mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-03-24 02:20:09 +08:00
Merge remote-tracking branch 'LCTT/master'
This commit is contained in:
Xingyu Wang
commit
ccb20c8fe3
@ -0,0 +1,146 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (wxy)
|
||||
[#]: reviewer: (wxy)
|
||||
[#]: publisher: (wxy)
|
||||
[#]: url: (https://linux.cn/article-11268-1.html)
|
||||
[#]: subject: (Podman and user namespaces: A marriage made in heaven)
|
||||
[#]: via: (https://opensource.com/article/18/12/podman-and-user-namespaces)
|
||||
[#]: author: (Daniel J Walsh https://opensource.com/users/rhatdan)
|
||||
|
||||
Podman 和用户名字空间：天作之合
|
||||
======
|
||||
|
||||
> 了解如何使用 Podman 在单独的用户空间运行容器。
|
||||
|
||||
|
||||
|
||||
[Podman][1] 是 [libpod][2] 库的一部分，使用户能够管理 pod、容器和容器镜像。在我的上一篇文章中，我写过将 [Podman 作为一种更安全的运行容器的方式][3]。在这里，我将解释如何使用 Podman 在单独的用户命名空间中运行容器。
|
||||
|
||||
作为分离容器的一个很棒的功能，我一直在思考<ruby>[用户命名空间][4]<rt>user namespace</rt></ruby>，它主要是由 Red Hat 的 Eric Biederman 开发的。用户命名空间允许你指定用于运行容器的用户标识符（UID）和组标识符（GID）映射。这意味着你可以在容器内以 UID 0 运行，在容器外以 UID 100000 运行。如果容器进程逃逸出了容器，内核会将它们视为以 UID 100000 运行。不仅如此，任何未映射到用户命名空间的 UID 所拥有的文件对象都将被视为 `nobody` 所拥有（UID 是 `65534`， 由 `kernel.overflowuid` 指定），并且不允许容器进程访问，除非该对象可由“其他人”访问（即世界可读/可写）。
|
||||
|
||||
如果你拥有一个权限为 [660][5] 的属主为“真实” `root` 的文件，而当用户命名空间中的容器进程尝试读取它时，会阻止它们访问它，并且会将该文件视为 `nobody` 所拥有。
|
||||
|
||||
### 示例
|
||||
|
||||
以下是它是如何工作的。首先，我在 `root` 拥有的系统中创建一个文件。
|
||||
|
||||
```
|
||||
$ sudo bash -c "echo Test > /tmp/test"
|
||||
$ sudo chmod 600 /tmp/test
|
||||
$ sudo ls -l /tmp/test
|
||||
-rw-------. 1 root root 5 Dec 17 16:40 /tmp/test
|
||||
```
|
||||
|
||||
接下来，我将该文件卷挂载到一个使用用户命名空间映射 `0:100000:5000` 运行的容器中。
|
||||
|
||||
```
|
||||
$ sudo podman run -ti -v /tmp/test:/tmp/test:Z --uidmap 0:100000:5000 fedora sh
|
||||
# id
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
# ls -l /tmp/test
|
||||
-rw-rw----. 1 nobody nobody 8 Nov 30 12:40 /tmp/test
|
||||
# cat /tmp/test
|
||||
cat: /tmp/test: Permission denied
|
||||
```
|
||||
|
||||
上面的 `--uidmap` 设置告诉 Podman 在容器内映射一系列的 5000 个 UID，从容器外的 UID 100000 开始的范围（100000-104999）映射到容器内 UID 0 开始的范围（0-4999）。在容器内部，如果我的进程以 UID 1 运行，则它在主机上为 100001。
|
||||
|
||||
由于实际的 `UID=0` 未映射到容器中，因此 `root` 拥有的任何文件都将被视为 `nobody` 所拥有。即使容器内的进程具有 `CAP_DAC_OVERRIDE` 能力，也无法覆盖此种保护。`DAC_OVERRIDE` 能力使得 root 的进程能够读/写系统上的任何文件，即使进程不是 `root` 用户拥有的，也不是全局可读或可写的。
|
||||
|
||||
用户命名空间的功能与宿主机上的功能不同。它们是命名空间的功能。这意味着我的容器的 root 只在容器内具有功能 —— 实际上只有该范围内的 UID 映射到内用户命名空间。如果容器进程逃逸出了容器，则它将没有任何非映射到用户命名空间的 UID 之外的功能，这包括 `UID=0`。即使进程可能以某种方式进入另一个容器，如果容器使用不同范围的 UID，它们也不具备这些功能。
|
||||
|
||||
请注意，SELinux 和其他技术还限制了容器进程破开容器时会发生的情况。
|
||||
|
||||
### 使用 podman top 来显示用户名字空间
|
||||
|
||||
我们在 `podman top` 中添加了一些功能，允许你检查容器内运行的进程的用户名，并标识它们在宿主机上的真实 UID。
|
||||
|
||||
让我们首先使用我们的 UID 映射运行一个 `sleep` 容器。
|
||||
|
||||
```
|
||||
$ sudo podman run --uidmap 0:100000:5000 -d fedora sleep 1000
|
||||
```
|
||||
|
||||
现在运行 `podman top`：
|
||||
|
||||
```
|
||||
$ sudo podman top --latest user huser
|
||||
USER HUSER
|
||||
root 100000
|
||||
|
||||
$ ps -ef | grep sleep
|
||||
100000 21821 21809 0 08:04 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
```
|
||||
|
||||
注意 `podman top` 报告用户进程在容器内以 `root` 身份运行，但在宿主机（`HUSER`）上以 UID 100000 运行。此外，`ps` 命令确认 `sleep` 过程以 UID 100000 运行。
|
||||
|
||||
现在让我们运行第二个容器，但这次我们将选择一个单独的 UID 映射，从 200000 开始。
|
||||
|
||||
```
|
||||
$ sudo podman run --uidmap 0:200000:5000 -d fedora sleep 1000
|
||||
