• 0 Posts
  • 26 Comments
Joined 9 months ago
cake
Cake day: March 26th, 2025

help-circle
  • PSA for those who haven’t read the docker docs in detail: If you run docker with UFW or any other iptables based firewall, it will often overwrite and break your firewall rules.

    Many people running containers on public hosts get burned by this, because they’re expecting their firewall to block outside traffic from hitting the container.

    Firewalld is a solid alternative that does not suffer from the same failure model; highly recommend.


  • Been a minute since I touched iptables, but IIRC, not quite that simple.

    You’d want to allow outbound connections to destination ports of 80/443/22 and then also allow responses from any established connection (because the server replies won’t likely be going back to your port 80/443/22 as their dest). Unless you’re running dns over https across your whole system, you’ll need to allow that too.

    Nothing against doing things the hard way, but you might like OpenStitch if you’re looking to control traffic in a practical manner.









  • In high school, we used to play a game colloquially called Spoons/Assassins/Spoon Assassin/Marker tag. Long story short, everyone playing gets assigned another player as a target. You tag your target on the back of the neck with a spoon or marker to “kill” them + take over their assignment. Rinse and repeat until only the winner is standing.

    Major catch here is that for the game to work properly, the targets have to be chained in a loop, so there usually has to be a trusted individual running the game who can validate the assignment list.

    So I scraped the online school directory to pull names, emails, and school photos of everyone. Then I built a Java Swing app to track a list of who was playing, and the app would shuffle a random list and email everyone their assignments blindly, photos included. Flash forward a few months, and eventually we had a full roster of ~80 people playing across grades, which was ~10% of the student body.

    Unfortunately, a group of freshmen started their own take on the game, which devolved into mauling one another with Crayola markers and Sharpies. The principal catches word that I’ve been running a ring, and brings me into his office to tell me to shut it down.

    Uncharacteristically for my teenage years, I went all-in on diplomacy. I plead my case, tell him I’m not involved with the freshmen, hear out his concerns, volunteer to modify the game rules, and point out that our group been playing for months without issues. No dice; the dude was a jackass with a chip on his shoulder. So we come to an impasse, staring at one another in silence.

    Eventually, to break the silence, he asks about a stray bandage I have sticking out the top of my shirt. I’d had a small melanoma removed from my collarbone that week, which was caught as early as possible and removed without issue. Seizing the opportunity, I tell the principal “I have cancer”, and immediately walk out before he could formulate a response. Poor dude went white as a sheet. Good times.

    Bit of a lame ending for the app, but building it taught me the skills I used to jump-start my career, and drove home the point that software isn’t an end unto itself — it’s the way people use it to come together that makes things great.





  • Great answer on the whole, but worth noting that both Git’s standard CLI client and most hosted git services do run periodic GC to prune dangling commits.

    I second the suggestion to take periodic snapshots of your mirror. Because the majority of file contents will not be changing over time, you can make these snapshots very disk-space efficient by taking binary diffs of the tar’d repo using rdiff or the like.