bubblewrap VS Pi-hole

Nothing nix specific but you may be interested in https://github.com/containers/bubblewrap

Recently, I came across Chainguard and wrote the article How to build Docker Images with Melange and Apko. As a fervent supporter of Kubernetes and GitLab CI, I was eager to experiment with building images using Melange in this particular setup. GitLab's shared Runners work seamlessly with Bubblewrap, eliminating the need for additional configurations. This post is intended for enthusiasts like myself, interested in hosting their own Kubernetes Runners and leveraging the Kubernetes Runner Type of Melange.

```

This is basically manually invoking what Flatpak does:

https://github.com/containers/bubblewrap

This is also useful for more than just security. E.G., you can test how your app would behave on a fresh install by masking your user configuration files. I personally also have a tool that uses it to basically bundle all dependencies from an entire Linux distribution in order to make highly portable AppImages— Been meaning to post that, will get around to it eventually maybe.

The flags above should hide your user data (`--tmpfs`), disable network access (`--unshare-all`), hide/virtualize devices and OS state (`--dev` and `--proc`), and make the rest of the root filesystem read-only (`--ro-bind`­— Including the insecure X11 socket in `/tmp`, which you might want to expose for GUI apps).

Check them against `bwrap --help`; I might have omitted one or two more things you'd need.

While trying to find out more comparison information, found this light on details issue:

https://github.com/containers/bubblewrap/issues/81

It mentions nsjail and minijail.

This is an overreaction, almost to the point of absurdity.

Risks inherent to pipe installers are well understood by many. Using your logic, we should abandon Homebrew [1] (>38k stars on GitHub), PiHole [2] (>46k stars on GitHub), Chef [3], RVM [4], and countless other open source projects that use one-step automated installers (by piping to bash).

A more reasonable response would be to coordinate with the developers to update the docs to provide alternative installation methods, rather than throwing the baby out with the bathwater.

[1] https://brew.sh/

[2] https://github.com/pi-hole/pi-hole

[3] https://docs.chef.io/chef_install_script/#run-the-install-sc...

[4] https://rvm.io/rvm/install

Pi-hole to block ads and tracking for my less technically savvy relatives

https://pi-hole.net/

I ran a competing project[0] on my home network for a few years before I discovered NextDNS[1]. What I lost in performance (requests don't leave my house) I gained in portability: ALL my devices can take advantage – at home and away – and time-saved. PiHole works 90% of the time, but when it did stop working, I'd have to spend a bit of time fixing it. At $20/year, I simply couldn't compete with NextDNS.

Note: This isn't a shill for NextDNS; I love these kinds of projects and think they absolutely should exist, but NextDNS just happens to be one of those dead-simple SaaS tools that is an insanely good value.

0 - https://pi-hole.net/

1 - https://nextdns.io

It definitely IS an option, but at the network level.

https://pi-hole.net/

It runs on damn near everything, and is a DNS level adblocker for the whole network.

I recently switched to Wipr [0]. It’s dead simple to use, and will auto update its filter lists in the background.

Adguard [1] is a decent free option.

I also use a Pi-hole [2] on my network.

[0] https://kaylees.site/wipr.html

[1] https://adguard.com/en/adguard-safari/overview.html

[2] https://pi-hole.net/

Are you trying to build a DNS proxy (similar to Pi-hole) that intercepts DNS requests and checks for the ones that look harmful? If so, I would suggest trying to separately build a DNS client and a DNS server, before trying to integrate them together. Start with Beej's Guide to Network Programming if you need to learn the basics of sockets, and then take a look at the documents that define the DNS protocol itself (RFC1034 and RFC1035).

Setup a pi-hole.

It's definitely not as simple as installing an app on your phone, but I run a Pi-hole on my home network, and it does block ads in many games.