adduser --disabled-login --comment "" SomeUserName
adduser
: friendlier front-end foruseradd
,usermod
andgroupadd
--disabled-login
: no password and shell set to/usr/sbin/nologin
--comment ""
: don't prompt for details, successor of deprecated--gecos
flag i think
Only needed if a user needs to run a command as root/sudo (e.g. not needed for zfs send
/syncoid
when setting it up rootless with zfs allow
)
visudo /etc/sudoers.d/SomeUserName
(better than just visudo
because of package manager upgrades)
To check sudoers configuration (above command won't check permissions by default):
visudo --check --strict
#!/bin/bash
/usr/sbin/syncoid \
--sendoptions=w # send raw/encrypted
--no-privilege-elevation \ # don't attempt to use root/sudo (assumes proper permissions / zfs allow)
--no-sync-snap \ # don't create a snapshot for this sync (would require additional permissions, i skip this because sanoid already creates plenty of snapshots)
--pv-options='-L 5M' \ # optional: limit bandwidth to 5MB/s
tank/source-dataset SomeUser@SomeServer:tank/target-dataset
from="192.168.0.0/24",restrict,command="SomeCommandHere" ssh-[...] [key] user@host
ssh -F ~/.ssh/config user@ip
-F
forces usage of the config, skipping global config which attempts to send locales.
Source: https://stackoverflow.com/a/41786965
services:
app:
build:
context: .
dockerfile_inline: |
FROM baseimage ...
- grow VM disk on Proxmox
- in VM:
growpart [device] [partitionNumber]
(e.g.growpart /dev/sda 2
) - in VM:
resize2fs [partition]
(e.g.resize2fs /dev/sda2
) - verify with
df -h