alexellisuk

I find it fascinating that a list of OSS/self-hosted S3 projects is on the front page of Hacker News. Familiar with most of these from working with on-premises customers with OpenFaaS. Minio was one of the first we integrated with in 2017 - back then it didn't support webhooks for notifications on object mutation, so ended up sending them a PR and showing it on the stage at Dockercon Austin.

I don't have a horse in this game, but have had pretty reasonable results using SeaweedFS for GitHub Actions caching. RustFS is on my list to test next, and a team mate is quite keen on Garage.

Just hit this too:

https://news.ycombinator.com/item?id=47542182

The reason I was interested, was adding the new tool to arkade (similar to Brew, but more developer/devops focused - downloads binaries)

The agent found no Arm binaries.. and it seemed like an odd miss for a core tool

https://x.com/alexellisuk/status/2037514629409112346?s=20

Quick comment for the author.

Just added this new tool to arkade, along with the existing jq/yq.

No Arm64 for Darwin.. seriously? (Only x86_64 darwin.. it's a "choice")

No Arm64 for Linux?

For Rust tools it's trivial to add these. Do you think you can do that for the next release?

https://github.com/micahkepe/jsongrep/releases/tag/v0.7.0

This reminds me of netbooting workflows from things like MaaS, Tinkerbell, and Dan's old Plunder tool.

They'd netboot.. not mount the disks, then download an ISO/IMG and write it directly to the primary boot disk.

If netbooting is a heavy lift, why not boot into a custom initramfs you built, with i.e. dd/curl installed, and flash the disk that way, without mounting / at all? Then kexec/chroot into it?

I'd much prefer this as a way to provision Raspberry Pis.

Hi we've made Superterm free for personal use. Feel free to try it out.

There are other free/OSS tools around, we're focusing on: long lived sessions - with notes, attention feedback, and efficient keyboard shortcuts. You don't need to be a tmux expert to use it, but there's a built-in tutor just in case you want to take it a bit further.

The mobile experience is one of the things that most other alternatives haven't touched yet - they're native apps or only run on macOS.

The PWA to me feels close to native, but has that portability.

I think it says something about the current focus and mindset, that this got 12 upvotes, despite you having posted it three times.

We also care about security for CI and production workloads (actuated/slicervm). I would have liked to have seen more people becoming aware of this, and taking action.

The CLAUDE_CODE_OAUTH_TOKEN exfil is interesting. When our code review both runs, it thinks it has a valid LLM token, but it's a dummy API key that's replaced through MITM on egress. (Not a product, just something we've found very valuable internally.. )

https://blog.alexellis.io/ai-code-review-bot/

We built SlicerVM for this in 2022, but not just for sandboxing. It's for servers + API launched VMs (i.e. what we now like to call a 'sandbox'). Feel free to take a look, a lot of our early users are saying things like this.

AFAIK that's not possible at the moment. Apple limits the full GPU acceleration for macOS guests.

Hi, I'm the author of the article (OpenFaaS founder).

Slicer came about as an internal tool (2022) for rapid customer support where we needed real Linux or Kubernetes clusters, not in a few minutes, but as quickly as possible. It shares a lot of code with actuated (ephemeral, self-hosted CI runners).

It's grown and evolved and gained a Mac version which I mention in the post (with a video demo).

We're seeing fragmentation in the world of sandboxes - both in local or SaaS. We've seen that before with FaaS, and openfaas gave a consolidated UX.

We think slicervm can do the same today.

There are many SaaS and OSS tools in the VM and space. Slicer is a premium experience, that's fast and just works with opinionated defaults and a full Kernel, Ubuntu LTS and systemd.

Free trial available, or individual tier with commercial usage allowed.

They used to charge a fair admin fee like 30-70 EUR for most bare-metal hosts.. now it's 99 EUR for the most basic/cheapest option.. up to 350 EUR for something modest like a 16 Core Ryzen.. monthly fees haven't changed much.

https://www.hetzner.com/dedicated-rootserver/matrix-ex/ https://www.hetzner.com/dedicated-rootserver/matrix-ax/

This is great news for folks that use microVMs - "we only use AWS" has been an issue for our stuff (slicer services/sandboxes/actuated self-hosted GitHub runners)

If anyone here can't wait (as it looks like there's very little info on this at the moment..)

I wrote up detailed instructions for Ant Group's KVM-PVM patches. Performance is OK for background servers/tasks, but does take a hit up to 50% on complex builds like Kernels or Go with the K8s client.

DIY/detailed option:

https://blog.alexellis.io/how-to-run-firecracker-without-kvm...

Fully working, pre-built host and guest kernel and rootfs:

https://docs.slicervm.com/tasks/pvm/

I'll definitely be testing this and comparing as soon as it's available. Hopefully it'll be accelerated somewhat compared to the PVM approach. There's still no sign whether those patches will ever end up merged upstream in the Linux Kernel. If you know differently, I'd appreciate a link.

Azure, OCI, DigitalOcean, GCE all support nested virt as an option and do all take a bit of a hit, but it makes for very easy testing / exploration. Bare-metal on Hetzner now has a setup fee of up to 350 EUR.. you can find some stuff with 0 setup fee, but it's usually quite old kit.

Edit: this doesn't look quite as good as the headline.. Options for instances look a bit limited. Someone found some more info here: https://x.com/nanovms/status/2022141660143165598/photo/1

I’m seeing 429s cascading downloading things like setup-buildx on self hosted runners. That seems odd/off.

