title: Consulting DevOps from the Ops side

text:
# Question
Title: Consulting DevOps from the Ops side
## Background

One of the org units in my company is doing application support for a relatively large client; that is, they're keeping some of their business applications running 24x7, doing anything from the root account upwards (no hardware/network). Things like keeping volumes, RAM, CPU sufficient, routing bug tickets where they need to go, backup&recovery, all that stuff. All the applications (many) are in a quite stable state, little development is going on.

It's 100% classical, i.e., 100% Ops. The occasional contacts with development are laden with the usual problems (mistrust, prejudice, etc.).

The customer decided that it wants to be modern, and is in the process of introducing "DevOps" - without having a clear understanding of what that actually means. They just know that they don't want to have one large entity running a large cluster of servers, not really knowing the software indepth, but that individual teams should build and support their own applications. Note that there is no container technology or anything like that - they are getting into OpenShift, but softly-slowly. Everything is quite classical... trouble ticket systems, multi-tier support levels, a great many tickets solved regularly, but all of them very easy in itself (like volumes running full etc.), very occasional difficult problems that need developer input.

So I'm on a taskforce of ours that's supposed to come up with ideas. I have quite some experience consulting Dev teams to be more "DevOps"y - i.e., more automation, more tooling, keeping dev/test/prod environments identical, that kind of thing. From *their* point of view, it's pretty clear how to proceed. But in my current example, it's not quite clear to me what to suggest. They do have problems, but more in the "Ops" side (like finding enough good staff to man the 24x7 shifts and so on). There does not really seem to be a "Dev-Ops" problem to be solved.

## Question

In an Ops-heavy department with only a small amount of development going on, what are some DevOps practises, culture changes, process changes etc. that are very likely

* beneficial, no matter what they are doing so far
* relatively easy to introduce
* not that likely to induce fear and instinctive resistance (which there seems to be quite a case going on here, after the first talks)

For example, in a Dev team, I'd show them what to do with containers, or 12-factor, or ... and what concrete problem it solves, and this usually shows them that there's not much to fear, and that there are real benefits to be reaped. From there on, it goes as far as they want to take it.

The only objective problem I saw so far was that they really have little to no insight in the software, i.e., they mostly cannot even read the source (due to lack of knowledge) which would, in some cases, help in solving/routing bug reports etc.

The main subjective problem seems to be that they think *real* bad about developers. (According to them, those are lazy, picky, don't want to do 24x7, solve every ops problem simply by "re-rolling containers" etc.).

# Answer
The key to presenting solutions is always to identify problems first; if the team doesn't feel like you're solving any problems, then they're going to dismiss what you're suggesting. The specific problems your Ops team is facing we don't know, but there are a number of common ones:

* Getting non-actionable alerts
* Spending lots of time in toil
* Version upgrades are a pain
* Deployments are a pain
* No visibility into what the apps are doing

and so on. Once you know what problems they're having, then you can target solutions that fix those.

> The main subjective problem seems to be that they think real bad about developers.

Cultural changes are incredibly difficult to make (usually the easiest way to is hire people with the philosophies you want and gradually prune off the old people). But embedding operations engineers with developers can help this one immensely. I've worked in several small companies where there was just one engineering team (and I happened to work primarily on ops work), and so this idea comes very naturally to me, but for people who have been working solely on an operations team with little contact with developers for a long time, it can be a difficult adjustment. But move your desk to be with them, participate in their chat channels, eat lunch with them - this all helps both ops and devs realize that the other side are actually humans. This also provides better opportunities for ops to use their expertise to solve problems for devs that otherwise wouldn't've surfaced (say, they're trying to do something and you provide a quick shell script that solves it much faster than the manual way they were going with), and that builds trust and emotional budget that you can spend when you need something from them.
> 8 votes

---
Tags: culture, process
---


# Question
Title: Keep getting permissions error gcloud.container.clusters.get-credentials
I am trying to integrate CircleCi with gcloud Kubernetes engine.

1. I created a service account with Kubernetes Engine Developer and Storage Admin roles.
2. Created CircleCi yaml file and configured CI.

Part of my yaml file includes:

```
docker:
            - image: google/cloud-sdk
        environment:
            - PROJECT_NAME: 'my-project'
            - GOOGLE_PROJECT_ID: 'my-project-112233'
            - GOOGLE_COMPUTE_ZONE: 'us-central1-a'
            - GOOGLE_CLUSTER_NAME: 'my-project-bed'
        steps:
            - checkout
            - run:
                  name: Setup Google Cloud SDK
                  command: |
                      apt-get install -qq -y gettext
                      echo $GCLOUD_SERVICE_KEY > ${HOME}/gcloud-service-key.json
                      gcloud auth activate-service-account --key-file=${HOME}/gcloud-service-key.json
                      gcloud --quiet config set project ${GOOGLE_PROJECT_ID}
                      gcloud --quiet config set compute/zone ${GOOGLE_COMPUTE_ZONE}
                      gcloud --quiet container clusters get-credentials ${GOOGLE_CLUSTER_NAME}

```

Everything runs perfectly except that the last command:

```
gcloud --quiet container clusters get-credentials ${GOOGLE_CLUSTER_NAME}

```

It keeps failing with the error:

```
ERROR: (gcloud.container.clusters.get-credentials) ResponseError: code=403, message=Required "container.clusters.get" permission(s) for "projects/my-project-112233/zones/us-central1-a/clusters/my-project-bed". See https://cloud.google.com/kubernetes-engine/docs/troubleshooting#gke_service_account_deleted for more info.

```

I tried to give the ci account the role of project owner but I still got that error.

I tried to disable and re-enable the Kubernetes Service but it didn't help.

Any idea how to solve this? I am trying to solve it for 4 days...

# Answer
> 1 votes
I removed the service account and recreated it (with same name and roles). Generated a new key and updated the CI and suddenly it worked. gcloud glitch.

---
Tags: kubernetes, google-cloud-platform, circleci-2.0
---


# Question
Title: Change variable inside of project. Jenkins, docker, kubernetes
Because I am new in the DevOps, I don't know where I need to apply the changes to correctly run the project.

The structure:

Git → Jenkins → Docker build -\> Kubernetes (deploy)

Is it better to make the change of variables in the project, (example: password, database connection, etc.) to Jenkins, Kubernetes, or Docker?

Example:

With docker-compose I use an environment variable to change the variable inside my code.

```
environment:
  MONGO_INITDB_ROOT_USERNAME: user
  MONGO_INITDB_ROOT_PASSWORD: user

```

I want to change this variable and run correctly in the production environment.

I don't know where it is the best to change the variable, Jenkins, Kubernetes with Ansible, etc.

# Answer
> 1 votes
As @Harith mentioned, the use of secrets simplifies deployments in various environments using environmental variables. To load in a secret directly use:

> $ kubectl create secret generic \< NAME OF SECRET \> --from-literal=\< KEY \>=abc123!:?

NOTE! This will put the secret in the Default namespace, add a namespace flag for specific resources e.g.:

> $ kubectl create secret generic mongodbsecret --from-literal=mongoUser=abc123!:? -n mongoNamespace

You can then reference this secret in the deployment.yml or pod.yml or wherever you put your image for deployment on the kubernetes cluster.

```
env:
- name: MONGO_INITDB_ROOT_USERNAME <name of the env var in the code>
   valueFrom:
     secretKeyRef:
       name: mongodbSecret <NAME OF SECRET>
       key: mongoUser <KEY>

```

However, if all you need is to change 'development' to 'production' you could put an environment var directly in the (deployment).yaml.

```
env:
- name: NODE_ENV
  value: production

```

You can also update the Jenkinsfile to send in the environment by for instance:

```
def resource_env = BRANCH_NAME == 'master' ? 'production' : 'development'

sh "kubectl set env ${kubeImageName} NODE_ENV=${resource_env} --namespace ${kubeNamespace}"

```

On your current pipeline idea: The safest place for sensitive env vars would be putting it in kubernetes in a secret in your situation. However, for simple selection of deployment environments then using a Jenkinsfile simplifies things a bit like 'prod' vs 'dev'. Putting sensitive, variable or private things on git is a bad idea. Keep your docker images precise and task-orientated.

Hope that helps

# Answer
> 0 votes
The most important aspect you must consider when dealing with environment variables is **security**. So, no matter what, you don't want to expose the environment variables to the public by putting them out to, for example, github.

Coming to your question, here is how you would use;

***Docker***: Make the docker take the values from the shell. So, in this case, you would need to use Jenkins to store your environment variables which will then be picked up by docker.

***Kubernetes***: Kubernetes provides an object known `Secrets`, so by using this object, you can store environment variables and then have them accessed via `Deployment` k8s object. https://kubernetes.io/docs/concepts/configuration/secret/

---
Tags: jenkins, continuous-integration, kubernetes, jenkins-plugins
---


# Question
Title: Docker Hub automated builds and Travis CI
I'm wanting to create a basic 'on new commits to master, rebuild the images and deploy to kubernetes' pipeline.

Docker Hub has its concept of automated builds on new commits, but I'd still need to use Travis CI to do the kubernetes deployment.

Is there a way to synchronise these - so that Travis doesn't start its scripts until Docker Hub has built the image?

Alternatively - I could just do all of the building on Travis CI. But Docker Hub doesn't seem to provide service accounts - or have I got that wrong? It seems like the only way to create a service account is to actually manually create a new username/password for service account. Is that the case?

What are the generally established ways of doing this?

# Answer
> 1 votes
If you're married to Docker Hub, you could use a webhook to notify Travis of the need to start it's job.

However, I solve this problem using Quay.io - it has the robot account (you refer to "service account") you need. It also has a richer set of notifications.

You could maintain your current workflow using webhooks to

1. create the repository on Quay or Docker Hub, have the image built on git events.
2. Create a webhook in the repository to send data to your Travis job when builds succeed

Or, you could build your images in the Travis job.

1. Push the initial image to a repository on Quay
2. Add a robot account to your repository in Quay
3. Add the necessary secrets to your Travis build (token and robot user name)
4. Configure Travis to build the image, run whatever tests you need and then push on green.
5. Add an `after_success` task to redeploy your app in k8s after the push.

