cwielenb/CNCF-Dataset huggingface dataset:
Project: LinuxKit (Provisioning / Automation & Configuration)
File: kernel-bcc.md

The `bcc` utility is a standard Linux tool to access performance counters, trace events and access various other kernel internals for performance analysis. The `bcc` utility needs to matched be with the kernel. For recent kernel build, LinuxKit provides a `linuxkit/kernel-bcc` package with a matching tag for each kernel under `linuxkit/kernel`. The preferred way of using the `linuxkit/kernel-bcc` package is to add it to the `init` section. This adds `/usr/share/bcc` to the systems' root filesystem. From there it can be bind mounted into your container accessed via `/proc/1/root/usr/share/bcc/tools` from with in the `getty` or `ssh` container. accessed via a nsenter of `/bin/ash` of proc 1. If you want to use `bcc` you may also want to remove the `sysctl` container, or alternatively, disable the kernel pointer restriction it enables by default: ``` echo 0 > /proc/sys/kernel/kptr_restrict ``` Now, `bcc` is ready to use. The LinuxKit `bcc` package contains the `bcc` binary, example and tool scripts, and kernel headers for the associated kernel build.
Project: YugabyteDB (App Definition and Development / Database)
File: yba_completion_fish.md

Generate the autocompletion script for fish Generate the autocompletion script for the fish shell. To load completions in your current shell session: yba completion fish | source To load completions for every new session, execute once: yba completion fish > ~/.config/fish/completions/yba.fish You will need to start a new shell for this setup to take effect. ``` yba completion fish [flags] ``` ``` -h, --help help for fish --no-descriptions disable completion descriptions ``` ``` -a, --apiToken string YugabyteDB Anywhere api token. --config string Config file, defaults to $HOME/.yba-cli.yaml --debug Use debug mode, same as --logLevel debug. --disable-color Disable colors in output. (default false) -H, --host string YugabyteDB Anywhere Host (default "http://localhost:9000") -l, --logLevel string Select the desired log level format. Allowed values: debug, info, warn, error, fatal. (default "info") -o, --output string Select the desired output format. Allowed values: table, json, pretty. (default "table") --timeout duration Wait command timeout, example: 5m, 1h. (default 168h0m0s) --wait Wait until the task is completed, otherwise it will exit immediately. (default true) ``` - Generate the autocompletion script for the specified shell
Project: KubeDB by AppsCode (App Definition and Development / Database)
File: kubectl-dba_exec_mariadb.md

title: Kubectl-Dba Exec Mariadb menu: docs_{{ .version }}: identifier: kubectl-dba-exec-mariadb name: Kubectl-Dba Exec Mariadb parent: reference-cli menuname: docs{{ .version }} sectionmenuid: reference Execute SQL commands to a mariadb resource Use this cmd to execute sql commands to a mariadb object's primary pod. Examples: kubectl dba exec md md-demo -n demo -f demo.sql kubectl dba exec md md-demo -c 'describe pet' -d kubedb" ``` kubectl-dba exec mariadb [flags] ``` ``` -c, --command string command to execute -d, --dbName string name of the database inside mariadb to execute command (default "mysql") -f, --file string path to command file -h, --help help for mariadb ``` ``` --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace. --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation. --cache-dir string Default cache directory (default "/home/runner/.kube/cache") --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --default-seccomp-profile-type string Default seccomp profile --disable-compression If true, opt-out of response compression for all requests to the server --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to the kubeconfig file to use for CLI requests. --match-server-version Require server version to match client version -n, --namespace string If present, the namespace scope for this CLI request --password string Password for basic authentication to the API server --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0") -s, --server string The address and port of the Kubernetes API server --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server ``` - Execute script or command to a database.
Project: ClickHouse (App Definition and Development / Database)
File: multi-region-replication.md

slug: /ru/faq/operations/multi-region-replication title: Does ClickHouse support multi-region replication? sidebar_position: 30 The short answer is "yes". However, we recommend keeping latency between all regions/datacenters in two-digit range, otherwise write performance will suffer as it goes through distributed consensus protocol. For example, replication between US coasts will likely work fine, but between the US and Europe won't. Configuration-wise there's no difference compared to single-region replication, simply use hosts that are located in different locations for replicas. For more information, see .
Project: LinuxKit (Provisioning / Automation & Configuration)
File: testing.md