$ sudo podman top --latest user huser
|
||||
USER HUSER
|
||||
root 200000
|
||||
|
||||
$ ps -ef | grep sleep
|
||||
100000 21821 21809 0 08:04 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
200000 23644 23632 1 08:08 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
```
|
||||
|
||||
请注意，`podman top` 报告第二个容器在容器内以 `root` 身份运行，但在宿主机上是 UID=200000。
|
||||
|
||||
另请参阅 `ps` 命令，它显示两个 `sleep` 进程都在运行：一个为 100000，另一个为 200000。
|
||||
|
||||
这意味着在单独的用户命名空间内运行容器可以在进程之间进行传统的 UID 分离，而这从一开始就是 Linux/Unix 的标准安全工具。
|
||||
|
||||
### 用户名字空间的问题
|
||||
|
||||
几年来，我一直主张用户命名空间应该作为每个人应该有的安全工具，但几乎没有人使用过。原因是没有任何文件系统支持，也没有一个<ruby>移动文件系统<rt>shifting file system</rt></ruby>。
|
||||
|
||||
在容器中，你希望在许多容器之间共享**基本**镜像。上面的每个示例中使用了 Fedora 基本镜像。Fedora 镜像中的大多数文件都由真实的 `UID=0` 拥有。如果我在此镜像上使用用户名称空间 `0:100000:5000` 运行容器，默认情况下它会将所有这些文件视为 `nobody` 所拥有，因此我们需要移动所有这些 UID 以匹配用户名称空间。多年来，我想要一个挂载选项来告诉内核重新映射这些文件 UID 以匹配用户命名空间。上游内核存储开发人员还在继续研究，在此功能上已经取得一些进展，但这是一个难题。
|
||||
|
||||
由于由 Nalin Dahyabhai 领导的团队开发的自动 [chown][6] 内置于[容器/存储][7]中，Podman 可以在同一镜像上使用不同的用户名称空间。当 Podman 使用容器/存储，并且 Podman 在新的用户命名空间中首次使用一个容器镜像时，容器/存储会 “chown”（如，更改所有权）镜像中的所有文件到用户命名空间中映射的 UID 并创建一个新镜像。可以把它想象成一个 `fedora:0:100000:5000` 镜像。
|
||||
|
||||
当 Podman 在具有相同 UID 映射的镜像上运行另一个容器时，它使用“预先 chown”的镜像。当我在`0:200000:5000` 上运行第二个容器时，容器/存储会创建第二个镜像，我们称之为 `fedora:0:200000:5000`。
|
||||
|
||||
请注意，如果你正在执行 `podman build` 或 `podman commit` 并将新创建的镜像推送到容器注册库，Podman 将使用容器/存储来反转该移动，并将推送所有文件属主变回真实 UID=0 的镜像。
|
||||
|
||||
这可能会导致在新的 UID 映射中创建容器时出现真正的减速，因为 `chown` 可能会很慢，具体取决于镜像中的文件数。此外，在普通的 [OverlayFS][8] 上，镜像中的每个文件都会被复制。普通的 Fedora 镜像最多可能需要 30 秒才能完成 `chown` 并启动容器。
|
||||
|
||||
幸运的是，Red Hat 内核存储团队（主要是 Vivek Goyal 和 Miklos Szeredi）在内核 4.19 中为 OverlayFS 添加了一项新功能。该功能称为“仅复制元数据”。如果使用 `metacopy=on` 选项来挂载层叠文件系统，则在更改文件属性时，它不会复制较低层的内容；内核会创建新的 inode，其中包含引用指向较低级别数据的属性。如果内容发生变化，它仍会复制内容。如果你想试用它，可以在 Red Hat Enterprise Linux 8 Beta 中使用此功能。
|
||||
|
||||
这意味着容器 `chown` 可能在两秒钟内发生，并且你不会倍增每个容器的存储空间。
|
||||
|
||||
这使得像 Podman 这样的工具在不同的用户命名空间中运行容器是可行的，大大提高了系统的安全性。
|
||||
|
||||
### 前瞻
|
||||
|
||||
我想向 Podman 添加一个新选项，比如 `--userns=auto`，它会为你运行的每个容器自动选择一个唯一的用户命名空间。这类似于 SELinux 与单独的多类别安全（MCS）标签一起使用的方式。如果设置环境变量 `PODMAN_USERNS=auto`，则甚至不需要设置该选项。
|
||||
|
||||
Podman 最终允许用户在不同的用户名称空间中运行容器。像 [Buildah][9] 和 [CRI-O][10] 这样的工具也可以利用用户命名空间。但是，对于 CRI-O，Kubernetes 需要了解哪个用户命名空间将运行容器引擎，上游正在开发这个功能。
|
||||
|
||||
在我的下一篇文章中，我将解释如何在用户命名空间中将 Podman 作为非 root 用户运行。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/18/12/podman-and-user-namespaces
|
||||
|
||||
作者：[Daniel J Walsh][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[wxy](https://github.com/wxy)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/rhatdan
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://podman.io/
|
||||
[2]: https://github.com/containers/libpod
|
||||
[3]: https://linux.cn/article-11261-1.html
|
||||
[4]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html
|
||||
[5]: https://chmodcommand.com/chmod-660/
|
||||
[6]: https://en.wikipedia.org/wiki/Chown
|
||||
[7]: https://github.com/containers/storage
|
||||
[8]: https://en.wikipedia.org/wiki/OverlayFS
|
||||
[9]: https://buildah.io/
|
||||
[10]: http://cri-o.io/
|
||||
@ -1,5 +1,5 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: translator: (geekpi)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
|
||||
@ -0,0 +1,57 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (Happy birthday to the Linux kernel: What's your favorite release?)
