secure

I built something similar! https://michael.stapelberg.ch/posts/2021-03-13-smart-interco...

> I bought the cheapest compatible BTicino intercom device (BT 344232 for 32 €) that I could find on eBay, then soldered in 4 wires and added microcontrollers to make it smart. It now connects to my Nuki Opener Smart Intercom IOT device, and to my local MQTT Pub/Sub bus (why not?).

I recently blogged about how I do this using MicroVMs on NixOS: https://michael.stapelberg.ch/posts/2026-02-01-coding-agent-...

Yeah, when you run ≈10k agents instead of ≈10, you need a different solution :)

I’m curious what gVisor is getting you in your setup — of course gVisor is good for running untrusted code, but would you say that gVisor prevents issues that would otherwise make the agent break out of the kubernetes pod? Like, do you have examples you’ve observed where gVisor has saved the day?

You might want to add a little note to that effect to your link blog :)

I have added year indicators to my blog (such that old articles have a prominent year name in their title) and a subscribe note (people don’t know you can put URLs into a feed reader and it’ll auto-discover the feed URL). Each time, the number of people who email me identical questions goes down :)

Anyway, thanks for blogging!

https://github.com/gokrazy/freeze is a minimal take on this

GNOME’s “proper wayland implementation” also does not work with my monitor, as I explained in the article:

> By the way, when I mentioned that GNOME successfully configures the native resolution, that doesn’t mean the monitor is usable with GNOME! While GNOME supports tiled displays, the updates of individual tiles are not synchronized, so you see heavy tearing in the middle of the screen, much worse than anything I have ever observed under X11. GNOME/mutter merge request !4822 should hopefully address this.

No, the company has not always referred to itself in all capitals.

https://forums.tomshardware.com/threads/nvidias-name-change....

When I got to know their products, they were nVidia.

Probably not specific to Sway, but specific to the nVidia driver.

No, the lesson of “separate display server from window manager” was very clear when Wayland was started. People have been discussing this over the years ever since. (See also “client-side decorations” for another part of this issue that was heavily discussed.)

I’ve been using X11 with high-DPI screens since 2013, but with integer scaling (200% or 300%), never fractional scaling.

Was it vroom by any chance? A slot car racing game in space: https://nixdoc.net/man-pages/irix/man6/vroom.6.html

Video:

https://www.youtube.com/shorts/imguo4oUd-c?app=desktop

Thanks for your reply!

Can I suggest that we ask todsacerdoti to add a filter to their cross-posting thingie that skips articles that the author posted to HN?

I’m asking because todsacerdoti’s posts of my content always seem to be the ones that get traction, no matter if I post first on HN or lobsters. In fact, I’m wondering how he can even submit when I have already submitted — why isn’t his post marked a dupe? (To be clear: this was for my prior submissions, not this particular one.)

> If OP's CPU cooler (Noctua NH-D15 G2) wasn't able to cool down his CPU below 100C, he must have been (intentionally or unintentionally with Asus multi core enhancement) overclocked his CPU. Or he didn't apply thermal paste properly or didn't remove the cooler plastic sticker?

I did not overclock this CPU. I pay attention to what I change in the BIOS/UEFI firmware, and I never select any overclocking options.

Also, I have applied thermal paste properly: Noctua-supplied paste, following Noctua’s instructions for this CPU socket.

I’m using Prometheus for this, with the Prometheus Node Exporter

HN mods, can we please finally ban this cross-posting bot called https://news.ycombinator.com/user?id=todsacerdoti?

This is my post, and my own submission got marked as a “dupe” (https://news.ycombinator.com/item?id=45155986).

On every blog post I post, todsacerdoti steals my post. It’s a bot. Why isn’t it banned?

Yeah, the clicky installer is pretty nice and smooth, but I mention in the article why the clicky installer is not good enough for me to install VMs — you cannot customize/pre-load it, and I want to minimize the manual steps.

SuSE Linux (around since the 90s) had such a single-layer-manages-everything approach, so yes, it’s not a new concept.

I used to think that you don’t need Nix to get most of the benefits that Nix/NixOS are known for. And to a certain extent, that’s true — you can achieve much in other scenarios. But by now, I think the reason why Nix/NixOS work well and deliver these powerful abstractions is because they are Nix all the way down, giving you an unparalleled level of integration/reach for your declarative layer.

Yes, I use this same config snippet throughout my installs and haven’t gotten around to managing my home with Nix yet.

Later, I refactored this config snippet into a Flake that I include: https://github.com/stapelberg/nix/ …but that’s for a follow-up blog post :)

Welcome to Linux!

I agree that through the lens of “how much time do you save?”, automating a NixOS installation is not worth it. As you describe, it’s just a few interactive commands in the upstream installer.

But from the perspective of “how much effort is it to spin up a new VM for this new project / task?”, spending the extra few minutes on building the fully automated installation path is well worth it. Also consider the perspective of “how many steps does it take to recover this VM in a disaster scenario?”, where reducing the manual steps to a minimum is very helpful.

BTW, the maintenance of the installer is virtually free: The configuration I show is the configuration I use in NixOS as well, so that needs to be updated anyway. Aside from that, to rebase my installer from NixOS 24.11 to NixOS 25.05, I just changed a number. When setting up a new machine, I can either download the upstream installer and write it to a USB stick, or I can change a number, rebuild (< 2 minutes) and write to a USB stick. Really not much difference.

> Almost none of the packages the author listed get used, including zsh

Just to clarify: the point of having packages like lshw and zsh available is not for the case of performing the automated installation (where, yes, they are not used), but for the case where I want to interactively poke around in a booted installer to inspect the target system.

Glad to hear that the article describes exactly what you need :)

Try out building an installer and run it in a VM, it only takes a few minutes!

Yes. I also submitted my article myself (https://news.ycombinator.com/item?id=44148997), but the upvotes came in on this duplicate submission.

I don’t know who todsacerdoti is, but looking at their submission history, it looks like this account automatically cross-posts from other sites (maybe lobsters?)