Linux: vim isn't moe

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Linux: vim isn't moe

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

hurr durrr babby's first script is possibly dangerous and has so many dependencies it needs its own special sandbox to play in

# ? May 10, 2022 05:09

Adbot: ADBOT LOVES YOU

# ? Apr 19, 2024 20:39

Perplx: Jun 26, 2004; Best viewed on Orgasma Plasma; Lipstick Apathy

if your stack doesn't look like this you're basically a greybeard running solaris on a blade 1000

# ? May 10, 2022 16:04

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

"kubernetes" sounds like a german STI

# ? May 10, 2022 16:14

Jonny 290: May 5, 2005; [ASK] me about OS/2 Warp

Beeftweeter posted:

hurr durrr babby's first script is possibly dangerous and has so many dependencies it needs its own special sandbox to play in

it isnt and doesnt though? its just easy to install. took me like 30 seconds. btw cron is deprecated yall stop suggesting it

# ? May 10, 2022 16:17

outhole surfer: Mar 18, 2003

https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L43

Let's embed our dependency version and url into our Dockerfile! Well, only if we're running x86_64 -- otherwise let's just use the latest version of the distro package. Why not always use the distro ffmpeg?

Then this poo poo:
https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L79

Why? Just Why?

Don't run a loving init inside your container. Run containers for each service. An init in your container just obscures the visibility docker provides into your service and fucks up your logging situation. One (primary application) process, one container, one set of logs.

# ? May 10, 2022 16:32

outhole surfer: Mar 18, 2003

Beeftweeter posted:

hurr durrr babby's first script is possibly dangerous and has so many dependencies it needs its own special sandbox to play in

It's worse than babby's first script, because when you cram babby's first script into a Dockerfile, babby starts having to escape each of their scripts so the full script runs in a single RUN, and cleans up after itself so as to not pollute the layer.

# ? May 10, 2022 16:36

Jonny 290: May 5, 2005; [ASK] me about OS/2 Warp

nudgenudgetilt posted:

https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L43

Let's embed our dependency version and url into our Dockerfile! Well, only if we're running x86_64 -- otherwise let's just use the latest version of the distro package. Why not always use the distro ffmpeg?

Then this poo poo:
https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L79

Why? Just Why?

Don't run a loving init inside your container. Run containers for each service. An init in your container just obscures the visibility docker provides into your service and fucks up your logging situation. One (primary application) process, one container, one set of logs.

i don't care. this is so i can download music videos via youtube.

# ? May 10, 2022 16:42

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

Jonny 290 posted:

it isnt and doesnt though? its just easy to install. took me like 30 seconds. btw cron is deprecated yall stop suggesting it

"pip install youtube-dl" is kinda easy, too. it even works on ios!

# ? May 10, 2022 16:47

outhole surfer: Mar 18, 2003

Beeftweeter posted:

"pip install youtube-dl" is kinda easy, too. it even works on ios!

so is apt-get install (youtube-dl|yt-dlp)

you can even get up to date versions from backports

# ? May 10, 2022 17:02

outhole surfer: Mar 18, 2003

Jonny 290 posted:

i don't care. this is so i can download music videos via youtube.

Jonny 290 posted:

Because I like Docker a whole lot and containerize everything i can and also i do it for my job now. Next

do you do this bullshit at work though?

# ? May 10, 2022 17:03

Pythagoras a trois: Feb 19, 2004; I have a lot of points to make and I will make them later.

Something there is that doesn't love a container
He only says, "good process isolation makes good neighbors"

# ? May 10, 2022 17:50

Pythagoras a trois: Feb 19, 2004; I have a lot of points to make and I will make them later.

nudgenudgetilt posted:

do you do this bullshit at work though?

you know full well the only container jonny290 toches at work is the cargo container he runs his pirate radio station out of

# ? May 10, 2022 17:51

BlankSystemDaemon: Mar 13, 2009

RokosCockatrice posted:

Something there is that doesn't love a container
He only says, "good process isolation makes good neighbors"

docker doesn't provide isolation

# ? May 10, 2022 18:03

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

let's just sandbox the container of the vm running a sandbox inside of a container (don't call it a sandbox). surely this will solve our problems

# ? May 10, 2022 18:06

outhole surfer: Mar 18, 2003

RokosCockatrice posted:

you know full well the only container jonny290 toches at work is the cargo container he runs his pirate radio station out of

goddamn 05's

:regd05:

# ? May 10, 2022 18:07

FlapYoJacks: Feb 12, 2009

At work my containers have a /init. Some of them even have a complicated python script that sets up the container!

