mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-03-21 02:10:11 +08:00
Merge remote-tracking branch 'LCTT/master'
This commit is contained in:
Xingyu Wang
commit
dff86afbe6
@ -0,0 +1,249 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (wxy)
|
||||
[#]: reviewer: (wxy)
|
||||
[#]: publisher: (wxy)
|
||||
[#]: url: (https://linux.cn/article-12227-1.html)
|
||||
[#]: subject: (9 open source CSS frameworks for frontend web development)
|
||||
[#]: via: (https://opensource.com/article/20/4/open-source-css-frameworks)
|
||||
[#]: author: (Bryant Son https://opensource.com/users/brson)
|
||||
|
||||
9 个用于前端 Web 开发的开源 CSS 框架
|
||||
======
|
||||
|
||||
> 探索开源 CSS 框架，找到适合你的项目的框架。
|
||||
|
||||
|
||||
|
||||
当大多数人想到 Web 开发时，通常会想到 HTML 或 JavaScript。他们通常会忘记对网站的欣赏能力有更大影响的技术：<ruby>[级联样式表][2]<rt>cascading style sheets</rt></ruby>（简称 CSS）。据维基百科的说法，CSS 既是网页中最重要的部分，也是最常被遗忘的部分，尽管它是万维网的三大基石技术之一。
|
||||
|
||||
本文将探讨九种流行的、强大的、开源的框架，是这些框架让构建漂亮的网站前端的 CSS 开发变得简单明了。
|
||||
|
||||
名称 | 介绍| 许可证
|
||||
---|---|---
|
||||
[Bootstrap][3] | 最流行的 CSS 框架，来自 Twitter | MIT
|
||||
[PatternFly][4] | 开源框架，来自 Red Hat | MIT
|
||||
[MDC Web][5] | Material Design 组件开源框架，来自 Google | MIT
|
||||
[Pure][6] | 开源框架，来自 Yahoo | BSD
|
||||
[Foundation][7] | 前端框架，来自 Zurb 基金会 | MIT
|
||||
[Bulma][8] | 现代 CSS 框架，基于 Flexbox | MIT
|
||||
[Skeleton][9] | 轻量级 CSS 框架 | MIT
|
||||
[Materialize][10] | 基于 Material Design 的 CSS 框架 | MIT
|
||||
[Bootflat][11] | 开源 Flat UI 工具，基于 Bootstrap 3.3.0 | MIT
|
||||
|
||||
### Bootstrap
|
||||
|
||||
[Bootstrap][2] 无疑是最流行的 CSS 框架，它是所有前端 Web 设计的开端。Bootstrap 由 Twitter 开发，提供了可用性、功能性和可扩展性。
|
||||
|
||||
![Bootstrap homepage][13]
|
||||
|
||||
Bootstrap 还提供了大量的[例子][14]来帮助你入门。
|
||||
|
||||
![Bootstrap examples][15]
|
||||
|
||||
使用 Bootstrap，你可以将不同的组件和布局拼接在一起，创造出有趣的页面设计。它还提供了大量详细的文档。
|
||||
|
||||
![Bootstrap documentation][16]
|
||||
|
||||
Bootstrap 的 [GitHub][3] 仓库有超过 19000 个提交和 1100 个贡献者。它基于 MIT 许可证，所以（和这个列表中的所有框架一样）你也可以加入并贡献。
|
||||
|
||||
![Bootstrap GitHub][17]
|
||||
|
||||
### PatternFly
|
||||
|
||||
[PatternFly][18] 是由 Red Hat 开发的一个开源的（MIT 许可证）CSS 框架。PatternFly 采取了与 Bootstrap 不同的方法：Bootstrap 是为任何对创建一个漂亮网站感兴趣的人而设计的，而 PatternFly 主要针对企业级应用开发者，它提供的组件，如条形图、图表和导航，对于创建强大的、指标驱动的仪表盘非常有吸引力。事实上，Red Hat 在其产品（如 OpenShift）的设计中也使用了这个 CSS 框架。
|
||||
|
||||
![PatternFly homepage][19]
|
||||
|
||||
除了静态 HTML 之外，PatternFly 还支持 ReactJS 框架，ReactJS 是 Facebook 开发的一个流行的 JavaScript 框架。
|
||||
|
||||
![PatternFly ReactJS support][20]
|
||||
|
||||
PatternFly 有许多高级组件，如条形图、图表、[模态窗口][21]和布局等，适用于企业级应用。
|
||||
|
||||
![PatternFly chart component][22]
|
||||
|
||||
PatternFly 的 [GitHub][4] 页面列出了超过 1050 个提交和 44 个贡献者。PatternFly 得到了很多人的关注，欢迎大家踊跃贡献。
|
||||
|
||||
![PatternFly GitHub][23]
|
||||
|
||||
### MDC Web
|
||||
|
||||
凭借其大获成功的安卓平台，谷歌以一个名为 [Material Design][24] 的概念制定了自己的标准设计准则。Material Design 标准旨在体现在所有谷歌的产品中，这些标准也可以面向大众，并且在 MIT 许可证下开源。
|
||||
|
||||
![Material Design homepage][25]
|
||||
|
||||
Material Design 有许多“用于创建用户界面的交互式构建块”的[组件][26]。这些按钮、卡片、背景等可用于创建网站或移动应用程序的任何类型的用户界面。
|
||||
|
||||
![Material Components webpage][27]
|
||||
|
||||
维护人员为不同的平台提供了详尽的文档。
|
||||
|
||||
![Material Design documentation][28]
|
||||
|
||||
还有分步教程，其中包含用于实现不同目标的练习。
|
||||
|
||||
![Material Design tutorial][29]
|
||||
|
||||
Material 组件的 GitHub 页面承载了面向不同平台的存储库，包括用于网站开发的 [Material Web 组件（MDC Web）][5]。MDC Web 有超过 5700 个提交和 349 个贡献者。
|
||||
|
||||
![MDC Web GitHub][30]
|
||||
|
||||
### Pure
|
||||
|
||||
Bootstrap、Patternfly 和 MDC Web 都是非常强大的 CSS 框架，但是它们可能相当的笨重和复杂。如果你想要一个轻量级的 CSS 框架，它更接近于自己编写 CSS，但又能帮助你建立一个漂亮的网页，可以试试 [Pure.css][31]。Pure 是一个轻量级的 CSS 框架，它的体积很小。它是由 Yahoo 开发的，在 BSD 许可证下开源。
|
||||
|
||||
![Pure.css homepage][32]
|
||||
|
||||
尽管体积小，但 Pure 提供了建立一个漂亮网页的很多必要的组件。
|
||||
|
||||
![Pure.css components][33]
|
||||
|
||||
Pure 的 [GitHub][6] 页面显示它有超过 565 个提交和 59 个贡献者。
|
||||
|
||||
![Pure.css GitHub][34]
|
||||
|
||||
### Foundation
|
||||
|
||||
[Foundation][35] 号称是世界上最先进的响应式前端框架。它提供了先进的功能和教程，用于构建专业网站。
|
||||
|
||||
![Foundation homepage][36]
|
||||
|
||||
该框架被许多公司、组织甚至政客[使用][37]，并且有大量的文档可用。
|
||||
|
||||
![Foundation documentation][38]
|
||||
|
||||
Foundation 的 [GitHub][7] 页面显示有近 17000 个提交和 1000 个贡献者。和这个列表中的大多数其他框架一样，它也是在 MIT 许可证下提供的。
|
||||
|
||||
![Foundation GitHub][39]
|
||||
|
||||
### Bulma
|
||||
|
||||
[Bulma][40] 是一个基于 Flexbox 的开源框架，在 MIT 许可证下提供。Bulma 是一个相当轻量级的框架，因为它只需要一个 CSS 文件。
|
||||
|
||||
![Bulma homepage][41]
|
||||
|
||||
Bulma 有简洁明快的文档，让你可以很容易地选择你想要探索的主题。它也有很多网页组件，你可以直接拿起来在设计中使用。
|
||||
|
||||
![Bulma documentation][42]
|
||||
|
||||
Bulma 的 [GitHub][8] 页面列出了 1400 多个提交和 300 多个贡献者。
|
||||
|
||||
![Bulma GitHub][43]
|
||||
|
||||
### Skeleton
|
||||
|
||||
如果连 Pure 都觉得太重了，那么还有一个叫 [Skeleton][44] 的更轻量级框架。Skeleton 库只有 400 行左右的长度，而且这个框架只提供了开始你的 CSS 框架之旅的基本组件。
|
||||
|
||||
![Skeleton homepage][45]
|
||||
|
||||
尽管它很简单，但 Skeleton 提供了详细的文档，可以帮助你马上上手。
|
||||
|
||||
![Skeleton documentation][46]
|
||||
|
||||
Skeleton 的 [GitHub][9] 列出了 167 个提交和 22 个贡献者。然而，它不是很活跃，它的最后一次更新是在 2014 年，所以在使用之前可能需要一些维护。由于它是在 MIT 许可证下发布的，你可以自行维护。
|
||||
|
||||
![Skeleton GitHub][47]
|
||||
|
||||
### Materialize
|
||||
|
||||
[Materialize][48] 是一个基于 Google 的 Material Design 的响应式前端框架，带有由 Materialize 的贡献者开发的附加主题和组件。
|
||||
|
||||
![Materialize homepage][49]
|
||||
|
||||
Materialize 的文档页面非常全面，而且相当容易理解。它的组件页面包括按钮、卡片、导航等等。
|
||||
|
||||
![Materialize documentation][50]
|
||||
|
||||
Materialize 是 MIT 许可证下的开源项目，它的 [GitHub][10] 列出了超过 3800 个提交和 250 个贡献者。
|
||||
|
||||
![Materialize GitHub][51]
|
||||
|
||||
### Bootflat
|
||||
|
||||
[Bootflat][52] 是由 Twitter 的 Bootstrap 衍生出来的一个开源 CSS 框架。与 Bootstrap 相比， Bootflat 更简单，框架组件更轻量级。
|
||||
|
||||
![Bootflat homepage][53]
|
||||
|
||||
Bootflat 的[文档][54]几乎像是受到了宜家的启发 —— 它显示的是每个组件的图片，没有太多的文字。
|
||||
|
||||
![Bootflat docs][55]
|
||||
|
||||
Bootflat 是在 MIT 许可证下提供的，其 [GitHub][11] 页面包括 159 个提交和 8 个贡献者。
|
||||
|
||||
![Bootflat GitHub][56]
|
||||
|
||||
### 你应该选择哪个 CSS 框架？
|
||||
|
||||
对于开源的 CSS 框架，你有很多选择，这取决于你想要的工具功能有多丰富或简单。就像所有的技术决定一样，没有一个正确的答案，只有在给定的时间和项目中才有正确的选择。
|
||||
|
||||
尝试一下其中的一些，看看要在下一个项目中使用哪个。另外，我有没有错过任何有趣的开源 CSS 框架？请在下面的评论中分享你的反馈和想法。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/open-source-css-frameworks
|
||||
|
||||
作者：[Bryant Son][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[wxy](https://github.com/wxy)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/brson
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/browser_web_internet_website.png?itok=g5B_Bw62 (Digital creative of a browser on the internet)
|
||||
[2]: https://en.wikipedia.org/wiki/Cascading_Style_Sheets
|
||||
[3]: https://github.com/twbs/bootstrap
|
||||
[4]: https://github.com/patternfly/patternfly
|
||||
[5]: https://github.com/material-components/material-components-web
|
||||
[6]: https://github.com/pure-css/pure
|
||||
[7]: https://github.com/foundation/foundation-sites
|
||||
[8]: https://github.com/jgthms/bulma
|
||||
[9]: https://github.com/dhg/Skeleton
|
||||
[10]: https://github.com/Dogfalo/materialize
|
||||
[11]: https://github.com/bootflat/bootflat.github.io
|
||||
[12]: https://getbootstrap.com
|
||||
[13]: https://opensource.com/sites/default/files/uploads/2_bootstrapscreenshot.jpg (Bootstrap homepage)
|
||||
[14]: https://getbootstrap.com/docs/4.4/examples/
|
||||
[15]: https://opensource.com/sites/default/files/uploads/3_bootstrapsamples.jpg (Bootstrap examples)
|
||||
[16]: https://opensource.com/sites/default/files/uploads/4_bootstrapdocs.jpg (Bootstrap documentation)
|
||||
[17]: https://opensource.com/sites/default/files/uploads/5_bootstrapgithub.jpg (Bootstrap GitHub)
|
||||
[18]: https://www.patternfly.org
|
||||
