lucperkins

perf script | stackcollapse-perf.pl |  # taken from the flamegraph page linked above
  grep ^qemu | # We're only interested in the qemu process
  awk '/unknown/ { gsub("(\\[unknown];){1,}", "[unknown...];", $0) } { print }' | # Make the graph a lot less tall by collapsing multiple consecutive unknown stack frames together
  flamegraph.pl > flamegraph.svg # and generate a flamegraph

lucperkins

[root@oak:~]# nsenter -t 1684606 -p -- unshare -m

🗣 Now inside the build's PID namespace (through nsenter) and a new mount namespace (created by unshare)
[root@oak:~]# ps -f 1
UID          PID    PPID  C STIME TTY      STAT   TIME CMD
root           1       0  0 Sep02 ?        Ss     1:24 /run/current-system/systemd/lib/systemd/systemd

[root@oak:~]# mount -t proc proc /proc

[root@oak:~]# ps -f 1

lucperkins

[root@oak:~]# pgrep -a qemu
1678991 /nix/store/6shk4z9ip57p6vffm5n9imnkwiks9fsa-qemu-host-cpu-only-for-vm-tests-7.0.0/bin/qemu-kvm [...]

[root@oak:~]# nsenter --target=1678991 --pid

🗣 This spawned a new shell within the build's PID namespace
[root@oak:~]# ps -f 1
UID          PID    PPID  C STIME TTY      STAT   TIME CMD
root           1       0  0 Sep02 ?        Ss     1:24 /run/current-system/systemd/lib/systemd/systemd

lucperkins

warning: Target and debugger are in different PID namespaces;
thread lists and other data are likely unreliable.
Connect to gdbserver inside the container.

lucperkins

defmodule TasksAppWeb.TodoController do
  use TasksAppWeb, :controller
  use Plug.ErrorHandler

  alias TasksApp.Todos
  alias TasksApp.Todos.Todo

  def index(conn, _params) do
    todos = Todos.list_todos()
    conn

lucperkins

{
  "private": true,
  "dependencies": {
    "event-stream": "^4.0.1",
    "express": "^4.17.1",
    "left-pad": "^1.3.0"
  }
}

lucperkins

workflow "OPA evaluation" {
  on = "push"
  resolves = ["install"]
}

# Determines whether the policy has been violated
action "evaluate" {
  uses = "docker://openpolicyagent/opa:0.11.0"
  args = [
    "eval",

lucperkins

package ci

# The package.json is presumed faulty
default allow = false

# Packages that aren't allowed
blacklist = {
    "event-stream",
    "left-pad"
}

lucperkins

# Install doctl (DigitalOcean CLI tool)
brew install doctl

# Install kubectl
brew install kubernetes-cli

# Log into DigitalOcean
export DO_ACCESS_TOKEN=...
doctl auth login init --access-token ${DO_ACCESS_TOKEN}

lucperkins

Homebrew build logs for coredns on macOS 10.14.2
Build date: 2019-01-31 09:32:03