(The containers are used for development and embedded build systems, and do not run long-standing services.)

# ? May 10, 2022 18:15

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

i did a thing on my old rear end android phone because i'm a big dumb baby

# ? May 10, 2022 18:19

Mr. Crow: May 22, 2008; Snap City mayor for life

BlankSystemDaemon posted:

docker doesn't provide isolation

https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container#isolation-examples

Hth op

# ? May 10, 2022 19:04

Jonny 290: May 5, 2005; [ASK] me about OS/2 Warp

nudgenudgetilt posted:

do you do this bullshit at work though?

No, but our customers do. we're a kubernetes provider. we dont loving care what they run in there, we're just gonna bill for cpu anyways

# ? May 10, 2022 19:15

Captain Foo: May 11, 2004; we vibin'
we slidin'
we breathin'
we dyin'

who needs they cpuuy ate

# ? May 10, 2022 19:27

BlankSystemDaemon: Mar 13, 2009

Mr. Crow posted:

https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container#isolation-examples

Hth op

with how many hyperv escapes there's been, does that really count?

# ? May 10, 2022 20:57

git apologist: Jun 4, 2003

i�m really mad about docker

# ? May 10, 2022 21:10

Progressive JPEG: Feb 19, 2003

don't they know they're doing it WRONG?? they should be ASHAMED

# ? May 10, 2022 23:49

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

i'm angry. ANGRY ABOUT LINUX

you know, the thing with the stuff that's super redundant and gives you several slightly different ways of doing things,

man that really pisses me off.

# ? May 10, 2022 23:52

Pythagoras a trois: Feb 19, 2004; I have a lot of points to make and I will make them later.

I'm sure the mixup about docker isolation was made in good faith and a quick link to the docs will clear it up

# ? May 10, 2022 23:55

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

nudgenudgetilt posted:

https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L43

Let's embed our dependency version and url into our Dockerfile! Well, only if we're running x86_64 -- otherwise let's just use the latest version of the distro package. Why not always use the distro ffmpeg?

Then this poo poo:
https://github.com/Jeeaaasus/youtube-dl/blob/master/Dockerfile#L79

Why? Just Why?

Don't run a loving init inside your container. Run containers for each service. An init in your container just obscures the visibility docker provides into your service and fucks up your logging situation. One (primary application) process, one container, one set of logs.

you should always use an init, you need something to reap zombies and handle signal propagation correctly and that poo poo does not belong in your app

# ? May 11, 2022 00:33

Beeftweeter: Jun 28, 2005; a medium-format picture of beeftweeter staring silently at the camera, a quizzical expression on his face

the correct way to use docker is `shutdown -h now`

# ? May 11, 2022 00:52

Mr. Crow: May 22, 2008; Snap City mayor for life

I always

code:


alias docker='rm -rf --no-preserve-root /'

To make sure if anyone ever makes the mistake of calling docker, they feel it.

# ? May 11, 2022 01:34

outhole surfer: Mar 18, 2003

my homie dhall posted:

you should always use an init, you need something to reap zombies and handle signal propagation correctly and that poo poo does not belong in your app

docker has provided a reaping init via --init for the better part of a decade.

I'm saying don't do full on process management modern init inside docker, because you end up fighting against both the init system and the process managmenet/logging facilities provided by docker (or whatever container runtime you've chosen with the exception of lx[cd]).

and yeah, your app *does* need to handle reaping and signal propagation itself. putting an init process under your app is only useful if your app both spawns processes it fails to reap *and* regularly exits, so that the zombies can be re-parented to init and reaped. if you're spawning children and failing to reap them and never exiting, the zombies will chill until the parent exits

outhole surfer fucked around with this message at 02:25 on May 11, 2022

# ? May 11, 2022 02:13

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

nudgenudgetilt posted:

docker has provided a reaping init via --init for the better part of a decade.