Anyone else having issues? It is blocking any kind of release

Is this going to need 1x or 2x of those RTX PRO 6000s to allow for a decent KV for an active context length of 64-100k?

It's one thing running the model without any context, but coding agents build it up close to the max and that slows down generation massively in my experience.

Author of the post here. I have to caveat this - I do use cloud-hosted SOTA models extensively, but whilst I am British, I am not Simon Willison and do not live and breathe local models!

I'm curious what results you can get from your own kit, if you can tune the setup better, using the same inputs or even a different model.

Do test and experiment for yourself. Do not take me as an expert on all things local LLM.

I did use one of our products to sandbox Ollama, and Claude - other sandboxes are available, many cloud-hosted, I'm sure they are also excellent choices.

Disclaimer: author of the post here. Many people are considering Firecracker, and other sandboxing for AI agents, background tasks, and other processing. This post is a quick tour of what is possible - hopefully to get you thinking of what you could do with this kind of tech too. Of course, we're interested in users, please feel free to reach out on X to @alexellisuk or @slicervm

This looks handy.. along with the odd gist of "convert mkv to mp4" that I have to use every other week.

Quite telling that these tools need to exist to make ffmpeg actually usable by humans (including very experienced developers).

It sounds like you'd be better off self-hosting Jenkins. The other issue with GHA is they cap all runs at 6 hours.

Despite what people say about "maintaining" Jenkins (whatever that means to them personally) - you can set it up in an IaaC way including the jobs. You can migrate/create jobs en masse via its API (I did this about 10 years ago for a large US company converting from what was then called TFS)

Interesting starter post.. I took this one step further a few years ago to make the init mount various other /proc /sys etc filesystems and boot up with Firecracker - using a container image as a rootfs.. GitHub https://github.com/alexellis/firecracker-init-lab Blog post: https://actuated.com/blog/firecracker-container-lab

Hi, I'm the author of this post. Before anyone reads too much into this - it's a tool for us to use internally with the team, and for various OSS repos I maintain. If you'd like the code let me know and we can make it available - but at its core it's getting webhooks from GitHub and using Slicer's API to launch reviews in isolated microVMs.

It's not the only thing that could be created - far from it, it's of use to us, but it may give you some of your own ideas or maybe you can think of other use-cases for running LLM inferences, builds, code generation, or analysis within a temporary, isolated environment.

Case in point... front page 61 comments.. https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-ret...

This whole discussion needs way more input - this has been posted three times (I was the last and it got flagged as "dupe") - the moderators are not allowing fair discussion here.

As an industry this has a huge impact.

Good to know re: Traefik - I wonder if K3s will continue to ship Traefik v2?

The reason people are posting again is that this hasn't had any discussion. It's going to have a major impact and the reasoning is "we have something shiny now".. even the tone of the post: "if you must use ingress"

This looks like a lot of fun. I've been trying to help folks understand how to make use of Firecracker - what it is, when to use it and how to tie its various low-level parts together. Unlike Docker - microVMs tend to need a lot more hands-on knowledge up front.

I tried out smolBSD - the build and boot speed were impressive - as was the hint at a patch that boot time will be reduced from 100ms to 10ms. That's neat - in my experience adding systemd to a modern Linux Kernel pushes Firecracker up to 1-2s.

This smolBSD idea reminds me of unikernels and also of LinuxKit.

The documentation for smolBSD is a great start and could be so much better - for instance - the SSH example shows no way to configure an authorized SSH key or how to log in. The port-map to the host for the open port is also not mentioned.

I'm sure the author knows how to do these things - but even reading around in the repo, it wasn't clear. So hoping he'll improve on this if he's listening.

If anyone's interested in the Linux equivalent of this - check out my blog post on building a Linux microVM from a container [1] and video talk on Firecracker/Linux with Richard Case that led much of the work on Weave Ignite/Flintlock [2]

[1] https://actuated.com/blog/firecracker-container-lab [2] https://www.youtube.com/watch?v=CYCsa5e2vqg

:-( How did the link hijack your password/2fa? Or did you also enter some stuff on the form?

How did simply opening this email in something like Gmail or a desktop client result in it being able to compromise NPM packages under your control?

I'm just curious - and as a word of warning to others so we can learn. I may be missing some details, I've read most of the comments on the page.

A number of people reached out about the Beelink SER4-7 - which are about double the cost of a bare N100. Nice machines and I may have considered them if they'd been more popular at the time.

Certainly, if the main use-case is fastest speed in a straight line - get something with a Ryzen like the Acemagic I mentioned at the end with Geekbench scores.

Then read the next bit :)

> Now, if something is public facing and making revenue (or risks revenue/reputation by going down), I will absolutely run that on a popular cloud VM, or on Hetzner's bare-metal offering split up into various microVMs. If possible, I'll run it on a CDN - like my blog, a homepage, or a documentation site.

I like that idea. Not dissimilar to the way GitHub now supports a "personal README" - I've seen it populated with generated graphics/charts/links etc.

Author of the post here. The man pages on my Mac are also a hobby/pastime. It's funny the things you can learn from them.

Not to mention - vimtutor that's built in for extended periods of being offline like on a flight.

Nice.. like a kind of "teletext". The first finger didn't work.