LinuxKit Testing and CI ======================= The test suite uses To install this you should use `make bin/rtf && make install`. To run the test suite: ``` cd test rtf -v run -x ``` This will run the tests and put the results in a the `_results` directory! Run control is handled using labels and with pattern matching. To run add a label you may use: ``` rtf -v -l slow run -x ``` You can list the tests which will be run using: ``` rtf list ``` Some tests may be marked as `SKIP` and `LABELS` column will typically provide and indication as to why a test may be skipped. To run tests that match the pattern `linuxkit.build` you would use the following command: ``` rtf -v run -x linuxkit.build ``` To add a new test, you should first decide which group it should be added to. Check the `test/cases` folder for a list of existing groups. Groups can be nested and there examples of this in the existing set of test cases. If you feel that a new group is warranted you can create one by `mkdir 000_name` where `000` is the desired order and `name` is the name you would like to use You must copy an existing `group.sh` in to this folder and adjust as required or you may use the To write your test, create a folder within the group using the `000_name` format as described above. You should then copy an existing `test.sh` in to this directory and amend it, or start from an If your test can only be run when certain conditions are met, you should consider adding a label to avoid it being run by default and document the use of the label in `tests/README.md` Note: This will hopefully change significantly soon The LinuxKit CI system uses The configuration can be found The test logs are available via the `Details` link but also via this . The raw test logs are also stored on where each branch contains the results for a particular run. Each PR is tested on disposable VM's spawned in Google Cloud Platform This machine has no privileges or credentials to talk to GCP or other cloud platforms. TODO: Add instructions on how to build a base image for LinuxKit CI in GCP. LinuxKit CI runs `make ci-pr` in the VM. This target runs the tests using `rtf` and the results directory is `scp`'ed back to the controller. The test results will be stored in DataKit for additional access Additionally, the `./artifacts` folder is `scp`'ed back to the controller. If the tests passed the next step is to check if the kernel config test image runs on GCP. The `./artifacts/test.img.tar.gz` file is used to create a GCP image by the Python scripts that are part of LiunxKit CI. It runs this image and greps for the success message in the logs. Branches and Tags are tested on a dedicated machine that runs in GCP. LinuxKit CI runs `make ci` or `make ci-tag` in the VM This target runs the tests using `rtf` and the results directory is SCP'd back to the controller. The test results will be stored in DataKit. If the tests pass, the GCP test is run in the same manner as described for PR tests. Finally, CI will run `make test-ltp` which will run the Linux Testing Project tests.
Project: Podman (App Definition and Development / Application Definition & Image Build)
File: security-opt.md

Security Options apparmor=unconfined : Turn off apparmor confinement for the <<container|pod>> apparmor=alternate-profile : Set the apparmor confinement profile for the <<container|pod>> label=user:USER: Set the label user for the <<container|pod>> processes label=role:ROLE: Set the label role for the <<container|pod>> processes label=type:TYPE: Set the label process type for the <<container|pod>> processes label=level:LEVEL: Set the label level for the <<container|pod>> processes label=filetype:TYPE: Set the label file type for the <<container|pod>> files label=disable: Turn off label separation for the <<container|pod>> Note: Labeling can be disabled for all <<|pods/>>containers by setting label=false in the containers.conf (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. label=nested: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without nested, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels. mask=/path/1:/path/2: The paths to mask separated by a colon. A masked path cannot be accessed inside the container<<s within the pod|>>. no-new-privileges: Disable container processes from gaining additional privileges. seccomp=unconfined: Turn off seccomp confinement for the <<container|pod>>. seccomp=profile.json: JSON file to be used as a seccomp filter. Note that the `io.podman.annotations.seccomp` annotation is set with the specified value as shown in `podman inspect`. proc-opts=OPTIONS : Comma-separated list of options to use for the /proc mount. More details for the possible mount options are specified in the proc(5) man page. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/): Paths to unmask separated by a colon. If set to ALL*, it unmasks all the paths that are masked or made read-only by default. The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux, /sys/devices/virtual/powercap. The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. Note: Labeling can be disabled for all containers by setting label=false in the containers.conf(5) file.
Project: Lagoon (App Definition and Development / Application Definition & Image Build)
File: ruby.md

