djs55 (u/djs55) - Readit News

djs55 commented on A decade of Docker containers cacm.acm.org/research/a-d... · Posted by u/zacwest

tzs · 5 days ago

I've not done serious networking stuff for over two decades, and never in as complex an environment as that in the article, so the networking part of the article went pretty much over my head.

What I want to do when running a Docker container on Mac is to be able to have the container have an IP address separate from the Mac's IP address that applications on the Mac see. No port mapping: if the container has a web server on port 80 I want to access it at container_ip:80, not 127.0.0.1:2000 or something that gets mapped to container port 80.

On Linux I'd just used Docker bridged networking and I believe that would work, but on Mac that just bridges to the Linux VM running under the hypervisor rather than to the Mac.

Is there some officially recommended and supported way to do this?

For a while I did it by running WireGuard on the Linux VM to tunnel between that and the Mac, with forwarding enabled on the Linux VM [1]. That worked great for quite a while, but then stopped and I could not figure out why. Then it worked again. Then it stopped.

I then switched to this [2] which also uses WireGuard but in a much more automated fashion. It worked for quite a while, but also then had some problems with Docker updates sometimes breaking it.

It would be great if Docker on Mac came with something like this built in.

[1] https://news.ycombinator.com/item?id=33665178

[2] https://github.com/chipmk/docker-mac-net-connect

djs55 · 5 days ago

(co-author of the article and Docker engineer here) I think WireGuard is a good foundation to build this kind of feature. Perhaps try the Tailscale extension for Docker Desktop which should take care of all the setup for you, see https://hub.docker.com/extensions/tailscale/docker-extension

BTW are you trying to avoid port mapping because ports are dynamic and not known in advance? If so you could try running the container with --net=host and in Docker Desktop Settings navigate to Resources / Network and Enable Host Networking. This will automatically set up tunnels when applications listen on a port in the container.

Thanks for the links, I'll dig into those!

djs55 commented on I'm Peter Roberts, immigration attorney who does work for YC and startups. AMA · Posted by u/proberts

cgh · 2 years ago

I worked for a large Silicon Valley company as a foreign national (Canadian) and I flew down at least once a quarter. When I said I was going for “unpaid business”, I was questioned enough that it led me to ask my employer to get me the proper visa so I could legally work because it felt like I could get denied entry on the whim of the immigration agent. It felt uncertain and was kind of stressful.

My advice is, don’t risk it. Get the visa to allow you to work for at least the time you are there. I ended up getting a full TN visa but I believe there are short-term work visas for this circumstance as well.

djs55 · 2 years ago

I believe even with the visa it’s still up to the immigration agent. I came close to trouble once when asked for my H1B visa petition document (not the visa in the passport). I had a photocopy and was told that wasn’t enough and although they’d let me in this time they expected to see the original in future. I also travelled with a letter from my employer explaining where I worked, job title etc as extra documentation just in case to derisk further.

djs55 commented on Why workers are calling BS on leaders about returning to the office fastcompany.com/90639348/... · Posted by u/aseerdbnarng

ItsMonkk · 5 years ago

College was by far the best time in my life because of the environment of campus, even with the pitiful dorm room sizing and sub-average dining options. If I could move to a campus - perhaps that was focused on people in their thirties - where people from many companies would go to work remotely and live, that would be an absolute game-changer for me.

djs55 · 5 years ago

I feel exactly the same way. College had just the right amount of private space, lots of shared spaces for social occasions / group working and a maintenance department to look after all the tedious domestic repairs. Bliss

djs55 commented on QEMU 6.0 qemu.org/2021/04/30/qemu-... · Posted by u/ingve

simojk · 5 years ago

Does QEMU support TSO when used with Apple Silicon?

djs55 · 5 years ago

Do you mean TSG? From https://wiki.qemu.org/ChangeLog/6.0#TCG

> TCG > Added support for Apple Silicon hosts (macOS)

djs55 commented on M1 dev setup with a virtual Linux box · Posted by u/cachehit

tmiller02 · 5 years ago

Vagrant works great on Macs with M1, the issue is finding a compatible 'provider' (VirtualBox, VMWare etc).

For my personal projects I've been able to switch from using VirtualBox to Docker as a Vagrant provider, and it works well enough for what I need it to do.

I created a cookiecutter template for Django projects at https://github.com/tmiller02/cookiecutter-django-react-ansib... that I use for development on my M1 mac using Vagrant + Docker.

djs55 · 5 years ago

(I work for Docker on the M1 support) I'm glad it's working for you! There's a bug in the recent Docker Desktop on Apple Silicon RC build which affects some users of vagrant at the provisioning stage when the new ssh key is copied into the machine. It turned out that the permissions of `/dev/null` inside `--privileged` containers were `0660` (`rw-rw----`) instead of `0666` (`rw-rw-rw-`) In case you (or someone else) runs across this there's an open issue with a link to a build with the fix: https://github.com/docker/for-mac/issues/5527#issuecomment-8...

djs55 commented on Making hibernation work under Linux Lockdown mjg59.dreamwidth.org/5584... · Posted by u/edward

watermelon0 · 5 years ago

You should check `powercfg lastwake` via PowerShell, and Event Viewer, to determine what wakes up your PC.

