David McKeone dmckeone

Proxmox Assign Bind Mount To Unprivileged Container

In order for the LXC container to have full access the proxmox host directory, a subgid is set as owner of a host directory, and an ACL is used to ensure permissions.

Bind Mount dataset to LXC

Add the following line to /etc/pve/lxc/<CT_ID>.conf

mp0:/mount/point/on/host,mp=/mount/point/on/lxc

Create group on host

In the default Proxmox configuration, unpriviliged container subgids will have the prefix "10" followed by the expected 4-digit gid.

Blog post: https://segmentfault.com/a/1190000017136059

FWIW: I (@rondy) am not the creator of the content shared here, which is an excerpt from Edmond Lau's book. I simply copied and pasted it from another location and saved it as a personal note, before it gained popularity on news.ycombinator.com. Unfortunately, I cannot recall the exact origin of the original source, nor was I able to find the author's name, so I am can't provide the appropriate credits.

Effective Engineer - Notes

By Edmond Lau
Highly Recommended 👍
http://www.theeffectiveengineer.com/

What's an Effective Engineer?

Stuff I wish I'd known sooner about service workers

I recently had several days of extremely frustrating experiences with service workers. Here are a few things I've since learned which would have made my life much easier but which isn't particularly obvious from most of the blog posts and videos I've seen.

I'll add to this list over time – suggested additions welcome in the comments or via twitter.com/rich_harris.

Use Canary for development instead of Chrome stable

~~Chrome 51 has some pretty wild behaviour related to console.log in service workers. Canary doesn't, and it has a load of really good service worker related stuff in devtools.~~

	#!/bin/python3
	#
	"""Example Sanic Reverse Proxy"""

	from urllib.parse import urlsplit, urlunsplit
	from sanic import Sanic, Request
	from sanic.response import stream, HTTPResponse
	import httpx

	env = {"hostname-from": "localhost", "port-from": 8000, "port-to": 8080}

	import argparse

	from graphql import (
	build_schema,
	get_named_type,
	GraphQLNamedType,
	GraphQLSchema,
	is_input_object_type,
	is_object_type,
	)

	import asyncio
	import aiopg
	import aiopg.sa
	import asyncpg
	import asyncpgsa
	import sqlalchemy as sa

	pg_tables = sa.Table(
	'pg_tables', sa.MetaData(),
	sa.Column('schemaname'),

	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
	ssl_session_cache shared:SSL:10m;
	ssl_dhparam /etc/ssl/certs/dhparam.pem;
	ssl_session_timeout 1d;
	ssl_session_tickets off;

	SELECT blocked_locks.pid AS blocked_pid,
	blocked_activity.usename AS blocked_user,
	now() - blocked_activity.query_start
	AS blocked_duration,
	blocking_locks.pid AS blocking_pid,
	blocking_activity.usename AS blocking_user,
	now() - blocking_activity.query_start
	AS blocking_duration,
	blocked_activity.query AS blocked_statement,
	blocking_activity.query AS blocking_statement

	import re

	from sqlalchemy.ext.compiler import compiles
	from sqlalchemy.schema import CreateTable, DropTable, \
	CreateSequence, DropSequence, CreateIndex, DropIndex
	from sqlalchemy.dialects.postgresql import DropEnumType

	patches = (
	(CreateTable, 'visit_create_table', "^\s*CREATE TABLE", "CREATE TABLE IF NOT EXISTS"),
	(CreateIndex, 'visit_create_index', "^\s*CREATE INDEX", "CREATE INDEX IF NOT EXISTS"),