sueboy: Docker

顯示具有 Docker 標籤的文章。顯示所有文章

nftables template + docker part2


#!/usr/sbin/nft -f

# From https://wiki.gbe0.com/en/linux/firewalling-and-filtering/nftables/template-inbound-outbound

## Clear/flush all existing rules
flush ruleset

# 定義變數
define DOCKER_SUBNETS = { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16 }
define PRIVATE_SUBNETS = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }

# Main inet family filtering table
table inet filter {

  # Rules for forwarded traffic
  chain forward {
    type filter hook forward priority 0; policy drop

    # 防止 IP 欺騙攻擊
    iifname "docker0" ip saddr != $DOCKER_SUBNETS counter drop comment "防止 Docker IP 欺騙"
    iifname "br-*" ip saddr != $DOCKER_SUBNETS counter drop comment "防止 Docker 橋接網路 IP 欺騙"

    # 允許 Docker 容器網路轉發
    # 允許從 Docker 網橋到任何地方的轉發，但有來源 IP 檢查
    iifname "docker0" ip saddr $DOCKER_SUBNETS counter accept comment "允許來自 Docker 的轉發流量"
    iifname "br-*" ip saddr $DOCKER_SUBNETS counter accept comment "允許來自 Docker 網橋的轉發流量"

    # 允許已建立連接的回應流量
    oifname { "docker0", "br-*" } ct state established,related counter accept comment "允許返回 Docker 的回應流量"

    meta l4proto { tcp, udp } th dport 53 counter accept comment "允許 DNS 查詢轉發"

    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "Forward - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

  # Rules for input traffic
  chain input {
    type filter hook input priority 0; policy drop

    ## Permit inbound traffic to loopback interface
    iif lo \
      accept \
      comment "Permit all traffic in from loopback interface"

    # 允許來自 Docker 網路的連接
    iifname { "docker0", "br-*" } counter accept comment "允許來自 Docker 網路的流量"

    # 添加針對常見掃描攻擊的防禦
    tcp flags & (fin|syn|rst|ack) == 0 counter drop comment "空封包丟棄"
    
    # 防止 TCP 探測掃描
    tcp flags syn tcp option maxseg size 0 counter drop comment "丟棄異常的 MSS 值封包"
    
    # SYN flood 防護
    tcp flags syn tcp dport { 22, 80, 443 } ct state new limit rate 10/second counter accept comment "防止 SYN flood"
    tcp flags syn tcp dport { 22, 80, 443 } ct state new counter drop comment "丟棄超出速率的 SYN 封包"

    ## Permit established and related connections
    ct state established,related \
      counter \
      accept \
      comment "Permit established/related connections"

    ## Log and drop new TCP non-SYN packets
    tcp flags != syn ct state new \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - New !SYN: " \
      comment "Rate limit logging for new connections that do not have the SYN TCP flag set"
    tcp flags != syn ct state new \
      counter \
      drop \
      comment "Drop new connections that do not have the SYN TCP flag set"

    ## Log and drop TCP packets with invalid fin/syn flag set
    tcp flags & (fin|syn) == (fin|syn) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - TCP FIN|SIN: " \
      comment "Rate limit logging for TCP packets with invalid fin/syn flag set"
    tcp flags & (fin|syn) == (fin|syn) \
      counter \
      drop \
      comment "Drop TCP packets with invalid fin/syn flag set"

    ## Log and drop TCP packets with invalid syn/rst flag set
    tcp flags & (syn|rst) == (syn|rst) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - TCP SYN|RST: " \
      comment "Rate limit logging for TCP packets with invalid syn/rst flag set"
    tcp flags & (syn|rst) == (syn|rst) \
      counter \
      drop \
      comment "Drop TCP packets with invalid syn/rst flag set"

    ## Log and drop invalid TCP flags
    tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - FIN:" \
      comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)"
    tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
      counter \
      drop \
      comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)"

    ## Log and drop invalid TCP flags
    tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - FIN|PSH|URG:" \
      comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"
    tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
      counter \
      drop \
      comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"

    ## Drop traffic with invalid connection state
    ct state invalid \
      limit rate 100/minute burst 150 packets \
      log flags all prefix "IN - Invalid: " \
      comment "Rate limit logging for traffic with invalid connection state"
    ct state invalid \
      counter \
      drop \
      comment "Drop traffic with invalid connection state"

    ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS
    ip protocol icmp icmp type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS"

    ## Permit all other inbound IPv4 ICMP
    ip protocol icmp \
      counter \
      accept \
      comment "Permit all other IPv4 ICMP"

    ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS
    icmpv6 type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS"

    ## Permit all other inbound IPv6 ICMP
    meta l4proto { icmpv6 } \
      counter \
      accept \
      comment "Permit all other IPv6 ICMP"

    ## Permit inbound traceroute UDP ports but limit to 500 PPS
    udp dport 33434-33524 \
      limit rate 500/second \
      counter \
      accept \
      comment "Permit inbound UDP traceroute limited to 500 PPS"

    ## Permit inbound SSH
    tcp dport ssh ct state new \
      counter \
      accept \
      comment "Permit inbound SSH connections"

    ## Permit inbound HTTP and HTTPS
    tcp dport { http, https } ct state new \
      counter \
      accept \
      comment "Permit inbound HTTP and HTTPS connections"


    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "IN - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

  # Rules for output traffic
  chain output {
    type filter hook output priority 0; policy drop

    ## Permit outbound traffic to loopback interface
    oif lo \
      accept \
      comment "Permit all traffic out to loopback interface"

    # 允許 Docker 相關的輸出流量
    oifname { "docker0", "br-*" } counter accept comment "允許 Docker 網路輸出"

    ## Permit established and related connections
    ct state established,related \
      counter \
      accept \
      comment "Permit established/related connections"

    ## Drop traffic with invalid connection state
    ct state invalid \
      limit rate 100/minute burst 150 packets \
      log flags all prefix "OUT - Invalid: " \
      comment "Rate limit logging for traffic with invalid connection state"
    ct state invalid \
      counter \
      drop \
      comment "Drop traffic with invalid connection state"

    ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS
    ip protocol icmp icmp type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit outbound IPv4 echo (ping) limited to 2000 PPS"

    ## Permit all other outbound IPv4 ICMP
    ip protocol icmp \
      counter \
      accept \
      comment "Permit all other IPv4 ICMP"

    ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS
    icmpv6 type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit outbound IPv6 echo (ping) limited to 2000 PPS"

    ## Permit all other outbound IPv6 ICMP
    meta l4proto { icmpv6 } \
      counter \
      accept \
      comment "Permit all other IPv6 ICMP"

    ## Permit outbound traceroute UDP ports but limit to 500 PPS
    udp dport 33434-33524 \
      limit rate 500/second \
      counter \
      accept \
      comment "Permit outbound UDP traceroute limited to 500 PPS"

    ## Allow outbound HTTP and HTTPS connections
    tcp dport { http, https } ct state new \
      counter \
      accept \
      comment "Permit outbound HTTP and HTTPS connections"

    ## Permit outbound DNS requests
    meta l4proto { tcp, udp } th dport 53 \
      counter \
      accept \
      comment "Permit outbound TCP and UDP DNS requests"

    ## Allow outbound NTP requests
    udp dport 123 \
      counter \
      accept \
      comment "Permit outbound NTP requests"

    # 在日誌記錄前添加額外的計數器以便監控
    counter comment "計數即將丟棄的流量"
        
    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "OUT - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

}

# 在主要表格後添加
table inet nat {
    chain prerouting {
        type nat hook prerouting priority -100; policy accept;
    }
    
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        # 正確處理 Docker 網路 NAT
        ip saddr $DOCKER_SUBNETS oifname != { "docker0", "br-*" } masquerade comment "Docker 容器 NAT"
    }
}

nftables template + docker


#!/usr/sbin/nft -f

# From https://wiki.gbe0.com/en/linux/firewalling-and-filtering/nftables/template-inbound-outbound

## Clear/flush all existing rules
flush ruleset

# Main inet family filtering table
table inet filter {

  # Rules for forwarded traffic
  chain forward {
    type filter hook forward priority 0; policy drop

    # 允許 Docker 容器網路轉發
    # 允許從 Docker 網橋到任何地方的轉發
    iifname "docker0" counter accept comment "允許來自 Docker 的轉發流量"
    iifname "br-*" counter accept comment "允許來自 Docker 網橋的轉發流量"