[19]: https://opensource.com/sites/default/files/uploads/6_patternflyhomepage.jpg (PatternFly homepage)
|
||||
[20]: https://opensource.com/sites/default/files/uploads/7_patternflyreactjs.jpg (PatternFly ReactJS support)
|
||||
[21]: https://en.wikipedia.org/wiki/Modal_window
|
||||
[22]: https://opensource.com/sites/default/files/uploads/8_patternflycomponents.jpg (PatternFly chart component)
|
||||
[23]: https://opensource.com/sites/default/files/uploads/9_patternflygithub.jpg (PatternFly GitHub)
|
||||
[24]: https://material.io
|
||||
[25]: https://opensource.com/sites/default/files/uploads/10_materialhome.jpg (Material Design homepage)
|
||||
[26]: https://material.io/components/
|
||||
[27]: https://opensource.com/sites/default/files/uploads/11_materialcomponents.jpg (Material Components webpage)
|
||||
[28]: https://opensource.com/sites/default/files/uploads/12_materialdocs.jpg (Material Design documentation)
|
||||
[29]: https://opensource.com/sites/default/files/uploads/13_materialtutorial.jpg (Material Design tutorial)
|
||||
[30]: https://opensource.com/sites/default/files/uploads/15_materialgithub.jpg (MDC Web GitHub)
|
||||
[31]: https://purecss.io
|
||||
[32]: https://opensource.com/sites/default/files/uploads/16_purehome.jpg (Pure.css homepage)
|
||||
[33]: https://opensource.com/sites/default/files/uploads/17_purecomponents.jpg (Pure.css components)
|
||||
[34]: https://opensource.com/sites/default/files/uploads/18_puregithub.jpg (Pure.css GitHub)
|
||||
[35]: https://get.foundation
|
||||
[36]: https://opensource.com/sites/default/files/uploads/19_foundationhome.jpg (Foundation homepage)
|
||||
[37]: https://zurb.com/responsive
|
||||
[38]: https://opensource.com/sites/default/files/uploads/21_foundationdocs.jpg (Foundation documentation)
|
||||
[39]: https://opensource.com/sites/default/files/uploads/22_foundationgithub.jpg (Foundation GitHub)
|
||||
[40]: https://bulma.io
|
||||
[41]: https://opensource.com/sites/default/files/uploads/23_bulmahome.jpg (Bulma homepage)
|
||||
[42]: https://opensource.com/sites/default/files/uploads/24_bulmadoc.jpg (Bulma documentation)
|
||||
[43]: https://opensource.com/sites/default/files/uploads/25_bulmagithub.jpg (Bulma GitHub)
|
||||
[44]: http://getskeleton.com
|
||||
[45]: https://opensource.com/sites/default/files/uploads/26_skeletonhome.jpg (Skeleton homepage)
|
||||
[46]: https://opensource.com/sites/default/files/uploads/27_skeletondocs.jpg (Skeleton documentation)
|
||||
[47]: https://opensource.com/sites/default/files/uploads/28_skeletongithub.jpg (Skeleton GitHub)
|
||||
[48]: https://materializecss.com
|
||||
[49]: https://opensource.com/sites/default/files/uploads/29_materializehome.jpg (Materialize homepage)
|
||||
[50]: https://opensource.com/sites/default/files/uploads/30_materializedocs.jpg (Materialize documentation)
|
||||
[51]: https://opensource.com/sites/default/files/uploads/31_materializegithub.jpg (Materialize GitHub)
|
||||
[52]: http://bootflat.github.io
|
||||
[53]: https://opensource.com/sites/default/files/uploads/32_bootflathome.jpg (Bootflat homepage)
|
||||
[54]: http://bootflat.github.io/documentation.html
|
||||
[55]: https://opensource.com/sites/default/files/uploads/33_bootflatdocs.jpg (Bootflat docs)
|
||||
[56]: https://opensource.com/sites/default/files/uploads/34_bootflatgithub.jpg (Bootflat GitHub)
|
||||
@ -1,5 +1,5 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: translator: (lxbwolf)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (Acceleratorrrr)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (My Linux Story: From 8-bit enthusiast to Unix sysadmin)
|
||||
[#]: via: (https://opensource.com/article/20/4/linux-story)
|
||||
[#]: author: (James Farrell https://opensource.com/users/jamesf)
|
||||
|
||||
My Linux Story: From 8-bit enthusiast to Unix sysadmin
|
||||
======
|
||||
How my early interest in computers got me hooked on a career as a
|
||||
sysadmin and Linux fan.
|
||||
![Person typing on a 1980's computer][1]
|
||||
|
||||
It all started in the mid-1980s with an [Apple ][c][2] that my parents purchased for our family. Although I enjoyed playing games, I quickly became fascinated with BASIC programming and how useful it could be for work and fun. This was an era when computers were viewed as little more than typewriters, so people with "advanced computer skills" could easily use them to their advantage.
|
||||
|
||||
One example was using BASIC and a dot matrix printer to auto-generate punishment assignments. When I was assigned to write out 200 times some apologetic statements, I asked my teacher if it could be typed out. On confirmation, I wrote a 5 line BASIC program to generate it for me. Another example of subtle trickery was using non-WYSIWYG word processors, such as AppleWorks for micro-manipulation of fonts, line spacing, and margins to "stretch" term papers out to the required length.
|
||||
|
||||
My obsession with computers quickly lead to an Apple ][gs with a RAM drive card and an x86 PC co-processor card. Modems and BBSs were getting hot, and having a dual-hardware system like this gave me all sorts of options for software. However, modem speeds of 2400bps put a real damper on getting anything more than a few KBs of fun downloads per day. I stuck with Apple as a hobby for some time, but that was soon to change.
|
||||
|
||||
### Venturing into Unix
|
||||
|
||||
My undergraduate program was BS in Computer Information Systems (CIS) and my graduate degree was MS in Computer Science. My undergraduate education program put me mostly into PCs and a little into timeshare mainframes. The real fun began in my graduate programs, where dial-in access to Unix machines with internet connections opened a whole new world of exploration. Although I still used my dual-processor ][gs for modem work and writing and printing papers, Unix systems really grabbed my attention with their general-access Telnet-based games, FTP archives, online email, and C programming. Gopher was popular and growing with people like me who were bound to plain terminal interfaces.
|
||||
|
||||
My graduate program took a fateful turn for the better when I was assigned to the academic computing department, which was charged with running computer services for the school. The students had access to [Ultrix][3]-based systems with X Window terminals. Most were grayscale, as color processing was then a CPU intensive task and really affected system performance. The few color systems were nice, but those machines just dragged.
|
||||
|
||||
This was a really fun time for me, as I was given root access to systems and assigned to system and network maintenance. I had some excellent mentors, and this strongly influenced my decision to get into system administration rather than programming (although I still really love programming to this day).
|
||||
|
||||
### From Unix to Linux
|
||||
|
||||
Scarcity is the mother of invention, and we students often got creative when we had to share the scant resources of the school's computer systems. We had three to five times more students than we had Ultrix workstations, so finding resources (especially at project delivery time) was often a challenge. There was a bank of 56k [PPP][4] modems available for remote system access when graphical displays were not needed. However, finding a machine with spare resources and sharing the system for source compilation often resulted in slow progress. Like most, I found working at night often helped, but I needed something else to let me iterate more quickly.
