| === genii is now known as genii-core | ||
| lordievader | Good morning | 06:14 |
|---|---|---|
| tuxick | anyone know how to create additional users with autoinstall, as in https://cloudinit.readthedocs.io/en/latest/topics/examples.html ? | 07:28 |
| tuxick | or should i ignore cloud-init docs? | 07:28 |
| tuxick | i ended up using late-commands because needed to get stuff done | 07:29 |
| andypandy | I just got my first zfs raidz1 up and running. I have got the "Previous version" (shadow copy) working when doing a manual snapshot. Great! Now I need to automate snapshots to protect from accidental deletion etc since there are no recycle bin when deleting files from network storage in windows. Anyone know of a good tool to use to auomate the rolling snapshots? | 11:16 |
| tuxick | wrap the call with "are you sure? y/N" | 11:53 |
| === haggertk- is now known as haggertk | ||
| === masACC is now known as maswan | ||
| === genii-core is now known as genii | ||
| TJ- | alis list libvirt | 14:43 |
| patdk-lap | didn't know you could do that in irc | 14:48 |
| TJ- | didn't mean to! - typoed /msg alis as /amsg alis ooops | 14:48 |
| sdeziel | andypandy: I use sanoid (`apt install sanoid`) as it does snapshot scheduling and more. There is also `zfs-auto-snapshot` that's simpler | 14:48 |
| andypandy | Thanks sdeziel | 14:49 |
| foo | Walex_away / patdk-lap / Walex - well, WISP called me back a few hours after we figured out mtu issue. They said something was consuming 10bmit down non-stop for the past 7 days on the network (which is pretty much when I arrived here). After process of elimination, turns out it was most likely my phone downloading the 3GB iOS update. I could clearly see ping times 300-900ms when my phone was on the | 17:15 |
| foo | network and sub 50ms when I took my phone off the network. Now that I've solved that, I also just re-tested file transfer of 4K file with mtu 1500 .... and it works fine now. Can you explain this? I'm confused why my phone downloading a file would affect me uploading a 4K file. | 17:15 |
| patdk-lap | it shouldn't, unless there is a huge buffer somewhere | 17:28 |
| patdk-lap | that is causing tcp timeout and retries | 17:29 |
| patdk-lap | changing mtu shouldn't change anything for that | 17:29 |
| patdk-lap | but your phone shouldn't be downloading 3gb for 7days, unless you have no bandwidth at all | 17:29 |
| patdk-lap | sounds like it was having issues also | 17:30 |
| foo | patdk-lap: so odd. I appreciate you sharing. A part of me wants to understand this, another part of me wants to get on with my work, haha. | 17:31 |
| patdk-lap | not sure there is much more to understand | 17:31 |
| foo | patdk-lap: someone else said that pending how the WISP was throttling me, if I was saturating my download it was affecting my upload | 17:31 |
| patdk-lap | without knowing how their network works | 17:31 |
| patdk-lap | what policies they have configured | 17:31 |
| patdk-lap | ya, that goes in the, unless we know exactly how they do things, we won't know | 17:32 |
| foo | patdk-lap: here is how someone else described it: https://bpa.st/6EIQ | 17:33 |
| foo | fair enough | 17:34 |
| foo | :) | 17:34 |
| patdk-lap | ya, that issue I never hit, as my systems all do that by default | 17:34 |
| patdk-lap | voip, then acks, then other data, then bulk data (torrents, downloads,,,) | 17:35 |
| foo | patdk-lap: "do that" as in, what, exactly? | 17:35 |
| foo | patdk-lap: oh, QoS? | 17:35 |
| patdk-lap | prioritize acks | 17:35 |
| patdk-lap | yep | 17:35 |
| foo | copy | 17:35 |
| foo | patdk-lap: given what we've discussed, would you say that this WISP could be better configured to priorirtize ACKs? | 17:36 |
| patdk-lap | I give acks upto 10% of my upstream, dedicated | 17:36 |
| patdk-lap | well, normally they wouldn't care much about it | 17:36 |
| patdk-lap | it would normally be your connection that it would be the issue | 17:36 |
| patdk-lap | but if the problem is the wisp cell site is overloaded, not much you can do there | 17:37 |
| patdk-lap | unless they do qos, and unlikely they will do that down to that level, normally they would only do it down to the customer level | 17:37 |