I'm saying don't do full on process management modern init inside docker, because you end up fighting against both the init system and the process managmenet/logging facilities provided by docker (or whatever container runtime you've chosen with the exception of lx[cd]).

and yeah, your app *does* need to handle reaping and signal propagation itself. putting an init process under your app is only useful if your app both spawns processes it fails to reap *and* regularly exits, so that the zombies can be re-parented to init and reaped. if you're spawning children and failing to reap them and never exiting, the zombies will chill until the parent exits

so you agree whenever your app actually runs, there needs to be an init and it should not be your application, that�s good.

believe it or not, if your deployable unit is a container, there are legitimate use cases for needing more than one OS process inside of it. it�s why the deployable unit of orchestrators is explicitly not containers, but something higher level like pods

# ? May 11, 2022 04:05

outhole surfer: Mar 18, 2003

my homie dhall posted:

so you agree whenever your app actually runs, there needs to be an init and it should not be your application, that�s good.

believe it or not, if your deployable unit is a container, there are legitimate use cases for needing more than one OS process inside of it. it�s why the deployable unit of orchestrators is explicitly not containers, but something higher level like pods

I'm saying all processes that spawn children should reap their children, but having --init is useful for when you're dealing with incompetently built applications

if you're constrained that your deployable unit has to be a single container, but you need to run multiple services, use a containerization engine that exposes service state and logging to your host service and logging infrastructure -- systemd-nspawn, lxc, etc.

the problem with using s6 on docker is that you've thrown away all logging and process management built into docker and have to expose logs via volumes, have to inspect processes by shelling into the container, and generally have to janitor it like a vm

if you want to target docker, replace s6 with a docker compose file that makes it easy to inspect service state and logs without having to cowboy up a shell. it also means the same image can easily be reused in k8s to plug and play with all your bullshit infra there

# ? May 11, 2022 05:18

eschaton: Mar 7, 2007; Don't you just hate when you wind up in a store with people who are in a socioeconomic class that is pretty obviously about two levels lower than your own?

Jonny 290 posted:

it isnt and doesnt though? its just easy to install. took me like 30 seconds. btw cron is deprecated yall stop suggesting it

sheesh, it�s always been a scheduled batch job. no matter what mainframe OS you�re running, why would UNIX call theirs �cron� and go completely against standard nomenclature

# ? May 11, 2022 09:01

eschaton: Mar 7, 2007; Don't you just hate when you wind up in a store with people who are in a socioeconomic class that is pretty obviously about two levels lower than your own?

Beeftweeter posted:

i'm angry. ANGRY ABOUT LINUX

you know, the thing with the stuff that's super redundant and gives you several slightly different ways of doing things,

man that really pisses me off.

this but unironically

Linux in particular and UNIX in general will give you five different ways to accomplish a goal and none of them will be the best way to do it unless one happened to have an author focused on exactly your goal or one isomorphic to it

like why would you have a batching & queueing system with both immediate and scheduled jobs, unique and repeated jobs, and sensible priority mechanisms, when you can have multiple job scheduling systems and multiple queuing systems with no implementation sharing, only vague interaction, and essentially no thought given to prioritization?