|
||||
|
||||
Then one of the school's sysadmins suggested I check out a Unix system that was freely available. This was Linux, made available as 3.5" floppy images. Given our school's blazing fast T1 line, it was easy for me to search newsgroups and other sources to learn how to download it. It was all 32-bit Intel PC-based, a class of equipment that I did not own.
|
||||
|
||||
Luckily, my work at the school gave me access to junk piles of old computers, so the wheels started turning.
|
||||
|
||||
I found enough discarded PCs to build a solid 80386 PC with some decent RAM (I am sure well under 1GB), a workable graphic display, a thin-net (coax) Ethernet card, and a hard disk. The images I had were Linux kernel 0.98, and I don't recall it being part of an official distribution (it might have been SLS). What I do remember is that it came on a series of floppy images—the first booted the kernel and a minimal installer, next it formatted the drive, and then it asked for each successive floppy image to install the core GNU utilities. After the core was installed and the system bootable, you would download and install other package images, like compilers and such.
|
||||
|
||||
This was a serious boon to me in my academic career. With no X Window server display running, this PC seriously outperformed the Ultrix workstations I had access to at school. I was allowed to connect this machine to the academic network, mount the school's student Network File System (NFS) shares, and access the internet directly. Since my graduate program used [GCC][5] (and sometimes Perl 4) for most student work, I could do my development work locally. This gave me exclusive access to a key resource that enabled me to iterate more quickly on my projects.
|
||||
|
||||
All was not perfect, however. The hardware was a tiny bit unstable (likely why it was discarded), but I could deal with that. What really got me was how much Linux and Ultrix differed at the OS and system library level. I began to appreciate what it meant to port software to other platforms; I was free to develop wherever I wanted, but I had to deliver my projects as Ultrix compiled binaries. The C code that ran perfectly on one platform would crash on the other. This was very frustrating, but probably my rudest awakening was early Linux's handling of null-pointer dereferencing. Linux seemed happy to pass over these as a virtual no-op, but Ultrix promptly dumped core on [SIGSEGV][6]. This was quite a thing to find out when my first port to the target platform happened days before my project was due! This also made my exploration of C++ quite challenging, as my careless use of malloc()/free() along with automatic [constructor and destructor][7] processing peppered my projects with null pointer bombs all over the place.
|
||||
|
||||
Toward the end of my graduate program, I upgraded to a complete beast of a workstation—an Intel 486DX2 66MHz with SCSI hard drives, a CD-ROM drive, a 1024x768 RGB monitor, and a 16550 UART serial card perfectly matched to my new US Robotics V.Everything modem. It could dual-boot Windows and Linux, but more importantly, the graphics card and processor allowed a much more pleasant (and faster) development environment. The old 386 was still in service back at the school, but most of my heavy work and hacking now happened at home.
|
||||
|
||||
Similar to [Mike Harris' story][8] about Linux in the '90s, I really got into those CD bundles that were popular at the time. There was a new Micro Center computer store close to where I lived, and it was a goldmine of hobby PC parts, phenomenal technical books, and every conceivable Linux (and free Unix) CD archive. I remember [Yggdrasil][9] and [Slackware][10] being some of my favorite distributions. What was really incredible was the enormous size of CD storage—650MB! This was an essential resource for getting access to software. Yes, you could download the bits at 56k, but that was quite limiting. Not to mention the fact that most people could not afford to archive that much idle data for later perusal.
|
||||
|
||||
### And on to today
|
||||
|
||||
This is what kicked off my more than 25 years of system administration and open source software fun. Linux has been an important part of both my career and personal development. Nowadays, I am still heavily into Linux (mostly CentOS, RedHat, and Ubuntu), but often have fun with the likes of [FreeBSD][11] and other cool open source offerings.
|
||||
|
||||
My forays into Linux led me to Opensource.com, where I hope to give back a little and help bootstrap new generations of hands-on computer fun.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/linux-story
|
||||
|
||||
作者：[James Farrell][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/jamesf
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/1980s-computer-yearbook.png?itok=eGOYEKK- (Person typing on a 1980's computer)
|
||||
[2]: https://en.wikipedia.org/wiki/Apple_IIc
|
||||
[3]: https://en.wikipedia.org/wiki/Ultrix
|
||||
[4]: https://en.wikipedia.org/wiki/Point-to-Point_Protocol
|
||||
[5]: https://en.wikipedia.org/wiki/GNU_Compiler_Collection
|
||||
[6]: https://en.wikipedia.org/wiki/Segmentation_fault
|
||||
[7]: https://www.tutorialspoint.com/cplusplus/cpp_constructor_destructor.htm
|
||||
[8]: https://opensource.com/article/19/11/learning-linux-90s
|
||||
[9]: https://en.wikipedia.org/wiki/Yggdrasil_Linux/GNU/X
|
||||
[10]: http://slackware.com
|
||||
[11]: https://www.freebsd.org/
|
||||
@ -1,254 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (9 open source CSS frameworks for frontend web development)
|
||||
[#]: via: (https://opensource.com/article/20/4/open-source-css-frameworks)
|
||||
[#]: author: (Bryant Son https://opensource.com/users/brson)
|
||||
|
||||
9 open source CSS frameworks for frontend web development
|
||||
======
|
||||
Explore open source CSS frameworks and find the right one for your
|
||||
project.
|
||||
![Digital creative of a browser on the internet][1]
|
||||
|
||||
When most people think about web development, HTML or JavaScript usually come to mind. They usually forget about the technology that has far more impact on the ability to enjoy a website: [cascading style sheets (CSS)][2]. CSS is both one of the most important and the most often forgotten parts of any webpage, even though it's one of the three cornerstone technologies of the World Wide Web, according to Wikipedia.
|
||||
|
||||
This article explores nine popular, powerful, and open source frameworks that make CSS development straightforward for building beautiful website frontends.
|
||||
|
||||
Name | What It Is | License
|
||||
---|---|---
|
||||
[Bootstrap][3] | The most popular CSS framework; by Twitter | MIT
|
||||
[PatternFly][4] | Open source framework; by Red Hat | MIT
|
||||
[Material Components for the web][5] | Open source framework; by Google | MIT
|
||||
[Pure][6] | Open source framework; by Yahoo | BSD
|
||||
[Foundation][7] | Frontend framework; by Zurb Foundation | MIT
|
||||
[Bulma][8] | Modern CSS framework based on Flexbox | MIT
|
||||
[Skeleton][9] | Lightweight CSS framework | MIT
|
||||
[Materialize][10] | CSS framework based on Material Design | MIT
|
||||
[Bootflat][11] | Open source Flat UI kit based on Bootstrap 3.3.0 | MIT
|
||||
|
||||
|
||||
|
||||
If you prefer to follow along as I explore this live, you can watch my video.
|
||||
|
||||
### Bootstrap
|
||||
|
||||
[Bootstrap][12] is easily the most popular CSS framework, and it is the one that started all frontend web design. Developed by Twitter, Bootstrap offers usability, functionality, and extensibility.
|
||||
|
||||
![Bootstrap homepage][13]
|
||||
|
||||
Bootstrap also offers plenty of [examples][14] to get you started.
|
||||
|
||||
![Bootstrap examples][15]
|
||||
|
||||
With Bootstrap, you can stitch together different components and layouts to create an interesting page design. It also offers plenty of detailed documentation.
|
||||
|
||||
![Bootstrap documentation][16]
|
||||
|
||||
Bootstrap's [GitHub][3] repository lists more than 19,000 commits and 1,100 contributors. It is based on the MIT License, so (as with all of the frameworks on this list) you can jump in and contribute as well.
|
||||
|
||||
![Bootstrap GitHub][17]
|
||||
|
||||
### PatternFly
|
||||
|
||||
[PatternFly][18] is an open source (under the MIT License) CSS framework by Red Hat. PatternFly takes a different approach than Bootstrap: While Bootstrap is meant for anyone interested in creating a beautiful website, PatternFly is primarily focused on enterprise application developers and provides components, such as bars, charts, and navigations, that are very appealing for creating powerful, metrics-driven dashboards. In fact, Red Hat uses this CSS framework for the design of its products, such as OpenShift.
|
||||
|
||||
![PatternFly homepage][19]
|
||||
|
||||
In addition to static HTML, PatternFly also supports the ReactJS framework, a popular JavaScript framework developed by Facebook.
|
||||
|
||||
![PatternFly ReactJS support][20]
|
||||
|
||||
PatternFly has many advanced components, such as bars, charts, [modals][21], and layouts, that are suitable for enterprise-level applications.
|
||||
|
||||
![PatternFly chart component][22]
|
||||
|
||||
PatternFly's [GitHub][4] page lists more than 1,050 commits and 44 contributors. PatternFly is getting a lot of attention, and you are more than welcome to contribute.
|
||||
|
||||
![PatternFly GitHub][23]
|
||||
|
||||
### Material Components for the web
|
||||
|
||||
With its highly successful Android platform, Google set its own standard design guidelines with a concept called [Material Design][24]. The Material Design standards are intended to be reflected across all Google products, and they are also available to the general public and open source under the MIT License.
|
||||
|
||||
![Material Design homepage][25]
|
||||
|
||||
Material Design has a number of [Components][26], "interactive building blocks for creating a user interface." These buttons, cards, backdrops, and more can be used to create any type of user interface for a website or mobile application.
|
||||
|
||||
![Material Components webpage][27]
|
||||
|
||||
The maintainers provide thorough documentation for different platforms.
|
||||
|
||||
![Material Design documentation][28]
|
||||
|
||||
There are also step-by-step tutorials with exercises for accomplishing different goals.
