Having seen this happening in the past, pre-AI, the answer is usually that they don't. They just stay on that version forever. Or it's maintained until the original author moves on, after which it's someone else's problem to figure out how to move back to the upstream, which has now had years of changes.
This is how I'm doing it as well, for an internal enterprise platform for agentic workflows. Let's me implement as fine-grained access rules as I want, and gives me somewhere that can hold credentials without exposing them to the agent.
Yes! Few things piss me off more. It boggles the mind that this behavior is the norm, and it happens all the time! There are practically 0 situations in which I want something to automatically steal focus.
To my knowledge, there isn't a single definition of a union. In America, it seems to mean something wildly different than what I'm used to in my part of Europe.
To me, it is simply an organization by workers to collectively bargain with capital (who have their own equivalent to unions). The unions also typically offer unemployment insurance as well as income replacement in case of strikes, which are a possible measure that can be organized by the unions to force capital to come to the negotiation table. An employer has no right to know if you're in a union or not, so it would be quite impractical to try to hire only non-union members, and most companies don't mind either way, because the collective bargain agreements go both ways and can make it simpler than negotiating individual agreements with each employee.
In the US, it seems like unions are what I would call a guild - very highly coupled to a particular profession. Where I'm from they typically accept anyone who works in a general sector (say medical, government, transportation, etc.), as typically most workers in the same sector would have similar challenges and goals.
I did the same, except I'm paying for Mullvad through the Tailscale partnership, so I reached out to them and expressed my desire for them to partner with other privacy focused VPN providers like Njalla, Airvpn and others. I don't feel great about my money funding ethno-fascists in my country.
Firecracker launches small, but otherwise general purpose virtual machines. Containers, at least the standard implementations that most of us use, use kernel features like namespaces to isolate workloads, but still share a kernel so the sandboxing is not as strong.
Wasm is a virtual machine, just like for example the jvm is, that is designed around only allowing the executed program access to the host runtime via specific apis that are subject to security policies. It does not run arbitrary software, but rather only software built to target specifically wasm.
The software this post is about is just bundling a wasm runtime with other software for convenience.
Anyone have ideas about what to do when using cgroup weights rather than max?
I'm currently in the process of removing cpu.max from our clusters, to allow applications to better utilize the available cpu time which currently is just being wasted. We will use cpu weights to make sure that cpu time is fairly allocated during contention, and to not oversubscribe the hosts, but I'm sure that among the thousands of applications that are running on those clusters today, many will be relying on cpu.max to size threadpools etc.
On the one hand, we do want applications to use the available cpu time, but at the same time they need to not kill themselves by running out of memory.
Network policies controlling egress would be one thing. I haven't seen how you make secrets available to the agent, but I would imagine you would need to proxy calls through a mitm proxy to replace tokens with real secrets, or some other way to make sure the agent cannot access the secrets themselves. Specifically for an agent that works with code, I could imagine being able to run docker-in-docker will probably be requested at some point, which means you'll need gvisor or something.
reply