Please. This is Wednesday, the 13th of November, 2024. This is the monthly
general meeting of SLU, St. Louis Linux Unix users group
It's our usual two
two talks in this meeting and our opening talk is Lee Lamert uh
Mm-hmm.
regular with our group that he's going to be talking about when ip tables
not equaling IP tables.
And later we'll have a talk by andrew denner
He'll be our second speaker of the night for our mini talk.
With that, I'll turn it over to Lee.
All right, Gary, thank you.
And let's see, let me grab a screen here.
I think I got one.
formal bookend.
Jay again, Grant?
doing the normal bookend slide thing
I was going to say I'll watch the chat. I was waiting for somebody to call for that.
Thank you, sir.
Oh, I usually do that in the middle of Wednesday, don't we? No, I don't care.
Go ahead.
Go through that or
Try to start.
Later, go ahead you start.
Okay.
about uh
three weeks ago, or actually first part of October.
I ran into a
a problem with a server that lets the script search on it
And I got a nasty email from
let's encrypt that. Your certificate expires on October 30th.
And this was the first.
So I took a look at the machine. It's Debbie and 10.
IP table shows the
port open.
the rule that stat shows support listening
shirt bot pre and post hooks appear correct
Didn't work. Updating to Debian 11.
Change nothing.
So the whole point of this is to recap
the process I went through to troubleshoot it
And then in the end, luckily, I hope Grant and drafted him to help out a little bit.
And we found the problem and got it fixed in about half an hour.
Okay, I don't understand what the problem was.
You just went through it. I don't understand.
You say you got the alert.
On the 1st of October, it's telling you it was going to expire on the 30th what
Then what?
Wait, wait. Okay. Let's encrypt.
Started about 10 years ago.
And probably three or four years after that, it got really common.
It was a project with Google and some other folks, some of the major players.
It is a free…
search, SSL cert that allows you to secure a website or lots of other services.
by using a cert that is publicly accepted by everybody.
And usually it's like 90 days and then it
You need another one?
Right, right.
Okay.
And on 10, 1,
the shirt was 60 days old.
Okay.
And then it expired
30 days after that, 1030.
Right.
Sure.
and 31. So I got this email from Let's Encrypt on the first saying that your certificate expires on 1030.
Right?
which meant that it had been expired for 60 days or
It had been
not renewed for 60 days up until 10.1. So basically the renewal had failed for 60 days and I didn't notice it.
Oh, so the process is it normally
renews in advance of expiration.
And that's what…
Right. Normally you send it to check
And I think six…
55 or like 60 days out. I don't remember what the standard is anymore
it'll renew automatically.
So, you know, it's or maybe I guess it is 60 days out uh
So 60 days out of 90, it'll try to have anew automatically.
And in this case, I got the email on the first that it had not renewed
And it expired on 1030.
Does that work?
Okay, yeah, I think so.
So as part of that process.
Let's recap a little bit.
Okay.
Basically, there is a utility, I use Cirquebot. There are some others out there like Acme that Grant uses.
At 30 days before the shirt expires.
you run a cron job
that we'll call shirt bot and say, hey, check your cert
And it looks at the configuration on the machine
And it will
attempt to renew it.
uh…
Okay, so that's what you're talking about when you say renewal fails. You're talking about that
Let's encrypt renewal had failed.
Correct.
Right.
from your script. Okay, now that's what I didn't understand.
Okay, sure, no problem at all.
Okay.
Anybody else have a question at this point?
A real quick interjection.
My understanding is the first 30 days is considered normal use.
the next day 31 through 60, it's try to renew it.
And then by day like 61, if it hasn't been able to renew, it's alert, hey.
your cert expires in
30, 29, 28 days, give you some buffer to fix it.
And that…
Right.
And that's why I got the alert on October 1, which was that which
meant that was day 60.
Okay.
Yep. Normally they renew before that.
Now, my question is, why did you check for the open ports, et cetera, et cetera?
listening and all this stuff you've got listed in this next paragraph.
Why did you do that?
Okay, that's what I was getting
I was going to review here for a few minutes.
Okay.
You know, basically.
to renew the cert
the script will reach out and send a request to
the Let's Encrypt server.
Hey, I want to renew the Let's Encrypt server will then call back to that system
And look for a web page that has a key that says, yes, this is the right system and yes, it is active, et cetera, et cetera, etc.
It's called a…
So you were thinking that something in there was broken. That's why you check this stuff.
Right, because…
Oh, good.
port 80 has to be open
the program
If you run that stat when or during the renewal process, you will see a program listing on port 80.
which is the cert bot script
And there also are pre and post hooks, which I'm going to show you in a few minutes.
Okay.
to open port 80 in the firewall for this handshake to happen.
Okay.
Yes, excellent.
Okay, cool.
So the next next thing I'm going to do here is show the script
for each one of those steps.
to start off with?
there are called renewal hooks.
You can see my cursor moving, right?
Yeah, yes. Pre-hook.
Yeah, pre-hook and post hook.
Right.
Pre-Hook is done before the handshake.
And that pre-hook calls IP tables
adds a rule to the input chain for TCP port 80 accept.
Okay.
When it's done, the post hook
deletes that rule.
So the mechanism here is when the renewal starts.
the script will automatically open that port
And with using acute tables command
And it will, when it's done, it will close that port with the IP tables command.
Okay.
And that means I never have to work. Their system never has to worry about malicious traffic coming in on that port 80 by accident.
even though there's nothing there listening
you don't want the port open because that's a possible attack vector.
Understood.
NetStat here. You can see
I think I might have accidentally deleted the
TCP line
The TCP6 will also handle regular TCP.
Okay. So here's the Python 3, let's encrypt cert bot
script. So it is running, it is listening on port 80.
And according to the IP tables, rules, 480 should be open
So when I look at IP tables.
I see…
A rule here except
protocol tcp
source destination, port 80.
And you see that with IP tables minus VNL, just like
Chuck used to do every 15 seconds 10 years ago when he was doing some of these presentations.
Everybody follow so far?
Like, ooh.
Okay.
I hope so.
Okay. So that's rule.
Or…
The NIP tables.
IP table save is an IP tables command.
that actually dumps the current firewall in its entirety to the screen for you.
In this case.
It was October 26 at 2.26 in the afternoon.
the input chain defaults to accept, the forward chain defaults to accept, output
chain forwards to accept.
And the only rule in the firewall here
is…
the port 80 except
Okay.
So at this point, everything looks fine.
So what's going on?
pre and post hooks look look okay?
And that stat shows the port open when search bot's running. IP table shows an accept, and IP save confirms. IP save confirms.
Well, when I kind of…
phone a friend, call Grant. He said, well, let's try a TCP dump.
PCP'd up.
My notes, Grant said, Nancy, Nancy, India. I'm not sure is that right?
Was that the right switches?
Yes, that's numeric IP, numeric service, and interface.
Okay. ETH zero on port 80.
TCP dumb listening on ETH zero.
And I only grabbed a couple packets since the line's so long but you can see
There are none of these
see 2364, 14, 2, 13, 80,
That's an outbound request and inbound reply, it looks like.
Yeah.
Hot bill, hot.
Okay.
And anyway, we saw no traffic getting into the machine on port 80.
So…
I kind of threw this in as
I'm not even sure what you call it as a blast from the past.
I remember 15 years ago when System D first hit the scene, everybody poo-pooed
you know just some idiot
college students at some of the big software houses want to do it better.
Well, 15, 20 years later, we're stuck with it.
Thank you.
So the question is.
Is there something else?
It could be in play here.
Well, I'll show you here on the next slide.
The IP tables command
is actually a sim link
to a to not uh back up
IP tables.
managed the kernel
with NetFilter.
Grant NF table, NF tables
is NF tables, but that's still in the kernel, right? But the utilities or manages it
Yes.
Okay.
So…
As another aside.
Shouldn't you be using SS instead of netstat?
they can do the same thing
Oh.
It's the same thing. And I've used NetStat for 20 some odd years and
Okay.
I don't like to switch if I don't have to.
Well, it's my understanding from what I've read and heard
And it's some stuff I've been looking at that ss
pull stuff exactly from the kernel
Whereas NetSt relies on a lot of configuration files that might be screwed up.
I would not.
I challenge that.
Okay. And I have no way of confirming that's true or not.
Yeah.
It's just something I heard.
NetStat, IFconfig, and route command have been considered deprecated for
15 to 20 years.
But there's 40, 50,
year old diehards that have been using it for a very long time.
Right.
And it's still being installed and used.
For the case of Lee's presentation.
NetStat and SS or socket stat.
functionally do the same thing
it's an Emacs versus VI.
type thing they both
do the gold.
Thank you.
RVI versus Emax, yeah.
Yeah. All right.
I will knit.
So we're going to do it the right way. Yeah.
All right, so let's take a look at exactly what's on the system.
I just, I do a witch on IP tables.
1, 2, 3, 4, 5, 9. There's 13 different
options for utilities
for IP tables.
That's probably only half of them because there's probably IPv6 tables counterparts to
Yeah, gotcha. Except I try to ignore IP6 as much as I can.
I hate it.
I mean.
You know, and actually IP tables itself
is a SIM link to alternate's IP tables?
And alternates IP tables is actually
similar link to IP tables, NFT.
Interesting. Okay.
So here's the fly annoyment.
If you look up here at the top.
IP tables is assembling to IP tables nft
So we've got NFT, we've got NFT save, NFT restore
So what happened to IP tables?
Well, actually, IP tables is
Now, physically, IP table is legacy.
This is the original IP tables command that used net filter.
Yeah.
