PolitePixels
PolitePixels
  • 24
  • 97 098
Building Secure Containers
Whitepaper link: politepixels.io/white-papers
Building secure Docker containers begins with minimising the contents of the container to only include what is necessary for the application to function. Start by choosing a lightweight base image, such as Alpine or distroless, as these contain fewer built-in libraries and binaries, reducing the attack surface. Use a multi-stage build process to separate the build environment from the runtime environment. This approach allows you to copy only the compiled application and essential runtime dependencies into the final image, excluding unnecessary build tools and libraries. For example, using a scratch image for the runtime can further reduce the size and remove potential vulnerabilities, as it contains no extra binaries or tools beyond what you explicitly add. Ensure your .dockerignore file excludes non-essential files such as local configuration files, build artefacts, and test folders to prevent them from being added to the image.
Another critical aspect is controlling the permissions and user access within the container. By default, many images run as the root user, which can be a significant security risk if the application is compromised. Create a dedicated user and group with limited privileges for the application to run as. This limits access to sensitive directories and ensures the application can only modify files it needs. Additionally, avoid baking secrets such as API keys directly into your images; instead, use Docker's secrets management to securely provide secrets at build or runtime without leaving them accessible within the image layers. Lastly, regularly scan your images with tools like Trivy to identify and address known vulnerabilities. However, as the video highlights, security begins with understanding and minimising the components of your container rather than relying solely on patching vulnerabilities later. By adopting these practices, you can significantly reduce security risks and build robust Docker containers.
มุมมอง: 39