---
Tags: travis-ci, dockerhub
---


# Question
Title: Are there dialects of YAML or just differences in parsing it?
We use YAML in several frameworks to define types and structures for our deployments. I read an article about why some people don't like YAML and they stated that the parsing of YAML is very different depending on the interpreter.

Can it be said that these interpreters define their own dialects of YAML or would that not be the case?

The background is that we would like to verify and validate YAML in our templates.

# Answer
There is only one YAML spec. That would lead me to say "There are no YAML dialects". There are certainly differences in **implementation**, perhaps due to what the article claims as the spec's ambiguity:

> YAML specification is so ambiguous,

It's a matter of opinion, I believe, but there is no doubting that various language-specific parsers of the same data result in different output. So, to answer the question(s):

1. **no** there are no YAML dialects (since there is one spec)
2. **yes** the spec provides much leeway for implementation and thus there are differences in how it is parsed.
> 2 votes

---
Tags: cloud, yaml, aws-cloudformation
---


title: How fast does Prometheus data grow?

text:
# Question
Title: How fast does Prometheus data grow?
This may sound like a vague question so I will provide some context below. The basic question is :

**What parameters describe the growth in size of a Prometheus database over time?**

To tie the question down: **When will the prometheus time series data base reach 1TB if I collect 10 metrics sampling them at 5 per minute?**

# Answer
Prometheus use a timeseries databases with vacuum, the documentation gives some maths to plan your disk consumption:

> On average, Prometheus uses only around 1-2 bytes per sample. Thus, to plan the capacity of a Prometheus server, you can use the rough formula:
>
> ```
> needed_disk_space = retention_time_seconds * ingested_samples_per_second * bytes_per_sample
>
> ```

So depending on your retention configuration, 1TB could never be reach or you can keep a very long time. That said it's using prometheus local storage, using another storage system will change the maths depending on the system concerned, influxdb is one of them and has its own documentation about storage.
> 8 votes

---
Tags: monitoring, capacity-planning, prometheus
---


# Question
Title: What are best practices for creating and triggering various pipelines regards monorepos?
According to this article a monorepo contains different projects. What are best practices for triggering different pipelines?

The current git repo contains the following projects:

```
╔═════════════╗
║ projects    ║
╠═════════════╣
║ A           ║
║ B           ║
║ C           ║
║ D           ║
║ E           ║
╚═════════════╝

```

There are three different pipelines, i.e. `x`, `y` and `z`

If a certain project inside the monorepo changes, different pipelines should be triggered, i.e.:

If a commit is done in folder `a` then pipeline `x` should be triggered (`a --> x`). If a change occurs in directory `b` or `c` then pipeline `y` should be run (`b || c > y`) and if either `d` or dir `e` changes then pipeline should start running (`d || e > z`).

How to achieve this? Most CI's are triggered by changes in a repository, e.g. one commits to a repo and a pipeline is triggered. There is a 1 on 1 relation. If this is translated to a monorepo that means that 1 change results in 3 pipeline triggers, while in some cases only 1 pipeline should be triggered.

# Answer
> 6 votes
> If this is translated to a monorepo that means that 1 change results in 3 pipeline triggers, while in some cases only 1 pipeline should be triggered.

I would definitely take this point into further consideration. One of the most compelling reasons for using a monorepo is that it does not create a technical separation of projects. There is only a logical separation, with the only technical distinction possibly being your versioning (unless you have a universal version number). This means, that you have no 100% guarantee that any one project does not depend on another project. Because of this, your final pipeline at some point should include **all of the projects** within your repository. By doing so, you are guaranteeing that a change to one project does not negatively impact any other projects in your repository (at the cost of the project with the longest time to build, publish, etc.).

That being said, if there are some steps in your pipeline that you would like to run separately (lint, syntax, compile, etc.), most CI's should have a way to filter your repo for a specific folder/project. If it doesn't, and you still don't want to run against all projects, you may need to consider refactoring your repository into separate repos or changing CI tools to comply with your workflow.

# Answer
> 3 votes
You need to narrow down your scope and deal with tooling for monorepos. There are various *awesome-monorepo* lists on Github (this is a recent one) to actually find out, what kind of tooling fits your use case best (what programming languages are you using?).

If you have completely isolated projects in your repository you can cobble up some bash scripting utilizing `git diff` output or better use one of the many available monorepo-aware built utilities (see above awesome list for examples).

---
Tags: continuous-integration, monorepo
---


title: Access database deployed in kubernetes

text:
# Question
Title: Access database deployed in kubernetes
I have created created a kubernetes cluster with 1 master and 2 nodes in our data centre and deployed a postgres database in it. I would like to access database with with Pgadmin

# Answer
> 0 votes
Expose the Postgres instance by setting up a node port service. Allow only specific IP addresses to access that service, this prevent unauthorized access.

---
Tags: kubernetes
---


# Question
Title: Is it possible to consolidate notification handlers when they are very similar?
I have an Ansible role which uses handlers to restart services via the `systemd` module.

```
- name: restart ntp
  systemd:
    name: ntp
    enabled: yes
    state: restarted
  become: true

- name: restart web server
  systemd:
    name: nginx
    enabled: yes
    state: restarted
  become: true

- name: restart grafana
  systemd:
    name: grafana
    enabled: yes
    state: restarted
  become: true

```

Is there a way so I could parameterize the three separate handlers into something like this?:

```
- name: restart {{svcname}}
  systemd:
    name: '{{svcname}}'
    enabled: yes
    state: restarted
  become: true

```

# Answer
In ansible 2.7 and earlier versions, variables in handlers name are not populated.
This bug was reported and a correction was lately pushed to devel version.

You need to run ansible from devel, and hope they publish this fix in the next release.
> 4 votes

# Answer
You could set a fact to be the list of services you need restarted by the handlers:

```
- name: Tag services to restart
  set_fact:
    services_to_restart:
     - ntp
     - nginx
     - grafana

```

then your handler becomes:

```
- name: Restart tagged services
  service:
    name: "{{ item }}"
    state: restarted
  loop: "{{ services_to_restart }} | default('nginx')"

```

I suggest using a sane default there in case you send an empty list to the service module.
> 1 votes

---
Tags: ansible
---


# Question
Title: How to report Code Coverage metrics across git repositories?
We are using private git repositories in Azure DevOps and I have a requirement to create code coverage report across git repositories. Our build CI/CD pipelines are using both TeamCity & Azure DevOps. I have looked at options and there is no straightforward solution to this problem. I am thinking about the following options:

* using service like coveralls.io, there is an option to add private repositories; the drawback it is subscription based service
* using TeamCity SonarQube plugin; It is not ideal and limited to the plugin features; I haven't tried it yet.
* using custom script to query and aggregate existing code coverage metrics of last successful build in TeamCity/Azure DevOps across projects and group them by repository; Both Azure DevOps & TeamCity offer REST APIs that can be used to get the data.

I still need a solution for Azure DevOps builds, however I have to admit I have not researched this properly yet.

**Has anyone done cross repository code coverage reporting and what approach/tools might be best**?

# Answer
If you use python and GitLab like I do, you can include a test coverage report in your CI/CD pipeline. You `pip install coverage` and then just run `coverage` in your pipeline. The following is an excerpt from an AWS lambda pipeline, but you should be able to find something similar for your environment:

```
 script:
    - pip install -r ./awslambda/requirements.txt
    - coverage run -m unittest discover -v -s "./awslambda" -p "*_test.py"
    - coverage report

```

The above generates a nice code coverage report and it is free of charge, for Python, AWS and GitLab.
> 3 votes

# Answer
You can use sonarqube. It does not generate its own test coverage report, but re-uses the coverage file of your existing pipelines.
> 1 votes

---
Tags: azure-devops, teamcity, code-coverage
---


# Question
Title: What is the best way to put on a repository for a docker image with multiple tags?
I've seen a lot of repositories with Docker images and I think (correct me if my guessing is wrong) that the projects that handle a docker image with multiple tags can be grouped into three groups:

* Dockerfiles with different names in the same directory.
* Dockerfiles with the same name (i.e. "Dockerfile") in different directories.
* Dockerfiles with the same name (i.e. "Dockerfile") in different branches.

I've looked at the Docker documentation page but there are no suggestions on how one should manage multiple tag images. I'm not looking for a subjective answer. Of course, any advice will be appreciated but what I want is to know the pros and cons of each of the three possibilities.

Of course, there is the possibility that I've understood nothing of how docker images should be deployed. In this unfortunate case, please be merciful and point me in the right direction.

---

### Case study

I wanted to pose a general question but I realized that maybe it was too broad. For this reason, I explain here what is my case hoping that could help a bit more what I wanted to achieve and what I've done now (this question is about only a part of what I wanted to achieve).

What I want is to develop a docker hub automated build linked to a Git Hub repository. The images are about LaTeX on Ubuntu. The first build, tagged `base`, starts from Ubuntu 18.04 and comes with `texlive-base`. Another build, tagged `full`, starts from the build tagged `base` and comes with `texlive-full`. Another two builds, tagged `develop-base` and `develop-full`, will start from the respectively builds without 'develop' and will come with writing and visualization tools. All the builds will probably have some semantic versioning system.

What I've done right now is implement `base` and `full` through two different Docker files into two different directories in the same Git Hub repository. Whenever a tag `base` or `full` is created/moved, the corresponding build is triggered. This implementation has a problem: if I move the tag `base`, the image `base` is correctly built but all the images that depend on it are not built again and I have to manually trigger them. What I've thought is to have a branch for each tagged image (with the corresponding automated builds triggered at each new push on that branch) and a tag system to keep track of the version number (with the corresponding automated builds triggered at each new tag). The tags will be `base`, `full`, `develop-base`, etc. for each latest version and with semantic versioning for each version, including the latest, i.e. `1.0-base`, `2.3-full`, `1.3.1-develop-base`, ecc. In the latter case, the automated build triggering will probably have to handle regular expression to automatically label the images with a version number.

