Alt account of @Badabinski

Just a sweaty nerd interested in software, home automation, emotional issues, and polite discourse about all of the above.

  • 0 Posts
  • 93 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2024

help-circle

  • Each VM can be sized appropriately for the demands of the container. With docker desktop, you can’t have a container use all of your system cores without making the VM have access to all of your cores all the time always. One of the biggest benefits (imo) of running containers on a Linux workstation is that if you don’t define a CPI limit, a container can use all the compute/memory on your system. You just can’t do that with Docker desktop. This also affects multi threaded container builds when you’re using buildkit.

    Being able to spin up a vm to build a container with all cores accessible to it, and then run the actual container with a smaller number of cores would make container builds so much faster.

    EDIT: I’ve looked, and it appears that podman desktop also does 1 big VM, rather than having 1 VM per container.








  • For anyone else who doesn’t know what this is:


    This is my build of Proton with the most recent bleeding-edge Proton Experimental WINE.

    Things it contains that Valve’s Proton does not:

    • Additional media foundation patches for better video playback support
    • AMD FSR patches added directly to fullscreen hack that can be toggled with WINE_FULLSCREEN_FSR=1
    • FSR Fake resolution patch details here
    • Nvidia CUDA support for PhysX and NVAPI
    • Raw input mouse support
    • ‘protonfixes’ system – this is an automated system that applies per-game fixes (such as winetricks, envvars, EAC workarounds, overrides, etc).
    • Various upstream WINE patches backported
    • Various wine-staging patches applied as they become needed










  • Wireguard was written with the explicit goal of having sane, secure defaults. I totally feel you w.r.t. openvpn or ipsec, since it’s easy to do something wrong. Wireguard is much easier because it simply refuses to give you the choice to do things incorrectly.

    w.r.t. the certificate thing, you could set up a reverse proxy and do HSTS to ensure nobody can load up a rogue CA on your devices. HSTS has the issue that SSH has (trust on first use or whatever it’s called), but you just need to make sure nobody is MITM you for that first connecting and then you’ll be good to go. This would let you use a self-signed certificate if you do desired.