The . Based on . 3.0 (Security Support until March 2024) - `uselagoon/ruby-3.0` 3.1 (Security Support until March 2025) - `uselagoon/ruby-3.1` 3.2 (Security Support until March 2026) - `uselagoon/ruby-3.2` !!! Tip We stop updating and publishing EOL Ruby images usually with the Lagoon release that comes after the officially communicated EOL date: . Previous versions will remain available. The default exposed port of ruby containers is port `3000`. Lagoon has no "pre-defined" type for Ruby services, they should be configured with the `lagoon.type: generic` and a port set with `lagoon.port: 3000` ```yaml title="docker-compose.yml" ruby: build: context: . dockerfile: Dockerfile labels: lagoon.type: generic lagoon.port: 3000 ports: "3000" ```
Project: KICS (Provisioning / Security & Compliance)
File: f34c0c25-47b4-41eb-9c79-249b4dd47b89.md

title: IP Forwarding Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f34c0c25-47b4-41eb-9c79-249b4dd47b89 Query name: IP Forwarding Enabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Instances must not have IP forwarding enabled, which means the attribute 'canipforward' must not be true<br> ```tf title="Positive test num. 1 - tf file" hl_lines="4" resource "googlecomputeinstance" "appserver" { name = "primary-application-server" machine_type = "e2-medium" canipforward = true boot_disk { initialize_params { image = "debian-cloud/debian-11" } } network_interface { network = "default" } } ``` ```tf title="Negative test num. 1 - tf file" resource "googlecomputeinstance" "appserver" { name = "primary-application-server" machine_type = "e2-medium" canipforward = false boot_disk { initialize_params { image = "debian-cloud/debian-11" } } network_interface { network = "default" } } ```
Project: KICS (Provisioning / Security & Compliance)
File: e66e1b71-c810-4b4e-a737-0ab59e7f5e41.md

title: OSLogin Is Disabled In VM Instance hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e66e1b71-c810-4b4e-a737-0ab59e7f5e41 Query name: OSLogin Is Disabled In VM Instance Platform: GoogleDeploymentManager Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: VM instance should have OSLogin enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="10" resources: name: vm type: compute.v1.instance properties: description: my-vm metadata: fingerprint: fingerprint items: key: enable-oslogin value: false key: my-key-2 value: false ``` ```yaml title="Negative test num. 1 - yaml file" resources: name: vm type: compute.v1.instance properties: description: my-vm metadata: fingerprint: fingerprint items: key: my-key-2 value: false ``` ```yaml title="Negative test num. 2 - yaml file" resources: name: vm type: compute.v1.instance properties: description: my-vm metadata: fingerprint: fingerprint items: key: enable-oslogin value: true key: my-key-2 value: false ```
Project: OpenTofu (Provisioning / Automation & Configuration)
File: CODE_OF_CONDUCT.md

