moonpiedumplings

Discourse is especially neat in that when you start typing a post, it automatically searches the title of your post and shows you recommendations. Here is an example from Incus' forums:

This is probably very, very useful and cuts down a lot on duplicate questions. But Matrix doesn't have anything like that, which probably causes more burdens on people answering questions.

Is incus-compose a part of the base system, or an add-on

it's a program you install on your client machine. It just connects to the Incus API (probably using the Incus cli).

How does it work on IncusOS if it’s a command-line tool and there’s neither a remote nor a local shell, only a web API?

The Incus cli connects to the API.

Does it provide a built-in way to automate container updates

For the most part, Incus containers are system containers, similar to lightweight virtual machines. They run a full distro, including systemd and all that. For keeping those updating, you would want to use the auto update methods that Linux distros provide.

There are also OCI containers that Incus can run, but I don't think there is any form of auto update for those. You might be better off just running docker/podman/kubes in a VM for that.

Incus somewhat recently added support for gpu acceleration for VM's via virtualgl/virgl: https://linuxcontainers.org/incus/news/#gpu-sharing-for-virtual-machines-through-drm-native-context

This does only support OpenGL, but it's way, way better than no hardware accel for many things.

In addition to that, there is potential of windows virtual machines getting support for OpenGL hardware acceleration, as well: https://github.com/virtio-win/kvm-guest-drivers-windows/pull/943 . Unfortunately that looks like it stalled. I have seen other projects, like this or this, but even if people get something working, one big barrier is the drivers have to be signed (by Microsoft) before they can easily be included into Windows.

I use Incus on Debian 13. Debian 13 packages Incus, and that version only does security updates and focuses on stability. To be clear, Debian's model is to not do bugfixes or feature updates, to prevent any update from being breaking in any way. This ensures users can automatically get security updates.

I get it from zabbly's repos: https://github.com/zabbly/incus , in order to get newer versions of Incus, and to get, however. There is a risk of breaking updates but I'll live and fixing the occasional thing on my one server is okay. The Zabbly incus repos also come with the UI, although the UI is just a static site you can put in the right spot. I like that design, because it means that only the API can do anything, which lessens the attack surface.

I also use Incus personally on my laptop on Arch Linux. It's nice to have the same UI/UX for vm management, and being able to download the premade images from their docker like repository is pretty nice as well.

No, you can install Incus on any linux distro. I use it on a Debian server.

It's IncusOS that is immutable.

But proxmox is actually just a set of packages on top of debian, and proxmox is not immutable either. You aren's supposed to tinker with the host, but if you are doing things like jailbreaking consuner gpu's to unlock the server gpu only features, then it becomes nice to have that option.

Except this is because containers, as they arw commonly referred to, are an image of software compiled for linux + linux kernel specific technologies for running them (cgroups, namespaces) etc.

Nothing stops a microkernel from having gitten popular and then having got it's own implemented containers. Linux won because it was first, not because monolithic is better.

What is the most popular unix like microkernel?

Macos is monolithic. Technically it's "hybrid" but from a security architecture perspective hybrid suffers from all the same flaws of monolithic.

Linux containers are a security nightmare. The linux kernel has so much attack surface they add that constantly causes privesc cves, and it's especially annoyimg when they break out of the container to the host. Literally 3 of the recent 0days wouldn t work if you disabled user namespaces, which are needed for rootless containers.

So nowadays, every cloud provider runs "containers" that are actually vm's, in order to receive the same security that a microkernel would provide.

Sovereign OS is pointed out to be source available only in the comments.

GrapheneOS replies to many of the addressed points, and notes that SovereignOS is actually really just a fork that seems to charge for some bs features and preinstalled apps.

Hmmm. If this is a userspace kernel it can probably be used to sandbox apps similar to https://en.wikipedia.org/wiki/GVisor .

The simplest solution is probably nested VM's. Just run Libvirt/Virt-Manager, or even nested proxmox for them to be able to snapshot and restore the instance.

Unofficial tool for PWA management: https://github.com/filips123/PWAsForFirefox

It's not, but it doesn't look like they need hardcore censorship resistance if they are able to host and use headscale. It looks like their main problem is internet outages.

I have been in environmenrs where any usage of wireguard is automatically fingerprinted and blocked.

I'm pro reposts, I hadn't seen two of those articles you have mentioned in the post.

Xkcd 10000