Top all-time · #1990
Stéphane Graber
Personal blog · stgraber.orgsystemsprogramming
Stéphane Graber's personal blog at stgraber.org covers systems and programming. Since 2010, 40 different Hacker News readers have linked it 49 times, most often “Time to Move On – Stéphane Graber”. It is still writing: the last post was on 2026-08-31, and you can follow it by feed.
Stéphane Graber's website -
Most-linked posts?
- Time to Move On – Stéphane Graber5 people · 6 mentions · first linked 2023-07-10
- Canonical re-licenses LXD under AGPLv3, slaps a CLA on top4 people · 4 mentions · first linked 2023-12-12
- /2014/01/17/lxc-1-0-unprivileged-containers/3 people · 3 mentions · first linked 2014-02-23
- Getting started with LXD – the container lightervisor2 people · 2 mentions · first linked 2015-04-21
- LXD 2.0: Blog post series [0/12]2 people · 2 mentions · first linked 2017-02-17
- LXC in Ubuntu 12.04 LTS2 people · 2 mentions · first linked 2012-05-23
- /2014/02/09/lxc-1-0-gui-in-containers/2 people · 2 mentions · first linked 2015-02-17
- Stable Linux mainline builds for Ubuntu2 people · 2 mentions · first linked 2023-08-24
- /2014/01/01/lxc-1-0-security-features/2 people · 2 mentions · first linked 2014-02-22
- Run your own LXD demo server2 people · 2 mentions · first linked 2017-03-06
What Hacker News says?
I think that essentially, the LXD project focuses on making VM-like containers (with a full OS that you SSH into, etc), whereas Docker and friends focus on immutable application containers - essentially, a zone for running a single application, and which you delete and start from scratch rather than entering and changing stuff. In fact, the LXD people have a guide on how to run Docker containers inside LXD :) https:…
Comment linking /2016/04/13/lxd-2-0-docker-in-lxd-712/
on “Docker Is Raising Funding at $1.3B Valuation”Submitted LXD 2.0: Introduction to LXD as a story · 226 points
HN discussion> my understanding is that if you sign a CLA, you typically give a right to relicence to the beneficiary of the CLA. Just to clarify, this depends upon the exact CLA you sign. Canonical's CLA (CCLA) [1] for example, contains this clause in Section 2.3 Outbound license: > We may license the Contribution under any licence, including copyleft, permissive, commercial, or proprietary licences. As a condition on the exerc…
Comment linking /2023/12/12/lxd-now-re-licensed-and-under-a-cla/
on “Rug pulls, forks, and open-source feudalism”Submitted LXC in Ubuntu 12.04 LTS as a story · 89 points
HN discussionThis is actually quite similar to using LXC containers to run GUI apps. Something like Wine would be a good candidate to run in a container, perhaps others too. And you can use both privileged and unprivileged containers for this. I have a guide on running accelerated GUI apps in both privileged and unprivileged containers: http://www.flockport.com/run-gui-apps-in-lxc-containers and here's one more by Stephane Grabe…
Comment linking /2014/02/09/lxc-1-0-gui-in-containers/
on “First fully sandboxed Linux desktop app”Submitted Getting started with LXD – the container lightervisor as a story · 48 points
HN discussionYou can also use just LXC to do the same: https://www.stgraber.org/2014/02/09/lxc-1-0-gui-in-container...
Comment linking /2014/02/09/lxc-1-0-gui-in-containers/
on “Docker containers on the desktop”Submitted LXC 1.0 blog-post-series (2013) as a story · 17 points
HN discussionYou can create either privileged or unprivileged LXC containers. Creating Unprivileged containers only requires a very simple configuration that takes 60 seconds to do. Here's Stephane Graber's blog on it: https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-con... Also, note that with LXD/LXC the "default" container is now unprivileged. Also with LXD/LXC the LXC command syntax is now simplified even more than i…
Comment linking /2014/01/17/lxc-1-0-unprivileged-containers/
on “Super small Docker image based on Alpine Linux”Submitted Incus 6.3 (LXD) as a story · 6 points
HN discussionIf you use LXD in Ubuntu, you can (and should) have your containers stored in the ZFS filesystem. I have be doing that, and did not notice any problems. About LXD: https://stgraber.org/2016/03/11/lxd-2-0-blog-post-series-012...
