# Question
Title: Can I run Chef/Puppet server from Azure and manage my on-premise infrastructure?
I would like to use Azure Chef server (or Puppet, or any other solution) from Azure to manage my infrastructure (around 25 servers and 20 desktops) wich is on-premise behind a corporate firewall.

Is that possible? I tried searching for a similar solution but all I can find are articles how to manage Azure infrastructures.

# Answer
> 3 votes
The prerequisites for a chef server are here and common to any installation.

You only need to allow https to port 443 from your inner infrastructure to the cloud server.

If you have a proxy with SSL interception I'd recommend adding this proxy certificate to each client `cacert.pem` and set an environment variable `SSL_CERT_FILE=<chef_install_path>embedded/ssl/certs/cacert.pem` so other call from different ruby tools using openssl will also work.

---
Tags: chef, azure, puppet
---


# Question
Title: Is there a puppet module to manage policykit rule on Ubuntu 16.04?
Is there any module which could help to manage policykit rules on puppet for Ubuntu 16.04 instead of putting file on /etc/polkit-1/localauthority/50-local.d ?

# Answer
> 0 votes
It appears that there is. For future reference, the best place to look for puppet modules generally is to search Puppet Forge. That is the central repository for modules and any module uploaded there can be installed using puppet by typing:

```
puppet module install jhoblitt-policykit

```

But obviously, you will want to update the name of the module to be whatever you want to install.

---
Tags: puppet
---


title: What is the message of this picture?

text:
# Question
Title: What is the message of this picture?
I have found this picture in a comment to this Reddit thread and would like to better understand its message. I do not know the image's original source, maybe it will come up later.

# Answer
> 4 votes
The Reddit thread asks:

> Why is the Docker Mind Shift so hard?

The OP then links to The Docker Mind Shift and states that

> The Docker Mind Shift helps explain the challenges many people struggle with, in DevOps and containers. Thoughts?

(Currently,) the highest upvoted comment states

> to be honest my biggest challenges have been with the speed of tooling changes rather than the concepts. In theory, i get the workflow and ideas behind docker fairly well, but in practice sometimes it does feel like you're throwing a whole load of plates up in the air and then walking off before they hit the ground again. I get that as a new tech idea it moves fast, but just trying to keep up with the ever moving goalposts can be exhausting. It does seem to have gotten better in the last 2 years though to be fair.

In response to this comment, sirex007 responds

> after finishing any reasonably sized project in docker, i'm always reminded of this image

and links to the above image. This image is attempting to comically illustrate the confusion many feel with the world of DevOps. There is a smorgasboard of toolkits and frameworks out there, and the bullets in the image are a commentary of the nonsense of the diagram to the right.

This is seen in the first bullet:

> * Did you just pick things at random?

The subsequent bullets then expand on this question. For example, Redis is a caching system and stores key-value pairs. Similarly, MongoDB is a type of NoSQL database which *also* supports key/value pairs and caching, so it is a little silly to have both Redis and MongoDB.

It seems that sirex007 feels that this graphic illustrates the point that `I get that as a new tech idea it moves fast, but just trying to keep up with the ever moving goalposts can be exhausting.` and `my biggest challenges have been with the speed of tooling changes` as there are a lot of trendy tools appearing in the graphic, which is making the point that the implementer doesn't seem to understand the toolkits in use in his or her stack well.

This is a fair point: with the DevOps goal of rapid iteration and deployments, the appearance of new tools on a frequent basis and the changes within those tools could certainly seem like they are moving at a breakneck pace. I would argue that this is evidence of the success of the DevOps model however. If these projects are able to successfully iterate rapidly using DevOps, it is proof of the model's successes - though perhaps the cost is trying to keep up with that rapid pace.

---
Tags: culture
---


# Question
Title: Best learning resources for continuous integration tools like Jenkins
I am a .NET developer , I have decided to learn DevOps continuous integration tools.

One of my folk asked me to learn below tools and language:

1. Jenkins
2. Shell Scripting
3. Python

I have found below learning resources to be usefull.

**Free Videos**

1. https://www.youtube.com/watch?v=p7-U1\_E\_j3w
2. https://www.youtube.com/watch?v=89yWXXIOisk&t=89s

**Free Course**

1. https://www.udacity.com/course/intro-to-devops--ud611

**Paid Course**

1. https://www.udemy.com/the-complete-jenkins-course-for-developers-and-devops/

**Training Materials**

https://gist.github.com/ssmythe/ae1449b116ece85dc10d

Is their any other resources available by which one can master Jenkins and continuous integration ?

Any resource available to get started shell scripting and Python language ?

# Answer
> 1 votes
Here are the resources which might be useful for . continuous integration Below . you might be visited but as novice . it will be easy to understand.

jenkins:-

https://www.tutorialspoint.com/jenkins/jenkins\_git\_setup.htm

Shell Scripting :- I would . suggest . to start with basic unix commands like . cp,mv, file related and . permissions etc.. (Basic stuff).

Its good to have . some practise on the system so that you can get an Idea . Because as a Devops engineer we should be strong enough on Basic . stuff.

---
Tags: jenkins, continuous-integration, python, shell-script
---


# Question
Title: Debug BackendConnectionErrors from Kubernetes Service LoadBalancer sesrvice
We recently moved some of our production infrastructure to Kubernetes. Many pods are exposed through a `LoadBalancer` service on AWS. This creates an ELB, registers each node in the cluster with the ELB, and configures a node port to map ELB ports to pods. Our applications are able to connect via the load balancer, but amount of `BackendConnectionErrors` (as reported by cloudwatch) is 5-7x higher than request count. I'm not sure how to debug this.

The number of reported backend connection errors does not correlate with any application layer error metrics. This leaves me to conclude that it some sort of infrastructure problem perhaps being amplified by retries. However I do not know how to debug this issue.

My hypothesis is one or both of these:

* Some weird AWS setting that is missing on the ELB for connection management
* Nodes in the cluster have some sysctl setting or other networking config that's blocking the *amount* of connections coming over the ELB
* Some intermediate piece of networking infrastructure messing with the connections.

My question is: how I can debug/trace some TCP/networking related metrics on the instances in the cluster?

More info about the CloudWatch metrics in question.

# Answer
My solution to this problem was to rework my Services. The setup in my question had one K8s `Service` with ~10 ports. I reworked the setup to use one port per `Service`. The problem went away. I don't know why though. This makes me suspect something on the nodes themselves or some complexity in routing connections to the correct node port. I'm cautious of exposing too many ports again because of this.
> 5 votes

---
Tags: amazon-web-services, linux, kubernetes
---


# Question
Title: How can I deploy an AWS Lambda function from Jenkins?
I have a simple Lambda function that I'm trying to deploy through Jenkins -

```
public String handleRequest(String input, Context context) {
        String output = "";
        if (input.isEmpty()) {
            output = "No input provided";
        } else {
            output = "Hello, " + input + "! Checking invocation - 1";
        }
        return output;
    }

```

I'm able to deploy and invoke this through Eclipse's AWS Lambda plugin without any problems.

I'm using the AWS Lambda plugin for Jenkins and following their documentation.

* I'm providing my Git repository as the source.
* Artifact Location - `src/main/java/`
* Handler Name - `lambda.Hello` (*lambda* is the package name and *Hello* is the class name). I've also tried using `lambda.Hello.handleRequest`, `lambda.Hello::handleRequest` and other variations.

Jenkins says that the build was successful but when I test it on the AWS console, I'm getting -

```
"errorMessage": "Class not found: lambda.Hello",
  "errorType": "class java.lang.ClassNotFoundException"

```

Where am I going wrong here? When I export the test function from AWS and unzip it, I can see that code on Git definitely got deployed but it's unable find the class.

# Answer
> 3 votes
I found the solution while trying to manually deploy the Lambda function as a jar file. These are the steps -

* Create your Lambda function as a Maven project using the AWS documentation.
* Create your Jenkins job as a Maven project and specify `package` in the goals section.
* Follow the Jenkins Lambda plugin documentation for deployment and specify `target/your-project-1.0-SNAPSHOT.jar` as the Artifact location.

This should build your Lambda function with Maven and then deploy it to AWS.

---
Tags: jenkins, continuous-integration, jenkins-plugins, continuous-deployment, aws-lambda
---


# Question
Title: Error with docker-compose - image not supported?
What's wrong with the following spec? (Image parameter is here to tag resulting image).

version: '3'

```
services:
   foo:
      build:
         image: foo/bar
         dockerfile: Dockerfile
         context: .

```

System output:

```
services.foo.build contains unsupported option: 'image'

```

*Versions: docker-compose: 1.14.0; Docker: 17.06.0-ce*

# Answer
> 7 votes
“Image” needs to be at the same level as “build”.

---
Tags: docker-compose
---


# Question
Title: Does load balancer F5 support CasC (Configuration as Code)?
Using CasC with F5 would allow for versioned and optionally dynamic network endpoint configuration, saving time and reducing risks.

Does this tool support this? Are Single Configuration Files (SCF, F5 term) the vehicle to do that?

# Answer
> 11 votes
Yes, F5's do support Configuration as Code. Historically, F5 has made an appliance to manage Configuration as Code called "Enterprise Manager" which pragmatically managed client endpoint F5s (LTMs, etc) using the iControl XML API.

They rather quickly discovered this management appliance was terrible and added a more robust REST API to the client appliances for managing devices (LTMs, etc.; also branded as iControl) which is much easier to use and more flexible and then began building a replacement for the Enterprise Manager branded BIG-IQ.

The point being, you can manage that same API using this REST interface. See their tutorial on DevCentral. Usually, you can find the exact REST syntax and calls on the DevCentral site on a per-version basis like this one for TMOS 12.1.0.

Generally speaking, it is NOT recommended that you use an SCF (Single Configuration File) pretty much ever for a couple of reasons. First, it lacks any supporting files, such as certificates and keys for your SSL profiles or scripted (so-called "external" health monitors), etc. Secondly, it plays poorly if you use partitioning, as partitions are spread over several files in a foldered structure. These don't consolidate well into an SCF file. You would actually be better off to write TMOS scripts. One of the reasons F5 switched from the bigpipe command to the TMOS shell is that it could be scripted where bigpipe could not be easily scripted. But again, the REST API is preferred. SCFs are really a legacy of version 9 of TMOS and haven't aged well and work poorly in version 12. A significant reason for this is due to the changes in the HA peering between V10 and V11 when they changed to a clustered architecture. It really wreaked havoc on the usability of the SCFs.