|
||||
[#]: via: (https://opensource.com/article/19/8/linux-kernel-favorite-release)
|
||||
[#]: author: (Lauren Pritchett https://opensource.com/users/lauren-pritchetthttps://opensource.com/users/sethhttps://opensource.com/users/luis-ibanezhttps://opensource.com/users/mhayden)
|
||||
|
||||
Happy birthday to the Linux kernel: What's your favorite release?
|
||||
======
|
||||
It's been 28 years since the first Linux kernel was conceived. There
|
||||
have been several releases since 1991, so what's your favorite? Take our
|
||||
poll.
|
||||
![][1]
|
||||
|
||||
Let's take a trip back to August 1991, when history was in the making. The tech world faced many pivotal moments that continue to impact us today. An intriguing project called the World Wide Web was announced by Tim Berners-Lee and the first website was launched. Super Nintendo was released in the United States and a new chapter of gaming began for kids of all ages. At the University of Helsinki, a student named Linus Torvalds asked his peers for feedback on a new free operating system he had been developing as a hobby. It was then that the Linux kernel was born.
|
||||
|
||||
Today, we can browse more than 1.5 billion websites, play with five additional Nintendo game consoles on our televisions, and maintain six longterm Linux kernels. Here's what some of our writers had to say about their favorite Linux kernel release.
|
||||
|
||||
"The one that introduced modules (was it 1.2?). It was a big step towards a successful Linux future." —Milan Zamazal
|
||||
|
||||
"2.6.9 as it was the version at the time when I joined Red Hat in 2006 (in RHEL4). But also a slightly bigger love for 2.6.18 (RHEL5) as it was the one which was deployed at massive scale / for mission critical workloads at all our largest customers (Telco, FSI). It also brought one of our biggest techno change with virtualization (Xen then KVM)." —Herve Lemaitre
|
||||
|
||||
"Kernel 4.10. (although I have no idea how to measure this)." —Ivan Bazulic
|
||||
|
||||
"The new kernel that shipped with Fedora 30 fixed a suspend issue with my Thinkpad Yoga laptop; suspend now works flawlessly. I'm a jerk and just lived with this and never filed a bug report, so I'm especially appreciative of the work I know must have gone into fixing this." —Máirín Duffy
|
||||
|
||||
"I will always have a special place in my heart for the 2.6.16 release. It was the first kernel that I was responsible for converting to run on the hertz neverlost gps system. I lead the effort to build the kernel and root filesystem for that device, it was truly a magical time for me. We updated the kernel several times after that initial release, but I think I'll have to go with the original version. Sadly, I don't really have any technical reasons for this love, it's purely sentimental =)" —Michael McCune
|
||||
|
||||
"My favorite Linux kernel release was the 2.4.0 series, it integrated support for USB, the LVM, and ext3. Ext3 being the first mainline Linux filesystem to have journaling support and available with the 2.4.15 kernel. My very first kernel release was 2.2.13." —Sean Nelson
|
||||
|
||||
"Maybe it's 2.2.14, because it's the version that ran on the first Linux I ever installed (Mandrake Linux 7.0, in 2000 IIRC). It was also the first version I ever had to recompile to get my video card, or my modem (can't recall) working." —Germán Pulido
|
||||
|
||||
"I think the latest one! But I had for a time used the realtime kernel extensions for audio production." —Mario Torre
|
||||
|
||||
_Of the more than [52 versions][2] of the Linux kernel, which one is your favorite? Take our poll and tell us why in the comments._
|
||||
|
||||
|
||||
|
||||
Following my recent post on the initiatives now in place to rebalance the demographics of the Linux...
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/19/8/linux-kernel-favorite-release
|
||||
|
||||
作者：[Lauren Pritchett][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/lauren-pritchetthttps://opensource.com/users/sethhttps://opensource.com/users/luis-ibanezhttps://opensource.com/users/mhayden
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/linux_anniversary_celebreate_tux.jpg?itok=JOE-yXus
|
||||
[2]: http://phb-crystal-ball.org/
|
||||
@ -0,0 +1,196 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (How to Install Ansible (Automation Tool) on Debian 10 (Buster))
|
||||
[#]: via: (https://www.linuxtechi.com/install-ansible-automation-tool-debian10/)
|
||||
[#]: author: (Pradeep Kumar https://www.linuxtechi.com/author/pradeep/)
|
||||
|
||||
How to Install Ansible (Automation Tool) on Debian 10 (Buster)
|
||||
======
|
||||
|
||||
Now a days in IT field, automation is the hot topic and every organization is start adopting the automation tools like **Puppet**, **Ansible**, **Chef**, **CFEngine**, **Foreman** and **Katello**. Out of these tools Ansible is the first choice of almost all the IT organization to manage UNIX and Linux like systems. In this article we will demonstrate on how to install and use ansible tool on Debian 10 Sever.