I realize that my question isn't very related to what I wanted to achieve but I want to learn to walk before trying to run. Thus, I want to understand when and why one should choose one way or the other to put on a docker hub repository with several images and which are those ways. The project of LaTeX images itself, that maybe you could think that is very naive, is to deeply understand the way docker, docker hub, docker cloud, docker compose, ecc. work.

# Answer
> 2 votes
If you think of the Dockerfile as a kind of "*bill of materials*" for your containers, then there is the following consideration:

* container environments are mostly same - you can use many Dockerfiles in same folder, or even just one Dockerfile with parametrized builds
* container environments are or might divert in terms of further "local assembly parts" configuration files, scripts etc., then you are better off with using separate folders.

Branching has rather to do with developing *versions*, or also independent features which then should be anyway merged together. See Git flow on this topic.

As a reference project laoyut, check for example the GitHub project linked from Tomcat Docker Hub site. Here you find different folders, even with single Dockerfiles.

See also this TeX-Docker distro:

Side note: strange enough there is no "official" Docker distro for TeX, while many other well established open source communities have this *library* entry.

---
Tags: docker, dockerfile, learning
---


# Question
Title: ansible task -easy_install with requirements.txt file
I want to run easy\_install task in order to install many modules in virtual environment.

Is there an option to install all modules in requirements.txt file? as I understand it accept only one module at a time.

Another option is to do it with `with_items` but how can I make Ansible iterate over both the name and the version of each module

```
- name: Install things
  easy_install:
   name: pip
   state: latest

```

I want certain versions obviously...

I can not work with Pip task, only easy\_install. Thanks

# Answer
You can loop over file content:

```
- name: Installs Python libraries from requirements.txt
  easy_install:
    name: {{ item }}
    state: present
  with_lines: cat "/my_app/requirements.txt"

```
> 1 votes

# Answer
You can loop with dictionaries using `loop`. It doesn't look like the `easy_install` module handles versions with a module attribute, so you might have t pass the version on the `name` attribute.

```
- name: install things with easy_install
  easy_install:
    name: "{{ item.name }}=={{item.version}}"
    state: present
  loop:
    - { name: 'pip', version: '18.1' }

```
> 1 votes

---
Tags: ansible
---


# Question
Title: SSH tunneling to hosts deployed behind firewalls
I'm working on a deployment that will require me to place Ubuntu servers that monitor industrial equipment at various sites and behind firewalls that are out of my control. I need to maintain SSH access to the servers to perform maintenance and updates, but am struggling on the best way to securely accomplish this.

Port forwarding and creating firewall pinholes are not options, so I can't quite get my head around what to do. Is there some system that I could use to maintain the ability to open an SSH tunnel to these machines from the outside world? Is there a better way to accomplish this?

Thanks!

# Answer
Assuming that the monitoring host is able to make *outbound* connections, you can solve this by having a bastion host elsewhere which you can connect through. Obviously do make sure to clear this with your customer.

To do this, set up a server somewhere under your control. This might be a VPS with a generous traffic limit, or it might be a physical server under your control, or something else. Give it a stable DNS name, possibly on a one-per-customer basis, which maps to the IP address of the bastion host. Mind the possibility that you may need to renumber that host in the future, possibly without being able to access the monitoring host.

Now, configure the monitoring host (the one that you want to be able to ultimately connect to) to connect *out* to the bastion host to set up a SSH tunnel. This will probably include creating a non-privileged user account on the monitoring host to run the tunnelling SSH process, and protecting that appropriately. (Remember: this account won't be used for logging in to; it will only run a local, non-interactive SSH client process, and own the tunnel.) Also set up a non-privileged account on the bastion host, with only sufficient privileges to log in with SSH (not to a shell) and set up a SSH tunnel to the monitoring host.

With that in place, you can set up something like `autossh` on the monitoring host to maintain a connection to the bastion host to keep the tunnel alive. Add some decent logging on the bastion host, since on the monitoring host, the connection will almost certainly look like it originates from localhost.

When you need to connect to the monitoring host, first connect to the bastion host setting up a SSH tunnel to the bastion host's local port that forwards to the monitoring host; and then connect to the local port that maps to that tunnel. This will tunnel the SSH traffic *via* the bastion host, allowing your system to talk to the ultimate target host without requiring the host that is ultimately being connected to to be able to accept incoming connections.
> 1 votes

# Answer
If organizations which manage firewall host and infra around can create a user for you on their equipment - you can use the advantage of "jump host". Imagine you have access to host A and host A has connectivity with host B. Then you can do it with the following ssh config.

```
Host A
  Username username
  Hostname bloody.enterprise.example
Host B
   ProxyJump A

```

If it's not an option.Well, you can consider setting up VPN.
> 0 votes

# Answer
Officially, you should ask those firewall admins to create you a VPN access on each router, optionally ask them to have only access to your server behind their firewall.

That will leave you a user account to manage your updates, while at the same time you will be covered legally: if a leak happens, or a security issue happen, the fact you have only VPN access to that server limits your liability and they know that you have access.

Often internet usage in industrial network is restricted, which is why for me it's the best solution, as asking to have your equipment able to talk to the internet (the way around) could often be an issue.
> 0 votes

---
Tags: linux
---


# Question
Title: Is there a php (or composer) command to change upload_max_filesize && post_max_size from terminal?
Is there a `php` (or `composer`) terminal command to change the `php.ini` variables `upload_max_filesize` and `post_max_size from terminal` to some value directly from terminal, without `sed` or `awk` operations?

The reason; having a more a version-agnostic and more backward-compatible directive in my server-environment-establishment script, to change the values of these two variables.

## Update

If I'm not wrong utilizing the confd CM (supported in PHP \>= 5.0) should be good (I can't test right now):

**1.** Create something like `/etc/php7/conf.d/local.ini`.

**2.** Add to it:

```
upload_max_filesize = 2000M
post_max_size = 2000M

```

# Answer
> 3 votes
> The reason; having a more a version-agnostic and more backward-compatible directive in my server-environment-establishment script, to change the values of these two variables.

If you're trying to configure a server, you should use a configuration management system (Ansible, Puppet, Chef, Salt) or bake images for immutable infrastructure; trying to hack in pieces of configuration via PHP or bash or whatever will just make you unhappy.

# Answer
> 1 votes
PHP has supported `conf.d` configuration subdirectories for ages now (cf. `PHP_INI_SCAN_DIR` in its documentation, this stuff is as old as PHP 5 basically) - allowing you to simply add a small file containing just the snippet of config you need in there, and as long as you make sure it's named so that it's ordered in a way it overrides the defaults, you're done.

IOW you don't go searching for an existing value to fiddle with, you just add your own.

# Answer
> 0 votes
You can use regex and after that change, you need to restart the webserver:

```
sed -i 's/upload_max_filesize\s*=.*/upload_max_filesize=100M/g' path/to/php.ini
sed -i 's/post_max_size\s*=.*/post_max_size=100M/g' path/to/php.ini
sed -i 's/memory_limit\s*=.*/memory_limit=512M/g' path/to/php.ini

```

But it is preferable to use **Configuration Management Tools**

---
Tags: configuration-management, php, shell-script, environment-variables, composer
---


# Question
Title: Groovy script to show only selected item
I used jenkins Active choices plugin and Mavenmetadata plugin to build above UI. When I click a radio button particular version only should be display. How can I write a groovy script to fulfill above requirement?

Below images showing my groovy scripts.

# Answer
> 1 votes
You can use the Jenkins pipeline syntax to get the groovy script. For example below code will generate radio buttons for active choice parameter. you can generate scripts like this from your jenkins instance at http://localhost:8080/pipeline-syntax/. More info is here https://jenkins.io/doc/book/pipeline/getting-started/#snippet-generator

```
def createInputParameters(){
([[$class: 'RebuildSettings', autoRebuild: false, rebuildDisabled: false],
 parameters([[$class: 'ChoiceParameter', choiceType: 'PT_RADIO', description: '',
 filterLength: 1, filterable: false, name: 'Select_snapshot_or_release',
  randomName: 'choice-parameter-1683871426502398',
   script: [$class: 'GroovyScript', fallbackScript: [classpath: [], sandbox: true,
    script: 'return "Error"'],
     script: [classpath: [], sandbox: true,
      script: '''return[
            \'snapshots\',\'release\']''']]]]),
             [$class: 'ThrottleJobProperty', categories: [],
              limitOneJobWithMatchingParams: false, maxConcurrentPerNode: 0,
               maxConcurrentTotal: 0,
               paramsToUseForLimit: '', throttleEnabled: false, throttleOption:
               'project']])
      }

```

---
Tags: jenkins, jenkins-plugins, groovy
---


# Question
Title: Is it possible to set CloudWatch alarm for a combination of metrics?
For example, I want to trigger a CloudWatch alarm for the following:

`Number of messages sent` \- `Number of messages deleted` \>= 6

The above is for AWS SQS metrics. And I want that metric to trigger AWS Lambda if that alarm is set off.

**Is there any way I can do it? If not, then is there any work-around** \[Aiming for a serverless paradigm\]

*\[I want to do that, cause there's no metric which tells me the number of messages currently (available) in the queue\]. So, if there's a metric which can give me that, it'd be very helpful*

# Answer
For the last overall goal, I would set the alarm on `ApproximateNumberOfMessagesVisible` from Cloudwatch documentation on SQS this is:

> The number of messages available for retrieval from the queue.
>
> Units: Count
>
> Valid Statistics: Average, Minimum, Maximum, Sum, Data Samples (displays as Sample Count in the Amazon SQS console)

---

For the more generic computed metric question I would go with a lambda running priodically, gathering metrics from cloudwatch, doing the maths and pushing back to cloudwatch.

Here is an example lambda gathering data from Cloudwatch to push to elasticsearch. With the examples on the documentation you should be able to push metrics back from the lambda.

