Introduction to eBPF for Observability | Better Stack Community
In today's world of intricate software systems, where microservices and distributed architectures reign supreme, observability is critical for maintaining operational efficiency and performance. eBPF stands for extended Berkeley Packet Filter. It has emerged as a revolutionary technology that provides unprecedented visibility into the inner workings of the Linux kernel, helping you monitor, troubl
Accelerate Next.js in Kubernetes
That's 93.6% faster median latency and near-perfect reliability compared to the standard approaches for scaling Node.js applications. These results come from production-grade benchmarks on real Next.js applications running on Kubernetes, comparing three common deployment strategies with identical total CPU resources (6 CPUs each). All configurations were tested under the same sustained load patter
第798回　Ubuntuã®ã‚»ã‚ュリティを支ãˆã‚‹AppArmor入門 | gihyo.jp
Ubuntuã§ã¯ã‚»ã‚ュリティ対ç–ã®ä¸€ç’°ã¨ã—ã¦AppArmorを採用ã—ã¦ã„ã¾ã™ã€‚AppArmorを使ãˆã°ã€ä»»æ„ã®ãƒ—ãƒã‚°ãƒ©ãƒ ã«å¯¾ã—ã¦ã€æ„図ã—ãªã„ファイルやデãƒã‚¤ã‚¹ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’阻害ã—ãŸã‚Šã€ã‚µãƒ–プãƒã‚»ã‚¹ã«å¯¾ã™ã‚‹ã‚»ã‚ュリティ制約をã‹ã‘ãŸã‚Šã§ãã¾ã™ã€‚今回ã¯ã‚ã¾ã‚Šæ„è˜ã™ã‚‹ã“ã¨ã®ãªã„ã‚‚ã®ã®ã€çŸ¥ã£ã¦ãŠãã¨ã„ã¤ã‹å½¹ã«ç«‹ã¤ã‹ã‚‚ã—ã‚Œãªã„ã€å®Ÿéš›ã«å½¹ã«ç«‹ã¤æ™‚ã¯ã‚ã¾ã‚Šæ¥ã¦ã»ã—ããªã„AppArmorã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã—ょã†ã€‚ AppArmorã¨MACã¨LSM㨠「AppArmorã€ã¯ã€Œåå‰ãƒ™ãƒ¼ã‚¹ã®å¼·åˆ¶ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã§ã€LSMを用ã„ã¦å®Ÿè£…ã•ã‚Œã¦ã„る仕組ã¿ã€ã¨ç´¹ä»‹ã•ã‚Œã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ã©ã†ã„ã†æ„味ã§ã—ょã†ã‹ã€‚ ã¾ãšã¯AppArmorã®ç‰¹å¾´ã¨ãªã‚‹ã€Œåå‰ãƒ™ãƒ¼ã‚¹ï¼ˆã‚‚ã—ãã¯ãƒ‘スåベース）ã€ã«ã¤ã„ã¦ã§ã™ãŒã€ã“ã‚Œã¯ã€Œã‚»ã‚ュリティè¨å®šã‚’対象ã¨ãªã‚‹ãƒ•ã‚¡ã‚¤ãƒ«ãƒ‘スを元ã«è¨å®šã™ã‚‹ã€ã“ã¨ã‚’æ„味ã—ã¾ã™ã€‚ã¤ã¾ã‚Šãƒ•ã‚¡ã‚¤ãƒ«ãƒ‘スã”ã¨ã«ã€ä½•ã‚’許å¯ã—何を許å¯ã—
- The standard for customising cloud instances
Cloud images are operating system templates and every instance starts out as an identical clone of every other instance. It is the user data that gives every cloud instance its personality and cloud-init is the tool that applies user data to your instances automatically. Use cloud-init to configure: Setting a default locale Setting the hostname Generating and setting up SSH private keys Setting up
What is Tracing? - Perfetto Tracing Docs
NOTE: the word "tracing" in this document is used in the context of client-side side software (e.g. programs running on a single machine). In the server world, tracing is usually short for distributed tracing, a way to collect data from many different servers to understand the flow of a "request" throughout multiple services. As such, this document will not be useful to you if you are interested i
Sandboxing and Workload Isolation
Sandboxing and Workload Isolation Author Name Thomas Ptacek @tqbf @tqbf Workload isolation makes it harder for a vulnerability in one service to compromise every other part of the platform. It has a long history going back to 1990s qmail, and we generally agree that it’s a good, useful thing. Despite a plethora of isolation options, in the time I spent consulting for technology companies I learned
How fast are Linux pipes anyway?
In this post, we will explore how Unix pipes are implemented in Linux by iteratively optimizing a test program that writes and reads data through a pipe.1 We will begin with a simple program with a throughput of around 3.5GiB/s, and improve its performance twentyfold. The improvements will be informed by profiling the program using Linux’s perf tooling.2 The code is available on GitHub. The post w
The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation
Abstract¶ This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow†but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102. Corrupti
Welcome to Linux From Scratch!
