Recent content on Tuan-Anh Tran
I used to be interested in Ladybird . Independent browser engine, built from scratch, no Blink/WebKit/Gecko code. On paper, exactly the kind of project the web needs if we don’t want Chrome to become the new IE. In July 2024, Chris Wanstrath (GitHub co-founder, former CEO) and Andreas Kling turned it into a proper 501(c)(3) nonprofit, the Ladybird Browser Initiative. Chris kicked in $1…
A snapshot of what I actually use. Not aspirational, not a distro review. Just the tools that survived contact with daily work. system Arch Linux : rolling release, minimal by default, AUR when I need something obscure. Same distro I’ve been on for years; I stopped distro-hopping a long time ago. I like the idea of NixOS and nix shell , but Nix flake syntax scares me. i3 : tiling window…
For years, companies fought to get their icon on your phone. They wanted you inside their app: their layout, their offers, their brand. For years after that, product teams lived and died by UX: smoother flows, clearer buttons, faster loads. Marketers chased click-through rates, conversion funnels, and A/B tests on every step. The whole game assumed a human would see the screen, tap, and stay long…
Disclaimer I am not a lawyer, nor am I an expert in copyright law or software licensing. The following post is a breakdown of recent community events and legal news; it should not be taken as legal advice regarding your own projects or dependencies. In the world of open source, relicensing is notoriously difficult. It usually requires the unanimous consent of every person who has ever contributed…
Most people interact with BuildKit every day without realizing it. When you run docker build , BuildKit is the engine behind it. But reducing BuildKit to “the thing that builds Dockerfiles” is like calling LLVM “the thing that compiles C.” It undersells the architecture by an order of magnitude. BuildKit is a general-purpose, pluggable build framework. It can produce OCI…
The old compliance rule no longer works For years, enterprise security has lived by a simple, if flawed, rule: “Patch anything with a CVSS score above 7.0 within 30 days.” It was a clean metric for auditors and a clear directive for SRE teams. But in a recent post , Greg Kroah-Hartman, as the head of the Linux Kernel CNA, confirmed a shift that breaks this model. The kernel team is now…
Agents break the contract of trust Agents are underdeterministic. Underdeterminism is incompatible with trust. Period. Security has always assumed deterministic behavior. We can’t write policy to prevent bad outcomes when we don’t even know what the agent will do. Sandboxing is the natural answer: everyone is buying Mac Minis to run Moltbot (OpenClaw now), Docker is using microVMs for…
The bottleneck has moved from writing code to verifying it. CI must move with it: run where agents run, and run fast. It’s the same pattern everywhere: we’re changing how we architect systems, how we run CI, and how we build in general so that AI coding agents can work effectively. I wrote about one side of that a few weeks ago (architecture for disposable software). Shifting CI left…
We are entering what I like to call the “Post-Agentic” era. It’s a subtle shift, but a profound one. For the last year or two, we’ve been obsessed with “agents”: standalone entities that can perform tasks. We spent our time optimizing for agent efficiency, worrying about token costs, and trying to make a single agent smart enough to solve complex problems in one…
When I first started building and deploying AI agents that could actually do things (edit code, run tests, manage infrastructure), my first instinct was to lock everything down, perhaps because I’ve been in the container/microVM space for so long. I was convinced that we needed complex, multi-layered isolation to prevent an agent from hallucinating its way into a rm -rf / disaster. Looking…
Note: When I talk about 0-CVE, I mean zero known CVEs. It’s impossible to have true 0-CVE as new vulnerabilities are discovered daily, but I can aim for zero known vulnerabilities in my deployed images. This post dives into the details of my previous talk, “From Container to Bare Metal: Redefining OS Build with bootc,” presented at Chainguard’s “In Containers We…
It’s weird to see Docker Inc (the company) struggle to find its place in 2026. What started as the company that revolutionized how we deploy applications has been through multiple identity crises, pivoting from one strategy to another in search of sustainable revenue and market relevance. The Identity Crisis Docker’s journey reads like a startup trying to find product-market fit,…
The AI era has fundamentally changed the privacy landscape. Every piece of content you create online - blog posts, social media updates, code repositories, photos - is being scraped, indexed, and fed into training datasets. Companies are building AI models on your data without consent, and the traditional privacy playbook no longer applies. As someone who’s been pro-Linux and open source for…
