Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

5

There are options you can pass through apt-get to dpkg that will handle the config choices. We usually do something like: apt-get install -y --no_install_recommends -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' <package_name> When using ansible you can do: apt: pkg: "{{ item }}" only_upgrade: yes ...


4

What you are primarily discussing is the hosting model for the underlying cloud you are using, for example, from what you have said so far your hosting model is relying on Infrastructure-as-a-Service (IaaS), and you want to have less responsibility for managing the Operating System. That being the case you would need to move right in the table below to ...


4

TL;DR Pick software that focuses on long-term support. Use containers so that you can separate the runtime you need for your app from the security patching of the underlying infrastructure. Long Answer: I used to run some old PHP sites running popular content management systems. The plugins would fall out of support such that I could not upgrade the ...


3

From my experience this is very provider specific and requires evaluating the SLA offered for a particular service. For example the siteground cloud server offerings shown at https://www.siteground.com/cloud-hosting.htm state: We preinstall and maintain all the software you need on your server. While offerings from liquidweb they make it clear they will ...


3

Fixed price tiered billing is an older billing model that suits a monthly billing cycle where usually the level of resources provided does not change over a month. Even if it is changed, this is usually met with friction from the billing department in form of the higher pricing tier being applied to the whole month. By comparison AWS can be credited as the ...


3

I'm using scripts from sue445/jenkins-backup-script. It archives Jenkins settings and plugins such as: $JENKINS_HOME/*.xml $JENKINS_HOME/jobs/*/*.xml $JENKINS_HOME/nodes/* $JENKINS_HOME/plugins/*.jpi $JENKINS_HOME/secrets/* $JENKINS_HOME/users/* Usage ./jenkins-backup.sh /path/to/jenkins_home archive.tar.gz # add timestamp suffix ./jenkins-backup.sh /...


2

Docker was built for linux, it runs on Mac through HyperkIT, which is a lightweight hypervisor. This means Docker only sees devices connected to the hyperkit hypervisor, rather than the devices connected to the Mac. Unfortunately, Hyperkit has issues with USB device passthrough from your MacOS to the hypervisor (read more here) so the --device command won't ...


2

You can try the thinBackup plugin (even though it is not actively maintained) [if taking a logical backup is all you want] (i.e. most of the config xml files, jobs, nodes etc). The backup size won't be huge.


2

So what you can do is you list all of your containers with command: docker container ls -a And the second field is an image name, you can run this command to get all the read-only layers with their respective directories to search for the file in: docker image inspect <image_id> | jq '.[0].GraphDriver.Data.LowerDir' -r | tr ":" "\n" If the file was ...


2

The answer to the question "is there a Dockerfile for that, as well?" https://github.com/tianon/docker-brew-ubuntu-core/tree/dist-amd64 Note their git branches contain the actual release build based on architecture.


2

Ansible is at its core a programming language - a meta programming language written in python compiling itself into python and shell scripts mostly. It will do whatever you program it to do. It all depends on how your roles and playbooks are written. It certainly can be done - almost anything can be done - your install roles could track dependencies on ...


2

Use the --limit option to select a subset of hosts: ansible-playbook -i /path test.yml --tags automation --limit host2 Its description from ansible-playbook documentation: further limit selected hosts to an additional pattern


2

Background When using cloud services such as AWS or Azure your ability to access the console of booting instances is typically restricted to a read-only type of interaction. AWS does provide tools, so you just need to adjust your approach, if you're expecting to drop to single user mode or watch a booting system on a console. For example, in the EC2 ...


2

This response is for Kernel: Linux 4.4.132-1075-rockchip-ayufan-ga83beded8524 Architecture: aarch64 aarch64 aarch64 GNU/Linux I had the same issue when issuing commands to a cluster in swarm mode. Running docker info would result in Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? Running sudo systemctl ...


2

Well, to begin with, one of the key concepts behind the CaaS/PaaS/FaaS services is the offloading of the OS maintenance burden :) So it shouldn't even matter what version (or even what OS! - it could even be a proprietary one) the provider runs under the hood as long as the CaaS/PaaS/FaaS service performs according to the respective SLAs. Which is, in a way,...


1

When configuring PM2 is finished and it's working properly, you must run two commands to make your PM2 as a autostart service and enjoy that. 1) Run 'pm2 save': It's save all of your PM2 configure to a file. admin@server:~$ sudo pm2 save 2) Run 'pm2 startup': This command creates a system service and runs your last change saved with the first step. admin@...


1

Have you heard about the distroless? See this link too.


1

All my searches for a term brought me to conclude that the general term either for one Apache virtual host file or a constellation of Nginx block files (each containing at least one block) is just that --- a virtual host. Per project; either the virtual host (entity) is a single file or a combination of files, and that's true if the webserver software is ...


1

Assuming that the monitoring host is able to make outbound connections, you can solve this by having a bastion host elsewhere which you can connect through. Obviously do make sure to clear this with your customer. To do this, set up a server somewhere under your control. This might be a VPS with a generous traffic limit, or it might be a physical server ...


1

That doc say next: When running Tomcat on unixes, the console output is usually redirected to the file named catalina.out. The name is configurable using an environment variable. (See the startup scripts). Whatever is written to System.err/out will be caught into that file. That may include: Uncaught exceptions printed by java.lang....


1

As long as no one else is logging into the server or able to run docker commands against the host, then passing secrets as an environment variable into the container which is only stored on the host is relatively secure. About the only risk I can think of is that it is a clear text value on the disk, so you have the risk of the secret escaping with a lost ...


1

ENV variables are a good way of passing secrets to a container. What you don't want to do is bake the secrets directly in the image. As you have rightly done, do not store secrets in your source control repo as well. Besides ENV variables, you could also consider using an external secrets repository, such as Hashicorp Vault, or possibly even AWS secrets. ...


1

Do you need to run it beside a VPN "OpenVPN service" ? I think using below would solve the issue for clearing any unused networks by at least 1 container. $ docker network prune


1

Terraform is awesome for setting everything up. I like it less for the actual configuration. After Terraform runs and sets everyhting up (ec2 security groups/instances etc,.) we run Ansible to configure additional users. I recommend leaving AWS default user (ec2user, ubuntu) if you're using SSH Keys. Add to your 'authorized keys' all the public keys for ...


1

For the easy solution, use named volumes when possible. They will initialize to the contents of the image, include file owners and permissions. When you need host volumes, my preferred solution for developer machines is to run the entrypoint as root and drop permissions to the application user after adjusting uid/gid values of the users inside the container ...


1

I'm a little confused about the exact use case. Are you asking about writing to volumes that are mounted inside the container? You can change what the process in the docker container runs as by using --user on your run commands. docker run --user 1000 --ti centos/7 /bin/bash This answer may help you: https://stackoverflow.com/questions/41100333/...


1

I agree with others not to bake user accounts into the OS images. Especially personal user accounts of your infrastructure team should be maintained with a decent user management. There are only very rare circumstances where you want to system/service account to be installed everywhere. Reason: Getting users into the systems is most times easy because ...


Only top voted, non community-wiki answers of a minimum length are eligible