Linux From Scratch (LFS) is a project that provides you with step-by-step instructions for building your own custom Linux system, entirely from source code. Currently, the Linux From Scratch organization consists of the following subprojects: LFS :: Linux From Scratch is the main book, the base from which all other projects are derived. BLFS :: Beyond Linux From Scratch helps you extend your finis
WebVM: Client side X86 virtual machines in the browser
TL;DR — We made a server-less virtual Linux environment that runs unmodified Debian binaries in the browser. This is powered by CheerpX, a WebAssembly virtualization platform. Feel free to play with it and report bugs: https://webvm.io WebVM — a server-less virtual Linux environment running fully client-side in HTML5/WebAssembly.The web platform is well on its way to becoming the dominant platform
ptrace より 100 å€é€Ÿã„システムコールフック作ã£ãŸ - ã‹ãƒ¼ãã‚‹ã•ã‚“ã¨ã‹
æ–°ã—ã„高性能ã§æ±Žç”¨çš„ãªã‚·ã‚¹ãƒ†ãƒ コールフックã®ä»•çµ„ã¿ã‚’作ã£ã¦ã¿ã¾ã—ãŸã€‚ モãƒãƒ™ãƒ¼ã‚·ãƒ§ãƒ³ã¨ã—ã¦ã€ã‚·ã‚¹ãƒ†ãƒ コールをフックã—ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ç©ºé–“ã§ã‚¨ãƒŸãƒ¥ãƒ¬ãƒ¼ãƒˆã—ãŸããªã£ãŸã®ã§ã™ãŒã€ç¾çŠ¶ã€æ€§èƒ½ã¨æ±Žç”¨æ€§ã‚’両立ã™ã‚‹ä»•çµ„ã¿ãŒãªã•ãã†ã ã£ãŸã®ã§ã€æ–°ã—ã„方法を考ãˆã¾ã—ãŸã€‚ 今回ã®ã‚·ã‚¹ãƒ†ãƒ コールフックã®ä»•çµ„ã¿ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªç‰¹å¾´ãŒã‚ã‚Šã¾ã™ã€‚ ptrace より 100 å€ä»¥ä¸Šé«˜é€Ÿ LD_PRELOAD ã‚„æ—¢å˜ã®ãƒã‚¤ãƒŠãƒªæ›¸ãæ›ãˆãƒ„ールより確実 カーãƒãƒ«ã¸ã®å¤‰æ›´ãªã—ã€ã‹ã¤ã‚«ãƒ¼ãƒãƒ«ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’使ã‚ãªã„ プãƒã‚°ãƒ©ãƒ ã®ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã€ãƒ—ãƒã‚°ãƒ©ãƒ ã®å†ã‚³ãƒ³ãƒ‘イルä¸è¦ eBPF ã§ãƒˆãƒ¬ãƒ¼ã‚·ãƒ³ã‚°ã‚’ã—ã¦ã„ã‚‹ã‘ã‚Œã©ã€ã§ãã‚Œã°åˆ¶ç´„ãŒå°‘ãªã„ユーザー空間ã§ãƒˆãƒ¬ãƒ¼ã‚·ãƒ³ã‚°ãƒ„ールを作りãŸã„。もã—ãã¯ã€gVisor ã®ã‚ˆã†ãªã‚µãƒ³ãƒ‰ãƒœãƒƒã‚¯ã‚¹ã‚’作りãŸã„ã‘ã‚Œã©ã€ptrace ã«ã‚ˆã‚‹æ€§èƒ½åŠ£åŒ–ãŒå¤§ãã„ã®ã§ã€ä»–ã®é«˜é€Ÿãªã‚·ã‚¹ãƒ†ãƒ コールフックã®ä»•çµ„ã¿ãŒä½¿ã„ãŸã„ã€ã¨ã„ã†ã‚ˆã†
ランã‚ング
ランã‚ング
メンテナンス
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
https://hypr.land/
GitHub - microsoft/WSL: Windows Subsystem for Linux
GitHub - hrw/syscalls-table: Information about Linux system calls on different architectures
The Kernel Report - Jonathan Corbet, LWN.net
GitHub - sverrejoh/rclonefile: The macOS API for creating copy on write clones of files
O'Reilly Book: Learning eBPF | Isovalent Book
Release v1.0.0 · containerd/nerdctl
GitHub - azu/bi-epub-reader: Standalone Epub reader using Bibi.
GitHub - Narsil/rdev: Simple library to listen and send events to keyboard and mouse (MacOS, Windows, Linux)
{{#tags}}- {{label}}
{{/tags}}