|
||||
|
||||
[![Ansible-Install-Debian10][1]][2]
|
||||
|
||||
My Lab details:
|
||||
|
||||
* Debian 10 – Ansible Server/ controller Node – 192.168.1.14
|
||||
* CentOS 7 – Ansible Host (Web Server) – 192.168.1.15
|
||||
* CentOS 7 – Ansible Host (DB Server) – 192.169.1.17
|
||||
|
||||
|
||||
|
||||
We will also demonstrate how Linux Servers can be managed using Ansible Server
|
||||
|
||||
### Ansible Installation on Debian 10 Server
|
||||
|
||||
I am assuming in your Debian 10 system you have a user which has either root privileges or sudo rights. In my setup I have a local user named “pkumar” with sudo rights.
|
||||
|
||||
Ansible 2.7 packages are available in default Debian 10 repositories, run the following commands from command line to install Ansible,
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo apt update
|
||||
root@linuxtechi:~$ sudo apt install ansible -y
|
||||
```
|
||||
|
||||
Run the below command to verify the ansible version,
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo ansible --version
|
||||
```
|
||||
|
||||
![ansible-version][1]
|
||||
|
||||
To Install latest version of Ansible 2.8, first we must set Ansible repositories.
|
||||
|
||||
Execute the following commands one after the another,
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ echo "deb http://ppa.launchpad.net/ansible/ansible/ubuntu bionic main" | sudo tee -a /etc/apt/sources.list
|
||||
root@linuxtechi:~$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 93C4A3FD7BB9C367
|
||||
root@linuxtechi:~$ sudo apt update
|
||||
root@linuxtechi:~$ sudo apt install ansible -y
|
||||
root@linuxtechi:~$ sudo ansible --version
|
||||
```
|
||||
|
||||
![latest-ansible-version][1]
|
||||
|
||||
### Managing Linux Servers using Ansible
|
||||
|
||||
Refer the following steps to manage Linux like servers using Ansible controller node,
|
||||
|
||||
### Step:1) Exchange the SSH keys between Ansible Server and its hosts
|
||||
|
||||
Generate the ssh keys from ansible server and shared the keys among the ansible hosts
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo -i
|
||||
root@linuxtechi:~# ssh-keygen
|
||||
root@linuxtechi:~# ssh-copy-id root@linuxtechi
|
||||
root@linuxtechi:~# ssh-copy-id root@linuxtechi
|
||||
```
|
||||
|
||||
### Step:2) Create Ansible Hosts inventory file
|
||||
|
||||
When ansible is installed then /etc/hosts file is created created automatically, in this file we can mentioned the ansible hosts or its clients. We can also create our own ansible host inventory file in our home directory,
|
||||
|
||||
Read More on : [**How to Manage Ansible Static and Dynamic Host Inventory**][3]
|
||||
|
||||
Run the below command to create ansible hosts inventory in our home directory
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ vi $HOME/hosts
|
||||
[Web]
|
||||
192.168.1.15
|
||||
|
||||
[DB]
|
||||
192.168.1.17
|
||||
```
|
||||
|
||||
Save and exit the file
|
||||
|
||||
**Note:** In above hosts file we can also use host name or FQDN as well but for that we have to make sure that ansible hosts are reachable and accessible by hostname or fqdn.
|
||||
|
||||
### Step:3) Test and Use default ansible modules
|
||||
|
||||
Ansible comes with lot of default modules which can used in ansible command, examples are shown below,
|
||||
|
||||
Syntax:
|
||||
|
||||
# ansible -i <host_file> -m <module> <host>
|
||||
|
||||
Where:
|
||||
|
||||
* **-i ~/hosts**: contains list of ansible hosts
|
||||
* **-m:** after -m specify the ansible module like ping & shell
|
||||
* **<host>:** Ansible hosts where we want to run the ansible modules
|
||||
|
||||
|
||||
|
||||
Verify ping connectivity using ansible ping module
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo ansible -i ~/hosts -m ping all
|
||||
root@linuxtechi:~$ sudo ansible -i ~/hosts -m ping Web
|
||||
root@linuxtechi:~$ sudo ansible -i ~/hosts -m ping DB
|
||||
```
|
||||
|
||||
Output of above commands would be something like below:
|
||||
|
||||
![Ansible-ping-module-examples][1]
|
||||
|
||||
Running shell commands on ansible hosts using shell module
|
||||
|
||||
**Syntax:** # ansible -i <hosts_file> -m shell -a <shell_commands> <host>
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo ansible -i ~/hosts -m shell -a "uptime" all
|
||||
192.168.1.17 | CHANGED | rc=0 >>
|
||||
01:48:34 up 1:07, 3 users, load average: 0.00, 0.01, 0.05
|
||||
|
||||
192.168.1.15 | CHANGED | rc=0 >>
|
||||
01:48:39 up 1:07, 3 users, load average: 0.00, 0.01, 0.04
|
||||
|
||||
root@linuxtechi:~$
|
||||
root@linuxtechi:~$ sudo ansible -i ~/hosts -m shell -a "uptime ; df -Th / ; uname -r" Web
|
||||
192.168.1.15 | CHANGED | rc=0 >>
|
||||
01:52:03 up 1:11, 3 users, load average: 0.12, 0.07, 0.06
|
||||
Filesystem Type Size Used Avail Use% Mounted on
|
||||
/dev/mapper/centos-root xfs 13G 1017M 12G 8% /
|
||||
3.10.0-327.el7.x86_64
|
||||
|
||||
root@linuxtechi:~$
|
||||
```
|
||||
|
||||
Above commands output confirms that we have successfully setup ansible controller node
|
||||
|
||||
Let’s create a sample NGINX installation playbook, below playbook will install nginx on all server which are part of Web host group, but in my case I have one centos 7 machine under this host group.
