The Lego Mirror - Tech

Creating IPv4-only and IPv6-only containers with podman

2025-05-24T02:15:00+00:00

By default, newer versions of podman run containers with a dual stack network that supports IPv4 and IPv6 (yay). But if you're doing something specific, you can set up IPv4-only and IPv6-only networks.

(Note: I tested this all with rootless podman 5.5.0, the current version in Fedora 42.)

I'm primarily writing this because it took me a while to figure this out, I got entirely tripped up by the --ipv6 option which turned out to not be what I wanted, despite the name implying it enables IPv6.

The documentation for it is technically accurate, as it says:

Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet.

The most important part is in parenthesis — it enables a dual-stack network. Which means that passing --ipv6 when creating a network doesn't just enable IPv6, it also enables IPv4!

What you actually want is:

$ podman network create --subnet fd00::/64 --gateway fd00::1 ipv6-only

You can verify that IPv4 doesn't work by:

$ podman pull quay.io/curl/curl:latest
$ podman run --rm -it --net=ipv6-only curl -v4 https://en.wikipedia.org
* Host en.wikipedia.org:443 was resolved.
* IPv6: (none)
* IPv4: 208.80.154.224
*   Trying 208.80.154.224:443...
* Immediate connect fail for 208.80.154.224: Network unreachable
* Failed to connect to en.wikipedia.org port 443 after 13 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to en.wikipedia.org port 443 after 13 ms: Could not connect to server

And that IPv6 works:

$ podman run --rm -it --net=ipv6-only curl -I6 https://en.wikipedia.org
HTTP/2 301 
date: Fri, 23 May 2025 00:29:41 GMT
...

And now for IPv4, which is even simpler:

$ podman network create ipv4-only

Yep, no options needed, you just need a network in which IPv6 is not enabled by the subnet and doesn't pass the --ipv6 flag.

The default networking stack for rootless containers is documented (under "pasta") as "IPv4 and IPv6 addresses and routes, as well as the pod interface name, are copied from the host". In my testing this is correct, but this is an entirely separate thing from podman network that appears to exist by default, which is IPv4-only.

I ended up figuring out the whole misleading --ipv6 thing thanks to a GitHub comment, which explicitly spelled out "The --ipv6 flags means dual-stack", and even explained the rationale why: "this is fully compatible with docker ..."

I shouldn't be too surprised that Claude also got tripped up by the --ipv6 flag and gave me bad advice. ¯\_(ツ)_/¯

Final final note: if you try a plain podman run curl ... without first pulling the image, it won't know which image you actually want, and none of the three prompts it gives you (registry.fedoraproject.org, registry.access.redhat.com, docker.io/library) are the official upstream image. I've submitted a PR to the containers/shortnames repo to fix that, so a plain curl image name will automatically be aliased to the upstream image.

Switching feed readers

2025-04-08T23:10:00+00:00

I recently switched my RSS/Atom feed reader away from Tiny Tiny RSS and its companion Android app. I had fallen behind on upgrades on the server, and the app had been removed from F-Droid, so I needed to do something. I had set up Tiny Tiny RSS in 2017, so it was time for a fresh start.

I wanted a similar setup: a server that would maintain track of my subscriptions, articles and (un)read status, and then an Android app with a good UI and offline support. I do most of my feed reading on my phone these days, so I'm a bit more picky on that side.

Rachel (by the bay) recently praised the FreshRSS developers, so that was the first thing I tried out. And it worked...fine? I set up a container with podman, hooked it up to a MariaDB database (also in a container), and imported all my feeds.

Mostly for due dilligence, I tried out Miniflux next. It only supports postgres, which knocked it down a peg for me since I prefer MariaDB. I was really impressed with its feature to download content from the link instead of what's in the feed to "fix" feeds that truncate content.

Then I learned that FreshRSS has the same feature, just a little less automatic! FreshRSS requires you to manually enter a CSS selector, which so far has just been pretty trivial since it's either article or main. It also supports manual feed construction using XPath, which seems really cool, but I haven't gotten that far yet.

On my phone, I evaluated multiple apps: Capy Reader, Readrops and Flux News.

The main limitation I encountered with Readrops was not having a preview or snippet when viewing all the articles (example). I also found the "estimated reading time" indicators kind of patronizing with no way to disable them.

