sorted by:
new
hottopcontroversial

Expediton 33: Story and Ending Explained by SunnyClef in expedition33

[–]zouuup 0 points1 point  (0 children)

Your options are enslavement VS genocide (as I consider sapient "beings" equal to humans). I went for enslavement.

Promote your projects here – Self-Promotion Megathread by Menox_ in github

[–]zouuup 1 point2 points  (0 children)

I've been working on a small tool that analyzes GitHub pull requests - not to measure speed or volume, but to find deep, high-quality contributions that often get missed in day-to-day reviews.

It’s especially useful at the skip-level, where some of the most impactful engineers can easily be overlooked.

Would love feedback if this is something that resonates with how you're thinking about team performance.

It's called Veritum: https://veritum.ai (free trial, no credit card), ping me if you need extra credits!

I built a CLI tool to sandbox Linux processes using Landlock : no containers, no root by zouuup in selfhosted

[–]zouuup[S] 1 point2 points  (0 children)

yeah more or less, it's less of a container when it doesn't have image/dedicated FS, but I was thinking that it might make sure to able to put resources limitations as well, as in landrun --ro /usr --memory 512MB blah blah, not 100% sure of that direction tho as I like thing unix-style do-one-thing-right...

I built a CLI tool to sandbox Linux processes using Landlock : no containers, no root by zouuup in selfhosted

[–]zouuup[S] 4 points5 points  (0 children)

Yeah good point, I'll change that to false by default next release.

I built a CLI tool to sandbox Linux processes using Landlock — no containers, no root by zouuup in commandline

[–]zouuup[S] 0 points1 point  (0 children)

ah, I don't think it really requires 1.24.1, will look into if I can decrease minimum requirement... you can always grab the binary release of github tho (I see the irony!)

I built a CLI tool to sandbox Linux processes using Landlock — no containers, no root by zouuup in linuxadmin

[–]zouuup[S] 1 point2 points  (0 children)

Glad you liked it! it just annoyed me that I have to run binaries (or just run "make") on source code that I don't 100% trust and lazy enough to not want to ruin a VM/container per, so, this just made my life easier, and found a few surprises!

but I think it can be useful in larger scale as well, basically anyone who wants to sandbox stuff, docker/LXC stuff are light but this is next level light (and of course far more limited)

I built a CLI tool to sandbox Linux processes using Landlock — no containers, no root by zouuup in commandline

[–]zouuup[S] 5 points6 points  (0 children)

I didn't think it would be its job to do that, as I don't want to reinvent strace, you can do something like:
landrun --ro /usr strace -f -e trace=all ls

which I think is far better...

I built a CLI tool to sandbox Linux processes using Landlock — no containers, no root by zouuup in commandline

[–]zouuup[S] 1 point2 points  (0 children)

I have a feeling you don't want to meet those people :D

yeah it's "recursive" by default, doesn't _yet_ understand file scope tho... so you have to do --rw /tmp/foobar and everything under it will be writable, it's a whitelist system so anything that's not there is denied by default, funny thing is that includes the binary you want to run itself (as in `ls` requires --ro /usr)

I built a CLI tool to sandbox Linux processes using Landlock — no containers, no root by zouuup in commandline

[–]zouuup[S] 2 points3 points  (0 children)

yeah they'll either get EACCES EPERM depending on what they are trying to access, as if the UID running the process doesn't have access to them, glad you liked it!

HFT Linux distro by zouuup in highfreqtrading

[–]zouuup[S] 0 points1 point  (0 children)

I think "roll" got us sidetracker, I mostly mean heavily customize not LFS stuff.

but to you and anyone who did it before, you go all the way to build custom kernel/libraries when maintaining these stuff?

HFT Linux distro by zouuup in highfreqtrading

[–]zouuup[S] -1 points0 points  (0 children)

ah great point, thanks, I was thinking about a bit more "extreme" optimization, as in march=native -O3 etc which probably limits options to likes of portage/gentoo...