>>comparing even to plain Docker – not to even mention Kubernetes
>Why do I need to rebuild without Bluetooth support?
Because you don't need it? Or you don't want it, but cannot deactivate it in bios? Security and Kernel-size
>> services gonna start because it will be different each time
Please read and don't make your own interpretation like with docker -> kubernetes
Just blacklist the kernel modules, then. Or even plain delete them from disk.
Compiling kernels is really a lost art that many people have never done. It’s probably best to avoid too much of that in production until it’s absolutely necessary.
Well yes, being organized is always important, like a customer of mine wanted all Linux server with GUI and installed all of them as "Desktop-Role" aka preempt-kernel.
Gui-Server...bleh..but Customer is King, but i could at least change he's mind about the kernel so Gui-Server-Role it was.
A slimmed-down kernel make the difference from ~100MB (kernel) + 32MB (Modules) to 2MB (Kernel + Modules), faster load, or for smaller devices, and overall less potential attack surface.
The magic of reading....
By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different.
That was not the point of this thread, so back at ya:
> The magic of reading....
>By the time you want to slim down the kernel that much, Linux, OpenBSD, FreeBSD, they're not that different.
Yes, but you don't do that by blacklisting modules right? Because that was your solution ;)
This is about easily disabling support for one thing. The OP says it's easier in FreeBSD because you add a line to a text file and recompile the kernel. We're saying it's also very easy in Linux even without recompiling the kernel by simply blacklisting and/or deleting a module. Alternatively, recompiling the kernel is also quite easy but what's the point? To shave off 5kb from the kernel, or not even that, since the module is external anyway? My time is worth a lot more than those potential few kbs.
By the time you're fine-tuning your kernel to be the absolute minimum for a specific machine, it doesn't really matter if it's FreeBSD or Linux. It will take time and probably quite a bit of trial and error. And then again, if you have ever run `make menuconfig` on a Linux kernel tree you probably know it's pretty easy. In fact, the discoverability is excellent there, since the options are presented to you with explanations. Is that harder than manually editing a conf file, having to know beforehand exactly what lines to add/delete/edit and with what values? If you think it is, you can also edit the conf file for the Linux kernel.
I have nothing against FreeBSD, but this argument is total nonsense.
Hint is was not about about Bluetooth ;)
But maybe everyone else is wrong, just not you.
Otherwise it's just an implementation choice: recompile kernel, or blacklist+delete modules.
Oh yeah, since we care about security so much, let's have a whole fucking C compiler suite on every machine because what if we need to recompile the kernel to mitigate a potential problem that might not even be there!?
If you really care that much, you delete the modules and run depmod. It's fast and you don't need to have a compiler on hand.
But why so aggressive? No one attacks your substitute religion.
Okay, you can set up a whole container so you can recompile your kernel to your heart's delight. Fine. How does it scale? How do you distribute your new shiny kernel to hundreds of machines and keep track which is running which? What if you make a mistake, is it easy to roll back? How easy is it?
Also, need I remind you that a world where you don't have to (but can if you really really want to) compile things to get the results you want is infinitely better than a world where you have to compile things?
Like you distribute a iso or a image, is that really so impossible for you?
>How does it scale?
As much as you want.
>What if you make a mistake, is it easy to roll back?
See you don't even know zfs or be's..or hell version's??...your a evangelist and i don't like them.
>I know, when you run out of any arguments of merit
Seams like you run out of arguments, again you can create your own image of freebsd without compiler, nfs, zfs whatever you want. But your are probably happy having the cruise-ship for the fishing side trip. Have fun with your religion.
By the way, as an example, you can also disable IPv4 and IPv6 in the kernel, I'm not sure how to do it in Linux.