While Sadiq Khan seems to be in a commanding position, the Tories have some slender causes for hope

London mayoral election 2024: Could the Conservatives be ousted indefinitely by Labour?

Police say the remains, found at Rowdown Fields in Croydon, will be sent away for &quot;full analysis&quot;.

Croydon: Possible human remains found in south London park

Walking a 26-mile stretch from Hertfordshire, our writer witnesses how a neglected artery of the city has been transformed into a recreational and cultural hub

Walking London’s unsung waterway: the River Lea rises again | London holidays | The Guardian

Members of the Aslef union will walk out on 8 April in a dispute over terms and conditions.

London Tube strikes: Little to no service during walkout, TfL warns - BBC News

Met says suspects travelled directly to Heathrow and left within hours of attack on Pouria Zeraati

Men linked to stabbing of Iranian journalist in London ‘have fled UK’ | Iran | The Guardian

Suspects travelled to Heathrow Airport and fled Britain hours after attacking journalist, police say

Three suspects in stabbing of London-based Iranian journalist fled UK by plane ‘within hours of attack’ | The Independent

The journalist was discharged from hospital and is currently in a &quot;safe place&quot; with his wife, under the Met Police&#x27;s supervision.

Pouria Zeraati attack: Three suspects left UK hours after Iranian journalist was stabbed in London, police say | UK News | Sky News

News presenter Pouria Zeraati was stabbed outside his home in Wimbledon on Friday.

Pouria Zeraati: Three accused of TV presenter attack have left UK - BBC News

The affected West Coast Main Line is one of the most important railway routes in the UK, connecting London and Glasgow to other major cities including Liverpool, Birmingham and Manchester.

Frustrated train passengers face delays and disruption after London Euston signal failure | UK News | Sky News

A measure of buyer activity fell across prime and super-prime price tiers

London Luxury Housing Demand Wilted Heading Into Spring - Mansion Global

LNDDO

lnddo

The Way We Live Now by Anthony Trollope is part of the HackerNoon Books Series. You can jump to any chapter in this book . LADY POMONA'S DINNER PARTY here LADY POMONA'S DINNER PARTY. Roger Carbury's half formed plan of keeping Henrietta at home while Lady Carbury and Sir Felix went to dine at Caversham fell to the ground. It was to be carried out only in the event of Hetta's yielding to his prayer. But he had in fact not made a prayer, and Hetta had certainly yielded nothing. When the evening came, Lady Carbury started with her son and daughter, and Roger was left alone. In the ordinary course of his life he was used to solitude. During the greater part of the year he would eat and drink and live without companionship; so that there was to him nothing peculiarly sad in this desertion. But on the present occasion he could not prevent himself from dwelling on the loneliness of his lot in life. These cousins of his who were his guests cared nothing for him. Lady Carbury had come to his house simply that it might be useful to her; Sir Felix did not pretend to treat him with even ordinary courtesy; and Hetta herself, though she was soft to him and gracious, was soft and gracious through pity rather than love. On this day he had, in truth, asked her for nothing; but he had almost brought himself to think that she might give all that he wanted without asking. And yet, when he told her of the greatness of his love, and of its endurance, she was simply silent. When the carriage taking them to dinner went away down the road, he sat on the parapet of the bridge in front of the house listening to the sound of the horses' feet, and telling himself that there was nothing left for him in life. If ever one man had been good to another, he had been good to Paul Montague, and now Paul Montague was robbing him of everything he valued in the world. His thoughts were not logical, nor was his mind exact. The more he considered it, the stronger was his inward condemnation of his friend. He had never mentioned to anyone the services he had rendered to Montague. In speaking of him to Hetta he had alluded only to the affection which had existed between them. But he felt that because of those services his friend Montague had owed it to him not to fall in love with the girl he loved; and he thought that if, unfortunately, this had happened unawares, Montague should have retired as soon as he learned the truth. He could not bring himself to forgive his friend, even though Hetta had assured him that his friend had never spoken to her of love. He was sore all over, and it was Paul Montague who made him sore. Had there been no such man at Carbury when Hetta came there, Hetta might now have been mistress of the house. He sat there till the servant came to tell him that his dinner was on the table. Then he crept in and ate,—so that the man might not see his sorrow; and, after dinner, he sat with a book in his hand seeming to read. But he read not a word, for his mind was fixed altogether on his cousin Hetta. "What a poor creature a man is," he said to himself, "who is not sufficiently his own master to get over a feeling like this." At Caversham there was a very grand party,—as grand almost as a dinner party can be in the country. There were the Earl and Countess of Loddon and Lady Jane Pewet from Loddon Park, and the bishop and his wife, and the Hepworths. These, with the Carburys and the parson's family, and the people staying in the house, made twenty-four at the dinner table. As there were fourteen ladies and only ten men, the banquet can hardly be said to have been very well arranged. But those things cannot be done in the country with the exactness which the appliances of London make easy; and then the Longestaffes, though they were decidedly people of fashion, were not famous for their excellence in arranging such matters. If aught, however, was lacking in exactness, it was made up in grandeur. There were three powdered footmen, and in that part of the country Lady Pomona alone was served after this fashion; and there was a very heavy butler, whose appearance of itself was sufficient to give éclat to a family. The grand saloon in which nobody ever lived was thrown open, and sofas and chairs on which nobody ever sat were uncovered. It was not above once in the year that this kind of thing was done at Caversham; but when it was done, nothing was spared which could contribute to the magnificence of the fête. Lady Pomona and her two tall daughters standing up to receive the little Countess of Loddon and Lady Jane Pewet, who was the image of her mother on a somewhat smaller scale, while Madame Melmotte and Marie stood behind as though ashamed of themselves, was a sight to see. Then the Carburys came, and then Mrs. Yeld with the bishop. The grand room was soon fairly full; but nobody had a word to say. The bishop was generally a man of much conversation, and Lady Loddon, if she were well pleased with her listeners, could talk by the hour without ceasing. But on this occasion nobody could utter a word. Lord Loddon pottered about, making a feeble attempt, in which he was seconded by no one. Lord Alfred stood, stock-still, stroking his grey moustache with his hand. That much greater man, Augustus Melmotte, put his thumbs into the arm-holes of his waistcoat, and was impassible. The bishop saw at a glance the hopelessness of the occasion, and made no attempt. The master of the house shook hands with each guest as he entered, and then devoted his mind to expectation of the next comer. Lady Pomona and her two daughters were grand and handsome, but weary and dumb. In accordance with the treaty, Madame Melmotte had been entertained civilly for four entire days. It could not be expected that the ladies of Caversham should come forth unwearied after such a struggle. When dinner was announced Felix was allowed to take in Marie Melmotte. There can be no doubt but that the Caversham ladies did execute their part of the treaty. They were led to suppose that this arrangement would be desirable to the Melmottes, and they made it. The great Augustus himself went in with Lady Carbury, much to her satisfaction. She also had been dumb in the drawing-room; but now, if ever, it would be her duty to exert herself. "I hope you like Suffolk," she said. "Pretty well, I thank you. Oh, yes;—very nice place for a little fresh air." "Yes;—that's just it, Mr. Melmotte. When the summer comes one does long so to see the flowers." "We have better flowers in our balconies than any I see down here," said Mr. Melmotte. "No doubt;—because you can command the floral tribute of the world at large. What is there that money will not do? It can turn a London street into a bower of roses, and give you grottoes in Grosvenor Square." "It's a very nice place, is London." "If you have got plenty of money, Mr. Melmotte." "And if you have not, it's the best place I know to get it. Do you live in London, ma'am?" He had quite forgotten Lady Carbury even if he had seen her at his house, and with the dulness of hearing common to men, had not picked up her name when told to take her out to dinner. "Oh, yes, I live in London. I have had the honour of being entertained by you there." This she said with her sweetest smile. "Oh, indeed. So many do come, that I don't always just remember." "How should you,—with all the world flocking round you? I am Lady Carbury, the mother of Sir Felix Carbury, whom I think you will remember." "Yes; I know Sir Felix. He's sitting there, next to my daughter." "Happy fellow!" "I don't know much about that. Young men don't get their happiness in that way now. They've got other things to think of." "He thinks so much of his business." "Oh! I didn't know," said Mr. Melmotte. "He sits at the same Board with you, I think, Mr. Melmotte." "Oh;—that's his business!" said Mr. Melmotte, with a grim smile. Lady Carbury was very clever as to many things, and was not ill-informed on matters in general that were going on around her; but she did not know much about the city, and was profoundly ignorant as to the duties of those Directors of whom, from time to time, she saw the names in a catalogue. "I trust that he is diligent, there," she said; "and that he is aware of the great privilege which he enjoys in having the advantage of your counsel and guidance." "He don't trouble me much, ma'am, and I don't trouble him much." After this Lady Carbury said no more as to her son's position in the city. She endeavoured to open various other subjects of conversation; but she found Mr. Melmotte to be heavy on her hands. After a while she had to abandon him in despair, and give herself up to raptures in favour of Protestantism at the bidding of the Caversham parson, who sat on the other side of her, and who had been worked to enthusiasm by some mention of Father Barham's name. Opposite to her, or nearly so, sat Sir Felix and his love. "I have told mamma," Marie had whispered, as she walked in to dinner with him. She was now full of the idea so common to girls who are engaged,—and as natural as it is common,—that she might tell everything to her lover. "Did she say anything?" he asked. Then Marie had to take her place and arrange her dress before she could reply to him. "As to her, I suppose it does not matter what she says, does it?" "She said a great deal. She thinks that papa will think you are not rich enough. Hush! Talk about something else, or people will hear." So much she had been able to say during the bustle. Felix was not at all anxious to talk about his love, and changed the subject very willingly. "Have you been riding?" he asked. "No; I don't think there are horses here,—not for visitors, that is. How did you get home? Did you have any adventures?" "None at all," said Felix, remembering Ruby Ruggles. "I just rode home quietly. I go to town to-morrow." "And we go on Wednesday. Mind you come and see us before long." This she said bringing her voice down to a whisper. "Of course I shall. I suppose I'd better go to your father in the city. Does he go every day?" "Oh yes, every day. He's back always about seven. Sometimes he's good-natured enough when he comes back, but sometimes he's very cross. He's best just after dinner. But it's so hard to get to him then. Lord Alfred is almost always there; and then other people come, and they play cards. I think the city will be best." "You'll stick to it?" he asked. "Oh, yes;—indeed I will. Now that I've once said it nothing will ever turn me. I think papa knows that." Felix looked at her as she said this, and thought that he saw more in her countenance than he had ever read there before. Perhaps she would consent to run away with him; and, if so, being the only child, she would certainly,—almost certainly,—be forgiven. But if he were to run away with her and marry her, and then find that she were not forgiven, and that Melmotte allowed her to starve without a shilling of fortune, where would he be then? Looking at the matter in all its bearings, considering among other things the trouble and the expense of such a measure, he thought that he could not afford to run away with her. After dinner he hardly spoke to her; indeed, the room itself,—the same big room in which they had been assembled before the feast,—seemed to be ill-adapted for conversation. Again nobody talked to anybody, and the minutes went very heavily till at last the carriages were there to take them all home. "They arranged that you should sit next to her," said Lady Carbury to her son, as they were in the carriage. "Oh, I suppose that came naturally;—one young man and one young woman, you know." "Those things are always arranged, and they would not have done it unless they had thought that it would please Mr. Melmotte. Oh, Felix! if you can bring it about." "I shall if I can, mother; you needn't make a fuss about it." "No, I won't. You cannot wonder that I should be anxious. You behaved beautifully to her at dinner; I was so happy to see you together. Good night, Felix, and God bless you!" she said again, as they were parting for the night. "I shall be the happiest and the proudest mother in England if this comes about." About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Anthony Trollope (2004). The Way We Live Now. Urbana, Illinois: Project Gutenberg. Retrieved October 2022 https://www.gutenberg.org/cache/epub/5231/pg5231-images.html This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

