Madhu Akula madhuakula

Rails on Docker

Note: many issues listed below are not specific to Rails or to Ruby. They can also exist in other languages or web frameworks presenting similar challeneges. It is important to note these challenges, because they can impede the workflow and best practices taught and used by Rails practitioners.

Challenges and Remediations

Different versions of Ruby

There are many different versions of Ruby in use. This is very unique, in that, in the Python world, you have many versions, but almost everyone will be using the last 2.X or the last 3.X. In the Java world, most use cases are covered by the last two major releases of either Java released by Oracle or on OpenJDK.

Protip 1: Create a Non-root User

This is good advice particularly in Linux

RUN groupadd -r nodejs \
   && useradd -m -r -g nodejs nodejs

USER nodejs

How to setup Let's Encrypt for Nginx on Ubuntu 16.04 (including IPv6, HTTP/2 and A+ SLL rating)

There are two main modes to run the Let's Encrypt client (called Certbot):

Standalone: replaces the webserver to respond to ACME challenges
Webroot: needs your webserver to serve challenges from a known folder.

Webroot is better because it doesn't need to replace Nginx (to bind to port 80).

In the following, we're setting up mydomain.com. HTML is served from /var/www/mydomain, and challenges are served from /var/www/letsencrypt.

How to Build a Successful Information Security Career (Daniel Miessler)
- https://danielmiessler.com/blog/build-successful-infosec-career/#gs.DtVCbbw
The First Steps to a Career in Information Security (Errata Security - Marisa Fagan)
- http://blog.erratasec.com/2010/04/first-steps-to-career-in-information.html#.WFrbofkrIuU
Hiring your first Security Professional (Peerlyst - Dawid Balut)
- https://www.peerlyst.com/posts/hiring-your-first-security-professional-dawid-balut
How to Start a Career in Cyber security
- https://www.concise-courses.com/security/how-to-start-your-career/
How to Get Into Information Security (ISC^2)
https://www.isc2.org/how-to-get-into-information-security.aspx

Docker Cheat Sheet

Why

Why Should I Care (For Developers)

"Docker interests me because it allows simple environment isolation and repeatability. I can create a run-time environment once, package it up, then run it again on any other machine. Furthermore, everything that runs in that environment is isolated from the underlying host (much like a virtual machine). And best of all, everything is fast and simple."

TL;DR, I just want a dev environment

Docker Swarm Mode Ports

Starting with 1.12, Docker Swarm Mode is a built-in solution with built-in key/value store. Easier to get started, and fewer ports to configure.

Inbound Traffic for Swarm Management

TCP port 2377 for cluster management & raft sync communications
TCP and UDP port 7946 for "control plane" gossip discovery communication
UDP port 4789 for "data plane" VXLAN overlay network traffic

AWS Security Group Example

AWS Tip: You should use Security Groups in AWS's "source" field rather then subnets, so SG's will all dynamically update when new nodes are added.

Humans build and fix systems.
Humans get tired and stressed, they feel happy and sad.
Systems don't have feelings yet. They only have SLAs.
Humans need to switch off and on again.
The wellbeing of human operators impacts the reliability of systems.
Alert Fatigue == Human Fatigue
Automate as much as possible, escalate to a human as a last resort.
Document everything. Train everyone. Save time.
Kill the shame game.
Human issues are system issues.

	#!/bin/bash

	# update apt-get
	export DEBIAN_FRONTEND="noninteractive"
	sudo apt-get update

	# remove previously installed Docker
	sudo apt-get purge lxc-docker*
	sudo apt-get purge docker.io*

	# Defaults / Configuration options for homebridge
	# The following settings tells homebridge where to find the config.json file and where to persist the data (i.e. pairing and others)
	HOMEBRIDGE_OPTS=-U /var/lib/homebridge

	# If you uncomment the following line, homebridge will log more
	# You can display this via systemd's journalctl: journalctl -f -u homebridge
	# DEBUG=*

	# to generate your dhparam.pem file, run in the terminal
	openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048