Top all-time · #24383
gruchalski.com
Personal blog · gruchalski.com/posts · on HN as rad_gruchalskiprogrammingsystemssecurity
gruchalski.com is a personal blog at gruchalski.com about programming, systems and security. Since 2021, 3 different Hacker News readers have linked it 32 times, most often “Do you need a database for that Ory stack?”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
Linked on HN for a post about Fly Machines, Fly.io's API for fast-booting VMs. The one comment discusses VMs versus containers and how Fly.io runs Docker images, not the writing itself.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
engineering software for 20+ years
Most-linked posts?
- Do you need a database for that Ory stack?2 people · 2 mentions · first linked 2021-11-24
What Hacker News says?
Regarding turning Dockerfiles into a MicroVM: https://gruchalski.com/posts/2021-03-23-introducing-firebuil... , on GitHub: https://github.com/combust-labs/firebuild . This could get you started. Plenty of moving parts in that problem. Many root OS’s, many inits, … Difficult to pull this off by one person without any particular reason so I kinda suspended the project but who knows, seems like people want it so might…
Comment linking /posts/2021-03-23-introducing-firebuild/
on “We clone a running VM in 2 seconds”Submitted Do you need a database for that Ory stack? as a story · 2 points
HN discussionI like your event sourcing approach. I was recently looking into YugabyteDB changde data capture and it quickly became apparent that cdc can be used for exactly that. I wrote about It here: https://gruchalski.com/posts/2022-02-23-yugabytedb-change-da... . One problem with the cdc approach is not having a way to monitor ddl operations. However, at least in any Postgres capable database with extensions support, it’s p…
Comment linking /posts/2022-02-23-yugabytedb-change-data-capture/
on “Postgres Auditing in 150 lines of SQL”Submitted YugabyteDB: Postgres Foreign Data Wrapper as a story · 2 points
HN discussionIntegrating Kratos with anything is just so much work. The only nice thing differentiating Kratos from Keycloak is the ability to provide your own UI out of bound. In Keycloak, one has to use the template language provided by Keycloak and embed all those templates in a JAR file, which can be an operational hassle. Kratos makes it nice because it decouples the registration/login/recovery/settings flows from the UI bu…
Comment linking /posts/2020-09-05-introduction-to-keycloak-authorization-services/
on “The Modern Guide to OAuth”Submitted Keycloak 17.0.0 with TLS in Docker Compose behind Envoy proxy as a story · 1 points
HN discussion> thought we turned to Docker/containers because VMs were too heavy? VMs are lightweight now, though containers are lighter still; ref: https://fly.io/blog/sandboxing-and-workload-isolation/ Btw, Docker wasn't about security as much as it was about "package once, run anywhere". > Now we've got VMs that run Docker? Fly.io doesn't run Docker as-is, but rather unpacks it and runs it in a guest through containerd ; ref:…
Comment linking /posts/2021-03-03-thoughts-on-creating-vmms-from-docker-images/
on “Fly Machines: An API for Fast-Booting VMs”But it is possible to have initial certificates without opening anything: https://gruchalski.com/posts/2021-06-04-letsencrypt-certific... From there, it’s possible to use HTTPS negotiation.
Comment linking /posts/2021-06-04-letsencrypt-certificates-for-local-development/
on “Should you use Let's Encrypt for internal hostnames?”I have recently looked at a similar context but using Ory Keto. I've written about it here: https://gruchalski.com/posts/2021-04-11-looking-at-zanzibar-... . Evaluated scenario was: a company employs a director and IT staff, the director contracts a consultant, the IT staff subscribes to external services. Find out what the company pays for directly and indirectly. The new Keto 0.6 works very nice.
