cwielenb/CNCF-Dataset huggingface dataset:
Project: KICS (Provisioning / Security & Compliance)
File: 27fcc7d6-c49b-46e0-98f1-6c082a6a2750.md

title: No New Privileges Not Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 27fcc7d6-c49b-46e0-98f1-6c082a6a2750 Query name: No New Privileges Not Set Platform: DockerCompose Severity: <span style="color:#bb2124">High</span> Category: Resource Management URL: Ensuring the process does not gain any new privileges lessens the risk associated with many operations.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" version: "3.4" services: service-service-service: build: context: ./ dockerfile: service.dockerfile ports: "6969:8080" networks: service-service-frontend restart: always security_opt: no-new-privileges:false networks: service-service-frontend: ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="12" version: "3.4" services: service-service-service: build: context: ./ dockerfile: service.dockerfile ports: "6969:8080" networks: service-service-frontend restart: always security_opt: "apparmor: false" networks: service-service-frontend: ``` ```yaml title="Negative test num. 1 - yaml file" version: "3.4" services: service-service-service: build: context: ./ dockerfile: service.dockerfile ports: "6969:8080" networks: service-service-frontend restart: always security_opt: no-new-privileges:true networks: service-service-frontend: ```
Project: ArangoDB (App Definition and Development / Database)
File: blockStreaming_doubleBuffer.md

by Takayuki Matsuoka `blockStreaming_doubleBuffer.c` is LZ4 Streaming API example which implements double buffer (de)compression. Please note : Firstly, read "LZ4 Streaming API Basics". This is relatively advanced application example. Output file is not compatible with lz4frame and platform dependent. Handle huge file in small amount of memory Always better compression ratio than Block API Uniform block size First of all, allocate "Double Buffer" for input and LZ4 compressed data buffer for output. Double buffer has two pages, "first" page (Page#1) and "second" page (Page#2). ``` Double Buffer Page#1 Page#2 +++ | Block#1 | | +-+-++ | v {Out#1} Prefix Dependency ++ | | v | ++-+-+ | Block#1 | Block#2 | ++-+-+ | v {Out#2} External Dictionary Mode ++ | | | v +-+-++ | Block#3 | Block#2 | +-+-++ | v {Out#3} Prefix Dependency ++ | | v | ++-+-+ | Block#3 | Block#4 | ++-+-+ | v {Out#4} ``` Next, read first block to double buffer's first page. And compress it by `LZ4compresscontinue()`. For the first time, LZ4 doesn't know any previous dependencies, so it just compress the line without dependencies and generates compressed block {Out#1} to LZ4 compressed data buffer. After that, write {Out#1} to the file. Next, read second block to double buffer's second page. And compress it. This time, LZ4 can use dependency to Block#1 to improve compression ratio. This dependency is called "Prefix mode". Next, read third block to double buffer's first page, and compress it. Also this time, LZ4 can use dependency to Block#2. This dependency is called "External Dictonaly mode". Continue these procedure to the end of the file. Decompression will do reverse order. Read first compressed block. Decompress it to the first page and write that page to the file. Read second compressed block. Decompress it to the second page and write that page to the file. Read third compressed block. Decompress it to the first page and write that page to the file. Continue these procedure to the end of the compressed file.
Project: Meshery (Provisioning / Automation & Configuration)
File: bash.md

layout: default title: Bash permalink: installation/linux-mac/bash type: installation category: mesheryctl redirect_from: installation/platforms/bash installation/bash display-title: "false" language: en list: include image: /assets/img/platforms/bash.png abstract: Install Meshery CLI on Linux or MacOS with Bash {% include mesheryctl/installation-bash.md %}
Project: KubeBlocks by ApeCloud (App Definition and Development / Database)
File: kbcli_fault_network_dns.md

title: kbcli fault network dns Inject faults into DNS server. ``` -h, --help help for dns ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "$HOME/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use ``` - Network chaos. - Make DNS return an error when resolving external domain names. - Make DNS return any IP when resolving external domain names.
Project: Tremor (App Definition and Development / Streaming & Messaging)
File: tuplepattern.md

The `TuplePattern` defines structural patterns against tuple values. Tuple patterns start with the `%(` operator and end with `)`. Patterns may be empty `%()`, `%(...)` any, or a sequence of tuple patterns followed by an optional open tuple `...` match. Tuple patterns are ordinal patterns defined against arrays. Where search like predicate filters are preferential the `ArrayPattern` may be a better choice.
Project: Apache Hadoop (App Definition and Development / Database)
File: RELEASENOTES.0.20.3.md