วีดีโอ

Securely Access Kubernetes With Tailscale
มุมมอง 33716 ชั่วโมงที่ผ่านมา
Our whitepaper: politepixels.io/white-papers/secure-remote-working-with-kubernetes Tailscale is a game-changer for anyone needing secure, easy access to internal systems without the hassle of traditional VPN setups. Unlike standard VPNs, Tailscale is built on WireGuard and works as a mesh network, meaning devices connect directly to each other without relying on a central server. This setup mak...
Shift Your Security Left
มุมมอง 17914 วันที่ผ่านมา
Our whitepaper: politepixels.io/white-papers/secure-remote-working-with-kubernetes Shifting left in security is a transformative approach that prioritises security from the very beginning of the development process. Rather than treating security as an afterthought, shifting left means embedding security practices into the earliest stages, starting with planning and design. This proactive method...
Future of FluxCD?
มุมมอง 1.1K9 หลายเดือนก่อน
Weaveworks has officially announced the end of the company.
High Performance Proxmox On Hetzner
มุมมอง 2.5K10 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ In this tutorial, we're taking a significant leap in our network setup by upgrading to a 10 GB ethernet connection. We'll navigate through the limitations of Hetzner's default 1 Gbit connection and delve into why a 10 Gbit/s connection is crucial for handling data-heavy tasks, particularly for configurations with SSDs in CEPH nodes. Discover how we tackle this up...
Clustering Proxmox On Hetzner
มุมมอง 3.6K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ Continuing from where we left off in setting up Proxmox on Hetzner's dedicated servers, this video takes a giant leap forward into clustering and resource management. Ready for some advanced infrastructural configurations? Let's dive in! The focus now shifts to expanding our setup with two additional Hetzner machines. We'll tackle the intricacies of assigning uni...
Configuring Proxmox For Hetzner
มุมมอง 11K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ Throughout the video, we delve into the nitty-gritty of Proxmox configuration, highlighting key steps such as booting from the drives, setting up network devices, and managing SSH access over Port 2222. I'll walk you through running and connecting to your virtual machines, ensuring you understand every command and its purpose. But that's not all! The tutorial als...
Installing Proxmox On Hetzner
มุมมอง 17K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ In this video, I dive deep into the world of infrastructure learning by setting up a personal cloud using Proxmox on Hetzner's dedicated servers. If you're looking for an affordable way to learn and experiment with cloud infrastructures, this tutorial is for you! We start by exploring why mainstream cloud providers like AWS, Azure, and Google might not be the mos...
Efficient Kubernetes Namespace Segmentation
มุมมอง 139ปีที่แล้ว
Join us as we delve into the concept of Kubernetes namespaces and how to simplify cluster management by adopting a tenant-based approach. In this video, we'll explore the pragmatic partitioning of namespaces into four essential categories that cater to various operational needs within your Kubernetes environment. Discover the roles of the 'kube-system', 'infra', 'domain', and 'CI/CD' namespaces...
Kubernetes Supply Chain Security
มุมมอง 88ปีที่แล้ว
Dive into the realm of supply chain security within Kubernetes clusters, discussing the rise of related attacks and the importance of secure container practices. Unveiling alarming statistics, the episode explores the risks tied to third-party dependencies. Through examples, it discusses actionable security measures like multi-stage containers, Docker Trust Sign, and Trivy for container scannin...
Native Sidecars In Kubernetes 1.28
มุมมอง 237ปีที่แล้ว
In today's video, I cover the exciting new features of Kubernetes version 1.28, including the much-anticipated "sidecars." Dive into a comprehensive understanding of how Kubernetes is evolving, the improvements in its latest version, and the implications of these changes for developers and businesses. Highlights of the video include: - Sidecars in Kubernetes: A look into the official implementa...
Debug Kubernetes With Large Language Models
มุมมอง 9Kปีที่แล้ว
Discover how to revolutionize your Kubernetes cluster management using the power of Large Language Models (LLMs) in this comprehensive tutorial! Dive into the world of AI-powered cluster management and learn how to integrate LLMs like GPT-4 with Kubernetes to create easily maintainable systems and reduce recovery times. Article: politepixels.io/articles/videos_2023-05-04-k8sgpt Code source: git...
What Is Containerisation
มุมมอง 6Kปีที่แล้ว
Dive into the world of containerisation, as we explore its evolution, benefits, and impact on the software development process. Learn the basics of Dockerfiles, container runtimes, and the Open Container Initiative, along with practical tips to get started on your containerisation journey. Unleash the full potential of your software development process by boosting productivity, efficiency, and ...
Build Your Own Firewall With eBPF XDP
มุมมอง 10Kปีที่แล้ว
In this video, we delve into the exciting world of eBPF and XDP, two powerful Linux technologies that allow you to create lightning-fast, flexible, and efficient networking applications. We'll start by introducing eBPF and XDP, explaining their potential and various use cases. Next, we'll walk you through setting up a basic packet viewer, including crafting an eBPF program and a Python script t...
Democratising Data With Metalakes
มุมมอง 7Kปีที่แล้ว
In this video, we explore the importance of metadata in driving digital transformation and data democratization within organizations. Metadata is crucial for enhancing data discovery, understanding, trustworthiness, governance, and collaboration. We discuss various storage options for metadata, including relational databases, NoSQL databases, metadata repositories, and data catalogues. Article:...
4 Cool Things About Kubernetes 1.27
มุมมอง 13Kปีที่แล้ว
4 Cool Things About Kubernetes 1.27
Building eBPF Programs - Linux Observability
มุมมอง 7Kปีที่แล้ว
Building eBPF Programs - Linux Observability
The Twelve Factor App - DevOps Essentials
มุมมอง 2.1Kปีที่แล้ว
The Twelve Factor App - DevOps Essentials
Mastering Ownership & Borrowing In Rust
มุมมอง 1.4Kปีที่แล้ว
Mastering Ownership & Borrowing In Rust
Uncovering the Story Behind The LastPass Breach
มุมมอง 1.3Kปีที่แล้ว
Uncovering the Story Behind The LastPass Breach
The Future of Linux Observability - EBPF
มุมมอง 1.5Kปีที่แล้ว
The Future of Linux Observability - EBPF
Don't Panic! How To Stay Calm During Outages
มุมมอง 1.3Kปีที่แล้ว
Don't Panic! How To Stay Calm During Outages
Introduction to FinOps: Take Control of Your Cloud Spendings!
มุมมอง 123ปีที่แล้ว
Introduction to FinOps: Take Control of Your Cloud Spendings!
3 Cool Things About Kubernetes 1.26
มุมมอง 1.4Kปีที่แล้ว
3 Cool Things About Kubernetes 1.26