Comment linking /posts/2021-04-11-looking-at-zanzibar-through-ory-keto/
on “Zanzibar: Google’s Consistent, Global Authorization System (2019)”Wow, this is neat when one has a Postgres instance running out there. A portable alternative which I find very useful is to start a database in a container. I use ory/dockertest for that. I've written more about it here: https://gruchalski.com/posts/2021-04-24-on-software-testing-... . It's in the context of golang and launching the Ory platform for integration testing. Edit / added: could be relevant here for some.…
Comment linking /posts/2021-04-24-on-software-testing-with-dockertest/
on “Pg_tmp – Run tests on an isolated, temporary PostgreSQL database”This always reminds me of this thing I’ve written some time ago : https://gruchalski.com/posts/2021-04-02-kafka-infinite-reten...
Comment linking /posts/2021-04-02-kafka-infinite-retention/
on “Scaling Kafka at Honeycomb”> TLS always felt like a scary beast to me until I started writing Go. The crypto/tls package is amazing and makes doing incredible things with TLS super easy. This x100. I have been recently developing an embedded CA for a gRPC service in golang. Issuing a root, intermediate, server and a client cert for mtls is less than 350 lines of code. It’s incredible. I’ve written more about it here: https://gruchalski.com/po…
Comment linking /posts/2021-03-28-firebuild-rootfs-grpc-with-mtls/
on “TLS Mastery”> But the problem is, permissions are actually a representation of business processes snd communication structures. They are rarely user <-> role <-> permissions (I wish they were!). UMA2 is available in Keycloak. Known as Authorization Services. I have written about it in the past: https://gruchalski.com/posts/2020-09-05-introduction-to-keyc... .
Comment linking /posts/2020-09-05-introduction-to-keycloak-authorization-services/
on “Show HN: Open Source Authentication and Authorization”Welcome. Thank you for a great catch-the-Fortran-wave book. Pun intended. Your examples are fun to follow and step out of the regular day-to-day distributed computing comfort zone. I mentioned your book in my post on Fortran: https://gruchalski.com/posts/2022-08-28-i-enjoyed-modern-for... .
Comment linking /posts/2022-08-28-i-enjoyed-modern-fortran/
on “A modern Fortran scientific programming ecosystem”> Per API call seems more predictable, but still not as clear as the "at a glance, MAU number" Do product managers know how many API calls your average user would use? Yes, auth is most often implemented by devs, but are they always the buyer? I’ve done some research into Hydra: https://gruchalski.com/posts/2021-05-23-do-you-really-need-a... .
Comment linking /posts/2021-05-23-do-you-really-need-a-database-for-that-ory-stack/
on “Show HN: Open-Source Auth for NextJS / React”And the same but with Docker: https://gruchalski.com/posts/2021-04-24-on-software-testing-... .
Comment linking /posts/2021-04-24-on-software-testing-with-dockertest/
on “Ephemeral Postgres Databases”The thing with Keycloak is: when you know what you are looking for, it's all self descriptive. Server administration documentation is awesome: https://www.keycloak.org/docs/latest/server_admin/index.html I've written more about Authorization Services: https://gruchalski.com/posts/2020-09-05-introduction-to-keyc... And can recommend these resources: https://www.janua.fr/tag/technical-blog/
Comment linking /posts/2020-09-05-introduction-to-keycloak-authorization-services/
on “A detailed guide to SSO on Kubernetes”Running an internal CA is really easy in 2022: https://gruchalski.com/posts/2020-09-09-multi-tenant-vault-p... .
Comment linking /posts/2020-09-09-multi-tenant-vault-pki-with-custom-root-pem-bundle/
on “Ask HN: What's your solution for SSL on internal servers?”That's incorrect. Keycloak comes with UMA2 implementation which is for authorization. There is the whole concept of authorization services in there. I have written about it here: https://gruchalski.com/posts/2020-09-05-introduction-to-keyc... .