    # 允許已建立連接的回應流量
    oifname { "docker0", "br-*" } ct state established,related counter accept comment "允許返回 Docker 的回應流量"

    meta l4proto { tcp, udp } th dport 53 counter accept comment "允許 DNS 查詢轉發"

    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "Forward - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

  # Rules for input traffic
  chain input {
    type filter hook input priority 0; policy drop

    ## Permit inbound traffic to loopback interface
    iif lo \
      accept \
      comment "Permit all traffic in from loopback interface"

    # 允許來自 Docker 網路的連接
    iifname { "docker0", "br-*" } counter accept comment "允許來自 Docker 網路的流量"

    # 添加針對常見掃描攻擊的防禦
    tcp flags & (fin|syn|rst|ack) == 0 counter drop comment "空封包丟棄"
    
    # 防止 TCP 探測掃描
    tcp flags syn tcp option maxseg size 0 counter drop comment "丟棄異常的 MSS 值封包"
    
    ## Permit established and related connections
    ct state established,related \
      counter \
      accept \
      comment "Permit established/related connections"

    ## Log and drop new TCP non-SYN packets
    tcp flags != syn ct state new \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - New !SYN: " \
      comment "Rate limit logging for new connections that do not have the SYN TCP flag set"
    tcp flags != syn ct state new \
      counter \
      drop \
      comment "Drop new connections that do not have the SYN TCP flag set"

    ## Log and drop TCP packets with invalid fin/syn flag set
    tcp flags & (fin|syn) == (fin|syn) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - TCP FIN|SIN: " \
      comment "Rate limit logging for TCP packets with invalid fin/syn flag set"
    tcp flags & (fin|syn) == (fin|syn) \
      counter \
      drop \
      comment "Drop TCP packets with invalid fin/syn flag set"

    ## Log and drop TCP packets with invalid syn/rst flag set
    tcp flags & (syn|rst) == (syn|rst) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - TCP SYN|RST: " \
      comment "Rate limit logging for TCP packets with invalid syn/rst flag set"
    tcp flags & (syn|rst) == (syn|rst) \
      counter \
      drop \
      comment "Drop TCP packets with invalid syn/rst flag set"

    ## Log and drop invalid TCP flags
    tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - FIN:" \
      comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)"
    tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
      counter \
      drop \
      comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)"

    ## Log and drop invalid TCP flags
    tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
      limit rate 100/minute burst 150 packets \
      log prefix "IN - FIN|PSH|URG:" \
      comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"
    tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
      counter \
      drop \
      comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"

    ## Drop traffic with invalid connection state
    ct state invalid \
      limit rate 100/minute burst 150 packets \
      log flags all prefix "IN - Invalid: " \
      comment "Rate limit logging for traffic with invalid connection state"
    ct state invalid \
      counter \
      drop \
      comment "Drop traffic with invalid connection state"

    ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS
    ip protocol icmp icmp type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS"

    ## Permit all other inbound IPv4 ICMP
    ip protocol icmp \
      counter \
      accept \
      comment "Permit all other IPv4 ICMP"

    ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS
    icmpv6 type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS"

    ## Permit all other inbound IPv6 ICMP
    meta l4proto { icmpv6 } \
      counter \
      accept \
      comment "Permit all other IPv6 ICMP"

    ## Permit inbound traceroute UDP ports but limit to 500 PPS
    udp dport 33434-33524 \
      limit rate 500/second \
      counter \
      accept \
      comment "Permit inbound UDP traceroute limited to 500 PPS"

    ## Permit inbound SSH
    tcp dport ssh ct state new \
      counter \
      accept \
      comment "Permit inbound SSH connections"

    ## Permit inbound HTTP and HTTPS
    tcp dport { http, https } ct state new \
      counter \
      accept \
      comment "Permit inbound HTTP and HTTPS connections"


    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "IN - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

  # Rules for output traffic
  chain output {
    type filter hook output priority 0; policy drop

    ## Permit outbound traffic to loopback interface
    oif lo \
      accept \
      comment "Permit all traffic out to loopback interface"

    # 允許 Docker 相關的輸出流量
    oifname { "docker0", "br-*" } counter accept comment "允許 Docker 網路輸出"

    ## Permit established and related connections
    ct state established,related \
      counter \
      accept \
      comment "Permit established/related connections"