|
||||
|
||||
![Material Design tutorial][29]
|
||||
|
||||
The Material Components GitHub page hosts repos for different platforms, including [Material Components for the web (MDC Web)][5] for website development. MDC Web has more than 5,700 commits and 349 contributors.
|
||||
|
||||
![MDC Web GitHub][30]
|
||||
|
||||
### Pure
|
||||
|
||||
Bootstrap, Patternfly, and MDC Web are very powerful CSS frameworks, yet they can be quite heavy and complex. If you want a lightweight CSS framework that it is closer to coding CSS yourself yet helps you build a nice web page, try [Pure.css][31]. Pure is a lightweight CSS framework with a minimal footprint. It was developed by Yahoo and is open source under the BSD License.
|
||||
|
||||
![Pure.css homepage][32]
|
||||
|
||||
Despite its small size, Pure offers plenty of the components necessary to build a good-looking webpage.
|
||||
|
||||
![Pure.css components][33]
|
||||
|
||||
Pure's [GitHub][6] page shows more than 565 commits and 59 contributors.
|
||||
|
||||
![Pure.css GitHub][34]
|
||||
|
||||
### Foundation
|
||||
|
||||
[Foundation][35] claims to be the most advanced responsive frontend framework in the world. It provides advanced features and tutorials for building professional websites.
|
||||
|
||||
![Foundation homepage][36]
|
||||
|
||||
The framework is [used][37] by many companies, organizations, and even politicians, and it has plenty of documentation available.
|
||||
|
||||
![Foundation documentation][38]
|
||||
|
||||
Foundation's [GitHub][7] page shows nearly 17,000 commits and 1,000 contributors. Like most of the other frameworks on this list, it's available under the MIT License.
|
||||
|
||||
![Foundation GitHub][39]
|
||||
|
||||
### Bulma
|
||||
|
||||
[Bulma][40] is an open source framework based on Flexbox and available under the MIT License. Bulma is a pretty lightweight framework, as it requires only one CSS file.
|
||||
|
||||
![Bulma homepage][41]
|
||||
|
||||
Bulma has clean and simple docs that make it easy to choose the topics you want to explore. It also has a number of web components you can just pick up and use in your design.
|
||||
|
||||
![Bulma documentation][42]
|
||||
|
||||
Bulma's [GitHub][8] page lists more than 1,400 commits and 300 contributors.
|
||||
|
||||
![Bulma GitHub][43]
|
||||
|
||||
### Skeleton
|
||||
|
||||
If even Pure is too heavy for you, there is an even lighter-weight framework called [Skeleton][44]. The Skeleton library is only about 400 lines long, and the framework provides only the essential components to start your CSS framework journey.
|
||||
|
||||
![Skeleton homepage][45]
|
||||
|
||||
Despite its simplicity, Skeleton offers detailed docs to help you get started right away.
|
||||
|
||||
![Skeleton documentation][46]
|
||||
|
||||
Skeleton's [GitHub][9] lists 167 commits and 22 contributors. However, it's not the most active project; its last update was in 2014, so it may need some maintenance before using it. Since it is released under the MIT License, feel free to do that yourself.
|
||||
|
||||
![Skeleton GitHub][47]
|
||||
|
||||
### Materialize
|
||||
|
||||
[Materialize][48] is a responsive frontend framework based on Google's Material Design with additional themes and components developed by Materialize's contributors.
|
||||
|
||||
![Materialize homepage][49]
|
||||
|
||||
Materialize's documentation page is comprehensive and pretty easy to follow. Its components page includes buttons, cards, navigations, and more.
|
||||
|
||||
![Materialize documentation][50]
|
||||
|
||||
Materialize is an open source project under the MIT License, and its [GitHub][10] lists more than 3,800 commits and 250 contributors.
|
||||
|
||||
![Materialize GitHub][51]
|
||||
|
||||
### Bootflat
|
||||
|
||||
[Bootflat][52] is an open source CSS framework derived from Twitter's Bootstrap. Compared to Bootstrap, Bootflat is simpler, with lighter-weight framework components.
|
||||
|
||||
![Bootflat homepage][53]
|
||||
|
||||
Bootflat's [documentation][54] almost seems inspired by IKEA—it shows an image of each component without much text.
|
||||
|
||||
![Bootflat docs][55]
|
||||
|
||||
Bootflat is available under the MIT License, and its [GitHub][11] page includes 159 commits and eight contributors, as of this writing.
|
||||
|
||||
![Bootflat GitHub][56]
|
||||
|
||||
### Which CSS framework should you choose?
|
||||
|
||||
You have many options for open source CSS frameworks, depending on how feature-rich or simple you want the tooling to be. Like all technology decisions, there is no single right answer for everything or everyone; there is only the right choice for the given time and the given project.
|
||||
|
||||
Give a few of these a spin and see which one you want to use in your next project. Also, did I miss any interesting open source CSS frameworks? Please share your feedback and ideas in the comments below.
|
||||
|
||||
Which frontend framework should you pick for your next web app? Pam Selle will address this...
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/open-source-css-frameworks
|
||||
|
||||
作者：[Bryant Son][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/brson
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/browser_web_internet_website.png?itok=g5B_Bw62 (Digital creative of a browser on the internet)
|
||||
[2]: https://en.wikipedia.org/wiki/Cascading_Style_Sheets
|
||||
[3]: https://github.com/twbs/bootstrap
|
||||
[4]: https://github.com/patternfly/patternfly
|
||||
[5]: https://github.com/material-components/material-components-web
|
||||
[6]: https://github.com/pure-css/pure
|
||||
[7]: https://github.com/foundation/foundation-sites
|
||||
[8]: https://github.com/jgthms/bulma
|
||||
[9]: https://github.com/dhg/Skeleton
|
||||
[10]: https://github.com/Dogfalo/materialize
|
||||
[11]: https://github.com/bootflat/bootflat.github.io
|
||||
[12]: https://getbootstrap.com
|
||||
[13]: https://opensource.com/sites/default/files/uploads/2_bootstrapscreenshot.jpg (Bootstrap homepage)
|
||||
[14]: https://getbootstrap.com/docs/4.4/examples/
|
||||
[15]: https://opensource.com/sites/default/files/uploads/3_bootstrapsamples.jpg (Bootstrap examples)
|
||||
[16]: https://opensource.com/sites/default/files/uploads/4_bootstrapdocs.jpg (Bootstrap documentation)
|
||||
[17]: https://opensource.com/sites/default/files/uploads/5_bootstrapgithub.jpg (Bootstrap GitHub)
|
||||
[18]: https://www.patternfly.org
|
||||
[19]: https://opensource.com/sites/default/files/uploads/6_patternflyhomepage.jpg (PatternFly homepage)
|
||||
[20]: https://opensource.com/sites/default/files/uploads/7_patternflyreactjs.jpg (PatternFly ReactJS support)
|
||||
[21]: https://en.wikipedia.org/wiki/Modal_window
|
||||
[22]: https://opensource.com/sites/default/files/uploads/8_patternflycomponents.jpg (PatternFly chart component)
|
||||
[23]: https://opensource.com/sites/default/files/uploads/9_patternflygithub.jpg (PatternFly GitHub)
|
||||
[24]: https://material.io
|
||||
[25]: https://opensource.com/sites/default/files/uploads/10_materialhome.jpg (Material Design homepage)
|
||||
[26]: https://material.io/components/
|
||||
[27]: https://opensource.com/sites/default/files/uploads/11_materialcomponents.jpg (Material Components webpage)
|
||||
[28]: https://opensource.com/sites/default/files/uploads/12_materialdocs.jpg (Material Design documentation)
|
||||
[29]: https://opensource.com/sites/default/files/uploads/13_materialtutorial.jpg (Material Design tutorial)
|
||||
[30]: https://opensource.com/sites/default/files/uploads/15_materialgithub.jpg (MDC Web GitHub)
|
||||
[31]: https://purecss.io
|
||||
[32]: https://opensource.com/sites/default/files/uploads/16_purehome.jpg (Pure.css homepage)
|
||||
[33]: https://opensource.com/sites/default/files/uploads/17_purecomponents.jpg (Pure.css components)
|
||||
[34]: https://opensource.com/sites/default/files/uploads/18_puregithub.jpg (Pure.css GitHub)
|
||||
[35]: https://get.foundation
|
||||
[36]: https://opensource.com/sites/default/files/uploads/19_foundationhome.jpg (Foundation homepage)
|
||||
[37]: https://zurb.com/responsive
|
||||
[38]: https://opensource.com/sites/default/files/uploads/21_foundationdocs.jpg (Foundation documentation)
|
||||
[39]: https://opensource.com/sites/default/files/uploads/22_foundationgithub.jpg (Foundation GitHub)
|
||||
[40]: https://bulma.io
|
||||
[41]: https://opensource.com/sites/default/files/uploads/23_bulmahome.jpg (Bulma homepage)
|
||||
[42]: https://opensource.com/sites/default/files/uploads/24_bulmadoc.jpg (Bulma documentation)
|
||||
[43]: https://opensource.com/sites/default/files/uploads/25_bulmagithub.jpg (Bulma GitHub)
|
||||
[44]: http://getskeleton.com
|
||||
[45]: https://opensource.com/sites/default/files/uploads/26_skeletonhome.jpg (Skeleton homepage)
|
||||
[46]: https://opensource.com/sites/default/files/uploads/27_skeletondocs.jpg (Skeleton documentation)
|
||||
[47]: https://opensource.com/sites/default/files/uploads/28_skeletongithub.jpg (Skeleton GitHub)
|
||||
[48]: https://materializecss.com
|
||||
[49]: https://opensource.com/sites/default/files/uploads/29_materializehome.jpg (Materialize homepage)
|
||||
[50]: https://opensource.com/sites/default/files/uploads/30_materializedocs.jpg (Materialize documentation)
|
||||
[51]: https://opensource.com/sites/default/files/uploads/31_materializegithub.jpg (Materialize GitHub)
|
||||
[52]: http://bootflat.github.io
|
||||
[53]: https://opensource.com/sites/default/files/uploads/32_bootflathome.jpg (Bootflat homepage)
|
||||
[54]: http://bootflat.github.io/documentation.html
|
||||
[55]: https://opensource.com/sites/default/files/uploads/33_bootflatdocs.jpg (Bootflat docs)
|
||||
[56]: https://opensource.com/sites/default/files/uploads/34_bootflatgithub.jpg (Bootflat GitHub)
|
||||
@ -1,161 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (Why strace doesn't work in Docker)
|
||||
[#]: via: (https://jvns.ca/blog/2020/04/29/why-strace-doesnt-work-in-docker/)
|
||||
[#]: author: (Julia Evans https://jvns.ca/)
|
||||
|
||||
Why strace doesn't work in Docker
|
||||
======
|
||||
|
||||
While editing the capabilities page of the [how containers work][1] zine, I found myself trying to explain why `strace` doesn’t work in a Docker container.
