Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
7
Newest
 Tumbleweed
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 9 votes cast
Feb
9
revised Upgrading mongoDB shard to 3.2
deleted 3 characters in body
Jan
26
comment Upgrading mongoDB shard to 3.2
While the question remains, I eventually shut down the whole cluster, split fleet services, restarted the cluster and then performed a rolling upgrade.
Jan
26
awarded  Tumbleweed
Jan
19
revised Upgrading mongoDB shard to 3.2
deleted 6 characters in body
Jan
19
asked Upgrading mongoDB shard to 3.2
Nov
6
comment iptables: filter before DNAT
This answer, while relatively short, was the solution to my problem of locking down docker containers to only certain source IPs and host destination ports. For a container docker run -p 12380:80 nginx, the command iptables -I DOCKER -m conntrack --ctstate DNAT ! --ctorigsrc 172.17.8.1/32 --ctorigdstport 12380 -j REJECT successfully restricted access so that only IP 172.17.8.1 (e.g. the Vagrant host) can access port 12380. In combination with a PRE_DOCKER chain dropping by default, this works better than any other solution out there.
Nov
6
comment Steps for limiting outside connections to docker container with iptables?
Hum, that's sort of ugly if you happen to run multiple containers that use, say, an internal NGINX to do reverse proxying (e.g. Zabbix, a custom load balancer, etc.) because it would require you to know the container's IP in advance. I'm still searching to a solution for that problem that does not require --iptables=false, because this seems to be the worst choice of them all.
Nov
6
comment Steps for limiting outside connections to docker container with iptables?
If you do iptables -vnL DOCKER, the destination ports are all ports within the container. If I get that right, that means the rules above would only affect the port 3306 within the container - that is, if you were to -p 12345:3306 your container, your rule would still be the one required to lock down the access (i.e. --dport 12345 wouldn't work), because the DOCKER chain's ACCEPT rules are post-NAT.
Nov
27
awarded  Popular Question
Jan
31
awarded  Autobiographer
Nov
4
comment Computer sleep and wake up announcement on a network
Good point! I'll have a look!
Nov
4
comment Computer sleep and wake up announcement on a network
This is why I am asking - I'm thinking about a way to inform a server (all devices for that matter) that a device has woken up. Otherwise a device might not notice. This could come in handy when it comes to waking up computers that don't support 'wake on unicast' etc.
Nov
4
asked Computer sleep and wake up announcement on a network
Nov
2
revised ethtool, WOL: What does “wake on physical activity” actually mean and (how) can I use it?
edited title
Nov
2
awarded  Editor
Nov
2
revised ethtool, WOL: What does “wake on physical activity” actually mean and (how) can I use it?
added 30 characters in body
Nov
2
comment ethtool, WOL: What does “wake on physical activity” actually mean and (how) can I use it?
Supports Wake-on: pg and Wake-on: pg. According to the ethtool man pages, p stands for physical activity.
Nov
2
comment ethtool, WOL: What does “wake on physical activity” actually mean and (how) can I use it?
So far so good, but what exactly is that "physical activity" mentioned by ethtool?
Oct
31
asked ethtool, WOL: What does “wake on physical activity” actually mean and (how) can I use it?
Oct
31
awarded  Scholar