It’s not an either-or scenario. Running services in Docker/Podman is great and makes a lot of sense, as you’ve found. But there’s no reason the OS running those Docker containers can’t be a VM on a hypervisor like Proxmox. Then you get the simplicity of Docker, in addition to the isolation and segmentation (network and process) provided by VMs, and snapshot-based incremental backups from PBS. It’s the best of both worlds. You wouldn’t have a VM per service like you ran before, instead you’d have a VM per group of related services with common networking and security requirements. For example, all of your publicly exposed services can run in Docker in their own isolated VM that’s walled off from the rest of your network, while your internal-only services also run in Docker, but on a separate VM on your internal network.

Should be, but it’s not. It’s discrimination, but discrimination is perfectly legal as long as it’s not done on the basis of one of the handful of protected classes (race, sex, religion, etc.)

By that logic, all gambling is just prediction

All while living in that Democrat-controlled area because it’s much nicer than the Republican hellhole they keep clamoring for

It’s financial obesity, and should be treated as such

It didn’t take long to go from “corporations are people” to “the only people that matter are corporations”

In general, you take the model size in billions of parameters (eg: 397B), divide it by 2 and add a bit for overhead, and that’s how much RAM/VRAM it takes to run it at a “normal” quantization level. For Qwen3.5-397B, that’s about 220 GB. Ideally that would be all VRAM for speed, but you can offload some or all of that to normal RAM on the CPU, you’ll just take a speed hit.

So for something like Qwen3.5-397B, it takes a pretty serious system, especially if you’re trying to do it all in VRAM.

1. Tesla is a car company
2. Tesla is a battery company
3. Tesla is a robot company <---- you are here
4. Tesla is a company

One can hope at least

The fact that this reponse has 1 downvote is *chef’s kiss*

On iOS, it uses your linked credit card to verify you’re over 18, and then passes a “this user is over 18” flag to any app or website that needs it. It’s arguably the least intrusive or insecure way to handle this push from the EU.

And his moronic supporters think this is a good thing, because it’s “saving them money”

But who writes bash scripts to do math?

A full script? Nobody. But you can just run it interactively on the command line, which a lot of AI clients have access to. bc works great for basic math in the shell.

Interestingly, AI is actually pretty good at making graphs, the trick is you don’t ask it to actually make the graph itself. Instead you have to ask it to write a python script to create a graph using matplotlib from whatever source file contains the data, then run that script. Same with math. Don’t ask it to do math directly, instead ask it to write a bash or python script to do some math, then run that. Still not perfect, but your success rate increases by about 1000%

Who cares if it’s exposed to the internet?

1. Encrypting your local traffic is still valuable to protect your systems from any bad actors on your local network (neighbor kid cracks your wifi password, some device on your network decides to start snooping on your local traffic, etc)

2. Many services require HTTPS with a valid cert to function correctly, eg: Bitwarden. Having a real cert for a real domain is much simpler and easier to maintain than setting up your own CA

Why are you having to update your DNS records when you add a new service? Just set up a wildcard A record to send *.myserver.com to the reverse proxy and you never have to touch it again. If your DNS doesn’t let you set wildcard A records, then switch to a better DNS.

I didn’t use to, but I do now. Debian on everything (except the Proxmox servers, but Proxmox is basically Debian too)

You clearly have absolutely zero experience here. When you’re prompted for access, it tells you the exact command that’s going to be run. You don’t just give blind approval to “run something”, you’re shown the exact command it’s going to run and you can choose to approve or reject it.

if you’re denying access to your agentic AI, what is the point of it? It needs access to complete agentic tasks.

Yes, which it can prompt you for. Three options:

1. Deny everything
2. Prompt for approval when it needs to run a command or write a file
3. Allow everything

Obviously optional 1 is useless, but there’s nothing wrong with choosing option 2, or even option 3 if you run it in a sandbox where it can’t do any real-world damage.

Only if the user has configured it to bypass those authorizations.

With an agentic coding assistant, the LLM does not decide when it does and doesn’t prompt for authorization to proceed. The surrounding software is the one that makes that call, which is a normal program with hard guardrails in place. The only way to bypass the authorization prompts is to configure that software to bypass them. Many do allow that option, but of course you should only do so when operating in a sandbox.

The person in this article was a moron, that’s all there is to it. They ran the LLM on their live system, with no sandbox, went out of their way to remove all guardrails, and had no backup. The fallout is 100% on them.

The absolute narcissism in this take is mind-boggling. “I don’t do anything that needs more than 32 GB of RAM, therefore you don’t either”