|
||||
|
||||
The problem here is – if you run `strace` in a Docker container, this happens:
|
||||
|
||||
```
|
||||
$ docker run -it ubuntu:18.04 /bin/bash
|
||||
$ # ... install strace ...
|
||||
[email protected]:/# strace ls
|
||||
strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted
|
||||
```
|
||||
|
||||
strace works using the `ptrace` system call, so if `ptrace` isn’t allowed, it’s definitely not gonna work! This is pretty easy to fix – on my machine, this fixes it:
|
||||
|
||||
```
|
||||
docker run --cap-add=SYS_PTRACE -it ubuntu:18.04 /bin/bash
|
||||
```
|
||||
|
||||
But I wasn’t interested in fixing it, I wanted to know why it happens. So why does strace not work, and why does `--cap-add=SYS_PTRACE` fix it?
|
||||
|
||||
### hypothesis 1: container processes are missing the `CAP_SYS_PTRACE` capability
|
||||
|
||||
I always thought the reason was that Docker container processes by default didn’t have the `CAP_SYS_PTRACE` capability. This is consistent with it being fixed by `--cap-add=SYS_PTRACE`, right?
|
||||
|
||||
But this actually doesn’t make sense for 2 reasons.
|
||||
|
||||
**Reason 1**: Experimentally, as a regular user, I can strace on any process run by my user. But if I check if my current process has the `CAP_SYS_PTRACE` capability, I don’t:
|
||||
|
||||
```
|
||||
$ getpcaps $$
|
||||
Capabilities for `11589': =
|
||||
```
|
||||
|
||||
**Reason 2**: `man capabilities` says this about `CAP_SYS_PTRACE`:
|
||||
|
||||
```
|
||||
CAP_SYS_PTRACE
|
||||
* Trace arbitrary processes using ptrace(2);
|
||||
```
|
||||
|
||||
So the point of `CAP_SYS_PTRACE` is to let you ptrace **arbitrary** processes owned by any user, the way that root usually can. You shouldn’t need it to just ptrace a regular process owned by your user.
|
||||
|
||||
And I tested this a third way – I ran a Docker container with `docker run --cap-add=SYS_PTRACE -it ubuntu:18.04 /bin/bash`, dropped the `CAP_SYS_PTRACE` capability, and I could still strace processes even though I didn’t have that capability anymore. What? Why?
|
||||
|
||||
### hypothesis 2: something about user namespaces???
|
||||
|
||||
My next (much less well-founded) hypothesis was something along the lines of “um, maybe the process is in a different user namespace and strace doesn’t work because of… reasons?” This isn’t really coherent but here’s what happened when I looked into it.
|
||||
|
||||
Is the container process in a different user namespace? Well, in the container:
|
||||
|
||||
```
|
||||
[email protected]:/# ls /proc/$$/ns/user -l
|
||||
... /proc/1/ns/user -> 'user:[4026531837]'
|
||||
```
|
||||
|
||||
On the host:
|
||||
|
||||
```
|
||||
[email protected]:~$ ls /proc/$$/ns/user -l
|
||||
... /proc/12177/ns/user -> 'user:[4026531837]'
|
||||
```
|
||||
|
||||
Because the user namespace ID (`4026531837`) is the same, the root user in the container is the exact same user as the root user on the host. So there’s definitely no reason it shouldn’t be able to strace processes that it created!
|
||||
|
||||
This hypothesis doesn’t make much sense but I hadn’t realized that the root user in a Docker container is the same as the root user on the host, so I thought that was interesting.
|
||||
|
||||
### hypothesis 3: the ptrace system call is being blocked by a seccomp-bpf rule
|
||||
|
||||
I also knew that Docker uses seccomp-bpf to stop container processes from running a lot of system calls. And ptrace is in the [list of system calls blocked by Docker’s default seccomp profile][2]! (actually the list of allowed system calls is a whitelist, so it’s just that ptrace is not in the default whitelist. But it comes out to the same thing.)
|
||||
|
||||
That easily explains why strace wouldn’t work in a Docker container – if the `ptrace` system call is totally blocked, then of course you can’t call it at all and strace would fail.
|
||||
|
||||
Let’s verify this hypothesis – if we disable all seccomp rules, can we strace in a Docker container?
|
||||
|
||||
```
|
||||
$ docker run --security-opt seccomp=unconfined -it ubuntu:18.04 /bin/bash
|
||||
$ strace ls
|
||||
execve("/bin/ls", ["ls"], 0x7ffc69a65580 /* 8 vars */) = 0
|
||||
... it works fine ...
|
||||
```
|
||||
|
||||
Yes! It works! Great. Mystery solved, except…
|
||||
|
||||
### why does `--cap-add=SYS_PTRACE` fix the problem?
|
||||
|
||||
What we still haven’t explained is: why does `--cap-add=SYS_PTRACE` would fix the problem?
|
||||
|
||||
The man page for `docker run` explains the `--cap-add` argument this way:
|
||||
|
||||
```
|
||||
--cap-add=[]
|
||||
Add Linux capabilities
|
||||
```
|
||||
|
||||
That doesn’t have anything to do with seccomp rules! What’s going on?
|
||||
|
||||
### let’s look at the Docker source code.
|
||||
|
||||
When the documentation doesn’t help, the only thing to do is go look at the source.
|
||||
|
||||
The nice thing about Go is, because dependencies are often vendored in a Go repository, you can just grep the repository to figure out where the code that does a thing is. So I cloned `github.com/moby/moby` and grepped for some things, like `rg CAP_SYS_PTRACE`.
|
||||
|
||||
Here’s what I think is going on. In containerd’s seccomp implementation, in [contrib/seccomp/seccomp_default.go][3], there’s a bunch of code that makes sure that if a process has a capability, then it’s also given access (through a seccomp rule) to use the system calls that go with that capability.
|
||||
|
||||
```
|
||||
case "CAP_SYS_PTRACE":
|
||||
s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{
|
||||
Names: []string{
|
||||
"kcmp",
|
||||
"process_vm_readv",
|
||||
"process_vm_writev",
|
||||
"ptrace",
|
||||
},
|
||||
Action: specs.ActAllow,
|
||||
Args: []specs.LinuxSeccompArg{},
|
||||
})
|
||||
```
|
||||
|
||||
There’s some other code that seems to do something very similar in [profiles/seccomp/seccomp.go][4] in moby and the [default seccomp profile][5], so it’s possible that that’s what’s doing it instead.
|
||||
|
||||
So I think we have our answer!
|
||||
|
||||
### `--cap-add` in Docker does a little more than what it says
|
||||
|
||||
The upshot seems to be that `--cap-add` doesn’t do exactly what it says it does in the man page, it’s more like `--cap-add-and-also-whitelist-some-extra-system-calls-if-required`. Which makes sense! If you have a capability like `CAP_SYS_PTRACE` which is supposed to let you use the `process_vm_readv` system call but that system call is blocked by a seccomp profile, that’s not going to help you much!
|
||||
|
||||
So allowing the `process_vm_readv` and `ptrace` system calls when you give the container `CAP_SYS_PTRACE` seems like a reasonable choice.
|
||||
|
||||
### that’s all!
|
||||
|
||||
This was a fun small thing to investigate, and I think it’s a nice example of how containers are made of lots of moving pieces that work together in not-completely-obvious ways.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://jvns.ca/blog/2020/04/29/why-strace-doesnt-work-in-docker/
|
||||
|
||||
作者：[Julia Evans][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://jvns.ca/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://wizardzines.com/zines/containers
|
||||
[2]: https://docs.docker.com/engine/security/seccomp/
|
||||
[3]: https://github.com/containerd/containerd/blob/4be98fa28b62e8a012491d655a4d6818ef87b080/contrib/seccomp/seccomp_default.go#L527-L537
|
||||
[4]: https://github.com/moby/moby/blob/cc0dfb6e7b22ad120c60a9ce770ea15415767cf9/profiles/seccomp/seccomp.go#L126-L132
|
||||
[5]: https://github.com/moby/moby/blob/master/profiles/seccomp/default.json#L723-L739
|
||||
@ -1,5 +1,5 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: ( )
|
||||
[#]: translator: (geekpi)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
|
||||
@ -1,108 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (geekpi)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (4 cool new projects to try in COPR for May 2020)
|
||||
[#]: via: (https://fedoramagazine.org/4-cool-new-projects-to-try-in-copr-for-april-2020/)
|
||||
[#]: author: (Dominik Turecek https://fedoramagazine.org/author/dturecek/)
|
||||
|
||||
4 cool new projects to try in COPR for May 2020
|
||||
======
|
||||
|
||||
![][1]
|
||||
|
||||
COPR is a [collection][2] of personal repositories for software that isn’t carried in Fedora. Some software doesn’t conform to standards that allow easy packaging. Or it may not meet other Fedora standards, despite being free and open source. COPR can offer these projects outside the Fedora set of packages. Software in COPR isn’t supported by Fedora infrastructure or signed by the project. However, it can be a neat way to try new or experimental software.
