If you are like me, coding LLMs made open source more important not less. A few months ago I wanted to see how far I could get using minimal LLM cost (local on two 3090s and one subscription) to automate OSS containers with a build recipe that matched bits.
That project ended up as ReadyStack.dev. ReadyStack publishes free Community Edition containers for open-source applications. I designed it to be a low cost image standard that puts provenance as a first order concern.
My goal was to see if I could build in trust with my images in a way nobody else had. Use the build recipe and match bits. Each release's build kit includes everything the build needs: upstream source pinned, the OS packages as .debs, the language dependencies, the base images saved by digest, fixed SOURCE_DATE_EPOCH. BUILD_OFFLINE.sh rebuilds with the network off, so mirrors dropping old packages don't matter, and VERIFY_OFFLINE.sh checks your digest against ours.
We currently have 101 of 101 releases reproducing their published linux/amd64 digest in our clean-room rebuild process, which is just a trust signal, but an important one as we don't have much of, if at all. Certainly, not for free.
For full disclosure, I built a sister project, ce.rodeo, which grades container images from all publishers, including ReadyStack.dev. Yes, it is a conflict of interest to grade my own images. I publish the measuring criteria and I needed a standard of what existed so I had to create a grading system first. Happy to hear suggestions.
I started out to do something for OSS. I designed it to run on a skinny budget and it is doing that. It runs on donations, so far just mine.
The bigger idea is that open-source software should be having its greatest era now that everyone has a DevOps genius at their fingertips. I chose to take a leap and build a platform to be part of that.
Happy to answer questions.
Comments URL: https://news.ycombinator.com/item?id=50469853
Points: 1
# Comments: 0
