Download and Flash Asuswrt-Merlin Firmware (v384.6)

https://www.asuswrt-merlin.net/ https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC56U/Release/RT-AC56U_384.6_0.zip/download

Prepare USB Drive

1. Login to router via SSH (ssh admin@router_ip)
2. fdisk /dev/sda
3. mkfs.ext3 /dev/sda[1,2]

Enable JFFS Custom Scripts and Configs

Administration -> System -> Persistent JFFS2 partition -> Enable JFFS custom scripts and configs (‘yes’)

Execute Entware-Setup to Enable /opt Mount on USB Drive

The newly flashed firmware (v384.6) has entware-setup.sh included already. FYI: https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/others/entware-setup.sh

Update Post-Mount Script

/opt/etc/init.d/rc.unslung start is the line added; not sure if it’s necessary. :)

Issue

When putting files into an NFS shared directory, I get an “Access failed: 553 Could not create file.” error.

Solution

1. setsebool -P ftpd_full_access 1
2. Make sure the mounted directory has the correct ownership.

Setup a Standard RHEL/AlmaLinux 8.5 VM

1. Docker proxy settings:

   cat /etc/systemd/system/docker.service.d/http-proxy.conf 
   [Service]
   Environment="HTTP_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "HTTPS_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "NO_PROXY=orbw-artifactory.ca.alcatel-lucent.com"

2. Insecure (private) registry:

   cat /etc/docker/daemon.json 
   {
       "insecure-registries" : [ "orbw-artifactory.ca.alcatel-lucent.com:8081" ]
   }

Install GitLab Runner

docker run -d --name gitlab-runner --restart always -v /home/cloud-user/config:/etc/gitlab-runner -v /var/run/docker.sock:/var/run/docker.sock orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest

GitLab Runner Register

docker run --rm -it -v /home/cloud-user/config:/etc/gitlab-runner orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest register

Example config:

Use wget to download a list of files:

wget -x -P /data/temp/files --no-host-directories -i /data/temp/file.txt

A few readings from the internet.

Docker Default Security Option

https://docs.docker.com/engine/security/seccomp/

# docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.6.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)

Server:
 Containers: 17
  Running: 15
  Paused: 0
  Stopped: 2
 Images: 16
 Server Version: 20.10.8
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: e25210fe30a0a703442421b0f60afac609f950a3
 runc version: v1.0.1-0-g4144b63
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.42.2.el7.x86_64
 Operating System: Red Hat Enterprise Linux Server 7.9 (Maipo)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 23.39GiB
 Name: gene-k8s-k8sc-node1
 ID: VGBN:P5LX:RTQG:OX67:INYM:ZUHD:W6NQ:FWWL:KUV5:NZ6N:2DKH:ZIYL
 Docker Root Dir: /opt/nsp/docker
 Debug Mode: false
  Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
   127.0.0.0/8
 Live Restore Enabled: false

WARNING: API is accessible on http://0.0.0.0:2375 without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: https://docs.docker.com/go/attack-surface/
[root@gene-k8s-k8sc-node1 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
[root@gene-k8s-k8sc-node1 ~]# ps -eZ | grep docker
system_u:system_r:unconfined_service_t:s0 1254 ? 00:00:00 docker
system_u:system_r:container_runtime_t:s0 30862 ? 00:02:10 dockerd
system_u:system_r:container_runtime_t:s0 30976 ? 00:00:00 docker
[root@gene-k8s-k8sc-node1 ~]# docker context ls
NAME        DESCRIPTION                               DOCKER ENDPOINT               KUBERNETES ENDPOINT                ORCHESTRATOR
default *   Current DOCKER_HOST based configuration   unix:///var/run/docker.sock   https://127.0.0.1:6443 (default)   swarm

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

The Huainanzi says: “Rather than standing by the pond and envying the fish, it is better to go home and weave a net.”

Diligence (Shen Qin)

The Zengguang Xianwen states: “The plan of a lifetime lies in diligence.”

He Shaoji, a famous calligrapher of the Qing Dynasty, sent a light box back from the capital when he learned his daughter was preparing her dowry. On her wedding day, his daughter Chunmei and her husband opened the box, only to find it empty. However, at the bottom of the box, a large character was clearly written: “Diligence”. Upon seeing this, the newlyweds fell into deep thought and understood their father’s profound intention. From then on, the word “Diligence” became the couple’s guiding principle for managing their family and achieving prosperity. As the saying goes, “With diligence, nothing in the world is difficult; with laziness, everything is lost.” Diligence is undoubtedly the first essential of life. In our dealings with others and in our work, we should take diligence as the foundation. No pain, no gain. The road ahead will have wind and rain, and no one can be successful without effort. But heaven rewards diligence and will not let down anyone who works hard. Time waits for no one. We must seize the moment, be diligent, positive, and disciplined, so that we can go steadily and far, making our path smoother.