UVOO Tech Wiki - Recent changes [en]

Kube-virt - k8s in k8s

Busk — Sun, 02 Aug 2026 15:11:02 GMT

Created page with "One of the most popular and powerful use cases for KubeVirt, often referred to as **Kubernetes-in-Kubernetes** or **Tenant Clusters**. In this architecture, your underlying b..."

New page

One of the most popular and powerful use cases for KubeVirt, often referred to as **Kubernetes-in-Kubernetes** or **Tenant Clusters**.

In this architecture, your underlying bare-metal Kubernetes cluster acts as the **infrastructure management layer** (the control plane for hardware), and KubeVirt provisions VMs that join together to form separate, isolated **tenant Kubernetes clusters**.

---

## Why Do This? (Key Benefits)

* **Multi-Tenancy & Hard Isolation:** Containers share the host kernel. If you need strict security boundaries between teams or environments (e.g., Prod vs. Dev), VMs provide hardware-level virtualization isolation.
* **Infrastructure-as-Code (GitOps):** You can manage the lifecycle of entire target Kubernetes clusters declaratively using standard `kubectl` commands or GitOps pipelines (ArgoCD/Flux).
* **Cluster API (CAPI) Integration:** Using the **Cluster API Provider KubeVirt (CAPK)**, you can declare a target Kubernetes cluster in YAML, and CAPI + KubeVirt will automatically spin up the VMs, run `cloud-init` to install Kubernetes on them, and join them into a fully functional tenant cluster.
* **Testing & Sandbox Environments:** It allows developers to spin up ephemeral, full-featured Kubernetes clusters (with custom kernel modules or CNI configurations) without needing real physical hardware.

---

## How the Architecture Looks

```
┌────────────────────────────────────────────────────────────────────────┐
│ BARE-METAL KUBERNETES CLUSTER │
│ (Management Cluster: Physical Servers + Storage + KubeVirt Operator) │
│ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ TENANT KUBERNETES CLUSTER │ │
│ │ │ │
│ │ ┌────────────────────┐ ┌────────────────────┐ │ │
│ │ │ KubeVirt VM 1 │ │ KubeVirt VM 2 │ │ │
│ │ │ (Tenant Control) │ │ (Tenant Worker) │ │ │
│ │ │ │ │ │ │ │
│ │ │ ┌────────────────┐ │ Network │ ┌────────────────┐ │ │ │
│ │ │ │ Tenant K8s API │ ◄────────────────►│ Tenant Pods │ │ │ │
│ │ │ └────────────────┘ │ (Overlay/VLAN) │ └────────────────┘ │ │ │
│ │ └────────────────────┘ └────────────────────┘ │ │
│ └──────────────────────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────────────────────┘

```

---

## Typical Workflow

1. **Deploy Bare-Metal K8s:** You set up physical servers with a Kubernetes distribution (e.g., Talos, RKE2, OpenShift, or upstream K8s).
2. **Install KubeVirt:** Deploy the KubeVirt operator on the bare-metal cluster.
3. **Use Cluster API (CAPK):** Apply a manifest defining a tenant cluster (e.g., 1 Control Plane VM, 3 Worker VMs).
4. **Bootstrapping via cloud-init:** KubeVirt boots the VMs, and `cloud-init` runs scripts (like `kubeadm join` or `k3s`) to wire the nodes into the new nested cluster.

---

## Things to Consider

* **Nested Virtualization / Overhead:** Ensure hardware-assisted virtualization (`/dev/kvm`) is available on your bare-metal nodes so KubeVirt runs near native speed.
* **Networking:** You’ll need a CNI or plugin like **Multus** or **OVN-Kubernetes** on the bare-metal cluster to assign dedicated IPs or VLANs to the VM nodes so the tenant cluster can route traffic cleanly.

Openssl

Busk — Sat, 01 Aug 2026 22:06:24 GMT

Swap space

Busk — Sat, 01 Aug 2026 21:03:21 GMT

Gitlab runner LXD

Busk — Sat, 01 Aug 2026 20:10:13 GMT

Created page with "https://docs.gitlab.com/runner/executors/custom_examples/lxd/ You need to **install the `gitlab-runner` apt package first**. Installing the package creates the `gitlab-runne..."

New page

https://docs.gitlab.com/runner/executors/custom_examples/lxd/

You need to **install the `gitlab-runner` apt package first**.

Installing the package creates the `gitlab-runner` system user and the `/etc/gitlab-runner/` directory structure where `config.toml` lives.