ความคิดเห็น

  • @dovazencot
    @dovazencot 5 ชั่วโมงที่ผ่านมา

    You’ve got some top tier content, keep up the good work, it’s definitely appreciated! 😁

    • @PolitePixels
      @PolitePixels 4 ชั่วโมงที่ผ่านมา

      I am glad you are enjoying the content! 😁

  • @ultrasive
    @ultrasive 3 วันที่ผ่านมา

    Is this like for running / building other peoples code and avoiding it escaping chroot and namespaces?

    • @PolitePixels
      @PolitePixels 3 วันที่ผ่านมา

      It is more about good practices when creating containers to ensure you have reduced possible attack vectors. I am planning on creating another video, in the future, which focuses on how to run containers securely.

    • @ultrasive
      @ultrasive 3 วันที่ผ่านมา

      @ would anything other than kata containers Qemu plus a namespaced wireguard overlay network be necessary for running 3rd party tenants apps?

    • @nislab_
      @nislab_ 9 ชั่วโมงที่ผ่านมา

      Nice to see you again 😊

  • @mask17ful
    @mask17ful 5 วันที่ผ่านมา

    Everything is cool until u can be sure they will not compromise you :) u never know

    • @PolitePixels
      @PolitePixels 5 วันที่ผ่านมา

      That is why having a Zero Trust setup is so important, so even if they get access to a pod, then further authorisation layers still need to be breached.

  • @NrJuan
    @NrJuan 6 วันที่ผ่านมา

    Great video! This ties really well in with fluxcd concept of multitenancy and add a seperation with git sources as well allowing developers to have a cicd setup with in their own repo and deploying from there as well in to their own namespaces that is allocated for them. Regarding resources, wouldn't it be better give every developer team their own namespace and then build resource quotas on that namespace. That will give you fair use in the cluster and it builds a great dashboard for who is using how much.

    • @PolitePixels
      @PolitePixels 5 วันที่ผ่านมา

      Yeah, in that situation I often give each team its own domain namespace. Usually I try to split it up by the logical unit in the organisation, so then the permission structure is really easy to understand from a quick glance. I would also say though that sometimes its worth considering a hard segmentation, depending on your situation, and actually create a different cluster.

  • @zx9rmario
    @zx9rmario 11 วันที่ผ่านมา

    Traffic on vswitch is limited to 1TB/month. Each more TB costs 1 euro.

  • @АлексейЯкимович
    @АлексейЯкимович 13 วันที่ผ่านมา

    Great video! Thanks a lot!

    • @PolitePixels
      @PolitePixels 5 วันที่ผ่านมา

      I'm glad you liked it!

  • @dmitrijit5851
    @dmitrijit5851 14 วันที่ผ่านมา

    Note - You CANNOT join cluster if you have VMs already created on a node !!!

  • @dmitrijit5851
    @dmitrijit5851 18 วันที่ผ่านมา

    Thanks @PolitePixels ! Can you do extra video for simplier more common setups and hetzners failover IP ? Basically 2 machines, wher one replicates from another, and in case of hardware failure failoverIP could be switched to another machine ? Also Proxmox BACKUP server seems very powerfull, and would be good to have video tutorial on that ? Thanks !

  • @souzadavi2409
    @souzadavi2409 23 วันที่ผ่านมา

    PS.: on minute 5:46 when is creating a cluster you should change to vmbr1 and not use vbmr0. On video show the public IP, this is bit confusing, but that should be the private IP 192.168.50.11. If you didn't pay attention this will give a ssl error and the PVE2 not connect. To fix you need change the file: /etc/corosync/corosync.conf in file change ring0_addr: to 192.168.50.11 on totem config change the version number: config_version: 3 Save the file and copy it to cp /etc/corosync/corosync.conf /etc/pve/corosync.conf ...stop all these services pveproxy, pvedaemon, pve-cluster, corosync. .. And delete all files in /var/lib/corosync/* than restart the service at this order: corosync, pve-cluster, pvedaemon, pveproxy ... You need to do this process on all node... thanks for great video!!!

