I can break one container without breaking all of them? I can run them in isolated container networks and even isolated cgroups if I want to. Docker hides a lot of the core reasons tools like jails and chroot and eventually LXC were created but containers absolutely can do the things you are using vms for if you are willing to learn how they work
I built my recommendation around the likelihood this person is already using docker and therefore already has containers that would be extremely easy to run without unraid. There would be less lift to use the same config files and volume mounting they are already using.
Operationally though I would never run vms and containers in the same orchestrated system. Look at what they are asking to do. Why would you run sonarr as a container and radarr as a vm. Obviously they are going to end up just doing one or the other
I legitimately don’t understand the trendiness of proxmox given that vms are overkill compared to containers. If you are migrating from unraid you are likely already using the docker version of all your arr services so going and spinning up vms feels like a step backwards.
You can either use the exact same containers and use systemd to run them as raw services or use something like docker compose or dozens of other tools to orchestrate them. I use k8s but can’t recommend it with a straight face after taking down VMs for being overkill (very different kinds of overkill but still)
It’s a failure when despite that the company goes bankrupt and the product stops being made. Consider actually reading the article. It’s the story of terrible business culture inside private equity firms that causes amazing products to keep disappearing. Being an amazing product makes you the target of these scumbags the very first time you stumble as a business. So you can tongue in cheek argue that is what causes you to fail.
I hate this excuse because it’s so incredibly easy to keep records without keeping the account itself active. I work in healthcare and we have to do shit like this all the time with archiving patients records into an offline storage and then destroying their “hot” accounts to comply with two different incompatible laws.
Good thing °R and °RA aren’t pointing guns at each other
Neither are °F and °R nor °K and °C
This is almost artfully done
I’m always unsettled when discussing this topic that people can readily accept and understand that pets are unable to digest the same foods as us when it comes to toxic things like grapes or chocolate. Their livers and kidneys can’t break those compounds like caffeine and tartaric acid down as an efficiently as ours.
Similarly people readily accept the idea that a bird can eat nightshade and a deer can eat poison ivy because their bodies can digest foods ours can’t.
But that somehow doesn’t help them infer the same thing can mean those animals cannot get their nutrients from foods the same ways that we can and vice versa. That human dietary concepts don’t just magically apply to the whole animal kingdom
Unlike omnivores, cats are unable to synthesize arginine, taurine, methionine and cystine, arachidonic acid, niacin, pyridoxine, vitamin A and vitamin D from their own organs and must get it from other sources. Their livers and kidneys simply cannot make this material from other materials. For the most part this list of nutrients is not available in complete form in plants.
Our bodies for example make vitamin D from sunlight via our skin (d7). But can also get it in multiple base forms and synthesize it from animal based foods containing d3 or from compounds containing D2. Cats however only have the ability to use D3 and cannot synthesize D7 or convert D2 to D3 (omnivore liver)
In theory you could make food in a lab that is technically vegan and supplies the above nutrients. Nobody has done this.
This is exactly how ebpf was implemented for the Linux kernel. You can build watchdog processes that can see what’s happening in the kernel and build kernel interrupts but it’s actually all executed in user space and not rewriting the kernel itself. Since it’s a proper api, it also means it’s incredibly hard to fundamentally break the system, unlike when you’re just blowing away kernel code with your own shit like all these security products do.
It’s honestly way more about plant diversity. There are a million different plants in like a ten square mile area that all look exactly like an aloe and are related. The only way to differentiate them is by hyper obscure differences like their root structure and what their sap consists of.
You don’t even need to be in the proper tropics. Walk around San Diego with a plant id app and watch it spit out a different name for the same palm tree over and over because there are actually hundreds of varietals of palm with similar extremely complex identification processes. Some with toxic fruit and some with edible fruit that look the same.
Management: Our consultants don’t know what ebpf or what immutable filesystems are so obviously your wizard magic is not better than crowdstrike. Also IT will be in charge of that one component and clickops it bypassing the entire CICD pipeline and sanity checking system you have. It’s for compliance which is our word for shut up or we fire you.
