Ryan

I keep reading about the “supply chain.” I will just leave this here. https://www.softwaremaxims.com/blog/not-a-supplier

I’m still onboard with rust as being better than C, however…

My understanding is that it is considerably harder to correctly write unsafe rust than it is to correctly write c, because if you accidentally violate any of safe rust’s guaranteed invariants in an unsafe block, things go bananas.

Modern optimizing compilers are magical. I would need to check assembly but I would actually expect the if to be hoisted out of the loop entirely to relieve pressure on the branch predictor.

Because it is a slow moving event that will unfold over the next century.

It cannot be both so incredibly anxiety causing and also lacking in any urgency at the population level simultaneously.

I’ve seen this before and I think it is worth adding some context too.

Let’s start with, yea, it leads to absurd result like the clown show in uvalde where I wouldn’t trust that police force to rescue cats from trees.

But… the other way you can’t have a right to a scarce resource (police protection). Police calls while not exactly random can’t be accurately predicted. It doesn’t make sense for a police force to be liable for failing to protect when they might literally not have the ability to protect. Or, through chance, there are no police officers that can get to the location in time.

Instead, the point is to rely on the police wanting to actually do their job and have a legal doctrine accordingly. But in our culture it seems that perhaps that is not necessarily a warranted assumption anymore.

It does. I use this port

I can’t remember exactly what all the pieces are. However, I believe its a combination of

• cgroups: process isolation which is why you can see docker processes in ps/top/etc but you can’t for vms. I believe this is also what gets you the ability to run cross distro images since the isolation ensures the correct shared objects are loaded
• network namespaces: how they handle generating the isolated network stack per process
• some additional mount magic that I don’t know what its called.

My understanding is that all of the neat properties of docker are actuall part of the kernel, docker (and podman and other container runtimes) are mostly just packing them together to achieve the desired properties of “containers”.

I suspect they meant it runs natively in that it’s an aarch64 binary. It’s still running a VM under the hood because docker is really just a nice frontend to a bunch of Linux kernel features.

Its all fun and games until the email list doesn’t include the people its supposed to and I get a call on a text on Sunday morning because ‘Ahmahgad the etl pipeline hasn’t started!?!?!’