|
||||
|
||||
This article presents a few new and interesting projects in COPR. If you’re new to using COPR, see the [COPR User Documentation][3] for how to get started.
|
||||
|
||||
### Ytop
|
||||
|
||||
[Ytop][4] is a command-line system monitor similar to _htop_. The main difference between them is that _ytop_, on top of showing processes and their CPU and memory usage, shows graphs of system CPU, memory, and network usage over time. Additionally, _ytop_ shows disk usage and temperatures of the machine. Finally, _ytop_ supports multiple color schemes as well as an option to create new ones.
|
||||
|
||||
![][5]
|
||||
|
||||
#### Installation instructions
|
||||
|
||||
The [repo][6] currently provides _ytop_ for Fedora 30, 31, 32, and Rawhide, as well as EPEL 7. To install _ytop_, use these commands [with _sudo_][7]:
|
||||
|
||||
```
|
||||
sudo dnf copr enable atim/ytop
|
||||
sudo dnf install ytop
|
||||
```
|
||||
|
||||
### Ctop
|
||||
|
||||
[Ctop][8] is yet another command-line system monitor. However, unlike _htop_ and _ytop_, _ctop_ focuses on showing resource usage of containers. _Ctop_ shows both an overview of CPU, memory, network and disk usage of all containers running on your machine, and more comprehensive information about a single container, including graphs of resource usage over time. Currently, _ctop_ has support for Docker and runc containers.
|
||||
|
||||
![][9]
|
||||
|
||||
#### Installation instructions
|
||||
|
||||
The [repo][10] currently provides _ctop_ for Fedora 31, 32 and Rawhide, EPEL 7, as well as for other distributions. To install _ctop_, use these commands:
|
||||
|
||||
```
|
||||
sudo dnf copr enable fuhrmann/ctop
|
||||
sudo dnf install ctop
|
||||
```
|
||||
|
||||
### Shortwave
|
||||
|
||||
[Shortwave][11] is a program for listening to radio stations. Shortwave uses a community database of radio stations [www.radio-browser.info][12]. In this database, you can discover or search for radio stations, add them to your library, and listen to them. Additionally, Shortwave provides information about currently playing song and can record the songs as well.
|
||||
|
||||
![][13]
|
||||
|
||||
#### Installation instructions
|
||||
|
||||
The [repo][14] currently provides Shortwave for Fedora 31, 32, and Rawhide. To install Shortwave, use these commands:
|
||||
|
||||
```
|
||||
sudo dnf copr enable atim/shortwave
|
||||
sudo dnf install shortwave
|
||||
```
|
||||
|
||||
### Setzer
|
||||
|
||||
[Setzer][15] is a LaTeX editor that can build pdf documents and view them as well. It provides templates for various types of documents, such as articles or presentation slides. Additionally, Setzer has buttons for a lot of special symbols, math symbols and greek letters.
|
||||
|
||||
![][16]
|
||||
|
||||
#### Installation instructions
|
||||
|
||||
The [repo][17] currently provides Setzer for Fedora 30, 31, 32, and Rawhide. To install Setzer, use these commands:
|
||||
|
||||
```
|
||||
sudo dnf copr enable lyessaadi/setzer
|
||||
sudo dnf install setzer
|
||||
```
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://fedoramagazine.org/4-cool-new-projects-to-try-in-copr-for-april-2020/
|
||||
|
||||
作者：[Dominik Turecek][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://fedoramagazine.org/author/dturecek/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://fedoramagazine.org/wp-content/uploads/2017/08/4-copr-945x400.jpg
|
||||
[2]: https://copr.fedorainfracloud.org/
|
||||
[3]: https://docs.pagure.org/copr.copr/user_documentation.html#
|
||||
[4]: https://github.com/cjbassi/ytop
|
||||
[5]: https://fedoramagazine.org/wp-content/uploads/2020/04/ytop.png
|
||||
[6]: https://copr.fedorainfracloud.org/coprs/atim/ytop/
|
||||
[7]: https://fedoramagazine.org/howto-use-sudo/
|
||||
[8]: https://github.com/bcicen/ctop
|
||||
[9]: https://fedoramagazine.org/wp-content/uploads/2020/04/ctop.png
|
||||
[10]: https://copr.fedorainfracloud.org/coprs/fuhrmann/ctop/
|
||||
[11]: https://github.com/ranfdev/shortwave
|
||||
[12]: http://www.radio-browser.info/gui/#!/
|
||||
[13]: https://fedoramagazine.org/wp-content/uploads/2020/04/shortwave.png
|
||||
[14]: https://copr.fedorainfracloud.org/coprs/atim/shortwave/
|
||||
[15]: https://www.cvfosammmm.org/setzer/
|
||||
[16]: https://fedoramagazine.org/wp-content/uploads/2020/04/setzer.png
|
||||
[17]: https://copr.fedorainfracloud.org/coprs/lyessaadi/setzer/
|
||||
@ -0,0 +1,76 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (Acceleratorrrr)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (My Linux Story: From 8-bit enthusiast to Unix sysadmin)
|
||||
[#]: via: (https://opensource.com/article/20/4/linux-story)
|
||||
[#]: author: (James Farrell https://opensource.com/users/jamesf)
|
||||
|
||||
我的 Linux 故事：从8比特爱好者到 Unix 系统管理员
|
||||
======
|
||||
我是如何从一个电脑爱好者成为职业系统管理员和 Linux 粉丝的
|
||||
![Person typing on a 1980's computer][1]
|
||||
|
||||
故事得从1980年中期爸妈给家里购买[苹果 \]\[c][2] 开始。尽管很喜欢打游戏，但我还是很快被实用又好玩的 BASIC 编程迷住了。那个年代的人们还是把电脑当作打字机对待，所以懂电脑的人可以轻松使用他们的魔法。
|
||||
|
||||
用 BASIC 和点阵打印机自动生成惩罚作业来举个例子。被罚写两百遍道歉时，我问老师我可不可以打字代替手写。经过同意后，我写了5行 BASIC 语句来自动生成作业。另外一个小技巧是用非可视化文本编辑器，比如用 AppleWorks 微调字体，行距和边距，把学期报告扩充到要求的长度。
|
||||
|
||||
对电脑对喜爱很快让我接触到有 RAM 驱动和 x86 协处理器的苹果 ][gs。调制解调器和网络论坛刚开始火起来，它的双核处理器系统让我可以游刃有余的选择软件。但是由于调制解调器2400比特每秒的速度限制，下载任何超过几 KB 的东西都需要一天。我玩了不久之后就腻了。
|
||||
|
||||
### 探索 Unix
|
||||
|
||||
我的本科专业是计算机信息系统，硕士专业是计算机科学。本科教育主要是学习硬件和一些分时系统。研究生的时候才开始真正有意思起来，拨号上网简直打开了新世界的大门。尽管我依然用着我的双核 ][gs 来进行调制解调还有写写作业，不过Unix 系统让我真的热爱上方便的远程登录类游戏，文件传输协议，在线邮箱和 C 语言。当时 Gopher 非常受欢迎，特别是在我们这群终端用户中。
|
||||
|
||||
被分到学院计算机部门是我本科命运般的转折点，这个部门主管学校的计算机服务。学生们必须要用 X 视窗终端来登陆 [Ultrix][3] 系统。大部分都是黑白界面，彩色处理在当时非常占 CPU 也很影响系统性能。也有一些做的不错的彩色系统，但是这些机器都很慢。
|
||||
|
||||
我很喜欢那个时候，我有系统管理员权限而且工作是维护系统和网络。有一些出色的同事教我，他们对我选择从事系统管理员而不是程序员起了关键作用（尽管我至今热爱编程）。
|
||||
|
||||
### 从 Unix 到 Linux
|
||||
|
||||
稀缺是创造之母，当需要分享匮乏的学校电脑系统资源的时候，我们经常突发奇想。需要用电脑的学生是 Ultrix 工作站承受量的四到五倍，所以很难找到资源（特别是要交项目的时候）。虽然有一堆56k点对点协议的调制解调器处理远程系统访问，而且那时还不需要图像显示。但是发现一个有空余资源的机器然后分享出来的过程依然十分缓慢。和大部分人一样，我发现晚上加班很有效率，但我需要另外一些东西让我的项目迭代快一点。
|
||||
