- 24
- 97 098
PolitePixels
United Kingdom
เข้าร่วมเมื่อ 7 ก.ค. 2022
Discover the world of IT infrastructure made simple with PolitePixels. Our TH-cam channel provides clear and concise video tutorials, expert insights, and valuable tips on mastering complex topics. We also offer IT consultancy services, sharing our knowledge to empower you in navigating the tech landscape with confidence.
Together, we'll decode the complexities of IT infrastructure!
Check out our website for more information: www.politepixels.io
All code examples in videos will be found here: github.com/politepixels/code-examples
Together, we'll decode the complexities of IT infrastructure!
Check out our website for more information: www.politepixels.io
All code examples in videos will be found here: github.com/politepixels/code-examples
Building Secure Containers
Whitepaper link: politepixels.io/white-papers
Building secure Docker containers begins with minimising the contents of the container to only include what is necessary for the application to function. Start by choosing a lightweight base image, such as Alpine or distroless, as these contain fewer built-in libraries and binaries, reducing the attack surface. Use a multi-stage build process to separate the build environment from the runtime environment. This approach allows you to copy only the compiled application and essential runtime dependencies into the final image, excluding unnecessary build tools and libraries. For example, using a scratch image for the runtime can further reduce the size and remove potential vulnerabilities, as it contains no extra binaries or tools beyond what you explicitly add. Ensure your .dockerignore file excludes non-essential files such as local configuration files, build artefacts, and test folders to prevent them from being added to the image.
Another critical aspect is controlling the permissions and user access within the container. By default, many images run as the root user, which can be a significant security risk if the application is compromised. Create a dedicated user and group with limited privileges for the application to run as. This limits access to sensitive directories and ensures the application can only modify files it needs. Additionally, avoid baking secrets such as API keys directly into your images; instead, use Docker's secrets management to securely provide secrets at build or runtime without leaving them accessible within the image layers. Lastly, regularly scan your images with tools like Trivy to identify and address known vulnerabilities. However, as the video highlights, security begins with understanding and minimising the components of your container rather than relying solely on patching vulnerabilities later. By adopting these practices, you can significantly reduce security risks and build robust Docker containers.
Building secure Docker containers begins with minimising the contents of the container to only include what is necessary for the application to function. Start by choosing a lightweight base image, such as Alpine or distroless, as these contain fewer built-in libraries and binaries, reducing the attack surface. Use a multi-stage build process to separate the build environment from the runtime environment. This approach allows you to copy only the compiled application and essential runtime dependencies into the final image, excluding unnecessary build tools and libraries. For example, using a scratch image for the runtime can further reduce the size and remove potential vulnerabilities, as it contains no extra binaries or tools beyond what you explicitly add. Ensure your .dockerignore file excludes non-essential files such as local configuration files, build artefacts, and test folders to prevent them from being added to the image.
Another critical aspect is controlling the permissions and user access within the container. By default, many images run as the root user, which can be a significant security risk if the application is compromised. Create a dedicated user and group with limited privileges for the application to run as. This limits access to sensitive directories and ensures the application can only modify files it needs. Additionally, avoid baking secrets such as API keys directly into your images; instead, use Docker's secrets management to securely provide secrets at build or runtime without leaving them accessible within the image layers. Lastly, regularly scan your images with tools like Trivy to identify and address known vulnerabilities. However, as the video highlights, security begins with understanding and minimising the components of your container rather than relying solely on patching vulnerabilities later. By adopting these practices, you can significantly reduce security risks and build robust Docker containers.
มุมมอง: 39
วีดีโอ
Securely Access Kubernetes With Tailscale
มุมมอง 33716 ชั่วโมงที่ผ่านมา
Our whitepaper: politepixels.io/white-papers/secure-remote-working-with-kubernetes Tailscale is a game-changer for anyone needing secure, easy access to internal systems without the hassle of traditional VPN setups. Unlike standard VPNs, Tailscale is built on WireGuard and works as a mesh network, meaning devices connect directly to each other without relying on a central server. This setup mak...
Shift Your Security Left
มุมมอง 17914 วันที่ผ่านมา
Our whitepaper: politepixels.io/white-papers/secure-remote-working-with-kubernetes Shifting left in security is a transformative approach that prioritises security from the very beginning of the development process. Rather than treating security as an afterthought, shifting left means embedding security practices into the earliest stages, starting with planning and design. This proactive method...
Future of FluxCD?
มุมมอง 1.1K9 หลายเดือนก่อน
Weaveworks has officially announced the end of the company.
High Performance Proxmox On Hetzner
มุมมอง 2.5K10 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ In this tutorial, we're taking a significant leap in our network setup by upgrading to a 10 GB ethernet connection. We'll navigate through the limitations of Hetzner's default 1 Gbit connection and delve into why a 10 Gbit/s connection is crucial for handling data-heavy tasks, particularly for configurations with SSDs in CEPH nodes. Discover how we tackle this up...
