Identifying Container Image vulnerabilities with Docker Scout

We all know, that Docker technology is great and brings us many advantages, but also, unfortunately, Docker images include many attack surfaces on different layers.

Every day, there are new vulnerabilities discovered in open source projects and maintainers are tasked with patching their software. \~30k new vulnerabilities discovered in 2023 alone.

So how can we mitigate this risk? One solution is vulnerability scanning and its integration into your development lifecycle.

This video shows how to use Docker Scout to secure your Docker images

https://redd.it/1d3insy
@r_devops

Kubernetes is not DevOps.

See it time and time again here with people asking what to learn or creating roadmaps for DevOps saying you "need" Kubernetes (K8S) but that's such an incorrect statement.

Are there companies out there that use it and want you to have it? Sure. Many of those will never actually leverage it in the way it is constructed. Often times you will spend more time fixing issues with Kubernetes than you would other solutions. Kubernetes is container orchestration at scale, At Scale means "large volumes", which many companies don't have. I have worked for larger companies whose clusters almost never scaled and when they did they were minor. To the point that they spent more on K8S management, upkeep, and spending (servers on prem or cloud cost) than they made with systems on K8S.

Does this mean those companies built it incorrectly? Not all the time, no, it more often mean s that they were sold a solution for a problem they didn't have.

I want to be clear, you should ensure you learn Containerization. That is a modern framework for handling any application that's been made for or updated to handle it. Containers can be deployed on a variety of systems, both Kubernetes and not, and should be leveraged as such.

This ultimately comes down to a business case. Are you scaling, or planning to scale, at high levels? Say over 100 or 500 or greater? Yep Kubernetes is probably the solution you want at that point. Are you scaling less than 100, or 50, or 10? Other solutions are capable to assist you here for less cost and work.

From the azure end alone you have Container Instances and App Services which can host containers natively for both Windows and Linux. They have scale settings to allow up or out. They also have a much lower management overhead and cost overhead associated to them. AWS and GCP both have similar offerings that can be used instead.

Should you learn Version Control (git in most cases), a programming language (optional usually depending on the role you want), monitoring, log handling, IaC, Containerization, scripting, CI/CD? Yes to almost all. Should you learn Kubernetes? Only if the jobs you want need it.

https://redd.it/1d3kexn
@r_devops

Docker to kubernetes

Any advice here much welcome.
My company are transitioning from a monolithic architecture to breaking this up into microservices for future scaling and deployment of individual components.

We already have broken a few services out of the monolith into independant microservices, but there are now plans to do all. Docker was OK to manage 5 microservices or so but will be eventually running 20+ so moving to k8s makes sense.

I have a bit of previous k8s experience, but when it comes to moving a monolith architecture to separate services, I am wondering what the best approach is.
Is the best route to break up the monolith and after everything is running as its own docker container, port this to k8s, or is it better to transition the current microservices to k8s and the break up the monolith and add to the kubernetes cluster as I go?

I ask because both routes involve a lot of work, and anyone with a bit of experience of doing something similar in the past can share any knowledge or do's/don'ts when approaching this. Thanks

https://redd.it/1d3lrui
@r_devops

Is KodeKloud Standard sufficient enough to get you to feel confident about getting into DevOps or is KodeKloud Pro needed for that?

Nothing more than the above inquiry. Right now I’m learning on my own but could use some guidance. I was told to check out KodeKloud. I hear great things about it but noticed they have a tier subscription. 450 dollars a year for Pro is steep. I would have to cut my personal entertainment budget in half to afford that. Meanwhile, the Standard tier is cheaper but I’m not sure if it’s worth getting.

https://redd.it/1d3mfv1
@r_devops

Survey on the Best Reverse Proxy for Instant Rollback in Docker Deployments: Traefik vs. Nginx vs. OpenResty

Hello r/devops!

I am conducting a research study to determine the best reverse proxy solution for implementing an instant rollback feature in Docker deployments. If you have experience with Traefik, Nginx, or OpenResty, your insights would be incredibly valuable. The survey will take about 5-10 minutes to complete, and your responses will help identify the strengths and weaknesses of each reverse proxy in real-world scenarios.

Thank you in advance for your participation!

Link to Survey

https://redd.it/1d3jxoo
@r_devops

Test and stage environments strategy?

Good morning.

I want to share a question with you to see if you can clear up my doubts.

What do you consider the responsibilities and activities of a person who has to define and maintain the strategy of the test and stage environments? This person will work in the Test and Release Unit, which is responsible for test cases (test factory, quality, automation, execution...) and the company's software releases.