  • @hansun1757
    @hansun1757 23 วันที่ผ่านมา

    eBPF basic example wirte ebpf_probe.c but runner.py path(ebpf_watch.c) ?? not good example indeed

  • @veli33yilmaz
    @veli33yilmaz 25 วันที่ผ่านมา

    Great tutorial! Thank you. How auctions work in hetzner? if i buy a machine from auction will the peocess be same for connecting to the machine or setup

  • @TheXISU
    @TheXISU 29 วันที่ผ่านมา

    Now if I have a bunch of lxcs and few containers inside a Ubuntu vm, how do I access them through the internet?

  • @moddofx
    @moddofx หลายเดือนก่อน

    Hi very nice tutorial. Just a question. Do you have a bug in your DNS setup? I think 4.4.4.4 is not DNS, shouldn't it be 8.8.4.4 from Google?

    • @souzadavi2409
      @souzadavi2409 24 วันที่ผ่านมา

      Yes change to 8.8.4.4

  • @bmdyy
    @bmdyy หลายเดือนก่อน

    Super helpful video, thank you!

  • @MatthewKennedyUK
    @MatthewKennedyUK หลายเดือนก่อน

    What is this seth thing?

    • @spooterify
      @spooterify 22 วันที่ผ่านมา

      It’s Ceph, it’s an object storage deamon for creating a shared storage pool across 3 nodes.

  • @MatthewKennedyUK
    @MatthewKennedyUK หลายเดือนก่อน

    I would pay for a more in depth version of this that expands on some of the concepts covered, as the last video (Pt 3) went in to some concepts I had absolutely no idea about, and while I can follow along, I would like to understand what and why.

  • @MatthewKennedyUK
    @MatthewKennedyUK หลายเดือนก่อน

    Would be nice if a script existed to take care of a lot of this.

  • @nobewayo
    @nobewayo หลายเดือนก่อน

    After doing sudo ifreload -a i lose all connection to the ssh.... Can still access with VNC though. But after doing everything after that and rebooting out of rescue it won\t connect to the ssh anymore. What is going on here?

    • @moddofx
      @moddofx หลายเดือนก่อน

      Same problem, did you finally solve it?

    • @souzadavi2409
      @souzadavi2409 24 วันที่ผ่านมา

      if you rescue_bridge isn't not set, after sudo ifreload -a you will lose the access, the only way to stay in ssh from rescue mode and not VNC is from rescue_bridge config.

    • @spooterify
      @spooterify 22 วันที่ผ่านมา

      In rescue_bridge conf make sure you remove the source line at the end

  • @JordAuke-s5s
    @JordAuke-s5s หลายเดือนก่อน

    Jones Donald Garcia Dorothy Perez Brian

  • @pawesieniewicz6480
    @pawesieniewicz6480 2 หลายเดือนก่อน

    Hi, could you make a video about pfsense with proxmox? 🙏🙏

  • @flohfloh1157
    @flohfloh1157 2 หลายเดือนก่อน

    What is the reason for the 3 partitions. I guess one is for EFI/Bootloader but for what is the other one?

  • @DarraghMcCarthy
    @DarraghMcCarthy 3 หลายเดือนก่อน

    also interested to see if SDNs can work seamlessly with Wireguard, rather than using a vSwitch

  • @vivekshinde4761
    @vivekshinde4761 3 หลายเดือนก่อน

    You made it Unbelievably simple 😊

  • @mithubopensourcelab482
    @mithubopensourcelab482 4 หลายเดือนก่อน

    Good one.... Ceph on 1 gb network is asking for disaster. I would recommend minimum of 10 G. Secondly, with ceph, you will never get snapshots. I generally prefer a Linux box with max possible drives as storage to Proxmox storage. I also prefer nfs over any other fancy stuff like smb/cifs or iscsi for its simplicity, able to mount any where in case required.