|
||||
后来学校但一个系统管理员建议我了解一个免费的 Unix 系统。那就是 Linux，被装在一个 3.5 英寸的软盘里。多亏我们学校超快的 T1 载波，让我很方便的查询到这个新群体和一些下载教程。这是一个我之前不曾接触过的32位网络计算机工具。
|
||||
|
||||
幸运的是，我的工作让我有机会使用一些淘汰的旧电脑，所以命运的齿轮又开始旋转起来。
|
||||
|
||||
我用一些报废的主机组装了一个可靠的，有足够 RAM 的80386台机（我确定不到 1GB），它有一个能用的显卡，一个细缆（同轴）以太网卡和一个硬盘。镜像用的是 Linux 内核0.98，不记得它是不是正式发行版的一部分了（可能是 SLS）。可我还能记得安装的一系列过程 - 首先启动内核和安装程序，然后格式化硬盘，接着要求每一个软盘安装 GNU 工具核心。核心装好之后，系统就可以启动了，你可以下载和安装其他的镜像包，比如编译器之类的。
|
||||
|
||||
这是我学术道路上巨大的福利。没有了 X 视窗显示，这台电脑性能比学校的 Ultrix 工作站强很多。学校允许我把这台机器连到校园网络，连接到学生网络文件系统，并且能直接接入内网。因为我研究生时主要用 [GNU 编译器套装][5] (还有 Perl 4)写作业，所以我可以进行本地开发。我可以使用这台主机作为独占资源来让我的项目更快迭代。
|
||||
|
||||
但是，这个方案不是完美的。硬件有时会有点不稳定（这可能就是放弃使用它的原因），但我都能搞定。操作系统和系统自带库层面才真正让我感受到 Linux 和 Ultrix 的不同。我开始领会到移植软件到其他操作系统的意义，我可以开发任何我想要的软件，但是我必须要把项目转换成 Ultrix 编译的二进制文件来传输。在一个平台上能运行的 C 语言可能在另一个平台出错。这让我非常沮丧，但是我可能本能的察觉到了早期 Linux 废弃空指针的方法。Linux 倾向于把它作为无操作处理，但是 Ultrix 会立即触发核心转储和段错误 [SIGSEGV][6]。这是正好在要交作业的几天之前，我第一次程序移植时的重大发现。这同时对我研究 C++ 造成了一些麻烦，因为我不小心使用同时使用 malloc()/free() 和自动[构造函数和析构函数]处理项目，结果空指针被炸得到处都是。
|
||||
|
||||
研究生快结束的时候，我用一颗英特尔 486DX2 66赫兹芯片和一块小型计算机系统接口硬盘，一块光驱和 一个1024x768 RGB 显示器将主机升级成了性能野兽。还把一个 16550 通用异步收发器完美组合到新的 US Robotics V.Everything 牌的调制解调器上。它可以跑 Windows 和 Linux 双系统，但最重要的是显卡和 CPU 的速度让开发环境幸福感倍增。那台旧的386依然在学校服役，不过我主要的工作都转移到了家里。
|
||||
|
||||
和 [麦克.哈里斯的故事][8] 里关于90年代的 Linux 类似，我真的对当时流行的光驱很着迷。我住的地方附近有小型电脑器材店，这个宝库充满了电脑配件，高级专业书籍和你能想到的任何 Linux （还有免费的 Unix）CD。我还记得[Yggdrasil][9]和[Slackware][10]是我最喜欢的发行版之一。更惊人的是 CD 650MB 巨大的存储量！使它成为软件必不可少载体。是的，你可以用56k 的速度下载，但是真的很慢。更别提大部分人负担不起将这么多闲置的数据存档供以后使用。
|
||||
|
||||
### 直到今天
|
||||
|
||||
就是这些开启了我长达25年的系统管理员和开源软件粉丝生涯。Linux 是我事业和个人开发中重要的一部分。最近我依旧醉心于 Linux （主要是 CentOS, RedHat, and Ubuntu)，但也经常从[FreeBSD][11]和其他炫酷开源系统中体验乐趣。
|
||||
|
||||
Linux 领导了我涉足 Opensource.com，我希望能回馈社区同时为下一代电脑出一份力。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/linux-story
|
||||
|
||||
作者：[James Farrell][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[Accelerator](https://github.com/Acceleratorrrr)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/jamesf
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/1980s-computer-yearbook.png?itok=eGOYEKK- (Person typing on a 1980's computer)
|
||||
[2]: https://en.wikipedia.org/wiki/Apple_IIc
|
||||
[3]: https://en.wikipedia.org/wiki/Ultrix
|
||||
[4]: https://en.wikipedia.org/wiki/Point-to-Point_Protocol
|
||||
[5]: https://en.wikipedia.org/wiki/GNU_Compiler_Collection
|
||||
[6]: https://en.wikipedia.org/wiki/Segmentation_fault
|
||||
[7]: https://www.tutorialspoint.com/cplusplus/cpp_constructor_destructor.htm
|
||||
[8]: https://opensource.com/article/19/11/learning-linux-90s
|
||||
[9]: https://en.wikipedia.org/wiki/Yggdrasil_Linux/GNU/X
|
||||
[10]: http://slackware.com
|
||||
[11]: https://www.freebsd.org/
|
||||
161
translated/tech/20200429 Why strace doesn-t work in Docker.md
Normal file
161
translated/tech/20200429 Why strace doesn-t work in Docker.md
Normal file
@ -0,0 +1,161 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (wxy)
|
||||
[#]: reviewer: (wxy)
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (Why strace doesn't work in Docker)
|
||||
[#]: via: (https://jvns.ca/blog/2020/04/29/why-strace-doesnt-work-in-docker/)
|
||||
[#]: author: (Julia Evans https://jvns.ca/)
|
||||
|
||||
为什么 strace 在 Docker 中不起作用？
|
||||
======
|
||||
|
||||
在编辑“容器如何工作”杂志的能力页面时，我想试着解释一下为什么 `strace` 在 Docker 容器中无法工作。
|
||||
|
||||
这里的问题是 —— 如果我在笔记本上的 Docker 容器中运行 `strace`，就会出现这种情况：
|
||||
|
||||
```
|
||||
$ docker run -it ubuntu:18.04 /bin/bash
|
||||
$ # ... install strace ...
|
||||
[email protected]:/# strace ls
|
||||
strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted
|
||||
```
|
||||
|
||||
`strace` 通过 `ptrace` 系统调用起作用，所以如果不允许使用 `ptrace`，它肯定是不能工作的! 这个问题很容易解决 —— 在我的机器上，是这样解决的：
|
||||
|
||||
```
|
||||
docker run --cap-add=SYS_PTRACE -it ubuntu:18.04 /bin/bash
|
||||
```
|
||||
|
||||
但我对如何修复它不感兴趣，我想知道为什么会出现这种情况。那么，为什么 `strace` 不能工作，为什么`--cap-add=SYS_PTRACE` 可以解决这个问题？
|
||||
|
||||
### 假设 1：容器进程缺少 `CAP_SYS_PTRACE` 能力。
|
||||
|
||||
我一直以为原因是 Docker 容器进程默认不具备 `CAP_SYS_PTRACE` 能力。这和它可以被 `--cap-add=SYS_PTRACE` 修复是一回事，是吧？
|
||||
|
||||
但这实际上是不合理的，原因有两个。
|
||||
|
||||
原因 1：在实验中，作为一个普通用户，我可以对我的用户运行的任何进程进行 `strace`。但如果我检查我的当前进程是否有 `CAP_SYS_PTRACE` 能力，则没有：
|
||||
|
||||
```
|
||||
$ getpcaps $$
|
||||
Capabilities for `11589': =
|
||||
```
|
||||
|
||||
原因 2：`capabilities` 的手册页对 `CAP_SYS_PTRACE` 的介绍是：
|
||||
|
||||
```
|
||||
CAP_SYS_PTRACE
|
||||
* Trace arbitrary processes using ptrace(2);
|
||||
```
|
||||
|
||||
所以，`CAP_SYS_PTRACE` 的作用是让你像 root 一样，可以对任何用户拥有的**任意**进程进行 `ptrace` 。你不需要用它来只是对一个由你的用户拥有的普通进程进行 `ptrace ` 。
|
||||
|
||||
我用第三种方法测试了一下 —— 我用 `docker run --cap-add=SYS_PTRACE -it ubuntu:18.04 /bin/bash` 运行了一个 Docker 容器，去掉了 `CAP_SYS_PTRACE` 能力，但我仍然可以跟踪进程，虽然我已经没有这个能力了。什么？为什么？
|
||||
|
||||
### 假设 2：关于用户命名空间的事情？
|
||||
|
||||
我的下一个（没有那么充分的依据的）假设是“嗯，也许这个过程是在不同的用户命名空间里，而 `strace` 不能工作，因为某种原因而行不通？”这个问题其实并不连贯，但这是我观察时想到的。
|
||||
|
||||
容器进程是否在不同的用户命名空间中？嗯，在容器中：
|
||||
|
||||
```
|
||||
root@e27f594da870:/# ls /proc/$$/ns/user -l
|
||||
... /proc/1/ns/user -> 'user:[4026531837]'
|
||||
```
|
||||
|
||||
在宿主机：
|
||||
|
||||
```
|
||||
bork@kiwi:~$ ls /proc/$$/ns/user -l
|
||||
... /proc/12177/ns/user -> 'user:[4026531837]'
|
||||
```
|
||||
|
||||
因为用户命名空间 ID（`4026531837`）是相同的，所以容器中的 root 用户和主机上的 root 用户是完全相同的用户。所以，绝对没有理由不能够对它创建的进程进行 `strace`!
|
||||
|
||||
这个假设并没有什么意义，但我（之前）没有意识到 Docker 容器中的 root 用户和主机上的 root 用户同一个，所以我觉得这很有意思。
|
||||
|
||||
### 假设 3：ptrace 系统的调用被 seccomp-bpf 规则阻止了
|
||||
|
||||
我也知道 Docker 使用 seccomp-bpf 来阻止容器进程运行许多系统调用。而 `ptrace` 在[被 Docker 默认的 seccomp 配置文件阻止的系统调用列表][2]中!（实际上，允许的系统调用列表是一个白名单，所以只是`ptrace` 不在默认的白名单中。但得出的结果是一样的。）
|
||||
|
||||
这很容易解释为什么 `strace` 在 Docker 容器中不能工作 —— 如果 `ptrace` 系统调用完全被屏蔽了，那么你当然不能调用它，`strace` 就会失败。
|
||||
|
||||
让我们来验证一下这个假设 —— 如果我们禁用了所有的 seccomp 规则，`strace` 能在 Docker 容器中工作吗？
|
||||
|
||||
```
|
||||
$ docker run --security-opt seccomp=unconfined -it ubuntu:18.04 /bin/bash
|
||||
$ strace ls
|
||||
execve("/bin/ls", ["ls"], 0x7ffc69a65580 /* 8 vars */) = 0
|
||||
... it works fine ...
|
||||
```
|
||||
|
||||
是的，很好用！很好。谜底解开了，除了.....