I decided to upgrade my NAS from a Synology DS918+ to an all-flash setup. After years of using spinning drives, I wanted the speed and silence that comes with NVMe storage. Your browser does not support the video tag. When I originally bought my Synology DS918+, I just wanted something that worked out of the box. I paid a premium price for that convenience, and it served me well. However, Synology…
Mình vừa đọc được một bài viết về Handmade Software Foundation , một tổ chức nhỏ với mục tiêu hỗ trợ và quảng bá “handmade software”, tức là phần mềm được viết thủ công bởi con người thay vì AI. Trong bối cảnh AI coding agents đang bùng nổ và có thể tạo ra code nhanh hơn, rẻ hơn, và trong nhiều trường hợp tốt hơn con người, khái niệm “handmade software” làm mình liên tưởng…
As software gets cheaper to produce (thanks to coding agents) and quality expectations shift, we’re witnessing the rise of disposable software : code that you generate, use, and discard rather than maintain indefinitely. The Traditional Model Traditional software follows a well-established pattern: you build something once, maintain it indefinitely, and pay for it through high upfront…
This seems to be a very common issue for Blizzard games. Sometimes their update agent went haywire which stop people from playing the game. In my case, I was playing Diablo 2: Resurrected on Linux (Arch Linux via Bottles ) one day and next day, their Battle.net client shows an error about “update agent went to sleep BLZBNTBNA00000005” & refuse to let me do anything. At first I thought…
There is this old saying ideas are cheap and execution is everything? Ideas are cheap. Execution is expensive. But that’s changing. With the raise of AI, this saying is no longer true. In fact, it’s dead wrong. For years, turning ideas into reality took time and money. Now, AI makes execution much easier and cheaper. This means good ideas matter more than ever. Execution is now…
LLM MCP security encompasses numerous critical concerns. Recently, Invariant Labs notified the community of a new type of attack called tool poisoning . Their article raises several security concerns that have been largely overlooked amid the excitement around new AI applications with MCP. Free-form text instruction The root cause of tool poisoning attack is that the agent ingests MCP’s…
Trừ khi công ty của bạn chuyên về mô hình nền tảng (foundation model), việc tích hợp AI sẽ không tạo ra sự khác biệt đáng kể cho sản phẩm của bạn. Lý do là vì AI hiện nay đã quá phổ biến. Việc sản phẩm của bạn có tính năng AI cũng không còn là điều gì đặc biệt nữa. Nó giống như việc bạn sử dụng một loại cơ sở dữ liệu (database engine) nào đó và coi đó là điểm khác biệt chiến lược của sản phẩm vậy.…
A typical Google Sheets link looks like this https://docs.google.com/spreadsheets/d/<....>/edit?gid=0#gid=0 In this mode, Google Sheets stops us from doing anything from saving, printing, add script, etc.. But they do have another feature called htmlview. In this mode, Google Sheets will renders the spreadsheet as a static HTML page & there is nothing to stop us from downloading the spreadsheet…
This is just notes I wrote for myself or anyone looking to get started with packaging for Arch Linux. Create an account with ArchLinux You need to sign up an account with ArchLinux AUR. Generate SSH key pair and add the public key to your ArchLinux AUR account. Once you finished that, verify it with ssh command $ ssh -T aur@aur.archlinux.org You should see sth like this Hi USERNAME! You've…
I just read this post on HackerNews regarding why you should not embedding YouTube videos directly. And it got me thinking about how do I do this with Hugo for my blog. 11 years ago, I pretty much did the same thing with Jekyll with my BetterTube plugin and now I want to port it to Hugo. This is how it work in action: Play video: OpenAI's nightmare: Deepseek R1 on a Raspberry Pi [Video playback…
The OBS Studio Flatpak Fiasco: A Packaging Problem The open-source streaming software OBS Studio has found itself at the center of a packaging controversy within the Fedora Linux community. The OBS team recently requested the removal of their software from Fedora Flatpaks , citing issues with the unofficial package. Users, unaware they were using a Fedora-packaged Flatpak, were reporting bugs…
Mình đang tìm hiểu để mua 1 cái TV mới, sau khi cái TV 10 năm tuổi đã lăn ra chết. Các tiêu chí cơ bản mình đặt ra là: 65 inch++ 4K. 8k vẫn chưa có content nên cũng không xét đến. OLED hoặc tốt hơn. Sau khi dùng OLED rồi thì không muốn quay lại LCD nữa. 120Hz++ 1000 nits. Không quá qua trọng nhưng cũng phải đủ sáng. Sau 1 hồi tìm hiểu thì chốt là sẽ mua Samsung hoặc LG. Lúc đầu có consider cả…
