1. Docker (or any Linux container runtime, for that matter) is not intended for, designed for, or effective as a security boundary.
2. Root containers run as root on the host. The "sandboxed" processes have full capabilities, as far as the kernel is concerned with them.
ProxyCommand allows you to use any command to setup a connection. Not necessarily an ssh command, like ProxyJump. It can be any command, as long as it receives on stdin and produces on stdout, it can act like a TCP connection.
ProxyJump is a special case of `ProxyCommand ssh -p <port> <user>@<host>`. Can't replace the `ssh` in there when using ProxyJump.
"It was the Hyundai Corpo that broke the law! They're stealing American jobs! That's why ICE targeted them! No, I have no evidence, only blind belief. Why are you even asking me for evidence?! What about when Hyundai did bad things in the past???!!?1?"
Who says they didn't? There is only one party here who acted in bad faith, and it wasn't Hyundai.
In fact, this party has a — by now well-established — track-record of precisely this bad behaviour. They haven't even tried to hide their actions, only their individual faces. They've been public about their disdain for the law, for humanity, and their general evil plans.
And here you are accusing their victims of crimes you, like them, have no evidence of.
I had some faith in you, that you weren't intentionally being difficult, that you just needed some help in finding a way. But now that I see you trying to put words in my mouth and foolishly arguing irrelevant pedantry, I doubt it.
I get that you probably just want to win an argument, for the sake of winning an argument, and most likely you're not actually interested in getting some software to run on your niche operating system.
But, just for the far fleeting chance that you are actually interested in doing the right thing:
1. I did not claim that the "oras" binary was the only incompatibility. I guessed your quick judgement was based on that binary being vendored for one platform only and showed that it does exist for other platforms. The latter clearly does not imply the former.
2. Ocicl developers claiming it "only works on Linux" is not a promise they make to you. You cannot hold them at gotcha-gunpoint just in case the software happens to run on a non-Linux OS. They are not interested in playing a game of gotchas with you.
They _are_ being clear: they have only tested it to work on Linux. It is you that misreads it, probably because, I'm guessing, you aren't familiar with the language of OSS READMEs
That's looking for the wrong thing. Us Linux users see things like that all the time: proprietary software has a download page that only lists Windows (and sometimes macOS) but never Linux.
But we don't stop there. We don't look for a reason to abandon hope (or worse, complain idly). We look for a way to run that software on Linux. And usually, it is a lot harder than this case.
>> ocicl (...) only works on Linux
> I don't see a reason why the author(s) of ocicle should lie to me.
Is it not obvious? They aren't lying. They're being clear. As they go on to say, in the very same sentence: ", but adapting to other systems and platforms should not be difficult."
If you'd looked for a way to run it on your niche operating system, like me, you'd have found an easy way. And, maybe, you could have even contributed the solution to the project, as it says two sentences after where you stopped reading and decided to idly complain in a thread on an unrelated forum.
> WSL2 is not (installed and) activated by default.
Windows also does not ship with ocicl (by default), but no one's gonna complain about that. If you'd like to install this piece of software on a Windows machine, think of enabling WSL2 as a preparatory step, like how you'd have to install MS Visual Studio / Cygwin to build Windows-only software, or install a DLL to run some Windows-only software.
> I wrote none of my Lisp tools on Linux, and I never received a Linux-related bug report for those.
Congrats. It is absolutely a good thing that you did not have to touch Linux in order to write software that (presumably) runs on Linux. Maybe the other OSes of the world can learn a thing or two about that.
And it is also good that you never received a Linux-related bug report. Presumably, your software runs flawlessly on Linux. Or, more likely, Linux users of your software know how to fix issues that may pop up and move on.
However, your limited experience of the world does not have to accurately portray how the world actually is.
> I wonder where I can find numbers on that.
The most popular implementation of CL is SBCL (ref: State of Common Lisp Survey 2020). SBCL is primarily developed and tested on Linux, and its largest industrial users also run it on Linux servers (same goes for ECL, Allegro, and LispWorks). This I know from being a (passive) participant in the CL community. I'm not sure I can get you numbers on this, but I can get you numbers that show SBCL receives bug reports for Windows far more than it does for Linux, despite Windows being one of the least tested or prioritised platform, so I'm not sure your method of judging a platform's importance is very good.
