Tobia's questions

I enabled Docker's ZFS Storage Driver, but apparently it only deals with Docker internals, using ZFS snapshots and clones for its own overlays.

But what I want is for Docker to create every volume, especially persistent ones, as their own ZFS filesystems, so that I can independently snapshot them for backup purposes.

Is there a Docker option to enable this feature? I would like to avoid having to manually create every volume of every application and bind mount them.

I found this plugin but it seems very little used.

With all ZFS-on-Linux versions I've ever tried, using zfs list to list all snapshots of a filesystem or volum (zfs list -r -t snapshot -H -o name pool/filesystem) always takes many orders of magnitude more time to run than ls .zfs/snapshot, which is immediate:

$ time ls -1 /srv/vz/subvol-300-disk-1/.zfs/snapshot
[list of 1797 snapshots here]
real    0m0.023s
user    0m0.008s
sys     0m0.014s

# time zfs list -r -t snapshot -H -o name vz/subvol-300-disk-1
[same list of 1797 snapshots]
real    1m23.092s
user    0m0.110s
sys     0m0.758s

Is this bug specific to ZFS-on-Linux?

Can anybody with a Solaris or FreeBSD ZFS box perform a similar test (on a filesystem with hundreds of snapshots on spinning hard disks)?

Is there a workaround to get a quick list of snapshots for a volume, which by its nature does not have a .zfs directory?

I've run the above test with ZFS-on-Linux 0.6.5.2-2-wheezy on kernel 2.6.32-43-pve x86_64 (Proxmox) but I've always seen this issue, both on older and newer ZFS and kernel versions.

Here are the pool stats:

# zpool list
NAME   SIZE  ALLOC   FREE  EXPANDSZ   FRAG    CAP  DEDUP  HEALTH  ALTROOT
vz    25.2T  9.42T  15.8T         -     5%    37%  1.00x  ONLINE  -

It contains 114 filesystems and 1 volume, each with hundreds of snapshots, as this is a zfs send / zfs recv backup server.

Solution: zfs list is slow because it fetches additional information, even if it's not displayed. The solution is adding both -o name -s name, that is, using zfs list -t snapshot -o name -s name

I'm using ZFS to take snapshots of running OpenVZ containers.

For MySQL databases I can use flush tables with read lock to put them in a flushed & locked state. This will put the underlying files in a consistent state and hold any incoming queries until I complete the snapshots, which take at most a couple seconds.

Here is a sample script, without error checking and other housekeeping code:

vz_root=/var/lib/vz/root/$veid
mysql_locked=/var/run/mysql_locked

# flush & lock MySQL, touch mysql_locked, and wait until it is removed
vzctl exec $veid mysql -NB <<-EOF &
    flush tables with read lock;
    delimiter ;;
    system touch $mysql_locked
    system while test -e $mysql_locked; do sleep 1; done
    exit
EOF

# wait for the preceding command to touch mysql_locked
while ! test -e $vz_root$mysql_locked; do sleep 1; done

# take a snapshot of the VZ filesystem, while MySQL is being held locked
zfs snapshot zpool/private/$veid@$(date +"%Y-%m-%d_%H:%M")

# unlock MySQL
rm -f $vz_root$mysql_locked

Can I do the same thing for an Oracle database?

Is there a command that will flush its tablespaces, put them in a consistent state, suitable for backup, and hold any activity until I unlock it?

I'd rather avoid having to reconfigure Oracle to use ZFS directly as a storage backend, because simple OpenVZ containers suit me very well. In fact I'd rather have some low-maintenance technique, without any complex Oracle setup, if any exists.

Is there an Nginx variable for the subpath inside the current location, or inside the current alias?

For example, given location /static {...} and GET /static/booze.png, is there a variable containing /booze.png, which would be the subpath inside the current location?

Or otherwise, given location /static { alias /srv/static-files; ...} and the same GET, is there a variable containing /booze.png, the subpath inside the current alias?

I know I can use regex locations to capture it, but I'd like to avoid it if I can use a builtin variable.

OS X resource forks are alternate streams of data attached to regular files. They may contain the file's custom icon, colored label, keywords, or any other metadata set by the user or by applications.

They are natively supported by OS X's HFS+ filesystem, but whenever OS X mounts another filesystem, whether local (FAT32) or remote (NFS, SMB) they are stored in so-called "dotbar" files: the resource fork for the regular file name.ext is stored in another regular but hidden file ._name.ext. (They are not to be confused with .DS_Store files, which store a directory's view settings, such as icon vs. column view, or the position of its window.)

The problem with dotbar ._ files is that they are actual regular files, in the target filesystem, with the same extension as the original file, therefore wreaking havoc in a number of ways. For example, Ant and Maven will see ._MyClass.java as yet another Java file to compile.

I see that OS X can be configured to store resource forks in SMB named streams and that Samba can be configured to store named streams in POSIX extended attributes or, alternatively, in a depot directory somewhere else.