Which is why IP tables is not necessarily always equal to IP tables
Hence the title for the talk.
So if I run IP tables legacy
IP table's legacy save.
we see the
rules that are actually
running compared to the rules before, there was only one rule.
The system is using actually ip tables legacy
And if you look down here.
there's no port 80.
So this took us about 10 minutes to figure out when Grant and I were looking at it a few weeks ago.
And this is an IP table's legacy problem. At that point, I had never even heard of it myself.
So IP tables on this system
is set up for nft
Because that's where the command is linked.
But short pot appears to not be listening to NFTables.
So let's add a rule to net filter
An ip tables legacy, add that port 80 except with net filter
Now we have…
What if we do IP tables legacy say we see a port 80 down here that wasn't there before
And…
We test again.
And we see incoming traffic on port 80.
not outgoing.
And it works.
This is the output of cert bot.
It saves a debug log.
It runs the cough.
for MX3, which is where this was living.
certificate is due for renewal, auto renewing, yada, yada, yada, yada, yada.
sends the challenge waiting for verification. It got the verification. It cleans up.
new certificate deployed without reload.
full chain is stored in that file.
I would also like to add
that when it was broken.
CERT bot was taking like 90 seconds to three minutes before it would time out.
Once it was fixed, it took a whole like
20 to 25 seconds to do its thing.
Yeah.
Yeah, so since you're not waiting for a timeout, the handshake comes back pretty much immediately.
So you know it right away.
All right, so…
We know what the problem is. We know what the solution is.
So now I wanted to talk a little bit about
the different components we have here.
We've talked about IP tables ip tables legacy. That was what solved the problem.
We've also got NF tables, net filter and ip tables nft
Originally, IP tables was the standard tool for managing firewall rules on Linux with Netfilter.
Overtime, IP tables evolve with multiple versions.
Good hands, performance, et cetera. IP tables is now ip tables legacy
Whereas NF tables
new filter tables.
who's introduced in kernel 313 is designed to replace IP tables with a simpler, more efficient structure and better performance.
In recent distros, NF tables is the default backend and ip tables
uses NFT for compatibility so the same IP tables command
can run against nft
And the internal structures are actually mirrored
At this point.
NFT commands work the same.
At some point in the future, that may change but now i
NFTables has both new and old
command and data structures.
We talked about IP table's legacy
using the traditional IP tables back in.
NFG, a newer version with NFTables framework
maintains the same syntax.
And if you look at this basic IP tables command it is
saved, which we saw before as a sim link
to whichever firewall flavor
is in vogue on your system.
So a legacy is the back end nft is newer ip tables
both use the same IP tables command
and the active
flavor depends on which version is linked. IP Tables Legacy or
NFT.
Now, so what have we learned?
Number one, number one
Rules are not shared.
Number two, you've got two flavors to deal with.
Number three, in this case, Certbot was using IP tables legacy
And the system rules were in IP table's legacy.
So a legacy ruler was required
Which means we had to use IP tables legacy and not
VIP tables command
on the system.
So the physical solution in my case
was to use
I just added legacy rules with IP tables.
So if the system changes in the future, we've got rules on both sides.
Although Grant did make the point when we were chatting here before the meeting.
that it would be better off
to cleanly
get rid of all the legacy rules and move them into IP tables
But I don't need that effort on the system right now. So I just set up parallel rules.
And both NFTables and netfilter.
You might have a question about
this solution.
Excellent.
I'm good. And I have, like I say, I have to give credit to Grant because
He jumped on a call with me on Saturday afternoon. We had this figured out in about half an hour
Okay.
And I started down my learning journey about legacy versus
NF tables.
Can you go back to your conclusion slide, please?
This is…
Certainly. I'll conclude it.
There.
Or maybe one more. Maybe one more.
No.
uh…
I lost track of which slide I wanted to talk about.
Mm-hmm.
Was it in the text or in the…
It was in the text. It talked about
Serv bot using
Legacy.
Maybe that's further down.
Was that your solutions towards the end?
Anyway, the question I had, oh, wait a minute. Okay, back. Go back to that slide. One more.
In this case, ShirtBot was leglessness.
No, Stan. Sorry.
Check that one. Chuck that one.
Go forward three and see if that's the slide he wants.
That one, before prevention slide.
One more back.
There. Cert bot
legacy. So that's the reason this thing broke because Certbot was using the legacy thing and it wasn't
And it was different than
the setup.
Right.
I disagree with that assertion.
I believe cert bot.
was using the unqualified
IP tables command.
which as his system was configured
was modifying IP tables NFT.
However, system firewall that actually mattered
was IEP table's legacy. So cert bot
through the alternatives link
was modifying the wrong firewall.
the solution
was to edit the configuration to cause cert bot to modify
the legacy firewall.
I believe.
Okay, that makes sense.
Thank you.
All right, anybody else?
Sean has a question. So if we upgraded to the new kernel firewall system.
Anytime in the last 10 years, we could have avoided this issue.
And no, I don't.
think that is a fair assessment.
because or because
maybe I'm misreading that.
IP table's legacy
aka net filter
And IP tables nft tables
aka nf tables
have coexisted in the kernel
side by side for many, many.
years. And it is possible
Which is actually what Lee found out
to inadvertently have both
running at the same time.
And it turns into
what is kernel default?
what is distro default, like what is distro init scripts do
to a firewall, et cetera.
If you stuck with
the old IP table's legacy
the entire time
that should be okay. If you migrated to NF tables or IP tables NFT,
eight years ago and you would be fine there.
Lee's problem comes from the accidental
crossing and trying to do things
with both unknowingly.
Okay, good.
as their knowledge percolates in. Yeah.
Believe me, it took me two weeks to wrap my head around this.
Well, should I be ornery and tell you there's another firewall in the Linux kernel?
Oh, no.
Berkeley packet filter, BPM.
APF.
That's it.
RPF, if you're on an open bsd fan
I did say the Linux kernel.
Right?
And Lee, I was about to chastise you, but you saved it when you said tables.
was the original net filter.
Because IPFW admin and IP chains
predate IP tables.
Okay.
Actually, that was chat gpt so
Yeah.
By the way, I added all the text so we have it in the presentation. So if somebody grabs the slides and downloads them.
you know they can read it without having to watch, you know, without having to go through a lot of the details in the video cool
Hmm.
And I actually had about four different sessions with ChatGPT and I cut and it is great.
points all the way through.
All right.
Gary, I will turn the floor back over to you.
As for the gooey middle.
Fantastic. Once again, Lee Lambert from Omnitech.
Ooh.
Another excellent
presentation. Thank you very much, Lee.
My pleasure.
And with that, I'm going to put in a quick plug.
or other people to maybe step up and do some presentations.
either, I mean, certainly always appreciate the the full presentation you know the whole meeting
But these little basic sessions, your tutorials on the front of this meeting.
Oh.
I mean, Lee just went a half an hour, but we
go as short as 15 minutes easily.
And they think, oh, I never have anything that I'd want to present but
Okay.
what lead has demonstrated if you uh
if you are working on some project, you run into some snag.
And you have one of these aha miracle things where you talk to somebody, you do some research.
And you find, oh, this is what this does, how it works. These are all great things that
you know other people would love to know. So if you've had an aha like this, you could easily turn it into maybe a 15 minute little talk for us.
And we'd all appreciate it. So think about it. If the opportunity comes up.
Send a note to Steercom at slug.org.
And one of us will get back with you and uh
see if we can work something out on the schedule.
So let's see other things about us. Oh, this is the St. Louis Unix users group
We talk about
Unix, all kinds, actually pretty much anything open source.
It tends to fascinate us. Open source or open standards probably is a better way of describing it.
And of course, Linux is a favorite topic.
Let's see, pardon me, my nose was itching a little bit.
Let's see, this group has met continually since we incorporated in 1992
There were at least two predecessor groups
that came and went before this, which were Unix user groups.
Let's see.
All of our meetings are free, open to the public.
By the way, any of you, if you're here for the first time ever.
If you ever attend two of our meetings in the same calendar year.
you're a voting member. There's no such thing as dues. So you get to vote.
So the agenda for this general meeting, which is always on the second Wednesday of the month.
is we usually turn on the Zoom about six o'clock so people can
Just chat, test their microphones or sound to screen share.
We start the base presentation at 630.
At about seven o'clock or whenever we get done with the base
We do this gooey middle, which is announcements
kind of overlooking some of the stuff we got out there online.
Talking about the calendar
And a general call for help session, just if somebody's got a snag, like trying to figure out where the hell IP tables is
You can ask in this gooey middle part of the meeting. You can also ask questions
after the main speaker later in the meeting, but if you can't stay late or if you're afraid too many people will
Yeah, you can put it in here in this middle of the meeting.
Then about 7.15 or whenever we wrap up this gooey middle.
We'll do the main topic.
And the main topic
Tonight will be Andrew Denner.
So, uh.
Let's see introductions. Oh, I'm your emcee. I'm Gary Meyer.
the man who's controlling the slide deck is our vice president, Stan Reichert.
Stan is also the go-to guy for anything
that really needs to get done. Stan jumps in there and always makes sure it's happened
before we even know it. So a big thanks as always to Stan.
Write it.
Right. And anybody that wants to send me $10, I'll make sure their name does not appear on the ballot.
So I thought that's cheaper.
Yes.
What?
I thought the price was closer to election time.
No.
It goes up.
Oh my. Lee Lambert, who just did the basic tutorial, he's our treasurer and
He also was very nice.
uses his machines here at work
to host our website, our mail server
And all of our necessary archiving systems. So while we appreciate everything Lee does for us.