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ vi nginx.yaml
|
||||
---
|
||||
- hosts: Web
|
||||
tasks:
|
||||
- name: Install latest version of nginx on CentOS 7 Server
|
||||
yum: name=nginx state=latest
|
||||
- name: start nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: started
|
||||
```
|
||||
|
||||
Now execute the playbook using following command,
|
||||
|
||||
```
|
||||
root@linuxtechi:~$ sudo ansible-playbook -i ~/hosts nginx.yaml
|
||||
```
|
||||
|
||||
output of above command would be something like below,
|
||||
|
||||
![nginx-installation-playbook-debian10][1]
|
||||
|
||||
This confirms that Ansible playbook has been executed successfully, that’s all from article, please do share your feedback and comments.
|
||||
|
||||
Read Also: [**How to Download and Use Ansible Galaxy Roles in Ansible Playbook**][4]
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linuxtechi.com/install-ansible-automation-tool-debian10/
|
||||
|
||||
作者：[Pradeep Kumar][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://www.linuxtechi.com/author/pradeep/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
|
||||
[2]: https://www.linuxtechi.com/wp-content/uploads/2019/08/Ansible-Install-Debian10.jpg
|
||||
[3]: https://www.linuxtechi.com/manage-ansible-static-and-dynamic-host-inventory/
|
||||
[4]: https://www.linuxtechi.com/use-ansible-galaxy-roles-ansible-playbook/
|
||||
@ -1,146 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (wxy)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (Podman and user namespaces: A marriage made in heaven)
|
||||
[#]: via: (https://opensource.com/article/18/12/podman-and-user-namespaces)
|
||||
[#]: author: (Daniel J Walsh https://opensource.com/users/rhatdan)
|
||||
|
||||
Podman 和用户名字空间：天作之合
|
||||
======
|
||||
|
||||
> 了解如何使用 Podman 在单独的用户空间运行容器。
|
||||
|
||||
|
||||
|
||||
[Podman][1] 是 [libpod][2] 库的一部分，使用户能够管理 pod、容器和容器镜像。在我的上一篇文章中，我写过 [Podman 作为一种更安全的运行容器的方式][3]。在这里，我将解释如何使用 Podman 在单独的用户命名空间中运行容器。
|
||||
|
||||
我一直在思考<ruby>[用户命名空间][4]<rt>user namespace</rt></ruby>，它主要是由 Red Hat 的 Eric Biederman 开发的，作为分离容器的一个很棒的功能。用户命名空间允许你指定用于运行容器的用户标识符（UID）和组标识符（GID）映射。这意味着你可以在容器内运行 UID 0，在容器外运行 UID 100000。如果容器进程逃逸出了容器，内核会将它们视为 UID 100000。不仅如此，任何未映射到用户命名空间的 UID 所拥有的任何文件对象都将被视为 `nobody` 所拥有（65534，`kernel.overflowuid`），并且不允许容器进程访问，除非该对象可由“其他人”访问（世界可读/可写）。
|
||||
|
||||
如果你拥有一个权限为 [660][5] 的属主为“真实” `root` 的文件，并且用户命名空间中的容器进程尝试读取它，则会阻止它们访问它，并且会将该文件视为 `nobody` 所拥有。
|
||||
|
||||
### 示例
|
||||
|
||||
以下是它是如何工作的。首先，我在 `root` 拥有的系统中创建一个文件。
|
||||
|
||||
```
|
||||
$ sudo bash -c "echo Test > /tmp/test"
|
||||
$ sudo chmod 600 /tmp/test
|
||||
$ sudo ls -l /tmp/test
|
||||
-rw-------. 1 root root 5 Dec 17 16:40 /tmp/test
|
||||
```
|
||||
|
||||
接下来，我将该文件卷挂载到一个使用用户命名空间映射 `0:100000:5000` 运行的容器中。
|
||||
|
||||
```
|
||||
$ sudo podman run -ti -v /tmp/test:/tmp/test:Z --uidmap 0:100000:5000 fedora sh
|
||||
# id
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
# ls -l /tmp/test
|
||||
-rw-rw----. 1 nobody nobody 8 Nov 30 12:40 /tmp/test
|
||||
# cat /tmp/test
|
||||
cat: /tmp/test: Permission denied
|
||||
```
|
||||
|
||||
上面的 `--uidmap` 设置告诉 Podman 在容器内映射一系列 5000 个 UID，从容器外的 UID 100000开始（因此范围是 100000-104999）到容器内 UID 0 开始的范围（所以范围是 0-4999）。在容器内部，如果我的进程以 UID 1 运行，则它在主机上为 100001。