Be aware that calling cloudwatch API to gather and push metrics has a cost when you got over 1M request per month, there's other limits to be aware of to avoid breaking your budget/workflow.
> 9 votes

# Answer
Recently AWS just announced **CloudWatch Metric Math** which should be suitable for your use case.

*References:-*
> 9 votes

---
Tags: amazon-web-services, amazon-sqs, amazon-cloudwatch
---


# Question
Title: Is Azure's confidential computing essentially encrypted RAM?
I'm trying to wrap my head around the Azure confidential computing offering.

It appears that that AWS does not offer encryption at the application level (see diagram for what I mean by this:)

My question is: **Is Azure's confidential computing essentially encrypted RAM?**

# Answer
The article you are referencing mentions encrypted RAM but that was only a reference to possibilities of enhancing the technology more in the future, not about the current state of confidential computing.

Confidential computing means, that when data is in use these things are prevented:

> * Malicious insiders with administrative privilege or direct access to hardware on which it is being processed
> * Hackers and malware that exploit bugs in the operating system, application, or hypervisor
> * Third parties accessing it without their consent

according to Microsoft own announcement

So in other words, it is kind of equivalent to encryption and firewall that are seen in communication but this time applied to running programs in a Trusted Execution Environment (TEE), which the term for the area which is protected when server runs a program.
> 6 votes

# Answer
Azure's Confidential Computing leverages Intel® SGX to enable applications run code inside secure enclaves. Intel Software Gaurd Extensions (SGX) use a Memory Encryption Engine that encrypts any enclave data that leaves the CPU cache to the RAM using a key that is only accessible to the processor, preventing attacks such as cold-boot, tapping on the memory bus, etc. It also provides isolation of the enclave's address space from any other entity (including the OS kernel and sudo users).
> 1 votes

---
Tags: amazon-ec2, azure, encryption
---


# Question
Title: Docker-compose + Kubernetes: backports.ssl_match_hostname.CertificateError
I have a complete docker stack (source) which uses docker-compose.

It works fine by its own, but now I'm trying to deploy it in Kubernetes' Minikube and when after `eval $(minikube docker-env)` I try to run `docker-compose up`, it throws the following error:

> backports.ssl\_match\_hostname.CertificateError: hostname '192.168.99.100' doesn't match 'localhost'

What am I missing?

---

This is the complete trace:

> Traceback (most recent call last):
>
> File "/usr/bin/docker-compose", line 9, in load\_entry\_point('docker-compose==1.8.0', 'console\_scripts', 'docker-compose')()
>
> File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 61, in main command()
>
> File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 113, in perform\_command handler(command, command\_options)
>
> File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 835, in up remove\_orphans=remove\_orphans)
>
> File "/usr/lib/python2.7/dist-packages/compose/project.py", line 372, in up warn\_for\_swarm\_mode(self.client)
>
> File "/usr/lib/python2.7/dist-packages/compose/project.py", line 539, in warn\_for\_swarm\_mode info = client.info()
>
> File "/usr/lib/python2.7/dist-packages/docker/api/daemon.py", line 33, in info return self.\_result(self.\_get(self.\_url("/info")), True)
>
> File "/usr/lib/python2.7/dist-packages/docker/utils/decorators.py", line 47, in inner return f(self, \*args, \**kwargs)
>
> File "/usr/lib/python2.7/dist-packages/docker/client.py", line 140, in \_get return self.get(url, \**self.\_set\_request\_timeout(kwargs))
>
> File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 480, in get return self.request('GET', url, \**kwargs)
>
> File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 468, in request resp = self.send(prep, \**send\_kwargs)
>
> File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 576, in send r = adapter.send(request, \**kwargs)
>
> File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 376, in send timeout=timeout
>
> File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 560, in urlopen body=body, headers=headers)
>
> File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 346, in \_make\_request self.\_validate\_conn(conn)
>
> File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 787, in \_validate\_conn conn.connect()
>
> File "/usr/lib/python2.7/dist-packages/urllib3/connection.py", line 277, in connect match\_hostname(cert, asserted\_hostname)
>
> File "/usr/lib/python2.7/dist-packages/backports/ssl\_match\_hostname/**init**.py", line 99, in match\_hostname % (hostname, dnsnames\[0\]))
>
> backports.ssl\_match\_hostname.CertificateError: hostname '192.168.99.100' doesn't match 'localhost'

# Answer
> 1 votes
It seems you have missed DNS. First, don't reference the device by IP, instead use a FQDN. If you need, you can set an entry for 192.168.99.100 in /etc/hosts for now. Secondly, type "hostname" on the node and verify it does not return "localhost" (it likely will). Then type "hostnamectl set-hostname newhostname.fullyqualified.com" and then regenerate and re-sign the certificate.

# Answer
> 0 votes
I don't have a proper solution to fix the certs, but a work-around is to make docker-compose not care about the mismatch as follows: `CURL_CA_BUNDLE= docker-compose up`

---
Tags: docker, kubernetes, docker-compose
---


# Question
Title: How to handle large deployments using tools like gitlab and docker
How to deploy multiple instances (40+) of the same application with gitlab? (it is a simple tomcat web app)

I want to be able to individually upgrade/downgrade them using web interface.

We already have a working gitlab+docker pipeline that deploys one instance of an app. We are not using k8s yet.

Should we create gitlab environment for each instance? Do we have better options besides gitlab environments?

*Update*: Instances (websites) do differ, they have the same codebase but different configuration. Right now the scaling is not a priority, what we really want is to have an interface to add, deploy, upgrade and downgrade websites. I've tried gitlab environmets on a smaller project and it's really awesome when you have like one or two websites, but when you have 10 or more and you have one environment for each website .gitlab-ci.yml grows exponentially.

# Answer
The documentation shows that you can have 40+ branches with different configurations. You express concern that the configuration becomes large. With a good editor that isn't really a problem. Yet that feels wrong, right?

With git, in general, a repository per independent deployable works better than a single repository holding many independent deployables. So an alternative layout is not 1 repo with 40 branches, but 1+40 repos. That would be 1 repo that builds the latest code and creates releases. Then 40 repos that represent the configuration to deploy a particular release of the code configured for one website. The 40 repos that deploy the code can hold the 40 per-website configurations and a standardised build script that simply downloads the right release of the code to deploy along with the website configuration into the environment.

We use 1+N+M git repos. We have 1 repo that holds the deploy scripts. They are versioned and released. We have N repos that build the different apps into releases. Currently, two php apps and two react apps that work together but are deployed and upgraded independently. Then M repos that represent the environments/sites we deploy into which is currently only staging and live.

We are using k8s (OKD) and the deployment scripts are using helm. That just means that our deployment scripts and environment setup are simpler and rollback/downgrade is fully automated. We don't actually download the app to deploy during our build. Instead, we simply push out the docker registry tag of the version of the code we want to deploy into a given environment.

I started a project to opensource our approach to deploying apps from git which is called OCD. It is still a work in progress but it demonstrates some of the above ideas.
> 3 votes

---
Tags: containers, gitlab, continuous-deployment, infrastructure-as-code
---


# Question
Title: A cloud technology with automatic upgrades of my OS-release and web server release?
I desire a cloud technology that will redund my need of using Vagrant to continuously integrate OS release upgrades (say from Ubuntu 18.04 to 20.04 including all software installed by `apt-get` --- assuming it will be supported in the next release) and will also redund my need of using Ansible for web server upgrades (say from Apache 2.4 to Apache 3.4, including automatic changes to all virtual host files --- if any will be necessary).

## Technologies I found so far

**1. Minimally controlled cloud:** The user is provided with an OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: Digital Ocean, Linode and so forth).

**2. Maximally controlled cloud:** Either the user or the company provides the OS, DNS zone management tool, bypass console and some more possible tools while the user adds the rest by itself (examples: Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP) and so forth).

I understand that using the VA stack (Vagrant-Ansible) could indeed give me just that, but I fear I might be wrong and will be very disappointed and will also lose money - VA stack might require a significantly higher pricing than my 20-30$ (USD) budget.

## My question

Is there any cloud hosting technology that will suit my needs without me needing to use Vagrant or Ansible for constantly upgrading the OS and web server?

Maybe the true solution will be to change attitude --- starting to work with Arch Linux where system upgrades including release upgrades are of the "rolling upgrade model", coming in "bits by bits" through time and are usually never "major", and maybe also finding another web server with similar upgrade model?

# Answer
> 3 votes
What you are primarily discussing is the hosting model for the underlying cloud you are using, for example, from what you have said so far your hosting model is relying on Infrastructure-as-a-Service (IaaS), and you want to have less responsibility for managing the Operating System.

That being the case you would need to move right in the table below to Platform-as-a-Service (PaaS) or Software-as-a-Service (SaaS) - this would mean you transferred the responsibility for updating the OS and Software to the provider, i.e. Azure, Amazon or Google.

*However, you would also lose some control over the stack that was being used and in addition incur higher costs (in general) than managing it yourself.*

*There is a good analogy comparing Cloud Hosting Models to Pizza if you prefer something less theoretical and entirely more fun.*

By way of an example, you can use Azure WebApps which is a PaaS service to host your application as long as the application is built using PHP, node.js, Java, .NET or Python (and a few others). You will have little to no control of the web server, operating system, server, storage and networking configuration. You could do similar with Google App Engine and AWS.

You could also re-platform your application to use an even higher order technology such as Serverless (AWS Lambda, Google Cloud Functions, Azure Functions, etc.) or even host your application on Salesforce's Software-as-a-Service engine.

---
Tags: ansible, linux, automation, vagrant, release-management
---


title: Import tarball as next revision

text:
# Question
Title: Import tarball as next revision
Some background:

I've got an existing build system that creates (among other things) container images. Due to the nature of their contents, they are suitable for running on practically any containerization toolset one might care to use.

Now I've got some users who want to load them into Docker. Ok, that works fine, except that each revision of the container image imports separately.

The users would like to take advantage of the space-saving capabilities of Docker layers to deduplicate data between versions.

I could, of course, instantiate the previous image, and then use rsync or similar to update it and then commit it (and that's what I'll do if I have to) but that seems like an awfully clunky workflow.