| patdk-lap | so one customer doesn't wipe out another | 17:37 |
| patdk-lap | all these qos things, the more you have, the better they are, takes more router memory and cpu power, larger routers, ... | 17:38 |
| foo | I see, I see | 17:38 |
| foo | patdk-lap: I could also share, that they wanted to solve my issue because customers that were downstream from me were complaining of slow speeds | 17:38 |
| foo | The WISP described it as a DoS attack... | 17:38 |
| foo | Could that be because my 4K file's ACK never made it back through so it caused a loop of sorts? | 17:39 |
| patdk-lap | well, it was a DOS, I wouldn't agree it was an attack, it was crap configuration :) | 17:39 |
| patdk-lap | foo, yes, default is 5 seconds | 17:39 |
| patdk-lap | if pings where >5seconds, yes, that would be an issue | 17:39 |
| patdk-lap | it sounds like they are not doing any qos of customer traffic, so you got to hog it all to yourself | 17:40 |
| foo | patdk-lap: I see | 17:40 |
| patdk-lap | or else other customers wouldn't have been complaining | 17:41 |
| patdk-lap | just you | 17:41 |
| foo | true | 17:41 |
| patdk-lap | ya, I do qos at several levels, once at the customer level, then by type (voip connections, acks, then normal web, then common torrent, ftp,...) | 17:42 |
| patdk-lap | then at each of those levels, it shares the bandwidth between connections (per tcp connection) | 17:42 |
| patdk-lap | so one single connection (like your ios update) wouldn't knock everything else off | 17:43 |
| patdk-lap | torrents though, make hundreds of connections, so that sharing doesn't work so well, why it goes on it's own qos level below all others | 17:44 |
| patdk-lap | though instead of sharing per ocnnnection, you could do it per ip | 17:44 |
| patdk-lap | works better inside the house, than at the wisp, but the wisp could do per ip, as a per customer thing | 17:45 |
| patdk-lap | really, if their equipment can do it, have someone that knows this enough to setup the templates, and then they could generate and push it out each time they onboard a customer automatically | 17:45 |
| foo | thanks patdk-lap , just called them back again to explain what might have caused this issue | 17:51 |
| foo | patdk-lap: hm, and I may be overthinking it at this point - but is it possible that redudcing the MTU worked so that a smaller ACK packet could make it back downstream to me | 17:52 |
| patdk-lap | the ack packets are all the same size, 64bytes, smallest possible | 17:54 |
| patdk-lap | it *might* have made the packet go out faster, so therefor the ack came back sooner | 17:54 |
| foo | patdk-lap: aha, ok, well scratch that. What I don't understand is why changing the MTU fixed this | 17:54 |
| foo | aha! | 17:54 |
| patdk-lap | technically acks aren't all 64k, but they are unless the server is also sending data back also | 17:55 |
| patdk-lap | so generally it's good to assume they are 64 | 17:55 |
| patdk-lap | not 64k heh, just 64 | 17:55 |
| foo | ha | 17:55 |
| foo | patdk-lap: super grateful for all the back-and-forth, I was following my curiosity on this one and learned a ton. Grateful for your time. | 17:56 |
| patdk-lap | could just be their qos is not configured correctly, who knows | 17:56 |
| patdk-lap | but something on their side is the source of the problem, you just exposed it | 17:57 |
| patdk-lap | I wouldn't take it personally you did anything wrong at all, but ya, unlikely the wisp feels that way | 17:57 |
| patdk-lap | cause their point of view, you are the issue | 17:57 |
| patdk-lap | cause their network allowed it | 17:57 |
| foo | I have shared nearly everything you've shared with me and what I've inferred from all of this and explained my intent is is to share what might improve their network should we conclude something. I think they appreciate it but who knows, if nothing more I learned a lot more. :) I think they likely only have like 6 customers downstream from me anyway | 17:59 |
| patdk-lap | ya, some people tend to not take criticism well, like network engineers | 17:59 |