We follow the . <!-- TODO: Decide who will handle Code of Conduct reports and replace [INSERT EMAIL ADDRESS] with an email address in the paragraph below. We recommend using a mailing list to handle reports. If your project isn't prepared to handle reports, remove the project email address and just have reporters send to conduct@cncf.io. --> Please contact core@opentofu.org in order to report violations of the Code of Conduct.
Project: KubeArmor (Provisioning / Security & Compliance)
File: trusted-cert-bundle.md

```sh kubectl exec -it mysql-74775b4bf4-65nqf -n wordpress-mysql -- bash root@mysql-74775b4bf4-65nqf:/# cd /etc/ssl/ root@mysql-74775b4bf4-65nqf:/etc/ssl# ls certs root@mysql-74775b4bf4-65nqf:/etc/ssl# rmdir certs rmdir: failed to remove 'certs': Permission denied root@mysql-74775b4bf4-65nqf:/etc/ssl# cd certs/ root@mysql-74775b4bf4-65nqf:/etc/ssl/certs# touch new touch: cannot touch 'new': Permission denied root@mysql-74775b4bf4-65nqf:/etc/ssl/certs# ``` ``` { "Action": "Block", "ClusterName": "aditya", "ContainerID": "b75628d4225b8071d5795da342cf2a5c03b1d67b22b40016697fcd17a0db20e4", "ContainerImage": "docker.io/library/mysql:5.6@sha256:20575ecebe6216036d25dab5903808211f1e9ba63dc7825ac20cb975e34cfcae", "ContainerName": "mysql", "Data": "syscall=SYS_RMDIR", "Enforcer": "AppArmor", "HostName": "aditya", "HostPID": 24462, "HostPPID": 24411, "Labels": "app=mysql", "Message": "Credentials modification denied", "NamespaceName": "wordpress-mysql", "Operation": "File", "Owner": { "Name": "mysql", "Namespace": "wordpress-mysql", "Ref": "Deployment" }, "PID": 185, "PPID": 179, "ParentProcessName": "/bin/bash", "PodName": "mysql-74775b4bf4-65nqf", "PolicyName": "harden-mysql-trusted-cert-mod", "ProcessName": "/bin/rmdir", "Resource": "/etc/ssl/certs", "Result": "Permission denied", "Severity": "1", "Source": "/bin/rmdir certs", "Tags": "MITRE,MITRET1552unsecured_credentials,FGT1555,FIGHT", "Timestamp": 1696320102, "Type": "MatchedPolicy", "UpdatedTime": "2023-10-03T08:01:42.373810Z", "cluster_id": "3896", "component_name": "kubearmor", "instanceGroup": "0", "instanceID": "0", "tenant_id": "167", "workload": "1" } ```
Project: KICS (Provisioning / Security & Compliance)
File: a46928f1-43d7-4671-94e0-2dd99746f389.md

title: Schemes Uses HTTP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a46928f1-43d7-4671-94e0-2dd99746f389 Query name: Schemes Uses HTTP Platform: OpenAPI Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Schemes should use 'https' protocol instead of 'http'. Scheme using 'http' allows for clear text credentials<br> ```json title="Positive test num. 1 - json file" hl_lines="13" { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "schemes": [ "http" ], "responses": { "200": { "description": "200 response" } } } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" swagger: "2.0" info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions schemes: http responses: "200": description: 200 response ``` ```json title="Negative test num. 1 - json file" { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "schemes": [ "https" ], "responses": { "200": { "description": "200 response" } } } } } } ``` ```yaml title="Negative test num. 2 - yaml file" swagger: "2.0" info: title: Simple API overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions schemes: https responses: "200": description: 200 response ```
Project: KICS (Provisioning / Security & Compliance)
File: cdddb86f-95f6-4fc4-b5a1-483d9afceb2b.md

title: COPY '--from' References Current FROM Alias hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: cdddb86f-95f6-4fc4-b5a1-483d9afceb2b Query name: COPY '--from' References Current FROM Alias Platform: Dockerfile Severity: <span style="color:#edd57e">Low</span> Category: Build Process URL: COPY '--from' should not mention the current FROM alias, since it is impossible to copy from itself<br> ```dockerfile title="Positive test num. 1 - dockerfile file" hl_lines="2" FROM myimage:tag as dep COPY --from=dep /binary / RUN dir c:\ ``` ```dockerfile title="Negative test num. 1 - dockerfile file" FROM golang:1.7.3 AS builder WORKDIR /go/src/github.com/foo/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go . RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=builder /go/src/github.com/foo/href-counter/app . CMD ["./app"] ```