The question:

Is there some piece of functionality built into Docker that I'm just not finding that would simplify the process of importing updated image tarballs into an existing image's history? I can find all kinds of resources about pruning and flattening Docker history, but nothing for those of us who manage our image contents via other systems.

# Answer
This is a known issue with aufs -- see here for context.

Use `ADD <tarball_path>` and use the overlay driver on the build server.
> 1 votes

---
Tags: docker
---


# Question
Title: What are some methods to measure the ROI for DevOps?
DevOps is complex, and involves many non-deterministic aspects like culture and process.
What are some ways to measure DevOps initiatives for success?
How do you prove to a business that the investment they have made is returning (or saving) real dollars?

# Answer
Great question! Most of us know investing in DevOps practices is a highly worthwhile pursuit for myriad reasons; we don't often justify DevOps on the impact to the bottom line alone, though.

**Note**: this is something of an opinionated question, and my answer is likewise, opinionated.

Tensibai wisely suggested we find the right metrics, and he used time-to-market as an example. This is a great big-picture approach.

As an alternative approach, my experience with bean-counters is that they don't need to--or necessarily want to--know the big-picture, they just want evidence of fiscal responsibility. They want to see a trend in the right direction.

Here are just a few fiscal wins:

* calculate the server costs saved by leveraging auto-scaling in the cloud
* for income-generating sites, extrapolate the cost-per-minute of downtime, then show improvements in MTTI and MTTR
* again, for income-generating sites, estimate the cost-per-minute saved by leveraging highly-available architecture based on past incidents
* if you've improved on your build and deploy pipeline, show that you've reduced regressions and errors in production caused by already-tracked faults
* if you've made improvements to developer test environments, or even the tools and configuration on developer laptops, look at commit histories to see if new engineers are making their first contributions sooner after joining
* perform a full cost comparison between cloud and on-prem, much like Gitlab did recently, to justify your infrastructure spending (a.k.a. savings!)

Showing that you're money-conscious and you have a few clear wins is often sufficient. I've certainly missed some obvious examples; feel free to add comments below.
> 17 votes

# Answer
The key metric for a DevOps pipeline is **Cycle Time** (also called **Lead Time**). This is the time it takes for a change (or a change request, tracking all the way to the inception of the idea). The best illustration of this concept I know of is from the book "The Goal", which talks about it in a manufacturing context.

**Deployment Frequency** is useful as well. We want deployments to be frequent in a DevOps pipeline. There is no magical "1 day is good, 2 days is bad" measurement; this will need a historical context on your project to be meaningful.

**Deployment Size**: Measured in however your developers measure work - user stories, story points, quatloos, whatever. Again, you want to see trends over time, not absolute value.

Between frequency and size there is a story to tell. Are our releases becoming more infrequent and larger? why? Are they becoming smaller and more frequent? Again, why?

Explaining whether the frequency/size trend is good, we will also need **Percentage of Failed Deploys**. Uncovering the 'why' in those three metrics will tell you a lot about the health of the project.

My personal favorite, although it is a vanity metric, is **Time for a Trivial Deploy**. If you found the smallest possible thing worth redeploying the entire site over... perhaps a typo in the CEO's name... how quickly could you go from the panic phone call to a deployed site? I say 'vanity' because it really isn't that predictive beyond what the other metrics above discuss, but makes me feel good when I like the value.

If we get into monitoring, there are a bunch of different things we can track... from all-encompassing things like '**Uptime**', to really low level things like the **time spent regenerating custom HTML** on a request-response cycle... but those aren't specific to instituting a DevOps culture.

These don't directly tie to dollars... doing so will require more knowledge about your org than I can offer in a forum like this; but they are the key to BEGIN to answer that question. Once you know you are able to regularly release work into production as a non-event, you can begin to see how much effort you were wasting before. As the book "The Goal" teaches (about manufacturing pipelines - it's relevant), optimizing locally can *look* like you're saving money, but ultimately, it just creates value that is tied up in inventory (undeployed features).

Beyond this advice, you should take a look at the State Of DevOps Report for the past few years. This is full of measurements about real world projects that you could emulate.
> 12 votes

# Answer
Captain obvious : by reducing time to market and defects on releases.

To extend on this one liner, the usual pitfall is being an organization change without any reference.

Engaging a culture or organization change implies some expense to train and introduce people to this new method, this have a cost in training but also imply a loss in productivity as people in a train session won't produce anything. This is the investment part of the cultural change.

To measure a ROI you have to first find some relevant metrics which should be improved (understand costly, either expensive or source of loss of profit). This could be a shorter time to market, less patch after each release, a better customer engagement within your product. Relevant metrics will be highly dependent of your product(s).

Measuring a ROI (how fast you have covered the training expense) implies that you can factually present an evolution on those metrics, so before engaging any change you must have defined those metrics and measured them in an objective way.
Once you have a real evolution to show you can tell if you did improve something in a way which has covered the training expense and become more profitable than it was before.

The usual pitfall is to engage the change before having defined any metrics and thus evaluating the ROI on a feeling and not on factual datas.

Productivity can be a metric, but its measurement is usually very hard to do in an objective fashion and should not be a first class metric for this kind of study.
> 8 votes

# Answer
Late to the game here but thought I'd chime in.

You can't manage what you don't measure, so for starters, here are the key metrics devops teams should be tracking for incident response:

* **Uptime %** : total % of time available = \[total time - downtime\] / \[total time\]
* **MTTR** : mean time to resolution = \[downtime\] / \[# incidents\]
* **MTTA** : mean time to acknowledge = \[total time to acknowledge\] / \[# of incidents\]
* **MTBF** : mean time between failures = \[total time - downtime\] / \[# of incidents\]

These metrics give you a high level health check of your operations, and help you identify where you need to dig in further.

Take a look at the whiteboard animation here for a more in-depth look on the topic.

Once you know your metrics, you can bump them up against the cost of downtime. You can start building out your team's ROI from there and set some quantitative metrics for continuous improvement.
> 1 votes

---
Tags: metrics, roi
---


# Question
Title: Is this an appropriate architecture, or can improvements be made?
Due to a combination of business/enterprise requirements and our architect's preferences we have arrived at a particular architecture that seems a bit off to me, but I have very limited architectural knowledge and even less cloud knowledge, so I would love a sanity check to see if there's improvement that can be made here:

Background: We are developing a replacement for an existing system that is a complete rewrite from the ground up. This requires us to source data from an SAP instance through BAPI/SOAP Web Services, as well as use some databases of our own for data not in SAP. Currently all of the data that we will be managing exists in local DBs on a distributed application, or in a MySQL database that will need to be migrated off of. We will need to create a handful of web applications that replicate the functionality of the existing distributed app, as well as providing admin related functionality over the data we control.

Business/Enterprise Requirements:

* Any databases we control must be implemented in MS SQL Server
* Minimize the number of databases created
* Phase 1 will have us deploy our applications to Azure, but we need the ability to bring these applications on-prem in the future
* Our Ops team wants us to dockerize everything as they feel it will make their management of the code a lot simpler.
* Minimze/eliminate replication of data
* The coding stack is going to be .NET Core for microservices and Admin apps, but Angular 5 for the main front-end application.

From these requirements our architect came up with this design:

Our front-ends will feed from a series of microservices (I use that term lightly as they are 'Domain' level and rather large), which will be broken into Read Services and Write Services in each domain. Both will be scalable and load balanced through Kubernetes. Each will also have a read-only copy of their database attached to them within their container, with a single master instance of the db available for writes that will push out updates to those read only copies.

(Sorry for the poor quality images, I'm redoing them from memory since, naturally, there's no actual documentation for this stuff except in the architect's head)

Service to Service communication will happen through a message queue that each service will listen to, and process any relevant messages. The primary use of this will be for email generation, as there isn't anything else we've identified that requires service to service communication for information yet. Anything "business logic" related that would require multiple services being involved would likely flow from the front-ends, where the front-ends would call each service individually and deal with atomicity.

From my perspective, the thing that rubs me the wrong way is the read-only db instances spinning up inside the docker containers for the services. The service itself and the db would have drastically different demands in terms of load, so it would make a lot more sense if we could load balance them separately. I believe MYSQL has a way of doing that with master/slave configurations, where new slaves can be spun up whenever load gets high. Especially while we have our system in the cloud and are paying for each instance, spinning up a new instance of the whole service when we only need another db instance seems wasteful (as does the opposite, spinning up a new db copy when we really just need a web service instance). However, I don't know the limitations of MS SQL Server for this.

My largest concern is around the MS SQL Server implementation. Coupling the read only instances so tightly to the services feels wrong. Is there a better way to do this?

NOTE: I asked this over on software engineering and they pointed me here. Sorry if this is not the appropriate SE.

Also there's no MS SQL Server tag

# Answer
> 2 votes
> My largest concern is around the MS SQL Server implementation. Coupling the read only instances so tightly to the services feels wrong. Is there a better way to do this?

Essentially what you have designed is a caching system - the service containers have a local copy of the data presumably so that for reads they don't have to make an extra network trip.

As you've pointed out, a more standard approach is to have a cluster of read replicas that all of the containers can read from. This allows you to scale them separately from the application servers, which is good, because they generally need different things (do you really want to allocate large amounts of RAM to every application container?). This will add network calls for database reads, but until that's proven to be an issue I wouldn't complicate the architecture to solve it.

If it *does* become an issue, a much more lightweight way of handling the problem is to run an actual cache locally, like memcache or redis. You can tune the TTLs on individual objects to be appropriate, and it will automatically drop off rarely-requested data to keep the application server light.

# Answer
> 1 votes
I could talk a lot about the architecture yet this is a devops community so I will addresses your main concern about running the database only.

**Short answer:**

If you were to modify the design to say "Azure SQL" for each microservice then it would look okay to me. Each microservice can have its own separate Azure SQL database instance (likely running on a shared cluster but that is invisible to you). To move it on-prem later you can decide if you want to build an "Azure SQL-like" setup on kubernetes or simply run a traditional SQL Server cluster on-prem. Using Azure SQL doesn't lock your architecture into Azure as I will discuss below.

