{"generator":"GNU social 2.0.2-dev","title":"Conversation","totalItems":20,"items":[{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@doty<\/a> consider this: forgejo will show the token to anybody who can open the web interface, so if you put the configuration into a private repo on the same forgejo instance, then you need the same privileges to view either<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115768841140221150","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115768841140221150","objectType":"note","content":"

@doty<\/a> consider this: forgejo will show the token to anybody who can open the web interface, so if you put the configuration into a private repo on the same forgejo instance, then you need the same privileges to view either<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115768841140221150","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/doty\/statuses\/115765123522230887","url":"https:\/\/mastodon.social\/@doty\/115765123522230887"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/doty"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11772528","source":"ActivityPub"}},"published":"2025-12-23T12:18:50+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115768841140221150"},{"actor":{"id":"https:\/\/mastodon.social\/users\/doty","displayName":"doty","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/357023-original-tmp20250806154251.webp","rel":"avatar","type":"image\/webp","width":198,"height":198},{"url":"https:\/\/gnusocial.jp\/avatar\/357023-96-20251222203323.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/357023-48-20251222203323.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/357023-24-20251222203323.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"357023"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/357023-96-20251222203323.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"John Doty","url":"https:\/\/mastodon.social\/@doty","portablecontacts_net":{"preferredUsername":"doty","displayName":"doty","note":"John Doty"}},"content":"

@whitequark<\/a> This is so great, thanks! The idea of putting my forgejo token into a configuration file is very scary to me\u2026. I haven\u2019t looked at the implementation but is there a way it could come from somewhere a little more secure? (I would want to commit my configuration file, but the chances of me then leaking my forgejo token at some point become 100%)<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/doty\/statuses\/115765123522230887","object":{"id":"https:\/\/mastodon.social\/users\/doty\/statuses\/115765123522230887","objectType":"note","content":"

@whitequark<\/a> This is so great, thanks! The idea of putting my forgejo token into a configuration file is very scary to me\u2026. I haven\u2019t looked at the implementation but is there a way it could come from somewhere a little more secure? (I would want to commit my configuration file, but the chances of me then leaking my forgejo token at some point become 100%)<\/p>","url":"https:\/\/mastodon.social\/@doty\/115765123522230887","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11768677","source":"ActivityPub"}},"published":"2025-12-22T20:33:23+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@doty\/115765123522230887"},{"actor":{"id":"https:\/\/social.afront.org\/users\/stylus","displayName":"Stylus","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/287249-original-tmp20241015225218.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-96-20241015225218.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-48-20241015225218.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-24-20241015225218.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"287249"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/287249-96-20241015225218.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Named after my first AD&D character, ca 1991.I'm a software developer, primarily #Python","url":"https:\/\/social.afront.org\/@stylus","portablecontacts_net":{"preferredUsername":"stylus","displayName":"Stylus","note":"Named after my first AD&D character, ca 1991.I'm a software developer, primarily #Python"}},"content":"

@whitequark<\/a> sounds like what I need is an understanding of how to secure podman properly, then.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115764264059667427","object":{"id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115764264059667427","objectType":"note","content":"

@whitequark<\/a> sounds like what I need is an understanding of how to secure podman properly, then.<\/p>","url":"https:\/\/social.afront.org\/@stylus\/115764264059667427","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764228243537751","url":"https:\/\/mastodon.social\/@whitequark\/115764228243537751"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767403","source":"ActivityPub"}},"published":"2025-12-22T16:57:00+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/social.afront.org\/@stylus\/115764264059667427"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@stylus<\/a> podman doesn't have a privileged daemon so a host takeover through it is unlikely; I'd expect a logic bug in forgejo-runner to be a more likely source of compromise (which you can't do anything about)<\/p>

Docker however does have a privileged daemon, and also there are two modes where the CI workflows are given access to a Docker control socket which are insecure in various well known ways. by not doing that you avoid that problem<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764272509899647","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764272509899647","objectType":"note","content":"

@stylus<\/a> podman doesn't have a privileged daemon so a host takeover through it is unlikely; I'd expect a logic bug in forgejo-runner to be a more likely source of compromise (which you can't do anything about)<\/p>