    ## Drop traffic with invalid connection state
    ct state invalid \
      limit rate 100/minute burst 150 packets \
      log flags all prefix "OUT - Invalid: " \
      comment "Rate limit logging for traffic with invalid connection state"
    ct state invalid \
      counter \
      drop \
      comment "Drop traffic with invalid connection state"

    ## Permit IPv4 ping/ping responses but rate limit to 2000 PPS
    ip protocol icmp icmp type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit outbound IPv4 echo (ping) limited to 2000 PPS"

    ## Permit all other outbound IPv4 ICMP
    ip protocol icmp \
      counter \
      accept \
      comment "Permit all other IPv4 ICMP"

    ## Permit IPv6 ping/ping responses but rate limit to 2000 PPS
    icmpv6 type { echo-reply, echo-request } \
      limit rate 2000/second \
      counter \
      accept \
      comment "Permit outbound IPv6 echo (ping) limited to 2000 PPS"

    ## Permit all other outbound IPv6 ICMP
    meta l4proto { icmpv6 } \
      counter \
      accept \
      comment "Permit all other IPv6 ICMP"

    ## Permit outbound traceroute UDP ports but limit to 500 PPS
    udp dport 33434-33524 \
      limit rate 500/second \
      counter \
      accept \
      comment "Permit outbound UDP traceroute limited to 500 PPS"

    ## Allow outbound HTTP and HTTPS connections
    tcp dport { http, https } ct state new \
      counter \
      accept \
      comment "Permit outbound HTTP and HTTPS connections"

    ## Permit outbound DNS requests
    meta l4proto { tcp, udp } th dport 53 \
      counter \
      accept \
      comment "Permit outbound TCP and UDP DNS requests"

    ## Allow outbound NTP requests
    udp dport 123 \
      counter \
      accept \
      comment "Permit outbound NTP requests"

    # 在日誌記錄前添加額外的計數器以便監控
    counter comment "計數即將丟棄的流量"
        
    ## Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
    ## The default policy will be applied to unmatched traffic
    limit rate 60/minute burst 100 packets \
      log prefix "OUT - Drop: " \
      comment "Log any unmatched traffic"

    ## Count the unmatched traffic
    counter \
      comment "Count any unmatched traffic"
  }

}

laravel schedule cron docker dockerfile docker-compose

cron

php laravel UI Boostrap jetstream docker-compose

laravel_docker

dokcer-compose.yml


  cron:
    build: ./infra/docker/cron
    env_file: ./env.mariadb.local.env
    stop_signal: SIGTERM
    depends_on:
      - app
    volumes:
      - ./backend:/work/backend

Dockerfile


FROM php:8.0.11-fpm-buster
LABEL maintainer="ucan-lab "
#SHELL ["/bin/bash", "-oeux", "pipefail", "-c"]

# timezone environment
ENV TZ=Asia/Taipei \
  # locale
  LANG=en_US.UTF-8 \
  LANGUAGE=en_US:UTF-8 \
  LC_ALL=en_US.UTF-8 \
  # Laravel environment
  APP_SERVICES_CACHE=/tmp/cache/services.php \
  APP_PACKAGES_CACHE=/tmp/cache/packages.php \
  APP_CONFIG_CACHE=/tmp/cache/config.php \
  APP_ROUTES_CACHE=/tmp/cache/routes.php \
  APP_EVENTS_CACHE=/tmp/cache/events.php \
  VIEW_COMPILED_PATH=/tmp/cache/views \
  # SESSION_DRIVER=cookie \
  LOG_CHANNEL=stderr \
  DB_CONNECTION=mysql \
  DB_PORT=3306 

RUN apt-get update
RUN apt-get -y install locales libicu-dev libzip-dev htop cron nano
RUN apt-get -y install default-mysql-client

RUN locale-gen en_US.UTF-8 && localedef -f UTF-8 -i en_US en_US.UTF-8
RUN docker-php-ext-install intl pdo_mysql zip bcmath exif

RUN apt-get clean && rm -rf /var/lib/apt/lists/* 

# 自訂
RUN mkdir -p /tmp/cache
WORKDIR /work/backend


# 這行超級重要 把初始環境的變數寫死
RUN printenv > /etc/environment

# 把log 輸出到 docker 上
RUN ln -sf /proc/1/fd/1 /var/log/laravel-scheduler.log


#ADD crontab /var/spool/cron/crontabs/root
#RUN chown root:crontab /var/spool/cron/crontabs/root
#RUN chmod 0600 /var/spool/cron/crontabs/root