<! --> These release notes cover new developer and user-facing incompatibilities, important issues, features, and major improvements. | Major | publish hadoop jars to apache mvn repo.* The hadoop jars are renamed from previous hadoop-\<version\>-\<name\>.jar to hadoop-\<name\>-\<version\>.jar. Applications and documentation need to be updated to use the new file naming scheme. | Minor | Namenode in Safemode reports to Simon non-zero number of deleted files during startup* With this incompatible change, under metrics context "dfs", the record name "FSDirectory" is no longer available. The metrics "files\_deleted" from the deleted record "FSDirectory" is now available in metrics context "dfs", record name "namenode" with the metrics name "FilesDeleted". | Minor | Incorrect exit codes for "dfs -chown", "dfs -chgrp"* Commands chmod, chown and chgrp now returns non zero exit code and an error message on failure instead of returning zero.
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: podman-manifest-exists.1.md

% podman-manifest-exists 1 podman\-manifest\-exists - Check if the given manifest list exists in local storage podman manifest exists manifest podman manifest exists checks if a manifest list exists on local storage. Podman returns an exit code of `0` when the manifest is found. A `1` is returned otherwise. An exit code of `125` indicates there was another issue. Print usage statement. Check if a manifest list called `list1` exists (the manifest list does actually exist): ``` $ podman manifest exists list1 $ echo $? 0 ``` Check if a manifest called `mylist` exists (the manifest list does not actually exist): ``` $ podman manifest exists mylist $ echo $? 1 ``` , January 2021, Originally compiled by Paul Holzinger `<paul.holzinger@web.de>`
Project: YugabyteDB (App Definition and Development / Database)
File: txn_show.md

title: SHOW TRANSACTION statement [YSQL] headerTitle: SHOW TRANSACTION linkTitle: SHOW TRANSACTION description: Use the SHOW TRANSACTION ISOLATION LEVEL statement to show the current transaction isolation level. summary: SHOW TRANSACTION menu: v2.18: identifier: txn_show parent: statements type: docs Use the `SHOW TRANSACTION ISOLATION LEVEL` statement to show the current transaction isolation level. {{%ebnf%}} show_transaction {{%/ebnf%}} Supports Serializable, Snapshot, and Read Committed Isolation<sup>$</sup> using the PostgreSQL isolation level syntax of `SERIALIZABLE`, `REPEATABLE READ`, and `READ COMMITTED` respectively. PostgreSQL's `READ UNCOMMITTED` also maps to Read Committed Isolation. <sup>$</sup> Read Committed support is currently in . Read Committed Isolation is supported only if the YB-TServer flag `ybenablereadcommittedisolation` is set to `true`. By default this flag is `false` and in this case the Read Committed isolation level of YugabyteDB's transactional layer falls back to the stricter Snapshot Isolation (in which case `READ COMMITTED` and `READ UNCOMMITTED` of YSQL also in turn use Snapshot Isolation). Show the current transaction isolation level. The `TRANSACTION ISOLATION LEVEL` returned is either `SERIALIZABLE`, `REPEATABLE READ`, `READ COMMITTED` or `READ UNCOMMITTED`.
Project: Chef Habitat (App Definition and Development / Application Definition & Image Build)
File: running_habitat_servers.md

+++ title = "Running Chef Habitat on Servers (Linux and Windows)" description = "Running Chef Habitat on Servers (Linux and Windows)" gh_repo = "habitat" [menu] [menu.habitat] title = "Running Chef Habitat on Servers (Linux and Windows)" identifier = "habitat/supervisors/running-habitat-servers" parent = "habitat/supervisors" weight = 25 +++ Chef Habitat can be run on bare metal servers, as well as virtual machines. Currently, Chef Habitat can run on Linux and Windows platforms, and in all cases, running a Supervisor boils down to running `hab sup run`. How that happens depends on which platform you choose to use. First, you must itself on the machine. Second, many packages default to running as the `hab` user, so you should ensure that both a `hab` user and group exist: ```bash sudo groupadd hab sudo useradd -g hab hab ``` Finally, you will need to wire Chef Habitat up to your systems init system. This may be SysVinit, systemd, runit, etc. The details will be different for each system, but in the end, you must call `hab sup run`. A basic systemd unit file for Chef Habitat might look like this. This assumes that you have already created the `hab` user and group, as instructed above, and that your `hab` binary is linked to `/bin/hab`. ```toml [Unit] Description=The Chef Habitat Supervisor [Service] ExecStart=/bin/hab sup run [Install] WantedBy=default.target ``` Depending on your needs and deployment, you will want to modify the options passed to `hab sup run`. In particular, if you wish to participate in larger Supervisor networks, you will need to pass at least one `--peer` option. As with Linux, you must first on the machine. Unlike Linux, however, the Windows Supervisor has no requirements for any `hab` user. On Windows, you can run the Supervisor as a Windows Service. You can use the `windows-service` Chef Habitat package to host the Supervisor inside the Windows Service Control Manager: ```powershell hab pkg install core/windows-service ```
Project: SPIRE (Provisioning / Key Management)
File: plugin_server_nodeattestor_x509pop.md