LADY POMONA'S DINNER PARTY

I’ve been using for more than 2 years now and have grown to love it. Really, it gives me the power of Docker Compose without having to learn all about Docker Compose. Lando The one thing that I’ve been missing, though, with Lando is a way to share my work with others. It’s one thing to quickly spin up a local dev environment and code up a new WordPress plugin. It’s quite another thing to spin up a staging area somewhere so I can install the plugin and show it. Especially if it’s a work in progress and not yet ready for full-blown testing. A few months ago, one of my best friends, , went to work for a company named ngrok, and just hearing the name made a lightbulb go off in my head. I had totally forgotten about until he mentioned it, but it is the perfect solution for this problem. Keith Casey ngrok ngrok is the swiss army knife of building tunnels. Whether you want to share your dev environment like I do, test out webhooks, or build ssh tunnels, it’s the tool for the job. (Honestly, that’s just scratching the surface of what ngrok is capable of, but we don’t have time to go into it all.) For now, let’s just make these three great tools play nice together so we can easily share local development environments. ngrok First, you need ngrok, and you will need a ngrok account. The free plan will do for most of us; however, if you are doing this professionally, I highly recommend the Basic plan as it gives you nice things like being able to use your own domain names. You can find out more about their plans and pricing on the . ngrok pricing page Create an account and then download the version of ngrok for your operating system. I grabbed the Linux version since I want it installed on WSL. I’m pretty sure this will also work on macOS and I know it will work on Linux. Once you’ve downloaded it, install it. For me this meant un-tarring the file and moving the resulting binary into . /usr/local/bin You will also need to connect your local install to your account. You do that with the command of ngrok. authtoken $ ngrok authtoken your_token_goes_here Don’t worry; finding your token is dead simple; your token, along with the complete command, is on the ngrok setup page once you are logged in. All you have to do is copy and paste it. (it’s very developer-friendly and borders on management-friendly.) Congratulations, ngrok is now ready to go. WordPress WordPress is a fickle beast at times, and this is one of those times. For everything to work correctly with ngrok, not only do we need to tell ngrok to pass us a host header, we also have to make sure WordPress deals with it correctly. Since the traffic won’t technically be coming from your domain, we need to make sure that WordPress will still work. .lndo.site The easiest way I found to do this is with an abandoned plugin, . There are a couple of plugins in the WordPress repo, but I had difficulty with them, and this one worked out of the box. Still, since it’s not in the plugin repository, you will have to do a little more work to get it installed. The easiest way is to simply clone the repo into your plugins dir. (if that statement didn’t make sense, you are reading the wrong article.) WP-Ngrok-Local Once you have that plugin installed and activated, you are ready to for the next step. Lando I assume you have a Lando project already spun up with WordPress installed and running. If not, check out to get Lando up and running inside WSL. Then check out to spin up a WordPress install. If you want to clone an existing WordPress site into a Lando project, check out my project which gives you the tools to do that. Making Lando work inside WSL2 Lando’s docs on recipes wpLandoClone , Once you have a working WordPress inside Lando with the plugin listed above installed and activated, we need one more piece of the puzzle, . share.sh is a simple bash script that will pull the needed data out of , parse it, and use it to fire up ngrok. share.sh lando info #!/usr/bin/env bash
set -eo pipefail

#
# Share a Lando based WordPress website using ngrok
# Cal Evans <cal@calevans.com>
#
# This script must be run OUTSIDE of the Lando environment but in the Lando dir.
# It uses the lando info command which is not available inside of the lando container.
#
# This is designed to work with a WordPress recipie. To make WordPress play nice
# you have to install the plugin at https://github.com/jonathanbardo/WP-Ngrok-Local
# Once you have that installed and activated, run this script and then visit
# the https URL that it shows.
#
# When you are done, press CTRL+C to exit.
#

#
# Check for sane environment
#
if ! command -v ngrok &> /dev/null
then
  echo ngrok is not installed.
  echo Visit https://ngrok.com/download and download the version for your OS.
  exit 1
fi

if ! command -v jq &> /dev/null
then
  echo jq is not installed.
  echo Visit https://stedolan.github.io/jq/download/ and download the version for your OS.
  echo If you have one, you can usually use your package manager to install it.
  exit 2
fi

# Get the https url from lando
#
FULL_SITE_NAME=`lando info --format json | jq '.[0].urls[-1]' | tr '"' ' '`

#
# Strip off the protocol
#
SITE_NAME=`echo $FULL_SITE_NAME | awk -F '//' {'print $2'}`
SITE_NAME=${SITE_NAME::-1}

#
# Call ngrok
#
ngrok http -host-header=$SITE_NAME $FULL_SITE_NAME Download and put it somewhere in your Lando project’s directory. I usually have a directory just for things like this. share.sh /scripts Then from of the Lando container, execute . If everything is in place, it will do the rest. outside share.sh NOTE: will not work from inside a Lando container. ngrok will. You can install ngrok inside the container and manually run it and it works great. however, relies on the command, so it only work from the outside. share.sh share.sh lando info The heart of is this line. share.sh ngrok http -host-header=$SITE_NAME $FULL_SITE_NAME When the variables are expanded it will look something like this: ngrok http -host-header=dev.ucdc.lndo.site https://dev.ucdc.lndo.site That’s the magic. Run it and you will get a screen that looks something like this. fClose() This solution works and it’s not too much trouble. On one of my project, I have the command to download and then activate the plugin built into my file so that it’s automatic any time I (re)build the project. .lando.yml I did try adding it to the section of the file. This did not work. I didn’t spend the time to investigate to figure out why it did not work; I just found out it did not work. tooling .lando.yml Honestly, the only way this could be better is if it were part of Lando itself. Lando has a command, but all it does is tell you that has discontinued its free service. My next Lando project is to dig into the share plugin and see if I can make it work with ngrok. I’m betting I can. lando share localtunnel.me Also Published Here