Puppet actually has a module for managing F5s if you use this configuration management tool and salt has a runner for it - both using the REST API if you use either of these configuration management tools.

# Answer
> 4 votes
James, you are correct in that BIG-IQ replaced Enterprise Manager. However, like Enterprise Manager, BIG-IQ is for 'device/feature' management. For integrating via REST APIs directly, or to 3rd party automation tools/tool-chains, you should look at F5 iWorkflow (programmable/extensible API gateway).

The team behind iWorkflow are focussed on 'services templates' and 'service catalogs'. These being great ways to rapidly create 'declarative interfaces' that you can hit with single REST calls, versus calling hundreds of 'imperative interfaces' (individual REST end-points) to perform the same task.

Moving to a declarative model will save you from MANY headaches in the future, and will better support automation, and integration with CI/CD pipe-lines. The LAST thing you want is to move all the nuances of your infrastructure into the automation pipe-line itself!! Abstraction through declarative interface will protect you from that pit of despair.

With REST+declarative interfaces, you have a much simpler Infrastructure as Code model in that you are only maintaining JSON blobs for the service templates, and not monolithic configuration files. Double-WIN!

Take a look at calling iApps (F5 services templates) from the REST API. Here's a free on-line training course:

http://f5-automation-labs.readthedocs.io/en/latest/

Chase = Correct! REST all the way!

---
Tags: configuration-management, load-balance, f5
---


# Question
Title: Why would graphite-webapp browser not display any body content?
I have used 0.9.x Graphite in the past as the basis of my monitoring system, and am trying a fresh install of 1.0.1 prior to upgrading across my systems (Ubuntu, 14.04, though I doubt that matters).

I appear to have graphite-webapp and carbon-cache running (`supervisorctl` reports both as `RUNNING`, and there are not errors in any logs I can find). I have confirmed by navigating in the server `/opt/graphite/webapp/storage/whisper/` that there is in fact data to display in the first place.

I am able to access http://localhost:8080 and see the usual graphite webapp header, but the body of the page is blank (where normally I would expect to see the file-browser that lets me choose data on the left, and it graphs the selected data on the right).

To the best of my knowledge, I have configured graphite as per the installation instructions, but obviously I have done something wrong.

If there are particular configuration files that would be useful for me to include (which can also server as a debugging path for future people who may have this issue), please comment the files that may help.

Note to editor: The tag should be "graphite", probably, but I don't have the rep to tag it correctly.

# Answer
You need to collect static assets in your Django

```
cd /opt/graphite/webapp && PYTHONPATH=/opt/graphite/webapp django-admin.py collectstatic --noinput --settings=graphite.settings

```

Static files will be installed in **/opt/graphite/static**. Then you need to configure your webserver to serve them directly. For Nginx something like:

```
location /static {
   root /opt/graphite
}

```
> 3 votes

---
Tags: monitoring
---


# Question
Title: Methodology for software development and deploy in fast-paced agency
**Background:**

Three months ago I was called to do a freelance job for a rather big agency, with 40~50 employees.

Things were chaotic when I got here. The entire development team had been hired by another company one month ago, and there were a lot of overdue jobs. I freelanced here for about three weeks, until they hired me. Since then, I had been working hard to fix things, and there were so many things to do that I had to let go of the process to focus on delivering the software.

Now, three months later, the dust have finally settled down, and now I'm looking forward to implement good development practices and methodologies, mixing development, deployment and project management.

**Scenario:**

We have several different clients, most of them with their own servers. Some of them have their own infrastructure team to handle their servers. Projects are in different languages, and I have little control over the client's servers.

Throughout the day, there might pop up several demands for different clients, and I must deliver them as quick as possible.

**Conclusion:**

I have to deliver things quickly, but I feel a urge to employ a methodology to do it, because I know that if I just keep doing things without proper control, some thing will certainly go wrong sooner than later.

**My two cents:**

One of the first things I plan to do, is to elect a preferred development language and framework, so we can specialize in something. Other than that, I'm not sure what to do.

# Answer
> 3 votes
In terms of development procedure, you should consider using the agile method. This is the most widely used method of software development and has proven itself. Within the scope of the agile method Pair programming will allow you to spool up another developer to assist with your projects when you are ready and find that you have more work than you can handle. You can then move into a standard agile method like scrum/kanban/scrumban (or continue the pair programming if you find you like it!)

One particular reason for choosing this method is that is lends itself well to DevOps and Continuous Integration. In fact, one could describe DevOps as a *specific way* of implementing the agile method. The Iterative, incremental and evolutionary philosophy of agile and the very short feedback loop and adaptation cycle marry beautifully with DevOps/Continuous Integration and provide a solid foundation to build upon.

> Here in the agency we have a infrastructure team as well, with the possibility to set-up our own internal or external servers to handle things.

Make good friends with the infrastructure team. Involve them early and often and drive them towards a Infrastructure/Configuration as Code philosophy which will allow you to collaborate closely with them. While it might seem like it is faster to just do it manually, doing so is creating technical debt. In a few years when it comes time to upgrade, no one will remember how the thing is built. It will also allow the infrastructure team to look good. Never again will they make a mistake or forget a step during deployment. Either the deployment code works or it doesn't and it will deploy exactly the same way it deployed in test/staging - making deployments and upgrades easy and horizontal scaling a breeze. Ignoring these techniques also slows down *your* development. If you can just fire up a new server, have it pull down (and compile) your latest git commit, run through an automated testing suite and then E-mail you the results while you go do something else it is a huge time-saver.

If you can, utilize the cloud - with Amazon for instance, a lot of the tools are already built for you. While this might make your Infrastructure team leery, just remind them that the cloud is just someone elses computer. All the cloud does is provide you with hardware. It will still require someone from the infrastructure team to install maintain and operate it. And it will allow you to avoid scalability issues. The database problems, storage and backup issues and headaches have now been outsourced.

> and I have little control over the client's servers.

See what you can do about this. Consider leveraging a tool like The Forman's Katello scenario (I like to deploy it with Salt Stack personally - I don't like ruby) which will allow you to manage and deploy your VMs on nearly any iron or cloud (including bare metal), manage the configuration of that hosts using Salt Stack, Chef, Puppet or Ansible, manage your docker containers and manage updates to your machines. This will allow you to then easily provide the code to your client to either A) automate or B) manually deploy their updates and deployments. Once you have proven the value of the speed and efficiency this method gives you, you may be able to simply use these same tools to spawn your client a copy of this stack for managing their environment or you may be able to talk/upsell your clients into letting you manage these deployments - The Foreman will allow you to configure sites and organizations (as well as mange users if paired with FreeIPA) so you can configure multi-tenancy. And the project is backed and supported by Red Hat.

If you have any doubts about the above, I recommend you pick up a copy of "The Phoenix Project" of the Audiobook which illustrates very well the value and benefit of the above.

> One of the first things I plan to do, is to elect a preferred development language and framework

If you go this route, just make sure to standardize on a language that plays well with REST most DevOps stuff uses this interface.

And finally,

> The entire dev team had been hired by another company - and they didn't have a solid process as well, only a few gits here and there

Do what you can to merge these together into one place. It will make your life a heck of a lot easier.

---
Tags: deployment, methodology
---


# Question
Title: How to configure gitlab-runner to run in the same docker host as gitlab?
I have a gitlab instance running in a docker container. Now I would like to setup gitlab-runner on the same host. Both are running:

```
docker container ls
CONTAINER ID        IMAGE                         COMMAND                  CREATED              STATUS                 PORTS                                                            NAMES
279473dceb2f        gitlab/gitlab-runner:alpine   "/usr/bin/dumb-ini..."   About a minute ago   Up About a minute                                                                       gitlab-runner
6d7af0d6b946        gitlab/gitlab-ce:latest       "/assets/wrapper"        2 hours ago          Up 2 hours (healthy)   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:8022->22/tcp   gitlab

```

I registered a docker image as a shared runner:

```
concurrent = 1
check_interval = 0

[[runners]]
  name = "default shared maven runner"
  url = "http://url-of-my-gitlab.instance"
  token = "valid token"
  executor = "docker"
  [runners.docker]
    pull_policy = "never"
    tls_verify = false
    image = "maven-java-8:latest"
    privileged = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0
  [runners.cache]

```

The registered image `maven-java-8` is a custom image with the correct settings.xml and it is listed in `docker images`.

But still the pipeline fails with:

```
Running with gitlab-ci-multi-runner 9.3.0 (3df822b)
  on Maven Test (5b2573e4)
Using Docker executor with image maven-java-8 ...
Using docker image  sha256:c266311d78b33f89f6eecce00f19a0428e37ba6af6734c8fced32fa11e4bd4ba for predefined container...
Pulling docker image maven-java-8 ...
ERROR: Job failed: Error response from daemon: repository maven-java-8 not found: does not exist or no pull access

```

Which I interpret as it is trying to use the local images inside of the gitlab-runner container.

The GitLab version is gitlab-ce 9.2.7 and the runner version is v9.3.0.

The content of my .gitlab-cy.yml is:

```
test:
  script:
    - mvn clean test

```

What am I missing?

# Answer
**Management Summary**

Set the `pull_policy` to `"never"` in the `[runners.docker]` section by calling:

```
docker exec -it gitlab-runner \
  vi /etc/gitlab-runner/config.toml

```

**Detailed Description**

It seemed the problem was a confusion with images and mounted volumes.

The documentation says to configure runners in:

```
/etc/gitlab-runner/config.toml

```

Which I did, but on the host machine. When running `gitlab-runner` in a docker container, it mounts a volume:

```
... -v /srv/gitlab-runner/config:/etc/gitlab-runner ...

```

This means, that the configuration file in `/etc/...` in the container is mounted to `/srv/...` on the host machine.

In this file the `pull_policy` was not set, which defaults to `always`, what ultimately caused my problem in the first place.
> 6 votes

---
Tags: docker, continuous-integration, gitlab
---


# Question
Title: What exactly is the cloud term 'a Firehose'?
I found a Firehose definition from Overview of the Loggregator System Cloud Foundry docs.