Here is the step-by-step order of operations to get everything set up correctly:

---

## Step 1: Install the GitLab Runner Package

Run these commands on your host machine to add GitLab's official repository and install the runner:

```bash
# 1. Download and run the official GitLab repository setup script
curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash

# 2. Install the gitlab-runner package
sudo apt-get install gitlab-runner

```

---

## Step 2: Create the LXD Executor Scripts

Next, create your wrapper scripts for the custom executor (e.g., in `/opt/gitlab-runner/`).

```bash
# Create directory for custom executor scripts
sudo mkdir -p /opt/gitlab-runner

# Create the prepare, run, and cleanup scripts
sudo touch /opt/gitlab-runner/lxd-prepare.sh
sudo touch /opt/gitlab-runner/lxd-run.sh
sudo touch /opt/gitlab-runner/lxd-cleanup.sh

# Make them executable
sudo chmod +x /opt/gitlab-runner/lxd-*.sh

```

*(Paste the script contents into these files and ensure the LXD TLS certificate generation step you performed earlier is configured under the `gitlab-runner` system user's home directory so it can authenticate against LXD).*

---

## Step 3: Register and Configure `config.toml`

Finally, register the runner with your GitLab instance, which will automatically generate or update `/etc/gitlab-runner/config.toml`.

```bash
# Register the runner (you'll need a registration token from GitLab UI)
sudo gitlab-runner register \
--non-interactive \
--url "https://gitlab.com/" \
--token "YOUR_RUNNER_AUTHENTICATION_TOKEN" \
--executor "custom" \
--description "lxd-restricted-runner" \
--custom-prepare-exec "/opt/gitlab-runner/lxd-prepare.sh" \
--custom-run-exec "/opt/gitlab-runner/lxd-run.sh" \
--custom-cleanup-exec "/opt/gitlab-runner/lxd-cleanup.sh"

```

Once registered, you can edit `/etc/gitlab-runner/config.toml` directly if you need to fine-tune concurrency limits or execution parameters.

Kubernetes Bare Metal

Busk — Sat, 01 Aug 2026 19:26:06 GMT

Created page with "https://www.digitalocean.com/community/tutorials/bare-metal-kubernetes You probably want to use cloud-init like this Ubuntu 24.04 `cloud-init` configuration for provisioning..."

New page

https://www.digitalocean.com/community/tutorials/bare-metal-kubernetes

You probably want to use cloud-init like this Ubuntu 24.04

`cloud-init` configuration for provisioning Kubernetes nodes on **Ubuntu 24.04 LTS**.

This script handles:

* Disabling swap (required by `kubelet`)
* Enabling necessary kernel modules (`overlay`, `br_netfilter`)
* Setting required `sysctl` networking parameters
* Installing and configuring `containerd` with the `SystemdCgroup` driver enabled
* Adding the official `pkgs.k8s.io` repository (configured for Kubernetes **v1.30**)
* Installing and locking (`apt-mark hold`) `kubelet`, `kubeadm`, and `kubectl`

---

## Cloud-Init YAML (`user-data`)

```yaml
#cloud-config
package_update: true
package_upgrade: false

packages:
- apt-transport-https
- ca-certificates
- curl
- gpg
- containerd

write_files:
# Enable required kernel modules for container networking
- path: /etc/modules-load.d/k8s.conf
permissions: '0644'
content: |
overlay
br_netfilter

# Set sysctl rules for iptables bridge & IP forwarding
- path: /etc/sysctl.d/k8s.conf
permissions: '0644'
content: |
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1

runcmd:
# 1. Disable swap immediately and persistently across reboots
- swapoff -a
- sed -i '/ swap / s/^$.*$$/#\1/g' /etc/fstab

# 2. Load kernel modules and apply sysctl settings
- modprobe overlay
- modprobe br_netfilter
- sysctl --system

# 3. Configure containerd with SystemdCgroup enabled
- mkdir -p /etc/containerd
- containerd config default | tee /etc/containerd/config.toml > /dev/null
- sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
- systemctl restart containerd
- systemctl enable containerd

# 4. Add official Kubernetes v1.30 apt repository
- mkdir -p -m 755 /etc/apt/keyrings
- curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
- chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
- echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list

# 5. Install Kubernetes binaries and prevent auto-upgrades
- apt-get update
- apt-get install -y kubelet kubeadm kubectl
- apt-mark hold kubelet kubeadm kubectl
- systemctl enable --now kubelet

```

---

## Next Steps After Boot

Once your machine finishes running `cloud-init`, choose your role:

### For the Control Plane (Master Node)

Initialize the cluster with your control plane IP and preferred pod CIDR (e.g., Flannel/Calico):

```bash
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

```

### For Worker Nodes

Run the `kubeadm join` command provided at the end of your control plane's `kubeadm init` output.