Ken Johnson is acting as our secretary and
If anyone else would like to help out being secretary, recording secretary
We'd love to have more help on that.
And chat monitor.
I believe Grant volunteered earlier, right?
And so he's been monitoring the chat tonight.
Okay.
I hear that mumble.
And topic, Wrangler.
Hey, all of you can be topic wranglers.
Anybody who, if you think you know somebody or if you yourself think a topic is interesting
Let the steering committee meeting know
Registering committee people
list know what an interesting topic would be and
If you have a suggested speaker.
More than happy to help follow up on that.
If you can run it all down yourself and say, okay, I got Bob and he'll talk about this on tuesday
We're on wednesday uh hey we'd love to have it that way, but we'll
we'll try and help arrange stuff if you just got little bits and pieces of who and what
So let's see the uh
eight days from now, next week on Thursday.
is the STL Linux meeting, also known as the stl lug meeting
So that meeting will be held next week.
No, don't have a topic nailed down yet.
So again, if anybody has any ideas.
I'm all ears. I got a couple of possibles, but we've got it nailed down yet so
Five days after that, the fourth Tuesday of the month is the new Linux meeting.
The new Linux meeting is a little different than this this is a
an announced topic with a set speaker, a set layout for the talk
The new Linux meeting works on a different premise.
It's whoever considers themselves to be the newest
user of Linux.
you get to ask the first question.
basically everybody else there in the meeting offers their advice, their insights of how whatever your problem might be resolved.
And when that first question gets
kind of resolved and dealt with. And the next, the second
least experienced user gets to ask a question.
So it really sounds like, wow, it has to be really simple stuff.
It's amazing sometimes how a new user's question will bring up some really great
topics or discussions that you haven't heard in a long time. So it's a great place to learn stuff.
And it's really good if the more experienced people can come to that meeting because they're the ones
We're there to answer those questions.
Don't think you'll be bored because like i say
A lot of times you get a great give and take discussions of how something could or should be done.
We're doing an upgrade of Bach, which is the system we use
For email and our website.
And so we're going to upgrade it, WN10 to WN12, hopefully.
So we've got a team of volunteers
We were basically looking at the house and what needs to go into that. Actually, I'm working on that for a few months.
And we're getting closer to pulling the trigger, but there's still time to volunteer and we want people working on it. It's a great learning experience.
Okay.
how you can both do your own systems at home or maybe work on a project at work that would do something like this.
So by all means, volunteer, please.
Let's see, the new sloop website is being built by Sean.
And Sean has really been doing some nice stuff and making
making some new enhancements.
Stan, were you going to click on that? Show us our
uh…
I'm not sure if I remember how to do that.
Just go to site.sloop.org.
Yeah.
Yep. Yep.
Where is it?
You want me to share? Yeah.
Yeah.
Where am I here? Right here.
That's it.
Yeah, we got new logos up here.
There's also a light mode if you want to use the light mode.
I'm not sure how to switch, but…
It's in your browser setup.
Oh, okay.
I always use dark, so that's what i that's what I show.
Myself, I don't like the dark. I prefer the light.
And the calendar is down here.
You guys have been playing with it a little bit to try and get the red ones always on the top.
which are the sponsored meetings
And then we got the usual social media
chunk down here at the bottom.
Click on the 21st.
on the calendar. I'm going to show more.
The 23 more.
Yeah.
Yeah, right. Okay, right.
Goodbye.
Yeah, see.
Well, yeah, whatever.
what we may have to do is eliminate
one of those all day things.
Thank you.
That's good. Thank you.
And then there's always more detail for each one
Each one of them.
Did the OpenSSL thing, I sent an email to discuss about.
make it to the calendar?
When was it?
I sent it with him last week. I'm trying to
find the email.
Well, what day is it?
supposed to be.
Right. I'm trying to…
Gary, was that the thing you were talking about this afternoon?
I don't think so.
No.
Okay, open SSL webinar. I'm opening, found the email. I'm opening it.
Come on, web browser.
The problem I have is Gary always waits till five minutes before an event to tell me about it.
Well, here I am telling you.
Thank you.
More than a week.
beforehand.
Well, we put it on the calendar and then Gary thinks it's important because it's going to happen in the next 10 minutes.
He wants me to send out a message to discuss, to remind people.
that.
You know, that'd be… So…
there is an open SSL webinar.
On the…
Yeah.
On November the 21st.
Cool.
Somewhere in there.
Oh, here we go.
Yeah.
thing with X509 keys
and certificates.
And that is X509 is the
standard that is SSL and TLS certificates?
So cool. I didn't know if it made the calendar or not.
made the calendar.
Cool.
Right.
Okay.
there's there's a…
Well, we're talking about calendar. I'll expand this out a little bit. And again, it kind of becomes a call for help. So I hope you don't mind.
But Stan was the one who first kind of
started using Google Calendar for us and he made a really good
summary both of
a calendar of our meetings
And then we started finding it advantageous to
also lists other technical groups that were meeting here in St. Louis. This was years ago.
before the pandemic and before the age where all the
so many meetings were on Zoom or in those days they were almost all physical meetings and
So we listed ones here in St. Louis.
Good.
with the aid.
And we would average between 150 and 180
meetings in St. Louis.
technical kind of things that be
Java meetings and HTML meetings and website meetings and you name it.
And we've since started adding remote meetings for Linux groups, et cetera, and it's gone up to like 300 and
20 or 350 a month.
So a little bit crowded on that calendar, but it's a nice resource.
Yeah, really?
And so kind of
Through the years, I've kind of taken over doing a lot of the work on the calendar.
And obviously I do a very poor job of it. I've scouted up some stuff. But in the age of COVID, a lot of
A lot of groups kind of stop meeting and
We kind of carried them on our calendar hoping that they would restart.
Obviously now it's to the point that, hey, if you're not restarting, it's time to get you off the calendar.
And we've also expanded. We're picking up a lot of out of town meetings because so many
meetings are now offered
on remote Zoom, remote Jitsi sessions.
So there's a lot more options and it needs a little more work to be grouped out and cleaned up
Tyler was going to help me on that and it's not
that Tyler hasn't done any work. It's that I haven't done a good job of turning stuff over to him. So I'm going to work at
hopefully getting things a little more cleaned up and organized and then hopefully
he's still willing to work, but there's enough work that uh
If anybody else would just really like to
help out maintaining the calendar.
We're more than happy if you'd like to volunteer we'll
We'll get you included and
It's kind of fun because, yeah, you wind up
Okay.
looking at what other groups are doing and
It gives you a good overview of technology
the modern day and age. And so, yeah, it's a good thing. And as I say.
I've got to clean out some of the older stuff
I hate to do it because some of them were good groups.
Yeah, Stan.
I'd like to point out that meetup.com sucks.
That's our motto, yes. Oh, and how do you feel about meetups, Dan?
You really want to know?
That's true.
This is supposed to be, we're trying to keep it
family friendly here, aren't we?
Oh, geez.
Yeah, probably.
I…
For a while there, if you made a mistake.
They only had a cancel button and
instead of delete something that was a mistake.
Well, I went in and say, oh, they got a delete button now. And guess what? I deleted a bunch of stuff because it was a mistake. And guess what?
The system set out a bunch of cancel messages.
Holy crud.
It is.
to meetup.com sucks. And it's like every other month they invent some new way to screw it up.
Mm-hmm.
Of course, their whole reason for being
is so somebody have has something, everybody has something to bitch about, right? Yep. Yep. Yep.
Yes.
and uh
You have to schedule a joint bitch session
with Meetup.
Thank you.
Ron just posted out there that yellow meetup sucks, but isn't it also a great way to attract new people who wouldn't normally be looking at our website? And yeah, that's exactly the way we look at it is
We don't really consider meetup to be our definitive definition of
when our meetings are, but yeah it's a great way to get to
to get new eyes on
So yeah, if you like it.
But it's kind of like having the domain name goodwill.com.
Mm-hmm.
Goodwill.com, you got the guys at the top. They're hiring people for minimum wage and they're getting all kinds of stuff that's donated to them and then they sell it.
So that don't mean that they're a great outfit.
Mm-hmm.
Okay.
With that, I'm going to pick on one other little thing on our calendar today
on the calendar listing.
the
There's a 75th anniversary.
Which is kind of rare in the computer world, right? Because gee, 75 years ago, 1949
computers were antique things back then. They really weren't computers as we know them today. They were 80 column card readers and printers
Thank you.
IBM was using them as business machines.
That long story I'm going to summarize real quickly
there was a Jesuit priest
He was a scholar of philosophy.
And he was doing all sorts of summary of old philosophical tests. I think it was St. Thomas's stuff he's working on.
And he was making these great
big sheets of cross references of, oh, yeah, well, this term he also uses in this text and this text and this text.
And so
what we would today consider hypertext, how to do links and linking these different things together. But obviously this wasn't
a computer thing back then. He was just making these big wall charts of just
went on all over the place. For some reason he had a crazy idea
He got himself set up with a meeting with Watts, who is the chairman of the board of IBM at the time.
And I don't know how he managed to get this meeting
goes and he meets with Watson. He explains that he's working with all these big techs
And they make these complex charts of how things link
uh with you know using different terms
And he explains all this to Watson and watson
And he wants Watson to help him put this on a computer.
And Watson said, well, I'm sorry, this is impossible.
And Watson had a
habit, he had a plaque on his desk all the time and said the
the difficult we do immediately
the impossible takes a little longer.
And basically, this Jesuit priest pointed to the plaque on watson's desk
looked at Watson and shamed him into, okay, I can wait. And Watson actually did design a team at
IBM to start working on what
eventually became hypertext.