Docker however does have a privileged daemon, and also there are two modes where the CI workflows are given access to a Docker control socket which are insecure in various well known ways. by not doing that you avoid that problem<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115764272509899647","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115764264059667427","url":"https:\/\/social.afront.org\/@stylus\/115764264059667427"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/social.afront.org\/users\/stylus"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767404","source":"ActivityPub"}},"published":"2025-12-22T16:56:59+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115764272509899647"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@stylus<\/a> so to finish answering your first q: it does not really matter that you use NixOS (it is equally possible, with the right effort, to securely configure NixOS, Debian, Fedora, whatever) but it does matter that you use a configuration where this effort has been put into it<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764228243537751","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764228243537751","objectType":"note","content":"

@stylus<\/a> so to finish answering your first q: it does not really matter that you use NixOS (it is equally possible, with the right effort, to securely configure NixOS, Debian, Fedora, whatever) but it does matter that you use a configuration where this effort has been put into it<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115764228243537751","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764223875488015","url":"https:\/\/mastodon.social\/@whitequark\/115764223875488015"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/social.afront.org\/users\/stylus"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767362","source":"ActivityPub"}},"published":"2025-12-22T16:45:44+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115764228243537751"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@stylus<\/a>
re second question: ARM64 runners should work _but_ my configuration only runs on virtualized (QEMU, KVM, etc) hardware. it will need to be modified a fair bit to run on bare metal, since it wasn't designed to be. I actually don't use NixOS on bare metal at all so I wouldn't know offhand how to do this<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764223875488015","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764223875488015","objectType":"note","content":"

@stylus<\/a>
re second question: ARM64 runners should work _but_ my configuration only runs on virtualized (QEMU, KVM, etc) hardware. it will need to be modified a fair bit to run on bare metal, since it wasn't designed to be. I actually don't use NixOS on bare metal at all so I wouldn't know offhand how to do this<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115764223875488015","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764216098853775","url":"https:\/\/mastodon.social\/@whitequark\/115764216098853775"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/social.afront.org\/users\/stylus"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767355","source":"ActivityPub"}},"published":"2025-12-22T16:44:36+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115764223875488015"},{"actor":{"id":"https:\/\/social.afront.org\/users\/stylus","displayName":"Stylus","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/287249-original-tmp20241015225218.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-96-20241015225218.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-48-20241015225218.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/287249-24-20241015225218.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"287249"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/287249-96-20241015225218.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Named after my first AD&D character, ca 1991.I'm a software developer, primarily #Python","url":"https:\/\/social.afront.org\/@stylus","portablecontacts_net":{"preferredUsername":"stylus","displayName":"Stylus","note":"Named after my first AD&D character, ca 1991.I'm a software developer, primarily #Python"}},"content":"

@whitequark<\/a> It's great to see this! Many of us have plenty of compute inside our homes, enough to support our own small project CI needs, but it's easy to be intimidated by the setup process, worrying about security if we let people use the runner via pull requests, etc.<\/p>

I followed some manual steps to set up a runner on a raspberry pi 5 earlier this year.<\/p>

I have what are probably some very basic questions.<\/p>

First, does using NixOS provide any extra isolation or security compared to just running forgejo-runner under its own Unix user in a regular Linux install?<\/p>

Second, would these steps adapt to the ARM-based pi5 or is it specific to x86_64 type machines?<\/p>

Semi-answering my second question, I see that pi 5 gets \"community supported (unverified)\" in the NixOS support matrix which is not exactly inspiring... but pi4 is YES. https:\/\/wiki.nixos.org\/wiki\/NixOS_on_ARM\/Raspberry_Pi<\/a><\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115763980442109205","object":{"id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115763980442109205","objectType":"note","content":"

@whitequark<\/a> It's great to see this! Many of us have plenty of compute inside our homes, enough to support our own small project CI needs, but it's easy to be intimidated by the setup process, worrying about security if we let people use the runner via pull requests, etc.<\/p>

I followed some manual steps to set up a runner on a raspberry pi 5 earlier this year.<\/p>

I have what are probably some very basic questions.<\/p>

First, does using NixOS provide any extra isolation or security compared to just running forgejo-runner under its own Unix user in a regular Linux install?<\/p>