**Long answer:**

MS SQL Server requires a huge amount of memory compared to opensource databases or stateless application services. It also requires software licences (we will look at optimising cost below). So it may be the case that it simply isn't particularly cost-effective to run an licensed instance per service. You could license one SQLServer instance and run many per-service private databases on it. Better yet use Azure SQL the managed database-as-a-service version of SQL Server. That doesn't lock them into Azure as you can move to AWS which has "Amazon RDS for SQL Server". Every serious cloud provider will offer a professionally managed database service for all the major databases.

Also as you point out running a database in the same kubernetes pod as your application server code won't allow you to scale them independently. Also, stateless application servers can run on pods that have no persistent storage. Then stateless application servers can die and be restarted at will and moved between cloud availability zones trivially. Obviously, databases need persistent storage that is "owned" by pod. So a database needs a persistent volume claim. If you want them to run with high availability you need them to run as a stateful set. Running the database in the same pod as the application server is something that a developer might run locally, but I wouldn't recommend it for SQL Server, as it starts up 10x slower than your code. Rather on a mac laptop run the SQL Server docker image exposing its port. On a windows laptop run SQL Server Express natively.

It is considered a very standard architecture for each microservice has it's own logical (but not necessarily physical) database, but to run as a stateless service with many replicas, so that they can be scaled independently. Also Azure has very good support for Redis as a cache. It is therefore considered a standard architecture for each microservice to have its own logical private database, it's own private Redis cache, and many independently scaled pods. If you are renting Azure SQL and Azure Redis you don't get to choose how they run it physically. And why would you want to? Let the professionals figure out how to run a resiliant setup that has high performance that you can "pay for what you use" and focus on writing your business logic not on managing stateful services in the cloud that you can easily rent.

I have seen developers running MS SQL Server Express locally on their laptop to debug and unit test, then deploy to Kubernetes on Azure where the microservices databases are all running on Azure SQL. I have also seen teams run against Azure SQL in production, but test against SQL Server setup on plain VMs in Azure. Why? Because Azure SQL only comes with "production pricing". That organisation already had SQL Server on-prem and DBAs so it was cheaper for them to install and run SQL Server on VMs in Azure to host the test envs. All the microservices had their own private databases. In test those per microservice database where on a shared SQL Server instance on VMs with a two node cluster for resilience. In production the per microservices instances were all on Azure SQL for high performance and high availability, likely running a shared cluster that is hidden from the customer.

---
Tags: azure, microservices, architecture
---


# Question
Title: Run scripts which are stored in GitLab from Jenkins
I have configured Jenkins Build Jobs and Deployment Jobs from using Jenkins shell. But I put all the commands in Shell to execute. Can I store those commands in GitLab and execute from jenkins?

# Answer
If you are using Gitlab merely as a source code repository, and you are triggering the jobs when there are changes to the repository.

The Jenkins Gitlab plugin documentations states:

> This plugin is a build trigger that allows GitLab to trigger Jenkins builds when code is pushed or a merge request is created. Configuration done on a per-job basis.

So, you can trigger the builds. But to answer your question:

> I put all the commands in Shell to execute. Can I store those commands in GitLab and execute from jenkins?

The answer is **yes**, but there is some leeway. It depends on how you've configured the jobs. If they are freestyle jobs, have them execute a shell command running the script in your repository. You can do this via the web-interface the Jenkins job editor.

However, I wouldn't recommend this as best practice. Instead, I would recommend having a pipeline description in the repository. See the plugin docs on github for more details on configuration.
> 1 votes

---
Tags: jenkins, git, gitlab, github, shell-script
---


# Question
Title: Is Vagrant an operating system by itself?
If Vagrant (and similar software) uses to orchestrate, install and continuously upgrade one or more OSs on a single machine, isn't it some kind of an operating system by itself?

Or it actually virtualizes an OS **on top of an existing OS** and doesn't operate as an OS by itself?

# Answer
No, Vagrant is a tool for creating virtual environments, which it then can run inside a virtual machine (originally only using Virtualbox, but nowadays also KVM and VMware among others).

The environment created by Vagrant is, however, a fully virtualized OS (e.g. Ubuntu).
> 0 votes

---
Tags: vagrant
---


# Question
Title: Why are IaaS hosting services are usually fixed-priced and PaaS are usually dynamically-priced?
Basic plans in IaaS host-providers like DigitalOcean and Linode are usually fixed-priced and basic plans in PaaS host-providers like Microsoft Azure or Amazon Web Services are usually dynamically-priced.

Why are IaaS hosting services are usually fixed-priced and PaaS are usually dynamically-priced?

# Answer
Fixed price tiered billing is an older billing model that suits a monthly billing cycle where usually the level of resources provided does not change over a month. Even if it is changed, this is usually met with friction from the billing department in form of the higher pricing tier being applied to the whole month.

By comparison AWS can be credited as the first provider to offer simple building blocks on an hourly basis (now per second). This allows for much more sophisticated usage of resources in form of:

* auto scaling to the best amount of resources required.
* turn services off out of hours or until turned on manually.
* ultimately to offering functions as a service, the most finegrainerld resource billing usage available.

So I don't see these two items as being directly comparable, but one is a progression from the other.
> 2 votes

---
Tags: linux
---


# Question
Title: Proper way to showcase multi-container web app to customers
I have a web app consisting of multiple services (authentication service, database, main web app..), and each of these services can run in container. Currently, when a customer ask for a demo, I am creating and running new instance of these containers on new open ports. But, it seems like this is not the right way to do, because each container is just consuming 1 GB RAM of my host machine (currently total 32 GB), even it is not used by anyone. What is your suggestions and is there any on hand solutions for this scenario? What should I research to find a solution for my need?

Edit response to comments:

* Firstly, it is not a laptop :), It is just a VM on Azure(32GB and 4 CPU), actually, yes, it's like laptop :(
* My customers want to (actually I want) test/evaluate my app without any installation, just filling a demo request form and then I will send them a mail to say "*your main web app is running on http://somehost:someport, you can use it now!*"
* Currently, I can perform the situation mentioned above, and someone who wants to use my app can use it. But it is not efficient.(???)
* You mention swarm/kubernates, So my main question is that; Is solution for my need is should be using swarm? If yes, How? is there an best practice approach you can share with me?

Now I will search on how to make my own SaaS system:)

# Answer
You mention that you are demonstrating this for a customer. The first question you should ask yourself (or, more pertinently, the customer) is :

> what does this customer really want?

Why have they come to you for this work? What is the pain they are currently feeling, what value are you providing to them.

Then, compare and contrast - show them the delta that your solution brings to them.

* It may be for example that they want to maintain a legacy application, but upgrade the hardware or underlying components ? In that case, show them how you have contained them with no negative experience to their users.
* It may be that they need to scale the capacity for usage of their application - they want to be able to meet demand elastically. Show them how by deploying in a container setup, you can scale out.
* It may be that they need four nines reliability - show them that you can have an easier HA setup - knock out one of the instances and prove that the application still works.
* It may be that they want faster delivery with no little impact on quality. Show that your delivery pipeline works smoothly with some automated tests and QA, with delivery and deployment.

TL;DR : Find out what your customer wants. Demonstrate the existing way of doing things. Compare it with the "new" way, and highlight the delta.
> 2 votes

---
Tags: docker, kubernetes, provisioning
---


# Question
Title: How to know where a docker image came from?
I have a Docker image on my system `12346789ABCD`.

Is there a way to know where it is coming from?

Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.

# Answer
Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like `quay.io/<namespace>/<image name>:<tag>`.

Some images are from *from* anywhere else at all. For example images that are `FROM: scratch` and images created via `docker import` will not be associated with any registry. These are the famous `none:none` images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.

So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using docker content trust even if the image contents themselves are not. If you need more certainty on the provenance, you probably need notary to ensure that trust is maintained throughout the delegation chain.

Hope that answers the question.
> 5 votes

---
Tags: docker
---


# Question
Title: SaltStack states pattern and replace for multiple files under directory and for multiple line matches
I am using saltstack state pattern and replace to match a pattern and replace with a new pattern. My init.sls file executes below:

```
`modify_script.sh:
   file.replace:
      - name: /path/to/script.sh
      - pattern: /aaa/bbb
      - repl: /aaa/ccc
      - pattern: /xxx/yyy
      - repl: /xxx/zzz`

```

The above works good if I use a single pattern and replace. This fails for multiple patterns and replaces as shown above. How to achieve multiple pattern replace for two or more patterns in a single file?

Secondly, I have multiple files in a directory which requires a pattern match and replace.

`modify_script.sh:
 file.replace:
 - name: /path/to/dir [having multiple files which require update]
 - pattern: /aaa/bbb
 - repl: /aaa/ccc`

Can I match the patterns for all the files under directory? I wouldn't want to match and replace a single file individually. Please advise.

# Answer
You should use Jinja to loop over a list of files and pattern/replacement pairs.

```
{% set files = ['/a/foo.sh', '/b/bar.sh', '/b/baz.sh'] %}

{% for file in files %}
{% for p, r in [('/aaa/bbb', '/aaa/ccc'), ('/xxx/yyy', '/xxx/zzz')] %}
replace {{ p }} in {{ file }}:
   file.replace:
      - name: {{ file }}
      - pattern: {{ p }}
      - repl: {{ r }}
{% endfor %}
{% endfor %}

```

Keep in mind the identifiers need to be unique, that's why variables in `replace {{ p }} in {{ file }}:` are used.
> 1 votes

---
Tags: salt
---


# Question
Title: Context of DevOps in ISO 27001 security audits
Correct me if I am wrong, ISO 27001 addresses mostly organizational and operational aspects. This sounds a little bit abstract and regulatory.

On the other hand, in DevOps, if you wish DevSecOps, there is proactive and very specific demand for processes and tools to ensure that no vulnerabilities are delivered to customer.

How do these two domains fit together?

Do security auditors ask actually in a security audit questions like,

* "Do you have a vulnerability scan as part of your component dependency management?
* Have you checked your API for OWASP breaches?
* Do you scan your Docker images, being aware of risks connected to base images?"