So it's obviously a long story, long ride up there.
That's the quick summary, but it's just an interesting thing how something we today think of as
Wow, modern wishbang technology but
kind of came from old ancient texts being cross-referenced.
Anyway, that's my fun story of the day.
With that.
I was intrigued by something in in uh
discuss at Holland, if you're here with us still.
You posted something about
Rust versus C++. Somebody was having a discussion.
Online, you want to give us just a
Quick little tease of that.
Hello, can you hear me?
Hello, we can hear you.
Yeah.
Well, last month…
those of us who attended the uh
the amazingly great
Thank you.
St. Louis Linux users meeting
Thank you.
group meeting. That was James Conroy
He gave a talk about um
formatters and linters. Maybe it was the other way around i don't remember.
But there was a discussion came up during the meeting which had to do with like
Rust and GCC
And as compilers.
And that's like my bailiwick. You know, I love that kind of stuff.
So I was kind of curious. First off, first thing I learned was that
GCC implemented their own standard. So I think it's like by default
They've got their little bit different
Then, what is it? C21 or something
I can't receive plus, I think we're 21.
Anyway, if you look at the main page, it's in there.
So that surprised me. But the other one that came up was about rust
Which had to do with the fact that
Rust is like this moving target
of and
you've got like all these dependencies and it's possible that you know what you
you know you could compile your code
today and then next week you try to compile it
And the dependencies are kind of changed out from underneath of you and you have to update your Rust compiler, right?
I found this video and I posted the link on discuss
If the link, the video has to do with the
It's an interview, I guess.
between Herb Sutter
And Steve Klavinick, I don't know how to pronounce his last name.
So, um.
Herb Sutter is well-known guy
in the C++ community.
He's worked on the standards organization.
Matter of fact, he's on both the
the C++ standards organization
and the rough standards organization.
And Steve Klavnick
is also well known.
also worked on the Rust compiler
And worked on, he's actually the author
of the Rust book. So there's a Bible for Rust.
all the rust programming language. Steve Klavnika
and some other people, but he's the primary author on that.
So it's a very interesting
park in about three
Four minutes into it or something
Thank you.
They literally answered James's concerns.
the two of them. So I thought that was
well worth it to post it up on to discuss if you
are interested in
like writing code
And making sure that you're
that you're following
some standards or whatever right and
how do you handle
the differences and stuff like that.
The long and the short of it is that rust the
has additions as well as versions.
And you want to target the
the most stable addition.
the most recent stable edition. So for example.
They're every three years, so 2015, 18,
21 and I think this year.
right is a new addition. I don't know if it's come out yet or not.
uh but um
If you target the 20
21 edition.
of rust, your code should be backwards compatible. So that was like the long and the short of it.
It answered your question, Gary?
Yes, it does. Thank you, Ed. And I apologize. I kind of threw that question out to Ed cold turkey that I figured…
I figured he could give us a little flavor of
that the conversation was about email.
Thank you.
I totally recommend going back to
The Linux user group, which is online, we recorded it
And watching that video
with james uh if so if you if you're if you haven't if you're
been to this meeting, but you didn't go to that meeting.
and you wanted to know more about compilers and linters and formatters.
you know uh i would definitely recommend doing that.
at first and then if you, you know, if you're really into it, then click on that link.
Fantastic.
About an hour-long video.
Any other…
And it's funny, too, because they really uh uh um
agree way more than they disagree.
Mm-hmm.
And you get the big rust guy in the big
C++ guy, right? You think they'd be at war with each other but no
they both they both are kind of say, no, we're learning from each other
So C++ is getting better because of Rust Dan. Rust is getting better because of C++.
Nice.
So.
All right. I didn't mean to dominate the conversation this long. Anybody have any…
Any other general questions you'd like to throw up here in the
in this gooey middle.
Okay, not hearing anything.
I'm going to turn it over to our main speaker unless somebody steps up and says, oh, I got to ask this question now.
I got a quick question for people. Okay.
Is anybody familiar with uh
the fiber gateways that AT&T uses.
Oh.
Basically, I've got one out there in the field and
We have a public subnet.
internally public ips
And I've been beating my head against the wall for a week. I can't figure out how to get the damn thing to pass traffic to it.
inbound.
Yeah.
Hit me up later. I don't.
Okay.
how late I'll be able to stay.
you're talking about
No, I'll catch you later, Grant. I didn't realize that was in your wheelhouse.
It's like what you have got installed at your house, right?
what you're asking.
True. Yeah.
Yeah.
Same thing, except this is for business.
Yeah, I've got the same thing and
I have the eight block globally routable and I have it fully functional and
Yeah, I can chat about that.
Okay.
Thanks. All right, Gary, over to you. Okay.
Well, and I'm going to do a quick turnover to our main speaker of the evening, Andrew Denner.
Andrew is from the ciao
It's from CIA lug
It's a secret organization, right? No, it's central illinois.
No, Iowa, Iowa, Iowa, not Illinois.
Central Iowa. I'm terrible at the wrong state, central Iowa. This is why I can neither work
for the CIA nor a lot of other places. But Andrew is going to tell us all about
power of pod man it's a Docker alternative. So I'm going to turn it over to Andrew. Thank you.
Thank you. And I apologize in advance. I saw there were some messages about
The person who updates websites being under the weather. Well, as you can tell from my voice here, I'm
Fighting through
cold, but hey, steroids are great and uh
We're just going to power through it here so uh
And also apologies for the slides not being nearly as polished as I would have liked.
Just for the fact that I've been prioritizing sleeping over
sliding here with an attempt to kick this.
But we're going to be talking tonight about
Podman and um
sort of following as part two in a talk that I gave a while back.
First is just a general intro.
There we go.
I am Andrew Denner, as they hinted. I've been a Linux user since 2003.
Everything from compiling
Gen 2 all the way down to
sent us and etc. Right now I'm sort of hooked on a uh
Ubuntu bent, but then again, I'm just lazy.
I am still somehow the president of the Central Iowa Linux Users Group. We meet the third wednesday
of the month at 7 p.m.
This next month, the discussion about pizza is very
appropriate because we're going to have what we call a SIGBAP, a special interest group
Beverage and provisions.
And we're just going to meet at a local pizza place and uh
nerd out offline so
Normally, though, if you go to our website, cialug.org, you can actually see our
Zoom meeting links and join in from anywhere in the world.
All the way from Australia to uh
Germany to whoever else really wants to wake up at odd hours of the night.
And or in the middle of their day.
That's a link to my social media connection stuff.
Like everyone else, I need to update my website
But yeah, I'm on all the major ones.
And yes, hello, Chris.
So as I had hinted at last time, back all the way in August 2024,
Gary had asked me to present and I shot out a few topics.
And the topic of the night was
Elevating containerization, a dive into Builder.
And in the links here, you can go back and watch me fumble through that.
As well as the slide decks and et cetera.
And just as a brief refresher.
Builder basically is a way around building a container
either from scratch or from using an image as a starting point
And it's basically not using Docker, but still generates
the default Docker-like image that everyone knows and loves
It has a lot of power to make it smaller.
single layered and allows you to just package in stuff very easily and script
using like bash as a scripting language
And very powerful.
I won't bore you with the full talk because you can hit play just as easily and
We have more stuff to plow through here.
But basically, as a reminder, as I hinted
there's this whole thing called the OCI or the open container initiative
Basically, Docker started it
and uh the
the whole idea is that
it basically Docker is the spot that we all sort of know and love.
But Docker has also done some stuff to make people mad. So of course, what do we do in the open source community?
We fork and we go out and we start our own stuff as well as other initiatives like
the whole Kubernetes space and all sorts of stuff like that have made it
not just Docker, but there's a whole ecosystem out there
We're going to talk a little bit about architecture.
how
pod man works versus Docker versus rootless versus all that sort of stuff.
We'll have a brief intro on how to install and set stuff up.
as well as a hello world showing you that Podman works
almost just the same exactly as Docker.
We're going to talk a little bit about SE Linux.
And security and how pod man is super powerful.
We'll talk about how you can even use Podman to play your
Kubernetes pods locally.
you can use it to replace Docker Compose since I know there's a lot of people who still love that.
You can schedule your stuff
You can schedule things like your pods to run inside of SM System D.
Which there already was a little bit of love and hate for System D earlier in the night here.
And then we'll just review and talk about the ugly bits and bobs that
really pod man's great, but there also are some pretty rough edges sometimes that you'll run headlong into
So it's not for the faint of art.
And really the first thing off is
Why are people angry at Docker and what did Docker, the company, do to make people
sort of twitchy.
And the big thing to remember here is, of course, Docker is a company.
they have to survive and it costs a lot of money to host
All of these containers and all of this stuff as well as doing
Countless amounts of development work and etc and
Oddly enough, people like to get paid.
So they've been trying to figure out all sorts of ways to squeeze
money out of money out of
both the big fish out in the world as well as the smaller fish.
one of their biggest things is like Docker Desktop, which is the Windows and OS X
Mac version of
Docker, if your company makes more than 10 million.
they have a per user fee in order to use it.
As well as they just keep ratcheting down
how much of a pull from the Docker Hub where all the containers that are pre-built are stored.
And stuff like that. So
different companies sort of have gone into a sort of damage control
sort of of, well, okay, I want to use this, but I don't want to have to pay for
500 people
X dollars a month. It doesn't fit on my credit card and getting the purchase orders in is just nightmare so
How can we still get stuff going?
And or places are cheap and they just don't want to pay. I mean, we've all been there.
So…
Red Hat was one of the places that sort of led the charge.