As proposed, it seems to be an ambiguous responsibility. I would like to know what you understand by this statement.

Many thanks for everything

https://redd.it/1d3jnnd
@r_devops

Moving selected files to glacier

I have a folder named "system" in which there are several files and folders I want to move all these except a folder named "second" To glacier.
How can I do this?

https://redd.it/1d3eq41
@r_devops

Can I get into devops as a network administrator?

Hi, I am 32, recently graduated with a bachelor's degree in computer science and electronics engineering.

I have some experience(school projects) with C++, Java, C#, Python (a little bit more than novice I think. Practicing leetcode atm).

I have slight experience working as a desktop support + currently working as a network administrator at a university. Do you think there is any chance to break into devOps industry?

Any thoughts or comments are appreciated! Thank you!




https://redd.it/1d3rtpa
@r_devops

Senior DevOps/Cloud Engineer/...?

What things have you done that make you think you are ready/qualified for upgrading from middle to senior level ?

https://redd.it/1d3vhvw
@r_devops

Linode LKE, anyone with experience?

i was really surprised by their cheap prices. 48 bucks for a cluster with medium power instances including network infra. or even smaller one with no cost to master nodes. can be 20$..

compared to the minimum of 130$ EKS+worker+network infra. of aws, which is the cheaper between GPC and azure. i think.


anyone have experience with linode then?

https://redd.it/1d3vqbn
@r_devops

3 Environment ( Dev, Stage, Prod) Deployment using GitHub action

Hi Folks,

I'm here to learn about the best practices. I want to create a GitHub action for CI for the above 3 environments. Should I create 3 separate yaml files for all 3 environments in workflows?

I also want to handle 3 different configuration files for example I have config.prod.yaml and I'm copying that into a docker file the same as I have for stage and dev how can I manage these files as well in GitHub action for different branches?

Right now I'm copying the config. prod.yaml into DOckerfile on build time I want to make it dynamic

i want to achieve this workflow ( feature -> PR -> Dev -> PR -> Stage -> PR -> Prod)


and then I will do the CD part with gitops using ArgoCD

​

Do you have any suggestions on how I can achieve the above scenario well or with the best practice?

https://redd.it/1d3ymjc
@r_devops

Hold up, can software actually be FRUGAL?

Ugh, phone troubles! My husband just got a new phone 8 months ago and already wants to upgrade because it's "slow." It really makes you think about how disposable tech feels these days.

Back in my day (yeah, I might be getting old!), we used things for ages and repurposed them whenever possible. Now, it's all about ditching the old for the new. But honestly, when does it stop? Every upgrade seems to slow my phone down even more!

But what if there was a better way? Imagine software that:

* Runs smoothly on even the oldest phones (those flip phones were built to last!)
* Keeps working for years, like a trusty pair of jeans (no more upgrade nightmares!)
* Saves battery like a champ (hello, longer screen time!)
* Takes up barely any storage space (storage who?)
* Helps you do more with less (because sometimes simple is just better!)

Is this just a dream, or is frugal software the future? When will we ditch this constant upgrade cycle and build software that's user-friendly, efficient, and lets EVERYONE join in, no matter what device they have!

https://redd.it/1d3zt1h
@r_devops

How can management efficiently handle 10 servers with the same stack?

I have a problem with my server structure.

I have a scraper script on more than 10 servers.
btw. This server is on a different provider, etc.

Currently, I am installing the same library on each server, setting up the repository on each instance, committing changes on one instance, and then updating all servers.

I have to log in via SSH to each server to run the same commands. My stack includes Ubuntu 22.04 and Docker Compose on each instance.

How can I automate my workflow for easy management without overengineering? I am thinking about Ansible, but maybe there is a simpler, easier solution?

https://redd.it/1d40868
@r_devops

Career change to DevOps.

Hi, I am 34. I work in IT consultancy. I have 5 years of experience as a back-end (Java) developer and another 4 years as... I don't know wtf I am. I'm in cybersecurity, but quite distant from the technical environment. I have meetings, review architectures, carry out threat models, have meetings, make Powerpoint presentations, write security policies, review DevOps practices from the security point of view, have meetings...

I want to go back to the technical aspect of my day to day, where I got to code, implement tools, maybe get to maintain pipelines...

Basically I am debating between going back to dev or trying to shift to DevOps (with almost no experience in that field).

