Charley Wu akunzai

Mistakes to Avoid: Docker Antipatterns

Whichever route you take to implementing containers, you’ll want to steer clear of common pitfalls that can undermine the efficiency of your Docker stack.

Don’t run too many processes inside a single container

The beauty of containers—and an advantage of containers over virtual machines—is that it is easy to make multiple containers interact with one another in order to compose a complete application. There is no need to run a full application inside a single container. Instead, break your application down as much as possible into discrete services, and distribute services across multiple containers. This maximizes flexibility and reliability.

Don’t install operating systems inside Docker containers

It is possible to install a complete Linux operating system inside a container. In most cases, however, this is not necessary. If your goal is to host just a single application or part of an application in the container, you need to install only the essential

Docker compose as a systemd unit

Create file /etc/systemd/system/[email protected]. SystemD calling binaries using an absolute path. In my case is prefixed by /usr/local/bin, you should use paths specific for your environment.

[Unit]
Description=%i service with docker compose
PartOf=docker.service
After=docker.service

Enable LDAP over SSL (LDAPS) for Microsoft Active Directory servers

Tip

Microsoft active directory servers by default provide LDAP connections over unencrypted connections (boo!).

The steps below will create a new self signed certificate appropriate for use with and thus enabling LDAPS for an AD server. Of course the "self-signed" portion of this guide can be swapped out with a real vendor purchased certificate if required.

Steps have been tested successfully with Windows Server 2012R2, but should work with Windows Server 2008 without modification. Requires a working OpenSSL install (ideally Linux/OSX) and (obviously) a Windows Active Directory server.

Create root certificate

ThreadPool Growth: Some Important Details

The CLR ThreadPool has two types of threads - "Worker" and "I/O Completion Port" (aka IOCP) threads.

Worker threads are used when for things like processing Task.Run(…) or ThreadPool.QueueUserWorkItem(…) methods. These threads are also used by various components in the CLR when work needs to happen on a background thread.
IOCP threads are used when asynchronous IO happens (e.g. reading from the network).

The thread pool provides new worker threads or I/O completion threads on demand (without any throttling) until it reaches the "Minimum" setting for each type of thread. By default, the minimum number of threads is set to the number of processors on a system.

Once the number of existing (busy) threads hits the "minimum" number of threads, the ThreadPool will throttle the rate at which is injects new threads to one thread per 500 milliseconds. This means that if your system gets a burst of work needing an IOCP thread, it will proces

	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Threading;
	using System.Threading.Tasks;
	using Microsoft.Extensions.Hosting;

	namespace WebApplication24
	{
	public abstract class HostedService : IHostedService

	<#
	.SYNOPSIS
	Locates Java versions and optionally sets JAVA_HOME and JRE_HOME.
	.DESCRIPTION
	The Find-Java function uses PATH, JAVA_HOME, JRE_HOME and Windows Registry to retrieve installed Java versions.
	If run with no options, the first Java found is printed on the console.
	.PARAMETER Vendor
	Selects Java vendor, currently supports Oracle, OpenJDK and IBM. Defaults to Any.
	.PARAMETER Architecture
	What processor architecture to match. Valid options are 32, 64, Match and All. Match detects what integer size is used for the PowerShell process, and matches the architecture. If Wow64 is available, 64 bit versions of Java are selected first.

	<#
	Prerequisites: PowerShell version 3 or above.
	License: MIT
	Author: Michael Klement <[email protected]>

	DOWNLOAD and DEFINITION OF THE FUNCTION:

	irm https://gist.github.com/mklement0/8689b9b5123a9ba11df7214f82a673be/raw/Out-FileUtf8NoBom.ps1 \| iex

	The above directly defines the function below in your session and offers guidance for making it available in future

	body { counter-reset: h1counter h2counter h3counter h4counter h5counter h6counter; }

	h1 { counter-reset: h2counter; }
	h2 { counter-reset: h3counter; }
	h3 { counter-reset: h4counter; }
	h4 { counter-reset: h5counter; }
	h5 { counter-reset: h6counter; }
	h6 {}

	h2:before {

	# How to uninstall Razer Synapse 2 ( https://www.razerzone.com/synapse-2 )
	# on OS X (10.11-10.13) (El Capitan, Sierra, High Sierra)
	# without using Razer's official uninstall tool.

	# Tested on OS X 10.11.5 in July 2016.
	# Edited with additional steps for later OS X versions,
	# contributed by commenters on this gist.

	# Step 1: In your terminal: stop and remove launch agents
	launchctl remove com.razer.rzupdater

	###
	###
	### UPDATE: For Win 11, I recommend using this tool in place of this script:
	### https://christitus.com/windows-tool/
	### https://github.com/ChrisTitusTech/winutil
	### https://www.youtube.com/watch?v=6UQZ5oQg8XA
	### iwr -useb https://christitus.com/win \| iex
	###
	### OR take a look at
	### https://github.com/HotCakeX/Harden-Windows-Security