AWS vs Azure

Busk — Sat, 01 Aug 2026 15:46:53 GMT

AWS vs Azure

Busk — Sat, 01 Aug 2026 15:46:15 GMT

Created page with "**for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.** The reduced configuration, lack of node managem..."

New page

**for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.**

The reduced configuration, lack of node management (no OS patching, no AMI rotations, no cluster autoscaling setup), and per-task scaling make it the lower-overhead option for developer velocity.

However, saying it’s *only* when resources are "mostly pegged" misses a few critical non-cost boundaries where Fargate simply cannot be used or becomes significantly more expensive.

---

### Non-Cost Constraints (When Fargate Is Not an Option)

Sometimes you **must** use EC2 regardless of price or utilization:

1. **GPU / Specialized Hardware Workloads:** Machine learning inference/training (NVIDIA GPUs), high-performance media encoding, or AWS Inferentia/Trainium hardware require EC2 instance types. Fargate doesn't support GPU pass-through.
2. **Custom Daemon / Host-Level Monitoring:** If you rely on daemonsets/agents that must run at the host OS level (e.g., specific kernel-level eBPF tracing, custom security agents, or system-wide log forwarders), Fargate’s serverless boundary prevents host access. Sidecar containers are required on Fargate instead.
3. **Privileged Mode & Kernel Tweaks:** Tasks requiring Linux `--privileged` access, custom kernel module loading, raw network sockets, or `sysctl` modifications are blocked by Fargate’s isolation boundary.
4. **Extreme Local Disk I/O:** Fargate task storage tops out at 200 GB of ephemeral storage. If your app requires terabytes of high-speed local NVMe scratch disk (like `i3en` or `z1d` instances), you need EC2.

---

### Cost Decision Matrix

```
Is the workload continuous & predictable?
/ \
/ \
YES NO (Bursty / Batch / Variable)
/ \
Are you running high-volume baseline? --> Use FARGATE
/ \ (Zero idle capacity waste)
/ \
YES NO
/ \
Are you using 3-yr Savings --> Use FARGATE
Plans + tight bin-packing? (Engineering time > ~20% savings)
/
YES
/
Use EC2
(Save up to 50%+)

```

---

### Summary Checklist

| Dimension | Default Choice | Shift to EC2 when... |
| --- | --- | --- |
| **Operational Effort** | **Fargate** (Zero node maintenance) | You already have robust node automation (e.g., Karpenter/Cluster Autoscaler) and dedicated DevOps resource. |
| **Scale Mechanism** | **Fargate** (Fast task provisioning) | Scaling is predictable and you can handle warm node pools. |
| **Hardware** | **Fargate** (Standard CPU/ARM + RAM) | You require GPUs, host storage, or kernel/privileged access. |
| **Cost at Scale** | **Fargate** (No waste from idle nodes) | Your monthly compute bill is large enough ($5k–$10k+/mo) that saving 30–50% pays for the engineering time to manage nodes. |

Saltstack docker

Busk — Fri, 31 Jul 2026 07:15:26 GMT

Saltstack docker

Busk — Fri, 31 Jul 2026 07:14:03 GMT

Created page with "``` #!/bin/bash set -e # ========================================== # CONFIGURATION # ========================================== # Replace with your Dockerized Salt Master's..."

New page

```
#!/bin/bash
set -e

# ==========================================
# CONFIGURATION
# ==========================================
# Replace with your Dockerized Salt Master's IP or DNS name
SALT_MASTER="mysalt.example.com"

# Uses the machine's hostname by default, or you can hardcode a name (e.g., "web-server-01")
MINION_ID=$(hostname)
# ==========================================

if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

echo "==> Installing prerequisites..."
apt-get update
apt-get install -y curl gnupg

echo "==> Adding Salt Project repository for Ubuntu 24.04 LTS (Noble)..."
mkdir -p /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg \
https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg

echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=amd64] https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/3006 noble main" \
| tee /etc/apt/sources.list.d/salt.list > /dev/null

echo "==> Installing Salt Minion..."
apt-get update
apt-get install -y salt-minion

echo "==> Configuring Minion to connect to $SALT_MASTER..."
mkdir -p /etc/salt/minion.d
echo "master: $SALT_MASTER" > /etc/salt/minion.d/master.conf
echo "$MINION_ID" > /etc/salt/minion_id

echo "==> Enabling and starting Salt Minion service..."
systemctl enable --now salt-minion
systemctl restart salt-minion

echo "=================================================="
echo "Success! The Salt Minion ($MINION_ID) is running."
echo "It has sent its public key to $SALT_MASTER."
echo "You must now log into the Master server and accept this key."
echo "=================================================="
```

```
# List pending keys to verify the minion showed up
docker compose exec salt-master salt-key -L

# Accept the specific minion key
docker compose exec salt-master salt-key -a
```