  • @mithubopensourcelab482
    @mithubopensourcelab482 4 หลายเดือนก่อน

    There is much better way to install Proxmox. Simply install stock Debian. Then you can install proxmox over debian. No need of rescue mode and additional stuff. Always install with default drive and then order additional drives.

    • @spooterify
      @spooterify 22 วันที่ผ่านมา

      Yeah but can you configure ZFS following this method?

    • @mithubopensourcelab482
      @mithubopensourcelab482 20 วันที่ผ่านมา

      @@spooterify off course !!

    • @mithubopensourcelab482
      @mithubopensourcelab482 17 วันที่ผ่านมา

      @@spooterify off course, yes.

  • @ZhivkoKabaivanov
    @ZhivkoKabaivanov 4 หลายเดือนก่อน

    VNC asks me for a password. In your qemu-system-x86_64 command, you don't specify any password for VNC. Could give me hint what I might be doing wrong?

  • @angelshce
    @angelshce 4 หลายเดือนก่อน

    How i can acces via RDP to a windows machine?

  • @alphaomega5017
    @alphaomega5017 5 หลายเดือนก่อน

    At the Current situation we need go to lesser pricing not on the higher side

  • @domjag600
    @domjag600 5 หลายเดือนก่อน

    Would it make sense to use pfSense or OPNSense to handle the firewall rules and DHCP?

  • @miguelmendez241
    @miguelmendez241 5 หลายเดือนก่อน

    Awesome video, one the best explanations 👍

  • @frankoonk2670
    @frankoonk2670 5 หลายเดือนก่อน

    Advice: i found out that sometimes the networkcard has 2 altnames, when i used the second altname i wasn't able to boot into proxmox, but when i use the first altname it works!

    • @alexocarroll5412
      @alexocarroll5412 5 หลายเดือนก่อน

      thanks pal, that one helped me since I had 2 altnames also. switching from the second to the first (eno1 in my case) allowed me to boot into pve.

  •  5 หลายเดือนก่อน

    hi thank you so much. But pastebin link is broken. Can you fix it please

  • @Keaza.
    @Keaza. 5 หลายเดือนก่อน

    I got it working without rescue mode at one point, but then I restarted the machine and now I cant longer access proxmox, I have to go into rescue mode and boot a vm from rescue mode. Wtf am I doing wrong?

    • @frankoonk2670
      @frankoonk2670 5 หลายเดือนก่อน

      Same problem over here! Also the fix to comment source /etc/network/interfaces.d/* doesn't work.

  • @cresuso
    @cresuso 5 หลายเดือนก่อน

    Wow I thought the only way to install proxmox on hetzner was through the installimage script. I've tried with installimage, but had the issue of mdadm raid enabled + wanting to use zfs instead (also bad idea to put zfs on top of mdadm), and couldn't just put the filesystem in the script (it doesn't support zfs). This a very cool way to installing an os on hetzner machines, allows for much more customization thank you very much !!

  • @BunkerFrog
    @BunkerFrog 5 หลายเดือนก่อน

    After following guide and rebooting (without using backup link and "source /etc/network/interfaces.d/*" ) system is not reachable. I was trying few times to reinstall system.

    • @souzadavi2409
      @souzadavi2409 23 วันที่ผ่านมา

      Before installing PROXMOX there is a trick, he said but if you do not pay attention on video you gone to see the problem when you boot, after boot the server doesn't ping anymore. Before installing PROMOX You should check ls -al /sys/firmware/efi or efibootmgr if is the result is empty, nothing showing, you need to remove -bios /usr/share/ovmf/OVMF.fd from the Command 1 and command 2. If this parameter is wrong the server will be unbootable!!! Five nights without sleep because of this, I hope no one getting into it! The tutorial is awesome!!! thank you!!!

  • @rtv1338
    @rtv1338 6 หลายเดือนก่อน

    Tnks, like

  • @ilintech
    @ilintech 6 หลายเดือนก่อน

    Thank you so much! I've just set up my very first Homelab on Hetzner with you. I've spent 4 to 5 hours on your two videos, but they are worth every minute. Great content!