# Answer
In my experience auditors tend to follow a Top-down Risk Assessment process whereby they review the **inherent risk** to business and IT for a company or system, then look at the **controls** that company has in place to mitigate the inherent risk and the **residual risk** that remains.

A top-down risk assessment opposes the way most technical people work, in that we look at specific vulnerabilities, defects and design flaws and then work up from there in a more bottom-up approach.

There is nothing inherently wrong with either approach they both have a place in any given company, so in answer to your questions:

* Auditors do not tend to ask domain-specific questions such as *Have you checked your API for OWASP breaches*; they do tend to ask questions such as *What controls are in place to mitigate the risk of data loss due to software vulnerabilities?*
* The thing to realise about ISO 27001, and most standards, is that they are not prescriptive - they are designed to provide a standard business language to enable communication between Business/IT and Auditors. More often than not "implementing" any standard is about identifying the **existing processes** that meet the requirements of the standard and documenting them, then looking for any gaps or flaws and plugging the holes.

The same logic goes for ISO 9000, ITIL, COBIT, COSO, etc. it's very rarely about enforcing some pre-defined process. Instead, it is a case of creating a mapping between what the auditor is looking for and what the business is doing.
> 2 votes

---
Tags: security, audit
---


# Question
Title: Is it true to say that both a "shared server environment " and a "VPS environment" can be either IaaS or PaaS?
Say I rent a DigitalOcean 20$ "VPS environment" (IaaS) or a SiteGround 10$ "shared-hosting environment" (PaaS).

As far as I know, in both cases **I share hardware** with other customers (both constellations aren't "dedicated" - either dedicated "on-perm" or dedicated in any other hosting model).

From what I just described, I get the impression that the notion of a "shared hosting environment versus a VPS environment" is misleading because in both cases there is direct sharing of one system (one hardware system - "shared" or "VPS").

Hence I ask, is it true to say that both a "shared server environment " and a "VPS environment" can be either IaaS or PaaS?

# Answer
> 0 votes
Usually, Only a VPS hosting can be either.

While an IaaS is always VPS, what's commonly called "shared hosting plan" is PaaS in which a client shares the same hardware **and webserver** software with different customers (due to sharing a webserver, it's not a VPS --- Virtual **Private** Server).

In a PaaS (of the subtype Pass;VPS) only the hardware is shared (so it's indeed a "shared server", but only in that sense).

# Answer
> 0 votes
A VPS service provides you with infrastructure in the form of private virtual machines. You have access to these VMs as if they were regular servers (e.g. via SSH). The infrastructure itself is the product. The VMs almost always run on shared hardware.

A "shared hosting" service provides you with an application environment. You may or may not have access to the underlying infrastructure; the infrastructure exists but the application platform is the product. The environment almost always runs on shared hardware.

You're correct that both VPS and "shared hosting" providers use shared resources for their service, but "shared hosting" providers only provide infrastructure insofar as it is required for the application to function.

For that reason "shared hosting" environments are usually categorized as PaaS. VPS services are IaaS, but many providers also offer PaaS products.

---
Tags: automation, servers
---


# Question
Title: How to send notification only in case of job output being non-empty
We are using rundeck to scan logfiles for a service, and take action depending on what is found there. Basically, for each item found, for which a records does not exists, a git repository is initialized and a few rest endpoints are called, but that's not the point.

We are setting up the job to run as scheduled, say every couple of hours, and to send notification on failure, and additionally to send notification on success only when at least one action has been taken (ie. the shell script in the task entered the loop at least once). The script is written so that it only emits output on stdout when items to be actioned are found.

Is there a way in rundeck to trigger notification with this requirement? Or a way to script it without writing a plugin from scratch?

One possible workaround would be to switch the failure notification trigger off, and make the script return non-zero in case of no items actioned, but I am not comfortable in doing that.

# Answer
> 7 votes
The way I could think of are:

Writing your own plugin, from the notification plugin example page, adapting the example mail notification code could be a way.

Disabling success notifications in rundeck, and handle the success notification part in your script itself. This way that's your script responsibility to warn it did something in normal state and it's still rundeck responsibility to warn you the script failed.

# Answer
> 1 votes
I was able to get around this issue in a bit of a dodgy way by changing the command to:

```
/bin/bash -c "your-command-here | { ! grep '^'; }"

```

This pipes the output through `grep` and fails if there is any output at all, but `grep` still passes it through so you still get to see the output in Rundeck upon failure.

One drawback is that I believe you lose any blank lines but we don't output any so no big deal for us, and it will tide us over until we can update the app to terminate with a proper exit code.

---
Tags: notifications, rundeck
---


# Question
Title: What is the common term for Apache virtual hosts or Nginx block systems?
A webserver environment as with *Apache* or *Nginx* includes a type of file (or a file system) that I can call a *webserver substrate*; In Apache it is called a **Virtual host** and in Nginx I can call it a "Block system", mainly comprised of a `server{}` block, among other blocks.

This "webserver substratre" **connects** an app's directory with the webserver, and also enables or disables it (by means of webserver requests and responses associated with that app directory). Thus, each web application has one such substrate.

What is the common term for such file, or file system, in the *Linux System Administration* (LSA) field?

# Answer
> 1 votes
All my searches for a term brought me to conclude that the general term either for one Apache virtual host file or a constellation of Nginx block files (each containing at least one block) is just that --- a virtual host.

Per project; either the virtual host (entity) is a single file or a combination of files, and that's true if the webserver software is different than these two.

---
Tags: terminology, linux, nginx, apache-httpd
---


# Question
Title: Jenkins Pipeline steps that run before Jenkinsfile
I'm just starting to get my toes wet with Jenkins and CI/CD.

I've built a set of static analysis tools and corresponding configurations I want to run before a branch's Jenkinsfile is even considered. I want to have Jenkins run these tools across every branch regardless of what the Jenkinsfile on the branch says. I want to make sure that the static analysis is out of the purview of the repo. How can I build a set of steps that are run before the Jenkinsfile on the branch is considered?

# Answer
> 1 votes
I see (at least) two possible solutions that both have their drawbacks.

1. Using a shared library containing all the code for your static analysis. That code can then be called as a step in the pipeline. https://jenkins.io/doc/book/pipeline/shared-libraries/. This doesn't keep the execution out of the pipeline completely, but it keeps the code out of each pipeline/branch and is (in my opinion) a pretty straight forward solution.
2. Putting the static analysis into a separate job, trigger that job for example with a git hook and then let that job trigger the pipeline. I my opinion a more complex solution that has more moving parts, but may be closer to what you're asking for.

---
Tags: jenkins, jenkinsfile
---


# Question
Title: Quest for a missing release of Apache Cloud Stack 4.7.1.3
Is there any public evidence of Apache Cloud Stack release 4.7.1.3?

Namely, what I can find so far, there is only 4.7.1.1, but an instance I can observe reports to be a 4.7.1.3.

See also:

https://github.com/apache/cloudstack/issues/3084

# Answer
As it came out, the instance is not Cloud Stack but Cloud Platform by Citrix, (a commercial fork?) so they have slightly different version numbers.

I.e.:

* 4.7.1.3 of Cloud Platform depends on CS 4.7.1.1.
* 4.11 of Cloud Platform depends on CS 4.10..?
> 0 votes

---
Tags: cloud
---


title: Restart agent for each build

text:
# Question
Title: Restart agent for each build
How do I configure jenkins to restart the agent for **each** build?

I tried to use "*launch method: launch agent via execution of command on the master*" in combintation with "*availability: take this agent online when in demand, and offline when idle*" but it has two drawbacks:

1. (not critical) build starts with a delay of about one minute.
2. (critical) the node goes offline only a minute after the end of the build, and if another build starts at that time, **the same** still running agent will be used (even if there are several similarly configured free nodes).

There is even a plugin (scripted cloud plugin) that, according to the description, should be suitable, but it does not work, probably because its code is outdated.

# Answer
> 2 votes
Slave restarts the agent itself after each build? You can use Conditional BuildStep plugin to restart it on a defined condition.

# Answer
> 2 votes
I still dont see how starting an agent creates a clean image. Expanding on your setup would help us provide better answer.

That said, from what I can gather here the following assumption comes to mind :

* You have agents pre-populated on a VM image. Starting this image will in turn start the agent in which you wish to start the build.

So you now have a chicken vs egg problem where you need the agent running to start the job but you need to start the agent as the job starts.

Why not have *another* agent who's job is to start the image. This new agent is no longer sensitive to the image cleanliness and can run indefinitely.

My approach here would take this a step further and not have the agent as part of the image altogether, but rather have the agent first start the image, provision it with whatever is needed for the build in some way, and then run the build.

A simple shared folder on the image with the host could do the work. Tools like Vagrant could also be of use. But without more information it's really difficult to go further.

This answer on stack overflow could also contain some help in this regard. Basically spins-up a new docker image on demand.

Another possible way with your current setup, make sure the build always ends with a shutdown of the image. This way the next job will be sure to use a fresh image as it *should* never survive the build. You could even test fort his situation and fail the build outright if you detect the image was re-cycled between builds rather than re-launched.

---
Tags: jenkins
---


# Question
Title: Are all virtualization (OS/above-OS) utilities DevOps utilities?
Are all virtualization (OS/above-OS) utilities commonly considered DevOps utilities?

These could be *OS virtalization* utilities like VirtualBox and Vagrant and maybe also WSL is considered as such and also, *above OS virtualization* tools like docker (AFAIK CMs like Ansible, Chef, Puppet and so forth aren't meant for "virtuallizing" anythin).

# Answer
I'd say you have touched another, far more fundamental question - what makes a utility a "DevOps" one? That is, how do you measure the "DevOpsness" of a tool and formalize facts in this context?

