I've heard "containers are not a security boundary" enough times that it's started to feel like received wisdom, and my honest read (after 13+ years) is that it's technically defensible but practically sloppy – and the sloppiness matters. The part that's true: containers share a kernel, and a kernel exploit crosses the container boundary where a VM would not. That difference is real and…
Off-and-on over the last several weeks, I've been spending time trying to learn/understand YubiKeys better, especially from the perspective of ECDSA and signing. 🔏 I had a good mental model for how "slots" work (canonically referenced by their hexadecimal names such as 9C ), but found that it had a gap related to "objects"; while closing that, I was annoyed that the main reference table for this…
See "My Docker Install Process" and "My Docker Install Process (redux)" . This one's going to be even more to-the-point. grab Docker's APT repo GPG key GNUPGHOME = " $( mktemp -d ) " ; export GNUPGHOME gpg --keyserver keyserver.ubuntu.com --recv-keys 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 sudo mkdir -p /etc/apt/tianon.gpg.d gpg --export --armor 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 | sudo tee…
I've recently been playing with Debian's iSCSI support, and it's pretty neat. It was a little esoteric to set things up, so I figured I'd write up a quick blog post of exactly what I did both for my own future-self's sake and for the sake of anyone else trying to do something similar. The most "followable" guide I found was…
I recently went through a stint of closing a huge number of issues in the docker-library/php repository, and one of the oldest (and longest) discussions was related to installing dependencies for a compiling extensions, and I wrote a semi-long comment explaining how I do this in a general way for any software I wish to Dockerize. I'm going to copy most of that comment here and perhaps expand a…
Following in the footsteps of one of my favorite Debian Developers, Chris Lamb / lamby (who is quite prolific in the reproducible builds effort within Debian), I've started a new project based on snapshot.debian.org (time-based snapshots of the Debian archive) and some of lamby's work for creating reproducible Debian ( debootstrap ) rootfs tarballs. The project is named "Debuerreotype" as an…
Since I wrote my first post on this topic , Docker has switched from apt.dockerproject.org to download.docker.com , so this post revisits my original steps, but tailored for the new repo. There will be less commentary this time (straight to the beef). For further commentary on "why" for any step, see my previous post. These steps should be fairly similar to what's found in upstream's "Install…
I've had several requests recently for information about how I personally set up a new machine for running Docker (especially since I don't use the infamous curl get.docker.com | sh ), so I figured I'd outline the steps I usually take. For the purposes of simplicity, I'm going to assume Debian (specifically stretch , the upcoming Debian stable release), but these should generally be easily…
I've been using VULTR for a little while now and have been generally very pleased (especially with the very recent facelift the management portal received). I don't want to waste too much time talking about it, but the "killer feature" for me (over some of their competitors like DigitalOcean ) is that I can provide a raw ISO and provision my VM directly using it as I would any local VM (which also…
DEP stands for "Debian Enhancement Proposals". DEP8 is about package testing, specifically post-install (as opposed to dh_auto_test which runs during package build, usually for unit tests). It's great for integration tests, etc. that have more interesting requirements for running than unit tests normally do. The problem is that the spec is a little bit long in the tooth for casual reading /…
The DD-WRT wiki hilariously has a page about this , but it's not very helpful and account creation is entirely disabled , so here goes a blog post for my own future reference: In the dns.he.net control panel , enable the hostname ( HOSTNAME ) for "dynamic dns". Click the DDNS icon and generate a "key" ( KEY ), which will be used as the password for updating. In the DD-WRT control panel, under…
I am really late coming to this train. This has been on my list since the day it was released, and today I finally found the time to sit alone and digest. To say that it was "emotionally moving" would be a gross misrepresentation of the film. There were clearly some aspects added for dramatic effect, but if you strip away (for example) the demonization of the opposition's actions, the proceedings…
I was given the opportunity to attend DebConf in Portland this year, and I must say that it took me entirely by surprise (as a first-time attendee). Most conferences have several strong talk tracks and you end up spending a lot of time sitting in talks wondering when they'll be over. At DebConf, there's an entirely different dynamic, with a strong focus on what they like to call "the hallway…
Docker on Gentoo can be a beautiful thing, but it can also be a challenge navigating some of the trade-offs. The hardest decision to make, in my opinion, is which storage backend to use. Each one has ups and downs, and some of them have ups and downs that are more specific to Gentoo than others. "aufs" Normally for an out-of-kernel module (even a filesystem), it would be a simple matter to simply…
My good friend Paul Tagliamonte recently gave a talk at PyCon 2014 about his language, Hy. It's effectively Lisp implemented inside Python (so cleanly that Python itself doesn't care to differentiate the result from any other Python code). It's a solid talk that covers a lot of good ground about some of the cool stuff you can do with Hy, and especially about the internals of exactly how Hy works,…