As far as I could tell, Flux News didn't have any support for offline reading.

I like Capy Reader, it's a clean UI that's similar enough to what I had with Tiny Tiny RSS. FreshRSS worked right away, but I couldn't get it to connect to Miniflux over the Google Reader API. I'm pretty sure it's a me problem, since others are using it with Miniflux just fine.

In any case, I tried out FreshRSS+Capy Reader for a week, and while I still need a bit more time to get used to it, I think it will meet my feed reading needs. So yesterday, after taking a backup, I shutdown my Tiny Tiny RSS server after more than 8 years in service 🫡. Here's to 8 more years of feed reading with FreshRSS and Capy Reader!

A website for Boba Quest 2025

2025-03-08T18:00:00+00:00

tl;dr: I've set up a new website for Boba Quest 2025 🧋: https://legoktm.com/bobaquest/.

Now that I have two months of reviews under my belt, I wanted to create a proper website to make it easy to discover them.

Taking inspiration from Everything is Everything, I wanted a similar layout with a big map of all the reviews and then explanations of the project itself.

I figured all of this could be built as a static site and a bit of JavaScript. I've had my eye on Zola for a while, since it's written in Rust and by the same author as Tera, my preferred templating library.

It ended up being a great fit, largely because it has builtin support for loading content from a TOML file via a load_data function. I store all of the review metadata in a single file, which drives the entire site.

My main criticism is that Zola doesn't support so-called "ugly URLs" like foo.html (it only supports foo/). I guess I'm weird in that, as this blog demonstrates, I like URLs that end with .html.

The last thing I did was set a Content-Security-Policy. It's relatively strict (I think), except for needing to allow style-src-elem 'unsafe-inline' because Leaflet's popups need it.

I started by asking Claude to generate such a website for me (chat transcript), and kept slowly refining with prompts. While normally Claude is really good at letting you preview HTML websites, its own CSP prevented any of the map tiles from loading so I had to copy it locally and preview it that way.

I'm reasonably proficient at HTML/CSS/JS, but this was a much more fun way to design a website. Instead of having to focus on syntax, I could just tell it to shape it how I wanted, plus making my own manual improvements here and there.

People, often rightfully so, criticize AI-generated content as lacking creativity, but I feel that using Claude allowed me to design the website exactly how I, a human, wanted it to look like, and not get bogged down fighting syntax things.

I eventually hit Claude's output limit (since it kept repeating the whole HTML file) and had to start branching off into individual chats, like adding an escape key handler and learning about vh units in CSS (big TIL for me). I hit the limit again when I added the "Recent reviews" sidebar.

That was roughly the point I checked it into Git, so you can browse how the initial version looked like. It's come quite a long way since then.

Simplifying PDF imports on reMarkable

2025-02-18T23:00:00+00:00

I've been using my reMarkable 2 a lot more recently, and have gotten started with actually hacking on it. It's a bit overdue, since the main reason I purchased it in the first place was that it is built on top of Linux and doesn't require any special jailbreaking/rooting.

I found Adrian Daerr's script to import PDFs/EPUBs into a reMarkable, which is surprisingly not a straightforward operation. You need to rename the file to use a UUID as its name, create corresponding .metadata and .content files, and then empty .cache, .highlights, and .thumbnails directories.

Daerr's bash script does all of this, except it runs on a different machine, and then scps the files over to the reMarkable. Modifying it to run on the reMarkable itself didn't seem too complicated, but I try to avoid writing shell scripts as much as possible, so I took the opportunity to port it to Rust.

I first asked Claude to port it to Rust, and, probably for the first time, I was disappointed by the result.

Specifically, it generated:

if args[1] == "-r" {
    restart_xochitl = !config.restart_xochitl_default;
    files_start_index =, 2;
}

I couldn't come up with a reason on why Claude would insert a comma after the equals sign (it's not really a hallucination I think?), but rust-analyzer flagged it as a syntax error right away.

I deleted most of that code anyways since I wanted to unconditionally restart, and also use camino instead. As an aside, std::path represents paths with OsString, which is incredibly inconvenient to use anywhere else, which'll expect normal UTF-8 Strings. camino only supports paths that are fully UTF-8 (aka String instead of OsString), which should be fine for most projects that don't need to support legacy files and encodings, like this one.

Next, I had to cross-build it for the reMarkable's ARM v7 CPU. I've done it before for Raspberry Pis, but since it's been a while, I wanted to try out the cross tool, which transparently builds in a container with the necessary toolchains. And if you set a little bit of metadata, it's as simple as cross build --release.

To make the newly imported file actually show up in the reMarkable file listing, you apparently have to restart the entire thing, which does work, but surely there's a better way to tell it to look for new files...

Finally, to actually make use of it, I set up rclone to automatically fetch a folder from my Nextcloud instance, and then run rm-import over it. And now I can drop a PDF in a dedicated Nextcloud folder, and it'll end up on my reMarkable!

Claude to Markdown browser extension

2025-02-11T05:37:00+00:00

tl;dr: A new browser extension allows you to automatically export Claude transcripts to Markdown. You can install it for Firefox.

Claude is the primary LLM I use these days, but they don't have a builtin way to share your sessions, which I find pretty useful to learn from. Simon Willison had previously posted a notebook with code to convert a JSON response to a nicely formatted Markdown transcript. But the process was pretty cumbersome, you need to open up the network console, find a specific request, and then copy the JSON out of it. But on a technical level, that should be pretty straightforward to automate...right?

I asked Claude, of course, and it created a WebExtension that automatically grabbed the specific JSON response necessary, and displays it to the user. I plugged in Simon's code to turn it into markdown, and huzzah!

When you reload the tab with Claude in it, or select a different conversation, their frontend will send a request with the full JSON contents, which the extension intercepts and stores for display in the popup. It doesn't (yet) support live updating as you send new messages or replies come in.

As a bonus, I had Claude add functionality to upload the transcript as a GitHub Gist. So you can see the full transcript of the conversation used to create the extension, uploaded by itself.

This is not a super novel idea, there are other extensions in the Firefox and Chrome stores that puport to have similar functionality, but I didn't immediately find any open source ones. I also wanted to refresh my knowledge on WebExtensions; it's been seven years since I last created one.

Overall I'd estimate Claude turned something that would've taken me ~5 hours to do from scratch into a 1-2 hour project, and even then most of that time was spent manually testing and verifying the functionality versus actually writing code. The original version was not perfect, I had to make some changes like adding a content-security-policy and removing extraneous permissions. Unsurprisingly it used manifest_version 2 instead of the newer v3, even though all the code it created was compatible with the v3 requirements.

I hope this is useful for others, you can install it in Firefox and browse the source code. In theory it should be compatible with other browsers, but I haven't tested it; the .zip bundle with the extension is uploaded as a release.

How many Rs are in the word strawberry?

2024-08-10T04:08:12+00:00

There's a viral Mastodon post that demonstrates a supposed deficiency in large language models (LLMs), specifically ChatGPT, because it apparently can't count the number of letters in the English word "strawberry".

> How many R's are in the word strawberry

ChatGPT: There are two "R's" in the word "strawberry."

> Are you sure?

ChatGPT: Yes, I'm sure. There are two "R's" in the word "strawberry."

[...]

> Count the Rs in the word straw and the word berry separately.

ChatGPT: Sure. Let's break it down:

* The word "straw" has 1 "R."
* The word "berry" has 2 "R's."

So, together they have 3 "R's." But in the combined word "strawberry," there are still only 2 "R's."

At first glance, that's a big yikes. (I was able to reproduce the inital result using ChatGPT 4o.)

But I get annoyed by this kind of post for two main reasons: 1) if you ask slightly differently, ChatGPT can easily get this question right, and 2) it's a missed opportunity to explain how LLMs work, specifically with regards to tokenization.

Here's the prompt I used with ChatGPT 4o:

> Write and then run a Python program to determine how many R's are in the word strawberry

ChatGPT: The word "strawberry" contains 3 occurrences of the letter 'R'.

It's not really well known that ChatGPT has a feature to execute Python code in a sandbox and use the result in answers.

The Python code it generated was:

# Python program to count the number of 'R's in the word 'strawberry'

word = "strawberry"
count_Rs = word.lower().count('r')  # Convert the word to lowercase and count 'r'
count_Rs

The code is pretty simple, and I think we'd all agree that this is a place where Python code can quite accurately answer this question. Having the LLM generate the code and execute it nicely sidesteps the underlying issue.