Second, would these steps adapt to the ARM-based pi5 or is it specific to x86_64 type machines?<\/p>

Semi-answering my second question, I see that pi 5 gets \"community supported (unverified)\" in the NixOS support matrix which is not exactly inspiring... but pi4 is YES. https:\/\/wiki.nixos.org\/wiki\/NixOS_on_ARM\/Raspberry_Pi<\/a><\/p>","url":"https:\/\/social.afront.org\/@stylus\/115763980442109205","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767347","source":"ActivityPub"}},"published":"2025-12-22T16:42:40+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/social.afront.org\/@stylus\/115763980442109205"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@stylus<\/a> <\/p>

re first question: this is a bit complicated. it mostly doesn't matter what user the forgejo-runner process runs as because that's not where the sensitive parts are. the bit that _really_ matters is your exact container runtime setup (that forgejo-runner is using via a socket). my configuration takes great care to set one up in a way where what's inside can't escape, but it's very easy to configure Docker on a regular Linux install such that this isn't the case<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764216098853775","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764216098853775","objectType":"note","content":"

@stylus<\/a> <\/p>

re first question: this is a bit complicated. it mostly doesn't matter what user the forgejo-runner process runs as because that's not where the sensitive parts are. the bit that _really_ matters is your exact container runtime setup (that forgejo-runner is using via a socket). my configuration takes great care to set one up in a way where what's inside can't escape, but it's very easy to configure Docker on a regular Linux install such that this isn't the case<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115764216098853775","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/social.afront.org\/users\/stylus\/statuses\/115763980442109205","url":"https:\/\/social.afront.org\/@stylus\/115763980442109205"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/social.afront.org\/users\/stylus"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767349","source":"ActivityPub"}},"published":"2025-12-22T16:42:38+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115764216098853775"},{"actor":{"id":"https:\/\/rubber.social\/users\/dragonarchitect","displayName":"Snaketember King Naga Calyo","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/115729-original-tmp20260926123654.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/115729-96-20260928105414.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/115729-48-20260927054032.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/115729-24-20260928105414.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"115729"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/115729-96-20260928105414.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Hi there!\u2029You'll get a little bit of everything me here, from EE, science, maths, & web dev, to daily life musings & commiserations to IRL kink to horny character & worldbuilding ideas.\u2029I'm an eldritch rubber goo thing whose gender-shape changes about as often as you change your bedsheets, but I'm usually a fingendered dragon girl toy. Get handsy with me. I'm tactile. <3\u2029I can't promise infallible use of CW's here. #ADHD #ActuallyAutistic","url":"https:\/\/rubber.social\/@dragonarchitect","portablecontacts_net":{"preferredUsername":"dragonarchitect","displayName":"Snaketember King Naga Calyo","note":"Hi there!\u2029You'll get a little bit of everything me here, from EE, science, maths, & web dev, to daily life musings & commiserations to IRL kink to horny character & worldbuilding ideas.\u2029I'm an eldritch rubber goo thing whose gender-shape changes about as often as you change your bedsheets, but I'm usually a fingendered dragon girl toy. Get handsy with me. I'm tactile. <3\u2029I can't promise infallible use of CW's here. #ADHD #ActuallyAutistic"}},"content":"

@whitequark<\/a> Good grief you're really cooking on all of these git-powerup projects. (This is admiration.)<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/rubber.social\/users\/dragonarchitect\/statuses\/115763896251668439","object":{"id":"https:\/\/rubber.social\/users\/dragonarchitect\/statuses\/115763896251668439","objectType":"note","content":"

@whitequark<\/a> Good grief you're really cooking on all of these git-powerup projects. (This is admiration.)<\/p>","url":"https:\/\/rubber.social\/@dragonarchitect\/115763896251668439","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767310","source":"ActivityPub"}},"published":"2025-12-22T16:37:08+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/rubber.social\/@dragonarchitect\/115763896251668439"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@dragonarchitect<\/a> aw, thank you :)<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764194496518904","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115764194496518904","objectType":"note","content":"

