*scratch*

For a while now we’ve had composefs support in the container-libs.

For the last couple of weeks, I’ve been working on garbage collection for composefs repositories.

Composefs achieves whole-filesystem integrity verification through image sealing: a single cryptographic digest authenticates an entire filesystem, covering both file contents and metadata (directory structure, permissions, ownership, symlinks, and xattrs…

I started working on GitChronicler mostly to learn how I could integrate AI into my workflow in a way that would actually spare me doing boring stuff, like writing the git commit message.

It happened a few times in the past that users wonder why they see two /sys/fs/cgroup mounts in their unprivileged container.

I have been working on a new functionality for the prctl syscall that addresses a common security concern with container runtimes.

When I started working on crun, I was looking at a faster way to start up and stop containers by improving the OCI runtime, the component in the OCI stack that is responsible for talking to the kernel and setting up the environment where the container run…

A bug report filed against crun a few days ago exposed a deadlock: under certain seccomp profiles, the runtime would hang indefinitely before the container process ever started.

For the last couple of weeks, I’ve been playing on a PoC implementation of a file system for the Linux kernel.

Seccomp is a kernel feature that restricts what syscalls can be used by a process.

One annoying issue with setting a memory limit for a container is that the OOM killer can leave the container in an inconsistent state with only some of its processes terminated.

A couple weekends ago I’ve played with seccomp user notifications and how they can be used in the OCI containers stack.

While working on crun, I got surprised by how much time the kernel spent in the copy_mount_options function.

CRFS is a Google project that aims at running a container without pre-pulling the image first.

The giuseppe/crun github project was moved under https://github.com/containers/crun.

I have finally opened some PRs for conmon and libpod that enable resources management for Podman rootless containers on Fedora 30 when using crun.

cgroups v2 will finally allow unprivileged users to manage a cgroup hierarchy in a safe manner without requiring any additional permission.

The video of the rootless containers talk from Devconf.cz 2019 is finally available on YouTube.

Additional IDs that are allocated to a user through /etc/subuid and /etc/subgid must be considered as permanently allocated and never reused for any other user.

Would be nice to have a way to “fork” the current session and be able to revert all the changes done, without any leftover on the file system.

I was looking for an Emacs mode that could help me to hack on Rust.

This is the recipe I use to build podman from upstream on Centos 7 and use rootless containers.

A couple of weekends ago I’ve played with libslirp and put together slirp-forwarder.

I’ve cleaned up some C files I was using locally for hacking with user namespaces and uploaded them to a new repository on github: https://github.com/giuseppe/become-root.

The fuse-overlayfs project I was working on in the last weeks was moved under the github.com/containers umbrella. fuse-overlayfs is a user-space implementation of the overlay filesystem that can be mounted without root privileges, which is essential for r…

Having Buildah running in a user namespace opens the possibility of building container images as a non-root user.

I made a new COPR repository for crun so that it can be easily tested on Fedora without having to build from source. crun is a lightweight OCI container runtime written in C, intended as a faster and lower-overhead alternative to runC.

I’ve spent some of the last weeks working on a replacement for runC, the most used/known OCI runtime for running containers.

It is still an ongoing work not ready for production, but the upstream version of OpenShift origin has already an experimental support for running OpenShift Origin using system containers.

Here are the slides for the Atomic System Containers talk I gave at Devconf.cz 2017.

I have been using Facebook for the last years to fill every dead time:waiting for the bus, ads on TV, compiling, etc.

bubblewrap is a sandboxing tool that allows unprivileged users to run containers.

Every programmer at some point gets in touch with the Brainfuck programming language and how surprising is that very few instructions are needed to have a Turing complete language, 6 is the case of Brainfuck (plus other 2 for I/O operations).

git rebase is one of my favorite git commands.

The main reason behind system containers was the inability to run Flannel in a Docker container as Flannel is required by Docker itself.

rpm-ostree, used together with OStree, is a powerful tool to generate immutable images for .rpm based systems, so why not use it for generating Docker images as well?

Coming as a surprise, this year we have got 4 students to work full-time during the summer on wget.

This tutorial shows how to create a QCOW2 image that can be directly imported via virt-install to test out Fedora 22 Atomic starting from a custom OStree repo.

These are the steps to setup the current website in a Docker container.