> The Firehose is a WebSocket endpoint that streams all the event data coming from a Cloud Foundry deployment. The data stream includes logs, HTTP events and container metrics from all applications, and metrics from all Cloud Foundry system components. Logs from system components such as Cloud Controller are not included in the firehose and are typically accessed through rsyslog configuration.
>
> Because the data coming from the Firehose may contain sensitive information, such as customer information in the application logs, only users with the correct permissions can access the Firehose.

Where does this term have it's roots and why it's called that way? Is the concept the same for other Cloud offerings and platforms?

It's funny when I translate this term to my native language.

# Answer
The fire hose is a reference to an old Weird Al Yankovick movie, UHF (1989). In this movie, George Newman (portrayed by Yankovick) starts a local TV channel in the UHF band and is responsible for programming on the channel. After befriending the Station's Janitor, Stanley Spadowski, (portrayed by Michael Richards) George gives the Janitor a slot to run a show of his own making. The show, entitled "Stanley Spadowski's clubhouse" becomes an overnight sensation due to Spadowski's zany antics.

During a gameshow segment on the show, (video) Spadowski announces that a little boy, Joel Miller has "won" a contest by finding a marble in a wading pool of oatmeal and "gets to drink from the firehose!" - and this seems to be the likely origin of the term.

An oft-repeated sentiment in IT is that trying to comprehend a vast amount of material in a short amount of time (such as is the case when starting a new job, taking a training course or seminar on a technological subject or learning about a new product or device) is like "attempting to drink from a firehose" - it is nearly impossible to consume the entirety of such a large volume of information that is directed at you with such a rapid flow - a direct reference to the above scene.

It appears that in an attempt at humor, Cloudfoundry has chosen to call their Websocket "The Firehose" because websockets are used to "*stream* all application event data" (which they apparently regard as voluminous) most likely in reference to this sentiment/saying and scene.
> 11 votes

---
Tags: monitoring, metrics, logging
---


# Question
Title: CircleCI manually approved Deployment with Rollback
The new CircleCI 2.0 configuration allows to have a step of type `approve` which waits for user input. Is there some way to not just deploy code using manual stop, but also have a rollback to a previous version based on user input?

# Answer
> 1 votes
The answer, no.

The best ways to rollback would be to use `git revert`, which then adds the rollback to history (which is a good thing), and then push that like any other commit. The other would be to use the git hash of the commit you'd like to rollback to and build it with the CircleCI API.

Right now, you could also attempt to rebuild and older build via the UI but this isn't suggest for deploys & Workflows. Too many variables for safe, reproducible deploys.

\- Ricardo N Feliciano
Developer Evangelist, CircleCI

---
Tags: circleci-2.0
---


# Question
Title: What is special about the admin in chef?
I've read over the chef docs for a while now and I can't seem to find anything that says what an admin does in chef. I can do all sorts of things with making people admins, but there's no indication of what this does for me. Is there a clear answer somewhere?

# Answer
> 2 votes
A Chef admin can create, modify and delete other users and clients. Basically an admin can manage access to Chef.

---
Tags: chef
---


# Question
Title: Configure Docker to use SSL for a private registry on Windows 10?
Trying to use a customer registry from a Windows 10 system - a native Docker client in PowerShell.

```
PS > docker --version

Docker version 17.06.0-ce, build 02c1287
PS > docker pull REPO_URL/foo-bar:0.1

Error response from daemon: get https://REPO_URL/v2/: x509:
certificate signed by unknown authority.

```

Importing the authority certificate to local user store via Windows tooling works for itself but has no effect here.

# Answer
The official Docker documentation says:

> Docker recognizes certs stored under **Trust Root Certification Authorities** or **Intermediate Certification Authorities**.

That is, you can proceed as the following:

* Start \> "Manage Computer Certificates" (also available in the control panel)
* Right-click on "Trusted Root Certification Authoritites" \> "All tasks" \> "Import"
* Browse to the crt file and then keep pressing "Next" to complete the wizard
* Restart Docker for Windows

In my case, the catch was that I imported the certificate via the context menu, and therefore it went to another folder where Docker could not access it. The certificate store behaves however very much like the normal Windows Explorer tree folder, so I had just to copy the certificate over to the supported category, and after Docker restart it worked.
> 10 votes

---
Tags: docker, windows, powershell
---


# Question
Title: Salt Stack environments ignoring saltenv
I have a salt master with four environments configured (base, dev, staging, prod)

I am initially trying to set a pillar item to track which envrionment is in use, namely core:env

However when I try to switch environments using the following command I always get the dev environment (it doesn't matter what env I put)

`salt 'deploy*' pillar.get core:env saltenv=base`

Here are my config files

```
/etc/salt/master (partial)
file_roots:
  base:
    - /srv/salt/base/states
  dev:
    - /srv/salt/dev/states
    - /srv/salt/base/states
  staging:
    - /srv/salt/staging/states
    - /srv/salt/base/states
  prod:
    - /srv/salt/prod/states
    - /srv/salt/base/states

pillar_roots:
  base:
    - /srv/pillar/base/pillars
  dev:
    - /srv/pillar/dev/pillars
    - /srv/pillar/base/pillars
  staging:
    - /srv/pillar/staging/pillars
    - /srv/pillar/base/pillars
  prod:
    - /srv/pillar/prod/pillars
    - /srv/pillar/base/pillars

```

and my pillars

```
root@Salt-Master:/srv/pillar# cat base/pillars/top.sls
base:
  'deploy':
    - core
root@Salt-Master:/srv/pillar# cat base/pillars/core.sls
core:
  env: base
root@Salt-Master:/srv/pillar# cat dev/pillars/top.sls
dev:
  'deploy':
    - core
root@Salt-Master:/srv/pillar# cat dev/pillars/core.sls
core:
  env: dev

```

(the rest follow the same pattern)

I have other data in the base pillar that is being pulled out, but the core:env item won't change from dev.

# Answer
> 2 votes
State and pillar environments are set independently.

Specifing

```
environment: prod

```

in the minion configuration will force the minion to use the prod state, but it will still use the default pillar data. To select a pillar environment you will also need:

```
pillarenv: prod

```

This also does not work in old versions of salt and is only supported with pillar.get as of salt version 2016.3, so you may be in need of an update.

---
Tags: configuration, salt
---


# Question
Title: Salt Stack Reporting - Executing commands based on environment
Salt allows users to assign machines to environments by setting in /etc/salt/minion:

```
environment: example

```

You can then execute environments for that state with the command `salt '*' state.apply saltenv=example`

However, it appears that the same cannot be said for an arbitrary command. Running `salt '*' cmd.run 'df -h' saltenv=example` will run on all minions instead of just the minions in the "example" environment. How can I run commands for only a specified environment?

# Answer
The answer is that you can't directly. You have to set a grain on the minions first by doing something similar to:

```
salt '*' cmd.run 'grep environment /etc/salt/minion | awk "{print \"environment: \" \$2}" >> /etc/salt/grains'
salt '*' saltutil.sync_grains
salt -G environment:prod cmd.run 'df -h'

```
> 3 votes

---
Tags: configuration-management, salt
---


title: RPM's, VM's : time consuming

text:
# Question
Title: RPM's, VM's : time consuming
I am constantly delivering RPM packages upon every new version of some project.

Every version is dependent on some developing prerequisites

1. CentOS 7
2. git
3. Some npm packages.
4. Some Python PIP packages
5. Some shared objects

I'm dealing with this issue currently with having a virtual machine for every release, and that is very convenient to release every version - just load the ova file of the specific machine and you are ready to go.

but the problem is, the overhead of dealing with virtual machines: cloning and other operations - taking too much time.

What do you recommend in order to do it much more easier?

# Answer
Have you considered setting up a build server (i.e. Jenkins, TeamCity) with disposable build agents?

If you do it in the cloud (i.e. via ec2 integration), you can literally set up an AMI with generic dependencies, then configure it to spin up a new VM for each build agent, which can be configured whichever way, and then delete the VM once you've done publishing your artifact (i.e. RPM).
> 2 votes

# Answer
For a laptop, desktop or standalone server, consider trying out Docker containers. These containers are designed to allow you to provide differing libraries, packages and shared objects uniquely to each application. You can have several different Docker containers running different and even conflicting libraries for the same application. You should be able to then use these to package and compile your RPMs.

Because these containers run on a single kernel instead of having to power the overhead of multiple kernels, you will be able to run more simultaneously. Furthermore, because Docker uses the underlying file system and creates unions instead of keeping an entire second copy of a whole disk image, managing and cloning containers is faster, lighter weight, will require less storage and since there is no boot sequence to go through, they should start and stop faster.

They are also compatible with Jenkins, TeamCity, Vagrant and several other build server software suites, AWS/EC2 and many configuration management systems.
> 2 votes

---
Tags: release, builds
---


# Question
Title: How to enable debug mode for Docker client on Windows 10?
By default, Docker client is not in debug mode. How to enable it?

```
   > docker info

    ..
    Debug Mode (client): false
    Debug Mode (server): true
    ..

```

If I try following `docker --help`

```
docker -D version

```

I get indeed

```
Debug Mode (client): true
Debug Mode (server): true

```

But then, how can I access log messages? The following for example does not seem to bring any debug statements to the console:

```
PS U:\> docker -D -l debug pull ubuntu:16.04
16.04: Pulling from library/ubuntu
75c416ea735c: Pull complete
c6ff40b6d658: Pull complete
a7050fc1f338: Pull complete
f0ffb5cf6ba9: Pull complete
be232718519c: Pull complete
Digest: sha256:a0ee7647e24c8494f1cf6b94f1a3cd127f4
Status: Downloaded newer image for ubuntu:16.04

```

# Answer
Eventually, using the `docker -D -l debug` setting for the client I have found the log outputs (apparently currently there are no debug level messages implemented as reported.

```
C:\Users\user\AppData\Local\Docker\log.txt

```
> 1 votes

---
Tags: docker, windows
---


# Question
Title: Cloud DB operator responsibilities / common tasks
When I feed a search engine with "DBA tasks responsibilities" lots of hits like "What does a DBA do all day?" and even official Oracle manual entries.

With modern automation a lot of those tasks don't exist anymore and as a DBaaS provider we sometimes even don't know our customers and his projects.

So what's the tasks of a Cloud DB operator?