I had similar issues, and IIRC, I had to disable wakeups for network adapters in Device Manager.

djs55 · 5 years ago

Thank you for this -- I've been bothered by my Windows PC not sleeping properly for the best part of a year. `powercfg lastwake` indicated the Ethernet adapter and then disabling the option "Wake on Pattern Match" has allowed the computer to sleep soundly.

djs55 commented on M1 Macs Review sixcolors.com/post/2020/1... · Posted by u/alwillis

hart_russell · 5 years ago

I received an M1 mini 2 days ago. I noticed the Steam client seems to be a bit laggy in UI responsiveness, but besides that I have no complaints. I got it for use as a server, so I was a bit dismayed to hear that M1 Docker support has hit a roadblock, but hopeful that they figure it out soon.

djs55 · 5 years ago

Don't worry, we (at Docker) have been working on Apple Silicon support for a while. The command-line tools work under Rosetta 2 but the local VM inside Desktop will take a little bit longer to port. Just in case you haven't seen it there's some further info on Docker+M1 in the blog post: https://www.docker.com/blog/apple-silicon-m1-chips-and-docke...

djs55 commented on Moderna Covid vaccine candidate almost 95% effective, trials show theguardian.com/world/202... · Posted by u/m1

StavrosK · 5 years ago

This touches on a question I had. Out of the tens of thousands of people vaccinated in countries where COVID runs rampant, how were there only 90ish people in the control group? I would have expected thousands.

djs55 · 5 years ago

Thousands (30) of people are in the trial, half were assigned randomly to the control group. So far 95 people in the trial have caught COVID and, when they unblinded the data, they discovered that 90 of those infections where in the control group. Since participants were randomly assigned into the test group vs the control group and so both groups should have the same amount of exposure, this is a strong signal that the vaccine was effective. Here's an article about Moderna's trial with a link to their 135 page (!) design doc https://www.livescience.com/moderna-vaccine-trial-protocol.h...

djs55 commented on Leaving OCaml blog.darklang.com/leaving... · Posted by u/rbanffy

kasajian · 5 years ago

Coincidentally, I chose to look into using OCaml for a project last week. I was pumped and then I was disappointed at the lack of interest in supporting Windows. That just tells me they're not a serious player.

djs55 · 5 years ago

I do OCaml programming on Windows and I found that it was a bit confusing at first with too many different ports and install options. However once I settled on https://github.com/fdopen/opam-repository-mingw I was fine. To my surprise I was able to extend existing C bindings to use Win32 APIs fairly painlessly (for example https://github.com/mirage/mirage-block-unix/commit/7cf658f8a... ) . I did have problems with I/O scalability at first but I fixed these by using libuv via https://github.com/fdopen/uwt . The core compiler and runtime are rock solid on Windows. Docker (where I work) ships OCaml/Windows binaries to lots and lots of desktops with no problem.

Apart from the too-many-ports problem, I think the main remaining problem is that too many 3rd party libraries require Unix-isms to build, like shell scripts. This necessitates the presence of cygwin for build (but not at runtime). However the ongoing "dune-ification" of the OCaml universe should help fix this since dune can do everything directly from OCaml code. I'm really looking forward to being able to open a powershell window and type "git clone"; "dune build" and have everything just work.

djs55 commented on Try OCaml try.ocamlpro.com/... · Posted by u/dna_polymerase

kxyvr · 8 years ago

Mostly, I'd like to ensure that I don't like the dll, so that I don't have to attempt to distribute it. More selfishly, I'd like to have a straightforward installation process where I pull down only a binary or two and can have a working environment and the ability to integrate additional packages.

I didn't know about dune. Looks neat. Is this meant to be used in conjunction with opam?

djs55 · 8 years ago

Yes -- opam and dune are complimentary. I normally use dune (formerly known as "jbuilder") as the build system within my packages, which I then publish and install via opam. Dune does the fast incremental builds, while opam deals with version constraint solving, downloading and general package metadata.

There are some interesting experiments combining the two more closely -- take a look at "duniverse" https://github.com/avsm/duniverse which is a prototype system which would use opam to solve package version constraints and download the sources, allowing dune to build everything at once. The nice thing about this is that you could patch one of your dependencies and then dune will be able to perform an incremental build, as if all the code was in one big project. I'm personally hoping this will help speed up Mirage development as it can be time-consuming to propose a change to an interface and then find all the places that need changing (a cost of having lots of small repos versus a big monorepo)