@dragonarchitect<\/a> aw, thank you :)<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115764194496518904","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/rubber.social\/users\/dragonarchitect\/statuses\/115763896251668439","url":"https:\/\/rubber.social\/@dragonarchitect\/115763896251668439"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/rubber.social\/users\/dragonarchitect"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11767311","source":"ActivityPub"}},"published":"2025-12-22T16:37:07+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115764194496518904"},{"actor":{"id":"https:\/\/fosstodon.org\/users\/Naich","displayName":"\ud83c\uddf3\ud835\uddee\ua71f\ud835\uddbc\ud835\ude29","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/84104-original-tmp20230103071347.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/84104-96-20230731161234.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/84104-48-20230731161234.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/84104-24-20230731161234.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"84104"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/84104-96-20230731161234.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Vaguely humanoid and mostly made of meat. Vegetarian cyclist Linux loving lefty who brews beer, currently reassembling an RD350LC motorbike. Also into punk, EDM, making stuff, the Oxford Comma and crap meta jokes.What is green and smells like yellow paint? Green paint.","url":"https:\/\/fosstodon.org\/@Naich","portablecontacts_net":{"preferredUsername":"Naich","displayName":"\ud83c\uddf3\ud835\uddee\ua71f\ud835\uddbc\ud835\ude29","note":"Vaguely humanoid and mostly made of meat. Vegetarian cyclist Linux loving lefty who brews beer, currently reassembling an RD350LC motorbike. Also into punk, EDM, making stuff, the Oxford Comma and crap meta jokes.What is green and smells like yellow paint? Green paint."}},"content":"

@whitequark<\/a>
I've read the main page and the FAQ, and I'm still not sure what Forgejo is or does.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/fosstodon.org\/users\/Naich\/statuses\/115762706101932437","object":{"id":"https:\/\/fosstodon.org\/users\/Naich\/statuses\/115762706101932437","objectType":"note","content":"

@whitequark<\/a>
I've read the main page and the FAQ, and I'm still not sure what Forgejo is or does.<\/p>","url":"https:\/\/fosstodon.org\/@Naich\/115762706101932437","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765777","source":"ActivityPub"}},"published":"2025-12-22T10:21:56+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/fosstodon.org\/@Naich\/115762706101932437"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@Naich<\/a> forgejo is a foss github clone with none of the bullshit<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762717872377908","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762717872377908","objectType":"note","content":"

@Naich<\/a> forgejo is a foss github clone with none of the bullshit<\/p>","url":"https:\/\/gnusocial.jp\/notice\/11765780","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/fosstodon.org\/users\/Naich\/statuses\/115762706101932437","url":"https:\/\/fosstodon.org\/@Naich\/115762706101932437"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/fosstodon.org\/users\/Naich"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765780","source":"ActivityPub"}},"published":"2025-12-22T10:21:55+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/gnusocial.jp\/notice\/11765780"},{"actor":{"id":"https:\/\/mastodon.gamedev.place\/users\/jalict","displayName":"Frans","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/282000-original-tmp20251126120715.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-96-20251205070725.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-48-20251126175812.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-24-20251205070725.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"282000"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/282000-96-20251205070725.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Babysitter for automated systems @ Flashbulb GamesBike Mechanic volunteer & board member@ https:\/\/bicycleinnovationlab.dk\/Artichoke is a shit veggie. Send me recipe to convince me otherwise - I am trying to stay ~open minded~#biketouring #hiking #homelab #gamedev #dkgame","url":"https:\/\/mastodon.gamedev.place\/@jalict","portablecontacts_net":{"preferredUsername":"jalict","displayName":"Frans","note":"Babysitter for automated systems @ Flashbulb GamesBike Mechanic volunteer & board member@ https:\/\/bicycleinnovationlab.dk\/Artichoke is a shit veggie. Send me recipe to convince me otherwise - I am trying to stay ~open minded~#biketouring #hiking #homelab #gamedev #dkgame"}},"content":"

@whitequark<\/a> Answers my question perfectly. Last time I setup Forgejo runner I had some odd handshake connection issues, so I had to resort to the Gitea one which felt stupid. Thank you, very useful!<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762555585665877","object":{"id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762555585665877","objectType":"note","content":"