# Answer
> 6 votes
I always saw a DBA as someone who fits in between developers and operations when it comes to database management.

On the one hand, they often take care of backups, clustering, replication, actual binary installation, file system management, etc.

On the other, they also take care of relational DB schema, do performance or query optimization, and advise developers on the best way to lay out their application storage and configuration schemas.

In theory, the first job can be done by a system administrator. The second job can be done by a senior developer or architect.

In practice, it often makes sense to have someone who's well versed in all parts of running a database.

Provisioning the instance is only a small part of what they do. Having your instance hosted in the cloud doesn't remove the need to have someone manage your schema or optimize performance. A cloud RDS with default settings likely won't be aware that key\_buffer\_size value needs to be set to 16M or some of your application's features won't run.

# Answer
> 2 votes
The DBA is the person/role who is responsible for the availability, integrity and security of the organizations data. The responsibilities are the same regardless of the technology that happens to be in use. The way the tasks are carried out may have changed, but they still need to be done. A modern DBA might not be writing backup scripts and changing tapes over but the need for backups hasn't gone away, nor the need to regularly test restoring them, nor the need to assess all the costs involved and the trade-offs, nor the need to document everything in a runbook, etc etc. He or she will be responsible for choosing which cloud service to use, what instance type, what level of IOPS is required, forecasting storage requirements, planning for different kinds of workloads such as OLTP or batch. Performance issues haven't gone away, nor have security audits. If there is an issue and someone needs to take action or make a decision at 3am - who do you call?

Some people say that you don't need DBAs any more - but the truth is if you don't know who the DBA is, it's probably *you*.

---
Tags: automation, databases, job-role
---


# Question
Title: What are known efforts to establish DevOps ontology model?
Today, for many domains there is a semantic ontology for making domain data machine-readable. There are quite many terms in the DevOps and related domains, often established by vendors but applicable to other tools, like declarative pipelines in Jenkins.

What are current efforts to establish the ontology of the DevOps domain?

References/Further reading:

# Answer
> 7 votes
According to Wikipedia, the first reference you linked,

> In computer science and information science, an ontology is a formal naming and definition of the types, properties, and interrelationships of the entities that really or fundamentally exist for a particular domain of discourse. It is thus a practical application of philosophical ontology, with a taxonomy.

The problem with developing an Ontology Model to define the terms of DevOps is that DevOps encompasses multiple domains and these domains can often have overlapping or contradictory terminology.

In fact, sometimes even within  domain there will be conflicting terminology. So it is difficult enough to establish a standard for a single domain, let alone multiple domains.

As such, it is doubtful there will be any attempt (or at least successful ones) to establish formal ontology rules for DevOps any time soon. (And it would have to start with formally defining DevOps first, and so far we have had trouble even making that clear).

# Answer
> 3 votes
# Yes but

It is hard to deny James and Tensibai's sentiments that we are hard to define. I've probably offended a few job interviewers by pointing out DevOps means whatever you want it to mean at the time. Vendors and the press in computing are not very motivated by correctness or conformity so any popular term will get muddied in a similar fashion.

# There is ITIL

But that doesn't mean some people aren't trying to create a common language for us to talk about operations and processes. While I haven't seen anyone applying it in the real world, there is ITIL. As Wikipedia tells us:

> ITIL, formally an acronym for Information Technology Infrastructure Library, is a set of detailed practices for IT service management (ITSM) that focuses on aligning IT services with the needs of business. In its current form (known as ITIL 2011), ITIL is published as a series of five core volumes, each of which covers a different ITSM lifecycle stage. Although ITIL underpins ISO/IEC 20000 (previously BS 15000), the International Service Management Standard for IT service management, there are some differences between the ISO 20000 standard and the ITIL framework.
>
> ITIL describes processes, procedures, tasks, and checklists which are not organization-specific, but can be applied by an organization for establishing integration with the organization's strategy, delivering value, and maintaining a minimum level of competency. It allows the organization to establish a baseline from which it can plan, implement, and measure. It is used to demonstrate compliance and to measure improvement.
>
> Since July 2013, ITIL has been owned by AXELOS, a joint venture between Capita and the Cabinet Office. AXELOS licenses organisations to use the ITIL intellectual property, accredits licensed examination institutes, and manages updates to the framework. Organizations that wish to implement ITIL internally do not require this license.

All of that sounds really exciting, but because of the licensing there's no way for me to build open source software based on this. If you search for ITIL in github the results are very sparse. Until the licensing model changes I think we're stuck with this state of affairs. Unless W3C or the IETF takes up this sort of challenge there won't be a standard which is available to the community.

---
Tags: terminology, methodology
---


title: How do I write a buildspec.yml file?

text:
# Question
Title: How do I write a buildspec.yml file?
I have ***Java Spring web service project on EC2***

I tried writing a `buildspec.yml` for it. However the AWS CodeBuild service is not giving successful results. In the install phase itself, it tells `apt-get` and `yum` command not found. The problem is that both `yum` and `apt-get` are not being detected. However the exemplary file in the docs is using `apt-get` to in the install phase. How can I make it work?

I am not able to figure it out... why does it fail for both `yum` and `apt-get`?

# Answer
Few ideas to help you

1. When you define a "CodeBuild" project, you can specify which base image it will use to execute your commands. The one you are using is not Ubuntu yet you are trying `apt-get`. Try a different base image.
2. Provide us with a better log stream.

### Exporting Logs from CloudWatch

I found that the easiest way is to export logs through command-line:

* click on 'View Logs' link, to find out your Log Group and Log Stream
* install "awscli" and "jq"

Run substituting your log-group-name and -log-stream-name:

```
aws logs get-log-events --log-group-name /aws/codebuild/Dumper  \
    --log-stream-name 0bd74b8c-74b9-4f9b-b275-167b45901aa3 | \
    jq '.events[].message' -r | grep -v '^$'

```

This should give you the output, which you can include in the question.
> 7 votes

---
Tags: amazon-web-services, spring-boot
---


# Question
Title: Codeship cannot push image to Google Container Registry
I created a Service Account in the Google Cloud console to let Codeship push Docker images to Google Container Registry, but when I test it with `jet steps --push` it says I don't have permissions.

```
{StepFinished=step_name:"push_app" type:STEP_FINISHED_TYPE_ERROR}
Image Push error for image gcr.io/my-project/my-app:1499432530, denied: Unable to access the repository; please check that you have permission to access it

```

The service account already has full owner permissions to my account. Is there anything I need to check in the Google console or my Codeship configuration?

# Answer
The service account needs permissions to the storage segment where the containers will be pushed. To fix this

* Log in to the Google Cloud Platform console
* Go to the *Storage* section
* Tick the corresponding storage segment and click *Show information panel* button in the top-right corner.
* Add the storage object administration permission to your service account.

You can then retry locally with `jet steps --push`.
> 1 votes

---
Tags: docker, continuous-delivery, google-cloud-platform
---


# Question
Title: Continuous Integration infrastructure for multiple iOS projects
As a iOS developer, I was looking to create a CI and CCQ (= Continuous Code Quality) infrastructure for the iOS projects we have in development so far. We already use Jenkins and SonarQube for almost all the Web and Android projects (using a VM foreach project, installing and configuring the CI and CCQ is automated) and it works great. But for the iOS projects, Jenkins needs to do the build on a computer running macOS, so I am not sure I have the perfect solution for that.

* I was looking into a solution to virtualise the macOS. For each project, to create a virtual macOS and install Jenkins as slave there to handle the builds. The solution looked perfect, but it seems it is not legal to have more than 2 VM running with macOS (and of course, only on Mac computer) http://images.apple.com/legal/sla/docs/macOS1012.pdf -\> The point 2.B. So this isn't a solution for my case.
* Another common solution I've read about is to have a Mac computer (maybe a MacMini) that will handle all the builds for all the projects. What do you think about this implementation? How many projects may it handle? Developers may need to do some configurations on their own project (especially in SonarQube), is it safe?
* Can we have multiple Jenkins and SonarQube instances on the same machine, using different ports? Is this even a solution to be considered or I am talking non-sense?
* Is there any other viable solution, maybe better than the ones above :) ?

Note: I am not sticking to Jenkins + SonarQube duo, if there are any other tools better suitable for iOS development, please share them with me.

# Answer
> Is there any other viable solution, maybe better than the ones above :) ?

For Jenkins probably no, due to the license issues you mentioned (you have to run macOS on Apple branded hardware). If you can work with that then it's definitely a solution.

If not, then I'd suggest you to check for a hosted iOS continuous integration system where you don't have to deal with the Apple hardware / licensing, the service will manage it for you, e.g. https://www.bitrise.io

There are also services where you can rent Apple hw and you can configure it any way you like, https://www.macstadium.com is one of them (probably the biggest one).
> 10 votes

# Answer
I think you can also look at new lightweight virtualization for macOS called Anka. Anka Build can make it possible for you to setup a virtualized infrastructure on Apple hardware and enable you to provision macOS Vms on-demand from Jenkins.
> 2 votes

---
Tags: jenkins, continuous-integration, ios
---


title: List of Ticket Management Software

text:
# Question
Title: List of Ticket Management Software
My devops team is struggling with managing incidents and having quick response times anyone know of some software that can help with this?

And the pros and cons of them?

Thank you very much.

# Answer
> 2 votes
Currently my team uses Jira, and it's RapidBoard agile thing. We aren't using real agile, but it's nice to schedule work loads for the next week.

Jira can be super complex, but we Have our tickets set up to:

```
New -->InProgress -->Done
     +-> Won't Do

```

It can be linked to github or to Bitstream, etc. which is nice. If you want more complex code reviews, Atlassian also has a code review tool (Crucible) that I really liked (used it at my previous job).

The real trick is to have the ability to schedule things and to track what state they are in.

The hardest part for us was to get people to break up large projects into multiple smaller tickets to better track progress.

# Answer
> -1 votes
Hey you should check out ngDesk. It does ticket and on-call/pager management, its also completely free.

Its a really awesome tool that my team has been using and loves.

