https://github.com/herd-core/herdLately, I have been trying to understand the security aspect of docker containers, and what I have realized is that all docker containers share the host's kernel. Any zero day vulnerability in the kernel can be used to gain access to the host os.In order to deal with this, I did some research turns out Amazon has open sourced the core technology behind their...
Most of my friends, have started using AI to do job applications, where you have to answer 3 questions. 1-2 para each. Even though the probability of you actually getting an interview is less that 0.01%. So is it reasonable to spend 25 minutes per job application. And when all the application answers look the same, wouldn't having an unpolished version stand out?
What this have led to is, even if some blog, article is written by human, if it uses even slightly fancy words, I have a tendency to assume it's human. Are other's experiencing the same?
https://github.com/herd-core/herdLately, I have been trying to understand the security aspect of docker containers, and what I have realized is that all docker containers share the host's kernel. Any zero day vulneerability in the kernel can be used to gain access to the host os.In order to deal with this, I did some research turns out Amazon has open sourced the core technology behind their...
I know this sounds strange, and this could have been a reddit post, but I have realized ever since I went back to not rewriting things for polish using AI. I have had more positive feedback from the community and any personal/professional email.people prefer reading short emails which doesn't have to be confusing.people dont wanna read AI slop. It sounds nice sure, but lately no one cares about...
Sprites are fantastic for persistent, hardware-isolated sandboxes. But to achieve those instant creation speeds, they start from a minimal base Linux environment rather than a standard OCI image.
herd solves the same problem (sub-second Firecracker cold boots) but optimizes for a different workflow:
I wanted to keep the standard Dockerfile developer experience. herd uses a containerd devmapper pipeline to instantly carve out copy-on-write snapshots directly from standard OCI images. You get the microVM isolation and speed, but you bring your existing containers.
Sprites are a managed cloud primitive. herd is built as an embeddable control plane, it's a single Go binary you can deploy directly onto your own servers or inside an air-gapped enterprise VPC.
It's the same core Firecracker magic, just optimized for teams who want to keep their Dockerfiles and own their metal.
Firecracker (and by extension, herd) is currently optimized for blisteringly fast CPU and network isolation—specifically. We do not currently support PCIe GPU passthrough at the moment.
If you need fast serverless GPU deployments, look into platforms like Modal. Once we tackle GPU scheduling in herd, I will make a lot of noise about it, but right now it is not the right tool for your specific job.
Quick question for your setup: Coder workspaces usually require persistent state for the developer. Are you looking to map local NVMe LVM volumes to the microVMs for speed, or are you relying on network-attached storage? herd's devmapper pipeline handles the ephemeral rootfs beautifully right now, but I'd love to hear what your specific persistence requirements are for those workspaces.
If you're open to chatting about how the Terraform provider should be structured to fit your team's workflow, shoot me an email: [email protected]
I’ve been having weird search problems with Antigravity lately.Today, I searched for ListenUnixSocket to see where it was being used. The search only gave me about six results, and they were all just definitions and test files. The code that actually called the function was completely missing. I almost deleted it because I thought it was dead code.I checked my spelling and capitalization, and I...
Hey HN.I'm an engineering student at Waterloo building stateful AI agents, and I kept hitting the same wall: whenever my Python scripts crashed or dropped a connection, the underlying Puppeteer or Ollama processes would just sit there orphaned, eating RAM until the node OOM-killed itself. Standard load balancers break sticky sessions, and passive HTTP timeouts are too slow for cleanup.I...
https://github.com/HackStrix/herd
Hey HN,Herd is a zero-dependency Go library that manages fleets of OS subprocesses and routes HTTP traffic to them with strict 1:1 session affinity.If you put heavy, stateful binaries (like Ollama, headless Chromium, or Python REPLs) behind a standard reverse proxy and get a spike in traffic, it usually ends badly. You either trigger a massive CUDA/Metal context storm that OOM-kills the host...
https://github.com/HackStrix/Portainer-Tailscale-Deployment-Action
I built a GitHub Action that lets you deploy Docker stacks to a Portainer instance sitting behind a private network — without opening any ports to the internet. The action spins up an ephemeral Tailscale node during the CI run using OAuth (so it never needs a long-lived auth key), reaches your Portainer API over the tailnet, deploys or updates your stack, then immediately logs the node out on...