Steve Folly's questions

We have a system that currently uses docker-compose for deployment of containers (effectively docker-compose pull && docker-compose up) and are in the process of converting the system to Kubernetes.

We have CI/CD that deploys to production automatically based on git tags pushed to the git repository. For staging, we keeping advancing a branch. The docker images are built and tagged with either the git production tag or git staging branch name.

At deployment, docker-compose is intelligent enough to not restart the container if the image is actually the same, i.e. two production tags point to the same image.

I'm looking for a way to do the same thing in Kubernetes - if at deployment the actual image used for the container of the pod is the same as what's already running (based on the image checksum, not just the image tag), then it shouldn't have to restart the pod. Is this possible?

Thanks

We have about 15 OS X desktop machines - mainly iMacs, some MacBooks and Mac Pros. Each user has a local account on the machine, and a portable USB disk for a Time Machine backup.

I want to coordinate the backups to a central NAS, and I'm thinking about something like the Synology DS2411+ (I know there are only 12 bays; we may need 2 of them!), allocating one disk each for each client machine.

Our network hardware is gigabit capable, and all clients connect at 1000baseT. I'm concerned about the network utilisation. I know the initial full backup will take a long time, but I'm prepared to do that one machine at a time overnight. But what about when multiple clients do their incremental TM backups at the same time? What kind of impact could that have on the network?

Is this a feasible network based solution? Are there alternatives?

I have some network user accounts on an OS X 10.5 Leopard server.

Is it possible to disable login at the login window, but still allow them to connect to their home account via Finder and Connect To Server?

If I untick 'access account' in the Workgroup Manager, the user can no longer login nor connect to server, so that's a bit too harsh.

I'm running an OS X 10.5.8 server. When my users ssh into it, it can take up to about 10 seconds before they see a prompt.

I've turned on debug for ssh and see it's pausing at the "Entering interactive session", looking at the server at this point, the "launchctl" process is running for the user that just logged in.

So, can I track this down further as to why launchctl is taking about 10 seconds to start up before the ssh prompt comes back? I'm assuming it's trying to start up per-user launch daemons and agents?

Is it a known problem that launchctl is so slow? (This is especially irritating because we use the "git" scm tool over ssh!) Is there anything I can do to speed it up?

Thanks for any help or advice.

Cheers, Steve

I look after the intranet in our office, running Mac OS X Server 10.5.8. We have several applications running on the intranet - Bugzilla, TWiki, a few home grown apps and some static pages. (Don't use the OS X collaboration tools - we were using TWiki before they were available.)

There is one host set up, and all the apps run under that - http://intranet/bugzilla, http://intranet/twiki, etc.

I've just read the chapter in Apache docs on virtual named hosts and I'm keen to try them. If I'm right, I'll end up with URLs like http://bugzilla/, http://twiki/, etc.? I know I also have to manage the DNS zone as well to add these names as aliases.

The advantages I can see are that it would make it easier to relocate an app to a different physical host should the need ever arise. We do have a dev set up for our public website, so having a virtual named host there makes it easier to test.

On the down side, I do have to manage DNS settings as well, whereas with a single host there is only one name to worry about.

What's the perceived wisdom here? Is this a good way to proceed?

Are there other advantages and disadvantages anyone would like to share before I make the leap. Or not.

Cheers.

It was brought to my attention recently the user's home folders on our server have group read permissions.

The subfolders within them - Documents, Movies, Pictures, etc. do not have group permissions, but any files and directories created at the top level in the home folder itself have group read permissions.

(If these were local accounts on a client machine, then each user would be in their own group, thus naturally restricting group access.)

What's the best way to fix current home folders now and to remove group read permissions for all future accounts that are created? I noticed each home folder currently has an ACL "group:everybody deny delete", could I add another ACL as a quick fix?

In WM, all users are by default put in the 'staff' group.

Cheers.

PS. I realise of course the exception to this is Public and Sites should be a+rx
PPS. I'm running OS X Server 10.5 Leopard (10.5.8)

I'm trying to set up a VPN connection. The remote site already has a DG834G for general use, but I don't want to use it's VPN capability, I want to separate a 'public' subnet for internet only, and 'private' subnet for VPN and internet (see here on superuser.com). I'm adding an FVG318 as the remote site's VPN router.

This diagram might help explain what I'm trying to achieve:

 internet -- > [834] < -- home 'public' subnet -- > [318] < -- home 'private' subnet -- >
                        |                                  |           |
                   friend's PC                             work PC 1   work PC 2

It's not obvious from the 834 manual - is there a way to configure the 834 to do VPN passthrough, so the 318 gets all the VPN packets. Or will the 834 just passthrough all packets anyway if there are no VPN tunnels configured on it? Or perhaps the 834 isn't a good choice in this set up?

Thanks for any help.