Here is the link https://www.ngdesk.com

---
Tags: continuous-delivery, build-pipeline, capacity-planning, practices
---


# Question
Title: Ansible tmp files created with odd permissions
I have an ansible playbook which can be simplified to this:

```
- name: Provision server
  hosts: all_hosts
  become: yes
  roles:
    - { role: foo }

```

With the following in `ansible.cfg`, since it may be relevant:

```
[defaults]
allow_world_readable_tmpfiles = True
host_key_checking = False
log_path=./ansible.log
remote_user = ubuntu

```

That playbook successsfully configures 10 servers, but one of the servers fails with:

```
[WARNING]: sftp transfer mechanism failed on [xx.xx.xxx.xxx]. Use
ANSIBLE_DEBUG=1 to see detailed information
 [WARNING]: scp transfer mechanism failed on [xx.xx.xxx.xxx]. Use
ANSIBLE_DEBUG=1 to see detailed information
fatal: [host_1]: FAILED! => {"failed": true, "msg": "failed to transfer file to /home/ubuntu/.ansible/tmp/ansible-tmp-1500318083.01-204857088854554/stat.py:\n\nscp: /home/ubuntu/.ansible/tmp/ansible-tmp-1500318083.01-204857088854554/stat.py: Permission denied\n"}

```

So I ssh'd to the problematic server and a "healthy" server, and `ls -al` the contents of the latest temp folder for each. The healthy server had files with permissions of `rwx --- ---`. The unhealthy server had this:

```
---x------ 1 ubuntu ubuntu 58378 Jul 17 14:09 file.py
---x------ 1 ubuntu ubuntu 56779 Jul 17 14:09 stat.py

```

Why would those files get those permissions? I assume that is the problem, because then scp tries to write to them, but it cannot. That doesn't totally make sense with the error message, though, which seems to be suggesting that the `scp` fails.

I'm trying to figure out what debug steps to take, and if anyone can think of other places I can look in order to provide more information, I'm all ears.

# Answer
> 3 votes
The reason for the failure is that the server in question, unlike all the others, had sftp disabled. Why the error messages are what they are, I don't know (why the errant `scp transfer mechanism failed`?), but I don't have time right now to investigate with the debug option enabled.

But that was the issue, and adding `scp_if_ssh=True` to the `[ssh_connection]` section of my `ansible.cfg` solved the issue:

```
[ssh_connection]
scp_if_ssh=True

```

---
Tags: ansible, linux, permissions
---


# Question
Title: Is it possible to combine jinja templates in ansible like this is possible with erbs in puppet?
It is possible to include a subtemplate in another Puppet template.

> `<%= scope.function_template("subtemplate.erb") %>`

# Answer
> 7 votes
Yes, that is possible according to this post.

When a second jinja template was created and this was included in the base jinja it was called.

```
{% include "checks/subdue.j2" %}

```

---
Tags: ansible, jinja
---


# Question
Title: Jenkins Console Output character issue, but plain text show correct
Jenkins working with newman command (postman) `newman run https://www.getpostman.com/collections/631643-f695cab7-6878-eb55-7943-ad88e1ccfd65-JsLv`, and the Console Output shows:

But when I go to **View as plain text**, the character shows correct:

Here more details:

* Jenkins Version: `2.7.0`
* Job Type: `free style`
* Slave OS: `Ubuntu 16.04 LTS`
* Jenkins Installation way: `apt install jenkins`
* JAVA\_ARG: `JAVA_ARGS=... -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=utf-8`

# Answer
that is formatting issue you may try to configure jenkins job to use formatted output as well check it out https://wiki.jenkins.io/display/JENKINS/AnsiColor+Plugin try all available schemes one by one, some of then should works well
> 2 votes

---
Tags: jenkins
---


# Question
Title: Decoupling data of devops tools eg jenkins nexus
Building devops pipe with tools such as Jenkins, Nexus, Hashicorp etc.. Deploying via terraform ansible & packer. Intending to use load balancers in front of each tool, want to deploy tools listed above with their data decoupled enabling easier tear down for updates etc. (eg load balance x2, nexus x2, data ?) Does anyone have any advice or suggested examples of how this is achieved. Not quite ready for containers, but trying to decouple data now in readiness for such a change. Cloud provider not defined yet AWS, Open Stack etc etc ?? Thoughts welcomed.

# Answer
You might want to explore immutable architecture.

**Steps**

1. CI with static analysis(Sonarqube, because free!), pushing version artefacts to Nexus.
2. Base Image using Packer. These must be revisited from time to time. Base Image has security hardening, log shippers, monitoring tools etc.
3. Environment/Application specific images from Base image.
4. healthCheck and version API for each application(healthCheck API in deployment and version for visibility of code in different VMs).
5. Deploy App using Terraform and Ansible.

Can use Jenkins 2.0 (pipeline as code) to achieve points 1,2,3. It can be part of each application itself.

Let me know if this answers your question.
> 4 votes

# Answer
I would not reccommed OpenStack Docker killed OpenStack I would reccomend to use Kubernetes, investigate, whether it works with your app architecture
> 0 votes

---
Tags: ansible, build-pipeline
---


# Question
Title: Retaining at least one successful build in Bamboo
In Jenkins, you could configure the system to retain a certain number of either successful or failed builds.

With Bamboo, it seems like you can just retain a certain number of builds which rotates the last successful build after 10 failed builds out of the system.

Is there a way in Bamboo to retain the last successful build for an unlimited time?

UPD wait, but is that true with the 10 builds limitation, really? I have just realized that I could click the UI through the whole build history, both successful and unsuccessful builds. https://i.stack.imgur.com/C2NAr.jpg

# Answer
> 7 votes
IMHO if your successful build doesn't push to an artifact repository, there's a problem in your pipeline.

Jenkins or Bamboo do *not* aim at keeping built artifacts forever and they don't give you any versioning delivery, as such that's a point of failure in your delivery system.

I'd advise to review your method to use an artifact repository and that will solve this XY problem of keeping a successful build inside the build system used as an artefact source.

**Note**: I can't speak for Bamboo's team, but adding this capacity involves raising the code complexity for a 'side usage'. As such it can makes sense Bamboo's team avoid it to avoid adding code complexity for a feature not in their overall goal. I don't think they avoid it to enforce a best practice, but more to avoid raising unnecessary (from the product point of view) complexity to their code base.

---
Tags: bamboo
---


# Question
Title: Spark on a Docker swarm - workers won't accept jobs
IMO the dashboard does not match the log error, or?

Spark master dashboard says (similar for memory as well):

> Alive Workers: 2 Cores in use: 2 Total, 0 Used

Log:

```
17/07/21 20:48:45 WARN TaskSchedulerImpl: Initial job has not accepted any
resources;
check your cluster UI to ensure that workers are registered
and have sufficient resources

```

Assuming there was e.g. not enough memory, how to determine that? Maybe a symptom, the workers get here and now "dissociated" but then reconnect.

# Answer
> 0 votes
TLDR; set workers' memory to 4G.

I reduced the test to the build-in Pi calculation:

```
./bin/run-example SparkPi 10

```

And got the same result; apparently 1G memory is insufficient even for simplest experiments. Increasing both master and workers memory to 4G and the problematic behaviour was not reproducible. However before the systems start computation the message still could appear but just once, seems it is printed in a waiting loop.

---
Tags: docker
---


# Question
Title: How to prevent that tags will be overwritten in docker private registries?
This is a follow-up to this question about preventing tag overwrite in docker hub.

When one pushes a tag to a private docker registry and the current tag exists then it will be overwritten. How to prevent this?

I have considered using a digest and other solutions, but this does not guarantee overwrites as one is still able to tag an image using a certain digest. I really would like to see an error and an exit code of 2.

# Answer
It is possible to prevent the overwrite of tags by listing the existing tags using https://github.com/jessfraz/reg and exit the pipeline if there is a duplicate.
> 3 votes

---
Tags: docker
---


# Question
Title: When setting up Foreman should this be setup on the same server as my puppet ro ansible master?
I am trying to setup Foreman to interface with my Puppet Master and Ansible installation. Do I need to have this on the same server or can it be by itself and make API/port calls? I am new to this so I don't know.

# Answer
> 2 votes
The Foreman comes with a Puppet Master whether you like it or not since The Foreman uses puppet as part of it's installer. This can't be disabled and The Forman will leave it behind and running - so you might as well use what is deployed anyway and make the Puppet Master and your Foreman server one in the same. You can keep your Ansible installation elsewhere, however The Forman integrates with Ansible and has Ansible callbacks so it might make sense to keep your configuration management stack all in one place.

On the other hand, The Forman can be a big install with lots of moving parts that seem to get gummed up from time to time, so you might be better off putting together an Ansible playbook to redeploy your Foreman stack since Ansible can also manage your Forman resources \- so this would be a good argument to keep the Ansible bits seperated.

---
Tags: ansible, automation, puppet
---


# Question
Title: Wordpress on AWS, how to update only a theme
In order to setup a flow from developer code to a public URL, I've been testing some flows and the current one does not work that good:

I have an **AWS Pipeline** that picks up the source code from **CodeCommit**, builds the **Sage Theme** using `gulp` and deploys the entire code into an Elacticbeanstalk application.

The bad part here is that I'm pushing the entire code again and again, all I really need is the theme folder. Plus, I need to re-activate all plugins every single time :(

What is the best approach for such scenario?

# Answer
> 1 votes
I'm not terribly familiar with elastic beanstalk, so I'm not sure if my method is at all approachable with your workflow, but I have a similar (non-AWS) workflow, and I can share how I do it.

---

I've managed to only push theme changes by separating the deployment of wordpress, and its mysql DB (both as a docker containers, in my case), and the deployment of the themes (which is a git repo).

This way I can separate/automate the deployment of wordpress, mysql, and my wordpress theme in a fairly loosely coupled manner.

Updating consists of only performing a git pull to the themes directory -- No other wordpress/mysql interaction occurs, so my plugins stay in whatever state they were previously in prior to the theme update.

---
Tags: amazon-web-services
---


# Question
Title: macOS testing on Desktop: Docker containers vs. Homebrew installation
Often I test some stuff on my MacBook. Mostly database and data store related stuff (MongoDB, MariaDB, Postgres). I install the software with Homebrew and test.

I wonder if I should switch to docker? What are pros and cons Homebrew vs. Docker for testing things on local Desktop?

# Answer
One of the advantages of using Docker would be that you can easily run tests with different versions of the (DB) apps, which could be quite difficult with Homebrew (some apps don't easily support multiple versions installed on the same system).
> 4 votes

# Answer
One of the cons of Homebrew for the use of testing your DB stuff is how tightly coupled the DB is to your local environment.

