It's supposed to scale globally (magically!) but I found multiple cases where particular nodes were problematic and the health checks didn't detect them (in fact to start with the health checks didn't even work properly if you had multiple containers, they did fix that). The support was quite slow too, after finding multiple product issues they'd escalate to developers and then come back a month later and ask to retest, but some of this took multiple round trips. I was only using this on a side project, but definitely wouldn't consider them for anything critical, even if they are quite cheap.

You could potentially combine https://github.com/binpash/try with bubblewrap (I'm not sure how well they compose and as the docs say it isn't a full sandbox).

The good (and bad because it's confusing and can lead to surprises if misconfigured) thing about Linux containers is all the pieces of containers can be used independently. The "try" tool lets you use the overlay part of containers on your host system, just like Bubblewrap lets you combine the namespacing parts of containers with your host system.

Instead you can create multiple Wireguard interfaces and use policy routing / ECMP / BGP / all the layer 3 tricks, that way you can achieve similar things to what vxlan could give you but at layer 3.

There's a performance benefit to doing it this way too, in some testing I found the wireguard interface can be a bottleneck (there's various offload and multiple core support in Linux, but it still has some overhead).

Comments URL: https://news.ycombinator.com/item?id=46594665

Points: 2

# Comments: 0

Because when the protocol is 0 it means a UDP socket Rust has called its API for creating any(?) datagram sockets UdpSocket, partly resulting in this confusion.

The kernel patch introducing the API also explains it was partly based on the UDP code, due to obviously sharing a lot of properties with it. https://lwn.net/Articles/420800/

PCI to PCIe adapter and then PCIe to M.2: https://www.vogons.org/viewtopic.php?t=78987 (PCIe has some level of backwards compatibility, although like that thread shows there are some limits as to what will work).

It is possible to add logos without (well, differently) abusing the error correction: https://research.swtch.com/qart

Of course most images in the middle aren’t doing that and rely on some level of error correction fixing it.

VT340 is definitely interesting and if someone were to emulate one that would also be great! (there's been some good research, e.g.: https://github.com/hackerb9/vt340test, which you might be surprised to learn has been used to make Windows Terminal one of the more conformant terminals...)

Comments URL: https://news.ycombinator.com/item?id=45766132

Points: 6

# Comments: 1

The host kernel patch for skas was never merged, probably for good reason, but that and Xen/VM hardware support meant UML stopped making sense.

> the 1Password browser plugin would have noticed that “members-x.com” wasn’t an “x.com” host.

But shared accounts are tricky here, like the post says it's not part of their IdP / SSO and can't be, so it has to be something different. Yes, they can and should use Passkeys and/or 1password browser integration, but if you only have a few shared accounts, that difference makes for a different workflow regardless.

Comments URL: https://news.ycombinator.com/item?id=45499345

Points: 5

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=45486034

Points: 3

# Comments: 0