Coder Legion - Recent posts tagged run

Understanding Systemd.exec - Part 1: How to Secure Applications Running in Systemd?

Sat, 02 May 2026 02:27:26 +0000

Hello, I'm Ganesh. I'm building git-lrc, an AI code reviewer that runs on every commit. It is free, unlimited, and source-available on GitHub. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product.

If you are running applications with systemd and want to restrict how they interact with Linux kernel features (like filesystem, processes, and capabilities), you can use the systemd.exec configuration options.

In this article I will be going to explain how to use these options to secure your application.

What are systemd.exec options?

Systemd.exec options are a set of configuration options that are used to configure how a systemd service interacts with the Linux kernel.

This feature is mainly used to provide security for the applications running in systemd.

Why we need this option in first place?

Hardening services (Postgres, Nginx, workers, etc) which are mostly open to the internet
Reducing blast radius after compromise
Lightweight (no container overhead)

How is this different from Docker?

Works on a single process/service.
Applies restrictions on top of the host.
Uses kernel features (namespaces, cgroups, capabilities)
Shares the same root filesystem (by default)
No packaging, no images

What is the real usecase?

Let's take an example of service.

/etc/systemd/system/myapp.service

Inside this file, we can control:

Where the app runs
Which user it runs as
What it can access
How secure / isolated it is
What resources it can use

Most common options

Run a service as non-root (security)

Set User= Group= to a non-privileged user (e.g. postgres, www-data).
This will prevent the service from running as root, which can lead to security vulnerabilities.

For example:

[Service]
User=postgres
Group=postgres

Restrict filesystem access

Set ProtectSystem= ProtectHome= ReadWritePaths= ReadOnlyPaths= to control filesystem access.
This will make service only read/ write specifed directory.

Example:

[Service]
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/postgresql
ReadOnlyPaths=/var/lib/postgresql/16/bin

Isolate runtime environment (like lightweight container)

Set PrivateTmp=yes NoNewPrivileges=yes to isolate runtime environment.
As there is no container like docker this will be running in the host but under private tmp and no new privileges.

Example:

[Service]
PrivateTmp=yes
NoNewPrivileges=yes

Limit resources (avoid abuse / crashes)

Set CPUQuota= MemoryMax= MemoryHigh= MemoryLimit= MemoryAccounting= to limit resources.
If we want specific service to use only limited resources, we can use these options.

Example:

[Service]
CPUQuota=50%
MemoryMax=512M

Provide controlled writable directories Set ReadWritePaths= ReadOnlyPaths= to control filesystem access. This will make service only read/ write specifed directory.

Example:

[Service]
ReadWritePaths=/var/lib/postgresql
ReadOnlyPaths=/var/lib/postgresql/16/bin

Drop dangerous privileges

Set CapabilityBoundingSet= to drop dangerous privileges.
This will make service only able to run commands with specific privileges.

Example:

[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

Run temporary / ephemeral services Set RuntimeDirectory= StateDirectory= LogsDirectory= to run temporary / ephemeral services. This will run the service in a temporary / ephemeral directory.

Example:

[Service]
RuntimeDirectory=myapp
StateDirectory=myapp
LogsDirectory=myapp

Limit process / thread count Set TasksMax= to limit process / thread count. This will make service only able to run with specific process / thread count.

Example:

[Service]
TasksMax=100

Restrict access to system calls Set SystemCallFilter= SystemCallArchitectures= to restrict access to system calls. This will make service only able to use specific system calls.

Example:

[Service]
SystemCallFilter=open,read,write,close
SystemCallArchitectures=amd64

Security measures for Docker Engine Set Delegate=yes to run Docker Engine with specific privileges. This will make Docker Engine only able to run with specific privileges.

Example:

[Service]
Delegate=yes

Conclusion

We could able to use systemd.exec options to secure application running in systemd.

But Until we integrate with real application and test these options, we can't be sure about the security.

In the next article we will see how service react with integrations of these options.