And…
what sort of spun out of this was
the whole pod man and Bilda and this whole sort of
alternative
universe.
just a little bit of intro here as well.
Docker really
where we're Docker and this whole open container world came from
it really isn't doing anything overly new and crazy.
But it is doing a lot of stuff
all bundled together into the right package.
There are plenty of other universe sort of tools in the Linux world
like LXC, LibVert, et cetera, that all have done
containerization like things.
But what really made Docker shine was the fact that
They were the full picture.
They were able to pair the namespaces to have
sort of that virtual
machine sort of appearance but lighter used control groups, network devices, CH route.
et cetera, all bundled together to make it easy.
But the big thing to remember here is that
Let me pull up a…
pen here um
the Docker daemon is running as root. We'll see that here in another slide a little bit more.
But it's running as root. You connect into it as a Docker user and it runs your stuff for you.
by default so
If you can pop outside of Docker Damon here and escape.
Well, congratulations. You're now root on the system.
As well as you can get away with all sorts of fun shenanigans like if you happen to mount
a volume into Docker and it's running as root.
Well, it has access to everything if you're running as root inside the container.
Well, now you can do all sorts of stuff in that folder that you just mounted.
Even though you as a user aren't supposed to.
I won't admit I've ever done that before, but it's great when you don't have permissions
So how does
Podman and Docker work and what are the big differences
As you can see, Docker Damon by default runs as a root.
And it connects to this whole container d
which then connects to the run C thing that is shared across
Everything from Kubernetes to Podman.
Docker are the folks who open sourced it and originally built all this sort of stuff and split it off. So it's great.
And basically what happens is you as a command line connect to Dr. Damon.
It pulls the images from a image registry
And then runs them inside of your kernel.
So all of your containers as well as the host are all running the same kernel.
And so that's the only thing that's really shared across everything.
Apologies here.
So then the difference inside of Podman is by default
It runs in a rootless space. So you are your individual user, like say I'm a dinner.
And all of my pods are running as
sub users inside of my name.
Hmm.
Did we lose the sound?
No, he muted. Looks like he's…
Coffee.
Apologies there.
Sorry about that.
So back again here.
So yeah, basically the idea is that you're running everything locally here
And basically, you're just directly running run c from podman
And it's running the kernels and the containers and interfacing everything directly without having to go through a
rootful daemon.
So the advantage there is the advantage there
Is it running more efficiently because it's not having to go through root rule
demoned or
Is it…
So basically, the big benefits are that
you don't have to have all of that power of rootful Docker.
It's more secure in the fact that if you pop your
out of your broadband container, well, you still are just running as
you will show it here in a demo in just a little bit.
For some very dumb reason i mount
slash ETC into my uh
container and container
I want to go ahead and start editing it. I won't be able to because I don't have that power.
To answer the question of how does it handle
mounting uh mounting
8443.
it actually uh
By default, not root.
It does not.
And you can grant yourself permissions to be able to edit it. It is
doable, but as a general rule
General users don't have access to those
Now, you can run Podman as root.
And it works just fine.
But of course, then you lose that extra security benefit.
But that's one of those things where if you're setting up ingress and you want to use this as like a full service.
you can set up the rules to either do a firewall forward or do stuff like that as well.
Any other questions?
Yeah.
My very vague thousand foot view
understanding of rootful versus rootless.
had to do with primarily with
the users as in
when it's rootless.
it's using, I thought the colonel was doing a user
namespace mapping
where different UIDs inside of the container
actually mapped back to
your
Correct.
or your group
of UIDs. So what is root
inside a rootless, or I'll say it this way, what is uid zero
inside of a rootless
container may really be uid
3,000 on the host.
And what's uid
100 in the container
translates to uid
3,100 on the host.
So in the container does not have
actual root access on the host.
Is that correct?
That is correct.
And thank you for the terminology. I was drawing a total blank and forgot to put it in my slide notes here.
And yeah, so basically it's running as uh
The sub user ID set.
So that is one call out that if your system administrator has not configured that.
it.
will not work well for you.
which is one of the things that drives me nuts at work is that
one of the machines I have access to that it would be great to run this on.
I can't do rootless because
The way things are configured, it just does not work.
Because that's not enabled and
the way that user control and all of that stuff is done inside the company.
it's not going to happen.
like um
I'll give Andrew a second to catch his breath.
In the chat, in the meeting chat, Andrew has already posted uh
the slide deck that he's working off of here. So if any of you want to pull that down and follow along
On your own machine, you're welcome to do it.
Also, we will be
putting that slide deck out in the archive so
If you don't feed it right now.
Don't worry about it. We'll make sure it's available later.
Back to you.
And apologies for not getting that out sooner. I was literally throwing in images and stuff to it.
here right up until the handover so
This is truly a just-in-time presentation.
But so basically
As I mentioned before.
Basically, Docker desktop
If you have a Mac machine or a Windows machine or stuff like that and you want to do local development work.
It, uh, uh.
is possible and basically Docker, the company, has a great solution
that is a cost. Yes, thank you, Sean.
that there is a cost, especially if you're a larger company, to use
But basically…
It…
basically does all of the integration.
to run a virtual machine.
And make all the connections and make it seamless and easy to use and all the pretty shiny pictures
that managers love and all that stuff.
The other option is that Podman does have a
Podman for windows
Podman Desktop, which is very powerful and
works and of course
is free and
leverages Podman instead of desktop.
Instead of Docker.
Yes, Grant, that is the command to give you uh
the privs to be able to get there.
But of course, the other option is if you already have WSL2 or brew
in your respective environment set up.
you can just go ahead, WSL2 is a full-blown Linux container.
system, just go ahead and run either Docker or podman inside there and it works just fine.
So the big question is, how do I install this stuff?
And here, if I can get this to play nice
We'll go ahead and just pop open this uh
Well…
Come on, I…
Sorry here, I'm failing at actually using
Okay, here we go.
So if I click on the link here and pull it up.
One thing I will say is that Podman has
some very nice documentation.
And it makes life very, very easy for using.
for when you run into the rough bits.
And that is one of the issues that we will run up against is that podman
is sort of the path less traveled. So there are rough edges sometimes.
But they walk you through for each environment.
Whether it be Arch, Alpine, scent
Debian, et cetera.
all of the stuff that you'd need. So for my favorite uh
Since I have a…
Ubuntu machine, it would be debian like
So you just run apt.
install Pod Man.
And it will install everything just fine.
So with that being said, let's go ahead and
dive straight into the demo here and start pulling down containers and running things.
So I'm going to switch machines over here to the lab.
Machine.
And I'll hit share.
Okay, and I assume everyone can see my uh
screen now and that it's large enough for everyone to be able to read.
We see it. Gary can't see it, though.
And so…
Okay.
Apologies, I'll try and describe the commands here as I go along.
But basically, the big thing to remember is
like 99% of the time
The commands that you use in Docker are the same exact commands that you'll use in podman.
So let's just go ahead and use one of the hello world
sort of commands.
Podman instead of Docker run
a dash r m
I could type.
or M.
God damn.
And I am horrible at typing today.
But let's just run the hello world command.
And I…
nerves are clearly getting the best of me here, so I'll flip it around.
the the hello world command, of course, it just spits out the command here
And it's
just exactly as you'd expect.
And all you had to do is just run Podman instead of Docker.
In fact, if you're on a machine that you
want to sort of install a compatibility shim over top of this.
Let's just type Docker. I don't have it installed on this machine.
And let's just try running command of course
It helps out and helpfully says, you don't have that installed.
But here are the options you have. And if you notice one of those is podman-docker.
And really all that does is just makes a SIM link from docker
the command docker to podman.
So let's go ahead and install that.
And at the time, if I hadn't already installed and set this up.
you just type in
pod man and for any of your uh
a Debian based world
that will install your stuff.
for pod man so now you need my super secret password
And there you can see it wants to install a couple things
And I find it interesting that the recommended packer is Dockerio.
But hey, we're not going to go ahead and go with that one because we want Podman instead.
And as you can see, it has to chuck some Python stuff in there because
Whatever.
And as we wait for a second for it to finish running.
Because what's a live demo without pain
So now we go
Docker. So let's just run that same command we just ran
Except for Docker instead.
And as you can see, it emulated container
using pod man
So it worked just fine.
So let's go ahead and dive into some of those bigger, deeper questions
Where, like, say, I want to actually do something that I'm not allowed to
So…
Just to show you the sort of security
stuff that we were sort of hinting at here
Let's go ahead and mount
Etsy into…
And then let's go ahead and just run your
basic Ubuntu contender container
And we're going to run the command bash here.
And I'm willing to bet I, there we go. So if we cd
into
Etsy host. So what I'm doing here is dash v is mount
And we're mounting the path ETC on the host
to slash ETC host.
On the actual
container itself. So here we are
As you can see, we're actually in my ETC. I'm running as root
In a sane world, I should be able to just…
go ahead and
touch foo and create a file called foo right here in ETC. If I was root.
And as you can see, I can't do it because
actually out in the real world. I'm not actually running his route.
I'm running as a sub user of myself.
So one of the big benefits is you can allow people to run containerization stuff on a shared machine.
And you don't have to worry about
securing stuff to stop them from doing
funky shenanigans.
would you
If that makes sense.
It does. Would you please rerun that, but instead of Etsy host
would you do temp post?
We're in temp on the host is world right.
And then touch a file inside the container, exit the container and do a long listing.
of the file.
Yep.
Okay, so here we are, temp and temp host.
And let's CD2.
And while this keyboard is terrible for typing.
As you can see, it successfully touched.
go along.
And now let's go ahead and exit.
And LLC.
Slash.
