テーマ： configuration
-
Writing idempotent admin scripts: check-then-change, drop-in files and marker comments
An admin script an agent might re-run after a partial failure or a repeated schedule should leave the system in the same state whether it runs once or five times. Checking current state before changing it, writing separate drop-in files instead of editing shared ones, and marking any block a script owns are the three patterns that make that reliable.
-
Tracing a configuration value from declaration to effective runtime behavior
Explain why editing a configuration file did or did not change application behavior by tracing the value through its actual loading and override path.
-
ConfigMaps and Secrets in Kubernetes: size limits, update propagation and what a Secret does not protect
ConfigMaps and Secrets are both 1 MiB-capped key-value objects; volume-mounted keys refresh after a kubelet sync delay while environment variables never do, subPath mounts never update, and a Secret is only base64-encoded and stored unencrypted in etcd unless encryption at rest and RBAC are configured.
-
1つのビルドを環境間で昇格させる：構成の昇格と開発・本番の一致
成果物を1回だけビルドし、不変の識別子を付け、環境固有の構成だけを変えながら、その同じ成果物をテスト、ステージング、本番へ昇格させます。バックエンドサービスと接続構成を環境間で似せ、ある段階の成功が次を予測できるようにします。
-
Testing configuration changes that alter another user’s authority
Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.
-
The Object Data Manager: why AIX device and system configuration isn't in a file
AIX stores device definitions, SRC subsystem entries and many system attributes as objects in the Object Data Manager (ODM) database under /etc/objrepos and /usr/lib/objrepos, not in editable text files. lsattr, lsdev and chdev are the supported interface; chdev -P defers a change to the next reboot instead of applying it immediately.
-
Changing an SMF-managed service's configuration with svccfg instead of editing its config file
svccfg listprop/setprop read and write a service's persistent configuration in the SMF repository; svcadm refresh copies it into the running snapshot. Where SMF generates a service's config file (for example /etc/resolv.conf from network/dns/client), hand-editing that file is overwritten.
-
Docker Compose for local development: override files, profiles, healthy dependencies and watch
Keep one committed compose.yaml that mirrors production shape, add a compose.override.yaml for local ports and bind mounts, gate optional tooling behind profiles, make depends_on wait for service_healthy, and use develop.watch to sync or rebuild on file changes.
-
Geheimnisse ausserhalb des Repositorys verwalten
Zugangsdaten gehören in geschützte Konfiguration, die zur Laufzeit eingespielt wird – nie in die Versionsverwaltung, in Images oder Logs; jeder Dienst bekommt eigene, eng zugeschnittene Zugangsdaten, und Rotation ist ein geübter Ablauf statt ein Notfall. Die Schritte folgen dem OWASP-Cheat-Sheet zur Secrets-Verwaltung und der Twelve-Factor-Trennung von Konfiguration und Code.
-
安全なデフォルトとフェイルクローズ設計
Saltzer と Schroeder のフェイルセーフなデフォルト原則では、アクセスを明示的な許可に基づかせ、誤りが許可ではなく拒否につながるようにする。現代の実装では、既定で拒否する認可、安全設定がなければ起動しない構成、エラー時にアクセスを開かず閉じる経路を意味する。
-
YAML 1.1 vs 1.2 implicit typing: the Norway problem, octal numbers and which parsers use which
YAML 1.1's boolean type treats yes, no, on and off as booleans and a leading zero as octal; YAML 1.2's Core Schema narrows booleans to true/false and requires an explicit 0o prefix for octal — and PyYAML, js-yaml and gopkg.in/yaml.v3 each land in a different place between the two.
-
sysctlによるLinuxカーネルパラメーターの設定：実行時の変更と/etc/sysctl.d
sysctl -wは次回の再起動までカーネルパラメーターを変更する。永続化するには/etc/sysctl.d/にファイルを配置し、/usr/lib、/etc、/run間の読み込み順を理解する必要がある。sysctl --systemは設定済みの全ファイルを適用し、競合時にどのファイルが優先されるかを示す。
機械可読： JSON