| patdk-lap | like me :) | 17:59 |
| patdk-lap | I got hit hard back in the 90's | 18:00 |
| patdk-lap | when shell accounts for the internet was a normal way to use the internet | 18:00 |
| patdk-lap | dialup into a shell account | 18:00 |
| patdk-lap | new isp, I noticed I had a shell account, if I didn't use ppp, so I used it | 18:00 |
| patdk-lap | I then got banned from the isp for *hacking* their server | 18:01 |
| patdk-lap | sorry, you misconfigured my user account on your server, and instead of giving me only ppp access, yo ugave me a full shell | 18:01 |
| patdk-lap | how was I suppose to know I shouldn't use it | 18:01 |
| foo | oh man. | 18:02 |
| foo | haha | 18:02 |
| === StarHeart is now known as Edgan | ||
| Guest47 | Hi. What's the minimum RAM needed to run a Ubuntu docker image? I need it to run sshd, and clone git repos (for backup purposes). It doesn't do anything else. I'll be running this on a very limited NAS. | 19:52 |
| === genii is now known as genii-core | ||
| sdeziel | Guest47: FYI, my gitolite LXD container consumes 27MB of RAM | 19:59 |
| Guest47 | sdeziel: based on Ubuntu?! nice! | 19:59 |
| sdeziel | Guest47: yes, 20.04 on amd64. systemd-journald is the biggest RAM consumer | 20:00 |
| Guest47 | good to know | 20:01 |
| === genii-core is now known as genii | ||
| Guest47 | I installed openssh-server but since the Docker image doesn't use systemd, the service doesn't start. I can do it manually with "service ssh start". How can I get this container to run this whenever it's restarted? I'm treating this as a VM, I know it's not common Docker usage. I don't want to write Dockerfiles/Compose files and constantly | 20:17 |
| Guest47 | destroy/create containers. This is a one-time thing. | 20:17 |
| sarnold | Guest47: are you sure you wouldn't rather have lxd instead? I always thought of docker as "I want this specific application to run in a container" and lxd as "I want a very lightweight vm-ish container" | 20:21 |
| Guest47 | sarnold: this is on my weird NAS with a custom Linux, I have no choice. I'm only doing all this because their Python 3 doesn' | 20:22 |
| Guest47 | doesn't have pip | 20:22 |
| sarnold | Guest47: oh | 20:22 |
| Guest47 | but since it supports Docker I can use Ubuntu to run commands I need to run | 20:22 |
| Guest47 | The plan is to execute tasks by SSHing to the Ubuntu container, then running the command, which saves the data to a volume mapped on the NAS | 20:23 |
| Guest47 | How can I run sshd at startup? The entry point of the Ubuntu image is "bash". I still want it to be bash, but I also want it to run sshd at startup (the container is set to auto-restart on error, powerup, etc) | 20:34 |
| Walex_away | Guest47: that is not an Ubuntu container, it is your own distribution at this point... | 20:37 |
| Walex_away | Guest47: in effect your container always boots in single user mode. | 20:38 |
| Walex_away | Guest47: the question is: what makes it run the initial shell, if you have not installed an 'init' daemon? | 20:39 |
| Walex_away | Guest47: or rather, which executable is the 'init' for that container? | 20:39 |
| Guest47 | bash | 20:39 |
| Walex_away | Guest47: and how do you start it? | 20:40 |
| Guest47 | oh sorry | 20:40 |
| Guest47 | PID #1 is bash. I start it using the Docker UI that's available on my NAS. I have buttons like "Start/Restart/Stop" | 20:41 |
| Guest47 | It lets me customize some things but I don't see an option to change the starting command | 20:41 |
| Walex_away | Guest47: OK! there two options then | 20:41 |
| Walex_away | Guest47: that 'bash' will belong to some user and therefore will execute some '.bash_profile' in the user's home directory. | 20:42 |
| Walex_away | Guest47: so you can treat the container as a single.user login and just start 'sshd' in it. | 20:43 |
| Walex_away | Guest47: if 'service sshd start' works that means that there is an 'sshd' start script somewhere, probably in '/etc/init.d/'. | 20:43 |
| Guest47 | that's the case, yeah | 20:44 |
| Walex_away | The other option is to run a process supervision daemon like 'sv' from 'runit' or 'daemontools' etc. | 20:44 |
