Julien Nicoulaud nicoulaj

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

Docker issues are frequently logged for DNS resolution in containers because it doens't inhert or get values for DNS from NetworkManager which leverages a built in dnsmasq to inteligently manage DNS.

Perminant workarround

sudo bash -c "echo listen-address=$(ip -4 addr show dev docker0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}') > /etc/NetworkManager/dnsmasq.d/docker-bridge"
sudo systemctl reload NetworkManager
sudo bash -c 'echo -e "{\n\t\"dns\": [\"$(ip -4 addr show dev docker0 | grep -oP "(?<=inet\s)\d+(\.\d+){3}")\"]\n}" > /etc/docker/daemon.json'
sudo systemctl restart docker

Title: Foreign Function Interface Author: Charles Oliver Nutter Organization: Red Hat Owner: Charles Oliver Nutter Created: 2014/01/28 Type: Feature State: Draft Exposure: Open Component: --/-- Scope: JDK

Everything I Ever Learned About JVM Performance Tuning @Twitter- by Attila Szegedi

http://www.infoq.com/presentations/JVM-Performance-Tuning-twitter (video & slides)

9 Fallacies of Java Performance - by Ben Evans

http://www.infoq.com/articles/9_Fallacies_Java_Performance (video & slides)

Visualizing Java GC - by Ben Evans

http://www.infoq.com/presentations/Visualizing-Java-GC (video & slides)

Java Garbage Collection Distilled by Martin Thompson

agnoster.zsh-theme

A ZSH theme optimized for people who use:

Solarized
Git
Unicode-compatible fonts and terminals (I use iTerm2 + Menlo)

For Mac users, I highly recommend iTerm 2 + Solarized Dark

Locate the section for your github remote in the .git/config file. It looks like this:

[remote "origin"]
	fetch = +refs/heads/*:refs/remotes/origin/*
	url = [email protected]:joyent/node.git

Now add the line fetch = +refs/pull/*/head:refs/remotes/origin/pr/* to this section. Obviously, change the github url to match your project's URL. It ends up looking like this:

	#!/bin/bash

	# Trap signals
	for signal in HUP INT QUIT ABRT KILL SEGV USR1 USR2 TERM; do
	trap "echo 'master : Received signal ${signal}...'" ${signal}
	done

	# Submit slaves
	slave_id=0; while read host slots queue procs; do
	for slot in $(seq $slots); do

	import java.io.File;
	import java.io.IOException;
	import java.io.RandomAccessFile;
	import java.nio.channels.FileLock;
	import java.nio.channels.OverlappingFileLockException;

	import static com.google.common.base.Preconditions.checkNotNull;

	public class FileSystemLock {
	private final File lockFile;

	public static String loadJMXAgent(int port) throws IOException,
	AttachNotSupportedException, AgentLoadException,
	AgentInitializationException {
	String name = ManagementFactory.getRuntimeMXBean().getName();
	VirtualMachine vm = VirtualMachine.attach(name.substring(0,
	name.indexOf('@')));

	String lca = vm.getAgentProperties().getProperty(
	"com.sun.management.jmxremote.localConnectorAddress");
	if (lca == null) {

	#include <stdio.h>
	#include <stdlib.h>
	#include <assert.h>

	typedef unsigned int u32;
	typedef unsigned long long u64;

	//-------------------------------------------------------------------------
	// WorkArea
	//-------------------------------------------------------------------------