You usually run into issues if you are trying to use off the shelf tools and git providers. IMO GitHub and GitHub actions sucks hard for monorepo. The fact that all actions have to be stored in a single directory for example almost certainly is unmanageable rats nest waiting to happen at any sufficiently large business with a sufficiently complex product or set of products.
This is why companies like google run their own forms of git with custom wrappers to let you do things like pull a segment of the terabyte sized repo or run partial builds with tooling that basically runs some kind of graph against the changes. Bazel for example had to be invented to help solve that problem at Google and pants similarly for twitter (who also has a monorepo)
If you are willing to invest in using tools like bazel and own building all these complex wrappers then it can be fine. But if you want to off the shelf gitlab or GitHub actions and use your IDEs built in git tooling it’s not going to be for you. That’s the difference between what’s possible or a good idea at a medium shop vs a company with 40k engineers
In my experience at a company that just moved away from monorepo, half the off the shelf vendors and foss tools out there balk at you if you expect monorepo support. We moved away specifically because at our current company size it is more tolerable to have our different products separate and eat the occasional pain of mass pattern adjustments across the repos than to build out a team to manage the custom tooling required for a gig plus sized monorepo
Plus, even google doesn’t have a true monorepo. Chrome and Android are not in the same repo as search for example. Find your seams and manage them appropriately
unique screens have unique canvas fingerprinting.
Exactly what I just said? Don’t use unique screens and you are less identifiable. The most anonymous browser is a freshly wiped two year old Apple device running safari or chrome from a university campus or coffee shop. A million other laptops have the same base canvas fingerprint.
Fewer people use Linux. Fewer people use specialized browsers. Fewer people have external displays. All those things make you easier to fingerprint than a vanilla machine.
Is it possible you misread what I typed?
The least unique setup is not to keep doing more special shit. You underestimate how many people run a vanilla safari or chrome browser on a MacBook with no external displays.
Linux, external monitor, special browser? That all makes you more unique
One could argue the requirements have changed because the security and compliance part of the world finally caught up to modern software delivery concepts. Even the most dinosaur apps at compliant orgs are being dragged kicking and screaming into new CI/CD tools where applying governance and custody chains and permissions and approvals are all self documented automated hooks.
If every single software a company licensed to produce a video game required this, you would be waiting an hour to see the start menu. Don’t let any company do this or they all will.
I was suggesting to do neither and run the container directly. Putting k8s on top of lxc is still completely stupid. Just run k8s bare metal to operate your containers.
Run docker within lxc within proxmox. This gave me an aneurism. You’ve lost the whole point of not actually virtualizing with containers by putting in two layers deep in virtualization. At this point your shit is so convoluted why don’t you just run kubernetes
ADHD and Autism are thought to be linked to the behaviors that herding breeds specifically exhibit. We may have accidentally bred these traits into them as the side effect behaviors of the disorders were the intended outcome for the breeds. A dog hyper focused on a single task, ignoring social queues and social distraction, but that is highly observant and never visually focused on a single thing so they quickly spot predators and dangerous situations for their job. Herding dogs hate eye contact, tend to be less pack social, and suffer from anxiety at alarming rates.
Very very interestingly herding dogs are also recommended companions for humans with autism
I was replying specifically in the context of the original question. Unraid already has their services tooling built out over containers so this person already is probably using containerized versions of the arr services. It would be overkill to go build vms for these services specifically for what you said. They don’t need to be windows or osx, they don’t need hardware passthrough, they don’t need a full kernel.
That aside. You absolutely can run containers as a full isolated kernel and directly map hardware to them. CGroups absolutely allows for those use cases. You may not be using docker anymore but docker is more of a crutch for beginners who probably dont need those things.
One example of this in the real world are COS and Bottlerocket which are literally distributions of Linux where even core is components are individually running under different containers via cgroups. COS runs on every GKE cluster in the world and bottlerocket on most EKS clusters.