That'd be a really good idea

https://en.wikipedia.org/wiki/Root_name_server

To be honest, setting up a DNS4EU replica would just be a simple unbound

Should be easy enough. But, the problem is the scale. I work at a privacy conscious EU based startup and we used to use quad9 for our infra. Shortly after we started using, we started to hit scalability issues. When the whole eu traffic was hot, our DNS query latency would also go up. To be able to keep up, we had to switch back to CF and Google. Hope there is a really good alternative one day.

Run your own resolver. It's not that hard.

Sure thing, but essentially it would be another thing that we have to make sure that it is protected and performant. At the time of building a startup, that’s still an item we are leaving someone else to manage.

It's simple to setup a resolver, really. Basically just "apt install unbound" and you have a resolver ready.

the only thing you might have to adjust is the access control

https://www.linuxbabe.com/ubuntu/set-up-unbound-dns-resolver...

      access-control: 10.0.0.0/8 allow
      access-control: 127.0.0.1/24 allow
      access-control: 2001:DB8::/64 allow

If denmark was to successfully adopt libreoffice they would probably invest in its upkeep aswell

Preventing another migration is a cost reduction in itself

Not in other countries besides the US. Haven't seen a printout since I started doing taxes.

With DBeaver I was able to use tnsnames.ora to use a few tricks to connect to an oracle db

It required certain host/user/cid combination to pass the whitelist.

The minecraft demo is quite impressive

https://browsercraft.cheerpj.com/

Thanks. Architecturally, beside the unmodified Minecraft and LWJGL jars, this demo uses the original JNI code from LWJGL, compiled from C++ to WebAssembly.

Clever.

Java seems to have come a long way since 2015. Might be worth looking into, if only I could find a page that summarizes every new language feature.

Java Almanac has a list of all features https://javaalmanac.io/features/

And the main page let you compare API versions https://javaalmanac.io/

Works on my smartphone. That's wild.

I love this... but I've grown disappointed by these technically impressive demos, now that older Minecraft running in WASM is no longer novel ever since Eaglercraft came out. As per the readme:

> The latest version of Minecraft. Newer releases of Minecraft use a newer version of Java and OpenGL which we currently do not support. [...] This demo demonstrate these capabilities by running an older version (1.2.5) of Minecraft and LWJGL entirely in the browser.

Sadly, no one seems to be able to get past Minecraft 1.5, which was released in 2013 :(

Edit: Hmm... not sure when this happened, but Eaglercraft supports 1.12 (2017) now. Neat! Might be hard to go further than that, since modern Minecraft uses Java 21 / OpenGL 3.2, and LWJGL itself has evolved significantly in its platform APIs.

As a matter of fact we have internally achieved 1.16.5.

The Java side of things works out-of-the-box, but LWJGL3 JNI code uses some subtle techniques that are yet supported in public builds of CheerpJ.

Now that we have Java 17 support we expect to be able to move even further.

the update is gold, original message: "They are reproduceable" updated message "lol actually not"

Not really, it's just someone with a higher goal of "freedom" (no binary firmware blobs) using it to push their agenda.

I'll happily agree higher degrees of "freedom" are an admirable goal, but this is just rudely shitting on a hard-earned achievement.

I'm not the type to write a blog. I just don't want to invest that much.

What I do though is documenting for myself, everything.

It has helped me greatly in the last few years

Do you have examples of how it helped?

I'm regularly kicking myself for not doing that, so I see the value, but some concrete examples might help my motivation.

If you're regularly kicking yourself, don't you have your own examples to draw from? Only half-joking.

I was asking myself the same question, looking for something noteworthy.

No there's nothing here to find. The way to go is in the linked discourse, god it's ugly, use iperf.

I used nspawn to get a system running in the most ridiculous way.

A debian aarch64 vm on kvm starting a systemd-nspawn for an unpacked raspberry pi 3 iso.

It works way too well judging by how ridiculous it was.

Still saved me a few days instead of setting things up myself.

