Narushia

It's great that this writeup was published, but unfortunately the text is full of claudisms and made me close the tab pretty quickly.

I was able to install it on Fedora from the .rpm distributed on their GitHub releases: https://github.com/docker/sbx-releases/releases

The .container units get the job done, but if you want to manage a stack of containers and are familiar with Kubernetes, or just like YAML, I recommend using the .kube units instead.[1]

[1]: https://docs.podman.io/en/stable/markdown/podman-kube.unit.5...

The archive.ph link gives me a looping CAPTCHA…

That's probably why they qualified it with 'almost'.

Obviously. Now think of the wants and workflows of your average user and is starts to make sense.

Never expected someone to call GNOME straight up ugly. IMO it's currently the most stylish DE out there by far (comparing to the default look of other DEs). Opinions, huh.

Thank you so much for replying! Seems promising, I will take a closer look. I'm definitely looking forward to possibly buying a Graphene-powered Motorola phone in the future.

Not possible in Finland. :( I'm using the one bank (OP) that used to allow rooted devices to use their app, but even they eventually blocked it via SafetyNet.

I agree that the features should ideally be provided by the base system so that the user does not have to "hack them in" with root-powered apps. But the reality is that most Android "distros" simply do not support the features that I would consider basic functionality. I mainly root for three reasons:

- Backing up all app data via Neo Backup. Android has an auto-backup feature that backs up app data to the user's Google Drive, but unfortunately the app developer can simply opt out of this, and the user cannot do anything about it. This means that app data may be lost when migrating to a new phone, as the app data is stored in directories that are not accessible in the filesystem without root.

- High-quality call recording via Call Recorder. For some reason, some (most?) phones do not allow apps to access the raw incoming audio stream. Non-root apps have to rely on capturing the other end through the microphone, which is horrible.

- /etc/hosts-based ad blocking while using a VPN via AdAway. DNS-based ad blocking is possible via apps like AdGuard, which use a local VPN to accomplish this. Unfortunately, Android only allows one VPN connection at a time, which means that without root I would not be able to use a VPN for any other purpose while simultaneously blocking ads.

---

I have no experience with GrapheneOS, so I'd be interested to hear if these features are possible on it without rooting. If not, can I request these features somewhere?

Happy Year of the Horse!

Isn't what you're describing solved by `uv tool install`?

It's Redacted.sh, a.k.a. RED. They have around three million torrents. But like What.CD, Redacted.sh is a private tracker, so you can't just jump in and see the content.

My additional recommendations:

1. You don't need a separate browser extension for blocking cookie notices, Ublock Origin can do that just fine. You just need to enable the cookie notice filters in the settings (they are disabled by default).

2. AdAway on Android allows network-level blocking without resorting to a VPN (it's based on /etc/hosts). Though it does require root.

I'd be surprised if it did, there's no technical reason to require those. Also, SafetyNet is deprecated in favor of Play Integrity, so you're not likely to see the former in any new apps/services.

> it’s nothing like dreaming.

That's interesting. When I close my eyes and imagine "seeing" things, I would actually describe it as pretty much exactly like the sensation I have when I "see" stuff in dreams. To me, this similarity is especially clear when I wake up in the middle of a dream, then close my eyes while awake — I can continue where I left off, and it "looks" exactly the same as in the dream.

But I agree that it doesn't feel like "sight", as in the physical act of seeing with your eyes.

uv has played well with Docker in my experience, from dev containers to CI/CD to production image builds. Would be interested to hear what is not working for you.

The uv docs even have a whole page dedicated to Docker; you should definitely check that out if you haven't already: https://docs.astral.sh/uv/guides/integration/docker/

> Any good solutions for passing secrets around that don't involve environment variables or regular plain text files?

Honestly, my answer is still systemd-creds. It's easy to use and avoids the problem that plain environment variables have. It's a few years old by now, should be available on popular distros. Although credential support for user-level systemd services was added just a few weeks ago.