Lando, WordPress, and ngrok…oh my

Here in the United States, much as it is throughout the world, you are what your credit score says you are. It affects everything you do, like determining the car you're able to purchase, the home you're able to afford, or even if you're able to rent an apartment at all. That reality is made all the more disturbing by the fact that as many as a full third of all Americans . have bad credit For them, life is more difficult than it should be. They pay higher interest rates on loans, pay more to finance credit card debt, and often spend years pursuing methods of to get back on track. It's a system that seems counterintuitive; it not only punishes those with bad credit, it also makes it hard for them to ever escape from it. fixing credit Today, however, lenders and financial institutions are starting to recognize the fact that continuing to rely on traditional credit scoring is cutting them off from so much of the market that it's impacting their bottom lines. To solve the problem, credit reporting agencies and some tech startups are starting to make alternative credit scoring models available to lenders based on everything from how reliably someone pays their cell phone bill to how often they send emails with single-word subject lines. Here's an overview of what's happening. A FICO Score for Millennials Photo: Jacob Lund / Adobe Stock If you examine the problem of poor credit in the US and elsewhere, what you'll find is that the people who have the most difficulty aren't just those who have made poor financial decisions in the past. It is actually people who have no credit history whatsoever – typically younger people who have yet to establish themselves in good standing with creditors. Of course, they can usually turn to eager credit card companies who are more than willing to use their lack of credit history to on their purchases, but that serves to worsen the problem. extract exorbitant fees and interest rates Now, though, one of the largest and most widely-used credit reporting agencies has created a whole new alternative scoring model to expand credit access to those with little to no hard credit history. It's called a score, and it leverages a variety of data sources, including payment histories of utility bills, cable bills, and cellular and landline phones. In short, the kinds of accounts young people are likely to have. The new system has made it possible to create scores for who previously fell outside of the traditional credit scoring systems. The underlying analytics work was so innovative; it even garnered . FICO XD 2 over 26.5 million people an Analytics 50 award for 2017 A 21st Century Approach to Credit Photo: Pablo Lagarto / Adobe Stock The market incumbents aren't the only ones trying to find a technological solution to the problem of poor access to credit. There are also several startups who aim to disrupt the sector with some brilliant and innovative approaches, too. One of them is Singapore-based , which uses a custom-built algorithm to assess non-traditional data and create a credit score. LenddoEFL Their scoring approach uses data points that most people would consider trivial. For example, they use the complexity of a person's average email subject lines as a marker to indicate attention to detail. They use the ratio of front-facing camera photos to standard photographs on your cellphone as a marker for age-related responsibility. They even take how often you use financial apps as an indicator of how serious you are about your money decisions. Together, the markers paint a picture of creditworthiness that has already led to $2.5 billion in loans to over 12 million people – with no appreciable increase in risk over traditional scoring methods. A Move Toward AI Photo: Andrey / Adobe Stock Moving forward, most financial institutions and lenders expect to leverage the kind of alternative credit scoring methods detailed above as a factor in their consumer lending and credit decisions. They don't plan to stop there, though. Most envision turning the entire credit decision-making process over to that can examine a much broader view of an individual's creditworthiness, using both the kinds of data mentioned here as well as any other available financial information considered relevant to the process. AI-enabled systems That should go a long way toward making it easier for those without credit histories to get access to credit and build a file, but should also drastically shorten the time it takes for someone with poor credit to improve their situation. Both of those results are good for all involved, from lenders who will see increased opportunity for profit, to individuals who will have access to the credit they need to live their best life. In a world where you are your credit score – any help that technology can provide is welcomed by all.

How Technology is Improving Access to Credit For Millions of People

TWEET OF THE DAY "Global Coin Research is delighted to announce our new book: 'The Small Handbook to Asia Crypto: on Local Ecosystems, Trends and Regulations'!" - put together a data-rich, 89-slide deck covering Asia's crypto scene . ⚡️ Will likely either be soft-forked in or will be a Bitcoin upgrade that imports the UTXO set . Joyce Yang over here IN BITCOIN Bitcoin's next technical leap according to Adam Back ⚡️ You can now export and visualize metrics from your lnd node thanks to Bitcoin/Lightning developer Valentine Wallace. Lndmon is a drop-in monitoring solution for your lnd node. The tool also allows routing node operators to monitor the activity of their channels, relative fee levels in the network, and more. Who knows, once Lightning channels are uncapped and users can lock in more BTC, there might be a small window of time where you can turn a decent profit by detecting poorly routed (high-fee) channels and offering a slightly cheaper alternative. Lndmon 🔹 Nine months after their announcement at Devcon4, Metamask has its beta mobile app. The app includes an experimental InstaPay feature that enables L2 zero-fee payments using Connext state channels. 🔹 As Ethereum developers start to review the different proposals to improve the Ethereum protocol (EIPs) for the upcoming Istanbul hard fork, one proposal, , has sparked a lot of debate. EIP2025 suggests creating a 1000 ETH dev fund by assigning part of the block reward, 0.005 ETH per block, to a specific multisig address. This has been met with backlash from prominent Ethereum folks like Eric Conner and Ameen Solimani. 🔹 EIP-2028 was approved for the Istanbul hard fork.  The proposal reduces the gas cost for transmitting data on Ethereum from 68 gas/byte to 16 gas/byte which is expected to deliver significant scalability improvement to a number of L2 solutions. IN ETHEREUM Metamask Delivers its Mobile App Beta released EIP-2025 Controversy EIP-2025 Approved Scalability Proposal EIP-2028 🔹 There seems to be a new wave of privacy features and tools coming to Ethereum. In addition to the Heiswap Ethereum mixer that launched on testnet a couple of weeks ago, a new mixer called Tornado.Cash was just . The new mixer uses zk-SNARKs to anonymize the mixer operation. Privacy on Ethereum announced 🔹 The Zcash community witnessed a friendly network split to create a new currency called . The goal is to show early opposition to extending Zcash founder reward beyond 10% of the total Zcash supply. The network split occured on July 18th, with the Ycash network implementing replay-protection to prevent accidental reply of Zcash transactions on Ycash or vice versa. The split-off YEC coin started trading on a small number of exchanges and is currently below $4 (compared to ~$70 ZEC price). 🔹 The MimbleWimble-based coin performed the first of its four scheduled hard forks on July 17th. The hard fork main goal was to update its GPU-friendly mining algorithm (AR29) to prevent ASIC manufacturers from designing chips targeting the algo. So far, Grin's dual-algo mining strategy has been working according to plan. The strategy aims to slowly increase the share of the ASIC-friendly mining algo (AT31) until it constitutes 100% of the network after 2 years. Privacy Coins The Z/Y-Cash friendly split Ycash Grin's First Hardfork 📚 As the use-cases of cryptocurrencies grow, the generated data grows as well and at a much faster rate. An increasing number of tools is available to help analyze that data to obtain meaningful insights. Anthony Sassano curated a of tools that serve Bitcoin, Ethereum, DeFi, and general crypto. Read of the Day A Mega-thread on Blockchain Analysis Tools list THOUGHT OF THE DAY Can DAOs be more agile than traditional firms? Decentralized Autonomous Organizations (DAOs) offer an innovative organizational structure whereby structure, governance, and operations are hardcoded into a smart contract. A DAO is governed by its shareholders that abide by a set of rules, and there isn’t a central authority that controls the organization. DAOs decrease coordination costs and circumvent most bottlenecks that exist in hierarchical organizations today. For example, most decision-making processes/ideas are controlled by key managers within a traditional organization. But innovative ideas and decisions also come from lower-ranking employees, though they often don't make it far. DAOs could enable decisions to be crowdsourced instead so organizations can respond quickly to threats and attacks. Take for example Ameen Solemani's case when he created MolochDAO. His core focus was to respond to areas where Ethereum needs the most development so that it can deliver Ethereum 2.0 before the upcoming smart contract wars. , he brought up the notion that there isn’t a coordinated and efficient way to respond to grants and proposals. On the Epicenter , he also mentioned that the proposal submission process for the Ethereum foundation is an arduous and time-consuming process. If fast execution is needed to deliver Ethereum 2.0, then a new funding process should respond to those needs. MolochDAO is a grant-coordinating decentralized system that allocates and funds areas of development for Ethereum. It was developed to coordinate decision-making processes so that funds could be allocated quickly in areas of need. In order to join MolochDAO, you need to be invited by an existing DAO member. The members will then review your background, reputation, and other metrics to see if the potential member could be resourceful for the overall group. Once voted-in you contribute capital which gives a number of shares in the DAO. The shares enable all members the ability to propose, vote for proposals or leave the DAO by self-destructing its shares. Once a funding proposal is accepted, it receives shares in the DAO that can be immediately converted into ETH. Essentially, MolochDAO collapses an organization into a singular decision-making process while incentivizing its members to enter and leave efficiently. MolochDAO could enable Ethereum to move faster by coordinating decisions, bringing unique participants and adding a fixed-time function. Currently, developers have a few ways to apply and receive grants, such as Gitcoin and the Ethereum Foundation. However, both organizations have unique organizational structures and motives that can detract time and focus. For example, members in the MolochDAO can add and vote in proposals within a 14-day time frame. This gives the entire member base a chance to express feedback while executing on a fixed time. Since the launch of MolochDAO in April, there have been roughly 76 proposals submitted. Out of the 76 proposals, 6 proposals were awarded a total of 249 shares to work on Ethereum 2.0. MolochDAO currently has 65 members and a diversified member base that consists of leaders, organizations, funds, and developers.  Each member has a unique outlook on how Ethereum 2.0 should be designed and implemented. MolochDAO plans to coordinate those unique outlooks while getting consensus and funding developers quickly. In his report podcast Enter MolochDAO Could MolochDAO enable Ethereum to move faster? p for Token Daily Newsletter to learn more. Sign u