(I can't believe I'm saying this, but) even Windows runs Linux now.
> How is this related to my comment?
Your comment indicates your access to computing does not include Linux. That would indeed be a niche area of computing, when intersected with the area targeted by this project, where Linux is commonplace.
> ... but still only supports one niche operating system.
1. Linux is not a niche in the target market for this project.
2. The project is written in Common Lisp with hard dependencies on SBCL-provided libraries[1], so there's reason to suspect it should work on other OSes supported by SBCL.
3. Sure, the presence of Makefile and sb-posix imply it requires a POSIX compliant OS, but Linux is not the only one that fits the bill.
4. The included Linux-only binary 'oras' is clearly a vendored artifact, not part of this project, and clearly an OCI client. A simple search shows it is indeed cross-platform[2].
Perhaps you should try what almost every Linux user has had to do when encountering software actually built for only one "niche" operating system that they want to use on their OS: look.
I don't care much for cloud providers adding unnecessary restrictions, so I manage my own sshd_config on VMs. I'd like to rent a flat, not a hotel room, thank you very much.
> Git hosting platform
It appears GitLab, one of my platforms of choice, does support this in self-hosted setups[1]. Even if they didn't, it'd be trivial to extend their sshd_config by myself anyway.
> then certain actions (but not all) will open it in the app without a prompt.
Firefox for Android prevents such attempts by default. That, plus uBlock Origin with its integrated element picker to permanently block elements make reddit bearable.
> For example, one that would be easy enough to defend ...
I'm sorry, but at this point, I think you're being pedantic. I have no interest in that here, and while I could have been exhaustively thorough in my original statement, I just didn't think I needed to and thus chose to be terse. I continue to believe I was clear then, and also believe that in the example you cite here a scientific basis (either for or against) can be clearly tested and observed.
> Thus, you judgment of the friend's discrimination against the drink ...
No. My point is I do not judge my friend on their discrimination against the drink. I judge my friend on their discrimination against the person. The drink is just an object, it's only purpose is in being 'not a person'. Replace it with anything else (say, something edible, or, a greeting) and my point still stands.
> If they did so because of a property of the drink it is fine.
No, that doesn't matter. If they did so because of the time of day, or their mood, or the colour of their shirt that day, would be the same. The difference lies in whether they did so because of the person offering.
You keep saying things like "... who is the intolerant one." in response to my point that the position or capability of intolerance is not limited to only "one" party. "Multiple" vs. "one".
> Harm is also an abstract concept of course, I don't understand where you want to go with that sentence.
Harm is often quite real. Not unlike intolerance. That was my point.
> Yet I still can't actually use these to discriminate in most cases.
Yes, you can. If you can prove a scientific basis, you can. A scientific basis is not a low bar, mind you, but if you can clear it, you absolutely can, as many of us do (from cosmetics to drug trials and prescriptions to even market investments).
> The use of 'differences in performance' in one side and a -ism on the other indicate we aren't comparing apples to apples.
Forgive me, I believed it was obvious that 'racism' in this context stood for 'differences in treatment by race'.
> So it seems the judgment is based off of the material and not the person.
You appear to have misread my point. Perhaps I wasn't clear enough. Let me reproduce the essential parts:
"... because of the bartender being non-muslim ..."
and added clarification:
" ... does not matter if the drink ...; only what my friend thinks of the bartender"
One party being intolerant does not prevent the another party from being intolerant. As I have tried to show repeatedly, multiple parties can be intolerant.
> In Alabama, according to your original comment, the intolerant are the pro choice ones: according to your reasoning, not to mine.
Expectant women in Alabama do not suddenly lose their rights when Alabama declares 'fetus' = 'child'. Alabama instead chooses to override women's rights and place fetal rights above it.
> Of course that you could just accept the obvious, that the concept of intolerance is clearly abstract, and finish the discussion
I could repeat this statement back to you, with the only change being my claim instead of yours, and it would mean just as much as it means when you say this. But that would be discourteous and discouraging of discourse, so I will try yet again, one final time:
The concept of intolerance is not any more "abstract" than "the concept of harm".
Yes, now you get my point. Do you run rootless containers (with the Docker backed) or do you run "root" containers?