  • @SurajKumarOjha-z8g
    @SurajKumarOjha-z8g 6 หลายเดือนก่อน

    3:09 in line 6 , it should be 'ebpf-probe.c' instead of 'ebpf-watch.c' since our python file name is ebpf-probe.c

  • @sleepwellness4007
    @sleepwellness4007 6 หลายเดือนก่อน

    sir i need your help

  • @rigod0n
    @rigod0n 6 หลายเดือนก่อน

    cheers!

  • @riccardogerardis4582
    @riccardogerardis4582 7 หลายเดือนก่อน

    Really good explanations! Thanks a lot

  • @ReneHoffmann194
    @ReneHoffmann194 7 หลายเดือนก่อน

    die audio is not in sync at about 0:40

  • @ranahaseeb2440
    @ranahaseeb2440 7 หลายเดือนก่อน

    I want to ask about the first term

  • @Unknown5147
    @Unknown5147 8 หลายเดือนก่อน

    Great video, thanks. Do you have any ideas how to get around the limit of 32 mac addresses per vswitch switch port? This limitation of hetzner causes a lot of inconvenience...

  • @dau
    @dau 8 หลายเดือนก่อน

    The system doesn't access to internet in a rescue mode in such a configuration because of a conflict between resque_bridge and vmbr0/2. Accordingly, if I don't comment source /etc/network/interfaces.d/* before reboot, the Proxmox system could not to be accessed outside because of network configuration error. Some manuals recommend writing a script to determine rescue mode and activate the corresponding network configuration (the interfaces file). I did the task a few times from the scratch with the same result, so I suppose that combined configuration doesn't work.

    • @liangyiu
      @liangyiu 7 หลายเดือนก่อน

      Thank you soooo freaking much!!! <3 I am just freaking going crazy after my 5th try installing it and proxmox not being pingable or anything, time to remove that stupid file ;DD

  • @rudidekok
    @rudidekok 8 หลายเดือนก่อน

    Im unable to resolve dns after setting up proxmox i did open incoming dns on 53 on hetzner firewal

    • @didrik_kurpz
      @didrik_kurpz 7 หลายเดือนก่อน

      same problem here

    • @rudidekok
      @rudidekok 7 หลายเดือนก่อน

      @@didrik_kurpz I resolved this by disabling ipv6 on the interface didn't need it anyway but resolved the issue

    • @AbhinavBhuria-st5qz
      @AbhinavBhuria-st5qz 7 หลายเดือนก่อน

      @@rudidekok Hi, a newbie here. How can we go about disabling ipv6 on the inyerface?

    • @rudidekok
      @rudidekok 7 หลายเดือนก่อน

      @@AbhinavBhuria-st5qz if something is assigning an ipv6 address to your network adapter's you can just remove the ipV6 address it's giving a in your adapter's and leave it blank or just go to nano /etc/network/interfaces and remove it from there and ctrl z to save, don't forget to apt install ifupdown2 it allows you to restart your network interfaces, it's been awhile don't have my proxmox in front of me right now

    • @Ulerich96
      @Ulerich96 6 หลายเดือนก่อน

      In my case was a wrong firewall configuration (I switched the destination with the source)

  • @EderNucci
    @EderNucci 8 หลายเดือนก่อน

    Grafana 🎉

  • @MdAtaurRahmanMondol
    @MdAtaurRahmanMondol 8 หลายเดือนก่อน

    Thanx for this series. how do i check netdev is present or not. in my case, it is giving me an error "qemu-system-x86_64: warning: netdev net0 has no peer"

  • @BeshoyAtef
    @BeshoyAtef 9 หลายเดือนก่อน

    Thank you really helpful , would be extra helpful if you uav text docs

  • @JosephJefferson-p2s
    @JosephJefferson-p2s 9 หลายเดือนก่อน

    How did you vnc into it. Can you add instruction on every step of the vnc process. I install vnc put my IP address in but I can never connect to it?

    • @regis9596
      @regis9596 7 หลายเดือนก่อน

      ssh tunnel