#RUN crontab -l | { cat; echo "* * * * * . /usr/local/bin/php /work/backend/artisan config:cache && php artisan schedule:run >> /var/log/cron.log 2>&1"; } | crontab -
#RUN crontab -l | { cat; echo "* * * * * date >> /var/log/cron.log"; } | crontab -
#RUN crontab -l | { cat; echo "* * * * * echo hello > /proc/1/fd/1 2>/proc/1/fd/2"; } | crontab -


COPY crontab /etc/cron.d/crontab
RUN chmod 0644 /etc/cron.d/crontab
RUN crontab /etc/cron.d/crontab

CMD bash -c "/usr/local/bin/php /work/backend/artisan config:cache && cron -f"

cron


# 這行可有可無 主要是 dockerfile printenv 那行最重要 #!/usr/bin/env bash
# 這行可有可無 SHELL=/bin/bash
PATH=/usr/bin:/usr/local/bin:$PATH
* * * * * cd /work/backend && php artisan schedule:run >> /var/log/cron.log 2>&1
#* * * * * cd /work/backend && php artisan schedule:run >> /var/log/cron.log 2>&1 && echo schedule > /proc/1/fd/1 2>/proc/1/fd/2
#* * * * * date >> /var/log/cron.log
#* * * * * echo hello > /proc/1/fd/1 2>/proc/1/fd/2
#要多一行

app/Console/Kernel.php


protected function schedule(Schedule $schedule)
    {
        // $schedule->command('inspire')->hourly();

        $fileCronLog = '/var/log/laravel-scheduler.log';  // dockerfile RUN ln -sf /proc/1/fd/1 /var/log/laravel-scheduler.log

        // cron('* * 26 * *')
        $schedule->command('your command')->timezone(config('app.timezone'))->everyMinute()->onOneServer()  
            ->before(function () {
                Log::info("Schedule your command before!");
            })
            ->after(function () {
                Log::info("Schedule your command after!");
            })
            ->onSuccess(function (Stringable $output) {
                Log::info("Schedule your command onSuccess!");
            })
            ->onFailure(function (Stringable $output) {
                Log::error("Schedule your command onFailure!");
            })
            ->appendOutputTo($fileCronLog);

aws ecr new account docker push policy

1. IAM User -> New User -> Demo_ECR

Add Permissions policies 新增許可

a. 直接連接現有政策 AmazonEC2ContainerRegistryPowerUser

b. 建立policies -> Demo_ECR https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.html

2. install aws cli tools windows

https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-windows.html

3. aws ecr repositories -> private -> create repository

input demo

Keep ooxxooxxooxxooxx.dkr.ecr.ap-northeast-1.amazonaws.com/demo

save

4. aws cli login powershell windows

aws configure

go back IAM, show Demo_ECR -> 安全登入資料 security login

run 建立存取金鑰 create Access Key

copy new Access Key ID and AWS Secret Access Key

back aws configure. Input Access Key ID, Secret Access Key, ap-northeast-1 and Enter

5. docker login

aws ecr get-login-password --region ap-northeast-1

copy return Text like: eyJwYXlsb2FkIjoieE9hcWgzYmdPOXpN...............

6. docker image craete

First check your docker image： docker image ls

REPOSITORY = Image Name.

Tag is import.

Example "demo" is my image that want to send to aws repository.

docker tag "your image name":"your image" tag "aws repository URI"

docker tag demo:latest ooxxooxxooxxooxx.dkr.ecr.ap-northeast-1.amazonaws.com/demo

check "docker image ls" again

Now you can see new repository: ooxxooxxooxxooxx.dkr.ecr.ap-northeast-1.amazonaws.com/demo

7. docker image push

docker push ooxxooxxooxxooxx.dkr.ecr.ap-northeast-1.amazonaws.com/demo

Finish.

ERROR

Q: error parsing HTTP 403 response body: unexpected end of JSON input: ""

A: When you step 3. Image scan settings：get error If you check true. You can change false then push success.