Must be used in conjunction with the agent-side x509pop plugin The `x509pop` plugin attests nodes that have been provisioned with an x509 identity through an out-of-band mechanism. It verifies that the certificate is rooted to a trusted set of CAs and issues a signature based proof-of-possession challenge to the agent plugin to verify that the node is in possession of the private key. The SPIFFE ID produced by the plugin is based on the certificate fingerprint, where the fingerprint is defined as the SHA1 hash of the ASN.1 DER encoding of the identity certificate. The SPIFFE ID has the form: ```xml spiffe://<trust_domain>/spire/agent/x509pop/<fingerprint> ``` | Configuration | Description | Default | |--||--| | `cabundlepath` | The path to the trusted CA bundle on disk. The file must contain one or more PEM blocks forming the set of trusted root CA's for chain-of-trust verification. If the CA certificates are in more than one file, use `cabundlepaths` instead. | | | `cabundlepaths` | A list of paths to trusted CA bundles on disk. The files must contain one or more PEM blocks forming the set of trusted root CA's for chain-of-trust verification. | | | `agentpathtemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `"{{ .PluginName}}/{{ .Fingerprint }}"` | A sample configuration: ```hcl NodeAttestor "x509pop" { plugin_data { cabundlepath = "/opt/spire/conf/server/agent-cacert.pem" } } ``` | Selector | Example | Description | ||-|| | Common Name | `x509pop:subject:cn:example.org` | The Subject's Common Name (see X.500 Distinguished Names) | | SHA1 Fingerprint | `x509pop:ca:fingerprint:0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33` | The SHA1 fingerprint as a hex string for each cert in the PoP chain, excluding the leaf. | | SerialNumber | `x509pop:serialnumber:0a1b2c3d4e5f` | The leaf certificate serial number as a lowercase hexadecimal string | The agent path template is a way of customizing the format of generated SPIFFE IDs for agents. The template formatter is using Golang text/template conventions, it can reference values provided by the plugin or in a Some useful values are: | Value | Description | |--|-| | .PluginName | The name of the plugin | | .Fingerprint | The SHA1 fingerprint of the agent's x509 certificate | | .TrustDomain | The configured trust domain | | .Subject.CommonName | The common name field of the agent's x509 certificate | | .SerialNumberHex | The serial number field of the agent's x509 certificate represented as lowercase hexadecimal |
Project: YugabyteDB (App Definition and Development / Database)
File: hincrby.md

title: HINCRBY linkTitle: HINCRBY description: HINCRBY menu: preview: parent: api-yedis weight: 2135 aliases: /preview/api/redis/hincrby /preview/api/yedis/hincrby type: docs `HINCRBY key field delta` This command adds `delta` to the number that is associated with the given field `field` for the hash `key`. The numeric value must a 64-bit signed integer. If the `key` does not exist, a new hash container is created. If the field `field` does not exist in the hash container, the associated string is set to "0". If the given `key` is not associated with a hash type, or if the string associated with `field` cannot be converted to an integer, an error is raised. Returns the value after addition. ```sh $ HSET yugahash f1 5 ``` ``` 1 ``` ```sh $ HINCRBY yugahash f1 3 ``` ``` 8 ``` ```sh $ HINCRBY yugahash non-existent-f2 4 ``` ``` 4 ``` ```sh $ HINCRBY non-existent-yugahash f1 3 ``` ``` 3 ``` , , , , , , , , , ,
Project: SchemaHero (App Definition and Development / Database)
File: OWNERS.md

See for general contribution guidelines. Marc Campbell (@marccampbell, Replicated) Dmitriy Ivolgin (@divolgin, Replicated) Ethan Mosbaugh (@emosbaugh, Replicated) Andrew Lavery (@laverya, Replicated) Salah Aldeen Al Saleh (@sgalsaleh, Replicated) Chris Gianelloni (@wolf31o2, Applause) Ales Verbic (@verbotenj, Applause)
Project: RabbitMQ (App Definition and Development / Streaming & Messaging)
File: 3.10.9.md