Temp.
And let's go ahead and grab
for foo in there because…
Should I pull up for a tent.
And there you can see I am actually the owner of that file.
even though it was root inside that actually touched it.
Thank you.
And then just out of curiosity here, because I'm curious how it translates
If we actually jump back into pod man
here and go cd
temp uh temp
Post and post
Oh, oh.
And it's…
it actually does handle the permissions, right?
Okay.
I'm assuming here, Sean, you're wanting to do uh
touch uh
who
uh…
Like that.
Anyway, we can play with this afterwards.
But the long story short.
at least in theory should honor
As you'd expect it to do.
Oh, I see what you mean. Okay. Anyway, though.
Okay.
Skipping ahead here.
So basically that's your hello world. Any of the commands that you'd expect to run inside of
Docker runs just as well inside of Podman.
It does use the same exact build engines for if you're doing a Docker file.
and want to build
a container of your own
It uses the same build engine as Builder, so there is compatibility there.
And basically they're sharing stuff across
So yeah, and I won't dive into how to actually create a
a Docker file itself. We're going to go into a bit more weird complex stuff here in just a few minutes.
So I will go ahead and jump back to our slide deck.
And…
we can keep boldly going forward here.
So the next thing to talk about
is the fact that
Podman being a Red Hat process.
uses SE Linux.
which um the the
great thing about SE Linux is that it does
very fine-grained support of
to protect you against bad actors. So even if you were running as root.
If…
that SE Linux context that you're running inside of
doesn't have permissions to do stuff.
it's not going to work.
I won't actually be demonstrating that today just for the fact that I don't have SE Linux set up on
this machine being that it's Ubuntu
You can actually run SE Linux just fine in Ubuntu.
But I like actually having a functional machine that I don't have to fight.
And I really don't care if this machine gets popped and someone's doing bad things in it because
It's a throwaway cheap Chinese laptop. So yay.
But what is SE Linux basically at the root of things?
It's…
a fine-grained control using the mandatory access control
model that's a Department of Defense style access control
Versus the default Linux world way of doing things, which is called DAC.
Which is discretionary access.
And basically, if you want to get your tinfoiled hat going really well.
It is originally developed by the NSA. They sense have let it go into the world and have
collaborated a lot with it.
It dates all the way back to 2000 and then was actually integrated into
the Linux kernel all the way back in 2003.
So talking about another really long living
thing that has been around for forever.
And basically, if you live in the Red Hat Enterprise Linux world.
or any of the Red Hat compatible stuff.
Everybody loves that. The Debian world sort of has gone more app armor.
Which is an easier, more simpler, and is only path-based control.
But the Debian world sort of has embraced that more.
you can use either in either space
But personally, for my personal machine that I don't have to worry about running services on and stuff like that.
I really don't care enough to have either of them running.
But we can talk a little bit about how you'd go about using it because this has been one of the big
Heartburns that I've had with pod man
is getting the security commands actually right and getting everything to play nice.
So you can use the command pod man inspect. And one of the things that it will list
in all the variables it spits out is what the security context is
using the double dash security dash opt
you can pass in the SE Linux label that you expect
In the form of user
system container, user groups and stuff like that.
or if you're doing that dash v
You can do what your hosted path is, what your container path is, and a colon
Z. And what that will do is you're saying, hey, I want this to be accessible inside my container
just go ahead and do what you need to do to make that work.
and uh really
you know.
That's one of the big issues that I've run into before I've figured that out.
was that, for example, I'd like to build my blog, dinner.co
inside of a podman container on a
it's a rocky container so it's a red hat like clone.
And one of the big problems was
the way that I was doing it was just mounting the folder with all of the markdown language I needed to compile into the HTML.
in just with a dash V. And of course, since
The SE Linux said, well.
know this container is running in a different context. It doesn't have permissions to access that.
It just, you'd end up not getting anything to run right and getting permissions right.
And until you do that colon capital Z on there.
you have to feed in like a security ops
like disabling SE Linux from running at all in it
And of course, that's not the secure way to do it or the right way to do it but
What can I say? I'm lazy.
On to the next part that I will actually demonstrate here.
Podman and Kubernetes.
So anyone who basically is anyone in the bigger world of using
Lots of stuff out in the cloud. Kubernetes is the 800 pound
gorilla. Podman is compatible.
And you can actually run pods that are created for Kubernetes
ish, as always in here is always in here
Podman is a…
And sort of the path less traveled so
things that work in Kubernetes, you may run headlong into things that don't work
In Podman.
For example, you may not, the ingress you may have is uh or
the network file systems that you have set up inside your Kubernetes controller
may not mesh and play well with Pod Man.
But for local development sort of stuff, you can totally do it.
The big call outs is reminding you that this is only one machine.
So you don't have all of the cool stuff that you can run in pod man or in Kubernetes like
being able to schedule it to run across 20, 30 machines. And if one blows up, whatever, who cares?
But it does work.
So let's go ahead and take a look at the actual demo here.
Before you move that screen.
Oh.
Let me just point out to people that top line
Well, you say pods created for k8s
K8S is an abbreviation used for Kubernetes for those
who may not be familiar with that. It's just because kubernetes
All right.
for damn long to spill out.
Yep. And yeah, thank you very much. And yeah, if there is any term or anything that I
I use here tonight. I apologize.
the tech world is full of jargon, and I tried to
get most of those out. And that is one that I missed.
Ingresses are one of those things where it does exactly what it sounds like.
It's basically a point from outside in the internet
that lets you be able to expose your website to the world
in a predictable way.
from your pod and you don't have to worry about what machine it's actually running on inside your cluster.
The magic just happens and it gets routed.
But thank you again here. We're going to go ahead and jump over
Again, to my demo
And part of the reason, if you are wondering, well, why do you have the demo on a different machine than what we're showing on?
This poor little machine is a little bit under-resourced, and I found that when you're running
The web browser showing your slide deck and flipping between stuff.
Memory resources tend to be a little bit
rough and uh
performance really takes a hit so
So that I have a backup machine. I'm running two machines so that the demo gods are hopefully less angry at me.
But let's just go ahead and boldly dive into what commands we need to run here.
So…
Let me pull my…
notes out here so I get things correct. We're using the pod man and Kubernetes.
stuff so
Let's go into the pod folder here.
And if we take a look at
this wp.yaml
It is…
very much a jet GPT, create me up
a Kubernetes pod
that can host a WordPress website for me.
So what do we have going on in here?
There's a volume that basically is where the database is storing its stuff.
We spin up a MySQL 5.7 database.
And we mount that in the right spot.
So that it will use that folder
as our
a permanent data store.
or passwords that we're setting up are
some WordPress, none of these are secure but hey
We're just going to spin this up so whatever yolo
And then…
the other container that we're spinning up. So we're actually saying, hey, make us two containers here inside of this pod.
And the other one that we're going to spin up is the WordPress.
And we're saying, hey.
Mr. WordPress.
We know that you're hosting stuff on port 80.
Let's go ahead and expose it out to the world on our actual machine as a host port. So basically the machine that's running it
It's going to be exposed as port 8000.
And then we're setting up for WordPress some passwords
And stuff like, okay, connect to the database on this spot here
here are your passwords, and this is how you connect to things. So it really a bog standard hello world
Kubernetes pod.
showing you that we can do some stuff
with persistent storage and
some networking between your pods and only exposing one thing out to the world.
for people to see, if that makes sense.
Okay, hearing no questions or screaming, this doesn't make any sense at all.
Let's go ahead and get things back up to the top of the screen here.
And I'm going to scroll just a little bit here.
So that I actually have my commands correctly here.
And apologies here.
And this is the point where my demo
world is failing us, so let's just go ahead with my notes here and go
for it here.
So, uh.
We're going to do…
Pardon?
Sorry here.
So pod man
odd man pod.
Start.
Sorry, I'm just going to grip it here.
The one thing that I forgot to write down
And I forgot grip.
There we go.
Admin.
Okay.
And that would be why it was on my other
history here so
Podman.
start and then
I believe this is the right one.
And this is where podman help comes in.
Should I say that again? This is where pod man what comes in?
God, man, help because i i
I munged my commands here.
Awesome.
Okay.
Here we go pod man
cube.
Play.
So, uh.
Here, let me go ahead. Yeah. So the actual command i was looking for
is Podman Cube, as in Kubernetes
play as in like go ahead and take and run this script
WPE YAML.
And we hit return
And it will take it a moment to spin it up here because it's translating some stuff.
And okay, as you can see
it spit out some information here.
This pod, 970, blah, blah, blah.
is running two containers.
A13, blah, blah, blah, and 91C or 9C1, blah, blah, blah.
And basically what it means is inside of this pod, which is like a big
met a group of things all running together.
Did someone raise their hand?
Okay, seeing no one uh
Sorry about that. Basically, it spins up these two containers inside this pod
They, by default, have permission to network with each other
And not necessarily with the
outside world.
But since we exposed port 80 or 8000
That is now accessible.
So if we go to local host, which is the machine that we are running right here.
local host 8000.
And as we will see.
Here's the hello world prompt for running
the setting up your WordPress.
So clearly we have a database connection
And we're talking to that database
And everything's being persisted the way that we'd expect it to.
And basically.
with just one question of how do I create a Kubernetes pod
I can now that once I'm done with my testing, I can go ahead and deploy this out to
my larger cluster and
not have to do anything different
for my developer work here on my local machine.
Hopefully that makes sense.
Okay.
And so now we're done with this. We want to go ahead and tear it down.
How do we do that? And this is where there is a little bit more
Heartburn, the commands are slightly different here.