A. other way.

https://github.com/aws/aws-toolkit-azure-devops/issues/311

https://stackoverflow.com/questions/34423873/docker-push-to-aws-ecr-private-repo-failing-with-malformed-json

go back step 1. change policy.

firebase deploy use rastasheep/ubuntu-sshd


docker run -d -P -p 9005:9005 -p 2222:22 -v C:\Users\user\Downloads\ooxxooxx\public_html:/project --name test_sshd rastasheep/ubuntu-sshd:18.04 

> apt update
> apt install curl
> curl -sL https://deb.nodesource.com/setup_16.x | bash -
> apt-get install -y nodejs

> npm install -g firebase-tools
> cd /project
> firebase login
> firebase deploy

docker-compose build error apt install update problem archive.ubuntu.com 404

https://ubuntuqa.com/zh-tw/article/6721.html


docker-compose build --no-cache  ooxxooxx

docker-compose env_file

ERROR: Couldn't find env file:

Try to use one line.


env_file:
  - ./env.mariadb.local.env


env_file: ./env.mariadb.local.env

php laravel UI Boostrap jetstream docker-compose

目錄裡面對應的檔案要先修改

=== 設定修改

[docker-compose]

docker-compose.yml ./backend 在執行docker-compose目錄下建立backend目錄，或者是移動位置

db-store 使用的是 volumes

[mysql]

infra/docker/mysql/Dockerfile

mysql user password root 等等自行變更，變更後要記得修改 infra/docker/php/Dockerfile

infra/docker/mysql/my.cnf

collation_server = utf8mb4_unicode_ci

[php]

infra/docker/php/Dockerfile 如果上面mysql設定有變更，記得這裡也要跟著變更

ENV TZ=Asia/Taipei

LANGUAGE=en_US:UTF-8

infra/docker/php/php.ini

mbstring.language = zh-tw

[nginx]

infra/docker/nginx/Dockerfile

ENV TZ=UTC+8

=== 指令開始執行


docker-compose up -d
  
docker-compose exec app composer create-project --prefer-dist laravel/laravel .

== jetstream Livewire !Now No Use


docker-compose exec app composer require laravel/jetstream
docker-compose exec app php artisan jetstream:install livewire  --teams
docker-compose exec app php artisan migrate

docker-compose exec web yarn install
docker-compose exec web yarn dev

== jetstream end

== Laravel UI Bootstrap Auth *more easy


docker-compose exec app composer require laravel/ui
docker-compose exec app php artisan ui bootstrap --auth
[ docker-compose exec app php artisan migrate ]

docker-compose exec web yarn install
docker-compose exec web yarn run dev

[ docker-compose exec web yarn add vue-template-compiler --dev --production=false ]

== Laravel UI Bootstrap end


docker-compose exec app composer require doctrine/dbal
docker-compose exec app composer require --dev barryvdh/laravel-ide-helper
docker-compose exec app composer require --dev beyondcode/laravel-dump-server
docker-compose exec app composer require --dev barryvdh/laravel-debugbar
docker-compose exec app composer require --dev roave/security-advisories:dev-master
docker-compose exec app php artisan vendor:publish --provider="BeyondCode\DumpServer\DumpServerServiceProvider"
docker-compose exec app php artisan vendor:publish --provider="Barryvdh\Debugbar\ServiceProvider"

=== remove all


docker-compose down --rmi all --volumes
docker-compose down --volumes

．參考：

https://github.com/ucan-lab/docker-laravel

https://github.com/ucan-lab/docker-laravel/blob/master/Makefile

https://qiita.com/ucan-lab/items/7824d1293fef4698c212

gcloud tools docker

Create directory "gcloud" at `pwd` first.

1. normal cli command


docker run -it -e CLOUDSDK_CONFIG=/config/mygcloud -v `pwd`/gcloud:/config/mygcloud -v `pwd`/gcloud/certs:/certs gcr.io/google.com/cloudsdktool/cloud-sdk

2. Put Projects


docker run -it -e CLOUDSDK_CONFIG=/config/mygcloud \
-v `pwd`/gcloud:/config/mygcloud \
-v `pwd`/gcloud/certs:/certs \
-v `pwd`/Documents/Projects:/home \
gcr.io/google.com/cloudsdktool/cloud-sdk

ethereum docker geth shell for geth attach and tail log

Help use docker geth for geth attach and watch log. Geth Command line path need to change for yourself env.


