Cyphar's Blog

Four Years On, Umoci Celebrates A Long-Awaited Release

Aleksa Sarai — Sun, 25 May 2025 21:05:00 +0000

At long-last a new blog post, and a new release of umoci! It's been a good four years since the last umoci release and six years since my last blog post, so let's make it a quick one.

The Road to OCIv2 Images: What's Wrong with Tar?

Aleksa Sarai — Mon, 21 Jan 2019 13:00:00 +0000

The need for a better container image format has been fairly self-apparent for a long time, but there hasn't been a solid effort to redesign how container images should operate. Most container image formats are based on tar, which at first glance may seem like a reasonable choice. In this first part of a series of articles that outline the design of "OCIv2 images", I hope to dissuade you of this notion.

Generating Coverage Profiles for Golang Integration Tests

Aleksa Sarai — Wed, 12 Apr 2017 15:30:00 +0000

While Go's system for unit tests is very seamless and full-featured, allowing for coverage reports to be generated as well as various other cool features, the integration testing story is far less full-featured. In particular, most projects don't use go test for integration tests and thus don't have a full picture of how their entire test suite stands in terms of code coverage.

umoci: a New Tool for OCI Images

Aleksa Sarai — Tue, 29 Nov 2016 15:30:00 +0000

Very recently, I've been working on implementing the required tooling for creating and modifying Open Container Initiative images without needing any external components. The tool I've written is called umoci and is probably one of the more exciting things I've worked on in the past couple of months. In particular, the applications of umoci when it comes to SUSE tooling like the Open Build Service or KIWI is what really makes it exciting.

Adventures into ptrace(2) Hell

Aleksa Sarai — Sun, 03 Jul 2016 19:00:00 +0000

As part of my work on rootless containers, I found that many tools try to drop privileges. This makes those tools break inside rootless containers, so I spent a week or two working on a tool that allows users to shim out all of the "drop privileges" syscalls. Here is documented the pain that I went through while figuring out how ptrace(2) is meant to work.

Rootless Containers with runC

Aleksa Sarai — Mon, 27 Jun 2016 21:05:00 +0000

There has been a lot of work within the runC community recently to get proper "rootless containers". I've been working on this for a couple of months now, and it looks like it's ready. This will be the topic of my talk at ContainerCon Japan 2016.

Debugging why ping was Broken in Docker Images

Aleksa Sarai — Fri, 04 Mar 2016 21:05:00 +0000

All complicated bugs start with the simplest of observations. I recently was assigned a bug on our openSUSE Docker images complaining that ping didn't work. After a couple of days of debugging, I was taken into a deep and dark world where ancient Unix concepts, esoteric filesystem features and new kernel privilege models culminate to produce this bug. Strap yourself in, this is going to be a fun ride.

Dockerinit and Dead Code

Aleksa Sarai — Thu, 21 Jan 2016 17:30:00 +0000

After running into insane amounts of very weird issues with gccgo with Docker, some of which were actual compiler bugs, someone on my team at SUSE asked the very pertinent question "just exactly what is dockerinit, and why are we packaging it?". I've since written a patch to remove it, but I thought I'd take the time to talk about dockerinit and more generally dead code (or more importantly, code that won't die).

Docker Internals and Implementing Rebase

Aleksa Sarai — Sat, 12 Dec 2015 22:30:00 +0000

SUSE's semi-annual Hackweek was last week and I decided to work on implementing docker rebase, mainly to learn about the internal image format of Docker and see whether it was possible to improve how the updating of Docker images works in practice (either rebuilding or zypper-docker).

Android Compilation Headaches

Aleksa Sarai — Sat, 28 Nov 2015 03:20:00 +0000

I've spent the last week of my life trying to build TWRP, which requires having a full, and working Android build environment. With the emphasis on working, I've had just about enough of the stupidity of the Android build system. Every guide is incomplete or out of date, the build system is broken in every possible way and nobody can explain what is going on. Here's my experience with trying to build Android and hopefully will help somebody realise the futility of trying to build a project with such a complicated build system.

Photometry of Contaminated Kepler Pixels

Aleksa Sarai — Tue, 03 Nov 2015 05:45:00 +0000

As part of the Talented Student Program, I undertook my first research project in the School of Physics (and hopefully the first of many). Specifically, this research involved designing a novel technique for making use of halo contamination from bright stars in Kepler K2 fields to do high-precision photometry. I'm planning on doing further research on this topic during the summer, and hopefully will get a paper published as a result.

Tuple Unpacking Oddness

Aleksa Sarai — Tue, 01 Sep 2015 01:00:00 +0000

While working on tutoring the NCSS Challenge, I found a very interesting oddity of Python's tuple unpacking execution order. While it turns out this is very well documented, it isn't very intuitive (as with most edge cases in languages).

Getting into Linux Kernel Development

Aleksa Sarai — Wed, 15 Jul 2015 14:20:00 +0000

I've been interested in kernel development for a long time, and recently got some patches merged into the Linux kernel. Here are my experiences about the process of kernel development and what newbies can do to get started.

Making a Simple Scheduler for an Arduino

Aleksa Sarai — Mon, 12 Jan 2015 03:00:00 +0000

The latest cool thing I worked on for NCSS in order to play "The Final Countdown" on a single Arduino Uno with proper chords. Also because I really wanted to write a scheduler, and this was a good excuse.