Reference Man Page Systemd : https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html

Any feedback or contributors are welcome! It’s online, source-available, and ready for anyone to use.
⭐ Star it on GitHub: https://github.com/HexmosTech/git-lrc

Understanding Interface in Go

Tue, 31 Mar 2026 22:11:11 +0000

Hello, I'm Ganesh Kumar. I'm working on git-lrc: a Git hook for Checking AI generated code.AI agents write code fast. They also silently remove logic, change behavior, and introduce bugs -- without telling you. You often find out in production.git-lrc fixes this. It hooks into git commit and reviews every diff before it lands. 60-second setup. Completely free.

In my previous post, I explained how methods works.

In this article we will understand how to work with interface.

What is an interface?

An interface is a type that defines a set of methods. It is used to define a contract for a type. It is an abstract signature of a type where we define the methods but not the implementation.


package main

import "fmt"

type shape interface {
    area() float64
}

type rectangle struct {
    width, height float64
}

func (r rectangle) area() float64 {
    return r.width * r.height
}

func main() {
    rect := rectangle{width: 10, height: 20}
    fmt.Println(rect.area())
}

Output:

gk@jarvis:~/exp/code/rd/go-exmaple$ go run main.go 
200

Interface are container which contains two properties.

Dynamic Type
Dynamic Value

Dynamic Type and Dynamic Value

Dynamic type is the type of the value stored in the interface.

package main

import "fmt"

func main() {
    // 'i' is an empty interface. Currently, both its dynamic type and value are nil.
    var i any 
    fmt.Printf("Value: %v \t Type: %T\n", i, i)

    // Now we assign an integer to it.
    // Dynamic Type becomes 'int', Dynamic Value becomes '42'
    i = 42
    fmt.Printf("Value: %v \t Type: %T\n", i, i)

    // Now we assign a string to it.
    // Dynamic Type becomes 'string', Dynamic Value becomes "Hello"
    i = "Hello"
    fmt.Printf("Value: %v \t Type: %T\n", i, i)

    // Now we assign a float to it.
    // Dynamic Type becomes 'float64', Dynamic Value becomes 3.14
    i = 3.14
    fmt.Printf("Value: %v \t Type: %T\n", i, i)
}

Output:

gk@jarvis:~/exp/code/rd/go-exmaple$ go run main.go 
Value: <nil>     Type: <nil>
Value: 42        Type: int
Value: Hello     Type: string
Value: 3.14      Type: float64

We can see that the dynamic type and dynamic value changes based on the value assigned to the interface.

Dynamic Type and Dynamic Value using reflection

This is another way to get the dynamic type and dynamic value.

package main

import (
    "fmt"
    "reflect"
)

// A custom struct
type User struct {
    Name string
}

func main() {
    var data interface{} = User{Name: "Alice"}

    // Extracting the dynamic type
    dynamicType := reflect.TypeOf(data)

    // Extracting the dynamic value
    dynamicValue := reflect.ValueOf(data)

    fmt.Println("Reflect Type:", dynamicType)         // main.User
    fmt.Println("Reflect Value:", dynamicValue)       // {Alice}

    // You can even check the underlying "Kind" (e.g., struct, int, ptr)
    fmt.Println("Kind of Type:", dynamicType.Kind())  // struct
}

Output:

gk@jarvis:~/exp/code/rd/go-exmaple$ go run main.go 
Reflect Type: main.User
Reflect Value: {Alice}
Kind of Type: struct

This way we can get the dynamic type and dynamic value using reflection.

Type Assertion

Type assertion is used to extract the dynamic value from the interface.

This is the basic way to use type assertion.

We try to extract the dynamic value from the interface. As, go is a static typed language, it will throw an error if the dynamic type is not the same as the type we are trying to extract.

package main

import "fmt"

func main() {
    var i interface{} = "Hello"

    s := i.(string)
    fmt.Println(s)

    s, ok := i.(string)
    fmt.Println(s, ok)

    f, ok := i.(float64)
    fmt.Println(f, ok)

    f = i.(float64)
    fmt.Println(f)
}

If we try to extract the dynamic value from the interface with a different type, it will throw an error.

To avoid this we first check if the dynamic type is the same as the type we are trying to extract.

Output:

gk@jarvis:~/exp/code/rd/go-exmaple$ go run main.go 
Hello
Hello true
0 false
panic: interface conversion: interface {} is string, not float64

Usage of Type Switch

Based on the dynamic type, we can extract the dynamic value from the interface.

package main

import "fmt"

func printTypeAndValue(i interface{}) {
    fmt.Printf("Type: %T\tValue: %v\n", i, i)
    switch i.(type) {
    case int:
        fmt.Printf("it is int %v\n", i)
    case string:
        fmt.Printf("it is string %v\n", i)
    case bool:
        fmt.Printf("it is bool %v\n", i)
    default:
        fmt.Printf("unknown")
    }
}

func main() {
    // 'i' is an empty interface. Currently, both its dynamic type and value are nil.
    printTypeAndValue("Hello")
    printTypeAndValue(42)
    printTypeAndValue(true)
}

Now we can see that based on the dynamic type, we can extract the dynamic value from the interface. We can print the value base on the dynamic type.

Output:

gk@jarvis:~/exp/code/rd/go-exmaple$ go run main.go 
Type: string    Value: Hello
it is string Hello

Conclusion

In this article we understood how interface works. We also understood how to use type assertion and type switch.

Check out: git-lrc
Any feedback or contributors are welcome! It’s online, open-source, and ready for anyone to use.
⭐ Star it on GitHub:

HexmosTech / git-lrc

Free, Unlimited AI Code Reviews That Run on Commit

git-lrc

Free, Unlimited AI Code Reviews That Run on Commit

AI agents write code fast. They also silently remove logic, change behavior, and introduce bugs -- without telling you. You often find out in production.

git-lrc fixes this. It hooks into git commit and reviews every diff before it lands. 60-second setup. Completely free.

See It In Action

See git-lrc catch serious security issues such as leaked credentials, expensive cloud

Democratizing AI: How DeepSeek’s Minimalist Models Deliver Enterprise-Grade Results

Thu, 27 Feb 2025 21:19:32 +0000

(A Technical Deep Dive for Resource-Constrained Environments)

Introduction: The Rise of Small-Scale AI

DeepSeek’s latest optimizations prove you don’t need enterprise-grade hardware to harness advanced AI. Developers have refined smaller models like DeepSeek-R1 (8B) and DeepSeek-V2-Lite (2.4B active params) to run efficiently on modest setups—think laptops and entry-level GPUs—while delivering surprising performance. Here’s why this matters:

Why Minimal DeepSeek?

Lightweight & Efficient: The 8B model runs on 16GB RAM and basic CPUs, while quantized versions (e.g., 4-bit) cut VRAM needs by 75%.
Developer-Friendly: Simplified installation via Ollama or Docker—no complex dependencies.
Cost-Effective: MIT license and open-source weights enable free local deployment.
Performance: Outperforms larger dense models in coding, math, and reasoning tasks.

Evolution of DeepSeek Minimal

Architectural Breakthroughs

Sparse Activation: Only 2.4B/8B parameters active per inference (vs dense 70B models).
Hybrid Attention: Combines grouped-query and sliding-window attention to reduce VRAM by 40%.
Dynamic Batching: Adaptive batch sizing prevents OOM errors on low-RAM devices.

Quantization Milestones

Developers achieved near-lossless compression through:

Technique	Memory Savings	Performance Retention
4-bit GPTQ	75%	98% of FP32
8-bit Dynamic (IQ4_XS)	50%	99.5% of FP16
Pruning + Distillation	60%	92% of original

Installation and Deployment

1. How to Install Quickly (Under 5 Minutes)

Advanced Optimization:

Use FP16 quantization: ollama run deepseek-r1:8b --gpu --quantize fp16
Reduce batch size to lower RAM usage.