#!/bin/sh
IFS=$'\n'
echo $1
echo $2

case $2 in
    attach) docker exec -it $(docker ps -a --no-trunc  | grep $1 | awk '{print $1}') geth attach --datadir=/root/.ethereum/devchain
        ;;
    log) docker exec -it $(docker ps -a --no-trunc  | grep $1 | awk '{print $1}') tail -n 30 -f /root/geth.log
        ;;
    sh) docker exec -it $(docker ps -a --no-trunc  | grep $1 | awk '{print $1}') sh
        ;;
    bash) docker exec -it $(docker ps -a --no-trunc  | grep $1 | awk '{print $1}') bash
        ;;
    *)  echo "command parms1: docker container name"
        echo "command parms2: attach (geth attach) or log (tail -n 30 -f) or sh or bash"
esac

[轉]如何為LINUX, WINDOWS容器加入憑證?

https://blog.kkbruce.net/2020/01/linux-windows-container-add-cert.html?fbclid=IwAR0d_LhzAYwatOZ-Ibl4mK7Ne-iAViwKT_UWcj0Wg52YlHTKzSFNDWcp-Hk#more

ubuntu


/usr/local/share/ca-certificates
update-ca-certificates

windows


Import-Certificate -FilePath ooxx   -CertStoreLocation ooxx

[轉]Kubernetes 调整 nodePort 端口范围

https://qhh.me/2019/08/pod 文件定义在 /etc/kubernetes/manifests/kube-apiserver.yaml15/Kubernetes-%E8%B0%83%E6%95%B4-nodePort-%E7%AB%AF%E5%8F%A3%E8%8C%83%E5%9B%B4/

在 command 下添加 --service-node-port-range=1-65535 参数，修改后会自动生效，无需其他操作:


apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --service-node-port-range=1-65535
    - --advertise-address=192.168.26.10
    - --allow-privileged=true
    - --authorization-mode=Node,RBAC
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --enable-admission-plugins=NodeRestriction
    - --enable-bootstrap-token-auth=true
    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
    - --etcd-servers=https://127.0.0.1:2379
    - --insecure-port=0
    - --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
    - --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
    - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
    - --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
    - --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
    - --requestheader-allowed-names=front-proxy-client
    - --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
    - --requestheader-extra-headers-prefix=X-Remote-Extra-
    - --requestheader-group-headers=X-Remote-Group
    - --requestheader-username-headers=X-Remote-User
    - --secure-port=6443
    - --service-account-key-file=/etc/kubernetes/pki/sa.pub
    - --service-cluster-ip-range=10.96.0.0/12
    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
    image: registry.aliyuncs.com/google_containers/kube-apiserver:v1.15.2
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 8
      httpGet:
        host: 192.168.26.10
        path: /healthz
        port: 6443
        scheme: HTTPS
      initialDelaySeconds: 15
      timeoutSeconds: 15
    name: kube-apiserver
    resources:
      requests:
        cpu: 250m
    volumeMounts:
    - mountPath: /etc/ssl/certs
      name: ca-certs
      readOnly: true
    - mountPath: /etc/pki
      name: etc-pki
      readOnly: true
    - mountPath: /etc/kubernetes/pki
      name: k8s-certs
      readOnly: true
  hostNetwork: true
  priorityClassName: system-cluster-critical
  volumes:
  - hostPath:
      path: /etc/ssl/certs
      type: DirectoryOrCreate
    name: ca-certs
  - hostPath:
      path: /etc/pki
      type: DirectoryOrCreate
    name: etc-pki
  - hostPath:
      path: /etc/kubernetes/pki
      type: DirectoryOrCreate
    name: k8s-certs
status: {}

k8s kubernetes Lesson 8 Error

Error： User "system:serviceaccount:kube-system:default" cannot get resource "namespaces"

https://github.com/fnproject/fn-helm/issues/21#issuecomment-545317241


kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
helm init --upgrade --service-account tiller

docker registry Other Way


On root home

openssl req -nodes -newkey rsa:4096 -keyout certs/docker-registry.key -out certs/docker-registry.csr -subj "/C=/ST=/L=/O=/OU=/CN=docker-registry"
openssl x509 -req -sha256 -days 365 -in certs/docker-registry.csr -signkey certs/docker-registry.key -out certs/docker-registry.crt


docker run -dp 5000:5000 --name registry -v "$(pwd)"/certs:/certs \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/docker-registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/docker-registry.key \
registry


nano /etc/hosts 
> 192.168.99.118 docker-registry

cd /etc/docker
mkdir certs.d
cd certs.d
mkdir docker-registry:5000
cd docker-registry:5000
cp ~/certs/docker-registry.crt ca.crt

