[Discuss] systemd sucks and containers suck and language-specific package repos suck

[kentborg at borg.org (Kent Borg)]

On 9/15/26 5:32 AM, markw at mohawksoft.com wrote:
> A VM is a very powerful tool,

Yes.

So are containers: I knew there was work afoot, but they still sneaked 
name spaces into the Linux kernel when I wasn't looking. When I saw what 
a complete set had been built I was really impressed and also very 
skeptical. Building isolation from all of that intertwined complexity 
seemed a contradiction. How could it possibly be secure? And even if all 
of the kernel code were perfect, there are so many knobs and levers to 
get right in used space that I doubted users could get that right.

Okay, containers should help with all those knobs and levers (I admit I 
don't know how much they actually solve the problem), and the kernel 
part seemed to be very well done.

But as complicated as KVM is, using it to run a full VM is apparently 
much more secure in practice, and it sure makes conceptually that it 
should be.

---

A couple years ago when I bought my Framework 13 laptop and I was 
confronted with the two DRAM slots. The fact that populating both with 
matching parts gives better performance, and throwing away parts in to 
upgrade hurts, I decided to max out my RAM from the start, and it wasn't 
that expensive. Lucky timing, prices have gone up since.

Anyway, not everyone has 64GB, so web browsers don't (yet) require 64GB, 
which means for the moment I get to decide how to use all that RAM. It 
is hard, 64GB is a lot.

I use VMs. I try to directly use the host for as little as possible. I 
am typing this in a Thunderbird window that looks and acts just as if 
Thunderbird were running on the host, but it is in a VM that I use for 
essentially nothing else. My web browser windows are also from their own 
VM. And when I want to visit a hostile URL I have a specific VM for 
that, too, one that I both keep well updated, and that I revert to a 
clean disk snapshot.

When I use Claude Code it is running as its own "claude" user in a VM 
that "claude" isn't even allowed to log into, and the VM also reverts to 
a snapshot. I keep my sources on the host and have a script that reverts 
to the snapshot and passes the right source directory through to the VM 
according to what project I am working on.

If I were to apply to a job listing that was actually a North Korean 
scam, they would manage to infect my VM, and the infection would be 
wiped once I ran my script again. (It could still be in the sources on 
my host it I put them there, but I would be skeptical enough to delete 
them. Or just keep the work completely in the VM.)

Doing this is very unusual. North Korea has undetected persistence in 
private git repositories *all* over the place because no one else does this.

Not everything is smooth. Akamai makes lots of web sites not work 
because they think my security measures are insecure. (Akamai doesn't 
care, I'm not their customer, and the web sites don't care and don't 
know what is going on because they have bought the best precisely so 
they could not have to think about what they are doing.)

I figure I get good isolation. An awful lot of the world runs on the 
multi-tenancy possible through the isolation of VMs, a lot of people who 
really care are watching and fixing bugs in this space. Occasional scary 
bug reports notwithstanding, it seems VMs are good isolation.

-kb