CloudNativeFolks Community

Beyond Tokens: Why the Future of Software Security is Capability Computing

Sangam Biradar — Wed, 05 Aug 2026 21:44:43 GMT

Over the past few decades, we've fundamentally changed how software is built. We moved from assembly to high-level languages, from monolithic applications to containers, and now from human-written code to AI-generated software.

Yet one question remains surprisingly unanswered:

What is this software actually capable of doing?

Today's compilers optimize programs for speed, size, and correctness. Runtime security platforms monitor behavior after deployment. Policy engines decide who can access what. But there is no unified system that understands software capabilities as a first-class concept during compilation.

I believe the next evolution is Capability Computing.

Imagine a compiler that doesn't just understand instructions like load, store, or call, but instead reasons about higher-level capabilities:

Filesystem.Read
Network.Send
Process.Execute
Secret.Read
Cloud.Create
AI.Tool.Invoke

Instead of optimizing only machine code, the compiler builds a Capability Graph that represents what a program is permitted to do. Security policies can then be verified before deployment, producing deterministic decisions:

ALLOW
DENY
ESCALATE

The output is not only a binary, but also a signed capability manifest that any runtime—whether a microVM, WebAssembly runtime, or cloud platform—can enforce.

This shifts security from reactive monitoring to proactive verification.

More importantly, this approach is independent of how software is created. Whether code is written by a developer, generated by an AI model, or produced by another compiler, the verification process remains the same because it operates on capabilities, not tokens.

In this vision, LLVM, MLIR, WebAssembly, and future compiler infrastructures become frontends. Different sandbox technologies become runtimes. The stable abstraction in the middle is Capability IR.

Just as LLVM standardized compiler infrastructure and Kubernetes standardized application orchestration, I believe there is an opportunity to standardize Capability Verification.

The long-term goal isn't another security product.

It's a new layer of computing where every piece of software can answer a simple question before it ever runs:

"What am I capable of doing, and can I prove that I'm allowed to do it?"

AWS Lambda Deployment with Terraform (In-Depth Guide)

Sangam Biradar — Thu, 16 Jan 2025 17:57:51 GMT

Introduction

Deploying and managing AWS Lambda functions can get complicated, especially when you need to orchestrate several components like IAM roles, event triggers, monitoring, and deployment pipelines. That's where Terraform shines—it allows you to manage all of this through code, providing automation, consistency, and scalability.

In this detailed guide, we’ll explore how to create and manage AWS Lambda functions using Terraform. We’ll go beyond the basics and discuss advanced topics like packaging code, using remote state, integrating with services like API Gateway and S3, and best practices for building reusable Terraform modules.

Why Terraform for AWS Lambda?

AWS Lambda is a great service for running code without provisioning or managing servers, but managing multiple Lambda functions manually can become overwhelming. Terraform lets you:

Automate Deployments: Define infrastructure as code to automate deployments and updates.
Ensure Consistency: By codifying your Lambda configurations, you can be sure they’re consistent across environments (dev, staging, production).
Version Control Everything: With Terraform, you can put your infrastructure in version control, just like your codebase, making it easy to roll back or collaborate with teams.
Simplify Management: You can manage your entire AWS infrastructure, not just Lambda, through a single tool like Terraform.

Now, let's go deeper into how to build, deploy, and manage AWS Lambda functions using Terraform.

Lets create a blank appstack using stackgen we are going to generate terraform

click on New appStack

lets create appStack from scratch and play around aws lambda and terraform

Click on Proceed

StackGen by Default apply all best security policies by framework so generated if will be more secure

create appstacks

Setting Up AWS Lambda in Terraform

AWS Provider Configuration

Terraform requires an AWS provider block that specifies which AWS account and region you're deploying to.

provider "aws" {
  region = "us-west-2"  # Adjust region as needed
}

drag and drop and bring cloud services and give required field

To go a step further, you can configure credentials securely using the AWS CLI, or IAM roles attached to the instance you're running Terraform from (if using EC2 or other AWS services):

aws configure

This sets up the ~/.aws/credentials file with your access and secret keys.

If you're running Terraform from an EC2 instance, you can configure an instance role with proper permissions, so there’s no need to use static credentials.

Using Profiles

If you manage multiple AWS accounts or regions, you can configure the provider to use specific profiles:

provider "aws" {
  profile = "dev"  # This profile should match the one in your AWS credentials
  region  = "us-west-2"
}

Defining AWS Lambda Function in Terraform

The main resource for creating a Lambda function in Terraform is aws_lambda_function. At a minimum, you need to define the runtime, handler, role, and deployment package (either a local ZIP or an S3 object).