|
||||
|
||||
### 为什么 `--cap-add=SYS_PTRACE` 能解决问题？
|
||||
|
||||
我们还没有解释的是：为什么 `--cap-add=SYS_PTRACE` 可以解决这个问题？
|
||||
|
||||
`docker run` 的手册页是这样解释 `--cap-add` 参数的。
|
||||
|
||||
```
|
||||
--cap-add=[]
|
||||
Add Linux capabilities
|
||||
```
|
||||
|
||||
这跟 seccomp 规则没有任何关系! 怎么回事？
|
||||
|
||||
### 我们来看看 Docker 源码
|
||||
|
||||
当文档没有帮助的时候，唯一要做的就是去看源码。
|
||||
|
||||
Go 语言的好处是，因为依赖关系通常是在一个 Go 仓库里，你可以通过 `grep` 来找出做某件事的代码在哪里。所以我克隆了 `github.com/moby/moby`，然后对一些东西进行 `grep`，比如 `rg CAP_SYS_PTRACE`。
|
||||
|
||||
我认为是这样的。在 `containerd` 的 seccomp 实现中，在 [contrib/seccomp/seccomp/seccomp_default.go][3] 中，有一堆代码确保如果一个进程有一个能力，那么它也会（通过 seccomp 规则）获得访问权限，以使用与该能力相关的系统调用。
|
||||
|
||||
```
|
||||
case "CAP_SYS_PTRACE":
|
||||
s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{
|
||||
Names: []string{
|
||||
"kcmp",
|
||||
"process_vm_readv",
|
||||
"process_vm_writev",
|
||||
"ptrace",
|
||||
},
|
||||
Action: specs.ActAllow,
|
||||
Args: []specs.LinuxSeccompArg{},
|
||||
})
|
||||
```
|
||||
|
||||
在 moby 中的 [profile/seccomp/seccomp.go][4] 和 [默认的 seccomp 配置文件][5]中，也有一些其他的代码似乎做了一些非常类似的事情，所以有可能就是这个代码在做这个事情。
|
||||
|
||||
所以我想我们有答案了!
|
||||
|
||||
### Docker 中的 `--cap-add` 做的事情比它说的要多
|
||||
|
||||
结果似乎是，`--cap-add` 并不像手册页里说的那样，它更像是 `--cap-add-and-also-whiteelist-some-extra-system-calls-if-required`。这很有意义! 如果你具有一个像 `--CAP_SYS_PTRACE` 这样的能力，可以让你使用 `process_vm_readv` 系统调用，但是该系统调用被 seccomp 配置文件阻止了，那对你没有什么帮助！
|
||||
|
||||
所以当你给容器 `CAP_SYS_PTRACE` 能力时，允许使用 `process_vm_readv` 和 `ptrace` 系统调用似乎是一个合理的选择。
|
||||
|
||||
### 就这样！
|
||||
|
||||
这是个有趣的小事情，我认为这是一个很好的例子，说明了容器是由许多移动的部件组成的，它们以不完全显而易见的方式一起工作。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://jvns.ca/blog/2020/04/29/why-strace-doesnt-work-in-docker/
|
||||
|
||||
作者：[Julia Evans][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[wxy](https://github.com/wxy)
|
||||
校对：[wxy](https://github.com/wxy)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://jvns.ca/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://wizardzines.com/zines/containers
|
||||
[2]: https://docs.docker.com/engine/security/seccomp/
|
||||
[3]: https://github.com/containerd/containerd/blob/4be98fa28b62e8a012491d655a4d6818ef87b080/contrib/seccomp/seccomp_default.go#L527-L537
|
||||
[4]: https://github.com/moby/moby/blob/cc0dfb6e7b22ad120c60a9ce770ea15415767cf9/profiles/seccomp/seccomp.go#L126-L132
|
||||
[5]: https://github.com/moby/moby/blob/master/profiles/seccomp/default.json#L723-L739
|
||||
@ -0,0 +1,108 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (geekpi)
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (4 cool new projects to try in COPR for May 2020)
|
||||
[#]: via: (https://fedoramagazine.org/4-cool-new-projects-to-try-in-copr-for-april-2020/)
|
||||
[#]: author: (Dominik Turecek https://fedoramagazine.org/author/dturecek/)
|
||||
|
||||
COPR 仓库中 4 个很酷的新项目（2020.05）
|
||||
======
|
||||
|
||||
![][1]
|
||||
|
||||
COPR 是个人软件仓库[集合][2]，它不在 Fedora 中。这是因为某些软件不符合轻松打包的标准；或者它可能不符合其他 Fedora 标准，尽管它是自由而开源的。COPR 可以在 Fedora 套件之外提供这些项目。COPR 中的软件不受 Fedora 基础设施的支持，或者是由项目自己背书的。但是，这是一种尝试新的或实验性的软件的一种巧妙的方式。
|
||||
|
||||
本文介绍了 COPR 中一些有趣的新项目。如果你第一次使用 COPR，请参阅 [COPR 用户文档][3]。
|
||||
|
||||
### Ytop
|
||||
|
||||
[ytop][4] 是类似于 _htop_ 的命令行系统监视器。它们之间的主要区别是 _ytop_ 在显示进程及 CPU 和内存使用率的顶部，还显示了系统 CPU、内存和网络使用率随时间变化的图表。此外，_ytop_ 显示磁盘使用情况和计算机温度。最后，_ytop_ 支持多种配色方案以及创建新配色的选项。
|
||||
|
||||
![][5]
|
||||
|
||||
#### 安装说明
|
||||
|
||||
[仓库][6]当前为 Fedora 30、31、32 和 Rawhide 以及 EPEL 7 提供 _ytop_。要安装 _ytop_，请[带上 _sudo_][7] 使用以下命令：
|
||||
|
||||
```
|
||||
sudo dnf copr enable atim/ytop
|
||||
sudo dnf install ytop
|
||||
```
|
||||
|
||||
### Ctop
|
||||
|
||||
[ctop][8] 是另一个命令行系统监视器。但是，与 _htop_ 和 _ytop_ 不同，_ctop_ 专注于显示容器的资源使用情况。_ctop_ 同时显示计算机上运行的所有容器的CPU、内存、网络和磁盘使用情况的概要，以及单个容器的更全面的信息，包括一段时间内资源使用情况的图表。当前，_ctop_ 支持 Docker 和 runc 容器。
|
||||
|
||||
![][9]
|
||||
|
||||
#### 安装说明
|
||||
|
||||
[仓库][10]当前为 Fedora 31、32 和 Rawhide 以及 EPEL 7 还有其他发行版提供安装包。要安装 _ctop_，请使用以下命令：
|
||||
|
||||
```
|
||||
sudo dnf copr enable fuhrmann/ctop
|
||||
sudo dnf install ctop
|
||||
```
|
||||
|
||||
### Shortwave
|
||||
|
||||
[shortwave][11] 是用于收听广播电台的程序。shortwave 使用广播电台的社区数据库 [www.radio-browser.info][12]。在此数据库中，你可以发现或搜索广播电台，将它们添加到库中，然后收听。此外，shortwave 还提供有关当前播放歌曲的信息，并且还可以记录这些歌曲。
|
||||
|
||||
![][13]
|
||||
|
||||
#### 安装说明
|
||||
|
||||
[仓库][14] 当前为 Fedora 31、32 和 Rawhide 提供 shortwave。要安装 shortwave，请使用以下命令：
|
||||
|
||||
```
|
||||
sudo dnf copr enable atim/shortwave
|
||||
sudo dnf install shortwave
|
||||
```
|
||||
|
||||
### Setzer
|
||||
|
||||
[setzer][15] 是 LaTeX 编辑器，它可以构建 pdf 文档并查看它们。它提供了各种类型文档（例如文章或幻灯片）的模板。此外，setzer 还有许多特殊符号，数学符号和希腊字母的按钮。
|
||||
|
||||
![][16]
|
||||
|
||||
#### 安装说明
|
||||
|
||||
[仓库][17] 当前为Fedora 30、31、32 和 Rawhide 提供 setzer。要安装 setzer，请使用以下命令：
|
||||
|
||||
```
|
||||
sudo dnf copr enable lyessaadi/setzer
|
||||
sudo dnf install setzer
|
||||
```
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://fedoramagazine.org/4-cool-new-projects-to-try-in-copr-for-april-2020/
|
||||
|
||||
作者：[Dominik Turecek][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[geekpi](https://github.com/geekpi)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://fedoramagazine.org/author/dturecek/
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://fedoramagazine.org/wp-content/uploads/2017/08/4-copr-945x400.jpg
|
||||
[2]: https://copr.fedorainfracloud.org/
|
||||
[3]: https://docs.pagure.org/copr.copr/user_documentation.html#
|
||||
[4]: https://github.com/cjbassi/ytop
|
||||
[5]: https://fedoramagazine.org/wp-content/uploads/2020/04/ytop.png
|
||||
[6]: https://copr.fedorainfracloud.org/coprs/atim/ytop/
|
||||
[7]: https://fedoramagazine.org/howto-use-sudo/
|
||||
[8]: https://github.com/bcicen/ctop
|
||||
[9]: https://fedoramagazine.org/wp-content/uploads/2020/04/ctop.png
|
||||
[10]: https://copr.fedorainfracloud.org/coprs/fuhrmann/ctop/
|
||||
[11]: https://github.com/ranfdev/shortwave
|
||||
[12]: http://www.radio-browser.info/gui/#!/
|
||||
[13]: https://fedoramagazine.org/wp-content/uploads/2020/04/shortwave.png
|
||||
[14]: https://copr.fedorainfracloud.org/coprs/atim/shortwave/
|
||||
[15]: https://www.cvfosammmm.org/setzer/
|
||||
[16]: https://fedoramagazine.org/wp-content/uploads/2020/04/setzer.png
|
||||
[17]: https://copr.fedorainfracloud.org/coprs/lyessaadi/setzer/
|
||||
Loading…
Reference in New Issue
Block a user