Cursor on Linux is offered as an AppImage. The CLI integration is currently broken on Linux. Here’s a workaround to install Cursor CLI on Linux. Create a file with the following content: #!/bin/bash # Wrapper script to launch Cursor IDE # Directory where AppImages are stored APPIMAGE_DIR = " $HOME /Applications" # Find the most recent Cursor AppImage CURSOR_APPIMAGE = $( ls -t "…
Temporary File Hosting with 0x0.st Sometimes you need a quick way to upload and share temporary files, like logs, for troubleshooting. 0x0.st is a simple and open-source solution that Upload files for free Keep them at least 30 days (which should be more than enough for most cases) Has an API for you to use. How I use it I wrote a small script to upload files or data directly to 0x0.st .…
I’m tired of chasing individual CVEs. What if we could eliminate that entire class of vulnerabilities altogether?🤔 This is the first post of this series where I look into solution to solve the above problem. PaX is one of the attempt to do so. If it’s so good, why hasn’t it make it into kernel mainline? etc… PaX Overview PaX is a security patchset developed by gcsecurity…
In this post, I’ll discuss my experience transitioning to Chainguard Images and the rationale behind this decision. The challanges The conventional vulnerability management process often proves cumbersome and inefficient. Here’s a typical scenario from my past experience: Periodic scans : every xx months (usually once a quarter), security team will scan organization-wide and send…
Building a machine learning rig This is my notes while building a machine learning rig. After a bunch of research, I ended up with the following specs: CPU: Threadripper PRO 3995WX . Mainboard: Supermicro M12SWA-TF . Cooler: Enermax TR4 500W GPU: 1x NVIDIA 3090 24GB Founder Edition & 1x NVIDIA 5090. RAM: 256GB (8x 32GB stick) memory ECC DDR4 3200Mhz. Storage: 2TB SSD Samsung 970 EVO Plus . PSU:…
Update Sober is now the recommended way to play Roblox on Linux. It’s easy to setup. Performance is good. I play game with my kid every now and then. His favorite game is Roblox. Unluckily, there’s no official Roblox client on Linux. So that leaves me with the only option of running emulation of one of the supported platform. I’ve tried many ways and finally settled on Waydroid.…
The best optimization is simply shutting things off You work from 8am to 8pm. That’s 12 hours. What happened to the rest of the day? You go home. So you shut things down. That’s 50% cost saving right there. Simple enough right? Now add the following constraints: Imagine if you have an AWS organization with hundreds of workload accounts. I’ve seen org with over 700 accounts.…
What is reproducibility? Reproducible builds are a set of software development practices that create an independently-verifiable path from source to binary code. as defined by reproducible-builds.org Why does it matter? The motivation behind the Reproducible Builds project is therefore to allow verification that no vulnerabilities or backdoors have been introduced during this compilation process…
The Write your first Wolfi package contributing guideline on Wolfi repo is a bit vague for beginner so I thought a more detailed, hands-on tutorial would benefit first-time contributor. Local dev environment The first step of contributing is to setup a build environment locally. Thanksfully, Wolfi team makes it very easy by just running make dev-container from the root of the repo. This assumes…
Thinh Nguyen có chia sẻ 1 bài khá tổng quan về secret trên k8s . Mình thấy gãi đúng chỗ ngứa vấn đề của mấy năm trước nên gõ nhanh bài này chia sẻ cùng mọi người. The problem Có 1 vấn đề từ những ngày đầu của k8s (những năm 2014-2016) là khi configmap/secret đc update thì làm sao để application nhận được các thay đổi đó. Giải pháp thời ấy đơn giản nhất là tự đi mà rolling update pods. Sau này đỡ…
Is it even possible? AWS Systems Manager có 1 tính năng là Default Host Management Configuration (DHMC). Cái này có gì hay ho? DHMC giúp bạn manage EC2 instances. Benefits bao gồm nhưng ko giới hạn những việc như: Connect to your instances securely using Session Manager. Perform automated patch scans using Patch Manager. View detailed information about your instances using Systems Manager…
The symptom: CS:GO launched to a black screen and just crash right after. The OS I’m using is Pop!_OS 21.10. The fix here is sudo apt install libtcmalloc-minimal4 cd <YOUR_STEAM_HOME_DIR>/steamapps/common/Counter-Strike \ Global \ Offensive/bin/linux64 # backup the old file mv libtcmalloc_minimal.so.0 libtcmalloc_minimal.so.0.bak mv libtcmalloc_minimal.so.4 libtcmalloc_minimal.so.4.bak ln -s…