Token Daily Capital Newsletter # 6

When it comes to securing your Kubernetes clusters, and the applications that run within it, there aren't a lot of security features enabled 'out-of-the-box'. This isn't necessarily a bad thing. This ensures that the amount of work required to get your first application up and running remains minimal. But when we're past the testing and development phase, we (of course) get to production. And that's where the real fun starts. There are few options available to add layers of security to you cluster. Today we'll take a closer look at PSP comes standard with Kubernetes, disabled by default and is currently in Beta. Pod Security Policies (PSP). Open Policy Agent (OPA) is a third party solution that is gaining popularity - and could potentially be an replacement option in the case that pod security policies don't make it to GA. A brief description of Kubernetes Pod Security Policies: Official Docs A Pod Security Policy (PSP) is a cluster-level resource that controls security sensitive aspects of the pod specification. The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system, as well as defaults for the related fields. So, what does that mean? Well, Pod Security Policies ensures that any pods in your cluster run within specific security boundaries. As a cluster-wide resource, this can't be enabled only for specific namespaces. Once enabled, all new pods (or when existing ones are restarted) are evaluated against these security boundaries, and if they pass the security checks, they are allowed to run. But what kind of boundaries are we talking about? I hear you ask… With a restrictive policy - more on this later - none of the containers are allowed added capabilities, the pods are only allowed to access specific Kubernetes resources, and pods aren't allowed to use the host's Linux namespaces (i.e. user or network). As an example. we can allow our pods to mount secrets, configMaps, and persistentVolumeClaims, but we do not allow any hostPaths to be mounted. Somewhere during my journey of grasping container concepts, I remember thinking: “Is the root user inside the container the same as the host?” and “If someone gained access to your containers, could they somehow elevate their privileges, and break our of the container or even access files on the host?” In short, yes… and is quite scary. For this reason - and more - is exactly what we're trying to prevent with pod security policies. that The problem is what nightmares are made of. An extreme example, but it does showcase what is possible. Let's quickly demonstrate this on our cluster. I doubt I have to say it; but for the record… This LAB THIS SCRIPT IS NOT FOR PRODUCTION USE. As a user with kubectl access, create the script (from the above link) and make it executable. Run it. And this will drop you into a new prompt. Executing the command returns . But this just means we are a root user inside the container? So…? Taking a closer look at the script, what it actually does is it mounts the host file-system, and executes a bash session. Wait! Ok, does this mean what I think it means? I'm afraid so... whoami root From inside the container, we're able to create files on the host's root filesystem. [root@sudo-- -cluster /] [root@sudo-- -cluster /] pod deleted [root@ -cluster /] total 28
[...]
-rw-r--r--.   1 root root    0 Dec 20 10:07 CreatingAFileOnRoot      <-- Here it is
drwxr-xr-x.  19 root root 3760 Dec 20 10:15 dev
drwxr-xr-x.  80 root root 8192 Dec 20 10:11 etc
drwxr-xr-x.   4 root root   28 Dec 20 09:24 home
[...] # inside the container test # touch /CreatingAFileOnRoot test # exit "blackspy-sudo" # on the host test # ls -l / The Fix We already know that PSPs will be able to help fix this rather critical problem, so let's get started. Check if PSPs are enabled for your kubeadm cluster An easy way to check whether PSPs are enabled is to double-check the Kube-API Server's configurations. On a kubeadm cluster, we can simply grep for it in the manifest file. As in the example below, you will see a comma-separated list of enabled plugins, and with ‘PodSecurityPolicy’ absent from the list, we know PSPs are not enabled for this cluster. - -- -admission-plugins=NodeRestriction # grep admission /etc/kubernetes/manifests/kube-apiserver.yaml enable Check if PSPs are enabled for your Rancher managed K8s cluster: On the Kubernetes nodes, check if ‘PodSecurityPolicy’ is listed in the list of plugins in the below output: $ docker inspect $(docker container ls | grep kube-apiserver | awk ) | grep '{print $1}' "enable-admission-plugins" "--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestrictio
n,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy" Enable PSPs - For our kubeadm cluster we can simply add to the comma-seperated list, and save the file. Seeing as it's a manifest file, once you save and exit, the Kube-API static pod will be restarted, and PSPs are enabled. You might not be able to get the status of your pods right away, cause obviously your API server is busy restarting. Keep in mind that static pods are node specific, so perform this step on all nodes. kubeadm PodSecurityPolicy - -- -admission-plugins=NodeRestriction,PodSecurityPolicy The connection to the server 10.10.7.10:6443 was refused - did you specify the right host or port?
NAME                                          READY   STATUS              RESTARTS   AGE
calico-kube-controllers-c9784d67d-4gnlz       1/1     Running             4          95d
calico-node-v6cbw                             1/1     Running             4          95d
coredns-f9fd979d6-gmrms                       1/1     Running             4          95d
coredns-f9fd979d6-xwnmv                       1/1     Running             4          95d
etcd-test-cluster                             1/1     Running             4          95d
kube-apiserver-test-cluster                   0/1     ContainerCreating   0          95d
kube-controller-manager-test-cluster          1/1     Running             5          95d
kube-proxy-knr2v                              1/1     Running             4          95d
kube-scheduler-test-cluster                   0/1     Running             5          95d 02ec67ffcf0e        ce0df89806bb 3 seconds ago       Up 2 seconds                            k8s_kube-apiserver_kube-apiserver-test-cluster_kube-system_e130d9af7a94d4a3fa4400b359d3a943_0
b919e9689f1c        k8s.gcr.io/pause:3.2 5 seconds ago       Up 4 seconds                            k8s_POD_kube-apiserver-test-cluster_kube-system_e130d9af7a94d4a3fa4400b359d3a943_0 # grep admission /etc/kubernetes/manifests/kube-apiserver.yaml enable # while true; do kubectl get pod -n kube-system; sleep 5; done # docker container ls | grep kube-api "kube-apiserver --ad…" "/pause" - If you are using a managed Kubernetes offering from a cloud provider, you obviously don't have access to the API configs, they often provide additional advanced settings where you can enable PSPs in your cluster. Cloud Providers - This is probably the easiest. Edit the cluster in the GUI, and under ‘Advanced Options’ select a Default Pod Security Policy. Rancher This is already enough to prevent someone from taking control of your cluster, like we demonstrated above. But we'll need to write rules to at least allow our good pods into the cluster. Just a note here: Let's quickly test a simple nginx pod via a deployment. [root@test-cluster /]# kubectl create deploy nginx -n test-ns --image=nginx
pod/test-pod created
[root@test-cluster /]# kubectl get pod -n test-ns
No resources found test-ns namespace. in Ok. So our pod wasn't created. Let's look at the other resources that form part of our deployment. [root@test-cluster /]# kubectl get all -n test-ns
NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nginx / m58s

NAME                               DESIRED   CURRENT   READY   AGE
replicaset.apps/nginx fc88d8 m58s 0 1 0 0 4 -6799 1 0 0 4 We can see our deployment created a replicaset resource, but our replicaset wasn't able to create the pod. Doing a on the replicaset we see the following: describe [...]
Events:
  Type     Reason        Age                   From                   Message
  ----     ------        ----                  ----                   -------
  Warning  FailedCreate  56s (x17 over 6m24s)  replicaset-controller  Error creating: pods is forbidden: PodSecurityPolicy: no providers available to validate pod request "nginx-6799fc88d8-" Looks like we'll have to write some policy to allow some pods. A preferred restrictive pod security policy: apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: super-restricted-psp
spec:
  allowPrivilegeEscalation: fsGroup: ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups: ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes: - configMap
  - emptyDir
  - projected
  - secret
  - downwardAPI
  - persistentVolumeClaim false # Prevents process to gain more privileges than its parent # Prevents GID 0 to be used by pods # Restrict supplemental GIDs to be non-zero # Only allow specific volumes But what does it all mean!? With the above policy we ensure that pods are quite ring-fenced. Let's go through a few items: - Essentially we're worried about containers processes without the flag set. This flag controls whether a process can gain more privileges than its parent process. Setting to false, ensures that the no_new_privs flag is set on our pods. - Any supplemental groups added to the volumes, must fall in the range between 1 and 65535. - Docker provides a set of capabilities to a container by default. These are capabilities like; chown, kill, setgid, etc. ( ). These are capabilities that, in majority of use-cases, and in my opinion, you won't necessarily need for a running container - these tasks can be taken care of at build time or by an init-container. With we only allow containers into the cluster that have dropped all their capabilities. This requires a parameter in the docker-compose file. Something like this: allowPrivilegeEscalation: false no_new_privs allowPrivilegeEscalation fsGroup requiredDropCapabilities Full list here requiredDropCapabilities: ALL cap_drop: ALL frontend:
  image: frontend
  build:
    context: .
  ports:
    - 2011:2011
  volumes:
    - ./frontend/src/:/frontend/
  env_file: .env
  cap_drop:
    - ALL If additional capabilities are required, I would suggest to drop all of them, and only add what is needed ( ). You will also need to create a custom PSP to match, otherwise, once again, the pod won't be allowed to run. - We only allow pods that want access to this list of resources. If a pod tries to mount a hostPath, it won't be allowed to run. cap_add volumes Exceptions You will, without a doubt, need to run pods that have more privileges than what is allowed in this policy above. As a simple example; a number of log shipping solutions requires the container run-time, to log container output to a file on the host (i.e. docker logging driver set to json-file). The log shipping pods then mount the host-path (where the logs are written to) and ship these to a Graylog, syslog, or ElasticSearch server. Roles and their bindings Additional to the above PSP, we will need to provide our pod's service account access to the PSP, and this done with Roles and Rolebindings. In my opinion, the above policy is rather restrictive, and it could be treated as a default cluster-wide policy. For this default policy we could write cluster roles and cluster role bindings to give access to any service account in the cluster. If and when a deployment requires additional permissions, a custom ad-hoc PSP can be written, but shouldn't necessarily be allowed to be used by all deployments (service accounts) as this could just put us in a similar exposed position as before (an open PSP to be used by everyone). PSP <--> Role <--> RoleBinding <--> ServiceAccount We will dig into the above now, but essentially a PSP is linked to a service account via a Role and a RoleBinding. First we link the PSP to a cluster role. We can see below that our cluster role is allowed to the called . cr-use-restricted-psp use podsecuritypolicy super-restricted-psp Cluster Role apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-use-restricted-psp
rules:
- apiGroups: [ ]
  resources: [ ]
  verbs:     [ ]
  resourceNames:
  - super-restricted-psp 'policy' 'podsecuritypolicies' 'use' With that done, we create a ClusterRoleBinding where we tie our ClusterRole to our system's service accounts (all of them, current and future). cr-use-restricted-psp Cluster Role Binding ---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-use-restricted-role
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cr-use-restricted-psp
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts Adding all three objects (PodSecurityPolicy, ClusterRole and ClusterRoleBinding) to a yaml file, and kubectl apply it. [root@ -cluster /] podsecuritypolicy.policy/super-restricted-psp created
clusterrole.rbac.authorization.k8s.io/cr-use-restricted-psp created
clusterrolebinding.rbac.authorization.k8s.io/crb-use-restricted-role created test # kubectl apply -f restrictive-psp.yml We can see our newly created PSP with the following command: [root@ -cluster /] NAME                   PRIV    CAPS   SELINUX    RUNASUSER   FSGROUP     SUPGROUP    READONLYROOTFS   VOLUMES
super-restricted-psp RunAsAny   RunAsAny    MustRunAs   MustRunAs configMap,emptyDir,projected,secret,downwardAPI,persistentVolumeClaim test # kubectl get psp false false Looking Good!! Let's try run an nginx pod with our new security rules in place. [root@ -cluster /] pod/ -pod created
[root@ -cluster /] NAME                     READY   STATUS             RESTARTS   AGE -pod                 0/1     CrashLoopBackOff   3          112s
[root@ -cluster /] [...]
Events:
  Type     Reason     Age                  From                          Message
  ----     ------     ----                 ----                          -------
  Normal   Scheduled  11m                                                Successfully assigned -ns/ -pod to -cluster
  Normal   Pulled     11m                  kubelet, -cluster         Successfully pulled image 4.378131401s
  Normal   Created    10m (x4 over 11m)    kubelet, -cluster         Created container -pod
  Normal   Started    10m (x4 over 11m)    kubelet, -cluster         Started container -pod
  Normal   Pulling    9m46s (x5 over 11m)  kubelet, -cluster         Pulling image Warning  BackOff    103s (x46 over 11m)  kubelet, -cluster         Back-off restarting failed container

