jessfraz

[[includes]]
name = "thing"

jessfraz

FROM python:2-alpine

RUN apk add --no-cache \
	gcc \
	libxml2-dev \
	libxslt-dev \
	musl-dev

ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/include/libxml2
ENV C_INCLUDE_PATH=$C_INCLUDE_PATH:/usr/include/libxml2

jessfraz

FROM python:2-alpine

RUN pip install \
	beautifulsoup4 \
	requests

COPY papers.py /usr/local/bin/
RUN chmod +x /usr/local/bin/papers.py

WORKDIR /root

jessfraz

Freezer cgroup FTW

In a terminal start a server.

$ python -m SimpleHTTPServer 8000

In another terminal set up the cgroups freezer.

jessfraz

deploying acs-engine with rawaccess

$ git clone git@github.com:jessfraz/acs-engine
$ git checkout rawaccess
$ make
$ ./bin/acs-engine deploy --subscription-id $SUBSCRIPTION_ID \
	--dns-prefix jessfraz-rawaccess \
	--location eastus --auto-suffix \
	--api-model examples/kubernetes.json 

jessfraz

# Description: Boxstarter Script
# Author: Jess Frazelle <jess@linux.com>
# Last Updated: 2017-09-11
#
# Install boxstarter:
# 	. { iwr -useb http://boxstarter.org/bootstrapper.ps1 } | iex; get-boxstarter -Force
#
# You might need to set: Set-ExecutionPolicy RemoteSigned
#
# Run this boxstarter by calling the following from an **elevated** command-prompt:

jessfraz

High-Level Security Profile Generator

(originally from my proposal on https://github.com/docker/docker/issues/17142#issuecomment-148974642 but generic)

The profile would generate artificats of an apparmor profile and seccomp filters.

Obviously doesn't have to be toml since that's super hipster :p

Assumptions

• no one is going to sit and write out all the syscalls/capabilities their app needs
• automatic profiling would be super cool but like aa-genprof it is never

jessfraz

server {
	....
  
	location ~ ^/x/(.*) {
		if ($args = "go-get=1") {
			add_header Content-Type text/html;
			return 200 '<meta name="go-import" content="$host/x/$1 git https://github.com/jessfraz/$1.git">';
		}
		return 302 https://github.com/jessfraz/$1;
	}

jessfraz

Keybase proof

I hereby claim:

• I am jessfraz on github.
• I am jessie (https://keybase.io/jessie) on keybase.
• I have a public key whose fingerprint is D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3

To claim this, I am signing this object:

jessfraz

Self isolating binaries

This is a play proposal for a new wrapper around go build that would build your binary but wrap it in code that would prepare isolation around your binary on run.

A concept of this is in https://github.com/jfrazelle/binctr, in that it takes a docker image and embeds the contents into a final binary so you have a self-contained binary.

The binctr example is unnessesarily heavy for go binaries because all you need is a completely static binary.