[go: up one dir, main page]

  • 1 Post
  • 70 Comments
Joined 3 years ago
cake
Cake day: June 23rd, 2023

help-circle


  • In a professional setting, sometimes the cost of developing something more performant in C is not worth it. The velocity unlocked by creating systems in Go is just incredible, after your company has built everything in C[++] for decades. I find myself creating gRPC APIs in Go to solve most design challenges, because it’s stupid fast to develop and is fairly maintainable after.














  • You could write a script that just restarts your container, make sure unprivileged users cannot edit it, and do one of two things:

    1. make a sudoers entry for your unprivileged account to call just that script as a user in the docker group with sudo
    2. use setuid on the script to have it execute from the docker group even when executed by users




  • iluminaetoSelfhostedK3s+Wireguard(?)
    link
    fedilink
    English
    arrow-up
    4
    ·
    2 years ago

    K8s has a mild solution to chicken and egg situations for nodes - the nodes support ‘static manifests’ which can be pods they know how to bring up before ever connecting to the API server. So you could have your wireguard peer be brought up this way. Downside is while those static manifests show up in k8s APIs, they aren’t fully manageable since they are defined by files on disk.