A TL;DR example of systemd-creds for anyone reading this:

    # Run the initial setup
    systemd-creds setup

    # This dir should have permissions set to 700 (rwx------).
    credstore_dir=/etc/credstore.encrypted
    # For user-level services:
    # credstore_dir="$HOME/.config/credstore.encrypted"
    
    # Set the secret.
    secret=$(systemd-ask-password -n)
    
    # Encrypt the secret.
    # For user-level services, add `--user --uid uidhere`.
    # A TPM2 chip is used for encryption by default if available.
    echo "$secret" | systemd-creds encrypt \
        --name mypw - "$credstore_dir/mypw.cred"
    chmod 600 "$credstore_dir/mypw.cred"

You can now configure in your unit file, e.g.:

    [Service]
    LoadCredentialEncrypted=mypw:/etc/credstore.encrypted/mypw.cred

The process you start in the service will then be able to read the decrypted credential from the ephemeral file `$CREDENTIALS_DIR/mypw`. The environment variable is set automatically by systemd. You can also use the command `systemd-creds cat mypw` to get the value in a shell script.

At least systemd v250 is required for this. v258 for user-level service support.

Interesting, the readme for that library says that NFSv4 is supported. So that likely means that VLC is doing something wrong on their side, because only NFSv3 works?

Yes, that's what at least the `nfs-server` service on Fedora does by default. And VLC also supports v3 on Android… maybe they use the same implementation as Kodi behind the scenes? It's weird the v4 support is so spotty still, even though it has been around for two decades. Even NFS v4.2 is almost ten years old at this point.

Would be cool if this also had a `retry` sub-command, for running any commands with an exponential backoff retry logic. Similar to these Rust tools:

https://github.com/demoray/retry-cli

https://github.com/rye/eb

NFS v4.2. Easy to set up if you don't need authentication. Very good throughput, at least so long as your network gear isn't the bottleneck. I think it's the best choice if your clients are Linux or similar. The only bummer for me is that mounting NFS shares from Android file managers seems to be difficult or impossible (let alone NFSv4).

I looked into this a while ago and was surprised to find that no file explorer on Android seems to support it[1]. However, I did notice that VLC for Android does support it, though unfortunately only NFSv3. I was at least able to watch some videos from the share with it, but it would be nice to have general access to the share on Android.

[1] Of course, I didn’t test every single app — there’s a bucketload of them on Google Play and elsewhere…

I think they can get away with the "close enough" solutions since Python's type annotations don't have any runtime contracts by default. Might be off-putting to people who are more familiar with statically typed languages (though not always, in my experience).

By default, Mypy warns you if try to reassign a method of any object[1]. It will also warn you when you access non-existent attributes[2]. So if you have a variable typed as `object`, the only attributes you can manipulate without the type checker nagging are `__doc__`, `__dict__`, `__module__`, and `__annotations__`. Since there are very few reasons to ever reassign or manipulate these attributes on an instance, I think the `object` type gets us pretty darn close to an "unknown" type in practice.

There was a proposal[3] for an unknown type in the Python typing repository, but it was rejected on the grounds that `object` is close enough.

[1]: https://mypy.readthedocs.io/en/stable/error_code_list.html#c...

[2]: https://mypy.readthedocs.io/en/stable/error_code_list.html#c...

[3]: https://github.com/python/typing/issues/1835

That's what I use it for. If you type something as `object`, static type checkers can just narrow down the exact typing later.

I disagree with `Optional`. It can cause confusion in function signatures, since an argument typed as "optional" might still be required if there is no default value. Basically I think the name is bad, it should be `Nullable` or something.

I believe Python's own documentation also recommends the shorthand syntax over `Union`. Linters like Pylint and Ruff also warn if you use the imported `Union`/`Optional` types. The latter even auto-fixes it for you by switching to the shorthand syntax.

I think I got softlocked, I dropped from the top of a factory building into an area where I'm just stuck lol.

Vte is GTK-only, while libghostty aims to be cross-platform.

I guess the line might feel fuzzy to some people, since nowadays many tools bundle both linting and formatting. And with modern IDE integrations, you might not even run them explicitly — the editor just does both automatically in one go.