You'll inevitably end up needing to manage the details of what services are running, and possibly needing to manage the versions of multiple installations. This can get complex if you need to install software that needs different versions of dependencies, or if you need to pin a very specific version on your test DB.

---

Docker can probably be a good fit for your usecase.

One of the pros of Docker is the ability to quickly set-up and tear-down. Here's an example:

Because containers have their own filesystem that is isolated from your host, you can start up a mysql:5.6 container, perform whatever operations you need to do for your testing, and stop the container. You can start up another mysql:5.6, (or even a mysql:5.7 container), and it will not matter than you could have destroyed that first container. The instances are independent of each other.

You can even easily stand up several DBs, and do some very complex A-B testing that would take a lot more effort if you were to manage the process with a homebrew installation.

---

It was not mentioned as a need for your usage, but Docker makes it easier to work with developers who use different operating systems, (but can also run docker locally). You can write one set of local development setup/test scripts, and it will generally not require any changes in order to have the same results.

It's a great tool for filtering out "it works on my machine".
> 4 votes

---
Tags: docker, testing, databases, open-source
---


# Question
Title: How to correlate Devops deploy on demand with Agile Sprint Process
I'm not clear how a Sprint which is timed-box to a predetermined length (1/2/3 weeks) fits with a DevOps principle of being able to deploy on demand or as needed.

Is deploying to production part of the definition of done rather than a post activity to the overall sprint?

How does the sprint process capture that code was deployed to production in the middle of a sprint rather than at the end where the goal is to have "potentially shippable product"?

# Answer
> 6 votes
There is no "Deploy-once-a-day" rule in devops philosophy. It's more of: Deploy as soon as possible and as often as possible. Also it calls for decoupling architecture so different parts of it may be released separately and also for decoupling deploys from release.

The Deveops Handbook by Gene Kim et al.calls for modifying Definition of Done to include running in production-like environments. That is follow the devops principles all the time during the sprint.

What you want to avoid is ending a sprint with all the developers handing over their code that is tested, is working but is not integrated and is handed to other team to be deployed, somehow.

I'd argue that definition of done is : it's not done until it's ready to run in production. Once it's ready you may or may not release it depending on your specific business needs and the sprint goal but if it's not ready to be released right now it's not done.

# Answer
> 2 votes
In a sense your question exactly underlines the problem faced by teams trying to be agile but without having the benefits of a good DevOps culture in place: there is practically no guarantee that at the end of each sprint they'll be able to deliver to their customers.

In some cases teams may end up using more relaxed definitions of done (like passed QA in my workspace/branch) or may account the additional steps for making the code shippable as tasks.

But with DevOps being `able to deploy on demand or as needed` shipping at the end of the sprint should simply be normal. Agile and DevOps really work very well together.

Side note: personally I find the `able to deploy on demand or as needed` a stretch - that only happens if the CI/CD processing passes all necessary QA checks. Very few CI/CD tools out there are able to actually guarantee it.

# Answer
> 2 votes
The Agile software development method

> describes a set of values and principles for software development under which requirements and solutions evolve through the collaborative effort of self-organizing cross-functional teams. It advocates adaptive planning, evolutionary development, early delivery, and continuous improvement, and it encourages rapid and flexible response to change.
>
> The term agile (sometimes written Agile) was popularized by the Agile Manifesto, which defines those values and principles. ***Agile software development frameworks continue to evolve, two of the most widely used being Scrum and Kanban.***

While there is no rule prohibiting using DevOps at the end of a Scrum Sprint to deploy the Sprint's results (in fact, it's encouraged - you are less likely to have mistakes and more likely to have production deployed identical to dev and test) DevOps is really better suited to Kanban than Scrum.

This is because the DevOps philosophy of rapid testing and release targeting 10+ deploys a day is better suited to releasing every time a work item is completed, which more closely aligns with the rapid feedback and response model outlined in the Second Way of DevOps.

However, even during a sprint, DevOps may be helpful to deploy code to testing, QA and staging and have pre-canned automated testing run through the testing units and report results or set up a new sandbox environment. This can allow developers still get the rapid, amplified feedback that DevOps can provide and increase the time spent coding instead of wasting that time prepping development environments - even if you do not deploy all the way to production.

# Answer
> 2 votes
Some great answers here, but I thought I'd chime in with an example of how we deliver features. "shipping" to production is not the goal, the goal is to deliver value. Shipping code to production is a means to an ends and we usually deploy many times to enable a feature. Here's a contrived example using a 1 week sprint for succinctness.

During planning on Monday the team discusses the new feature they want to implement and decide some refactoring work needs to be done before it can be implemented. Not doing the refactoring would introduce extra technical debt and potential performance issues. They spend the rest of Monday and most of Tuesday refactoring and ship this change Tuesday afternoon. This change is not visible to users.

Wednesday and Thursday they spend implementing the feature and deploy it to production at lunchtime Thursday, but only to a subset of users (using feature flags or a/b testing). Friday morning they find a bug in their code or maybe an undesirable outcome from the testing and ship an update at lunch time. Later they enable the feature for everybody.

This contrived example involved three deployments before the feature was considered "done". Most importantly it makes use of fast feedback to drive feature delivery. Taking the approach of writing features and deploying them as the "end game" introduces longer feedback cycles and makes your team slow to react i.e. less Agile.

# Answer
> 1 votes
> I'm not clear how a Sprint which is timed-box to a predetermined length (1/2/3 weeks) fits with a DevOps principle of being able to deploy on demand or as needed.

As usual, there is no commonly agreed-upon definition of DevOps, or description of what it entails, so we're just spouting opinions here. But in mine, DevOps encourages operations engineers to do as much as they can to get out of the way of developers, which includes not being a blocker for deploys unless they actually need to be (provisioning, architecture review, etc.).

That's not really tied to the development cycle at all - no matter what the cycle is, your job is to not be a blocker in it.

> How does the sprint process capture that code was deployed to production in the middle of a sprint rather than at the end where the goal is to have "potentially shippable product"?

It depends of course on your company, but in my opinion a feature isn't done until users have it.

---
Tags: culture, release, process, agile
---


# Question
Title: How to get EC2 instance tags when pulling CloudWatch data?
For monitoring purposes, we're pulling AWS/EC2 instances statistics data from CloudWatch and save it to InfluxDB.

We're using Telegraf to do this.

However, when pulling the data from Cloudwatch, it doesn't contain the instance tags or env\_variables, only the standard instance fields (instance\_id, for example)

Is there a way to get this data when pulling the stats? Some other agent? A Lambda function?

# Answer
CloudWatch metrics contain "dimensions" that loosely match InfluxDB's concept of "tags". The list of dimensions available for EC2 metrics is available in the AWS documentation. Instances tags are not available and I'm not sure what you mean by `env_variables` but since all that is supported is

* AutoScalingGroupName
* ImageId
* InstanceId
* InstanceType

the answer is still going to be this is not possible.
> 2 votes

---
Tags: monitoring, amazon-ec2, amazon-cloudwatch
---


# Question
Title: Bad edit to sudoers file on EC2 instance, how to fix it?
While writing a script to edit the sudoers file without using `visudo`, the script did not check for issue, and I have introduced some bad edits into the `sudoers` file, and thus cannot use sudo at all anymore. (I know I did a very bad thing, and should probably have used something like this)

**Question**: Is there anyway I can recover from this mistake, or do I have to destroy the VM and start from scratch with a new one?

# Answer
How about user-data ?

I believe adding the "#cloud-boothook" allow to force the user-data to run at every restart.

```
#cloud-boothook
#!/bin/bash
echo 'test' > /home/ec2-user/user-script-output.txt

```

If so, you could fix your sudo scripts hopefully... or install / add AWS run commands configuration https://aws.amazon.com/blogs/aws/new-ec2-run-command-remote-instance-management-at-scale/

For sure if it is an EBS Drive, you can detach & fix and then re-attach on the original system. A bit of a pain though.
> 5 votes

# Answer
Generally recovering from this sort of mistake involves editing the boot loader to force a root shell. Since you don't have physical access to the (non-physical) machine, things are a bit different.

If this is an EBS boot drive, you can try detaching it, fixing it on another machine, then reattaching.

This is a good opportunity to learn why it's useful to use configuration management tools for everything: if you were doing this, you could replace the instance in just a few minutes and one command.
> 4 votes

# Answer
If you know the root password, typically you can type "su" to switch to a super-user. You can then edit your sudoers file to fix sudo.
> 1 votes

# Answer
You need to have root access by using the `su` command as `sudo` doesn't seem to be usable and then make appropriate changes. Now for the most important point:

*Always use* **visudo** *to edit sudoers file*

Why? It tells you if there are any errors after you made changes hence preventing one from messing up `sudo` access.

> To resolve broken `sudo` follow this guide.

\*This may not be possible in virtual compute.
> 1 votes

# Answer
Detach the root volume, attach it to a running instance and restore the sudoers file in the volume. Detach the volume and re-attach to the instance in question and restart it. This should work.
> 1 votes

---
Tags: amazon-ec2, configuration
---


# Question
Title: Persistent Storage with Docker in Production - Which Solution and Why?
I've recently started working for a company that wants to break their monolithic SaaS application up into containerized microservices. I'm having a hard time grasping a fundamental part of persistent storage, though. Why are there so many different competing platforms? Portworx, Rexray, StorageOS, Flocker, Inifint, etc.

**My Questions**

1. Why wouldn't someone simply spin up an NFS server and use a hierarchical folder structure there as their storage backend? What gains do you get when using one of these tools?
2. How dangerous is it to use something like this with Docker? What are the common causes for catastrophic data loss in a docker-based environment?
3. What persistent storage solution would you recommend and why? My company operates a SaaS platform. The data payloads are small in size (5kb-100kb). Data processing is small-medium in resource consumption. Overall volume is medium, but continues to grow. We're hoping to completely move our monolithic application to the cloud as separate containerized microservices. Including our data warehouse.
4. Somewhat unrelated, but it ties in. What are the strengths of using Kubernetes as an orchestrator as opposed to Rancher/Cattle? Isn't Kubernetes over-engineered for a small-medium sized platform? Are there any strengths to using Kubernetes in Rancher aside from the one-click installation?