|
||||
|
||||
由于实际的 `UID=0` 未映射到容器中，因此 `root` 拥有的任何文件都将被视为 `nobody` 所拥有。即使容器内的进程具有 `CAP_DAC_OVERRIDE`，也无法覆盖此种保护。`DAC_OVERRIDE` 使根进程能够读/写系统上的任何文件，即使进程不是 `root` 用户拥有，也不是全局可读或可写的。
|
||||
|
||||
用户命名空间功能与主机上的功能不同。它们是命名空间功能。这意味着我的容器根只在容器内具有功能，实际上只在映射到用户命名空间的 UID 范围内。如果容器进程逃逸了容器，则它将没有任何功能而不是映射到用户命名空间的 UID，包括 UID=0。即使进程可能以某种方式进入另一个容器，如果容器使用不同范围的 UID，它们也不具备这些功能。
|
||||
|
||||
请注意，SELinux 和其他技术还限制了容器进程破开容器时会发生的情况。
|
||||
|
||||
### 使用 podman top 来显示用户名字空间
|
||||
|
||||
我们在 `podman top` 中添加了一些功能，允许你检查容器内运行的进程的用户名，并在主机上标识它们的真实 UID。
|
||||
|
||||
让我们首先使用我们的 UID 映射运行一个 `sleep` 容器。
|
||||
|
||||
```
|
||||
$ sudo podman run --uidmap 0:100000:5000 -d fedora sleep 1000
|
||||
```
|
||||
|
||||
现在运行 `podman top`：
|
||||
|
||||
```
|
||||
$ sudo podman top --latest user huser
|
||||
USER HUSER
|
||||
root 100000
|
||||
|
||||
$ ps -ef | grep sleep
|
||||
100000 21821 21809 0 08:04 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
```
|
||||
|
||||
注意 `podman top` 报告用户进程在容器内以 `root` 身份运行，但在主机（`HUSER`）上以 UID 100000 运行。此外，`ps` 命令确认 `sleep` 过程以 UID 100000 运行。
|
||||
|
||||
现在让我们运行第二个容器，但这次我们将选择一个单独的 UID 映射，从 200000 开始。
|
||||
|
||||
```
|
||||
$ sudo podman run --uidmap 0:200000:5000 -d fedora sleep 1000
|
||||
$ sudo podman top --latest user huser
|
||||
USER HUSER
|
||||
root 200000
|
||||
|
||||
$ ps -ef | grep sleep
|
||||
100000 21821 21809 0 08:04 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
200000 23644 23632 1 08:08 ? 00:00:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 1000
|
||||
```
|
||||
|
||||
请注意，`podman top` 报告第二个容器在容器内以 `root` 身份运行，但主机上的 UID=200000。
|
||||
|
||||
另请参阅 `ps` 命令，它显示两个 `sleep` 进程都在运行：一个为 100000，另一个为 200000。
|
||||
|
||||
这意味着在单独的用户命名空间内运行容器可以在进程之间进行传统的 UID 分离，这从一开始就是 Linux/Unix 的标准安全工具。
|
||||
|
||||
### 用户名字空间的问题
|
||||
|
||||
几年来，我一直主张用户命名空间应该作为每个人应该有的安全工具，但几乎没有人使用过。原因是没有任何文件系统支持或转移文件系统。
|
||||
|
||||
在容器中，你希望在许多容器之间共享**基本**镜像。上面的示例在每个示例中使用 Fedora 基本镜像。Fedora 镜像中的大多数文件都由实际的 UID=0 拥有。如果我使用用户名称空间 0:100000:5000 在此镜像上运行容器，默认情况下它会将所有这些文件视为 `nobody` 所拥有，因此我们需要移动所有这些 UID 以匹配用户名称空间。多年来，我想要一个挂载选项来告诉内核重新映射这些文件 UID 以匹配用户命名空间。上游内核存储开发人员继续调查并在此功能上取得进展，但这是一个难题。
|
||||
|
||||
Podman 可以在同一镜像上使用不同的用户名称空间，是由于自动 [chown][6] 内置于由 Nalin Dahyabhai 领导的团队开发的[容器/存储][7]中。Podman使用容器/存储，Podman 第一次在新的用户命名空间中使用容器镜像，容器/存储 “chowns”（如，更改所有权）镜像中的所有文件到用户命名空间中映射的 UID 并创建新镜像。可以把它想象成 `fedora:0:100000:5000` 镜像。
|
||||
|
||||
当 Podman 在具有相同 UID 映射的镜像上运行另一个容器时，它使用“预先设置所有权”的图像。当我在0:200000:5000 上运行第二个容器时，容器/存储会创建第二个镜像，我们称之为 `fedora:0:200000:5000`。
|
||||
|
||||
请注意，如果你正在执行 `podman build` 或 `podman commit` 并将新创建的镜像推送到容器注册表，Podman 将使用容器/存储来反转移位并将所有文件推回到实际 UID=0 的镜像。
|
||||
|
||||
这可能会导致在新的 UID 映射中创建容器时出现真正的减速，因为 `chown` 可能会很慢，具体取决于镜像中的文件数。此外，在普通 [OverlayFS][8] 上，镜像中的每个文件都会被复制。正常的 Fedora 镜像最多可能需要 30 秒才能完成 `chown` 并启动容器。
|
||||
|
||||
幸运的是，Red Hat 内核存储团队（主要是 Vivek Goyal 和 Miklos Szeredi）在内核 4.19 中为 OverlayFS 添加了一项新功能。该功能称为“仅元数据复制”。如果使用 `metacopy=on` 挂载覆盖文件系统作为挂载选项，则在更改文件属性时，它不会复制较低层的内容；内核创建新的 inode，其中包含引用指向较低级别数据的属性。如果内容发生变化，它仍会复制内容。如果你想试用它，可以在 Red Hat Enterprise Linux 8 Beta 中使用此功能。
|
||||
|
||||
这意味着容器 `chown` 可能在几秒钟内发生，并且你不会将每个容器的存储空间加倍。
|
||||
|
||||
这使得像 Podman 这样的工具在不同的用户命名空间中运行容器是可行的，大大提高了系统的安全性。
