Our great sponsors
|26 days ago||3 days ago|
|Apache License 2.0||Apache License 2.0|
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
2 projects | dev.to | 13 Aug 2022
Show HN: Distributed SQLite on FoundationDB
5 projects | news.ycombinator.com | 28 Jul 2022
Hello HN! I'm building mvsqlite, a distributed variant of SQLite with MVCC transactions, that runs on FoundationDB. It is a drop-in replacement that just needs an `LD_PRELOAD` for existing applications using SQLite.
I made this because [Blueboat](https://github.com/losfair/blueboat) needs a native SQL interface to persistent data. Apparently, just providing a transactional key-value store isn’t enough - it is more easy and efficient to build complex business logic on an SQL database, and it seems necessary to bring a self-hostable distributed SQL DB onto the platform. Since FoundationDB is Blueboat’s only stateful external dependency, I decided to build the SQL capabilities on top of it.
At its core, mvsqlite’s storage engine, mvstore, is a multi-version page store built on FoundationDB. It addresses the duration and size limits (5 secs, 10 MB) of FDB transactions, by handling multi-versioning itself. Pages are fully versioned, so they are always snapshot-readable in the future. An SQLite transaction fetches the read version during `BEGIN TRANSACTION`, and this version is used as the per-page range scan upper bound in future page read requests.
For writes, pages are first written to a content-addressed store keyed by the page's hash. At commit, hashes of each written page in the SQLite transaction is written to the page index in a single FDB transaction to preserve atomicity. With 8K pages and ~60B per key-value entry in the page index, each SQLite transaction can be as large as 1.3 GB (compared to FDB's native txn size limit of 10 MB).
mvsqlite is not yet "production-ready", since it hasn’t received enough testing, and I may still have a few changes to make to the on-disk format. But please ask here if you have any questions!
2 projects | news.ycombinator.com | 26 Jul 2022
This sounds quite a bit like Cloudflare Workers, and they have a comparison page - https://github.com/losfair/blueboat/wiki/Comparison-with-Clo....
Are V8 isolates the future of computing?
12 projects | news.ycombinator.com | 15 Jun 2022
Blueboat may be what you’re looking for12 projects | news.ycombinator.com | 15 Jun 2022
> If one writes Go or Rust, there are much better ways to run them than targeting WASM
wasm has its place, especially for contained workloads that can be wrapped in its strict capability boundaries (think, file-encoding jobs that shouldn't access anything else but said files: https://news.ycombinator.com/item?id=29112713).
> Containers are still the defacto standard.
wasmedge , atmo , krustlet , blueboat  and numerous other projects are turning up the heat !
Blueboat, an open-source alternative to Cloudflare Workers
2 projects | news.ycombinator.com | 23 Nov 2021
Deno Deploy Beta 2
9 projects | news.ycombinator.com | 1 Sep 2021
They're not perfectly isolated to a high security standard such that you could deploy your own v8 workers SaaS. And they do have quirks and development woes. I haven't tested in production but if it's just your trusted apps wanting to exceed the cloudflare workers 30 scripts limit then both are wonderfully powerful solutions to put behind a https proxy.
Firecracker internals: deep dive inside the technology powering AWS Lambda(2021)
9 projects | news.ycombinator.com | 27 Feb 2023
An analogous project from Google with similar use cases is gvisor, which IIRC underlies Cloud Run: https://gvisor.dev/
Why did the Krustlet project die?
6 projects | reddit.com/r/kubernetes | 14 Jan 2023
Yeah, runtimeClass lets you specify which CRI plugin you want based on what you have available. Here's an example from the containerd documentation - you could have one node that can run containers under standard runc, gvisor, kata containers, or WASM. Without runtimeClass, you'd need either some form of custom solution or four differently configured nodes to run those different runtimes. That's how krustlet did it - you'd have kubelet/containerd nodes and krustlet/wasm nodes, and could only run the appropriate workload on each node type.
Do I need kata containers?
2 projects | reddit.com/r/kubernetes | 11 Jan 2023
It all depends on your use-case and expectations. You should definitely check out gvisor. It creates a userpace isolated kernels for every container, thus making it sandboxed. The workloads then still run inside a container, not a stripped down OCI compatible VM as in kata.
I'm releasing cargo-sandbox
9 projects | reddit.com/r/rust | 2 Jan 2023
The Linux kernel has a huge attack surface, and privilege escalation vulnerabilities abound. This is why https://gvisor.dev/ exists - it's a memory-safe proxy for Linux syscalls. This is also why Chrome OS runs its Linux environment in a custom hypervisor written in Rust instead of containers.
Userspace isn't slow, some kernel interfaces are
4 projects | news.ycombinator.com | 13 Dec 2022
I can chime in with some optimizations (linux).
For normal UDP sockets UDP_GRO and UDP_SEGMENT can be faster than sendmmsg/recvmmsg.
In Gvisor they decided that read/write from tun is slow so they did PACKET_MMAP on raw socket instead. AFAIU they just ignore tap device and run a raw socket on it. Dumping packet from raw socket has faster interface than the device itself.
Why golang considered the most popular language among DevOps
5 projects | reddit.com/r/golang | 8 Nov 2022
You mean "all I could find was Kubernetes, Docker, TerraForm infrastructure as code language, Istio service mesh, gVisor security layer, Prometheus metrics service, Argo CD..." Oh, and almost every tool on https://landscape.cncf.io/
The Docker+WASM Technical Preview
9 projects | news.ycombinator.com | 24 Oct 2022
> gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel.
Implement DevSecOps to Secure your CI/CD pipeline
54 projects | dev.to | 27 Sep 2022
Have Gvisor and Kata containers for kernel isolation.
Linus Torvalds: Rust will go into Linux 6.1
12 projects | reddit.com/r/programming | 26 Sep 2022
Google Cloud Reference
24 projects | dev.to | 30 Aug 2022
gVisor: Secure container runtime 🔗Link
What are some alternatives?
firecracker - Secure and fast microVMs for serverless computing.
podman - Podman: A tool for managing OCI containers and pods.
wsl-vpnkit - Provides network connectivity to WSL 2 when blocked by VPN
kata-containers - Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/
containerd - An open and reliable container runtime
sysbox - An open-source, next-generation "runc" that empowers rootless containers to run workloads such as Systemd, Docker, Kubernetes, just like VMs.
KubeArmor - Cloud-native Runtime Security Enforcement System. [CNCF Sandbox Project]
podman-desktop - launch and setup vms for podman
WSL - Issues found on WSL
unikernels - State of the art for unikernels
UTM - Virtual machines for iOS and macOS
for-mac - Bug reports for Docker Desktop for Mac