*Thank you for the insight. Sorry for the naivety. I welcome all documentation and supplemental reading material.*

EDIT: For context we are using Azure as our underlying Cloud platform.

# Answer
> 4 votes
I can answer the 2nd point:

Docker is most suited in a micro service based architecture when the application runs inside the containers but the storage or any other live sessions are maintained in shared RAM or the database.

Basically you just should not store anything inside the docker container. There are many reasons to it:

1. Consider upgrade: Someone from your team has created a newer image of the application and you need the container running with the latest image. The current docker and popular way of doing this is to bring the existing container down and spin a new container with the same run time parameters as the older container but with the newer image. This is one of the biggest reasons why containers should always be stateless and not contain any data. You can have all your data mounted to some place and sessions kept inside a db or something like memchached etc.
2. One of the big use case of docker is to build clusters. If you start keeping data inside your containers then its an overhead to maintain that data in sync between the application containers.
3. The docker community in general does not recommend to keep any data in container and hence nobody has tried taking this risk in production and nobody wants to be the first storyteller of how they messed up production :)

---
Tags: docker, kubernetes, storage, data, data-protection
---


# Question
Title: Conflicting Kubernetes CPU usage & Docker Container Metrics
We recently switched over our production environment to Kubernetes. I'd like to enforce CPU limits on the containers. I'm getting conflicting CPU metrics that do not fit together. Here's my setup:

* DataDog agents running as a `Daemonset`
* Existing applications running without CPU Limits
* Containers in question are multi-threaded Ruby applications
* Two metrics: `kubernetes.cpu.usage.{avg,max}` and `docker.cpu.usage`
* `c4.xlarge` cluster nodes (4 vCPUs or 4000m in Kubernetes terms)

`kubernetes.cpu.usage.max` reports ~600m for the containers in question. `docker.cpu.usage` reports ~60%. It follows that a 1000m CPU limit would be more than enough capacity under normal operation.

I set the limit to 1000m. Then `docker.container.throttles` goes up significantly while `kubernetes.cpu.usage.max` and `docker.cpu.usage` stay the same. The system all fells to it's knees during this time. This does not make sense to me.

I researched Docker stats. It seems that `docker stats` (and the underlying API) *normalize* load according to CPU cores. So in my case, `docker.cpu.usage` of 60% comes (4000m * 0.60) to 2400m in Kubernetes terms. However this does not correlate with any Kubernetes numbers. I did another experiment to test my hypothesis that Kubernetes numbers are incorrect. I set the limit to 2600m (for some extra headroom). This did not result in any throttles. However Kubernetes observed CPU usage did not change. This leaves me confused.

So my questions are:

* Does this feel like a bug in Kubernetes (or something in the stack?)
* Is my understanding correct?

My follow up question relates to how to properly determine CPU for Ruby applications. One container uses Puma. This is a multi-threaded web server with a configurable amount of threads. HTTP requests are handled by one of the threads. The second application is a thrift server using the threaded server. Each incoming TCP connection is handled by it's own thread. The thread exits when the connection closes. Ruby as GIL (Global Interpreter Lock) so only one thread can execute Ruby code at a time. That does allow for multiple threads executing IO and things like that.

I think the best approach is limit the number of threads running in each application and approximating Kubernetes CPU limits based on the number of threads. The processes are not forking so total CPU usage is harder to predict.

The question here is: how to properly predict CPU usage and limits for these applications?

# Answer
Multiple things here:

1. Youre on AWS ec2, hence whatever you are doing on your instance for measuring CPU is calculating CPU on hypervisor level and not instance level. To very this run any load test and check iostat -ct 1 and CPU usage in cloudwatch. CPU usage in cloudwatch is always 10-20% greater than what iostat will report and that is because iostat will give CPU usage on hypervisor level.
2. As docker to see how kubernetes and docker metrics compare i suggest to run the containers with --cpuset=1 or any number to allow all containers to use only a single vCPU.
3. Also in AWS 1 CPU= 2vcpu. It is hyperthreaded to 2. You can maybe take this into consideration while calculating.
4. Finally the best metric to use to see CPU usage for a particular application is using htop and correlating with your cloudwatch metrics.
5. I have also observed sometimes docker daemon pinning itself to one of the virtual CPUs and hence when you are reducing it to 1000m, maybe the whole setup is getting slow because the reduction is happening on any one of the vpcus. You can use mpstat to get into details of this.
6. Lastly on the host level you can pin docker to a single CPU and observe more.

Hope this brings you somewhat closer. Update me if you have already found a solution.
> 4 votes

---
Tags: docker, kubernetes
---


# Question
Title: How to have multiple log streams in docker
We have an application that writes three types of logs into three separate files: access logs, generic application logs and system logs. The format (and purpose) of these logs are very different. And we have separate logforwarders that send them separately to our centralised logging system.

Based on the treat logs as event streams principle, we are thinking about moving from using files to stdout. While we know some of the benefit of this approach, this would also mean that we'd get a merged stream of the differently formatted logs, which we would need to split again either before we can send them to our central system (Kibana / Splunk / etc.), or inside there.

We're wondering whether there are any tools or recommendations on how we should approach this situation.

# Answer
> 16 votes
I'm still looking for a merging/splitting approach myself, but meanwhile this approach recommended by Kubernetes documentation seems like a sound solution: Use a sidecar container for each of your separate logs.

A "sidecar" is any docker container that you use alongside another docker container to work with it in some way. In this case for each of your three logs you would have a separate container that scans or tails the logs and outputs to stdout.

This way each of your log-sidecar-containers has its own docker-log from its own stdout. Being separate like this, you can use standard docker (and kubernetes, etc) practices for separating or aggregating. Here's what the Kubernetes page has to say:

> This approach allows you to separate several log streams from different parts of your application, some of which can lack support for writing to stdout or stderr. The logic behind redirecting logs is minimal, so it’s hardly a significant overhead. Additionally, because stdout and stderr are handled by the kubelet, you can use built-in tools like kubectl logs.

The "separate log streams" stem from the built-in tagging that docker applies to logs from different containers, described in the docker documentation here:

> The tag log option specifies how to format a tag that identifies the container’s log messages. By default, the system uses the first 12 characters of the container id. To override this behavior, specify a tag option

# Answer
> 8 votes
The idea of merging them into one stream just to split them later sounds painful. I've not had a reason to do this myself, but here's where I'd start:

* When you run the docker container, create a volume such that it will be easy to view/ship logs from the host.
* Use something like remote\_syslog2 to ship the logs to your log collector

It feels a little less-than-elegant to have to do some setup on the host as well, but if you use something like ansible where you can run a playbook and set that up during your deploy to the box it shouldn't be too bad.

---
Tags: docker, logging
---


title: How to send SMS through AWS?

text:
# Question
Title: How to send SMS through AWS?
Can we send SMS through AWS for the below case?

I have an application installed on Ec2 and that application runs few rules and may send SMS to end users if the rule conditions are met.

I wanted to integrate it with some SMSC and thought of giving a shot with AWS-SNS. However, I am not able to figure out how will i integrate my application with AWS-SNS.

Going through the documentation of AWS-SNS I am not sure if this can be achieved. It talks about creating topics and assigning E164 numbers to topics but does not tell us how to integrate this with our already existing application.

# Answer
> 8 votes
I believe you will need to do this programmatically using the AWS SDK as described in Sending a Message (AWS SDKs). Here is a quote a from it:

> To send an SMS message by using one of AWS SDKs, use the action in that SDK that corresponds to the Publish request in the Amazon SNS API. With this request, you can send an SMS message directly to a phone number
>
> ...
>
> **Sending a Message (AWS SDK for Java)**
>
> The following example uses the publish method of the AmazonSNSClient class to send a message directly to a phone number:
>
> ```
> public static void main(String[] args) {
>         AmazonSNSClient snsClient = new AmazonSNSClient();
>         String message = "My SMS message";
>         String phoneNumber = "+1XXX5550100";
>         Map<String, MessageAttributeValue> smsAttributes =
>                 new HashMap<String, MessageAttributeValue>();
>         //<set SMS attributes>
>         sendSMSMessage(snsClient, message, phoneNumber, smsAttributes);
> }
>
> public static void sendSMSMessage(AmazonSNSClient snsClient, String message,
>       String phoneNumber, Map<String, MessageAttributeValue> smsAttributes) {
>         PublishResult result = snsClient.publish(new PublishRequest()
>                         .withMessage(message)
>                         .withPhoneNumber(phoneNumber)
>                         .withMessageAttributes(smsAttributes));
>         System.out.println(result); // Prints the message ID.
>
> ```

---
Tags: amazon-web-services, amazon-cloudwatch
---


title: Docker Container capacity planning

text:
# Question
Title: Docker Container capacity planning
I'm running my application on 4 Virtual Machines with 8 3.2 GHz Virtual CPUs and 32 GB, however, I will be splitting up the processes into separate containers.

I am not sure how many containers to run per host. What are the typical numbers? For example how the VM to bare metal server ratio is 1:10 generally, any links on attributes to consider, decision frameworks to consider or experiences would help!

# Answer
> 9 votes
The same as any Linux load, consider no more processes in wait state than the number of CPU. The load on 1, 5 and 15 mins given by `uptime` should ideally be 1 less than number of cores.

Containers are roughly isolated processes, leaving a core for orchestration avoid congestion.

That doesn't mean only 7 containers on a 8 cores machine, it's a matter of simultaneous load, so the best way is to measure it and adapt consequently.

# Answer
> 1 votes
I personally have spinned 100 containers on a 32vcpu machine and as many docker containers pin to random CPUs, there is no such correlation between number of containers and number of vcpus. As docker containers can be thought of as processes, it seems logical what @Tensibai has mentioned.

---
Tags: docker, containers, capacity-planning, kubernetes
---


# Question
Title: Getting a docker build ready for (Heroku) deployment?
I've got a local application working using `docker-compose up`, this gets me the servers I need and they function just fine locally.

Now I've tried getting a `build.sh` started, but I can't figure out how to build a docker image using either `docker-compose` or just regular `docker-cli` with the final result of the build process. (The `/dist/` folder).

Could somebody explain to me how a regular process like this would look like, and what steps a build process would walk through in docker terms? Would I need a seperate command to package it for deployment? Is there a separate configuration required?