===== check registry is working
docker image pull busybox
docker image tag busybox docker-registry:5000/mybusybox
docker image push docker-registry:5000/mybusybox
docker run --rm docker-registry:5000/mybusybox echo "Hello from busybox"

//
docker rmi busybox docker-registry:5000/mybusybox
docker run --rm docker-registry:5000/mybusybox echo "Hello from busybox"

===== remove registry
docker container stop registry && docker container rm -v registry

https://jkzhao.github.io/2017/09/01/Registry%E7%A7%81%E6%9C%89%E4%BB%93%E5%BA%93%E6%90%AD%E5%BB%BA%E5%8F%8A%E8%AE%A4%E8%AF%81/

列出私有仓库中的所有镜像


curl -k -X GET https://docker-registry:5000/v2/_catalog  >> {"repositories":["mybusybox"]}

curl --cacert certs/docker-registry.crt https://docker-registry:5000/v2/_catalog

curl -k https://docker-registry:5000/v2/_catalog

Docker 本身DNS是不穩定的

再分享早上碰到docker穩定度問題，docker內到外網是靠本機的iptables做Nat出去，早上就發現運行很久的docker container，突然不送資料到ELK，一查發現DNS掛了，這之前也碰到幾次了，基本上不是中心DNS掛了，而且Docker本身架構的DNS掛了，基本上只要重啟docker service後就正常，無需對主機重啟，而重啟docker service是一件很嚴重的事情，因為上面所有的服務都會一併被下線，之後還要在把運行的服務全部重新上線…

也許我的理解是錯誤，但只能以目前的情況來判斷，也許是iptables nat轉換的問題，但本機沒有重開機，理論上就沒有這個問題才是。

Error: listen EADDRNOTAVAIL: address not available

So some page modify vue.config.js

Use public is Failed!!


    devServer: {
        public: '0.0.0.0:80', 
        disableHostCheck: true,
    }

Use host port is Correct!!


module.exports = {
    chainWebpack: config => {
        config.module.rules.delete('eslint');
    },
    devServer: {
        host: '0.0.0.0',
        port: '80',
        //public: '0.0.0.0:80',  //無效
        disableHostCheck: true,
    }
}

PS：
．Put eslint is maybe get some eslint error, not about host ip port.
．disableHostCheck can remove for try by yourself env.

How to use Makefile in docker-machine

https://stackoverflow.com/questions/34624510/how-to-use-makefile-in-docker-machine


tce-load -wi make

訂閱：文章 (Atom)

sueboy

EExcel 丞燕快速查詢2

雷池 SafeLine

nftables template + docker part2

nftables template + docker

laravel schedule cron docker dockerfile docker-compose

aws ecr new account docker push policy

1. IAM User -> New User -> Demo_ECR

2. install aws cli tools windows

3. aws ecr repositories -> private -> create repository

4. aws cli login powershell windows

5. docker login

6. docker image craete

7. docker image push

ERROR

firebase deploy use rastasheep/ubuntu-sshd

docker-compose build error apt install update problem archive.ubuntu.com 404

docker-compose env_file

php laravel UI Boostrap jetstream docker-compose

gcloud tools docker

ethereum docker geth shell for geth attach and tail log

[轉]如何為LINUX, WINDOWS容器加入憑證?

[轉]Kubernetes 调整 nodePort 端口范围

k8s kubernetes Lesson 8 Error

Error： User "system:serviceaccount:kube-system:default" cannot get resource "namespaces"

docker registry Other Way

Docker 本身DNS是不穩定的

pve lxc docker

Run ubuntu docker like VM

vue 3 vue-cli-service serve vue.config.js package.json docker

Error: listen EADDRNOTAVAIL: address not available

How to use Makefile in docker-machine