Lambda Function Definition

resource "aws_lambda_function" "my_lambda" {
  function_name = "my_lambda"
  runtime       = "python3.8"
  handler       = "lambda_function.lambda_handler"
  role          = aws_iam_role.lambda_role.arn
  filename      = "lambda_function.zip"
  memory_size   = 128
  timeout       = 10

  environment {
    variables = {
      ENV_VAR_1 = "value1"
    }
  }
}

above code explained :

function_name: The name of your Lambda function. It's important to note that Lambda function names must be unique within an AWS region.
runtime: Specifies the runtime environment for the function. AWS supports several runtimes like Python, Node.js, Java, Go, and custom runtimes via containers.
handler: This is the entry point of your code. For Python, it's typically . (e.g., lambda_function.lambda_handler), where lambda_function.py contains the function lambda_handler.
filename: The ZIP file containing the Lambda deployment package.
memory_size: Memory allocated to the function, ranging from 128 MB to 10,240 MB. Lambda allocates CPU power linearly in proportion to the memory.
timeout: The maximum amount of time (in seconds) a function is allowed to run. If your function exceeds this, it will be terminated.
environment: You can pass environment variables to the Lambda function.

Lets do same using StackGen topology - add new resource - aws lambda

you will see its create IAM role and CloudWatch Log by default so generated tf is secured

you can see IaC is generated

Advanced Configurations:

Tags: You can tag Lambda functions to make it easier to track costs, permissions, and resources across AWS services.
```
  tags = {
    Environment = "dev"
    Project     = "MyProject"
  }
```
Dead Letter Queues (DLQ): If Lambda functions fail, you can use DLQs to capture and analyze failures by connecting to an SQS queue or SNS topic.
```
  dead_letter_config {
    target_arn = aws_sqs_queue.lambda_dlq.arn
  }
```

Packaging and Deploying Code

AWS Lambda requires the function code to be packaged as a ZIP file. This can either be done manually or automatically using deployment pipelines.

Option 1: Local ZIP Package

When deploying code locally, you can package your Lambda function and pass the ZIP file to Terraform:

filename = "lambda_function.zip"

You can create this ZIP package manually or automate it with a script. Here's an example for Python:

zip lambda_function.zip lambda_function.py

Option 2: S3 Deployment

For larger functions or when working in a CI/CD pipeline, it's more efficient to store the Lambda package in an S3 bucket:

resource "aws_lambda_function" "my_lambda" {
  function_name = "my_lambda"
  runtime       = "python3.8"
  handler       = "lambda_function.lambda_handler"
  s3_bucket     = "lambda-deployment-bucket"
  s3_key        = "lambda_function.zip"
}

This way, your CI/CD system can upload new versions of your code to S3, and Terraform will use the new version when applying changes.

Adding Dependencies with Lambda Layers

Lambda Layers allow you to package libraries and dependencies separately from your main Lambda code. This helps reduce code size, speeds up deployments, and makes managing shared code easier.

Create a Lambda Layer

resource "aws_lambda_layer_version" "common_dependencies" {
  layer_name          = "common_dependencies"
  filename            = "layer.zip"
  compatible_runtimes = ["python3.8"]
}

You can attach the layer to your Lambda function by referencing its ARN:

resource "aws_lambda_function" "my_lambda" {
  function_name = "my_lambda"
  runtime       = "python3.8"
  handler       = "lambda_function.lambda_handler"
  layers        = [aws_lambda_layer_version.common_dependencies.arn]
}

This example assumes you’ve packaged your dependencies (e.g., Python libraries) into layer.zip.

IAM Roles and Permissions

Lambda requires an IAM role that grants it the necessary permissions to execute. The minimal requirement is permission to write logs to CloudWatch.

Basic IAM Role for Lambda

resource "aws_iam_role" "lambda_role" {
  name = "lambda_execution_role"
  assume_role_policy = <



if you click on the IAM rile you will find role policy which added
Attaching Policies
We’ll need to give the role basic execution permissions, like logging to CloudWatch:
resource "aws_iam_policy_attachment" "lambda_policy_attachment" {
  roles      = [aws_iam_role.lambda_role.name]
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

Advanced Role Configurations
For more advanced use cases, like accessing other AWS services (S3, DynamoDB, etc.), you’ll need to attach additional permissions. For example, if your Lambda function needs to read from an S3 bucket:
data "aws_iam_policy_document" "lambda_s3_policy" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::mybucket/*"]
    effect    = "Allow"
  }
}

resource "aws_iam_role_policy" "lambda_s3_access" {
  name   = "lambda_s3_access"
  role   = aws_iam_role.lambda_role.id
  policy = data.aws_iam_policy_document.lambda_s3_policy.json
}

This allows your Lambda to access objects in the specified S3 bucket
lets see using StackGen lets add S3 cloud resources by drag and drop

Connect lambda function to S3 and it will ask its IAM role and trigger configuration

I will select IAM here and if you click on configuration you will see role type and policy accordingly added by StackGen . it’s smart enough to understand resource mapping and its depend cloud resources and add policy base on that also its allow you to edit or add customised .


