Is incus-compose a part of the base system, or an add-on

it’s a program you install on your client machine. It just connects to the Incus API (probably using the Incus cli).

How does it work on IncusOS if it’s a command-line tool and there’s neither a remote nor a local shell, only a web API?

The Incus cli connects to the API.

Does it provide a built-in way to automate container updates

For the most part, Incus containers are system containers, similar to lightweight virtual machines. They run a full distro, including systemd and all that. For keeping those updating, you would want to use the auto update methods that Linux distros provide.

There are also OCI containers that Incus can run, but I don’t think there is any form of auto update for those. You might be better off just running docker/podman/kubes in a VM for that.

Incus somewhat recently added support for gpu acceleration for VM’s via virtualgl/virgl: https://linuxcontainers.org/incus/news/#gpu-sharing-for-virtual-machines-through-drm-native-context

This does only support OpenGL, but it’s way, way better than no hardware accel for many things.

In addition to that, there is potential of windows virtual machines getting support for OpenGL hardware acceleration, as well: https://github.com/virtio-win/kvm-guest-drivers-windows/pull/943 . Unfortunately that looks like it stalled. I have seen other projects, like this or this, but even if people get something working, one big barrier is the drivers have to be signed (by Microsoft) before they can easily be included into Windows.

I use Incus on Debian 13. Debian 13 packages Incus, and that version only does security updates and focuses on stability. To be clear, Debian’s model is to not do bugfixes or feature updates, to prevent any update from being breaking in any way. This ensures users can automatically get security updates.

I get it from zabbly’s repos: https://github.com/zabbly/incus , in order to get newer versions of Incus, and to get, however. There is a risk of breaking updates but I’ll live and fixing the occasional thing on my one server is okay. The Zabbly incus repos also come with the UI, although the UI is just a static site you can put in the right spot. I like that design, because it means that only the API can do anything, which lessens the attack surface.

I also use Incus personally on my laptop on Arch Linux. It’s nice to have the same UI/UX for vm management, and being able to download the premade images from their docker like repository is pretty nice as well.

What is the purpose of a VPN?

To obscure the traffic of your whole machine?

To obscure 99% of the traffic on your machine since it’s from your browser?

To bypass censorship for a website or two?

It’s actually pretty damn good in terms of privacy. It’s Mozilla VPN, which is white labelled and resold Mullvad (but at the same price).

Mullvad is a no logs provider with a good track record.

Unfortunately,: https://korben.info/en/mullvad-cofounder-funding-far-right.html

I typically avoid VPN’s, becuaee in my opinion DNS over TLS/HTTPs + HTTPS are enough for my privacy/security needs, but I will happily use the free VPN every once in a while to get around a firewall or test if a website is universally down. I find it very useful, and am happy that firefox has added. And although I’m not entirely pleased given recent relevations about Mullvad, I’m happy to see that Mozilla is attempting to make money by offering privacy, rather than taking it away.

You can use Firefox ESR, the extended support release which receives security updates but doesn’t receive feature updates or other major changes.

https://endoflife.date/firefox

Damn, I can’t believe 115 is still being maintained for 6 more months.

Librewolf is based on the main release of firefox, and will probably inherit all the UI changes as Mozilla releases them.

https://www.phoronix.com/news/XWayland-Rootfull-Desktop

https://ofourdan.blogspot.com/2023/11/xwayland-rootful-part-2.html?m=1

Edit: no, it doesn’t. Looking at the comments below, it’s public key crypto.

Original comment:

The problem is that if that is your threat model, then the VPS provider, ISP, and literally everything between you and letsencrypt can pull a conpromised key fro letsencrypt.

This actually happened btw, an xmpp server was attacked this way, they compromised not the server itself, but the VPS provider MITMed their traffic: https://www.devever.net/~hl/xmpp-incident

If your threat model involves this, then the only solution is Tor, which eliminates these requirements of trust.

The workaround I use is to connect my phone to my computer via bluetooth, and then linux/kde acts as a speaker/headphones.

So then, phone audio goes through my computer instead. I just play all audio or podcasts on my phone, and that’s how I sync up my playlists, and where I’m at in them.

EDIT no wait, this post is about secure, not hosting/tunneling in general. This comment is off topic ig.

I would like to avoid paying for a VPS

Oracle cloud free tier, but it does have a history of randomly killing the VPS’s created.

Public ipv4 addresses are scarce, and becoming more expensive now. You are probably going to have to shell out some cash if you don’t already get one as part of your internet plan.