Rootless docker

Busk — Fri, 31 Jul 2026 02:30:32 GMT

Rootless docker

Busk — Fri, 31 Jul 2026 02:00:06 GMT

Created page with "Works on Ubuntu 24.04 install-rootless-docker-on-ubuntu.sh ``` #!/bin/bash set -e SERVICE_USER="dockeruser" # 1. Ensure script is run with sudo/root privileges if $EUID..."

New page

Works on Ubuntu 24.04

install-rootless-docker-on-ubuntu.sh
```
#!/bin/bash
set -e

SERVICE_USER="dockeruser"

# 1. Ensure script is run with sudo/root privileges
if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

echo "==> Installing dependencies..."
apt-get update
apt-get install -y uidmap dbus-user-session slirp4netns docker-ce-rootless-extras

echo "==> Configuring Ubuntu 24.04 unprivileged user namespaces..."
sysctl -w kernel.unprivileged_userns_clone=1
echo "kernel.unprivileged_userns_clone=1" > /etc/sysctl.d/50-rootless-docker.conf

echo "==> Stopping and disabling rootful Docker to prevent socket conflicts..."
systemctl stop docker.service docker.socket || true
systemctl disable docker.service docker.socket || true
rm -f /var/run/docker.sock

echo "==> Creating dedicated user: $SERVICE_USER..."
if id "$SERVICE_USER" &>/dev/null; then
echo "User $SERVICE_USER already exists, skipping creation."
else
useradd -m -s /bin/bash "$SERVICE_USER"
echo "User $SERVICE_USER created successfully."
fi

echo "==> Enabling user lingering (ensures containers run without active SSH session)..."
loginctl enable-linger "$SERVICE_USER"

# Wait a moment for systemd to initialize the new user's DBUS environment
sleep 2

echo "==> Installing Rootless Docker as $SERVICE_USER..."
# We use sudo to switch users and explicitly set XDG_RUNTIME_DIR so systemctl --user works
sudo -i -u "$SERVICE_USER" bash << 'EOF'
# Define systemd runtime variables for the user session
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"

# Run the rootless installer
dockerd-rootless-setuptool.sh install

# Configure .bashrc for future logins
if ! grep -q "DOCKER_HOST" ~/.bashrc; then
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
fi

# Start and enable the systemd service for Docker
systemctl --user enable --now docker

echo "==> Rootless Docker installed successfully for $(whoami)!"
docker info | grep -i rootless
EOF

echo "==> Script complete!"
echo "To manage your containers, switch to the new user by running:"
echo "sudo su - $SERVICE_USER"
```

Tpm2

Busk — Fri, 31 Jul 2026 01:03:51 GMT

Tpm2

Busk — Thu, 30 Jul 2026 22:22:57 GMT

Created page with "Ubuntu 24.04 ls -l /dev/tpm* sudo apt install libtss2-rc0t64 libtss2-esys-3.0.2-0t64 tpm2-tools systemd-cryptenroll --tpm2-device=list lsblk -f | grep -i luk sudo systemd-cryp..."

New page

Ubuntu 24.04
ls -l /dev/tpm*
sudo apt install libtss2-rc0t64 libtss2-esys-3.0.2-0t64 tpm2-tools
systemd-cryptenroll --tpm2-device=list
lsblk -f | grep -i luk
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=1+4+7 /dev/nvme0n1p3
sudo reboot
sudo update-initramfs -u -k all

Codex gemini install cli

Busk — Sun, 26 Jul 2026 02:01:05 GMT

Kubectl sniff

Busk — Sat, 25 Jul 2026 21:16:09 GMT

Created page with "kubectl debug -i my-container-77c5f975d8-mt7mm -n my-ns --image=nicolaka/netshoot --target=my-container --profile=netadmin -- tcpdump -i any -nn -A -s 0 'tcp port 8080'..."