Clustering Proxmox On Hetzner
มุมมอง 3.6K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ Continuing from where we left off in setting up Proxmox on Hetzner's dedicated servers, this video takes a giant leap forward into clustering and resource management. Ready for some advanced infrastructural configurations? Let's dive in! The focus now shifts to expanding our setup with two additional Hetzner machines. We'll tackle the intricacies of assigning uni...
Configuring Proxmox For Hetzner
มุมมอง 11K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ Throughout the video, we delve into the nitty-gritty of Proxmox configuration, highlighting key steps such as booting from the drives, setting up network devices, and managing SSH access over Port 2222. I'll walk you through running and connecting to your virtual machines, ensuring you understand every command and its purpose. But that's not all! The tutorial als...
Installing Proxmox On Hetzner
มุมมอง 17K11 หลายเดือนก่อน
Commands: pastebin.com/1F0ALKPZ In this video, I dive deep into the world of infrastructure learning by setting up a personal cloud using Proxmox on Hetzner's dedicated servers. If you're looking for an affordable way to learn and experiment with cloud infrastructures, this tutorial is for you! We start by exploring why mainstream cloud providers like AWS, Azure, and Google might not be the mos...
Efficient Kubernetes Namespace Segmentation
มุมมอง 139ปีที่แล้ว
Join us as we delve into the concept of Kubernetes namespaces and how to simplify cluster management by adopting a tenant-based approach. In this video, we'll explore the pragmatic partitioning of namespaces into four essential categories that cater to various operational needs within your Kubernetes environment. Discover the roles of the 'kube-system', 'infra', 'domain', and 'CI/CD' namespaces...
Kubernetes Supply Chain Security
มุมมอง 88ปีที่แล้ว
Dive into the realm of supply chain security within Kubernetes clusters, discussing the rise of related attacks and the importance of secure container practices. Unveiling alarming statistics, the episode explores the risks tied to third-party dependencies. Through examples, it discusses actionable security measures like multi-stage containers, Docker Trust Sign, and Trivy for container scannin...
Native Sidecars In Kubernetes 1.28
มุมมอง 237ปีที่แล้ว
In today's video, I cover the exciting new features of Kubernetes version 1.28, including the much-anticipated "sidecars." Dive into a comprehensive understanding of how Kubernetes is evolving, the improvements in its latest version, and the implications of these changes for developers and businesses. Highlights of the video include: - Sidecars in Kubernetes: A look into the official implementa...
Debug Kubernetes With Large Language Models
มุมมอง 9Kปีที่แล้ว
Discover how to revolutionize your Kubernetes cluster management using the power of Large Language Models (LLMs) in this comprehensive tutorial! Dive into the world of AI-powered cluster management and learn how to integrate LLMs like GPT-4 with Kubernetes to create easily maintainable systems and reduce recovery times. Article: politepixels.io/articles/videos_2023-05-04-k8sgpt Code source: git...
What Is Containerisation
มุมมอง 6Kปีที่แล้ว
Dive into the world of containerisation, as we explore its evolution, benefits, and impact on the software development process. Learn the basics of Dockerfiles, container runtimes, and the Open Container Initiative, along with practical tips to get started on your containerisation journey. Unleash the full potential of your software development process by boosting productivity, efficiency, and ...
Build Your Own Firewall With eBPF XDP
มุมมอง 10Kปีที่แล้ว
In this video, we delve into the exciting world of eBPF and XDP, two powerful Linux technologies that allow you to create lightning-fast, flexible, and efficient networking applications. We'll start by introducing eBPF and XDP, explaining their potential and various use cases. Next, we'll walk you through setting up a basic packet viewer, including crafting an eBPF program and a Python script t...
Democratising Data With Metalakes
มุมมอง 7Kปีที่แล้ว
In this video, we explore the importance of metadata in driving digital transformation and data democratization within organizations. Metadata is crucial for enhancing data discovery, understanding, trustworthiness, governance, and collaboration. We discuss various storage options for metadata, including relational databases, NoSQL databases, metadata repositories, and data catalogues. Article:...
Building eBPF Programs - Linux Observability
มุมมอง 7Kปีที่แล้ว
Building eBPF Programs - Linux Observability
The Twelve Factor App - DevOps Essentials
มุมมอง 2.1Kปีที่แล้ว
The Twelve Factor App - DevOps Essentials
Uncovering the Story Behind The LastPass Breach
มุมมอง 1.3Kปีที่แล้ว
Uncovering the Story Behind The LastPass Breach
The Future of Linux Observability - EBPF
มุมมอง 1.5Kปีที่แล้ว
The Future of Linux Observability - EBPF
Don't Panic! How To Stay Calm During Outages
มุมมอง 1.3Kปีที่แล้ว
Don't Panic! How To Stay Calm During Outages
Introduction to FinOps: Take Control of Your Cloud Spendings!
