The Technology Chronicle

Having worked with multiple Virtualization platforms, I recently got an interesting opportunity to work with its younger sibling containerization . The  platform of choice was obviously Docker. Getting Docker up and run in an OS of your preference is a simple task, you can straightaway get it done using the instructions here . Interesting part is  getting to play around with it   Getting it up and running: Docker can be started as a services or at a tcp port. Starting as a service is pretty straight forward #service docker start However, the interesting bit is when you want to run it as a deamon listening to a specific port. This is useful in scenarios when you want to manage the docker engine remotely, say using a windows docker client or using one of the open source GUIs available for docker like Shipyard and Mist.io The command to run docker as a deamon listening to a port is # /usr/bin/docker  -d -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock...

This is the second post in the blog series on Cloud security. You can see the first blog post here The Cloud security alliance group provides actionable best practices for businesses to transition to cloud services while mitigating the risk involved in doing so. As per the latest version of CSA guide The critical areas of focus in cloud computing is divided into fourteen domains

Cloud security is a major consideration for enterprise wide cloud adoption, especially public cloud. This is part 1 of a serious of blog posts , where I am planning to pen down the different dimensions of Cloud security, starting with the risk factors of cloud adoption. The various attributes of security risks  involved in the process can be summed up as follows: ENISA* recommends the following  risk areas to be taken into account, while embarking on a cloud adoption journey

While trying to install OpenStack icehouse, faced an issue with nova-api service.It was not getting started. The following error was coming up in the Nova-api log Command: sudo nova-rootwrap /etc/nova/rootwrap.conf iptables-save -c Exit code: 1 .......  nova Stdout: '' 2014-10-17 07:21:08.058 27270 TRACE nova Stderr: 'Traceback (most recent call last):\n  File "/usr/bin/nova-rootwrap", line 6, in <module>\n    from oslo.rootwrap.cmd import main\nImportError: No module named rootwrap.cmd\n' Problem was with one of the oslo.rootwrap module. It was broken Solution is to upgrade the module using pip   #pip install oslo.rootwrap --upgrade

In OpenStack, by default users who are members of a  tenant can delete all instances in that tenant, even if it is spinned up by other users. If you want to restrict that, you  need to tweak the nova policy file  ie /etc/nova/policy.json Add the following lines in the file:     "admin_or_user":"is_admin:True or user_id:%(user_id)s",     "compute:delete":"rule:admin_or_user", Make the same changes in the /etc/openstack-dashboard/nova_policy.json file also Now restart the openstack-nova-api service Now user will be able to delete only those instances spinned up by them. Admin users will be able to delete all instances

Creating Yaml templates that assign floating IPs to your instances being spawned can be a bit tricky.Let us look at a scenario where we need to spin up a VM, assign a floating IP from a pool and make reference to this floating IP in your userdata as well. We will make use of the network ID of the internal and external network, as well as the Subnet ID of the internal network The logical workflow is as follows:   Create a port resource using internal network and internal subnet IDs Create a floating IP resource , referring to the external network ID   Associate the floating IP to the port   In the server resource being created, associate the port resource   Now we will see how this can be implemented using both HOT and AWS template formats

Recently a Ceilometer proxy for Zabbix was released by OneSource. This proxy will pull all the instance information from OpenStack and populate it in Zabbix The source code can be downloaded from here: https://github.com/OneSourceConsult/ZabbixCeilometer-Proxy The basic prerequisites for the server where the proxy is running is Python and Pika library. Also there should be network connectivity from the proxy machine to your OpenStack installation.