New page

kubectl debug -i my-container-77c5f975d8-mt7mm -n my-ns --image=nicolaka/netshoot --target=my-container --profile=netadmin -- tcpdump -i any -nn -A -s 0 'tcp port 8080' | grep -iE 'X-Forwarded-For|Host:'

Cka kubeadm init upgrade

Busk — Fri, 24 Jul 2026 17:30:10 GMT

Docker install ubuntu

Busk — Wed, 15 Jul 2026 17:05:45 GMT

Created page with "``` sudo apt update sudo apt install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /..."

New page

```
sudo apt update
sudo apt install -y ca-certificates curl gnupg

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

Lxc launch

Busk — Wed, 15 Jul 2026 17:00:03 GMT

← Older revision		Revision as of 22:06, 1 August 2026
Line 1:		Line 1:
		+	openssl s_client -connect docker2:993 -servername docker2 </dev/null 2>/dev/null \| openssl x509 -noout -subject
		+
	https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs		https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

← Older revision		Revision as of 21:03, 1 August 2026
Line 1:		Line 1:
	# Linux		# Linux
		+
		+	## Disable swap
		+
		+	# Disable swap immediately
		+	sudo swapoff -a
		+
		+	# Comment out or remove any swap entries from /etc/fstab to persist on reboot
		+	sudo sed -i.bak '/\bswap\b/s/^/#/' /etc/fstab

	## Clear swap		## Clear swap

← Older revision		Revision as of 15:46, 1 August 2026
Line 1:		Line 1:
		+	Here is how the core AWS services map directly to their Azure counterparts across key infrastructure categories:
		+
		+	### Core Service Mapping
		+
		+	\| Category \| AWS Service \| Azure Equivalent \| Description \|
		+	\| --- \| --- \| --- \| --- \|
		+	\| Compute \| EC2 \| Virtual Machines (VMs) \| On-demand virtual instances/servers. \|
		+	\| \| AWS Lambda \| Azure Functions \| Event-driven serverless compute. \|
		+	\| \| Elastic Beanstalk \| Azure App Service \| Managed PaaS for web app deployment. \|
		+	\| Containers \| EKS \| Azure Kubernetes Service (AKS) \| Managed Kubernetes engine. \|
		+	\| \| ECS / Fargate \| Azure Container Apps / ACI \| Serverless container execution. \|
		+	\| \| ECR \| Azure Container Registry (ACR) \| Docker/OCI image repository. \|
		+	\| Storage \| S3 \| Azure Blob Storage \| Scalable object storage. \|
		+	\| \| EBS \| Azure Managed Disks \| Block storage attached to compute instances. \|
		+	\| \| EFS / FSx \| Azure Files \| Fully managed network file shares (NFS/SMB). \|
		+	\| \| S3 Glacier \| Azure Archive Storage \| Cold/archival storage for backups. \|
		+	\| Databases \| RDS \| Azure SQL Database / Flexible Server \| Managed relational databases (PostgreSQL, MySQL, SQL Server). \|
		+	\| \| DynamoDB \| Azure Cosmos DB \| Fully managed NoSQL key-value/document database. \|
		+	\| \| ElastiCache \| Azure Cache for Redis \| In-memory caching. \|
		+	\| Networking \| VPC \| Virtual Network (VNet) \| Isolated private cloud networking. \|
		+	\| \| Route 53 \| Azure DNS \| Managed DNS routing service. \|
		+	\| \| Direct Connect \| Azure ExpressRoute \| Dedicated private link to on-premise hardware. \|
		+	\| \| ALB / NLB \| Application Gateway / Load Balancer \| Layer 7 (HTTP/HTTPS) and Layer 4 load balancing. \|
		+	\| Identity & Security \| AWS IAM \| Microsoft Entra ID (Azure AD) + RBAC \| Identity management, auth, and role definitions. \|
		+	\| \| AWS KMS \| Azure Key Vault \| Key, secret, and certificate management. \|
		+	\| \| AWS Shield / WAF \| Azure DDoS Protection / Web Application Firewall \| DDoS defense and application security. \|
		+	\| Analytics & AI \| Redshift \| Azure Synapse Analytics \| Cloud data warehousing. \|
		+	\| \| Amazon SageMaker \| Azure Machine Learning \| Platform for building, training, and deploying ML models. \|
		+	\| \| AWS Glue \| Azure Data Factory \| Managed ETL and data integration pipelines. \|
		+
		+	---
		+
		+	### Key Structural Differences
		+
		+	* Identity Model: AWS centers permissions around IAM policies attached to users/roles via JSON documents. Azure heavily relies on Microsoft Entra ID with Role-Based Access Control (RBAC) applied across standard scope hierarchies (Management Groups → Subscriptions → Resource Groups → Resources).
		+	* Resource Management: Azure mandates that every resource resides within a Resource Group for unified lifecycle management. AWS tags resources globally or groups them logically, but lacks the strict single-container grouping model native to Azure.
		+
		+
		+
	for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.		for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.

← Older revision		Revision as of 07:15, 31 July 2026
Line 1:		Line 1:
		+	```
		+	services:
		+	salt-master:
		+	image: saltstack/salt:latest
		+	container_name: salt-master
		+	restart: unless-stopped
		+	ports:
		+	- "4505:4505"
		+	- "4506:4506"
		+	volumes:
		+	- ./config/master:/etc/salt/master:ro
		+	- salt-pki:/etc/salt/pki
		+	- ./srv/salt:/srv/salt
		+	- ./srv/pillar:/srv/pillar
		+	- salt-cache:/var/cache/salt
		+	- salt-run:/var/run/salt
		+
		+	watchtower:
		+	image: containrrr/watchtower
		+	container_name: watchtower
		+	restart: unless-stopped
		+	environment:
		+	# Run at 2:00 AM every night
		+	# Format: Seconds Minutes Hours DayOfMonth Month DayOfWeek
		+	- WATCHTOWER_SCHEDULE=0 0 2 * * *
		+	# Remove old unpatched image layers from disk after updating
		+	- WATCHTOWER_CLEANUP=true
		+	# Check for base image updates regardless of local tag
		+	- WATCHTOWER_INCLUDE_RESTARTING=true
		+	volumes:
		+	# CRITICAL: This must point to the rootless user's socket, not /var/run!
		+	# Replace '1001' with the output of `id -u`
		+	- /run/user/1001/docker.sock:/var/run/docker.sock
		+	# Restrict Watchtower to ONLY update the salt-master container
		+	command: salt-master
		+
		+	volumes:
		+	salt-pki:
		+	salt-cache:
		+	salt-run:
		+	```
		+
	```		```
	#!/bin/bash		#!/bin/bash