มุมมอง 123ปีที่แล้ว
Introduction to FinOps: Take Control of Your Cloud Spendings!
You’ve got some top tier content, keep up the good work, it’s definitely appreciated! 😁
I am glad you are enjoying the content! 😁
Is this like for running / building other peoples code and avoiding it escaping chroot and namespaces?
It is more about good practices when creating containers to ensure you have reduced possible attack vectors. I am planning on creating another video, in the future, which focuses on how to run containers securely.
@ would anything other than kata containers Qemu plus a namespaced wireguard overlay network be necessary for running 3rd party tenants apps?
Nice to see you again 😊
Everything is cool until u can be sure they will not compromise you :) u never know
That is why having a Zero Trust setup is so important, so even if they get access to a pod, then further authorisation layers still need to be breached.
Great video! This ties really well in with fluxcd concept of multitenancy and add a seperation with git sources as well allowing developers to have a cicd setup with in their own repo and deploying from there as well in to their own namespaces that is allocated for them. Regarding resources, wouldn't it be better give every developer team their own namespace and then build resource quotas on that namespace. That will give you fair use in the cluster and it builds a great dashboard for who is using how much.
Yeah, in that situation I often give each team its own domain namespace. Usually I try to split it up by the logical unit in the organisation, so then the permission structure is really easy to understand from a quick glance. I would also say though that sometimes its worth considering a hard segmentation, depending on your situation, and actually create a different cluster.
Traffic on vswitch is limited to 1TB/month. Each more TB costs 1 euro.
Great video! Thanks a lot!
I'm glad you liked it!
Note - You CANNOT join cluster if you have VMs already created on a node !!!
Thanks @PolitePixels ! Can you do extra video for simplier more common setups and hetzners failover IP ? Basically 2 machines, wher one replicates from another, and in case of hardware failure failoverIP could be switched to another machine ? Also Proxmox BACKUP server seems very powerfull, and would be good to have video tutorial on that ? Thanks !
PS.: on minute 5:46 when is creating a cluster you should change to vmbr1 and not use vbmr0. On video show the public IP, this is bit confusing, but that should be the private IP 192.168.50.11. If you didn't pay attention this will give a ssl error and the PVE2 not connect. To fix you need change the file: /etc/corosync/corosync.conf in file change ring0_addr: to 192.168.50.11 on totem config change the version number: config_version: 3 Save the file and copy it to cp /etc/corosync/corosync.conf /etc/pve/corosync.conf ...stop all these services pveproxy, pvedaemon, pve-cluster, corosync. .. And delete all files in /var/lib/corosync/* than restart the service at this order: corosync, pve-cluster, pvedaemon, pveproxy ... You need to do this process on all node... thanks for great video!!!
eBPF basic example wirte ebpf_probe.c but runner.py path(ebpf_watch.c) ?? not good example indeed
Great tutorial! Thank you. How auctions work in hetzner? if i buy a machine from auction will the peocess be same for connecting to the machine or setup
Now if I have a bunch of lxcs and few containers inside a Ubuntu vm, how do I access them through the internet?
Hi very nice tutorial. Just a question. Do you have a bug in your DNS setup? I think 4.4.4.4 is not DNS, shouldn't it be 8.8.4.4 from Google?
Yes change to 8.8.4.4
Super helpful video, thank you!
What is this seth thing?
It’s Ceph, it’s an object storage deamon for creating a shared storage pool across 3 nodes.
I would pay for a more in depth version of this that expands on some of the concepts covered, as the last video (Pt 3) went in to some concepts I had absolutely no idea about, and while I can follow along, I would like to understand what and why.
Would be nice if a script existed to take care of a lot of this.
After doing sudo ifreload -a i lose all connection to the ssh.... Can still access with VNC though. But after doing everything after that and rebooting out of rescue it won\t connect to the ssh anymore. What is going on here?
Same problem, did you finally solve it?
if you rescue_bridge isn't not set, after sudo ifreload -a you will lose the access, the only way to stay in ssh from rescue mode and not VNC is from rescue_bridge config.
In rescue_bridge conf make sure you remove the source line at the end
Jones Donald Garcia Dorothy Perez Brian
Hi, could you make a video about pfsense with proxmox? 🙏🙏
What is the reason for the 3 partitions. I guess one is for EFI/Bootloader but for what is the other one?
also interested to see if SDNs can work seamlessly with Wireguard, rather than using a vSwitch
You made it Unbelievably simple 😊
Good one.... Ceph on 1 gb network is asking for disaster. I would recommend minimum of 10 G. Secondly, with ceph, you will never get snapshots. I generally prefer a Linux box with max possible drives as storage to Proxmox storage. I also prefer nfs over any other fancy stuff like smb/cifs or iscsi for its simplicity, able to mount any where in case required.
