politely ask them to look into the following: - https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ - http://boot2docker.io/ ...has anyone here ever used this approach with nix apps that need to run on Windows "natively"? Writing a powershell script to silently install boot2docker with this special docker image wouldn't be too difficult. The DarkTable folks don't seem interesting in maintaining Win builds so this may be the perfect workaround. NOTE: I realize that `File > Open Image` may be non-trivial, but surely there's a way to mount a host<->guest folder (e.g.: When using the application, the workspace is located in `C:\Users\$whoami\Documents\DarkTable\.jpg`)

This is such a great thread, I'm excited to begin reading quite a few of the linked blogs (such as this one: https://acoup.blog/). These ones are some of my favorites: - www.wall.org/~aron/blog/ (physics, theology, history, philosophy) - http://xahlee.info/ (math, emacs, keyboards, etc.) - https://matt.might.net/articles/ (academy, compsci, etc.) - https://www.joelonsoftware.com/ (programming, companies, etc.) - https://danluu.com/ (technical topics) - Mailing list in https://practicaltypography.com/ - http://paulgraham.com/ - https://math.ucr.edu/home/baez/ (math, physics) - https://www.gwern.net/index (interesting articles) - https://slatestarcodex.com/ and https://astralcodexten.substack.com/ (science, psychiatry, philosophy, rationality, etc.) - http://steve-yegge.blogspot.com/ (programming) - https://creativegood.com/blog/ (UX, and more) - https://daringfireball.net/ (Apple) - https://backreaction.blogspot.com/ (physics) - https://thelastpsychiatrist.com/ - https://historyforatheists.com/ (historical myths) - http://funcall.blogspot.com/ (programming, compsci) - https://blog.fawny.org/ (accessibility, design) - https://blog.jessfraz.com/ (technology) - https://use-the-index-luke.com/blog (databases) - https://weekendfisher.blogspot.com/ (God, love) I can list some of my favorite articles from one of these blogs if anyone is interested.

Funny, I never thought about it that way. Namespaced processes being a linux kernel feature in the first place. That's where the whole container thing CAME from in the first place. It's only because the Windows and OSX kernels _don't_ support namespacing, that we have to run docker et al inside a virtual machine on those environments. It is not the container implementation, but the virtual machine, which makes containers "secure" on those platforms. So put more finely: containers are not secure, anywhere. Virtual machines are. So you should run your containers inside virtual machines if security is important to you. Environments that can't run containers natively are forced into the more secure configuration. If you're interested in the ongoing work to make containers more secure, Jessie Frazelle has very clear posts on the subject [1][2]. The Bubblewrap project also has a great summary of various approaches being used to "jail" container processes properly. [3] [1] https://blog.jessfraz.com/post/containers-zones-jails-vms/ [2] https://blog.jessfraz.com/post/getting-towards-real-sandbox-containers… [3] https://github.com/projectatomic/bubblewrap

Maybe you already saw this: https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ It's pretty dated, but the state of containers has only improved since 2015, and this was usable for Google Hangouts (video) and YouTube all the way back then. https://hub.docker.com/r/jess/chrome/ ^ This got a push less than 24 hours ago https://github.com/jessfraz/dockerfiles/blob/master/chrome/stable/Dock… ^ This is the Dockerfile, in a repo full of Dockerfiles for other things you might have had trouble putting into a container. I tried this myself and had problems because (I think) I was on a very old LTS/stable distro with a necessity to use pretty old Docker release. This person is a maintainer on the Docker core team, so is most definitely tracking newest releases. I use Chrome in a headless setup with Kubernetes and Docker (Jenkins with kubernetes-plugin) but it's not Headless Chrome, it's Xvfb that makes my setup headless. Chrome itself works great in a container. It's one excellent way to keep it from eating up gobs of RAM like it does: just give it less RAM (cgroups). If you said "chroot jail" on purpose because you don't want Docker, I don't know why exactly, maybe because you don't think you can run graphical apps in a Docker container, but it's not true. You can! You could also cobble something together and do it without Docker, but I'm not recommending that, I just saw this and thought it would be exactly what you're looking for. Hope this helps!

Oh ffs... Jails is not Containers. https://blog.jessfraz.com/post/containers-zones-jails-vms/

Didn’t Jess Frazelle have most of her dependencies running inside lots of Docker containers for a while? She went pretty far and also kept it up for a long time. E.g., https://blog.jessfraz.com/post/docker-containers-on-the-desktop/

https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ is the one I remember, a bit old but still useful to see how she does it. Seems super painful and indirected for a nebulous gain to me, but find your joy however you want I guess

> Containers are not security isolation, I'm not sure why this has to be repeated so often because it's very obviously not the problem containers try to solve. I will refer you to: https://blog.jessfraz.com/post/containers-security-and-echo-chambers/

Additional reading on this topic if you fancy it. This is the first one I read regarding docker for GUI apps https://blog.jessfraz.com/post/docker-containers-on-the-desktop/

Miscellaneous technical stuff: - https://danluu.com/ - https://blog.jessfraz.com/ - https://adamwathan.me/ - https://jvns.ca/ - https://rachelbythebay.com/w/ - https://dankim.org/ - https://mtlynch.io/ - https://rgz.ee/ - https://markdotto.com/ - https://thorstenball.com/ - https://sarahdrasnerdesign.com/writing/ - https://lukesmith.xyz/ - Quirky minimalist linux & free software stuff. I don't agree with many of his opinions but his rants are entertaining + offer a refreshing view on certain things. Non-technical: - https://bernoid.com/

I started doing exactly that. I've been reluctant to contribute to nodejs (e.g. electron) projects for some time, because I just don't want to run npm on a computer with any kind of remotely private data. Lately there were just too many itches to scratch, so I went for a VM replicating my normal setup (dotfiles etc.), and I just use x2go, locally. Quick and dirty setup which is good enough when used infrequently. My ideal setup would probably be closer to https://blog.jessfraz.com/post/docker-containers-on-the-desktop/, but it's more setup than I could be bothered with at the time. Maybe one day.

The blog post links to Jessie Frazelle's GitHub repo [0]. Jessie also has a blog post about this [1] from back in 2015. If you prefer video format, Jessie also has a talk at DockerCon SF 2015 [2]. [0] https://github.com/jessfraz/dockerfiles [1] https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ [2] https://www.youtube.com/watch?v=cYsVvV1aVss

Whalebrew[0] has been doing this for years, though Subuser appears to provide more configuration/access control. [0] https://github.com/whalebrew/whalebrew It's not a new nor crazy idea...Jessie (jessfraz.com) talked about doing this[1] in their desktop environment back in 2015. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/