[root@ -cluster ~] [...]]
/docker-entrypoint.sh: Configuration complete; ready start up
2020/12/20 10:15:07 [emerg] 1 nginx: [emerg] chown( , 101) failed (1: Operation not permitted) test # kubectl run test-pod -n test-ns --image=nginx test test # kubectl get pod -n test-ns test test # kubectl descibe test-pod -n test-ns test test test test "nginx" in test test test test test "nginx" test test # kubectl logs test-pod -n test-ns for #1: chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted) "/var/cache/nginx/client_temp" Our pod failed to start, which in this case, is a good thing. Looking at the logs we can see that the nginx application tries to perform a chown (which is an added capability), and according to our PSP this is not allowed. Success… What if we want nginx to run? We have two options: If we don't mind giving it the permissions that it needs, we can write a new PSP (include companying Role and RoleBinding) that allows the chown capability. If we don't want to give it the permissions that it needs, we will have to amend the container to match our security requirements. There are a number of unprivileged nginx and httpd container images available on dockerhub For pods that don't require these additional permissions and fall within our security boundaries, they will be allowed to run without any additional configuration. Checking which PSP was assigned to my pod When a pod is allowed to run, the PSP that is assigned to the pod, is added as an annotation in the pod object yaml. A quick For loop: $ pod $(kubectl get pod -n <namespace> | grep -v NAME | awk ); echo $pod; kubectl get pod $pod -n <namespace> -o yaml | grep psp; done for in '{print $1}' do Or using labels and jsonpath selectors: $ kubectl get pod -l <labelKey>=<labelValue> -n <namespace> -o jsonpath= '{.items[*].metadata.annotations.kubernetes\.io/psp}' How are pods evaluated against PSPs If there are multiple policies available in the cluster, the PSP controller evaluates the pod's capabilities against the policies that - its service account has access to - in alphabetical order, and uses the first policy that allows the pod to run. If you want to specifically set a pod or deployment to use a custom PSP we can do that by specifying the service account in the deployment yaml. By not specifying a service account, the default service account in the namespace is used. [...]
containers:
- image: containerRegistry/myRepo/imagename:v2 name: coolContainer
  securityContext:
    capabilities:
      add:
      - CHOWN
      - SETGID
      - SETUID
      drop:
      - ALL
  volumeMounts:
  - mountPath: name: container-storage
serviceAccountName: coolContainer-sa .1 .0 "/storage" Conclusion Let's take another look at that malicious pod from earlier. We can see that the pod isn't even allowed to start and because of that it doesn't drop the user into a bash prompt. Doing a kubectl describe on the failed replica-set we see the following: Error from server (Forbidden): pods is forbidden: PodSecurityPolicy: unable to validate against any pod security policy: [] "blackspy-sudo" That feels better! Way more secure… But with anything in security, we need more layers! PSPs are by no means a silver bullet. Implementing PSPs in your cluster is just one of the many layers needed to secure your container development life-cycle.

The Restrictive Pod Security Policies in Kubernetes

You may think blockchain has little to do with hardware. After all, from Bitcoin to Etherum, blockchains are all software-defined. The hardware-based solution is usually more centralized. However, in the privacy-preserving blockchain world, by carefully combining software and hardware, we could design a solution with the best balance between scalability and confidentiality, while still keeping it trustless. TEE based blockchain confidentiality Phala Network implements a confidential smart contract. It differs from traditional contracts because contracts run inside a special hardware enclave in CPU, i.e. Trusted Execution Environment. The program running inside TEE is highly isolated from the rest of the world. A malicious attack can neither read the data in the memory without authorization nor manipulate the program to produce any unintended behavior. In Phala Network, we call the supportive program running inside TEE “ ”. is the runtime environment that maintains the basic TEE miner and Gatekeeper protocol inside the TEE. It handles the TEE remote attestation, on-chain registration, key management, and confidential contract execution. pRuntime pRuntime But how to convince a user the smart contract is running inside , not an emulator that doesn’t provide any data security? Here comes the core concept: Remote Attestation. pRuntime Remote Attestation “An application that hosts an enclave can also ask the enclave to produce a report and then pass this report to a platform service to produce a type of credential that reflects enclave and platform state. This credential is known as a quote. This quote can then be passed to entities off of the platform, and verified…” Remote Attestation is the key to ensure the security of a TEE system. , it proves that a certain code (measured by the hash of the code), optionally with some customized data generated by the code, is running inside an up-to-date genuine Intel SGX enclave. Quoted from Intel Secret Provisioning Remote Attestation is a basic building block for confidential smart contracts. But it’s not very useful if we cannot establish an end-to-end secure communication channel between a party to TEE. Intel SGX also provides a protocol to solve the problem elegantly. Secret Provisioning By adopting the Secret Provisioning protocol, a chain of trust from the user to can be established: pRuntime The blockchain has the hash of the canonical codepRuntime runs the remote attestation protocol, gets a report with the data: hash of the attested code ( itself); and the public key of an ephemeral identity key pairThe RA report is submitted to the blockchain and validated on-chain. The blockchain compares the hash from the RA report (implies: the participant is a canonical in TEE)The identity public key is registered on the blockchain (implies: only the current has control over this identity key) pRuntime pRuntime pRuntime pRuntime As a result, as long as a message is signed by the identity key, it must be produced by the registered . Users can further establish a TLS-like connection to a with its registered public key. pRuntime pRuntime To communicate with TEE, the user can get the public key of a certain from the blockchain (from TEE registration). Then the user can use the public key of his substrate account to run a Diffie-Hellman protocol. It derives a secret key for communication between the user and the . pRuntime pRuntime As the chain-of-trust established, it also implies the identity key is sufficient to uniquely represent the identity of the . So a single Remote Attestation can protect all the future communication with the pRuntime, if under the assumption of no TEE hardware breach (which will be discussed later). pRuntime How about upgrading? On-chain upgrading is a critical requirement as it greatly reduces the security risks exposed by a hard-fork upgrade. Substrate natively supports on-chain runtime upgrade. It’s done by the on-chain governance pallet. On the TEE side, the runtime is also upgradable. When upgrading pRuntime, we should submit the hash of the new pRuntime version to the blockchain. Then the community can review the code, discuss, and vote for the upgrade by an on-chain governance process similar to Substrate. Both Gatekeepers and miners have to upgrade pRuntime once a new version is accepted on-chain. Miners are easier because they can simply stop mining, do the upgrade, and resume mining. This is possible because miners are not required to be always online. Gatekeepers have high availability requirements. So they either run another TEE client with the newer version, and wait for a natural Gatekeepers switch in the next election period, or do an emergency encryption dump of the states, and recover it to the new pRuntime. Though there are risks to dump the state, it’s still useful in case of an emergency. SGX provides a , which can produce a cipher that can only be decrypted by the same enclave. “seal to enclave” feature To mitigate the risks for hardware security exploits, the keys in the Gatekeepers are distributed by a Shamir secret sharing scheme, which means that even the sealing is broken, the host still cannot get the original keys without massive collusion. Attack and defense Our threat model partially assumes the TEE manufacturer can be trusted. This is reasonable. First, they don’t know how their hardware will be used and thus only can plan the attack ahead of time, reducing the risks. Second, if affected by zero-day attacks, the other applications running on this CPU are generally at risk. Though we have the above assumption, we see actual hardware exploits come in the past. Fortunately, the vulnerable can usually be mitigated in a few ways. It’s common to think software vulnerabilities are patchable while hardware vulnerabilities are not. This is not always the case. CPU can be patched by microcode updates. With the special design of Intel SGX architecture, most of the vulnerabilities can be fixed. Recently there was an attack called , it was fixed by followed by a group key rotation. After the key rotation and revocation, all the out-of-date devices get rejected by the remote attestation. SGAxe a microcode upgrade But you might ask, what if someone still finds zero-day hardware vulnerable? Suppose the vulnerability requires physical access to exploit it, miners will be possible to steal data from the confidential contract. In this case, can apply randomness to mitigate. The blockchain can randomly assign some miners to the confidential contracts in a period. The miners shuffle in every such period. As long as the malicious party doesn’t have control over a great number of miners, the cost to do such an attack will be significantly high because it requires a massive control in a relatively long time. In the worst case where the enclave is fully cracked, exposing the confidential data available to the attacker and allowing the attacker to arbitrarily manipulate the execution, we still don’t want to give up the correctness of confidential contract. Therefore we have the design that confidential contracts can require one or more replications. The replication number doesn’t affect how the contract is executed because all the inputs are from the blockchain and thus deterministic. However, if more than one replica exists, multiple TEEs will try to commit the states back to the blockchain. In this case, there will be a simple on-chain voting process. We require a simple majority to “finalize” the states. By having replications, it failed-back to a Polkadot’s validator-like security model. The attacker must control a sufficient amount of miners to break the correctness, even if SGX’s security assumption is broken. Summary In the past, blockchains are only software. The miss of confidentiality has long become a limitation for mass adoption. With the help of hardware and carefully designed protocol, we showed that it’s possible to build a secure, scalable, and confidential-preserving blockchain. About Phala An early confidential smart contract blockchain on which you can develop confidential-preserving and privacy-first blockchain apps. Member of Builders Program starting lineup. Recipient of . Substrate-based Parity Web3 Foundation Grant | | 🌐Official Website Twitter Github