Comment linking /posts/2020-09-05-introduction-to-keycloak-authorization-services/
on “Casbin: An authorization library that supports authz models like ACL, RBAC, ABAC”I used YugabyteDB. License was one thing: database is Apache 2 licensed and no strings attached, you can operate it as a service yourself. Not so with CockroachDB, what powerhour said. Other reasons: it’s Postgres code under the hood, not a rewrite, so you can use existing extensions. I have even contributed the support for FDWs, which I use in production. More here https://gruchalski.com/tags/yugabytedb/ and here h…
Comment linking /tags/yugabytedb/
on “Ask HN: What has been your experience with CockroachDB?”I do it like this: https://gruchalski.com/posts/2022-04-28-private-go-modules-w... . This is in the context of go modules but it works with regular git stuff.
Comment linking /posts/2022-04-28-private-go-modules-with-multiple-git-identities/
on “Git with Multiple Email Addresses”Yes. Firecracker makes sense if you are going to run apps supplied by a third-party. It’s all about isolation. The story with firecracker is that it’s a great tool for rolling out very lightweight vms. It’s for sure production ready. What’s missing is a nicely packaged docker-like set of tools which do not require a bunch of different technologies being glued together. The biggest one being for sure integrated overl…
Comment linking /tags/firecracker/
on “Show HN: Firecracker Lab – Build a microVM from a container image”It's not complete (no rewrites) and does not provide RBAC component out of the box. It has the pieces but one has to put stuff together themselves. I have written more about it: https://gruchalski.com/posts/2021-05-15-rbac-with-ory-keto/ .
Comment linking /posts/2021-05-15-rbac-with-ory-keto/
on “Himeji: A scalable centralized system for authorization at Airbnb”I’m so happy to see that someone has finally built such thing. I’ve been asking for tiered storage in Kafka since 2016 ( https://gruchalski.com/posts/2016-05-08-the-case-for-kafka-c... ) but this approach is so much better. Kafka itself could solve this with tiered storage OR, at least, allowing adding volumes at runtime. But neither is possible. Very cool, have to find some time to take this for a test drive.
Comment linking /posts/2016-05-08-the-case-for-kafka-cold-storage/
on “Kafka Is Dead, Long Live Kafka”No. The article talks about setting up Keycloak in Kubernetes (and it does that poorly because it’s not a production setup) but you don’t need Kubernetes: https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-t... .
Comment linking /posts/2022-02-20-keycloak-1700-with-tls-behind-envoy/
on “Keycloak with PostgreSQL on Kubernetes”Maybe this will be helpful? https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-t... . I’m the author.
Comment linking /posts/2022-02-20-keycloak-1700-with-tls-behind-envoy/
on “Keycloak with PostgreSQL on Kubernetes”Yes. The white paper is very brief on details. Some systems in the wild totally miss the fact that a relation userset operation isn’t “include only”. That also applies to tupleset_to_userset. I was in that misled camp for quite some time. One day it clicked, but only after realising that the namespace config pseudo code from section 2.3. IS what defines relationships: https://gruchalski.com/posts/2022-10-22-zanzibar…
Comment linking /posts/2022-10-22-zanzibar-with-prolog-summary/
on “The Annotated Google Zanzibar Paper”> However, if you're already using ACME in production, maybe you'd prefer to use ACME locally? I just use Let’s Encrypt: https://gruchalski.com/posts/2021-06-04-letsencrypt-certific... . If I need a CA, I go for cfssl. Fact, I don’t have ACME via my own CA but it’s not necessary anyway if one is using LE.
Comment linking /posts/2021-06-04-letsencrypt-certificates-for-local-development/
on “Show HN: Anchor – developer-friendly private CAs for internal TLS”Yes, it’s possible. You can do this with Authorisation Services. Not an exact example but it’s close: https://gruchalski.com/posts/2020-09-05-introduction-to-keyc... . I’m the author.
Comment linking /posts/2020-09-05-introduction-to-keycloak-authorization-services/
on “Keycloak – Open-Source Identity and Access Management Interview”The former: https://gruchalski.com/posts/2023-07-10-yq-the-yaml-power-to... .
Comment linking /posts/2023-07-10-yq-the-yaml-power-tool/
on “Jaq – A jq clone focused on correctness, speed, and simplicity”