Lockdown your Dockerized build environments --- Because privileged mode is insecure, you should restrict your CI/CD environments to known users and projects. If this isn't feasible, then instead of using Docker, you could try using a standalone image builder like Buildah to eliminate the risk. Alternatively, configuring rootless Docker-in-Docker can mitigate some --- but not all --- of the security concerns... - Source: dev.to / about 1 month ago

In my experience, not using docker to build docker images is a good idea. E.g. buildah[0] with chroot isolation can build images in a GitLab pipeline, where docker would fail. It can still use the same Dockerfile though. If you want to get rid of your Dockerfiles anyway, nix can also build docker images[1] with all the added benefits of nix (reproducibility, efficient building and caching, automatic layering,... - Source: Hacker News / 8 months ago

Buildah: This lightweight, open-source command-line tool for building and managing container images. It is an efficient alternative to Docker. With Buildah, you can build images in various ways, including using a Dockerfile, a podmanfile or by running commands in a container. Buildah is a flexible, secure and powerful tool for building container images. - Source: dev.to / about 1 year ago

When I saw the title I thought it was going to be about `buildah` [1][2] Which allows you to create images using the command line to build them up step-by-step. [1] https://buildah.io/. - Source: Hacker News / over 1 year ago

Buildah is a "tool that facilitates building OCI images" of Containers. If it is not installed, podman system migrate will print out the warning:. - Source: dev.to / over 1 year ago

For what it's worth you can implement a C compiler in under 10kLOC. The chibi C compiler is only a few thousand lines [1]. There is also Cake [2] and the tiny C compiler [3] which are both relatively small. [1] https://github.com/rui314/chibicc [3] https://bellard.org/tcc/. - Source: Hacker News / 3 months ago

I was going to say, the list should include something by Fabrice Bellard. Tiny C Compiler is one. https://bellard.org/tcc/ I was thinking, maybe first version/commit of QEMU would be interesting to read. - Source: Hacker News / 11 months ago

I occasionally use tcc (https://bellard.org/tcc/) like an interpreter (`tcc -run`), it's convenient for certain odd tasks. Not so much for interactive stuff, but if I'm building little PoCs for an idea that will get dropped into a C project, or fiddling with structs work out how something should/is being stored, or in situations where I'm making stuff that interacts with or examples based on C code and I want to... - Source: Hacker News / about 1 year ago

This reminded me the idea of compilers bootstrapping (https://news.ycombinator.com/item?id=35714194). That is, now you can code in SectorC some slightly more advanced version of C capable of compiling TCC (https://bellard.org/tcc/), and then with TCC you can go forward to GCC and so on. - Source: Hacker News / about 1 year ago

The tinyc compiler reads scripts like a c-interpreter, with shebang and all. Source: over 1 year ago