Of course, the problem is you have to prompt it to use Python in the first place, knowing that this is a subject where an LLM without code execution would fail. Which brings me to...

When you provide a prompt for an LLM, it breaks down each word into tokens. OpenAI provides a visualization tool for this; you can see that using the GPT-4 tokenizer, the string "strawberry" is broken down into "str", "aw" and "berry", which get transformed to numerical values of [496, 675, 15717]. Or in other words, the LLM doesn't have access to individual characters, it just sees the tokens.

In this case, you can try to bypass the tokenizer by using spaces, so each letter is now its own word and tokenized separately:

> How many r characters are in the letters s t r a w b e r r y

ChatGPT: The word "strawberry" contains 3 instances of the letter "r."

Success, though I've had mixed success with approach this in the past.

There are plenty of problems, both technically and ethically, with LLMs and I don't want to be (or even appear to be) an apologist for them. But I think it's important that we all understand how LLMs work to actually tackle and address those problems.

Side quest: creating a "main" tool

2024-07-18T00:57:56+00:00

I like Simon Willison's framing of using large language models (aka LLMs, aka "AI") to enable side quests of things you wouldn't normally do.

Could I have done this without LLM assistance? Yes, but not nearly as quickly. And this was not a task on my critical path for the day—it was a sidequest at best and honestly more of a distraction.

So, yesterday's side quest: writing a tool that checks out the default branch of a Git repository, regardless of what it's named.

Context: most of my work these days happens on GitHub, which involves creating PRs off the main branch, which means I'm frequently going back to it, via git checkout main and then usually a git pull to fast-forward the branch.

But just to make things a little more interesting, the SecureDrop server Git repository's main branch is named develop, which entirely screws with muscle memory and autocomplete. Not to mention all the older projects that still use a master branch.

For a while now I've wanted a tool that just checks out the main branch, regardless of what it's actually named, and optionally pulls it and stashes pending changes.

I asked Claude 3.5 Sonnet for exactly that:

I want a Rust program named "main" that primarily checks out the main branch of a Git repository (or master if it's called that).

I want to invoke it as:

main - just checkout the main branch

main stash - stash changes, then checkout main, then pop the stash

main pull - checkout main and then git pull

main stash pull or main pull stash - stash changes, checkout main, then pull, then pop the stash

It was mostly there, except it hardcoded the main and master branches intead of looking it up via Git. I asked:

Is there a smarter way to determine the main branch? What if it's called something other than main or master?

And it adjusted to checking git symbolic-ref refs/remotes/origin/HEAD, which I didn't know about.

I cleaned up the argument handling a little bit, added --version and published it on Salsa.

It took me about 5-10 minutes for this whole process, which according to xkcd is an efficiency positive (saves 1 second, but I do it ~5 times a day) over 5 years.

It probably would've taken me 2-3x as long without using an LLM, but honestly, I'm not sure I would've ever overcome the laziness to write something so small.

Anyways, so far I haven't really gotten around to writing about my experiences and feelings about LLMs yet, so here's literally the smallest piece of work to kick that off.

Running the ArchiveTeam Warrior under Podman

2024-07-08T03:48:43+00:00

I'm finally back on an unlimited internet connection, so I've started running the ArchiveTeam Warrior once again.

The Warrior is a software application for archiving websites in a crowdsourced manner, especially when there's a time crunch when a website announces that it's closing or planning to delete things. Currently the default project is to archive public Telegram channels.

Historically the Warrior was distributed as a VirtualBox appliance, which was a bit annoying to run headlessly and was unnecessarily resource intensive because it required full virtualization. But they now have a containerized version that is pretty trivial to set up.

Relatedly, I've recently been playing with Podman's "Quadlet" functionality, which I really, really like. Instead of needing to create a systemd service to wrap running a container, you can specify what you want to run in a basically systemd-native way:

[Unit]
Description=warrior

[Container]
Image=atdr.meo.ws/archiveteam/warrior-dockerfile

PublishPort=8001:8001

Environment=DOWNLOADER=<your name>
Environment=SELECTED_PROJECT=auto
Environment=CONCURRENT_ITEMS=4

AutoUpdate=registry

[Service]
Restart=on-failure
RestartSec=30
# Extend Timeout to allow time to pull the image
TimeoutStartSec=180

[Install]
# Start by default on boot
WantedBy=multi-user.target default.target

I substituted in my username and dropped this into ~/.config/containers/systemd/warrior.container, ran systemctl --user daemon-reload and systemctl --user start warrior and it immediately started archiving! Visiting localhost:8001 should bring up the web interface.