Comment linking /2016/03/11/lxd-2-0-blog-post-series-012/
on “Ubuntu 16.04.2 LTS released”Submitted Run your own LXD demo server as a story · 4 points
HN discussion> https://github.com/zabbly/incus/issues/89#issuecomment-30764 ... > I mean sure, it's the UI component only, and not on the lxc repo but the Zabbly one, and maybe they treat things widely differently depending. This one is fair since Incus and Zabbly have had no desire to reimplement a web UI, they've instead opted to leave that to the community resulting in LXConsole for example. Zabbly, for additional context, is…
Comment linking /2023/12/12/lxd-now-re-licensed-and-under-a-cla/
on “Incus-OS: Immutable Linux OS to run Incus as a hypervisor”Submitted LXD client on Windows and MacOS as a story · 4 points
HN discussionAnd upstream doesn't have significant intentions for dendrite right now... Relevant btw re: licensing: https://stgraber.org/2023/12/12/lxd-now-re-licensed-and-unde...
Comment linking /2023/12/12/lxd-now-re-licensed-and-under-a-cla/
on “Nation-scale Matrix deployments will fail using the community version of Synapse”Submitted The FuturFusion Cloud Stack as a story · 3 points
HN discussionI've also struggled with the distinction, but I believe the commenter above was referring to LXC (and LXD's) "system containers". Full user namespacing has been in from very early on (day 1?) which is the "increased security" -- this is where I believed the difference between "system containers" for LXC and regular "application containers" was. runc was not always the runtime underneath Docker, and IIRC it has not a…
Comment linking /2014/01/01/lxc-1-0-security-features/
on “LXD 3.8 has been released”Submitted Inexpensive highly available cluster with LXD as a story · 3 points
HN discussionThanks, must've missed that! Apparently caching isn't enabled though[1]. [1]: http://www.stgraber.org/2012/02/24/dns-in-ubuntu-12-04/
Comment linking /2012/02/24/dns-in-ubuntu-12-04/
on “Steam's VAC reads all the domains you visited”Submitted Ubuntu Core in LXD containers as a story · 3 points
HN discussion"Working with silicon companies to ensure hardware-assisted security" doesn't mean that much though. A MMU is already hardware-assisted security. https://linuxcontainers.org/lxd/introduction/ says "unprivileged containers" as the leading security feature. Googling for that, there's more info at https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-con...
Comment linking /2014/01/17/lxc-1-0-unprivileged-containers/
on “Ubuntu 15.04 Launches with Support for OpenStack Kilo, New LXD Hypervisor”Submitted LXD 2.0: Docker in LXD as a story · 3 points
HN discussionMy understanding is that recent (13.10+) Ubuntu ships with an AppArmor profile that blocks known ways of escalating out of the container. So, LXC under Ubuntu is in better shape than LXC on other distros, where you can use the uevent_helper trick[1] to easily escape the container. It sounds like your use case could also use the new unprivileged containers[2] feature, which is going to be a dramatic increase in secur…
Comment linking /2014/01/17/lxc-1-0-unprivileged-containers/
on “LXC 1.0 Released”Submitted Incus 6.3 as a story · 2 points
HN discussion- nl · 2014-02-23
Can someone talk about LXC security in practice? I've read[1], and it is excellent to have options, but there I'd like guidance for what is actually usable and useful, especially via Docker. Background: I want to be able to execute arbitrary code submitted from the web. At the moment I'm sandboxing it inside a ZeroVM[2] container, inside a Docker (LXC) container. I'd like to lock down the Docker container more than…
Comment linking /2014/01/01/lxc-1-0-security-features/
on “LXC 1.0 Released” Submitted Stable Linux mainline builds for Ubuntu as a story · 2 points
HN discussionI think he meant LXD, the daemon for managing LXC containers written by Canonical. See https://www.stgraber.org/2015/04/21/lxd-getting-started/ . I guess that the point is that, compared to other solutions, Docker was specifically meant to run with only one service per container instance.
Comment linking /2015/04/21/lxd-getting-started/
on “Convert Servers to Docker Containers”Submitted Time to Move On – Stéphane Graber as a story · 2 points
HN discussionhttps://stgraber.org/2023/07/10/time-to-move-on/
Comment linking /2023/07/10/time-to-move-on/
on “Canonical and IBM Are Turning Ubuntu and Fedora into Microsoft Windows”Submitted Run your own LXD demo server as a story · 2 points
HN discussion