Should We Kick Hardware out of Blockchain?

The US presidential election, scheduled for November 5 of 2024, is beginning to have a strong impact on the cryptocurrency market. The topic of cryptocurrency continues to gain traction in speeches delivered by the candidates seeking to gain votes from the cryptocurrency community, which accounts for more than 46 million citizens in the United States - 22% of the adult population, according to the New York research agency NYDIG. Given the current administration’s totalitarian attitudes towards cryptocurrency and cryptocurrency companies, we can expect easing of regulation as we get closer to the November elections. Trump vs Biden Cryptocurrency Debate The debate between serving President John Biden and the presidential candidate Donald Trump was reported on May 15, 2024, by CCN. The serving president will have to answer several unpleasant questions regarding the implemented cryptocurrency regulation policy, which has led to an outflow of cryptocurrency capital, the shutdown of large companies, and high-profile lawsuits. From Donald Trump, who has turned the topic of cryptocurrency into a weapon against his opponent, in addition to attacks on the current state of affairs, one can expect loud election promises that can lead to significant volatility in the cryptocurrency market. The possible participation of Elon Musk, who has expressed his willingness to host the debate, and independent candidate Robert Kennedy Jr., also known for his love of cryptocurrencies, could turn the debate from a pre-election event into a cryptocurrency one. The first round of debates will take place on June 27, and the second on September 10. Coins without technology and product Meme tokens, popular in the cryptocurrency market in 2024, were a response to the position of the US Securities Commission (SEC), led by the main cryptocurrency villain Garry Gensler. According to the SEC's position, all cryptocurrency tokens issued by blockchain projects must be registered as securities. This makes sense: investors become familiar with the project, believe in its technology, and invest in the creation of the product through the purchase of shares or tokens. As a response to the SEC's position, the market has introduced meme tokens - comic-like cryptocurrencies, behind which there is neither technology nor product development, which does not allow the SEC to classify them as shares and, accordingly, charge the creators of the tokens with trading in unregistered securities. Today, there are 2,283 meme tokens listed on Coinmarketcap, representing only 10% of the total meme tokens created, and the combined capitalization of registered coins exceeds US$60 billion. The meme coin market continues to grow - 183 new cryptocurrencies were issued in April of 2024 compared to 18 in April of 2023. The average increase in the value of new coins after launch is 1300%, so it is not surprising that these coins without a product and technology have become so popular. The Hot Meme Summer 2024 The spring of 2024 saw the launch of several “political” meme tokens. The TRUMP token, created in February of 2024 on the SOLANA blockchain, has grown by 20% over the entire period and has now grown by 113% against the backdrop of Donald Trump’s decision to accept cryptocurrencies as donations during the election campaign. TRUMP is not currently traded on any centralized exchanges. TheMAGA token on the Ethereum blockchain was launched in December of 2023 and has grown by 41% over the entire period, and by 25% since the announcement of the debate on May 15. Like its predecessor, the token is not traded on centralized exchanges. The STRUMP token, launched at the end of March of this year on the Ethereum blockchain, grew 1100%, but between May 15 and May 22 showed a modest increase of 6%, which is significantly lower than the market average. STRUMP, however, is available for purchase on centralized exchanges. TheBABYTRUMP token launched at the end of February of this year on BinanceSmartChain, is up 39% to date, with a 17% increase between May 15 and May 22. The token is traded on centralized and decentralized exchanges. Another meme coin honoring Donald Trump, TREMP, was also launched in March on the SOLANA blockchain, and has grown by 800% over the entire period and by 90% from May 15 to  May 22. The token is traded in different places. Joe Biden is represented by the__Boden__ meme token on SOLANA. Since its launch in March, it has grown by 780%, and in the period from May 15 to 22 - by 6%. This token is available on various platforms. Elon Musk, a darling of the crypto community andDOGE ambassador, as well as a potential debate host, has two new coins dedicated to him. The OLENMOSK token, launched in March on the SOLANA blockchain, dropped in price by 86% over the entire period and remained stable from May 15 to May 22. It is, however, not available for purchase on centralized exchanges. Another token ELON is also in the red zone, having lost 92% in price over the entire period, but over the past week showed an increase of 13%. Unlike the previous token, ELON is traded on several large centralized exchanges. Judging by the number of new “political” meme tokens and the dynamics of their prices, the crypto community is betting on the further growth of the popularity of Donald Trump and his victory in the upcoming elections, which may affect the growth in the value of the cryptocurrencies inspired. However, you need to be prepared for total sales after the first stage of the debate. Not financial advice. DYOR The US presidential election, scheduled for November 5 of 2024, is beginning to have a strong impact on the cryptocurrency market. The topic of cryptocurrency continues to gain traction in speeches delivered by the candidates seeking to gain votes from the cryptocurrency community, which accounts for more than 46 million citizens in the United States - 22% of the adult population, according to the New York research agency NYDIG. Given the current administration’s totalitarian attitudes towards cryptocurrency and cryptocurrency companies, we can expect easing of regulation as we get closer to the November elections. The US presidential election, scheduled for November 5 of 2024, is beginning to have a strong impact on the cryptocurrency market. The topic of cryptocurrency continues to gain traction in speeches delivered by the candidates seeking to gain votes from the cryptocurrency community, which accounts for more than 46 million citizens in the United States - 22% of the adult population, according to the New York research agency NYDIG. Given the current administration’s totalitarian attitudes towards cryptocurrency and cryptocurrency companies, we can expect easing of regulation as we get closer to the November elections. Trump vs Biden Cryptocurrency Debate Trump vs Biden Cryptocurrency Debate The debate between serving President John Biden and the presidential candidate Donald Trump was reported on May 15, 2024, by CCN. The serving president will have to answer several unpleasant questions regarding the implemented cryptocurrency regulation policy, which has led to an outflow of cryptocurrency capital, the shutdown of large companies, and high-profile lawsuits. From Donald Trump, who has turned the topic of cryptocurrency into a weapon against his opponent, in addition to attacks on the current state of affairs, one can expect loud election promises that can lead to significant volatility in the cryptocurrency market. The possible participation of Elon Musk, who has expressed his willingness to host the debate, and independent candidate Robert Kennedy Jr., also known for his love of cryptocurrencies, could turn the debate from a pre-election event into a cryptocurrency one. The first round of debates will take place on June 27, and the second on September 10. The debate Coins without technology and product Meme tokens, popular in the cryptocurrency market in 2024, were a response to the position of the US Securities Commission (SEC), led by the main cryptocurrency villain Garry Gensler. According to the SEC's position, all cryptocurrency tokens issued by blockchain projects must be registered as securities. This makes sense: investors become familiar with the project, believe in its technology, and invest in the creation of the product through the purchase of shares or tokens. As a response to the SEC's position, the market has introduced meme tokens - comic-like cryptocurrencies, behind which there is neither technology nor product development, which does not allow the SEC to classify them as shares and, accordingly, charge the creators of the tokens with trading in unregistered securities. Today, there are 2,283 meme tokens listed on Coinmarketcap , representing only 10% of the total meme tokens created, and the combined capitalization of registered coins exceeds US$60 billion. The meme coin market continues to grow - 183 new cryptocurrencies were issued in April of 2024 compared to 18 in April of 2023. The average increase in the value of new coins after launch is 1300%, so it is not surprising that these coins without a product and technology have become so popular. Coinmarketcap Coinmarketcap The Hot Meme Summer 2024 The spring of 2024 saw the launch of several “political” meme tokens. The TRUMP token, created in February of 2024 on the SOLANA blockchain, has grown by 20% over the entire period and has now grown by 113% against the backdrop of Donald Trump’s decision to accept cryptocurrencies as donations during the election campaign. TRUMP is not currently traded on any centralized exchange s. TRUMP TRUMP SOLANA SOLANA not currently traded on any centralized exchange The MAGA token on the Ethereum blockchain was launched in December of 2023 and has grown by 41% over the entire period, and by 25% since the announcement of the debate on May 15. Like its predecessor, the token is not traded on centralized exchanges. MAGA not traded on centralized exchanges. The STRUMP token, launched at the end of March of this year on the Ethereum blockchain, grew 1100%, but between May 15 and May 22 showed a modest increase of 6%, which is significantly lower than the market average. STRUMP , however, is available for purchase on centralized exchanges. STRUMP STRUMP The BABYTRUMP token launched at the end of February of this year on BinanceSmartChain, is up 39% to date, with a 17% increase between May 15 and May 22. The token is traded on centralized and decentralized exchanges. BABYTRUMP Another meme coin honoring Donald Trump, TREMP , was also launched in March on the SOLANA blockchain, and has grown by 800% over the entire period and by 90% from May 15 to  May 22. The token is traded in different places. TREMP TREMP Joe Biden is represented by the__ Boden __ meme token on SOLANA. Since its launch in March, it has grown by 780%, and in the period from May 15 to 22 - by 6%. This token is available on various platforms. Boden Elon Musk, a darling of the crypto community and DOGE ambassador, as well as a potential debate host, has two new coins dedicated to him. The OLENMOSK token, launched in March on the SOLANA blockchain, dropped in price by 86% over the entire period and remained stable from May 15 to May 22. It is, however, not available for purchase on centralized exchanges. Another token ELON is also in the red zone, having lost 92% in price over the entire period, but over the past week showed an increase of 13%. Unlike the previous token, ELON is traded on several large centralized exchanges. DOGE OLENMOSK ELON ELON ELON ELON Judging by the number of new “political” meme tokens and the dynamics of their prices, the crypto community is betting on the further growth of the popularity of Donald Trump and his victory in the upcoming elections, which may affect the growth in the value of the cryptocurrencies inspired. However, you need to be prepared for total sales after the first stage of the debate. Not financial advice. DYOR Not financial advice. DYOR Not financial advice. DYOR

