Login
You're viewing the discuss.systems public feed.

Replies

  • 💬 3🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
    Oct 17, 2026, 9:50 PM

    @cancername It's neglecting that containers (on Linux) offer way more than just isolation, that's what I'm saying here.
    Of course, less features means less complexity - but that is not a trait by itself.

    I keep having this discussion about "complexity". It often boils down to not dealing with certain real problems.

    It's like saying that a can is simpler than a fridge. Sure is, both are for storage, but the fridge offers long-term cooling. The can merely isolates. They are hardly comparable.

    💬 1🔄 0⭐ 0
  • 지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
    Oct 17, 2026, 9:54 PM

    @cancername On that note:
    The post never uses the word "complex", though it does use numbers (that do not make sense to compare).

    OTOH, the *headline* claims that jails would be "better". And I'm saying that they have a different scope. Just like can vs fridge.

    💬 0🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Ian Wagnerianthetechie@fosstodon.org
    Oct 18, 2026, 1:23 AM

    @CyReVolt ooh interesting! Thanks for sharing!

    I do wish this were easier. With all these coding agents and stuff I was looking for a way to easily jail that process (ideally without requiring a root elevation to do so), but alas that’s not really supported :/

    So instead I built a heavy jail with all my dev environment and it all lives in there. It works surprisingly well with my emacs setup.

    Though, TBH, I think WASM is a better option if you have it for single binary sandboxing ;)

    💬 1🔄 0⭐ 0
  • 지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
    Oct 18, 2026, 5:38 PM

    @ianthetechie Absolutely.
    I am a big fan of container runtimes that support things that are not a giant file system. Especially if all it takes is really just granting network access and nothing else. There are tons of web services needing that and only that.

    They could store assets within some whatever image format, or just as part of the binary, like through what Go offers with the //go:embed directive directive and Rust via the include_bytes!/include_str! macros.

    💬 0🔄 0⭐ 0
  • cn (old) ->dhcp :nonbinary:cancername@mas.to
    Oct 18, 2026, 2:53 PM

    @CyReVolt I don't really see a good reason to do static linking beyond the usual benefits if you can reflink or hardlink the C runtime and dynamic loader.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • cn (old) ->dhcp :nonbinary:cancername@mas.to
    Oct 18, 2026, 5:31 PM

    @CyReVolt
    nevermind, the below is wrong, the files seem to be required for command line tools

    ~~huh? this is a rust binary that depends on libc and ld, right? i thought what you took issue with was the extra files the binary depended on.~~

    💬 1🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Ian Wagnerianthetechie@fosstodon.org
    Oct 18, 2026, 1:14 AM

    @CyReVolt yeah I read it and it seemed rather Claude-ish and not very deep :/

    The FreeBSD “modern” container orchestration has come a long way in the past like 2 years. Podman is now actually working quite well. I’m transitioning many of my jail setups that way. And fjord.daemonless.io/ looking really nice for “docker compose with FreeBSD extensions” like ZFS dataset management! They are also working on a registry and have standard apps like Postgres packaged already.

    💬 2🔄 0⭐ 0
  • Ian Wagnerianthetechie@fosstodon.org
    Oct 18, 2026, 1:17 AM

    @CyReVolt for multi-host orchestration, I think the state of the art is AppJail + Director + Overlord. There isn’t really consensus around a single way of doing things probably because Google isn’t involved 😂 I think within the next year honestly we will have pretty excellent ways of managing single node and complex multi-service apps with things like Fjord but multi node orchestration idk… I always tell people if you have a problem and you add k8s, you probably now have 3 problems 😂

    💬 1🔄 0⭐ 0
  • Ian Wagnerianthetechie@fosstodon.org
    Oct 18, 2026, 1:20 AM

    @CyReVolt buuuuut k8s is literally the only sorta-vendor-neutral way to create scaling infrastructure. That’s very unfortunate because, while the benefits are real, many managed hosts don’t do a great job with the implementation and TBH I think the tooling kinda sucks. The dev experience is barely tolerable with Terraform etc. and I’ve been using it for like 10 years by now 🫠

    All that to say, many decades into the computer revolution we still haven’t figured out how to deploy shit 😂

    💬 0🔄 0⭐ 0
  • kaleidoscopicfuzzy@beige.party
    Oct 18, 2026, 2:22 AM

    @ianthetechie the author has justified his use of AI on numerous occasions.

    In LinkedIn, for example, under <linkedin.com/posts/vvoss_unixu>:

    "… … these pieces are written between half past seven and half past ten most mornings. AI serves as my secretary and as a second pair of eyes on the facts, so that what reaches you has been checked. Nothing here is automated apart from the deployment to the blog. The argument, the opinions, the examples and the measurements are mine. …"

    #AI #Anthropic #Claude

    @CyReVolt

    💬 1🔄 0⭐ 0
  • 지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
    Oct 18, 2026, 5:30 PM

    @fuzzy @ianthetechie which kinda explains the bias; I see a lot of this kind of shilling, based on the idea "it's not Linux so must be better", usually neglecting tons of things. Somewhat funny.

    I do like to clarify things though. Spreading half-truths isn't helping, especially to readers that do not know as much.

    💬 0🔄 0⭐ 0
  • kaleidoscopicfuzzy@beige.party
    Oct 18, 2026, 1:53 AM

    @david_chisnall 👆️ any thoughts on the original post?

    I know, from Lobsters and elsewhere, that you're sometimes understandably passionate about the – ahem – diverse ways in which jails can be argued for and against.

    @CyReVolt if you have a LinkedIn account, make a comment there. The author is responsive.

    reddit.com/r/freebsd/comments/ includes commentary from @hayzam (author of Sylve).

    Thanks

    💬 1🔄 0⭐ 0
  • David Chisnall (*Now with 50% more sarcasm!*)david_chisnall@infosec.exchange
    Oct 18, 2026, 8:16 AM

    @fuzzy @CyReVolt @hayzam

    You can run a jail with a single binary, but I tend to ignore ‘jails vs containers’ posts because the whole comparison is a category error.

    Containers are a distribution and orchestration model that depend on:

    • A snapshotting or overlay filesystem.
    • A networking model with local routing and firewalling.
    • An isolation mechanism.

    On FreeBSD, these are typically provided by ZFS for the first, a mixture of things for the second, and jails for the third. The third could also be provided by bhyve.

    Jails are a good implementation of the isolation mechanism that containers require. ZFS is a good implementation of the snapshotting filesystem that the container layers model requires. Yet no one writes ‘ZFS vs containers’ comparisons.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 지지 ᚠד (Jiji Freya Daniel) 🐢✨🧡CyReVolt@mastodon.social
    Oct 18, 2026, 5:21 PM

    @fuzzy
    pretty much agreeing with @david_chisnall - that was my point; it's apple vs oranges (both are fruits and round, but).

    I would generalize the first point a bit; file systems are a bit of a legacy Unix detail here.
    I can imagine things that don't need one, say a typical web service that sits between some HTTP(S) endpoint and a database, merely doing things on the network, needing no file system (as in, no storage; neglecting files used for non-storage purposes).

    💬 0🔄 0⭐ 0