#random (2024-06)

It’s quite remarkable indeed!

I had the same thought…

It doesn’t shows signs of slowing down either.

I tried OpenStack at the first few releases, after that I understood why it failed, it is a disaster lol

IE: If you build an image with this dockerfile in Github Actions, you don’t get any ACLs, but if you build it locally, you get ACLs…. https://gist.github.com/AlexAtkinson/c57574cfad70fa50e11dd58c2b1730b5

A hint… Running that container like docker run acl-test:latest getfacl /var/cache/sit reveals that the acls exist while in github runner…. After pulling that container from ECR they no longer exist….

Pushing that docker image to dockerhub from GHA and pulling it has the same result as when pushing the image to ECR from GHA and pulling it…. No acls persisted.

I’m missing something basic.

“Docker imposes certain limitations that make working with capabilities much simpler. For example, file capabilities are stored within a file’s extended attributes, and extended attributes are stripped out when Docker images are built. This means you will not normally have to concern yourself too much with file capabilities in containers.
It is of course possible to get file capabilities into containers at runtime, however this is not recommended. “

https://github.com/docker/labs/blob/master/security/capabilities/README.md

Either the gist is private or deleted, but I don’t understand the rationale for doing this in a container.

NixOS community needs an actor to accelerate like IBM to RedHat 25 years ago

Oracle should invest into NixOS community before others start

I feel like most things oracle touches get ruined by their enterprise approach of trying to make money off everything

Please don’t let oracle near anything useful.

Lol agreed, one of companies I worked for was acquired by Oracle… now it is struggling to get back the battle field with the old competitors, feeling like it is interesting if it can start with a strategic one as NixOS, then IBM and Ubuntu and SUSE will be shaking…

I know people are experiencing this kind of situation every day, I had before too. Some decision makers are stupid, e.g. the persons who decided license change in Ha$hicorp. Keep calm and Learn Open Source!

my respects to this lady

I know that CloudFlare’s CEO is hard on their sales team, but as I understand, sales is a cutthroat industry where it’s extremely easy to develop metrics for measuring employee performance and also necessary for companies to drop low performers. It’s very meritocratic and that’s a pro and a con of the field. I hope she can find work elsewhere but I don’t think the decision makers are stupid here.

To err is human, but some wouldn’t just admit, this stupid is bigger and has more impact on people during this tough time

I have been laid off recently from ServiceNow , reason project closure , not related to performance or cost cut just project closed and they don’t need me anymore.

sorry to hear that, it is tough and will last for a while under the current world political relationship, be prepared

Azure AKS still supports both OSM and Istio. I tested Istio/Cilium on AKS. Istio can be enabled after AKS is created but Cilium requires to recreate AKS cluster

IIRC from various podcasts, Microsoft wanted to use Istio but felt they couldn’t commit to it given its funky governance.

There were some weird internal dynamics at Google who were trying to gain some advantage from having it outside the CNCF. I think some on the business side saw AWS getting a lot of the kubernetes benefits and wanted to keep Istio for themselves.

Istio and envoy were also a key part of the Google and GCP roadmap so they perhaps wanted more say on the initial features.

Publicly, Google was arguing disingenuously that Istio was already fully open source and had open governance (just not CNCF) so this was all FUD on Microsoft’s and IBM’s part.

Then at some point Google gave in after a few years, partly because some big customers wanted it in CNCF. At that point, OSM was no longer needed, and it never really had the featureset for adoption.

got it, felt OSM is more simple and straightforward, another M$ attempt tapping into open sources failed…

I think the community consensus is that a service mesh is mainly for big companies who need all the features that Istio has (e.g. expansion of mesh to on prem virtual machines).

Smaller companies can make do with something in between (like pod security groups on AWS, or DAPR for mtls).

I followed Cilium and Consul for a few years, even though Istio defeated OSM, the learning curve is hard, it depends on Envoy which is also not easy to configure. After eBPF is in production, Istio may face a strong competitor

good point on cilium/eBBF. Cisco is using it for its distributed HyperShield. GCP’s distributed firewall is another transparent option for L7 protection without needing to deploy a proxy - not sure if it uses cilium under the cover but more likely a mulit-tenant envoy as that’s the standard proxy Google uses corporation wide.

But yea for most people and most features Cilium/eBPF would also do the job, especially if it’s the managed dataplane by the Cloud Provider. There’s the ongoing vendor debate about whether Cilium is suitable for strong identity and multi-tenant L7 protection but they’re edge cases that only maybe some auditors and companies like Bloomberg would view as dealbreakers.

Ultimately service mesh (istio) solves around 10 problems, is expensive to rollout and requires a mature organisation. If you don’t have all 10 problems, don’t need it for regulatory purposes, and aren’t multi-cloud, there are many less expensive solutions in-between.

yes, cloud firewall is expensive, I used Istio recently to reduce the costs in a proof-of-concept project, much cheaper

I’m thinking about just having a management console with SSH access to the fleet where I can manually acknowledge and authorize them after power-on to grab secrets and store in memory.

Manual, remote authorization is basically the only cost effective pattern available if you need 99% security on devices that anyone can physically access. Of course, once physical access to the device is a possibility, there is no way to prevent access to its local data, even if only stored in memory.

I’m trying to get on his level

Docker Hub is falling down…

@Erik Osterman (Cloud Posse)

It’s no longer maintained

We went though recently and moved projects we are no longer using or maintaining to archives. Sorry for not updating it, there were several hundred.

what alternative would you advise for sudosh?

So we implemented this as a “poor man’s” alternative to Gravitational Teleport SSH, which adds proper session recording.

This is the gold standard, and what we would recommend.

Any customer we have that requires this capability is using Teleport

Note, there’s almost nothing to sudosh. It’s a thin wrapper to sudo so it can be used as a shell.

The easiest thing is to just fork it

OK thanks for the info Erik :)

oh no, MTV is my first door to the free world

Yesterday on Office Hours, had a UI issue with Zoom. It wouldn’t confirm that the recording would stop or start. And was persistently stuck on “Recording”. So not related, but related.

hmm this is suspicious

Zoom is definitely doing something behind the scene

yesterday seems my voice got no issue, but the other side was clear or far away

I assume you are referring too: https://github.com/996icu/996.ICU ?

yeah, it is there for a while and this repo has been blocked from mainland if remember it correct

https://qz.com/1589309/996-icu-github-hosts-chinese-tech-worker-complaints

https://magazine.scienceforthepeople.org/vol24-2-dont-be-evil/why-the-996-icu-movement-must-not-be-forgotten-in-the-us/

https://madeinchinajournal.com/2019/06/18/the-996-icu-movement-in-china-changing-employment-relations-and-labour-agency-in-the-tech-industry/

everyone in the world should be cautious, not only who works in tech industry. free world is not far from being slaved

https://www.reddit.com/r/programming/comments/bbdb39/the_996icu_github_repo_from_protesting_chinese/

the situation in that world is not improving after this repo was created, ’cause more layoffs there happened, and seldom people in free world noticed