Ollama Quickstart:

curl -fsSL https://ollama.com/install.sh | sh  # Install Ollama  
ollama run deepseek-r1:8b                     # Pull 8B model

Test immediately in your terminal or integrate with Open WebUI for a ChatGPT-like interface.

2. Bare-Metal Deployment

Requirements: x86_64 CPU, 16GB RAM, Linux/WSL2

git clone https://github.com/deepseek-ai/minimal-deploy  
cd minimal-deploy && ./install.sh --model=r1-8b --quant=4bit

Key Flags:

--quant: 4bit/8bit/fp16 (4bit needs 8GB VRAM)
--context 4096: Adjust for long-document tasks

Cloud-Native Scaling

Deploy on AWS Lambda (serverless) via pre-built container:

FROM deepseek/minimal-base:latest  
CMD ["--api", "0.0.0.0:8080", "--quant", "4bit"]

Cost Analysis:

1M tokens processed for $0.12 vs $0.48 (GPT-3.5 Turbo)

Developer Improvements: Cleaner, Smarter, Faster

Recent updates showcase the community’s focus on efficiency:

Load Balancing: DeepSeek-V3’s auxiliary-loss-free strategy minimizes performance drops during scaling.
Quantization: 4-bit models (e.g., IQ4_XS) run smoothly on 24GB GPUs.
Code Hygiene: PRs pruning unused variables and enhancing error handling.
Distillation: Smaller models like DeepSeek-R1-1.5B retain 80% of the 70B model’s capability at 1/50th the size.

Model	Hardware	Use Case
DeepSeek-R1-8B	16GB RAM, no GPU	Coding, basic reasoning
DeepSeek-V2-Lite	24GB GPU (e.g., RTX 3090)	Advanced NLP, fine-tuning
IQ4_XS Quantized	8GB VRAM	Low-latency local inference

Why Developers Love This

Privacy: No cloud dependencies—data stays local.
Customization: Fine-tune models with LoRA on consumer GPUs.
Cost: Runs 1M tokens for ~$0.10 vs. $0.40+ for cloud alternatives.

🔧 Pro Tip: Pair with Open WebUI for a polished interface:

docker run -p 9783:8080 -v open-webui:/app/backend/data ghcr.io/open-webui/open-webui:main

Real-World Use Cases

Embedded Medical Diagnostics

A Nairobi startup runs DeepSeek-V2-Lite on Jetson Nano devices:

97% accuracy identifying malaria from cell images
300ms inference time using TensorRT optimizations

Low-Code AI Assistants

from deepseek_minimal import Assistant  
  
assistant = Assistant(model="r1-8b", quant="4bit")  
response = assistant.generate("Write Python code for binary search")  
print(response)  # Outputs code with Big-O analysis

Future Directions

TinyZero Integration: Merging Jiayi Pan’s workflow engine for automated model updates
RISC-V Support: ARM/RISC-V binaries expected Q3 2025
Energy Efficiency: Targeting 1W consumption for solar-powered deployments

AI for the 99%

DeepSeek’s minimal versions exemplify the “small is the new big” paradigm shift. With active contributions from 180+ developers (and growing), they’re proving that:

You don’t need $100k GPUs for production-grade AI
Open-source collaboration beats closed-model scaling
Efficiency innovations benefit emerging markets most

While LLMs like GPT-4 dominate headlines, DeepSeek’s engineering team and open-source contributors have quietly revolutionized resource-efficient AI. Their minimalist models (e.g., DeepSeek-R1-8B, DeepSeek-V2-Lite) now rival 70B-parameter models in coding and reasoning tasks while running on laptops or Raspberry Pis.

DeepSeek’s minimal versions exemplify how smart engineering can democratize AI. Whether you’re refining a side project or prototyping enterprise tools, these models prove that “small” doesn’t mean “limited.”

Try it now:

ollama run deepseek-r1:8b