johnkoepi
Re:Server-side sandboxing: Containers and seccomp
on Wednesday October 25, 2023 @04:00AM (#38010387)
"seccomp containers" sounds weird... like what is a container in Linux anyway :D
Re:Server-side sandboxing: Containers and seccomp
on Wednesday October 25, 2023 @03:55AM (#38010363)
I love ideas behind Landlock but I don't fully see the struggle currently without taking into considerations issues with io_uring api. Seccomp nowadays with AppArmor|SElinux is enough even for Nested rootless containers. Nested even into std runc things. Both AppArmor and Seccomp profiles are stackable. If you don't need to generate unique profiles per each container you should be fine...
Re:Server-side sandboxing: Containers and seccomp
on Wednesday October 25, 2023 @03:51AM (#38010339)
way too different things, everyone using seccomp when they don't have AppArmor only profile. sometimes even do both.
Re:Server-side sandboxing: Containers and seccomp
on Wednesday October 25, 2023 @03:38AM (#38010262)
+1
Re:How to debug Linux syscalls with ftrace and eBPF
on Monday August 28, 2023 @01:21PM (#37297468)
An example of debugging mount(2) issues when mounting sysfs filesystem inside of the user namespace to demonstrate practical usage of ftrace (perf) and eBPF (bpftrace) in addition to reading of the Kernel source code for debugging syscalls behavior.
Re:Dockerizing MySQL at Uber Engineering
on Monday November 28, 2016 @11:54AM (#13056641)
> 3) Transferring data from one host to another when you need to bring up a stateful process does not scale. Above a few gigs, the transfer process creates significant load on both the source and destination host, and will easily saturate the link between the two...
It depends. @falcolas, could you point out a few other solutions then that? (for resharding live, other then replication / copy / rsync / ...)