giuseppe - Network

We are getting a lot of very low-quality security reports recently where we need to spend time explaining why what was reported is not an...

We are getting a lot of very low-quality security reports recently where we need to spend time explaining why what was reported is not an issue at all.

Is there any security bug bounty program going on?

we've finally sent upstream composefs. It is a new file system to mount read-only images with a bunch of cool...

we've finally sent upstream composefs. It is a new file system to mount read-only images with a bunch of cool features:

https://lkml.org/lkml/2022/11/28/349

Let's see what the upstream Linux community thinks about it.

some of the hardening features used with containers can also be useful for other use cases.For example, a quick hack to run "yum...

some of the hardening features used with containers can also be useful for other use cases.

For example, a quick hack to run "yum upgrade" without the expensive sync calls (use at your own risk!):

# printf "\$syscall in (@sync,@syncfs,@fsync) => ERRNO(0);\n=> ALLOW();\n" | easyseccomp | seccomp-run /dev/stdin yum upgrade -y

The script uses easyseccomp from: https://github.com/giuseppe/easyseccomp

crun 1.7 supports running the same #WebAssembly image used by Docker without any modification:$ readlink /usr/bin/crun-wasm../bin/crun$...

crun 1.7 supports running the same #WebAssembly image used by Docker without any modification:

$ readlink /usr/bin/crun-wasm
../bin/crun
$ podman --runtime /usr/bin/crun-wasm run --platform=wasi/wasm32 -t --rm michaelirwin244/wasm-example
[...]
Server is now running

It is almost 10 years that I sleep where I work and I've never bragged about it

It is almost 10 years that I sleep where I work and I've never bragged about it

just released crun 1.7 with improved performance and better support for #webassembly

just released crun 1.7 with improved performance and better support for #webassembly

if you've not already seen it:https://blogs.gnome.org/alexl/2022/06/02/using-composefs-in-ostree/

if you've not already seen it:

https://blogs.gnome.org/alexl/2022/06/02/using-composefs-in-ostree/