I actually liked how easy it is to spin up nspawn as a systemd service

  [Unit]
  Description=Raspberry Image Machine
  After=multi-user.target

  [Service]
  Type=simple
  User=root

  ExecStart=/usr/bin/systemd-nspawn -D /mnt/ /sbin/init

  [Install]
  WantedBy=multi-user.target

You might want to look into .nspawn files instead. Then you can also manage your nspawn-containers with the machinectl command.

See man 5 systemd.nspawn

And many command like systemctl and journalctl accept the -M parameter, which allows you to query systemd units inside your nspawn-containers from the host.

edit: The article actually explains all of these things in more detail.

I used to use qemu-user-static to run ARM Linux distros like Buildroot, Yocto, and Raspbian on x88_64. It worked surprisingly well! Outside of some minor bugs here and there, it was perfect for local development, emulating an embedded system I was working on.

Why run the Debian VM? Just use nspawn directly

hmm this is very interesting.

I am wondering though? Is there something like systemd-nspawn that doesn't require root?

If file system level isolation is enough for you, take a loot at schroot (https://linux.die.net/man/1/schroot) which allows root-less chroot. You can use something like debootstrap to get a complete userland into a user controlled directory and use schroot to chroot into it without root level access.

this is crazy , trying this out right now.

But is there a way to also run OCI compatible directly on this as well?

You could use docker export to sluro the container contents (see article for example)

EDIT: it seems that for creating a chroot you still require root.

I don't have root on that system and so I can't create a chroot , there is fakeroot but it doesn't work since it uses qemu on that locked system.

Are there any other alternatives

> it seems that for creating a chroot you still require root.

You actually don't as long as you have user namespaces.

One thing I am working on I use chroot (rather unshare --root=) to minimally sandbox a subprocess. At the beginning of the script I have this little snippet:

    if [ "$(id --user)" -ne 0 ]; then
     exec unshare --map-root-user --mount -- "$0" "$@"
    fi

Though you can probably just do something roughtly as `unshare --map-root-user --root=<PATH>`.

Fakeroot is good for the debootstrap step, and then schroot runs unprivileged.

fakeroot has nothing to do with qemu -- it simply uses LD preload to make commands think they're uid 0

It looks like systemd-nspawn is gaining rootless support, see https://github.com/systemd/systemd/issues/30239

Until then, I'm not sure if there is anything lightweight. If you don't need lightweight, there is Podman.

Do note that the current support is limited to signed disk images, while it was recently (still not in a release) gained the ability to use any directory that resides inside a signed disk image (instead of just the entire disk image).

Podman requires one time root for installation though.

I am on a completely rootless client at one of my servers.

Nope, you can compile/download and run it completely from unprivileged userspace.

all containers require root.

docker and the rootless nonsense is just root daemons and suid.

...would never have believed marketing lies would reach linux tools if anyone told me this before 2018.

Linux user namespaces can be used to create containers without having root access, see ex. https://unix.stackexchange.com/questions/66084/simulate-chro...

There's also https://github.com/termux/proot-distro which may or may not count as containers depending on how you define the word but I think it does count

you can't detach your username from a process, nor the network ns... etc, etc, etc.

yeah you can do some smaller fakechroot and maybe some bind mounts... if you call that a "container" good for you.

> you can't detach your username from a process, nor the network ns... etc, etc, etc.

Sure looks like it works?

  $ unshare -i -n -p -u -T -r -f
  # ls
  # id
  gid=0(root) groups=0(root),65534(nogroup)
  # ip -br a
  lo               DOWN

> yeah you can do some smaller fakechroot and maybe some bind mounts... if you call that a "container" good for you.

Why are you being condescending about what constitutes a container?

you can theoretically run a virtual machine like libriscv5 which doesn't require root. or qemu doesn't require root as well. But qemu is blocked for my usecase. There is flatpak theoretically as well

There is podman but it requires one time root.

qemu is great but it's a VM, not a container.

> All you need to use is a mac.

Might as well require you to pay 1000$ up front to use.