How the Upcoming Us Elections Are Changing the Cryptocurrency Market

This article is not for those who are easily afraid by the low-level specifics of container images and rely on high-level tools ( , , etc.) to package the application and its runtime dependencies into a container image. buildkit docker buildah What is a container image? A container image, in its most basic form, is a collection of tarball files in charge of the following tasks: Provide a root filesystem for the container process and its children to build an isolated environment, and restrict access to files and commands outside of the root filesystem. The instructions for setting up the container process with environment variables, cgroups, namespaces, security settings, and so on. That's nice, but … Is it good enough to deliver a container image for " "? Hello World What is the format of a container image? Is there any effort to standardize image formats for creating and transporting container images? What should we be searching for? Will container runtimes recognize my container image? … Open Container Initiative The is a non-profit open governance organization whose sole goal is to create open industry standards for container formats and runtimes. With that industry aligning around a set of open, universal container technology standards. Open Container Initiative OCI Image Specification specification defines an OCI Image as a , an (optional), a set of , and a . The purpose of this standard is to make it possible to develop compatible tools for different container runtimes (docker, container, rkt, runc, crun, etc.) This manifest image index filesystem layers configuration At the top level, a OCI Image is just a tarball, and it has the layout as below. # OCI container image layout
├── blobs
│   └── sha256
│       ├── DIFFID      (image.manifest)
│       └── DIFFID      (image.config)
│       └── DIFFID      (image.rootfs)
│       └── DIFFID      (image.application)
│       └── DIFFID      (image .... )
│       └── DIFFID      (image .... +n)
├── index.json
└── oci-layout Image Index (index.json) The image index is a collection of manifests for one or more platforms and is the starting point. It effectively acts as a manifest, listing all of the "resources" that a single container image requires. Key Property Descriptions Name Description architecture Name of the compilation/CPU architecture. os Name of the OS. (Linux, windows) os version Version of the operating system targeted by the referenced blob. manifests List of manifests for specific platforms. Sample OCI Image Index ~$ skopeo inspect --raw docker://yorek/multiarch-hello-world
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 428,
         "digest": "sha256:9b874ccdb73e1aaf29e1c0fd3a550ddfa486d73525f2d77b452e30a09d3cb417",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      }, 
      .....
   ]
} Image Manifest An image manifest specifies the layers and configuration of a single container image for a certain architecture and operating system. Sample OCI Image Manifest Specification for Linux ~$ cat blobs/sha256/dfddba39ed871b3994726d34b0f33b313101c8262567590c02d3763f9f5a27f6 | jq
{
  "schemaVersion": 2,
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:97895c15ee91c7d4957334444c1a449c52fc6c2f90a7113b49d77c8718f7d8c4",
    "size": 3058
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:45337b3433fa437664b13287291679cf9edca3230f1f37043cc61dab03199d6d",
      "size": 26692286
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:36d0aa647669adaa137c59f52b7e91018ef63c75a0daee690963133217ee47b3",
      "size": 54120976
    },
    .......

  ]
} You'll notice that the image manifest is merely a text file with no raw data streams from any of the filesystem layers. The manifest format provides a list of distribution artifact hashes. This list of hashes is effectively a set of instructions on what to download, in what order, how to validate against the content hashes after decompression. These hashes are represented in format to enable and uniquely identify image resources. Digests content addressability is Digest format digest ::= algorithm ":" encoded sha256:6c3c624b58dbbcd3c0dd82b4c53f04194d1247c6eebdaab7c610cf7d66709b3b Since we're talking about hashes, we need to distinguish between content hashes and distribution hashes. Content hashes Distribution hashes A content hash is used for uncompressed data present in the layers. A distribution artifact hash is simply a hash of the compressed blob. To hash a gzipped item, compression must first occur. Check the downloaded layers' integrity without first uncompressing them. The use of distribution artifact hashes eliminates the requirement to maintain a mapping of content hashes. But How To Build A Root Filesystem? The root file system is . It contains the files and directories critical for system operation, including the mounting device directory and programs for booting the container processes. the hierarchical file tree But how to build this hierarchical file order? image layers, also known as . We record file system changes (addition of files, removal of files, or updates) as achieve files. The first achieve file is the base layer; all the other achieve files contain only the changes to its base. Together these achieve files, in chronological order, are what make up the final Root Filesystem. Well, the answer is achieve files But ….. I still have questions Can these achieve files hold configuration metadata such as environment variables or default arguments? How to establish chronological order among these achieve files? How to pass security parameters for the container or child processes? etc.… Well, the answer is in Container Configuration It describes metadata information about the image such as date created, author, as well as execution/runtime configuration like its entry point, default arguments, networking, and volumes. It establishes chronological order among these achieve files (layers). It is JSON data structure and is considered to be immutable. {
  "created": "2021-01-07T01:29:27.650294696Z",
  "architecture": "amd64",
  "os": "linux",
  "config": {
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    ],
    "Cmd": [
      "/hello"
    ]
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
        "sha256:c6f988f4874bb0add23a778f753c65efe992244e148a1d2ec2a8b664fb66bbd1",
        "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
    ],
    .....
    
  },
  "history": [
    .....
  ],
  .....
  .....
} ENOUGH THEORY > WHEN WILL WE START BUILD THE IMAGE Step 1: Prepare defaults $ ALGORITHM="sha256"  
$ BUILD_DIR="build"  
$ BLOBS_DIR="$BUILD_DIR/blobs/$ALGORITHM"
$ mkdir -p $BLOBS_DIR Step 2: Get the busybox image as a base image # GET AUTH TOKEN
$ TOKEN=$(curl "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/busybox:pull" | jq -r .token)

# PULL LATEST MANIFEST (DOCKER V2) OF BUSYBOX FROM THE REGISTRY
$ curl https://registry.hub.docker.com/v2/library/busybox/manifests/latest  \
		-H "Accept: application/vnd.docker.distribution.manifest.v2+json"  \
        -H "Authorization: Bearer $TOKEN"  \
        -L \
        -o manifest.json 

# PARSE LAYERS REFs FROM THE MANIFEST 
$ CONFIG_LAYER=$(cat manifest.json | jq -r '.config.digest')
$ ROOTFS_LAYER_DIGEST=$(cat manifest.json | jq -r '.layers[0].digest')  
$ ROOTFS_LAYER_SIZE=$(cat manifest.json | jq -r '.layers[0].size')         

# PULL CONFIG LAYER OF BUSYBOX FROM THE REGISTRY
$ curl https://registry.hub.docker.com/v2/library/busybox/blobs/$CONFIG_LAYER \
       -H "Authorization: Bearer $TOKEN" \
       -L \
       -o config.json        
$ ROOTFS_LAYER_DIFF=$(cat config.json | jq -r '.rootfs.diff_ids[0]')  
        
# PULL ROOT FILE SYTEM LAYER OF BUSYBOX FROM THE REGISTRY
$ curl https://registry.hub.docker.com/v2/library/busybox/blobs/$ROOTFS_LAYER_DIGEST \
      -H "Authorization: Bearer $TOKEN" \
      -L \
      -o $BLOBS_DIR/${ROOTFS_LAYER_DIGEST//$ALGORITHM:/} Step 3: Create Application Layer Locally # CREATE APPLICATION LAYER LOCALLY
$ APP_LAYER="app-layer.tar"
$ GZIP_APP_LAYER="$APP_LAYER.gz"
$ echo 'echo "Hello World"' > hello.sh && chmod +x hello.sh
$ tar -cvf $APP_LAYER hello.sh

# CALCULATE LAYER'S DIGEST, DIFFID AND SIZE 
$ APP_LAYER_DIFF="$(sha256sum < $APP_LAYER | sed 's/\s*-//g')" 
$ APP_LAYER_DIGEST="$(gzip < $APP_LAYER > $GZIP_APP_LAYER | sha256sum | sed 's/\s*-//g')"
$ APP_LAYER_SIZE="$(stat -c%s $GZIP_APP_LAYER)"