Both solutions would solve the problem of dotbar files polluting the target filesystem, but I cannot get either to work.

 
Xattr

First I tried with xattr:

vfs objects = streams_xattr
kernel oplocks = no

The latter option is due to this bug. I told OS X to use it, by doing this in the root of the share, before mounting it:

touch .com.apple.smb.streams.on

But when I tried to copy a file over with Finder, I got this error:

The Finder can’t complete the operation because some data in “hello.java” can’t be read or written.
(Error code -36)

 
Depot

Then I tried with depot:

vfs objects = streams_depot

leaving .com.apple.smb.streams.on in the root of the share. Trying to copy the same file with Finder, I got another error:

The operation can’t be completed because an unexpected error occurred
(error code -50)

 
How can I make OS X work with either of these two options? My purpose is to get those nasty ._ out of the shared directories.

I tried simply veto'ing dotbar files:

veto files = /._*/
delete veto files = yes

But that causes some applications to fail, for example Mercurial when run from OS X over a mounted SMB share.

I'm using OS X 10.9.5 as the client; Samba 3.6.6 from Debian Wheezy as the server.

Edit: here's my configuration as requested:

[global]
    security = user
    invalid users = root
    workgroup = COMPANY_NAME
    encrypt passwords = true
    panic action = /usr/share/samba/panic-action %d
    syslog = yes
    syslog only = yes

    # PERFORMANCE TUNING
    socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072 SO_KEEPALIVE
    read raw = true
    write raw = true
    use sendfile = true
    min receivefile size = 16384
    aio read size = 16384
    aio write size = 16384
    max xmit = 131072
    getwd cache = true

    # DEFAULT OPTIONS FOR ALL SHARES
    writeable = true
    force group = company_group

    create mask = 664
    security mask = 664
    force create mode = 664
    force security mode = 664

    directory mask = 2775
    directory security mask = 2775
    force directory mode = 2775
    force directory security mode = 2775

    # solve problem where OS X clients remove mode 0100
    map archive = no

[homes]
    browseable = no

I have a few users using Mercurial over Linux Samba shares, mounted on their Macs.

The Samba server has the following veto rules (well discussed both here on this site and elsewhere) to prevent Macs from creating resource forks, which wreak havoc with all sorts of things, especially on developers' directories:

veto files = /._*/.DS_Store/
delete veto files = yes

The problem is that sometimes, randomly, Mercurial will choke with this error:

$ hg ci
trouble committing stylesheets/custom.css!
transaction abort!
rollback completed
abort: Permission denied: '/Volumes/xxx/yyy/.hg/store/data/stylesheets/._custom.css.i-JdxA5R'

Why is Mercurial trying to create a resource fork inside its own data store?

If I comment the veto rule, the commit succeeds, but it leaves no such resource fork on the server. So it appears to be a temporary resource fork, or that of a temporary file.

How can I prevent hg from creating it, or ignore the error, or make Samba swallow it silently?

Edit: I suppose (but I'm not certain) hg is creating a temp file called custom.css.i-JdxA5R and for some reason OS X tries to attach a resource fork to it. When that fails, as it's vetoed by Samba, OS X returns an error for the entire temp file operation.

I'd like to have Nginx suspend (hold) http requests for short periods of time, while I upgrade or restart the backend service, do a database migration, or some other administrative task, without causing errors to the end users.

Basically I'd like to do the following sequence of operations:

1. tell Nginx to stop forwarding requests to my backend, instead holding them in its asynchronous queues;
2. wait for and be notified when all pending requests to the backend are completed;
3. upgrade, restart, or otherwise operate on the idle backend service;
4. quickly verify that the backend service is operational, using its private address;
5. open Nginx's flood gates and let all the pending requests through.

Ideally, this would let me perform administrative tasks that need exclusive access to the entire backend server, such as restarts, upgrades, or migrations, without causing end users anything more serious than a delay, hopefully of less than a minute.

I have found this solution, but it's not addressing point 2. Moreover, it needs the Lua interpreter compiled into Nginx, with any memory leaks and security issues that might imply.

Is there any configuration trick or Nginx module specifically targeting this issue? Can it be done with stock Nginx, maybe by testing for the existence of a control file?

How are other admins addressing this issue at large?

(I know that the all-purpose and somewhat sprawling uWSGI application server has this feature, among hundreds of others, but I'd rather avoid introducing yet another element between Nginx and my backend.)

I have a simple nginx reverse proxy:

server {
  server_name external.domain.com;
  location / {
    proxy_pass http://backend.int/;
  }
}

The problem is that Set-Cookie response headers contain ;Domain=backend.int, because the backend does not know it is being reverse proxied.

How can I make nginx rewrite the content of the Set-Cookie response headers, replacing ;Domain=backend.int with ;Domain=external.domain.com?

Passing the Host header unchanged is not an option in this case.

Apache httpd has had this feature for a while, see ProxyPassReverseCookieDomain, but I cannot seem to find a way to do the same in nginx.