Saturday, September 23, 2017

Installing Docker on CentOS 7

from the excellent guide

sudo yum remove docker docker-common docker-selinux docker-engine
sudo yum install -y yum-utils   device-mapper-persistent-data   lvm2
sudo yum-config-manager --add-repo
sudo yum-config-manager --enable docker-ce-edge
sudo yum-config-manager --enable docker-ce-test
sudo yum install docker-ce
yum list docker-ce.x86_64  --showduplicates | sort -r
sudo systemctl start docker
sudo docker run hello-world
sudo docker run -it ubuntu bash
sudo yum makecache fast
sudo groupadd docker
echo $USER
sudo usermod -aG docker $USER
#(perform logout/login here)
#"centos docker"
sudo systemctl enable docker
#"Created symlink from /etc/systemd/system/ to /usr/lib/systemd/system/docker.service."
sudo chkconfig docker on
env | grep DOCKER_HOST
#DOCKER_HOST should not be defined if you want to connect to local daemon
#to restart daemon:
sudo service docker restart

useful commands (from the presentation below):
docker ps -a
docker version
docker info
docker images

docker run ubuntu echo "hello world"

docker run -i -t ubuntu

docker diff 82af4da88bd7
docker rm 042cbb043587

docker run -d ubuntu /bin/sh -c "while true; do echo hello world; date; sleep 2; done"
docker logs 7939ad46d57c
docker attach 7939ad46d57c
docker stop 7939ad46d57c

docker inspect 7939ad46d57c

docker commit -m "installed apache" 7939ad46d57c mynamespace/myimage
docker images

#login into
docker login
docker push mynamespace/myimage

docker rmi 77bde6a39eda

#execute the Dockerfile in myfolder and build a new image
docker build -t mynamespace/myimage

#run assigning a non default port
docker run -d -p :8000 mynamespace/myimage

here the link to shipyard

Cool Tools (from JBoss Hacks)

be aware that the Kindle edition is royally up, missing ALL the sample script in the text... what a pity... maybe the PDF version available here is better, no idea. to analyze gc logs thread dump analysis jboss/wildfly bash completion web console rich of managing plugins byteman , bytecode manipulation tool dockerhub wildfly image docker jboss images wildfly maven plugin

Jboss Forge
examples available here

Wildfly Swarm Project Generator windup / migration tool to migrate from other AS to JBoss

Friday, September 22, 2017

JBoss CLI sucks

Frankly the CLI hurts the eyes... someone should make it a bit more groovish... oh in fact here there is a guide how to do it but it's a bit raw...

some recipes here:

at the end of the book "WildFly Configuration, Deployment, and Administration - Second Edition" there is also a useful CLI cheat sheet.

All Day DevOps on October 24, 2017 starting at 8:00am GMT

register here

you can even watch the recorded session later (2016 recordings are available on their side...)

Sunday, September 10, 2017

Nexus Repository Migration

MIGRATING FROM 2.12.1 TO 2.14.5

Migrating from Nexus Repository Manager OSS 2.12.1-01 to the latest 3.0 version:

beware: upgrade agent is part of 2.14 only! You should first upgrade to 2.14 then migrate to 3.0, as shown here

Very detailed instructions here

Download old releases here

I have installed Nexus 2.12 here: /home/centos/nexus2/nexus-2.12.0-01/bin

cd /home/centos/nexus2/nexus-2.12.0-01/bin
./nexus start

The URL is http://localhost:8081/nexus/ (in 3.X it's simply http://localhost:8081 )

In maven's settings.xml I had this
        <!--This sends everything else to /public -->

this was valid for 3.5, in 2.12 the URL should be changed to http://localhost:8081/nexus/content/repositories/central/

I run a sample "mvn package" from "" and I can observe that the repository "Maven Central" is filled with stuff: http://localhost:8081/nexus/service/local/feeds/recentlyCachedReleaseArtifacts, then I select the "Central" repo, "Browse Index" and I can see stuff in it (junit, hamcrest, codehaus...)

I want now to upgrade from 2.12.1 to 2.14.5, which is the supported version to late upgrade to 3.5

I extract the 2.14.5 zip file in a temporary location and I copy the nexus-2.14.5-02 folder (NOT the sonatype-work folder!!!) to /home/centos/nexus2, so that the nexus-2.12 and nexus-2.14 share the same sonatype-work folder.

[centos@localhost nexus2]$ pwd

[centos@localhost nexus2]$ ls -ltra
total 4
drwxr-xr-x.  8 centos centos  113 Dec 16  2015 nexus-2.12.0-01
drwxr-xr-x.  3 centos centos   37 Dec 16  2015 sonatype-work
drwxr-xr-x.  8 centos centos  113 Jul 25 12:39 nexus-2.14.5-02
drwx------. 33 centos centos 4096 Sep 10 19:28 ..
drwxrwxr-x.  5 centos centos   73 Sep 10 19:34 .

apparently the sonatype-work format is binary compatible among the 2.12 and 2.14.5 versions.