RabbitMQ `3.10.9` is a maintenance release in the `3.10.x` . Please refer to the upgrade section from if upgrading from a version prior to 3.10.0. This release requires Erlang 24.2 and supports Erlang 25. has more details on Erlang version requirements for RabbitMQ. Erlang 23 support has reached its . This release of RabbitMQ requires Erlang 24.2 or later versions. Nodes will fail to start on older Erlang releases. Erlang 25 is recommended: it offers much improved performance on ARM64 architectures, across all architectures, and the most recent TLS 1.3 implementation. Release notes can be found on GitHub at . A rolling upgrade on Kubernetes could hang. GitHub issue: In mixed 3.11/3.10 clusters, channels that performed operations on classic queues could run into an exception. GitHub issue: A quorum queue consumer was cancelled and immediately re-registered while some deliveries were in flight could result in a channel exception. GitHub issue: More strings from external sources are converted to Unicode-aware representation internally, in log messages, CLI tools output and UI, and so on. GitHub issues: During plugin activation on a running node, plugins with dependencies were added to runtime code path in an order that could break if a plugin had hard transitive dependencies (that must be loaded first). Contributed by @gomoripeti. GitHub issue: Support for paths with non-ASCII (Unicode) characters in paths. `rabbitmq-diagnostics observer` now includes a new tab that provides access to internal classic queue metrics. GitHub issue: More free disk space monitor resilience improvements. GitHub issue: `rabbitmqctl listamqp10connections` were not listing connections correctly. GitHub issue: Shovel management HTTP API endpoint could run into an exception. Contributed by @gomoripeti. GitHub issue: `cuttlefish` upgraded to To obtain source code of the entire distribution, please download the archive named `rabbitmq-server-3.10.9.tar.xz` instead of the source tarball produced by GitHub.
Project: ClickHouse (App Definition and Development / Database)
File: v23.5.5.92-stable.md

sidebar_position: 1 sidebar_label: 2023 Backported in : Fix incorrect projection analysis which invalidates primary keys. This issue only exists when `queryplanoptimizeprimarykey = 1, queryplanoptimize_projection = 1` . This fixes . This fixes . (). Backported in : Update cargo dependencies. (). Backported in : Add `clickhouse-keeper-client` symlink to the clickhouse-server package. (). Backported in : Packing inline cache into docker images sometimes causes strange special effects. Since we don't use it at all, it's good to go. (). Backported in : The compiler's profile data (`-ftime-trace`) is uploaded to ClickHouse Cloud., the second attempt after . (). Backported in : Preserve environment parameters in `clickhouse start` command. Fixes . (). Fix backward compatibility for IP types hashing in aggregate functions (). Fix segfault in MathUnary (). Fix for moving 'IN' conditions to PREWHERE (). Fix binary arithmetic for Nullable(IPv4) (). Support IPv4 and IPv6 as dictionary attributes (). Fix reading from empty column in `parseSipHashKey` (). Fix async connect to hosts with multiple ips (). Allow parametric UDFs (). Fix ORDER BY tuple of WINDOW functions (). Fix error in `groupArrayMoving` functions (). Disable expression templates for time intervals (). Fix `countSubstrings()` hang with empty needle and a column haystack (). Fixed inserting into Buffer engine (). The implementation of AnyHash was non-conformant. (). Fix possible error "Cannot drain connections: cancel first" (). init and destroy ares channel on demand.. (). Fix crash in function `tuple` with one sparse column argument (). clickhouse-keeper: fix implementation of server with poll() (). Fix password leak in show create mysql table (). Not-ready Set (). Fix incorrect normal projection AST format (). Fix loading lazy database during system.table select query (). Fix: interpolate expression takes source column instead of same name aliased from select expression. (). Correctly handle totals and extremes with `DelayedSource` (). Fix: sorted distinct with sparse columns (). Fix fuzzer crash in parseDateTime() (). Decoupled commits from for backports (). Fix MergeTreeMarksLoader segfaulting if marks file is longer than expected (). Fix source image for sqllogic (). Pin rust nightly (to make it stable) (). Fix crash in comparison functions due to incorrect query analysis (). Less replication errors (). Improve logging macros (). Fix deadlocks in StorageTableFunctionProxy (). Disable testreversedns_query/test.py (). Disable testhostregexpmultipleptr_records/test.py (). Get rid of describe_parameters for the best robot token ().
Project: YDB (App Definition and Development / Database)
File: regions.md

An availability zone is a data processing center or an isolated segment thereof with minimal physical distance between nodes and minimal risk of failure at the same time as other availability zones. A large geographic region is an area within which the distance between availability zones is 500 km or smaller. A geo-distributed {{ ydb-short-name }} cluster contains nodes located in different availability zones within a wide geographic region. {{ ydb-short-name }} performs synchronous data writes to each of the availability zones, ensuring uninterrupted performance if an availability zone fails. In geographically distributed clusters, you can choose a policy for distributing computing resources across data centers. This lets you find the right balance between minimum execution time and minimum downtime if a data center goes offline.