• 1 Post
  • 30 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle
  • Container is just a term for a set of isolation solutions bundled together.

    Like file system isolation (chroot), network isolation, process isolation, device isolation…

    One of them is ofc chroot, yes container use exactly the same chroot functionality.

    So to answer your question, no, you don’t need full isolated container. You can use only chroot.

    You just need to pass all required devices ( and match the driver version running in kernel with your files in container and (avoid) more than one app having full unrestricted access to GPU as that would result in issues (but dont know the details so can’t help you with that)).



  • The only reason ssh client would “hang” without any output is when it’s waiting for external key storage to allow access. It’s designed that way to give user some time to approve access to key storage.

    It sometimes happen that the installed key storage is broken in a way that it fails to show user modal, for any reason (showing on wrong screen, wrong desktop, wrong activity, wrong framebuffer, …)

    One solution (that you already did) is to change the SSH agent env variable to point to different key storage.

    Another would be (if possible) to uninstall the broken key storage if you don’t use it. But it is sometimes needed/used by other apps.

    It’s overall good to notify/open bug on your distro issue tracker to notify that some packages are missconfigured (maybe have missing dependencies) or conflicts with other ones.




  • Totally agreed, but there are pros and cons.

    File - harder to steal but once stolen hacker can bruteforce it as much as it wants. Web service - with proper rate limits (and additional IP whitelist so you can only sync on VPN/local network) - its harder to bruteforce. (But yes, you (sometimes) have also full copy locally in the local client, but …)

    If it was only for me I probably would also go with KeePass as you will not update the same db at the same time, but with with multiple users it’s getting unmanageable.

    I just got triggered as those CVEs are not that bad due to the nature that the app encrypts stuff on the client side so web server is more like shared file storage, while your answer suggested to switch to a solution that doesn’t work for a lot of people (as we already tried that).




  • Just having btrfs is not enough, you need to have automatic snapshots (or do them manually) before doing updates and configured grub to allow you to rollback.

    Personally, I’m to lazy to configure stuff like that, I rather just pick my Vetroy USB from backpack, boot into live image and just fix it (while learning something/new interesting) than spend time preventing something that might never happen to me :)


  • It first downloads all packages from net, then it proceed totally offline starting by verifying downloaded files, signatures, extracting new packages and finally rebuilding initramfs.

    Because arch is replacing the kernel and inittamfs in-place there is a chance that it will not boot if interrupted.

    This issue was long resolved on other distro.

    One way to mitigate it is by having multiple kernels (like LTS or hardened) that you can always pick in grub if the main one fail.










  • Looks like the installer and grub is confused about the hard drive order different in instaler and different while booting, both those drives could also have the same partition/drive ID making it confused, that could happen if you cloned/copied the drive in the past

    I would say as a easy and safe solution

    1. unplug all other drives that you don’t want install linux
    2. Install Linux (best by formatting whole drive) - it should work just fine at this point
    3. After confirming everything works - connect the other drives back
    4. If Linux no longer boots after adding drives then tweak disk boot order in BIOS