This message, related to the development of the theme, only displays on the
localhost homepage to notify you of any important theme changes.
Below are the following changes that could be breaking changes for your site. For more details on any change, please refer to PR #154.
The major breaking change is:
images (backwards compatibility for featured and associated parameters still remains) will need to adjust from [images]="SRC" to the new format.[[images]]
src = "" // Link to image
alt = "" // Alt text for image
stretch = // Optional: See screenshots for referenced values and outcomes
If you utilize any of the following, there might be a breaking:
While I realize this is inconvenient, I hope that it is worth it to you in the long run. Thanks for using the theme, and feel free to submit issues as needed.
containers, packaging, programming, hacks, kubernetes, openshift, fedora, centos
This post shows how you can enable seccomp on all the Pods that are deployed with Prometheus Operator
Seccomp helps us limit the system calls the process inside container can make. And PodSecurityPolicy is the way to enable it on pods in Kubernetes.
Note on Linux Kernel capabilities
File capabilities allow users to execute programs with higher privileges. Best example is network utility ping.
The easiest way to prove that root inside the container is also root on the host
Here are simple steps that you can follow to prove that the root user inside container is also root on the host. And how to mitigate this.
Instead of polluting your PATH the easier way to put project specific scripts
There are always scripts that you write to automate some mundane tasks. And then you put that script in a directory that is in your PATH. But what this does is that it pollutes your system global PATH and shows up in places you wouldn’t want it to be in.
No docker cp needed to copy files from host to your container
This blog shows you how you can copy stuff from your host machine to the running container without the docker cp command that we usually use.
Understanding the seccomp profile json format
A large number of system calls are exposed to every userland process with many of them going unused for the entire lifetime of the process. A certain subset of userland applications benefit by having a reduced set of available system calls. The resulting set reduces the total kernel surface exposed to the application. System call filtering is meant for use with those applications. Seccomp filtering provides a means for a process to specify a filter for incoming system calls.
List of all the talks presented by me
Watch from 55m59s
Event Report for Kubernetes Bangalore Meetup
The Kubernetes Bangalore Meetup was organized at Arvind Internet on Feb 16th 2019. The agenda for the meetup was to teach Kubernetes to the beginners.
Dealing with apiserver in minikube can be tricky
If you want to provide extra flags to the kube-apiserver that runs inside minikube how do you do it? You can use the minikube’s --extra-config flag with apiserver.<apiserver flag>=<value>, for e.g. if you want to enable RBAC authorization mode you do it as follows:
Subpath Volume Mount could give you access to node
A volume mount CVE was discovered in Kubernetes 1.9 and older which allowed access to node file system using emptyDir volume mount using subpath. The official description goes as follows: