Tobias Oetiker oetiker

lxcfs-ns - Resource-Aware Process Isolation

A setuid helper that creates mount namespaces for lxcfs, enabling applications like Chrome and Firefox to see their actual cgroup resource limits instead of the full host resources.

The Problem

On shared multi-user systems (like ThinLinc terminal servers), you typically use systemd resource controls to limit per-user CPU and memory. However, applications read /proc/meminfo and /proc/cpuinfo directly, seeing the full host resources rather than their allocated limits.

This causes problems:

Chrome/Chromium sizes its renderer processes and caches based on "available" memory

How to add a One Time Password 2nd Factor for your Office365 Account using Bitwarden or any other free TOTP App of your choice.

Open https://mysignins.microsoft.com/security-info and login with your usual credentials.

Add sign-in method

zfs send helper

If you want to copy a zfs fileset from location a to b you can use the zfs send and zfs receive mechanism. Theoretically very simple, but if the fileset is hirarchical and there are snapshots and you want to be able To resume the copy process, some help may be needed.

The zfs send helper script looks at the zfs filesets actually present in the locations you indicate and it gives you the commands you need to do the actual copying. The script runs zfs but only to investigate it does not do any actual copying.

Protecting a Proxmox VM from the OOM Killer

VMs tend to occupy a lot of memory, but they are normally also the official denizens of a server. So if memory gets tight we rather have the oom killer kill the new kid on the block (some process which has suddenly started using more ram) instead of the regular VM crowd.

Obviously bad things will happen if the oom killer is not able to free enough memory to make your machine happy again, but with this you at least have some control over who gets killed.

The Hookscript Method

Running the ThinLinc Client on GNU Guix

GNU Guix is a cutting-edge package manager and operating system distribution built on the principles of software freedom. With Guix, you gain unparalleled control over your system, from the ability to customize packages to effortlessly rolling back system updates if something goes wrong.

ThinLinc is a powerful remote desktop solution for Linux systems, providing secure, efficient, and user-friendly access to centralized Linux environments from anywhere.

Unfortunately Cendio, the company behind ThinLinc insists on NOT makeing their client software available under an open source license. So for the time being there are no official GNU Guix packages for the non-free/binary ThinLinc Client.

Here is how you can run still run the ThinLinc client on GNU Guix:

LibreOffice as an external renderer for gitea

NOTE that libreoffice is a huge software package and thus highly vulnerable. I would certainly not recommend this setup for a public gitea instance where arbitrary users can upload documents!

Gitea can use external renderers to transform any file into html and then display this html. This aproach is nice, but it tends to get into trouble when the file you want to display has graphically complex content.

Libreoffice can convert quite a lot of filetypes to html, but the results are not all that convincing when it comes to graphical content.

So we use a different aproach. Use libreoffice to convert the file to pdf and then use pdftocairo to turn the files to svg and combine the svgs into a html file for gitea to display.

Migrating Authy to Bitwarden (Linux Edition)

With Authy EOLing the desktop App, migrating your Data may suddenly have become rather urgent. Here are some instructions, heavily influenced by information found on this gist

First install the authy desktop app and start it

wget https://api.snapcraft.io/api/v1/snaps/download/H8ZpNgIoPyvmkgxOWw5MSzsXK1wRZiHn_18.snap

	#!/bin/sh
	# apt install gdisk syslinux syslinux-efi mtools
	IMG=boot-image.img
	SIZE=300
	KERNEL=vmlinz
	INITRAMFS=initrd.img
	MD="mmd -i ${IMG}@@1M"
	CP="mcopy -i ${IMG}@@1M"
	RN="mren -i ${IMG}@@1M"
	dd if=/dev/zero bs=1M count=$SIZE of=$IMG

	sub MY::postamble {
	my $self = shift;
	my %r = (%{ $self->{PREREQ_PM} \|\| {} }, %{ $self->{BUILD_REQUIRES} \|\| {} }, %{ $self->{TEST_REQUIRES} \|\| {} } );
	my $modules = join " ", grep !/^perl\@/, map { $r{$_} ? $_ .'@'. $r{$_} : $_ } keys %r;
	my $tpd = "$FindBin::RealBin/3rd";
	warn "** call 'make builddeps' to build missing dependencies ...\n";
	return <<"EOF";
	builddeps: $tpd/touch
	mkdir -p $tpd

	my $dom = $res->dom('a[href]')->each(
	sub { shift->attrs('href' => 'http://xxx/x.x'); }
	);
	$res->body($dom->to_xml);