So the two, if you remember in the Docker world, there are two commands.
stop, which just turns off the pod.
or your set of containers and
RM, which actually deletes them.
In this case, we're done working with it. We want to just blow it away completely.
with the idea that stop your volumes actually persist and you can get back to them and you can
Stop it, spin it back up later, and everything's fine.
For example, if you were doing like a data science project and you have a Jupyter notebook.
And you want to keep your stuff around, but you don't want to keep it running all day long because
It's using gigabytes of data.
That's easy. But in this case, we want to delete it. So the command here is
pod man pod
Stop. And then…
really in the grand scheme of things, it's looking for that
huge multi-character long thing here
But the good news is this hash
All we have to do is just include the unique bits.
I know that there's only one pod running on my machine right now.
Which, if we want to actually see that
uh…
Sorry, P.S.
is what we're looking for. As you can see here.
We've got…
Actually, I've got a couple things running because I screwed things up.
But as you can see.
Well, I was testing things
The ones that we actually care about are three minutes
old here, the big things that we care about is the fact that there's
And it's forwarding through the infrastructure. And then we've got this other stuff going here.
And it's running Apache and MySQLD.
So if we want to tear this back down.
the command ends up being pod man
pod.
RM.
And then we need what is unique about this set of characters right here, this 970,
Well, if we go nine
7 oh so this is the name of the pod.
it will figure it out and fill the rest in for us.
We just hit root.
Remove.
Okay, it cannot do it without force.
No, let's just go ahead and do
dash f to force it.
And hey, look, we killed it with prejudice.
And now if we do this uh
PS, you can see that we're only down to this one Docker Compose container that I screwed up and
is still running in the background. So if we want to remove that one just because we're going to clean stuff up, we can do
admin uh admin
RM3BE.
And let's go ahead and force it.
And now it's cleaned up all the way.
it's supposed to be cleaned up. There's something weird hanging out there. Again, like I was mentioning, there be dragons here and
Slightly.
Podman doesn't always play nice. Go ahead, Grant.
you did a slightly different command.
You did Podman Pod RM.
earlier and then you just did Podman RM, you're missing a pod
And I think somebody else said 3B3 not equal 3B echo.
Three.
That is correct.
So, uh.
And in this case, because it's not a pod, it's a container
And it's a standalone. That's why Podman Pod isn't working.
But remember, it's compatible with Docker commands.
Docker remove in the name of a container will kill it.
Apparently it has a dependency and that isn't running.
Like I said, it's in a weird state.
And unfortunately, it will get sorted out when I reboot here clearly.
But we're just going to boldly go forward here just because
Again, what's a good demo if it doesn't always go straight? But thank you for pointing out that I can't type. I really appreciate
catching that because my eyes were definitely not seeing that.
but hey what's some self-deprecating humor uh
In a demo. That's the way most mine usually go.
The next thing we can talk about of uh
Of course, the world of Podman
the Docker world sort of before Kubernetes sort of took off in sort of as a competing thing.
there's this whole Docker compose
And basically it will
either allow you to spin up a Docker swarm of containers
across multiple machines in sort of a Kubernetes light sort of world
Or you can actually do a on one machine, spin up your full lab.
without having to write yaml that is the
or slightly easier yaml.
than what is
the whole Kubernetes space
And I know there are a lot of people who absolutely love Docker Compose.
And especially in a lot of documentation, you'll see where people will show you here, here's all the stuff that you need to build to put together
to do Docker compose. And the great thing is there is actually a compatibility
shim that will…
script it out and make it look exactly like you'd expect.
And again, it works
Sort of as Ron Burgundy says, 60% of the time it works every time.
or whatever that quote is.
So let's quick take a look at that as a demo.
And again, this is just a really
bare basic hello world.
And let's jump up a folder.
And CD into my Docker compose demo
And you'll ask, well, Andy, how did you actually create this demo?
I took the YAML that I made in
Asking ChatGPT to create for the last demo.
And all I did was say, hey, I have this pod this uh
Kubernetes pod, I want to run it in Docker Compose instead.
make me one and
our AI overlords translated it. Now, there are a couple things to point out that it
doesn't necessarily give you a like for like translation, but this will be close enough that it looks great.
And what are we doing here? Again, as we talked about.
There's a database and the WordPress server
We're pulling down
the MySQL 5.7 and WordPress latest
port 8080 or port 8000 is exposed
Restart always is always set up so that if something fails, it'll automatically spin it back up so that you don't get that 3 a.m. call of someone saying.
Hey, your WordPress blog is down.
Which, if you're reading my blog at 3 a.m, well.
We need to have talks about…
work-life balance, but whatever, here we are.
And just to prove that we're no longer actually running here so that
We can prove to myself that we are actually torn down.
As you can see, it's not actually running.
And let's go ahead and talk about how
In theory, this is supposed to be packaged and bundled along
with Podman, I did find that
apt, the way that they have their packages
set up, you actually need to have a pod man compose actually installed separately so
you need this pseudo
apt.
Stone.
podman dash
Impose, hit return, you type in my magic password
And if I type.
And basically what it does is installs this little shim
And now if you remember anything from
Docker Compose to actually spin up this container. What you're going to want to do is
You'd type docker compose, in their case, podman compose
Okay.
And what do we have going on here?
you can see that it's using Padman
version 493, which is what we have.
And as you can see, it's creating up the network and everything. Basically, all this is is just a
shim that sits in front and
runs a whole bunch of podman commands for us.
and translates your podman compose into actual Podman commands.
As you can see here.
So let's go ahead and look actually at our
WordPress website here.
And as you can see, we're actually up and running.
And just to prove, here you can set up everything and et cetera and
It works as expected.
So, uh, uh.
The big thing to remember is pod man
Docker compose by default runs
just putting it out to the console
Control-C actually sends it the the kill commands
And of course, it takes it a second here to die.
And so…
Looking again at our documentation.
all of the stuff that you'd figure exists
As you'd expect.
So as you can see, it mirrors a lot of the commands that we'd already expect.
So you can actually feed it in
to create stuff inside a named pod.
Which is, remember, that larger subunit of
individual containers to run.
all sorts of build arguments you can feed it.
And then the commands that we'd expect here as expected
You've got help, version, weight, system d
which we'll talk about here in a minute. But one of the great things about Podman is it does integrate with System D.
And you can use that to create up services that you can run
inside of System D.
You can push you can pull
Again, all the stuff that you'd expect
And one of the big uh
Shout outs here that you'd probably want to worry about here would be
Um…
Yeah, there are commands that you can run it in daemon mode
So if we do
I believe it's dash d
which is not playing nice at all.
Oh.
Because it's still running so
Okay, so…
Okay.
There we go. So one of the gotchas here and the weirdness is that
podman can pose actually does
still run stuff and spits out to the log.
Even though your containers are running in the background.
So it's really weird.
But if you run the as expected pod man compose down.
it does actually bring things down and delete everything as expected.
So that's where the problem we were running into.
Again, clearly I did not sacrifice nearly enough blood to the demo gods.
Hmm.
And then the last demo that we have
I'll actually show the slide later.
But there's really not much on the slide. So we'll just go forward with our
demo here. SYSTD can actually run pods as services.
And, uh.
the command that we want to run here would be, so let's go ahead and CD out of here.
And…
Let's just make another folder that will be empty.
And so what we want to go ahead and run here, the command
we're just going to want to
run a simple hello world so our
old uh
We have Podman as the command.
Generate.
System.
And then…
my pod?
And we're going to say to create as a file
And let's go ahead and create a new one.
And we want
podman generate.
Sorry, here, checking my notes.
I failed to copy and paste here. System D.
Okay, and here it's giving you a prompt that
This is using
you shouldn't really use Pod Man to run your containers. You should use Quadlets instead.
Whatever, personally, I still like Podman. I don't have much experience with quadlets.
But whatever.
And our…
So, okay, Led.
We wanted…
Sorry, you're working through one slight hiccup here.
Let's just go ahead and bring up our
CDU pod.
And we want to spin up our old
pod that we created using our Kubernetes container.
And this is the pod that we actually want to expose out to the world
and to run all the time.
So here, let's go ahead and run this
And this was what we actually wanted for the name.
I believe name
is e.
Five, three.
Okay.
We want…
WordPress pod sorry here
And since our pod already exists.
Okay, and as you can see.
There were a couple errors because we have this restart policy of
restart if it fails and we want to use system d instead
There's a couple of warnings here.
But what ended up getting created for us
is this service
sort of name files.
And so what we end up wanting to do is
this generated.service file.
is…
Basically, these are three services that we'll want to start in SISD.
And so let's go ahead and take a look at
what it actually created for us.
And so as you can see here.
container this was auto generated by pod man
And there's some documentation of how it was run, etc.
And it will mount run users 100
or this is my username.
And etc.
And what are we doing? We're going ahead and starting WordPress Pod.
And running all of these things.
And one of the hiccups here
If you want to run it as yourself.
we want to go ahead and edit.
There should be a user in here.
You…
Yourself versus what? Versus root?
Yes. So by default, your system d
will run uh
stuff inside of System D as a user.
And of course, that is
by default using the sysdi
I believe…
We want to have
see if it was generated for any of these other ones.
Sorry, this is the one spot that I ran into a hiccup of being able to test
And here.
Running out of hours in the day but uh
Basically, what you're wanting here is uh
Inside of your
unit you want.
user
equals
A dinner.
But we don't want quotes here.
is at least what their documentation is saying, I believe.
And basically what that will do is run
This is the container as user
a dinner which is me instead of the actual uh
root sysd user which
ends up being system or user zero.
And so when we want to actually deploy this.