There is much better way to install Proxmox. Simply install stock Debian. Then you can install proxmox over debian. No need of rescue mode and additional stuff. Always install with default drive and then order additional drives.
Yeah but can you configure ZFS following this method?
@@spooterify off course !!
@@spooterify off course, yes.
VNC asks me for a password. In your qemu-system-x86_64 command, you don't specify any password for VNC. Could give me hint what I might be doing wrong?
How i can acces via RDP to a windows machine?
At the Current situation we need go to lesser pricing not on the higher side
Would it make sense to use pfSense or OPNSense to handle the firewall rules and DHCP?
Awesome video, one the best explanations 👍
Advice: i found out that sometimes the networkcard has 2 altnames, when i used the second altname i wasn't able to boot into proxmox, but when i use the first altname it works!
thanks pal, that one helped me since I had 2 altnames also. switching from the second to the first (eno1 in my case) allowed me to boot into pve.
hi thank you so much. But pastebin link is broken. Can you fix it please
I got it working without rescue mode at one point, but then I restarted the machine and now I cant longer access proxmox, I have to go into rescue mode and boot a vm from rescue mode. Wtf am I doing wrong?
Same problem over here! Also the fix to comment source /etc/network/interfaces.d/* doesn't work.
Wow I thought the only way to install proxmox on hetzner was through the installimage script. I've tried with installimage, but had the issue of mdadm raid enabled + wanting to use zfs instead (also bad idea to put zfs on top of mdadm), and couldn't just put the filesystem in the script (it doesn't support zfs). This a very cool way to installing an os on hetzner machines, allows for much more customization thank you very much !!
After following guide and rebooting (without using backup link and "source /etc/network/interfaces.d/*" ) system is not reachable. I was trying few times to reinstall system.
Before installing PROXMOX there is a trick, he said but if you do not pay attention on video you gone to see the problem when you boot, after boot the server doesn't ping anymore. Before installing PROMOX You should check ls -al /sys/firmware/efi or efibootmgr if is the result is empty, nothing showing, you need to remove -bios /usr/share/ovmf/OVMF.fd from the Command 1 and command 2. If this parameter is wrong the server will be unbootable!!! Five nights without sleep because of this, I hope no one getting into it! The tutorial is awesome!!! thank you!!!
Tnks, like
Thank you so much! I've just set up my very first Homelab on Hetzner with you. I've spent 4 to 5 hours on your two videos, but they are worth every minute. Great content!
3:09 in line 6 , it should be 'ebpf-probe.c' instead of 'ebpf-watch.c' since our python file name is ebpf-probe.c
sir i need your help
cheers!
Really good explanations! Thanks a lot
die audio is not in sync at about 0:40
I want to ask about the first term
Great video, thanks. Do you have any ideas how to get around the limit of 32 mac addresses per vswitch switch port? This limitation of hetzner causes a lot of inconvenience...
The system doesn't access to internet in a rescue mode in such a configuration because of a conflict between resque_bridge and vmbr0/2. Accordingly, if I don't comment source /etc/network/interfaces.d/* before reboot, the Proxmox system could not to be accessed outside because of network configuration error. Some manuals recommend writing a script to determine rescue mode and activate the corresponding network configuration (the interfaces file). I did the task a few times from the scratch with the same result, so I suppose that combined configuration doesn't work.
Thank you soooo freaking much!!! <3 I am just freaking going crazy after my 5th try installing it and proxmox not being pingable or anything, time to remove that stupid file ;DD
Im unable to resolve dns after setting up proxmox i did open incoming dns on 53 on hetzner firewal
same problem here
@@didrik_kurpz I resolved this by disabling ipv6 on the interface didn't need it anyway but resolved the issue
@@rudidekok Hi, a newbie here. How can we go about disabling ipv6 on the inyerface?
@@AbhinavBhuria-st5qz if something is assigning an ipv6 address to your network adapter's you can just remove the ipV6 address it's giving a in your adapter's and leave it blank or just go to nano /etc/network/interfaces and remove it from there and ctrl z to save, don't forget to apt install ifupdown2 it allows you to restart your network interfaces, it's been awhile don't have my proxmox in front of me right now
In my case was a wrong firewall configuration (I switched the destination with the source)
Grafana 🎉
Thanx for this series. how do i check netdev is present or not. in my case, it is giving me an error "qemu-system-x86_64: warning: netdev net0 has no peer"
Thank you really helpful , would be extra helpful if you uav text docs
How did you vnc into it. Can you add instruction on every step of the vnc process. I install vnc put my IP address in but I can never connect to it?
ssh tunnel