| TJ- | anyone managed to deploy dnsmasq as an IPv6 DHCPv6/TFTP server and have example configs? Having a problem with it not responding to the client TFTP RRQ packets | 20:45 |
| Walex_away | the second option has the advantage that the process supervisor will restart the 'sshd' daemon if it crashes etc. | 20:45 |
| patdk-lap | Guest47, must you use ubuntu docker image? | 20:46 |
| Guest47 | I put in "service ssh start" in root's ~/.profile, restarted the container, but nothing | 20:46 |
| patdk-lap | if you just need ssh and docker, why not just use alpine? | 20:46 |
| * Walex_away had not changed nick | 20:46 | |
| === Walex_away is now known as Walex | ||
| Guest47 | patdk: I just didn't want to have to use a separate PC to create a Docker image, create a Docker registry account, upload there, download here, etc. For a container that I might tweak at any time. | 20:46 |
| Walex | Guest47: I would not be sure that /root/ is the home directory | 20:46 |
| Walex | Guest47: there is also another detail that matters quite a bit: | 20:47 |
| patdk-lap | oh, you are just looking for a preconfigured image, ya any full os image is going be kindof large | 20:47 |
| Guest47 | patdk-lap: cause I'm familiar with Ubuntu as a desktop user, I'm comfortable with that. RAM usage is negligible, it's great. | 20:47 |
| Walex | Guest47: the '.profile' is only executed if the 'bash' is a login shell | 20:47 |
| Guest47 | oh | 20:48 |
| Walex | Guest47: that can be achieved by running it as 'bash --login' | 20:48 |
| Guest47 | I can't edit the start command though... | 20:48 |
| Walex | Guest47: I don't know if your Docker tools allow you to do that. | 20:48 |
| Guest47 | whatever I put in init.d will execute at startup? | 20:48 |
| Walex | Guest47: AFAIk nothing that you put in 'init.d' will be executed at startup. | 20:48 |
| Walex | Guest47: traditionally only what you put in '7etc/rc.local' is exectued at estartup, if you have an 'init' system. | 20:49 |
| Walex | Guest47: I'll do a web search on how to configure Docket appositely. I will also at some Dockerfiles I got as I vaguely remember doing that. | 20:50 |
| Guest47 | OK, how do I control what "bash" runs then? If I can shove "service ssh start" somewhere, that's that | 20:50 |
| Guest47 | even on non-login sessions | 20:51 |
| Walex | Guest47: don't Dockerfiles have a "RUN" directive? | 20:51 |
| Guest47 | they do, but that would mean building my own image. I'll do that if push comes to shove, it's just way more troublesome than tinkering with a local distro. | 20:52 |
| Walex | oops that's build-time, I was thinking 'CMD'. Will check | 20:52 |
| Guest47 | oh snap, just thought of something...I've been going through the Ubuntu official image, but I | 20:52 |
| Guest47 | I'm sure tons of people have made an sshd variant | 20:52 |
| Walex | Guest47: ahhh sorry I had forgotten: you want to run an existing image even if does not do what you want. | 20:53 |
| Walex | Guest47: Do you know where the Dockerfile for that image is? Maybe looking at it there is some hook. | 20:53 |
| Walex | are you using this: https://registry.hub.docker.com/_/ubuntu/ ? | 20:54 |
| Guest47 | it's the official Ubuntu image. I dont think Docker downloads a Docker file and builds it locally, but a binary/filesystem image | 20:54 |
| Guest47 | yes | 20:55 |
| sdeziel | Guest47: a possible (ugly) hack would be to create a wrapper script "earlier" in $PATH that starts sshd if it is not running and then calls the real bash | 20:55 |
| Walex | Guest47: the Dockerfile is this apparently: https://github.com/tianon/docker-brew-ubuntu-core/blob/a967c2b8734c77f7f89449d0b87c2e1eebf8b26e/focal/Dockerfile | 20:55 |
| Guest47 | Found one: https://registry.hub.docker.com/r/rastasheep/ubuntu-sshd/ . Obviously, not official...should I trust this stuff? | 20:55 |
| Guest47 | sdeziel: I'll suck it up and get a different image | 20:56 |
| Walex | Guest47: The official Dockerfile does not have "bash --login" too bad | 20:56 |
| Guest47 | Walex yeah they use that Dockerfile to compile the image, then that image is uploaded to Docker Hub, then you download. AFAIK you can't tell Docker "here's a 1KB Dockerfile, run this locally" | 20:57 |
| Walex | Guest47: I usually build my docker images and keep them in a local repository | 20:58 |
| Guest47 | https://github.com/rastasheep/ubuntu-sshd/blob/master/18.04/Dockerfile | 20:58 |
| sdeziel | Guest47: that image is very outdated it seems | 20:59 |
| Guest47 | I should be able to just change "FROM ubuntu:18.04" to "FROM ubuntu:20.04" | 21:00 |
| Guest47 | if I build my own | 21:00 |
| Guest47 | why are people so in love with Alpine? TONS of sshd results for Alpine | 21:00 |
| Guest47 | to shave off 10MB off an image? | 21:01 |
| Guest47 | allright, I give up. I'll create my own image based on rastasheep's Dockerfile. | 21:04 |
| Guest47 | thanks for your advice, guys! | 21:06 |
| Walex | Guest47: that Dockerfile starts 'sshd' but does not start a console shell I think | 21:07 |
| Walex | Guest47: note that it starts *ssh -D' so it is 'sshd' that becomes process 1 | 21:08 |
| Guest47 | does that matter? My NAS can still ssh in and run arbitrary bash commands, right? | 21:09 |
| Walex | Guest47: it is up to you to decide that, whether you are sure that 'sshd' will never crash and there will never be network issues etc. | 21:10 |
| Guest47 | it shouldn't, the container runs on the same NAS that connects to it. It's just a local service. | 21:11 |
| Guest47 | also one of the options is "Auto-Restart container on error" | 21:11 |
| Guest47 | I will never ssh to it myself, it'll just be "ssh root@local-docker-ip -exec "wget blah blah && tar blah blah && python3 somescript.py " (not the exact syntax, you know what I mean, I'll look it up) | 21:13 |
| Guest47 | in an automatic script | 21:13 |
| Guest47 | Damn, it just never ends. I can't push the image I created, one of the fragments which is large (125MB), keeps failing around the 90-110MB mark. I started today just wanting to set up backups on my NAS, it turned into this whole adventure. :/ | 21:32 |
| Walex | foo: so after all it was a rate limiting issue. | 21:39 |
| Walex | foo: my guess that a smaller MTU paced the packets better was perhaps right. | 21:39 |
| Walex | foo: but as "patdk-lap" pointed out it should not take 7 days at 10mb/s, and anyhow a 3GB update is monstrous. | 21:40 |
| Walex | foo: but if you really saw much higher pings that meant that the link was saturated and this meant that uploading was throttled too. probably with a shaper script set at limiting the download rate to 9mb/s it would not have been congested. | 21:42 |
| === genii is now known as genii-core | ||
| === Walex is now known as Walex_away | ||
| foo | Walex_away: thanks for circling back :) | 21:47 |
| patdk-lap | apple tents to push gig updates though, so that is *common* | 22:00 |
| foo | patdk-lap: if an iOS update can "take down the network" on this WISP... I have to imagine they have other problems which I don't even want to think about, haha. | 22:00 |
| patdk-lap | apple has been down to take down many isp's | 22:00 |
| foo | oh, interesting | 22:00 |
| patdk-lap | most of them have onsite caches cause of this | 22:01 |
| patdk-lap | used to be common 10years ago | 22:01 |
| Guest47 | couldn't they rate-limit based on destination IP? | 22:01 |
| patdk-lap | we used to watch the bandwidth on the ios update cache when new apple releases where put out, was always intertaining | 22:01 |
| patdk-lap | Guest47, who knows, but they aren't :) or not enough | 22:02 |
| Guest47 | net neutrality is a meme :) | 22:02 |
| patdk-lap | or else it wouldn't take taken down the other customers | 22:02 |
| patdk-lap | https://www.fastvue.co/sophos/blog/the-bandwidth-impact-of-apples-ios-8-release-on-your-network/ | 22:04 |
| Guest47 | do they do like Windows and share iOS updates from other phones on the LAN? | 22:06 |
| patdk-lap | no, or atleast they didn't use to | 22:06 |
| Guest47 | no wait, stupid question, it would drain batteries and people would complain | 22:06 |
| patdk-lap | you can do something like that using macos | 22:06 |
| TJ- | finally got GRUB loading over pure IPv6 PXE/TFTP | 23:24 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!