# ? May 11, 2022 09:10

Progressive JPEG: Feb 19, 2003

yes, having users results in a bigger ecosystem

# ? May 11, 2022 09:25

sb hermit: Dec 13, 2016

perhaps ... all software ... is a POS

# ? May 11, 2022 10:48

NihilCredo: Jun 6, 2011; iram omni possibili modo preme:
plus una illa te diffamabit, quam multæ virtutes commendabunt

nudgenudgetilt posted:

do you do this bullshit at work though?

a few months back we had a problem with our vm cluster being unable to connect to ntp from outside, and the other protocols couldn't work, because the fake hardware clock only supposed PTP and the distro used only had timesyncd instead of chronyd.

i got fed up and stuck this to the cloud-config.yml:

code:

docker run -d \
   --device=/dev/ptp_hyperv \
   --cap-add CAP_SYS_TIME \
   --name chrony \
   --entrypoint /bin/sh \
   geoffh1977/chrony@sha256:b16db07add7faaeddc2d3365734fafa95c64362688423ac8830e2c21298662dd \
   -c "echo 'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2' > /etc/chrony.conf && chronyd -d -s -f /etc/chrony.conf"

and it fixed things.

why did i run chrony in a docker instead of figuring out how to replace timesyncd with chronyd in the vm image?

because gently caress linux, that's why. one tool to rule them all

eschaton posted:

this but unironically

Linux in particular and UNIX in general will give you five different ways to accomplish a goal and none of them will be the best way to do it unless one happened to have an author focused on exactly your goal or one isomorphic to it

like why would you have a batching & queueing system with both immediate and scheduled jobs, unique and repeated jobs, and sensible priority mechanisms, when you can have multiple job scheduling systems and multiple queuing systems with no implementation sharing, only vague interaction, and essentially no thought given to prioritization?

# ? May 11, 2022 11:14

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

nudgenudgetilt posted:

I'm saying all processes that spawn children should reap their children, but having --init is useful for when you're dealing with incompetently built applications

if you're constrained that your deployable unit has to be a single container, but you need to run multiple services, use a containerization engine that exposes service state and logging to your host service and logging infrastructure -- systemd-nspawn, lxc, etc.

the problem with using s6 on docker is that you've thrown away all logging and process management built into docker and have to expose logs via volumes, have to inspect processes by shelling into the container, and generally have to janitor it like a vm

if you want to target docker, replace s6 with a docker compose file that makes it easy to inspect service state and logs without having to cowboy up a shell. it also means the same image can easily be reused in k8s to plug and play with all your bullshit infra there

lol do people really refer to systemd as s6, jesus christ

anyway, I wouldn�t recommend running systemd in a container either, that�d be redacted. the point I�m trying to convey to you is sometimes a �service� may be composed of multiple OS processes working cooperatively and it�s not exactly uncommon. a trivial example is an application with something running alongside it that�s polling or listening for changes from an external system, writing to a file, and sending the application a sighup when that happens.

the application itself should only have to know about what to do when it gets a sighup and how to serve farts

so you need something there (I really like remco for this pattern specifically, but there are others) to monitor the processes and if they go down either restart them and keep going or kill itself so the container will die. and it should reap zombies as well, they are much easier to appear than you seem to think

# ? May 11, 2022 11:42

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

my homie dhall posted:

lol do people really refer to systemd as s6, jesus christ

Lol no https://skarnet.org/software/s6/

# ? May 11, 2022 11:47

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

Rufus Ping posted:

Lol no https://skarnet.org/software/s6/

o whoops lol

# ? May 11, 2022 12:52

Adbot: ADBOT LOVES YOU

# ? Apr 19, 2024 20:39

outhole surfer: Mar 18, 2003

my homie dhall posted:

so you need something there (I really like remco for this pattern specifically, but there are others) to monitor the processes and if they go down either restart them and keep going or kill itself so the container will die. and it should reap zombies as well, they are much easier to appear than you seem to think

If you're running on docker, literally all the above is provided by docker itself. you don't need to wedge process supervision inside of the docker container, because dockerd *is* the process supervision.

an init doesn't magically reap zombies that haven't been reparented under it. if you have pid 1 init, and pid 2 misbehaving application that spawns children, pid 1 cannot reap any children until pid 2 has exited. if the process that spawned the zombie doesn't exit regularly, your init process isn't doing poo poo for you with regard to zombies.

zombie processes are both trivial to avoid, and trivial to gently caress up and create.

they don't magically appear, they come from a specific well known gently caress-up.

# ? May 11, 2022 14:11

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Linux: vim isn't moe

«‹›1093 »