@whitequark<\/a> Answers my question perfectly. Last time I setup Forgejo runner I had some odd handshake connection issues, so I had to resort to the Gitea one which felt stupid. Thank you, very useful!<\/p>","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762555585665877","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762517308938626","url":"https:\/\/mastodon.social\/@whitequark\/115762517308938626"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765626","source":"ActivityPub"}},"published":"2025-12-22T09:41:49+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762555585665877"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@jalict<\/a> I clarified the \"important\" remark as well, hopefully to make it clear that there _is_ job isolation, it's just difficult to make hard promises about it<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762561263535458","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762561263535458","objectType":"note","content":"

@jalict<\/a> I clarified the \"important\" remark as well, hopefully to make it clear that there _is_ job isolation, it's just difficult to make hard promises about it<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115762561263535458","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762555585665877","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762555585665877"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.gamedev.place\/users\/jalict"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765627","source":"ActivityPub"}},"published":"2025-12-22T09:41:48+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115762561263535458"},{"actor":{"id":"https:\/\/mastodon.gamedev.place\/users\/jalict","displayName":"Frans","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/282000-original-tmp20251126120715.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-96-20251205070725.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-48-20251126175812.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/282000-24-20251205070725.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"282000"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/282000-96-20251205070725.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Babysitter for automated systems @ Flashbulb GamesBike Mechanic volunteer & board member@ https:\/\/bicycleinnovationlab.dk\/Artichoke is a shit veggie. Send me recipe to convince me otherwise - I am trying to stay ~open minded~#biketouring #hiking #homelab #gamedev #dkgame","url":"https:\/\/mastodon.gamedev.place\/@jalict","portablecontacts_net":{"preferredUsername":"jalict","displayName":"Frans","note":"Babysitter for automated systems @ Flashbulb GamesBike Mechanic volunteer & board member@ https:\/\/bicycleinnovationlab.dk\/Artichoke is a shit veggie. Send me recipe to convince me otherwise - I am trying to stay ~open minded~#biketouring #hiking #homelab #gamedev #dkgame"}},"content":"

@whitequark<\/a> I _think_ the \"important\" note covers this, but my English is failing me: So this runs actions directly on the host agent?<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762469480795557","object":{"id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762469480795557","objectType":"note","content":"

@whitequark<\/a> I _think_ the \"important\" note covers this, but my English is failing me: So this runs actions directly on the host agent?<\/p>","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762469480795557","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765582","source":"ActivityPub"}},"published":"2025-12-22T09:30:38+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762469480795557"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@jalict<\/a> no, it runs actions in a rootless container with no access to the host podman socket<\/p>

the builds are isolated, but I am just being very cautious as there have been high-profile backdoor incidents attacking GitHub Actions workflows and I don't have that much trust in the Forgejo Actions runners &c<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762517308938626","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762517308938626","objectType":"note","content":"

@jalict<\/a> no, it runs actions in a rootless container with no access to the host podman socket<\/p>

the builds are isolated, but I am just being very cautious as there have been high-profile backdoor incidents attacking GitHub Actions workflows and I don't have that much trust in the Forgejo Actions runners &c<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115762517308938626","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.gamedev.place\/users\/jalict\/statuses\/115762469480795557","url":"https:\/\/mastodon.gamedev.place\/@jalict\/115762469480795557"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.gamedev.place\/users\/jalict"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765583","source":"ActivityPub"}},"published":"2025-12-22T09:30:37+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115762517308938626"},{"actor":{"id":"https:\/\/cupoftea.social\/users\/acidbong","displayName":"Acid Bong","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/306131-original-tmp20241214101356.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-96-20251111150702.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-48-20251111150702.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-24-20251111150702.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"306131"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/306131-96-20251111150702.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Linux power user (using NixOS btw), guitarist, music fan, cat dad, hobby programmer (if I ever find enough concentration to learn a language).","url":"https:\/\/cupoftea.social\/@acidbong","portablecontacts_net":{"preferredUsername":"acidbong","displayName":"Acid Bong","note":"Linux power user (using NixOS btw), guitarist, music fan, cat dad, hobby programmer (if I ever find enough concentration to learn a language)."}},"content":"

