Paweł Gronowski

🐇🐇
Senior Software Engineer @ Docker Inc.
Maintainer of Docker Engine (moby)
Open source | Containers | Linux

[Paweł Gronowski @grono_dev]

What I learned from patching Docker Engine default seccomp profile for CVE-2026-31431 (Copy Fail)

1. If a seccomp rule already filters an argument (like AF_VSOCK), it's just a matter of adding a second negation for the AF_ALG, right?

Wrong!

These are two rules that ...

[Paweł Gronowski @grono_dev]

@pablos_83 To chyba przeze mnie, parę dni temu wymaksowałem IKE i się obkupiłem

[Paweł Gronowski @grono_dev]

@Piechocinski Czyli, wiceminister powiedział, że najbogatsi Polacy nie są podatnikami 🫠

Bo jak inaczej miliarderzy (których nawet nie dotyczy 2 próg) mieliby na tym skorzystać?

[Armin Ronacher ⇌ @mitsuhiko]

In case you are in the camp of “Andrew Tridgell is vibefucking rsync” please read this.l and adjust your priors. https://t.co/gyUvFNma1T

[Paweł Gronowski @grono_dev]

@gregpr07 How do you feel about it silently downloading binaries off the internet and installing stuff via npm?

[Pope Leo XIV @Pontifex]

Deep inner suffering inevitably arises when the human person is reduced to performance, consumption, or a statistical datum. Many young people today live under the yoke of expectations to perform, immersed in an exasperated competitiveness that generates anxiety, fear of not measuring up, and disorientation.

[Paweł Gronowski @grono_dev]

@tsoding You can also say that about a situation/thing, then it would mean that it got very seriously fucked up

[Paweł Gronowski @grono_dev]

Why the heck is almost every LSP written in Node

[Paweł Gronowski @grono_dev]

As much as I'd like to move off Vim... every editor is either a bloated mess or a security nightmare.

I really wanted to move to Zed but the silent "npm" installs really threw me off.

Looks like neovim is not leaving my toolset any time soon

[Paweł Gronowski @grono_dev]

@valigo So you're saying that:

Linux distro packagers:
> subject ANYONE who wants to use Zed even for Rust/C/C++ programming to security nightmare that is npm.

while

> Zed is a little bit to blame here

.

Are you serious?

[Paweł Gronowski @grono_dev]

OpenDivine is a WIP open-source engine for running Divine Divinity

Follow #opendivine here: https://t.co/npNJEhPMaQ

[Akihiro Suda (@[email protected]) @_AkihiroSuda_]

Wrote a blog: Improvements to Rootless mode in Docker v29.5

https://t.co/8cbGXw8pKM

- Faster image pulling and pushing
- Support for `docker run --net=host`
- Support for localhost registries
- Source IP propagation without the legacy slirp4netns dependency

[Paweł Gronowski @grono_dev]

@Kpelczynska Katastrofa demograficzna Polaków to niewygórowana cena za nabicie kabzy deweloperom

[Paweł Gronowski @grono_dev]

Code Blocks? Dev-C++?!?!?

Jezu, wy tak zdajecie matury? ;o

#matura

[Paweł Gronowski @grono_dev]

@ZgranyTyp Nie do końca RPG, ale legendarne Knights & Merchants (w formie KaM Remake)

[Paweł Gronowski @grono_dev]

@_L4ys -1days

[Paweł Gronowski @grono_dev]

@TRad_Krk Eh. Za moich czasów to takie były na podstawie.

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Paweł Gronowski @grono_dev]

@D1iv3 Ah, so nice of the Docker folks

[Paweł Gronowski @grono_dev]

Made some progress, player character sprite composition and animations are working!

#opendivine

[Paweł Gronowski @grono_dev]

I was bored this weekend so I've started to reimplement Divine Divinity game engine (basically like OpenMW does with Morrowind, still requires original game content)

Can already fly over Ferol!

#opendivine