What reverse proxy are you using?

Tailscale works great, but their free tier is limited to a total of 8 users, which is enough for a tiny minecraft server, but doesn’t seem to be enough for your usecase.

For 10-15+ users, you probably want to self host a VPN on your own VPS. Like, you can self host headscale, which is tailscale but self hosted. : https://github.com/juanfont/headscale [1]

I wouldn’t port forward game servers, because they often lack authentication (login and stuff), and then they also have security issues due to not receiving updates. If your game server isn’t truly public, then it’s easier to just have people use the tailscale client to connect to your VPN.

[1] Although I would recommend headscale to OP for it’s simplicity, it is very barebones, and software like netbird or netmaker is more close to a truly self hosted tailscale, with things like more advanced accounts, OIDC integration, authorization, and so on. But they are more annoying to host and set up.

No, firefox doesn’t implement the webusb standard which they probably want.

https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API

The problem here is not browser support, but them not shipping a native application or library (which I would want to be open source).

Do nix and then use nix2appimage, or nix bundle to package the app compressed as an arx archive without the startup times they complain about.

You can also use https://github.com/DavHau/nix-portable to bundle it a bit better, without needing nix on the host.

And then, based off a quick search:

https://github.com/neobrain/nix2flatpak

https://github.com/barstoolbluz/nix2deb

I couldn’t find nix2rpm or nix2pacman, but there exist tools to convert between formats (alien, debtap, rpmtap, and one more who’s name I can’t remember but I remeber as being the most versatile).

What I’m trying to say, is that when people said “just use nix”, they probably really mean to use nix as a platform to build other packages withouth doing extra work.

On the other hand,

You can also use one of the newfangled appimage like formats: https://docs.pkgforge.dev/formats/packages

This one is linked in there and creates a static executable from any binary: https://github.com/VHSgunzo/sharun

Now they would still have to build for macos and windows, but they are already doing that anyways.

As a sidenote, there is also this: https://github.com/pacur/pacur , which is an aur like repo that buids debs, rpm’s, and pacman packages. So there’s semi-automatic updates, via a publuc repo you can out stuff on.

The real elite solution, imo, is to host forgejo, or use codeberg, which insanely has a package registry for every possible format of packages. So you can directly just push there, after building however you want.

But if developer’s were good at packaging, I wouldn’t be so mad when they try to do it.

Because this:

The next version will include a new built-in self-updating mechanism

Downloading unsigned, unverified binaries directly from the latest versioned github release?

Makes it so that all that’s needed for getting malware on the system is pwning the developers account via some supply chain malware, that hooks into there browser and pushes a release.

And every additional developer who can release, or every github actions that is potentially vulnerable but can be made to release, or claude (since the author is letting it commit, which requires it to run without sandboxing afaik) becomes more attack surface.

There are ways to fix this. Conventional distros use multi party signing of commits and releases, where developers continously verify eachother and look over changes.

More newfangled flows involve using github actions to build immutable releases, directly from tagged versions of the code.

But random developer #3989 isn’t doing this. They are distributing their software in a way that malware distributors will be ery happy to see after pwning their account.

I want devs to use nix, because then I can build or run their program directly from the source code. It sidesteps so many issues with visibility of the supply chain, or being unable to inspect what I am running.

I like nix becuase I can make developers like the above satisfied by giving them a way to easily build static binaries, or other formats.

Nix is also packaged in debian as nix-bin.

A common distribution method involves multi-party signing, that is, multiple developers use keys to sign off on reviewed changes.

Multiple developers review the changes, before signing the git commit after review. Then they build the package, either locally or on CI servers, but again, multiple parties/servers sign and review, doing a reproducible build to verify across machines.

In an ideal architecture, there is never a single point of failure. You would have to compromise the computers of multiple devs, or multiple build servers that are building signed reproducible builds, in order to do it.

Although in theory, you could compromise all of them. But it’s extremely difficult.

Anyway I was gonna write a rant about it but I’m too tired. But basically the docker ecosystem is kinda fucked in this regard, and trades security in many aspects for convenience of development and distribution. This is one of the most notable examples of this.

It’s popular because it’s convinient and easy to use in many ways. If these pitfalls are a dealbreaker for you, then there is no trivial way to add the security requirements you are asking for.

You can pay for signed images from someone else, which is a little better, but there are still disadvantages.

Also what are you building? You might be able to replace docker with nix for example.

I think the most popular solution is locally building and registry.

Lichess