@whitequark<\/a> ah, makes sense now, cheers<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762325526292897","object":{"id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762325526292897","objectType":"note","content":"

@whitequark<\/a> ah, makes sense now, cheers<\/p>","url":"https:\/\/cupoftea.social\/@acidbong\/115762325526292897","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762323527581386","url":"https:\/\/mastodon.social\/@whitequark\/115762323527581386"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765409","source":"ActivityPub"}},"published":"2025-12-22T08:42:41+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cupoftea.social\/@acidbong\/115762325526292897"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@acidbong<\/a> it's kind of an atrocious piece of code but we were both sleep-deprived and needed to get something working at least<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762328852116599","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762328852116599","objectType":"note","content":"

@acidbong<\/a> it's kind of an atrocious piece of code but we were both sleep-deprived and needed to get something working at least<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115762328852116599","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762325526292897","url":"https:\/\/cupoftea.social\/@acidbong\/115762325526292897"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cupoftea.social\/users\/acidbong"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765410","source":"ActivityPub"}},"published":"2025-12-22T08:42:40+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115762328852116599"},{"actor":{"id":"https:\/\/cupoftea.social\/users\/acidbong","displayName":"Acid Bong","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/306131-original-tmp20241214101356.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-96-20251111150702.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-48-20251111150702.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/306131-24-20251111150702.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"306131"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/306131-96-20251111150702.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"Linux power user (using NixOS btw), guitarist, music fan, cat dad, hobby programmer (if I ever find enough concentration to learn a language).","url":"https:\/\/cupoftea.social\/@acidbong","portablecontacts_net":{"preferredUsername":"acidbong","displayName":"Acid Bong","note":"Linux power user (using NixOS btw), guitarist, music fan, cat dad, hobby programmer (if I ever find enough concentration to learn a language)."}},"content":"

@whitequark<\/a> why foldlAttrs instead of mapAttrs?<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762321936820113","object":{"id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762321936820113","objectType":"note","content":"

@whitequark<\/a> why foldlAttrs instead of mapAttrs?<\/p>","url":"https:\/\/cupoftea.social\/@acidbong\/115762321936820113","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115761949869111616","url":"https:\/\/mastodon.social\/@whitequark\/115761949869111616"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/mastodon.social\/users\/whitequark"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765401","source":"ActivityPub"}},"published":"2025-12-22T08:41:23+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/cupoftea.social\/@acidbong\/115762321936820113"},{"actor":{"id":"https:\/\/mastodon.social\/users\/whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/105710-original-tmp20230309163231.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-48-20230309163231.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/105710-24-20230309163231.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"105710"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/105710-96-20230309163231.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable","url":"https:\/\/mastodon.social\/@whitequark","portablecontacts_net":{"preferredUsername":"whitequark","displayName":"\u2727\u2726Catherine\u2726\u2727","note":"cat(girl) shaped object, hardware omelas kid"A cat is valued for companionship and its ability to kill vermin."\u2727 i have friends, and my purpose is to support them \u2727\u2726 i have enemies, and my purpose is to eliminate them \u2726\u2736 i have a life, and my purpose is to reach heaven by violence \u2736\u2737 nothing else matters \u2737#searchable"}},"content":"

@acidbong<\/a> port + 1<\/p>","generator":{"id":"tag:gnusocial.jp,2026-10-19:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762323527581386","object":{"id":"https:\/\/mastodon.social\/users\/whitequark\/statuses\/115762323527581386","objectType":"note","content":"

@acidbong<\/a> port + 1<\/p>","url":"https:\/\/mastodon.social\/@whitequark\/115762323527581386","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/cupoftea.social\/users\/acidbong\/statuses\/115762321936820113","url":"https:\/\/cupoftea.social\/@acidbong\/115762321936820113"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/cupoftea.social\/users\/acidbong"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2025-12-22:objectType=thread:nonce=0891a73422072f7a","notice_info":{"local_id":"11765402","source":"ActivityPub"}},"published":"2025-12-22T08:41:22+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/mastodon.social\/@whitequark\/115762323527581386"}],"links":[{"url":"https:\/\/gnusocial.jp\/conversation\/5979703","rel":"alternate","type":"text\/html"}]}