What do we actually do? We need to uh
do pseudo mv
This would be pod dash word
Press pod service.
And we want to go ahead and move that to ETC.
System.
B…
And then system
And then we can go ahead and run
pseudo
System cuddle.
enable
And there you go. Now, if we do uh
System control status.
you can see that it's loaded. It's not running because we didn't bring
those other two containers in.
But considering if we copied all of those in and spun them up and ran them.
then it would actually be
running here as we'd expect.
But you can do all of the other stuff that you'd consider you'd want to run in
like…
logs for logs
And this is where I admit I'm a bit weak on my system control.
commands.
But yeah, someone, you could have a whole other
presentation on how to use System D to
run stuff. And I'm sure there are far more
intelligent people on this call that can uh
a dive into System D than me here.
That's pretty good.
system, manage facilities.
Any other questions? Lee, I think I heard you talking.
I just was telling Gary to put that on the list so we can remind you in a couple months.
Yeah, I mean, I can definitely see you guys here in a few months.
But here to finish out the rest of my couple slides.
And I do have some slide notes that I'll share as well here.
Hitting here back to share.
And somehow my voice seems to have survived.
But the big things to remember here assist D can run pods as services.
As you can see, they're already recommending that you use another process which i'm
not very familiar with. I need to use Sisty more often.
Because there's a chat bot that we use to bridge between Slack and
IRC for the cia lug.
And it's notoriously bad at staying up.
So that's something I really need to wrap
behind something that's a little more resilient like sysd
But that's a whole other talk.
And sort of like I'd commented before.
The thing about Podman is it is a very large Swiss Army knife of different tools and stuff that you can use.
But as you can see, there is some rough edges. Sometimes the documentation is not
nearly as shiny as what Docker is.
And it's also the road less traveled. So if you go ahead and
Google stuff, it doesn't always come up nearly as helpful as what you'd expect.
Plus, it is very Red Hat centric so uh
They have very different opinions on how to do stuff than necessarily the Debian world does.
and uh
I love using it.
I love being there, that sort of counterculture rebel.
but uh
You will occasionally find those compatibility things. It's gotten a lot better than it once was.
But…
They're there to be dragons sometimes as well.
And then we can take any questions, comments, snide remarks, etc.
I don't see anything additional in the
the chat here.
Any other questions?
Fascinating, Andrew. Kudos.
But especially since you're feeling under the weather.
Yeah.
Yeah, I mean, there are things in there that I never even thought about
So yeah, a little bit of a
mind opener here tonight. Good.
Hello.
thingy thank you very much here and uh
My voice and cough uh
Definitely masks. I actually do feel great right now, but then again, that might be the fistful of steroids they gave me.
Slightly before this meeting so
Yeah.
That's good.
It was good, that is.
Excellent.
Any…
What we still have andrew still
Any other questions or even other questions
kind of jaunts off of something you made you think of
how it might fit in.
I'd like to point out that earlier Sean had put in the chat that was very easy to find
his previous
presentation under the new site
You can look up presentations by
presenter and it lists all the presentations that way
And just as a call out as well, the previous presentation using Bilda
If you pull down that slide deck that I sent out, there's a link in there.
Okay. Thank you.
I got a…
A question from a remote person who wasn't here.
Go ahead.
Can I do that? Okay.
Yeah.
Robert Sitek, who is
been at our meetings many, many times. I've given many, many presentations
Most notably on Docker.
Quite a few presentations on Docker.
So he was asking
about he wants to be able to
Switch.
He's using…
Jupyter notebooks and
I don't really understand this exactly, but he's
using that google
collab thing or whatever, right? Which is sort of a
online way of doing jupyter notebooks
That's the way I understand it. I believe that Robert gave a presentation on that as well.
He wanted to know if
Andrew, did you think that you could
replace
Docker in there with Bodman.
I don't know if I'm stating the question correctly.
Yes. So yeah, Jupyter Notebook, you can totally run inside of Podman.
And it's completely possible.
Here, if you want, I can quick share out and we can give a try at actually making it work.
Go ahead, please.
Okay, this will be somewhat…
Playing on the fly here just because
I have a general idea of how to do it, but…
Docker.
You put a notebook.
I just need to quick pull up what are the ports that I need here.
8888. Okay.
So let's go ahead and do
Badman, run.
RM.
it and we're going to pour port forward
Eight, eight…
eight, nine, and port 888.
So basically we're taking the pod or the Docker, the in container
port 888 and exposing it to the world is 8889.
And let's go ahead and…
the URL they're giving me is
quay dot.
IO slash.
Jupiter slash
base dash
a notebook. Let's go ahead and see if this works.
Sure.
Oh.
Is there a particular reason you changed the port instead of just carrying
8888 through 888.
No, in theory, you should be fine doing that.
I'm just…
root copying the Jupiter notebook docker guide
So here, I…
Basically, all I did was go, go Google searched
And…
This is the documentation that i am
pulling off of right now.
And as we wait for my poor little machine here to spin up.
all this fun uh
Java-y things.
and pull things down and uncompress it.
Hey, while we're waiting for that, I've got a question for Chris Lawrence. He posted out there.
3BE not equal to 3BE.
Oh, that was a typo on my part.
I was trying to delete a container that started with 3B3.
Okay.
And or vice versa. And I had a typo.
Okay, okay.
actually three baker echo versus three baker three.
Gotcha.
Yep, so here we go we're running
And we're spinning up Jupyter Lab, which is the favorite hello world of
Data science.
And here we're going to copy and paste this.
And as we remember, I…
don't want to…
The fun world of remembering that control C means something different in container world.
Versus uh
the rest of the world. And remember, I had jumped it ahead here by one
port. So here's port here
to quick tweak that and
When we hit return
Okay.
And as you can see, we're now running jupyter Notebook.
And we can do all sorts of stuff here like uh
three plus three plus
three plus three.
And go ahead and run it in python.
And as you can see or
If we want to actually document things in markdown
We could do all sorts of fun stuff like uh
Titan 1.
This is Merckdown and
You can even run stuff inside your container as a command like
Pip install uh
Oh, I don't know.
Oh.
pip install uh pip install
Oh.
just ask PIP for help.
Yeah, so the exclamation mark is run it as a shell command.
And as you can see here, we're installing the library pandas.
And it, of course, will take a hot minute to install because pandas
is pandas.
And then you can do stuff like
And basically, uh.
the Jupiter collab stuff
is exactly as…
It's fairly close to Jupyter Notebook, so you can actually
bring
you can play with their free CPUs and GPUs, and then once you want to bring it home.
You can with, of course, the
the provision and warning that there's just enough different that it's going to
So anyway, though, uh.
Yeah.
A little almost two-year-old visitor came in and wondered how things were going here
the smallest Linux user yet.
Okay.
As he's he compiled the kernel yet?
No, I'm trying to stop from corrupting him until at least he's…
a full two years old.
Okay.
I presume he's…
crashed and had some core dumps though
Yeah. The real question, the real question, them or emacs?
Yeah.
Yes. Yeah.
B.
My house, I'm a big believer in Vi. So yeah.
Okay.
Amex.
Well, I started using Vim years ago and I could never figure out how to get out of it. So I've sort of stuck with it.
All right.
Oh, my God.
But the one thing I will call out about
using Jupyter inside of either rootless Docker or Podman.
is you can enable
a whole bunch of different users to do all the fun stuff they want to do inside of Jupyter Notebook.
And you don't have to worry about granting them
the privileges and permissions to run stuff inside of
rootful Docker, which of course uh
Hmm.
If you give data scientists an inch, they'll try and take a mile and start doing fun shenanigans on your larger machine.
All is good.
So the answer overall was yes.
Hey, look.
You can run. You can run your Jupyter notebooks with fun.
Hello?
No, it looks that way to me.
Oh, okay.
Looks like it does.
Okay.
I'll pass that along.
Okay.
Golly.
So are we all burn out now or what?
Now we know everything there is to know about pod man.
It's just…
Well, not everything, but everything necessary, I guess, at this point.
High points.
highlights.
How long will it be before the
Slides are going to be up on
on the SLU website.
Whenever I feel like it.
Okay.
I know Andrew posted them in the chat, but…
It's a little bit difficult for me to get to that.
Sometime tomorrow, I'll send you a link, Ed.
Oh, thank you very much.
We want to try it over here. So what's going on?
Are we done with the meeting?
I guess, let's see, is there any…
Any questions of a general nature that don't necessarily apply to our main speaker tonight?
while people are thinking that
I'm going to extend another big thanks to Andrew Denner
Although I believe at least
portion of this was prepared for a presentation at the cia lug
I asked him on
relatively short notice if he could do it for us. I think he brushed it up and
They've made a few additions.
So thank you very, very much, Andrew. It was really an eye-opener. Appreciate it.
Okay, barring anybody else, should we kill the recording?
I suppose so. There's a thumbs up there. Oh, that was from Andrew.
heard okay from Andrew.
Okay, if hearing nothing else, I suppose this has been uh
Our monthly general meeting of SLUB, the St. Louis Linux Unix users group
The date is Wednesday, the 13th of November 2024.
Our main speaker tonight was Andrew Denner, who talked to us about
pod man uh versus pod man
Docker.
And our
basic tutorial on the front
was Lee Lamert. And Lee told us about IP tape when ip tables is not
IP tables so
Thank you all for coming tonight, and hopefully we will see you all again soon. Next meeting for us is the
new Linux user meeting.
And that…
No, no, no, no. It's the St. Louis Linux users group meeting.
Correct. Week from tomorrow, St. Louis load meeting a week from tomorrow.
Thank you all for coming. Good night.