|
||||
|
||||
### 前瞻
|
||||
|
||||
我想向 Podman 添加一个新标志，比如 `--userns=auto`，它会告诉它为你运行的每个容器自动选择一个唯一的用户命名空间。这类似于 SELinux 与单独的多类别安全（MCS）标签一起使用的方式。如果设置环境变量 `PODMAN_USERNS=auto`，则甚至不需要设置标志。
|
||||
|
||||
Podman 最终允许用户在不同的用户名称空间中运行容器。像 [Buildah][9] 和 [CRI-O][10] 这样的工具也可以利用用户命名空间。但是，对于 CRI-O，Kubernetes 需要了解哪个用户命名空间将运行容器引擎，而上游正在处理它。
|
||||
|
||||
在我的下一篇文章中，我将解释如何在用户命名空间中将 Podman 作为非 root 用户运行。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/18/12/podman-and-user-namespaces
|
||||
|
||||
作者：[Daniel J Walsh][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[wxy](https://github.com/wxy)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/rhatdan
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://podman.io/
|
||||
[2]: https://github.com/containers/libpod
|
||||
[3]: https://opensource.com/article/18/10/podman-more-secure-way-run-containers
|
||||
[4]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html
|
||||
[5]: https://chmodcommand.com/chmod-660/
|
||||
[6]: https://en.wikipedia.org/wiki/Chown
|
||||
[7]: https://github.com/containers/storage
|
||||
[8]: https://en.wikipedia.org/wiki/OverlayFS
|
||||
[9]: https://buildah.io/
|
||||
[10]: http://cri-o.io/
|
||||
@ -7,26 +7,26 @@
|
||||
[#]: via: (https://www.ostechnix.com/find-out-the-linux-distribution-name-version-and-kernel-details/)
|
||||
[#]: author: (sk https://www.ostechnix.com/author/sk/)
|
||||
|
||||
Find The Linux Distribution Name, Version And Kernel Details
|
||||
查找 Linux 发行版名称、版本和内核详细信息
|
||||
======
|
||||
|
||||
![Find The Linux Distribution Name, Version And Kernel Details][1]
|
||||
|
||||
This guide explains how to find the Linux distribution name, version and Kernel details. If your Linux system has GUI mode, you can find these details easily from the System’s Settings. But in CLI mode, it is bit difficult for beginners to find out such details. No problem! Here I have given a few command line methods to find the Linux system information. There could be many, but these methods will work on most Linux distributions.
|
||||
本指南介绍了如何查找 Linux 发行版名称，版本和内核详细信息。如果你的 Linux 系统有 GUI 界面，那么你可以从系统设置中轻松找到这些信息。但在命令行模式下，初学者很难找到这些详情。没有问题！我这里给出了一些命令行方法来查找 Linux 系统信息。可能有很多，但这些方法适用于大多数 Linux 发行版。
|
||||
|
||||
### 1\. Find Linux distribution name, version
|
||||
### 1\. 查找 Linux 发行版名称、版本
|
||||
|
||||
There are many methods to find out what OS is running on in your VPS.
|
||||
有很多方法可以找出 VPS 中运行的操作系统。
|
||||
|
||||
##### Method 1:
|
||||
##### 方法 1：
|
||||
|
||||
Open your Terminal and run the following command:
|
||||
打开终端并运行以下命令：
|
||||
|
||||
```
|
||||
$ cat /etc/*-release
|
||||
```
|
||||
|
||||
**Sample output from CentOS 7:**
|
||||
**CentOS 7 上的示例输出：**
|
||||
|
||||
```
|
||||
CentOS Linux release 7.0.1406 (Core)
|
||||
@ -45,7 +45,7 @@ CentOS Linux release 7.0.1406 (Core)
|
||||
CentOS Linux release 7.0.1406 (Core)
|
||||
```
|
||||
|
||||
**Sample output from Ubuntu 18.04:**
|
||||
**Ubuntu 18.04 上的示例输出：**
|
||||
|
||||
```
|
||||
DISTRIB_ID=Ubuntu
|
||||
@ -66,29 +66,29 @@ VERSION_CODENAME=bionic
|
||||
UBUNTU_CODENAME=bionic
|
||||
```
|
||||
|
||||
##### Method 2:
|
||||
##### 方法 2：
|
||||
|
||||
The following command will also get your distribution details.