Project: ClickHouse (App Definition and Development / Database)
File: merge.md

slug: /en/sql-reference/table-functions/merge sidebar_position: 130 sidebar_label: merge Creates a temporary table. The table structure is taken from the first table encountered that matches the regular expression. Syntax ```sql merge(['dbname',] 'tablesregexp') ``` Arguments `db_name` Possible values (optional, default is `currentDatabase()`): database name, constant expression that returns a string with a database name, for example, `currentDatabase()`, `REGEXP(expression)`, where `expression` is a regular expression to match the DB names. `tables_regexp` A regular expression to match the table names in the specified DB or DBs. See Also table engine
Project: KusionStack (Provisioning / Automation & Configuration)
File: PULL_REQUEST_TEMPLATE.md

<!-- Thank you for contributing to KusionStack! Note: With pull requests: Open your pull request against "main" Your pull request should have no more than three commits, if not you should squash them. It should pass all tests in the available continuous integration systems such as GitHub Actions. You should add/modify tests to cover your proposed code changes. If your pull request contains a new feature, please document it on the README. Please create an issue first to describe the problem. We recommend that link the issue with the PR in the following question. For more info, check https://kusionstack.io/docs/governance/contribute/ --> <!-- Add one of the following kinds: /kind bug /kind cleanup /kind documentation /kind feature --> <!-- *Automatically closes linked issue when PR is merged. Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`. If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`* --> Fixes # <!-- If no, just write "NONE" in the release-note block below. If yes, a release note is required: Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required". --> ```release-note ``` <!-- Please use the following format for linking documentation: [Design]: <link> [Usage]: <link> [Other doc]: <link> --> ```docs ```
Project: DevSpace (App Definition and Development / Application Definition & Image Build)
File: RELEASE.md

The `yaml` Project is released on an as-needed basis. The process is as follows: An issue is proposing a new release with a changelog since the last release All must LGTM this release An OWNER runs `git tag -s $VERSION` and inserts the changelog and pushes the tag with `git push $VERSION` The release issue is closed An announcement email is sent to `kubernetes-dev@googlegroups.com` with the subject `[ANNOUNCE] kubernetes-template-project $VERSION is released`
Project: ClickHouse (App Definition and Development / Database)
File: v21.6.4.26-stable.md

sidebar_position: 1 sidebar_label: 2022 Backported in : Allow NULL values in postgresql protocol. Closes . (). Backported in : Fixed bug with declaring S3 disk at root of bucket. Earlier, it reported an error: ``` (). Backported in : Fix limit/offset settings for distributed queries (ignore on the remote nodes). (). Backported in : Fix extremely rare error `Tagging already tagged part` in replication queue during concurrent `alter move/replace partition`. Possibly fixes . (). Backported in : Fix wrong result when using aggregate projection with not empty `GROUP BY` key to execute query with `GROUP BY` by empty* key. (). Backported in : Fix bug which allows creating tables with columns referencing themselves like `a UInt32 ALIAS a + 1` or `b UInt32 MATERIALIZED b`. Fixes , . (). Backported in : Fix bug with constant maps in mapContains that lead to error `empty column was returned by function mapContains`. Closes . (). Backported in : Fix crash in query with cross join and `joinedsubqueryrequires_alias = 0`. Fixes . (). Backported in : Fix possible parts loss after updating up to 21.5 in case table used `UUID` in partition key. (It is not recommended to use `UUID` in partition key). Fixes . (). Backported in : Do not use table's projection for `SELECT` with `FINAL`. It is not supported yet. (). Try fix `testconsistentpartsafterclone_replica` (). DictionaryLoader unnecessary dictionary configuration creation fix ().