From 9b4ec1274a0e740ceea0c99f615d0c492f448309 Mon Sep 17 00:00:00 2001 From: "Youri T. K. K. Mattar" Date: Tue, 11 Aug 2026 17:05:37 -0300 Subject: [PATCH] docs: lead with the command that works, and correct a wrong claim MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The published image pulls anonymously — verified by logging out of the registry, removing the local copy, and running the reported command, then the whole README flow against what came down: oxctl list, oxctl logs counter, curl, and a docker stop that exits in under a second. So the pull goes first. It is one command and needs no toolchain, which is what the section is for; building it yourself is the alternative, not the default. And a claim I wrote into ROADMAP while fixing the last problem was wrong: that a package pushed by Actions is private by default and would need a manual visibility change. It is not, for a package pushed from a public repository — it inherits the repository's visibility. Corrected in place rather than deleted, because the lesson is the same one the bug taught, applied to the fix: reasoning about what a command will do is not the same thing as running it. --- README.md | 17 +++++++++-------- ROADMAP.md | 14 +++++++++----- 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 586740f..3276df6 100644 --- a/README.md +++ b/README.md @@ -32,18 +32,18 @@ PID 1 kills the machine. ## Try it -You need [Docker](https://docs.docker.com/get-started/get-docker/) and a Rust -toolchain. Two commands: +You need [Docker](https://docs.docker.com/get-started/get-docker/) and nothing +else. No Rust, no virtual machine, no kernel. ```bash -cargo xtask fetch --arch x86_64 # a kernel and a busybox, into target/ -cargo xtask demo # build the image and run it +docker run --rm --name oxinit-demo -p 8080:8080 ghcr.io/youhide/oxinit:demo ``` -Or pull the image, which tracks `main` and needs no toolchain at all: +The image tracks `main` and is 4.6 MB. To build and run it yourself instead: ```bash -docker run --rm --name oxinit-demo -p 8080:8080 ghcr.io/youhide/oxinit:demo +cargo xtask fetch --arch x86_64 # a kernel and a busybox, into target/ +cargo xtask demo # build the image and run it ``` oxinit boots as PID 1 inside the container and starts a handful of small @@ -88,8 +88,9 @@ for each to actually be gone, and exits `0`. Most container images have to be killed after a ten-second grace period; that shows up as exit code 137. The units the demo runs are in [demo/](demo/), one small file each, and they -are meant to be read. The image is 4.6 MB — statically linked against musl, -`FROM scratch`, no base image and no shared libraries. +are meant to be read. The image is that small because oxinit is statically +linked against musl and the image is `FROM scratch` — no base image, no shared +libraries, nothing in it but the three binaries and the units. ## Why diff --git a/ROADMAP.md b/ROADMAP.md index fa439fe..e570fc7 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -990,11 +990,15 @@ And CI checks that the image reference in the README is the one the publish step pushes. That is the half a test on a locally built image structurally cannot cover, and it is the half that failed. -One thing here is not automatable: a package pushed by Actions is **private by -default**, and an anonymous `docker run` against a private package fails with -exactly the `denied` that was reported. Making it public is a one-time setting -on the repository's package page, and it belongs to whoever owns the account -rather than to CI. +One claim written here while fixing it was wrong, and is corrected rather than +quietly deleted: that a package pushed by Actions is private by default and +would need a manual visibility change. It is not, for a package pushed from a +public repository — it inherits the repository's visibility. Verified by +logging out of the registry and running the reported command, which now pulls +and runs. + +The lesson is the same one the bug taught, applied to the fix: the reason to +run the command is that reasoning about what it will do is not the same thing. ## Not doing, and why