|
||||
以下命令也能获取你发行版的详细信息。
|
||||
|
||||
```
|
||||
$ cat /etc/issue
|
||||
```
|
||||
|
||||
**Sample output from Ubuntu 18.04:**
|
||||
**Ubuntu 18.04 上的示例输出：**
|
||||
|
||||
```
|
||||
Ubuntu 18.04.2 LTS \n \l
|
||||
```
|
||||
|
||||
##### Method 3:
|
||||
##### 方法 2：
|
||||
|
||||
The following command will get you the distribution details in Debian and its variants like Ubuntu, Linux Mint etc.
|
||||
以下命令能在 Debian 及其衍生版如 Ubuntu、Linux Mint 上获取发行版详细信息。
|
||||
|
||||
```
|
||||
$ lsb_release -a
|
||||
```
|
||||
|
||||
**Sample output:**
|
||||
**示例输出：**
|
||||
|
||||
```
|
||||
No LSB modules are available.
|
||||
@ -98,87 +98,75 @@ Release: 18.04
|
||||
Codename: bionic
|
||||
```
|
||||
|
||||
### 2\. Find Linux Kernel details
|
||||
### 2\. 查找 Linux 内核详细信息
|
||||
|
||||
##### Method 1:
|
||||
##### 方法 1：
|
||||
|
||||
To find out your Linux kernel details, run the following command from your Terminal.
|
||||
要查找 Linux 内核详细信息，请在终端运行以下命令。
|
||||
|
||||
```
|
||||
$ uname -a
|
||||
```
|
||||
|
||||
**Sample output in CentOS 7:**
|
||||
**CentOS 7 上的示例输出：**
|
||||
|
||||
```
|
||||
Linux server.ostechnix.lan 3.10.0-123.9.3.el7.x86_64 #1 SMP Thu Nov 6 15:06:03 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
|
||||
```
|
||||
|
||||
**Sample output in Ubuntu 18.04:**
|
||||
**Ubuntu 18.04 上的示例输出：**
|
||||
|
||||
```
|
||||
Linux ostechnix 4.18.0-25-generic #26~18.04.1-Ubuntu SMP Thu Jun 27 07:28:31 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
|
||||
```
|
||||
|
||||
Or,
|
||||
或者，
|
||||
|
||||
```
|
||||
$ uname -mrs
|
||||
```
|
||||
|
||||
**Sample output:**
|
||||
**示例输出：**
|
||||
|
||||
```
|
||||
Linux 4.18.0-25-generic x86_64
|
||||
```
|
||||
|
||||
Where,
|
||||
这里，
|
||||
|
||||
* **Linux** – Kernel name
|
||||
* **4.18.0-25-generic** – Kernel version
|
||||
* **x86_64** – System hardware architecture (i.e 64 bit system)
|
||||
* **Linux** – 内核名
|
||||
* **4.18.0-25-generic** – 内核版本
|
||||
* **x86_64** – 系统硬件架构（即 64 位系统）
|
||||
|
||||
|
||||
|
||||
For more details about uname command, refer the man page.
|
||||
有关 uname 命令的更多详细信息，请参考手册页。
|
||||
|
||||
```
|
||||
$ man uname
|
||||
```
|
||||
|
||||
##### Method 2:
|
||||
##### 方法2：
|
||||
|
||||
From your Terminal, run the following command:
|
||||
在终端中，运行以下命令：
|
||||
|
||||
```
|
||||
$ cat /proc/version
|
||||
```
|
||||
|
||||
**Sample output from CentOS 7:**
|
||||
**CentOS 7 上的示例输出：**
|
||||
|
||||
```
|
||||
Linux version 3.10.0-123.9.3.el7.x86_64 ([email protected]) (gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) ) #1 SMP Thu Nov 6 15:06:03 UTC 2014
|
||||
```
|
||||
|
||||
**Sample output from Ubuntu 18.04:**
|
||||
**Ubuntu 18.04 上的示例输出：**
|
||||
|
||||
```
|
||||
Linux version 4.18.0-25-generic ([email protected]) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #26~18.04.1-Ubuntu SMP Thu Jun 27 07:28:31 UTC 2019
|
||||
```
|
||||
|
||||
* * *
|
||||
|
||||
**Suggested read:**
|
||||
|
||||
* [**How To Find Linux System Details Using inxi**][2]
|
||||
* [**Neofetch – Display Linux system Information In Terminal**][3]
|
||||
* [**How To Find Hardware And Software Specifications In Ubuntu**][4]
|
||||
|
||||
|
||||
|
||||
* * *
|
||||
|
||||
These are few ways to find find out a Linux distribution’s name, version and Kernel details. Hope you find it useful.
|
||||
这些是查找 Linux 发行版的名称、版本和内核详细信息的几种方法。希望你觉得它有用。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
@ -186,7 +174,7 @@ via: https://www.ostechnix.com/find-out-the-linux-distribution-name-version-and-
|
||||
|
||||
作者：[sk][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
@ -194,6 +182,3 @@ via: https://www.ostechnix.com/find-out-the-linux-distribution-name-version-and-
|
||||
[a]: https://www.ostechnix.com/author/sk/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://www.ostechnix.com/wp-content/uploads/2015/08/Linux-Distribution-Name-Version-Kernel-720x340.png
|
||||
[2]: https://www.ostechnix.com/how-to-find-your-system-details-using-inxi/
|
||||
[3]: https://www.ostechnix.com/neofetch-display-linux-systems-information/
|
||||
[4]: https://www.ostechnix.com/getting-hardwaresoftware-specifications-in-linux-mint-ubuntu/
|
||||
Loading…
Reference in New Issue
Block a user