Hôm trước mình hơi băn khoăn chút việc nếu sử dụng public ECR (public.ecr.aws) với sử dụng 1 k8s cluster trong private subnets, thì bandwidth từ việc pull images về trong private subnets sẽ đc tính thế nào. Tính vào cho NAT gateway? Hay tính vào cho S3 Gateway Endpoint? Vì public ECR sử dụng S3 làm storage nên trong trường hợp ngon nghẻ nhất là bandwidth đc tính vào Gateway endpoint thì ngon :)
I read many posts regarding Shure MV7 doesn’t work at all on Linux: here , here and here . It got me nervous as I already bought this on Amazon and return is not an option since I live in Vietnam. However, when I receive the mic today, it just works, right out of the box, on Pop!_OS (v 21.04). The only thing different with the vanilla Pop!_OS distro is I switch to pirewire for audio instead…
So you probably already heard the news Docker Desktop is no longer free . While this mostly affect macOS and Windows users and I use Pop!_OS, I still would like to see if we can get by without Docker at all. I’ve been using nerdctl for quite awhile now and while nerdctl mostly fill my needs for docker CLI, I “kinda” need kind CLI to create test cluster for testing purpose.…
K8s 1.22 giới thiệu Pod Security Admission (sau này gọi tắt là PSA) phiên bản alpha, để thay thế cho Pod Security Policy (PSP). Bài viết này sẽ hướng dẫn qua cách bạn setup PSA và sử dụng PSA 1 cách cơ bản nhất. Enable PSA Để cho mục đích lab đơn giản, mình sẽ sử dụng kind để tạo 1 cluster local. Mình sẽ tạo 1 cluster và enable PSA lên với config như sau
Previous setup I used a small VPS instance on RamNode to host my blog previously. No particular reason. I just happened to have lots of unused credits there. I have a local git repo on my Macbook. Setup a git hook to trigger jekyll build on the VPS. Nothing fancy. No CI/CD whatsoever. The new setup I recently migrated my blog from self-hosted on RamNode to Cloudflare Pages. There are still some…
TLDR: there’s a sample repo here if you’re lazy to read this post. The sample repo include GitHub Actions sample for CI as well. The Rust bit It’s very simple. You write your function in Rust #[js_function(3)] fn say_hello (ctx: CallContext ) -> Result < JsString > { let name = ctx.get:: < JsString > ( 0 ) ? .into_utf8() ? ; let name = name.as_str() ? ; let s =…
Nguồn gốc 2017, term GitOps đc WeaveWorks promote lên với bài viết “Operations by Pull Request” , đại để là k8s system state đc lưu ở 1 git repo changes made thông qua pull request rồi chạy CI/CD pipeline có công cụ hỗ trợ detect configuration drift và reconciler. Nhìn qua thì cũng chẳng có gì đặc biệt vì từ 2016, khi bên mình triển khai Kubernetes, mình cũng đã CI/CD và store system…
Structured logging Một best practice vẫn được recommend cho tới bây giờ là structured logging. Structured log là 1 dạng logging theo kiểu key=val để có thể giúp chúng ta dễ dàng parse log và đưa vào 1 log store để tiện query và phân tích. logger.info({ request_time : 1000 , payload_size : 2000 }) sau đó 1 đoạn structured log sẽ đc generated ra kiểu này, ngoài các metadata chúng ta log thì còn đi…
I got fed up with macOS. While the new hardware(Apple Silicon) got amazing feedbacks, the OS itself is so lag behind. I got a Windows 10 desktop at home and heck, it was even much more pleasant to use than using macOS. As a typical user (web browsing, mail and office stuff), Windows 10 is very good. As a developer, it’s getting a lot better with WSL/Microsoft Terminal/etc… I decided…
Cloudflare Warp is currently not supporting Linux. However, since it’s just Wireguard underneath, we can still use it unofficially. Install wgcf and wireguard-tools Get wgcf from its repo . Install wireguard-tools . I use Manjaro so I will use pacman for this pacman -S wireguard-tools . Generate Wireguard config You can now use wgcf to register, and then generate Wireguard config. wgcf…
TLDR: I wrote a SAX parser for Node.js. It’s available here on GitHub : https://github.com/tuananh/sax-parser I got asked about complete XML parsing with camaro from time to time and I haven’t yet managed to find time to implement yet. Initially I thought it should be part of camaro project but now I think it would make more sense as a separate package. The package is still in alpha…
I recently discover piscina project. It’s a very fast and convenient Node.js worker thread pool implementation. Remember when worker_threads first introduced, the worker startup is rather slow and pool implementation is generally advised. However, there wasn’t any good enough implementation yet until piscina . Since v4 when I move to WebAssembly, camaro performance took a huge hit (3…
I recently give fish shell another try and it doesn’t disappoint me this time. The support from various tools has improve tremendously and the ecosystem seesm to be a lot more mature last I tried. It tooks me like 15-20 minutes to migrate over everything to fish and it seems fish provides everything I need from zsh out of the box. Remind me why I need oh-my-zsh again? Installation Install…