I would like to know your opinion, or if someone found themselves in this situation.

https://redd.it/1d40v5g
@r_devops

Flutter Mobile CI/CD

I am wondering about what different stages people use in their CI Pipeline configuation. I have successfully implemented different scan stages through Sonar, also a successful Build stage. What could I implement more after that?

https://redd.it/1d41tbd
@r_devops

What do you wish Jenkins could do better ?

While still widely used where do you wish it can benefit from improvements ?

https://redd.it/1d43n2x
@r_devops

Managing Wing Libraries with AWS CodeArtifact

TL;DR

Asher Sterkin published an article that analyzes managing Wing libraries using AWS CodeArtifact.

Check out the full article here!

https://redd.it/1d4479c
@r_devops

SRE looking to transition to security

I've been working as a sysadmin -> DevOps -> SRE for over 10 years (on premisis, cloud, AWS, K8S) and looking to shake it up a bit and get onto a security operations team. That type of role doesn't exist where I'm currently working...but trying to understand what I should learn to get me in the door and build off of skills I already have.

Anyone have advice or a guide to making this career transition?

https://redd.it/1d436qn
@r_devops

Best practices to manage and deploy IaC

Hi! So I'm going to work as a junior cloud engineer soon (I've just graduated in IT) and chatting to one of the engineers in the company (there are like three of them, so it's a relatively small environment) he told me that they do everything by hand from the GUI. So the infrastructure they design is then deployed by hand.

Being a bit of a geek, and having enjoyed developing software i have already imagined a future where I can get the company to change its ways and start using IaC to manage infrastructure. Now, a doubt has come to my mind, could any of you tell me how the deployment part usually works in a professional and large context?

Suppose you have an infrastructure defined by terraform code, how would you go about ensuring an optimal workflow while virtually minimizing failures when going into production?

I personally imagined such a scenario. 3 branches, respectively production, staging and development.

On development you introduce new features and update the infrastructure, merge to the development branch only requires that the code is syntactically correct. After that, once some functionality has been introduced, we merge to staging where, through git hub actions, we run tests (terratest or terraform test) to make sure the infrastructure meets the logical requirements and that everything works correctly.
After that, maybe we can do some manual testing and if we realise that everything is working fine, we can merge it in production and deploy it.

Does this make sense?

https://redd.it/1d47gly
@r_devops

Infisical releases native K8s/AWS/GCP/Azure auth methods for secrets management

Infisical is unveiling not 1, not 2, but 4 new native authentication methods for Kubernetes, AWS, GCP, and Azure.

With this update, it is now possible for applications to fetch secrets back from Infisical without needing to explicitly manage an additional secret to authenticate with the platform in the first place (i.e. avoid secret zero).

Here’s how each method works:

Kubernetes Auth: Pods can use Kubernetes-native service accounts to have a service account credential mounted at a specified path. This credential can be used to authenticate with Infisical.

AWS Auth: AWS IAM principals for services like EC2 and Lambda can send a signed query containing a computed signature specific to the underlying IAM principal to authenticate with Infisical.

GCP Auth: GCP services like Compute Engine, App Engine, Cloud Functions, and Kubernetes Engine can use GCP-native ID tokens to authenticate with Infisical.

Azure Auth: Azure services like VMs, App Services, Functions, and Kubernetes Service can use Azure-native managed identity access tokens to authenticate with Infisical.

By treating Kubernetes, AWS, GCP, and Azure as trusted identity providers to supply and verify native platform tokens, we achieve a near “secretless” authentication pattern for applications running on these platforms. It’s now as seamless as pointing your application to Infisical to fetch back secrets.

Link to documentation: https://infisical.com/docs/documentation/platform/identities/machine-identities

https://redd.it/1d478jy
@r_devops

How likely is it to get into Dev Ops right after finishing College without any experience in it?

I don't have a strong coding background but I wanted to try getting into Dev Ops, but I don't know where to start and what resources I should follow and what I exactly need to know and what kind of projects I need to do, I have researched about it and most of the post say that you do not need much coding , you need just the basic networking knowledge(How much is basic I do not know) and you need to know about Linux commands, Git, CI(Jenkins), docker, Virtualization at least to get a intern?

Can i break into this field? I have basic knowledge that I had studied during bachelors in networking and some basic coding skills(Only in JS though). What should I learn and What should I follow , I am finding it really hard to create a roadmap that helps me. I would really appreciate some insights in this.


Thank You

https://redd.it/1d44ahn
@r_devops