# MOVE APPLICATION LAYER TO BLOBS FOLDER 
$ cp $GZIP_APP_LAYER "$BLOBS_DIR/$APP_LAYER_DIGEST" Step 4: Create OCI Layout (Files And Directory Structure) # OCI container image layout
# ├── blobs
# │   └── sha256
# │       ├── DIFFID      (image.manifest)
# │       └── DIFFID      (image.config)
# │       └── DIFFID      (image.rootfs)
# │       └── DIFFID      (image.application)
# ├── index.json
# └── oci-layout

# CREATE OCI-LAYOUT FILE
$ echo > "$BUILD_DIR/oci-layout" << EOF
{
  "imageLayoutVersion": "1.0.0"
} EOF

##
## CREATE OCI-CONFIG LAYER
$ CONFIG_LAYER="image-config.json"
$ echo > $CONFIG_LAYER << EOF 
{
  "created": "2020-04-07T01:29:27.650294696Z",
  "architecture": "amd64",
  "os": "linux",
  "config": {
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    ],
    "Cmd": [
      "/hello"
    ]
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
      "$ROOTFS_LAYER_DIFF",
      "$APP_LAYER_DIFF"
    ]
  },
  "history": []
}
EOF

$ CONFIG_LAYER_DIGEST="$(sha256sum < $CONFIG_LAYER | sed 's/\s*-//g')" 
$ CONFIG_LAYER_SIZE="$(stat -c%s $CONFIG_LAYER)"
$ cp $CONFIG_LAYER "$BLOBS_DIR/$CONFIG_LAYER_DIGEST"

# CREATE OCI-CONFIG LAYER
$ MANIFEST_LAYER="image-manifest.json"
$ cat > $MANIFEST_LAYER << EOF
{
  "schemaVersion": 2,
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "$CONFIG_LAYER_DIGEST",
    "size": $CONFIG_LAYER_SIZE
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "$ROOTFS_LAYER_DIGEST",
      "size": $ROOTFS_LAYER_SIZE
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "$APP_LAYER_DIGEST",
      "size": $APP_LAYER_SIZE
    }
  ]
}
EOF

$ MANIFEST_LAYER_DIGEST="$(sha256sum < $MANIFEST_LAYER | sed 's/\s*-//g')" 
$ MANIFEST_LAYER_SIZE="$(stat -c%s $MANIFEST_LAYER)"
$ cp $MANIFEST_LAYER "$BLOBS_DIR/$MANIFEST_LAYER_DIGEST"

# CREATE INDEX FILE
$ MANIFESTS_INDEX="index.json"
$ cat > "$BUILD_DIR/$MANIFESTS_INDEX" << EOF
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "$MANIFEST_LAYER_DIGEST",
      "size": $MANIFEST_LAYER_SIZE,
      "annotations": {
        "org.opencontainers.image.ref.name": "latest"
      }
    }
  ]
}
EOF


# CREATE OCI-LAYOUT FOLDER STRUCTURE
$ tree .
├── blobs
│   └── sha256
│       ├── 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
│       ├── 5cc84ad355aaa64f46ea9c7bbcc319a9d808ab15088a27209c9e70ef86e5a2aa
│       ├── 9710b9c0c7c956ca8d2884ee73d7fb578921f127f1eae05078965b2e3125b8de
│       └── e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
├── index.json
└── oci-layout

2 directories, 6 files Step 5 (Optional): Verify rootfs By Converted Into OCI Runtime Bundle Extract busbox layer  (5cc84ad355aaa64f46ea9c7bbcc319a9d808ab15088a27209c9e70ef86e5a2aa) and application layer (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) into rootfs folder. Use runc to initiate your hello world container by providing as bundle. -b rootfs # $ 
# ├── blobs
# │   └── sha256
# │       ├── 5cc84ad355aaa64f46ea9c7bbcc319a9d808ab15088a27209c9e70ef86e5a2aa
# │       └── e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

# STEP0: CREATE ROOTFS FOLDER
cd $BUNDLE_DIR
BUNDLE_DIR="runtime_bundle"
mkdir $BUNDLE_DIR && cd $BUNDLE_DIR

# STEP1: EXTRACT BUSYBOX LAYER INTO ROOTFS FOLDER
$ tar -vxzf ../$BUNDLE_DIR/$BLOBS_DIR/5cc84ad355aaa64f46ea9c7bbcc319a9d808ab15088a27209c9e70ef86e5a2aa -C rootfs

# STEP2: EXTRACT APPLICATION LAYER INTO ROOTFS FOLDER  
$ tar -vxzf ../$BUNDLE_DIR/$BLOBS_DIR/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 -C rootfs


# STEP3: ALLOW RUNC TO CREATE A DUMMY CONFIGURE FILE FOR YOU AND RUN 
# runc spec
# runc run test
# ls
bin       dev       etc       hello.sh  home      proc      root      sys       tmp       usr       var
# sh hello.sh 
Hello World

Give me a Unix Shell and I'll Build Container Images ... for Life

The basics An exemplary docker image has the following 3 parts: Name (required, user-specified at build time) Tag (optional, user-specified at build time) Digest (automatically generated at build time) Pull an image using name Examples: docker pull golang

docker pull yugabytedb/yugabyte

docker pull quay.io/keycloak/keycloak-x When an image is pulled using only the name, the image tagged is pulled. If there is no image with the tag , then no image will be pulled. latest latest Pull an image using name:tag Examples: docker pull golang:latest

docker pull golang:1.17.1

docker pull yugabytedb/yugabyte:latest

docker pull yugabytedb/yugabyte:2.9.0.0-b4

docker pull quay.io/keycloak/keycloak-x:latest

docker pull quay.io/keycloak/keycloak-x:15.0.2 An image like is available for multiple os/arch, example: , , etc. In such cases, docker automatically pulls the appropriate image for the os/arch the pull command is run on. golang windows/amd64 linux/amd64 Use this command to view os/arch’s of an image: docker manifest inspect --verbose golang:1.17.1

# sample output
[
  {
    "Ref": "docker.io/library/golang:1.17.1@sha256:232a180dbcbcfa7250917507f3827d88a9ae89bb1cdd8fe3ac4db7b764ebb25a",
    "Descriptor": {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "digest": "sha256:232a180dbcbcfa7250917507f3827d88a9ae89bb1cdd8fe3ac4db7b764ebb25a",
      "size": 1796,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    .
    .
    . A common thing that happens with a tag is that it could be reused. For example an image pulled using today may be completely different from an image pulled in 6 months. golang:latest Tags that look like version numbers can have the same behavior. There is no guarantee that an image pulled using today (on say ) will be the same when pulled 6 months later (again on ). golang:1.17.1 linux/amd64 linux/amd64 Caution needs to be exercised in production environments when pulling an image using the tag since it makes rollbacks harder. latest Pulling an image using name@sha256:digest A digest is an id that is automatically created during build time and cannot be changed (immutable). When an image is pulled using a digest, a will download the same image every time on any os/arch. This is called image pinning. docker pull First, determine the image you wish to use. Then get the digest as follows: name:tag docker manifest inspect --verbose golang:1.17.1

# sample output
[
  {
    "Ref": "docker.io/library/golang:1.17.1@sha256:232a180dbcbcfa7250917507f3827d88a9ae89bb1cdd8fe3ac4db7b764ebb25a",
    "Descriptor": {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "digest": "sha256:232a180dbcbcfa7250917507f3827d88a9ae89bb1cdd8fe3ac4db7b764ebb25a",
      "size": 1796,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    .
    .
    .

docker manifest inspect --verbose yugabytedb/yugabyte:2.9.0.0-b4

docker manifest inspect --verbose quay.io/keycloak/keycloak-x:15.0.2 The above command returns a JSON response. Look for the in the . digest Descriptor Examples: # golang 1.17.1 for linux/amd64
docker pull golang@sha256:232a180dbcbcfa7250917507f3827d88a9ae89bb1cdd8fe3ac4db7b764ebb25a

# yugabyte 2.9.0.0-b4 for linux/amd64
docker pull yugabytedb/yugabyte@sha256:974219f34a18afde9517b27f3b81403c3a08f6908cbf8d7b717097b93b11583d

# keycloak-x 15.0.2 for linux/amd64
docker pull quay.io/keycloak/keycloak-x@sha256:a6b7be1808b8443dde696c5f108be1cb6e7641d6b281ef7598df012c1d6871f8 Note: Comments added above only for readability. So what should you use? Well, that depends on your use case. A general guideline that I use for my workflows is: Experimenting on your local machine? It’s ok to pull using or . name name:tag Building an image for production? Use to pull your base image(s). This ensures that the same final image is built on any machine. name@sha256:digest Deploying an image to a production environment? If the image was built by your team (or company), it’s ok to use where a tag represents a version number, for example . Avoid using the tag since it makes rollbacks harder. name:tag v21.10.1 latest If the image was built by your team (or company), use if possible. If you choose to use , be mindful that tags can be reused. Avoid using the tag since it makes rollbacks harder. not name@sha256:digest name:tag latest Quick Recap A docker image usually has 3 parts: name, tag, and digest. Images can be pulled using , or or . name name:tag name@sha256:digest Some images are multi-architecture images. Pulling a multi-architecture image using or will automatically download the appropriate image for the os/arch the pull command is run on. name name:tag Use to view os/arch’s of an image and to get the digest. docker manifest inspect --verbose <name:tag> Pull an image using to download the same image on any os/arch. name@sha256:digest Avoid using the tag in a product environment since it makes rollbacks hard. latest Thank you for taking the time to read this article. I hope the information here helps you with image pulls for your use cases and workflows.

Stories, News & Mentions about LNDDO

Lnddo’s Stories on HackerNoon

Lnddo's News & Mentions