Possibly, my wish list for DevOpsness of a tool, **virtualization tools** or other, if they fulfill further criteria down on this list:

* Open and interoperable API, both for operational and intelligence needs
* Optimized workflows, see "developer experience"
* Machine readable configuration as code
* User community
* Short release cycles
* Certificate of software quality which is nowadays yet very ambigous
> 2 votes

---
Tags: terminology, virtualization
---


# Question
Title: How to use Jenkins to manage a repository from Github with a submodule from Bitbucket?
For my Jenkins build, I need to manage a Github repository to automate building a project. However, the issue is that this repository needs to pull a submodule from Bitbucket. This requires two difference instances of authentication, one for each service. As of now, Jenkins is only allowing the use of a single set of credentials, using a username and SSH key. Is there a way to specify a different set of credentials for each pull?

# Answer
It is a convenience that Jenkins will pull from git for you. With such a complex setup as needing to pull from two repos you can simply use a pipeline job that runs "sh" to explicitly git checkout the code and pull the submodules:

```
sh "git checkout ${custom_env_var} ${custom_parameter}

```

The good news with this slightly manual approach is that you can debug the sh commands to run on a dev server and cut paste them straight into a pipeline. Just start a “sh” session (usually it runs bash) and test the commands.
> 2 votes

# Answer
Assuming you are populating a tree of files to do a build, and some files come from Git and some from BitBucket, here are a few suggestions:

-Use two Jenkins jobs, one triggered by another

-Use a script run by a Jenkins job

-Add a pull to your make or other build toolchain to include the outside library
> 0 votes

---
Tags: jenkins, bitbucket, github
---


# Question
Title: How does Vagrant differ from VirtualBox and similar software, if at all?
Both Vagrant and VirtualBox (or their alternatives) seem to me to virtualize an OS on top of another OS,

How do they differ from one another essentially, if at all?

# Answer
> 3 votes
Vagrant is a tool to create and customize virtual environments (containers and VMs) in a reproducible fashion (across platforms) using code and a virtualization provider of your choice. VirtualBox is only one of the virtualization providers it supports. Vagrant can also create VMs using Hyper-V, VMware and AWS.

While VirtualBox's VBoxManage does let you create and configure VirtualBox VMs, Vagrant, by contrast, will allow you to create and configure VMs with the hypervisor provider of choice, which may or may not be VirtualBox. Vagrant is agnostic as to virtualization provider plug-in you use with it.

To sum it all up, Vagrant does not provide virtualization services itself.

## Further reading

**The links below provide helpful insights.**

An itemized comparison of Vagrant to Hypervisors can be viewed on this HasiCorp github issue.

These links provide some additional overview of Vagrant that may help bring the difference into focus.

Also, if you sign-up for a free account at LinuxAcademy you can view and work through this simple example that includes these tools.

---
Tags: terminology, vagrant, virtualization, virtualbox
---


# Question
Title: How frequently do PaaS:VPS agencies upgrade OS_release in comparison to PaaS:shared-webserver?
I know that in a In *PaaS:shared-webserver* service a user could have the OS of its server environment **release\_upgraded** in 8 or 12 years or so ! For example, I host a few sites on a particular host that uses a very old version of CentOS (from about 2007).

I never used a *PaaS:VPS* service (like AWS/MSA/GCP) and I wonder if they have a different standard of doing OS release\_upgrades; for example, I wonder if due to utilization of OS deployment tools like Vagrant, it might it be say per each new release (say, each 2 years) instead?

How frequently do PaaS:VPS agencies upgrade OS\_release in comparison to PaaS:shared-webserver?

# Answer
> 2 votes
From my experience this is very provider specific and requires evaluating the SLA offered for a particular service.

For example the **siteground** cloud server offerings shown at https://www.siteground.com/cloud-hosting.htm state: *We preinstall and maintain all the software you need on your server.*

While offerings from **liquidweb** they make it clear they will customize the support level to fit your requirements (the custom levels of management are detailed here). You can chose the support level for the product you purchase, whether it's a cloud VPS or dedicated server hardware.

IMHO most cloud products will probably be vendor managed and provide you a way to perform needed customization. But general statements are not useful when it comes to spending money. You have to confirm what your vendor is providing.

---
Tags: linux, vagrant, release-management, platform-as-a-service
---


# Question
Title: Is there a 5$-30$ IaaS that supports some rolling-release distro?
Is there a 5$-30$ IaaS that supports some rolling-release distro?

I consider a rolling-rlease OS (like ArchLinux) upon non rolling ones or at least upon a **rolling-combo** such as a *rolling Win10 + Vagrant + rolling-Ubuntu*) to save resources (both hardware and money).

ArchLinux seems to me to be the most communal and documented one out there but I might be wrong in that assumption.

I once asked DigitalOcean if they offer any IaaS VPSs ("droplets") with ArchLInux but a staff member told me they had that option and removed it for technical conflicts with their system and services.

# Answer
Linode is one of these (see linode.com). Linode offers 5$ ArchLinux and yesterday I talked with their staff and two staff members confirmed to me that they can't find any plans to stop supporting it in the future, so that's good.

According to ArchLinux wiki here, Arch Linux is a **full rolling release** OS which is basically "true rolling release OS":

> Linux Mint Debian Edition (LMDE) is based on Debian Stable and only receives updates in Mint packages and security updates. Arch is instead a full rolling-release distribution.

I understand that to be the highest one can go in rolling upgrades and of release as well.
> 1 votes

---
Tags: architecture
---


# Question
Title: AWS Cloudformation: Callback only for CREATE_COMPLETE or CREATE_FAILED of entire stack
I am creating a CF stack;

I have been using the `--notification-arns` flag of `aws cloudformaction create-stack` to send notifications to an email topic; however this produces a huge amount of spam, given that it records **every** `X_IN_PROGRESS` **and** `X_COMPLETE`, where `X=CREATE/DELETE` for **every** resource on the stack;

I just want to get notifications for the **stack** `CREATE/DELETE` events.

Is this possible?

# Answer
> 1 votes
I believe, alternatively, you could use CloudTrail+CloudWatch rules, but then you will get CREATE\_STACK events for *all* stacks Here is some information about that:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-api-logging-cloudtrail.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/EventTypes.html

And, of course, there's the option to put a lambda which listens on the notification topic and filters the needed events before sending the email.

---
Tags: amazon-web-services, aws-cloudformation
---


title: Accessing container by domain name

text:
# Question
Title: Accessing container by domain name
hey guys I have a docker container A with a domain name attached to it on a host B with a domain name attached to it as well.....how can I access the said container A via A's domain name rather than an B's ip address or domain name from computer C on the host B's local network

# Answer
> 1 votes
As I understand it you need to establish a network service (I.e, compose file), though if you are working with a docker file (e.g, ver. docker 1.x \< 2) you typically issue a command or execute a script. In either case, I’ll need to create a new network service and bridge ports (I.e, expose port) to make them accessible:

A \<-\> B -\> C

Check out the documentation:

https://docs.docker.com/network/

Hope that helped.

---
Tags: docker, networking, dns
---


# Question
Title: What is the difference between continuous deployment to continuous delivery?
I understand continuous integration as "orchestrating and continuously installing and/or upgrading an environment, or part of an environment, based on communally-maintained code".

*\- my own definition.*

But what is the difference between continuous deployment to continuous delivery, if at all there is one and both are not just parallels.

# Answer
> 1 votes
Long story short:

`Continuous delivery is the capability to deploy the software to any given environment at a given point of time.` The objective is to perform push-button deployments of any version of the software to any environment on demand.

Continuous Delivery is often conflicted with Continuous Deployment. Any change the developer makes gets deployed all the way up to Production is *Continuous Deployment*

The referenced article will give some info: DevOps in nutshell

---
Tags: terminology
---


# Question
Title: Will Docker Swarm work if masters are spread over 3 continents?
I need to deploy a highly available Docker Swarm on Azure. I created a VNet in 3 locations: Brazil South (my location), East US and West Europe. Then I enabled network peering so VMs in these locations can see each other as if they were in the same VNet. Cluster seems working fine. The problem is that turns out latency is high between these locations: ~190ms.

Questions:

1. Is this a recommended topology for HA? Is there a way to improve it?
2. Will this latency pose any (future) limitations?

# Answer
> 7 votes
There are various timeouts within swarm mode that do not handle high latency well and may start to assume nodes within the cluster are down, lose quorum, or have networking issues. For HA, the standard advice is to have multi-AZ but not multi-region for a single cluster. For use cases that need multi-region, you would deploy multiple swarm clusters, one per region. If you really need multi-region with a single swarm cluster, then consider placing all of the management nodes within the same region and only deploying worker nodes to the other regions.

---
Tags: docker-swarm
---


# Question
Title: How to find the image name corresponding to a layer digest?
Since 1.10, Docker implements a content addressable method based on a secure hash of the image and layer data:

```
sudo docker pull redis:5.0.2-alpine
sudo docker inspect --format '{{json .RootFS }}' redis:5.0.2-alpine | jq .
{
  "Type": "layers",
  "Layers": [
    "sha256:df64d3292fd6194b7865d7326af5255db6d81e9df29f48adde61a918fbd8c332",
    "sha256:04c8ef03e9356ae0c559ecc63ef5ef7154d5da8d4bef48786a7f00f628047d88",
    "sha256:169a281fff0fef0bfbec6873d7f0b6d2cad3a67068d0f16e2d32259582a2b95c",
    "sha256:1943100a0dc33557faa38ea52c3c6e974c0311122fa0ca9c5d8e398ab532ff2b",
    "sha256:1a49f3e37547b9141b4a5f78aaedb0ddcbfc8871466bbc3d3d8b8dba420c154a",
    "sha256:ba1d81ed872f9f31960e964cf6d00c77a668fd04ab0277ece2273dbb85003910"
  ]
}

```

But is there a way to match the layers digest with an image name, either locally downloaded or in some repository?

As far as I can tell, `docker search` does not allow searching by digest. Or does it?

# Answer
The mapping between image manifest and layers goes the other way. You can have one or more image manifests pointing to a layer. And those images may not even be tagged with an image name, or a single image may have multiple tags. So I'm not aware of an easy way to do a reverse search. You would need to go through each image on the local system or registry to see what images point to that layer, and then search the tags to see what names that image has.
> 2 votes

---
Tags: docker
---