NethServer 8: planning an evolution

The problem with Rocky Linux and Alma Linux is that they are not battle hardened or battle ready for the production environment and that could be a contributing factor as to why the Neth Devs haven’t chosen either of them yet.

Now @stephdl’s suggestion is something to consider as an option for the long-term

…which is a large part of why I’m inclined to favor Oracle. But they’ve built themselves a poor reputation too.

@danb35

AFAIK, Rocky, Alma and Oracle are all three doing the same thing: repackaging RHEL8…
So actually, all three can be considered “Battle Ready”, at least from the “Product” they’re delivering…

Rocky and Alma still need to prove their distribution / repackaging systems are battle ready and Rock-Solid.

So actually all three are “Docker” based distros - and besides boot logo probably very identical!

They call it “bug for bug” compatible with RHEL8, just as CENTOS8 was…

My 2 cents
Andy

I’d largely agree, and you’ve already noted that Rocky and Alma have yet to prove their distribution/repackaging systems (which Oracle has already done). The other important distinction is that Oracle, well, has Oracle behind it–and while that isn’t an unqualified “win” due to their baggage, they’re probably going to have the resources to keep the project going if IBM shuts theirs down completely, or otherwise makes it much more difficult for community distros to follow them.

Oracle sure has the resources to continue the project - even if IBM-Red makes it difficult for them, I fully agree with that!

I also fully agree with the fact that Oracle does have “baggage”…

Then again, If depending on a Corporation (RH) doesn’t work out, move on to Corporation “O” to continue - this still leaves us Netherians dependant on the whims of a corporation for our foundation… We’re actually increasing our dependencies by a BIG factor this way… :frowning:

My 2 cents
Andy

Sorry to bug with the same question… “Docked” or “Podman”, as RedHat choose for RH8/CentOS8?

@pike

As a well known englishman wrote:
“A rose, by any other name…”
… is still a rose, with thorns, petals and all…

Docker / Podman are both variants of the same, as is LXC…

My 2 cents
Andy

The resources, the motivation, and the track record.

I don’t think we’re increasing them, but we certainly aren’t decreasing them.

1 Like

Quoting from the very premature prototype documentation with experiments for NS8 :

Operating System (OS) requirements

NS8 should run on a OS with the following features:

  • small footprint, x86_64 and aarch64
  • systemd to keeps things running
  • podman ≥ 2.2
  • support WireGuard VPN

AFIAK the latter (WireGuard) is not default on el8 but a kmod for it can be installed.

And yes, it runs on Debian too.

4 Likes

Read by yourself mates. NS8 could run on debian :wink:

6 Likes

I’ve always said, I trust the NethServer Devs way more than I trust IBM, RH and Oracle!
You guys rock!

My 2 cents
Andy

6 Likes

However it is a pandora box I think, a lot of issues will come but I love the way.

→ Coders, Devs and generally Guys on the cutting edge of technology NEED a decent challenge!

If the engine works, it doesn’t really matter to most of us if it was the “red gearwheel” or the “green” one which makes it tick!
The NethServer Forum “Benchmark” is a tough test, but I’ve no doubt the dev team will master this… :slight_smile:

My 2 cents
Andy

1 Like

Yeah I am not worried about that, I will learn, I will play, I will code.

My issue is for the community developers, when we left NethGui I recall a discussion about cockpit and the skill to play with it, npm, vuejs, bash, perl, php, python (less but it exists), webpack, javascript…and probably I forgot an half (I am kidding). The developer says with his words, PHP you can hack, javascript is for real developer (that it is not completely true)

But more you have complex things, more you need an elite.

My role (with @davidep) is to be a community manager for the community of developers, and I do what I can to help, hence my worries :smiley:

6 Likes

Some people prefer the easy route down the mountain,
I think our Stephdl prefers the one that offers a challenge!

-> Not only as a biker… :slight_smile:

Why? Same with most of us… …Because we can!

3 Likes

:scream: :see_no_evil: :hear_no_evil: :speak_no_evil:
I feel a great disturbance in the Force
Unless it will be part in one or two years of mobile device and desktop OS… I will consider that piece of software quite far from interesting or reliable.

OpenVPN works far better for me (it’s been tested, evolved, de-bugged) or L2TP/IPSec. Could be WireGuard a strong selling point? Maybe.
But currently, even with the “placet” of becoming part of Linux Kernel, i cannot feel reliable or… “better” than IPSec or OpenVPN.

2 Likes

WireGuard is in the Linux kernel source tree :grinning:

I do not think it is a replacement for openVPN on the user-side (jet), rather for a replacement for a IPSec tunnel

2 Likes

Which is practically part of IPv6? Seriously?

@mark_nl
@pike

Hi

Debunking Wireguard:

It IS intended as a replacement for both IPsec and OpenVPN, however:

WireGuard only uses UDP.
This is unlike alternatives like OpenVPN because of the many disadvantages of TCP over TCP routing.
UDP as the only transport is inadequate for hotels, conference centers or other public networks that restrict communication to common HTTP and HTTPS protocols.

Wireguard IS faster than IPsec and OpenVPN, it’s code base is also very small and apparently very neat (Linus Thorvalds: A work of art!).

There are not much options for encryption like OpenVPN or IPsec.

My Interpretation / Conclusions:

Wireguard is not a “One Fix” for all VPN Requirements, Road-Warriors will have issues with Hotels, restrictive WLans and elsewhere, where OpenVPN just works…
But it should not be neglected or ignored either, as Wireguard does have interesting possibilities…

My 2 cents
Andy

1 Like

Maybe it’s time to give an update on NethServer 8 status! :slight_smile:

We have been working for a while on a prototype. After some trial and error, we are shaping something that can keep running few test applications.
We are trying hard to be independent by the distribution and CPU architecture, but we still do not know if we will support one ore more distributions on the final version.

For now, these are roughly the system requirements to make it work:

We are currently developing it on Fedora 34 Server and Debian 11 Bullseye.

The system can be formed by one or more nodes.

Moving parts:

  • node/cluster/module agent is a software written in Golang
  • actions to configure the system are mainly written in Python and Bash
  • almost everything is saved inside Redis
  • WireGuard is used only to connect nodes (it’s very efficient, easy to setup and it can even be confined inside a container)
  • the UI is composed by an API server (Golang) and Carbon design system on top of VueJS
  • everything is distributed inside a container except for the install script which for now is a simple Bash script (but it will probably rewritten in the near future)

If you want to sneak peak, this is the whole source code. Please be aware that the documentation is already a bit outdated :smiley:

19 Likes