# Answer
For building docker image using `docker-compose` you can add `build:` field to the service you want to build and assign to it the path of the `Dockerfile` for example:

```
version: '2'
services:
  web:
    build: .
    ports:
     - "8080:80"
    volumes:
     - /project:/var/www/html

```

This example define a web service which:

* Uses an image that’s built from the `Dockerfile` in the current directory.
* Forwards the exposed port 80 on the container to port 8080 on the host machine
* Mounts the project directory on the host to `/project` inside the container, allowing you to modify the code without having to rebuild the image.

To build the image, simply issue the build command via docker-compose, as such: `docker-compose build`.
> 1 votes

---
Tags: docker
---


# Question
Title: How to create staging servers for multiple git branches?
I have to create a new staging process for our development and testing.

At any given time, there are only around 4 git branches actively being developed and tested. Within each git branch, there **may be** database evolution scripts (straight SQL) that must be run, as well as evolution scripts from the backend for heavier processing (essentially these are HTTP routes that must be called within the app using admin credentials that perform database migrations and other changes that would be too difficult/not possible to script in the aforementioned plain SQL evolution scripts).

Our live DB is moderately sized ~ 4.2 GB. We have a brand new Dell PowerEdge server that is ready to be set up and is at my disposable.

I would love advice on the following questions, as well as to know how more experienced DevOps would approach this:

1. How can I run several different branches on the staging server? These branches pop up and disappear frequently as they pass QA and are merged into master and are released.
2. How would I set up the DB evolution system to make sure it always has appropriate DB for each branch? Each branch may make modifications to the DB in different ways that are not necessarily compatible with each other until they're merged.
3. How do I keep these branches up-to-date? Is there a way to auto pull commits on each branch?

Would love any more input as I'm a bit lost on how to set this all up. Current workflow is difficult for everyone involved: Devs have a completely isolated local copy of the app running locally and QA has 3-4 laptops in rotation that act as their staging "servers"

# Answer
> 7 votes
> 1) How can I run several different branches on the staging server?

Docker

> 2) How would I set up the DB evolution system to make sure it always has appropriate DB for each branch?

This depends on how much you expect your DB to scale. You can get pretty crazy with methods to clone database data but typically you will want a master copy that you do not alter until your code is released into production - and keep good backups when you do. While you *infrastructure* can be immutable and disposable, your data is not. You can only *emulate* disposability with you data. 4.2 GB really isn't that much to copy. You could make a script to spawn a new database instance for each build to operate on, then discard it once testing is complete.

> 3) How do I keep these branches up-to-date? Is there a way to auto pull commits on each branch?

You could consider using something like git hooks to trigger a build, force a code checkout or begin spawning a container and cloning your database. You could make an API call to a build automation system like Jenkins and/or use it to kick off a configuration management system like Puppet, Chef, Salt Stack, Ansible or something else. This would be more like an auto-pull than an auto push.

From the wording of your question, it's clear you are thinking of a mutable infrastructure, but consider using immutable testing deployments instead.

# Answer
> 2 votes
I'd argue that this isn't actually about staging servers. A staging server closely mimics the production environment, and is where a release goes immediately prior to going to production. A feature branch that hasn't been merged into master is not going to be released directly to production, so it should not go on a staging server.

If we reframe the question as being about shared development servers, then you'll find more resources as you search. As you've noticed, sharing development resources like this causes a number of problems, so it may perhaps be better to focus on solving the underlying issue instead: why is it hard for everyone involved in this process to run a dev server on their local machine?

---

Now, sometimes the situation is that you do indeed need to have these shared servers. If you've gone through and determined that you really *do*, then there are a number of techniques you can take to simplify the process.

> How can I run several different branches on the staging server? These branches pop up and disappear frequently as they pass QA and are merged into master and are released.

One of the easiest ways is to use part of the url to switch which code branch gets executed (this change is part of why this is not an appropriate staging environment). I've done this in the past with a wildcard DNS (so any `foo.our-dev-domain.com` would redirect to the same server) and routing code that loaded up `/our/release/directory/foo` in the include path.

You can also have a command (using something like Ansible) that adds the necessary configuration for a branch as necessary. This would probably be part of the deploy process, which I'll talk about in a minute.

> How would I set up the DB evolution system to make sure it always has appropriate DB for each branch? Each branch may make modifications to the DB in different ways that are not necessarily compatible with each other until they're merged.

The easiest thing to do is just live with it, and encourage people to have short-lived branches.

Another approach is to use dynamic routing code to switch to separate copies of the database (in RDBMS terms, a "database") based on the name of the branch.

> How do I keep these branches up-to-date? Is there a way to auto pull commits on each branch?

You can either push or pull. For instance:

* *pull* \- set up a cron job that does a `git pull` (or probably, a `git fetch` and a `git reset --hard`) every few minutes
* *push* \- set up a webhook that triggers upon push, and a little web service on the machine that listens to that and updates the repos as necessary
* *push* \- have developers explicitly run a deploy command to update their branches on the server

Talk to your users first and gather their requirements to see what they want (they may not like having it update automatically while they're in the middle of testing something), and that will inform your decision.

---

But again:

> Devs have a completely isolated local copy of the app running locally and QA has 3-4 laptops in rotation that act as their staging "servers"

The problem seems to be that QA rotates shared laptops instead of just checking out a particular branch the same way devs do.

# Answer
> 1 votes
That is what gitlab does best, consider to move to gitlab, setup a kube cluster and auto deploy. This will deploy each branch to an unique URL for testing.

---
Tags: git, testing, builds, branch, mysql
---


# Question
Title: Incorrect timezoneID inside docker container
I have created a docker image from the base Centos7 image and while running the container from it, the time and timezone were not in sync with my host. To give the container the same timezone as that of the host. I mounted /etc/timezone and /etc/localtime from the host to the container using the '-v' argument while running the container. After running the container with this, this is what i get inside the container and host:

For docker container running timedatectl:

> \[root@d7a24c723f6a /\]# timedatectl Local time: Tue 2017-08-01 10:28:30 IST Universal time: Tue 2017-08-01 04:58:30 UTC RTC time: n/a Time zone: UTC (IST, +0530) NTP enabled: n/a NTP synchronized: no RTC in local TZ: no

For host running timedatectl:

> \[root@indiadev72 ~\]# timedatectl Local time: Tue 2017-08-01 10:27:29 IST Universal time: Tue 2017-08-01 04:57:29 UTC RTC time: Tue 2017-08-01 04:57:29 Time zone: Asia/Kolkata (IST, +0530) NTP enabled: yes NTP synchronized: no RTC in local TZ: no DST active: n/a

I am not sure why my docker container is not able to take the timezone of the host.

EDIT: Also while running some of my test cases, i am able to see that the application is reading timezoneid as 'GMT+530' instead of Asia/Kolkata. While GMT+530 is indeed Asia/Kolkata but due the timezone ID mismatch inside the container my test cases are failing. Maybe its just the timezoneID issue and the container is picking up the correct time. Can someone please help here?

# Answer
The case is `dpkg-reconfigure tzdata` simply creates `/etc/localtime` as a copy, hardlink or symlink (a symlink is preferred) to a file in `/usr/share/zoneinfo`. So it is possible to do this entirely from your `Dockerfile`. Consider:

```
ENV TZ=Asia/Kolkata
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

```

And as a bonus, `TZ` will be set correctly in the container as well.

This is also distribution-agnostic, so it works with pretty much anything Linux.

The original answer: https://serverfault.com/questions/683605/docker-container-time-timezone-will-not-reflect-changes
> 1 votes

---
Tags: docker, linux
---


# Question
Title: Setting up Jenkins and git-server on same server
I want to setup a Jenkins and git on the same server.

What I am trying to do:

I want Jenkins to be able deploy a folder to another server which runs IIS server (which is running `.net`). I don't have code as I bought the product the client provides me with . It's just a publish folder or the executable files which I directly put on the server .I will be using `git` for version controlling.

> I want jenkins to periodically check the git repository and when it finds any changes, it deploys it over to my remote server which is running IIS and rename the old folder on git with date wise.

How should I go about implementing this?

Thanks in advance for your suggestions.

# Answer
For me I use `jenkins` in docker with git plugin.

The Git plugin will give you the ability to check the Git server every specific period of time or you can use git hook from github or bitbucket to trigger the task when ever any change happened to the repo or the branch.

For deployment, most of time I use shell build step to execute some shell command on remote node.
> 3 votes

---
Tags: jenkins, deployment, git, continuous-deployment
---


title: Limits of a singular Docker Swarm stack

text:
# Question
Title: Limits of a singular Docker Swarm stack
Normally, the example you start with Docker introduce environment to right more or less one app - frontend, backend, something else..

Would you put all containers of a larger app (20-30 containers and above without replicas) still to the same stack or introduce a set of stacks representing system layers?

# Answer
> 3 votes
I would say It depend on you preference since redeploying a stack for only 1 or so image, will not restart all the containers present.

In the other hand network feature since docker 17.06 are reusable between stack with the `attachable mode` so you could easily separate the layers of your app while keeping them on the same sub-network (for usage like `traefik` or private data network).

Frankly for me this is the same problem as in dev when you separate the functions you are defining so it's easier for the others devs to understand a file of 50 lines compare to a file of 500 lines.

In the end it also depend on how this is integrated with your CD and if it's painful to update one document or multiple document when adding/removing services.

Personally I would go with multiples stack files.

---
Tags: docker, architecture
---


# Question
Title: Is there a conceptual limitation to have a clone stage function in Bamboo?
In Bamboo, you can:

* clone a job
* clone a plan

Why is it not possible to clone a stage, I mean, could there be a certain reason to not have it?

# Answer
Stages group jobs inside plans. So technically they are cloned when the respective plans are cloned.

Which means that missing the ability to clone a specific stage should be just a UX/usability/functionality issue, not a conceptual one.

There *might* be a non-trivial implementation details when cloning stages - they may carry inside stage sequencing information, as in "pointers" to the stage objects preceeding and/or following them inside the plan "pipeline", which might be a bit more difficult to handle when cloning just one stage in the sequence. These would be easier to handle when cloning entire plans as the entire sequence of stages is cloned, there will always be a 1:1 relationship between the stages.
> 2 votes

---
Tags: bamboo
---