I stop nexus, make a backup copy of the conf folder:

cd /home/centos/nexus2
cp -R nexus-2.12.0-01/conf/ nexus-2.12.0-01/confBACKUP

apparently no further manual steps are required

and now I start the new version of Nexus

cd nexus-2.14.5-02/bin
./nexus start
At a quick look, the content of the repository and an extra user I had created are preserved in the migration...


Now I start nexus 3.5 side by side, on the same host, making sure I use a different number:

cd /home/centos/nexus3
grep -R 8081 *

and I change that port to 18081

cd /home/centos/nexus3/nexus-3.5.1-02/bin
./nexus start


things are working. I delete all pre-existing repositories

I follow all the steps as in and things work perfectly - using the "download" method (slowest)

I have tested the 3 methods and they all work, of course the file copy (hard link or not) is much faster than HTTP. If you wonder what a hard link is, read here

Saturday, September 9, 2017

Nexus and Maven (ST): setup

I have installed Maven (ST) in /home/centos/apache-maven-3.5.0/.

My m2 repo is in /home/centos/.m2/repository

To test the m2 repo, I "git clone", then "mvn package"

"ls /home/centos/.m2/repository" shows that stuff is actually pulled from the maven central repo , you should see plenty of this in the logs :


I edit the settings in /home/centos/apache-maven-3.5.0/conf/settings.xml to incorporate this setup

I have installed Nexus in /home/centos/nexus30/. Make sure you increase the file descriptors before you start.

"cd /home/centos/nexus30/nexus-3.5.1-02/bin/" and "./nexus start".

Login at http://localhost:8081 using admin/admin123 , go to http://localhost:8081/#admin/repository/repositories and check that "maven central" is already preconfigured with http://localhost:8081/repository/maven-central/ URL. You can browse the Nexus content at http://localhost:8081/#browse/browse/components:maven-central (it should be empty at this stage)

Clear the local Maven (ST) repo "rm -rf /home/centos/.m2/repository/*" and run again "mvn package". This time Maven should retrieve the artifacts from Nexus:

Downloaded: http://localhost:8081/repository/maven-public/org/apache/maven/plugins/maven-resources-plugin/2.5/maven-resources-plugin-2.5.pom

Browsing again http://localhost:8081/#browse/browse/components:maven-central should show that all artifacts are cached in Nexus.

In case of issues, check the logs /home/centos/nexus30/sonatype-work/nexus3/log (nexus.log, request.log, jvm.log) for details.

PS: (ST) stands for STINKS . Maven STINKS like a wet rotten dirty skunk. Use Gradle instead.

Friday, September 8, 2017

Software Vulnerability Control with Sonatype products

Interesting introductory vide on the topic of Security in Software Supply Chain

Software Factory | Sonatype from Sonatype Nexus on Vimeo.

A really detailed presentation of the "Nexus Lifecycle" and "Nexus IQ server"

Software Supply Chain
Continuous Integration
Continuous Delivery
Release Automation Tool
DevOps Native Software Development
Nexus Firewall
Public repositories: Maven Central,

Sonar Security Rules:

Software Weakness

Software Vulnerability Common Weakness Enumeration (common software security weaknesses) - very educational FAQ on Software Weakness here CVSS Common Vulnerability Scoring System, scores explained: Nexus lifecycle NVD is National Vulnerability Database - try searching for Bouncy Castle

Using "Application Health Check" to scan vulnerabilities:

I have read the devsecops Gartner report also available here

Very interesting also the 2017 State of the Open Software

See also the famous OWASP top 10 web application security risks. Number A9 says: "Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts."

Repository Health Check RHC demo video here

Result of a WebGoat Health Check

Comparison of Free and Opensource Software Licenses

more videos on:

Brian Fox, Integration of Nexus Health Check with Eclipse

Brian Fox, Nexus IQ Server email alerts on Weak Security

Brian Fox, Nexus IQ Server, Define security policies

Wednesday, September 6, 2017

Dependency trees in Nexus and Maven: who uses what ?

Nexus plugin to display who uses a given artifact (apparently the same info is built-in in Apache Archiva ). As suggested in SO, you should build a ├╝ber-POM containing all your projects, then generate the dependency tree.

Useful commands:

mvn dependency:tree -DoutputType=graphml -DoutputFile=dependency.graphml

(use also --debug in case of errors)

Here the documentation on Dependency Management in Maven

Transitive Dependencies

Friday, September 1, 2017

Spring Framework Essentials course by Ken Kousen in Safari Books Online

Here is the code

Ken is a very talented teacher, who focuses on concepts rather than sheer data. Highly recommended.

The course is available only if you register in Safari Books Online, but there is a short term FREE evaluation account (no credit car required).