@@ Line 5: / Line 5: @@
 curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
 sudo apt-get install -y nodejs
-sudo npm install -g npm@latest
-npm install -g @openai/codex
+mkdir -p ~/.npm-global
-npm install -g @google/gemini-cli
+npm config set prefix '~/.npm-global'
 codex --version
 gemini --version
 ```

@@ Line 1: / Line 1: @@
 Works on Ubuntu 24.04
 install-rootless-docker-on-ubuntu.sh
@@ Line 14: / Line 16: @@
 fi
-echo "==> Installing dependencies..."
+# ==========================================
 apt-get update
-apt-get install -y uidmap dbus-user-session slirp4netns docker-ce-rootless-extras
+apt-get install -y ca-certificates curl
 echo "==> Configuring Ubuntu 24.04 unprivileged user namespaces..."
 sysctl -w kernel.unprivileged_userns_clone=1
@@ Line 42: / Line 79: @@
 echo "==> Installing Rootless Docker as $SERVICE_USER..."
 sudo -i -u "$SERVICE_USER" bash << 'EOF'
      # Define systemd runtime variables for the user session

@@ Line 1: / Line 1: @@
 Ubuntu 24.04
 ls -l /dev/tpm*
-sudo apt install libtss2-rc0t64 libtss2-esys-3.0.2-0t64 tpm2-tools
-systemd-cryptenroll --tpm2-device=list
-lsblk -f | grep -i luk
+```
-sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=1+4+7 /dev/nvme0n1p3
+# 1. Update your package lists and install the Clevis toolset
-sudo reboot
+sudo apt update
 sudo update-initramfs -u -k all

← Older revision		Revision as of 17:30, 24 July 2026
Line 78:		Line 78:

	## Cilium		## Cilium
		+
		+	This is only needed on one node in the cluster for admin functions if wanted as helm is what installs cilium agent on k8s nodes

	https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/		https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/

@@ Line 2: / Line 2: @@
 ```
-lxc init ubuntu:22.04 --vm -c limits.cpu=6 -c limits.memory=12GB docker
+lxc --target lxdnode1 init ubuntu:22.04 --vm -c limits.cpu=6 -c limits.memory=12GB docker
 lxc config device override docker root size=100GB
 lxc start docker