You can then run systemctl --user cat warrior to see what the generated .service file looks like.

The AutoUpdate=registry line tells podman-auto-update to automatically fetch image updates and restart the running container. You'll likely need to enable/start the timer for this, with systemctl --user enable podman-auto-update.timer.

The one thing I haven't figured out yet is gracefully shutting down, which is important to avoid losing unfinished data. I suspect the Restart=always is harmful here, since I do want to explicitly shutdown in some cases.

P.S. I also have a infrequently updated Free bandwidth wiki page that contains other suggestions for how to use your internet connection for good.

Update (2024-07-14): I changed the restart options to Restart=on-failure and RestartSec=30, which fixes the issue with restarting immediately after a graceful shutdown and correctly restarting if it starts up before networking is ready.

Basic anti-abuse monitoring for Mastodon

2024-06-26T00:12:52+00:00

Back in February, Mastodon and the connected Fediverse faced a spam attack caused by unattended instances with an open signup policy. Bots quickly registered accounts and then sent spammy messages that were relayed through the Fediverse.

It was annoying and the normal moderation tool of limiting or blocking entire instances wasn't effective since the attackers were coming from a wide set of places. Since then people have developed shared blocklists that you can subscribe to, but that has its own downsides.

So here's the tool I developed that we used for wikis.world: masto-monitor.

The workflow is straightfoward:

Poll the federated timeline for all public posts
Check them against a manually curated list of patterns
If there's a match, report it using the API

This allows us to have an automated process checking all incoming posts while still enabling humans to make any moderation decisions.

The code itself is pretty straightforward that it doesn't really merit much explanation. The matching logic is very very basic, it just looks for substring matches. I think the approach is worth developing further, allowing people to write more expressive rules/filters that trigger automated reports.

But, I'm not planning to do so myself since we don't currently have a need, so people are welcome to fork it to enhance it.

Implementing search for my blog in WebAssembly

2024-06-08T05:18:24+00:00

If you visit my blog (most likely what you're reading now) and have JavaScript enabled, you should see a magnifying glass in the top right, next to the feed icon. Clicking it should open up a search box that lets you perform a very rudimentary full-text search of all of my blog posts.

It's implemented fully client-side using Rust compiled to WebAssembly (WASM), here's all the code I added to implement it.

At a high level, it:

Splits all blog posts into individual words, counts them, and dumps it into a search index that is a JSON blob.
Installs a click handler (using JavaScript) that displays the search bar and lazy-loads the rest of the WASM code and search index.
Installs an input handler (using WASM) that takes the user's input, searches through the index, and returns up to 10 matching articles.

The search algorithm is pretty basic, it gives one point per word-occurence in the blog post, and 5 points if the word is in the title or a tag. Then it sorts by score, and if there's a tie, by most recently published.

There's no stemming or language processing, the only normalization that happens is treating everything as lowercase.

I've played with WASM before but this is the first time I've actually deployed something using it. As much as I enjoyed writing it in Rust, the experience left something to be desired. I had to use a separate tool (wasm-bindgen) and load a pre-built JavaScript file first that then let me initialize the WASM code.

The payload is also ...heavy:

search.js: 5.53kB (23.63kB before gzip)
search_bg.wasm: 53.78kB (122.82kB before gzip)
search_index.json: 323.13kB (322.76kB before gzip)

I'm not sure why the index compresses so poorly with Apache, locally it goes down to 100kB. (I had briefly considered using a binary encoding like MessagePack but thought it wouldn't be more efficient than JSON after compression.) And of course, the more I write, the bigger the index gets, so it'll need to be addressed sooner rather than later. I think any pure-JavaScript code would be much much smaller than the WASM bundle.

The Lego Mirror - Tech

Creating IPv4-only and IPv6-only containers with podman

Real IPv6-only#

IPv4-only#

Final notes#

Switching feed readers

A website for Boba Quest 2025

Creating a static site#

Not handwritten#