VPC Configuration
Lambda functions can run inside a Virtual Private Cloud (VPC) to access private resources like databases or services that are not publicly available. To run your Lambda in a VPC, you need to specify the subnet IDs and security group IDs.
resource "aws_lambda_function" "my_lambda" {
  function_name = "my_vpc_lambda"
  vpc_config {
    subnet_ids         = ["subnet-12345", "subnet-67890"]
    security_group_ids = ["sg-123456"]
  }
}

Make sure that the subnet you choose has access to your required resources and allows outgoing traffic if necessary.
NAT Gateway
If your Lambda function needs to access the internet from inside a
VPC, you’ll need to configure a NAT Gateway. This allows outbound internet access for your function without exposing it publicly.

Event Sources and Triggers
One of the key benefits of AWS Lambda is its ability to integrate with various AWS services to automatically trigger the function. Common event sources include S3 (when an object is created), DynamoDB Streams, API Gateway, and CloudWatch Events.
S3 Event Trigger
You can trigger a Lambda function when an object is created in an S3 bucket:
resource "aws_s3_bucket_notification" "example" {
  bucket = aws_s3_bucket.example.bucket

  lambda_function {
    lambda_function_arn = aws_lambda_function.example.arn
    events              = ["s3:ObjectCreated:*"]
  }
}

This will trigger the Lambda function whenever a new object is uploaded to the S3 bucket.
API Gateway Integration
To expose your Lambda function as a REST API, you can integrate it with API Gateway:
resource "aws_api_gateway_rest_api" "example" {
  name = "example_api"
}

resource "aws_lambda_permission" "api_gateway_invoke" {
  statement_id  = "AllowExecutionFromApiGateway"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.example.function_name
  principal     = "apigateway.amazonaws.com"
}

This grants API Gateway the permission to invoke the Lambda function.

Monitoring and Logging with CloudWatch
By default, AWS Lambda logs output to CloudWatch. You can customize log retention, alarms, and even set up custom metrics.
CloudWatch Logs
resource "aws_cloudwatch_log_group" "lambda_logs" {
  name              = "/aws/lambda/my_lambda"
  retention_in_days = 14
}

This will store the Lambda logs for 14 days in CloudWatch.
CloudWatch Alarms
You can also set up alarms to monitor key metrics like error rates, invocation durations, or throttling:
resource "aws_cloudwatch_metric_alarm" "lambda_error_alarm" {
  alarm_name          = "LambdaErrorAlarm"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "Errors"
  namespace           = "AWS/Lambda"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  actions_enabled     = true
}


Reserved Concurrency
Lambda functions can scale automatically, but if you want to control the number of concurrent executions (e.g., to avoid hitting downstream service limits), you can use reserved concurrency.
resource "aws_lambda_function" "my_lambda" {
  reserved_concurrent_executions = 5
}

This limits your function to a maximum of 5 concurrent invocations at any given time.

Best Practices for Using AWS Lambda with Terraform
1. Version Control Your Deployment Packages
Always version your Lambda deployment packages. This way, you can easily roll back to a previous version if necessary. Use S3 versioning or CI/CD pipelines to manage different versions of your code.
2. Use Terraform Modules for Reusability
Modularize your Terraform code to increase reusability and maintainability. For example, create separate modules for your Lambda function, IAM roles, API Gateway, and S3 configurations. This makes it easier to manage and reuse across different projects or environments.
3. Remote State
In multi-team or multi-environment setups, use Terraform’s remote state to ensure that the same infrastructure code is applied consistently across different environments. This helps avoid state conflicts and maintains consistency.
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "prod/terraform.tfstate"
    region = "us-west-2"
  }
}

4. Environment Separation (continued)
Using workspaces or separate Terraform state files for different environments (dev, staging, prod) can help prevent resource conflicts and ensure isolation between your environments. Here's an example of using Terraform workspaces to manage multiple environments:
# Create a workspace for staging
terraform workspace new staging

# Create a workspace for production
terraform workspace new production

# Switch to the desired workspace
terraform workspace select production

You can also adjust your resource configurations based on the workspace:
resource "aws_lambda_function" "my_lambda" {
  function_name = "my_lambda_${terraform.workspace}"
  runtime       = "python3.8"
  handler       = "lambda_function.lambda_handler"
  role          = aws_iam_role.lambda_role.arn
  filename      = "lambda_function.zip"
  memory_size   = 128
  timeout       = 10
}

This creates separate Lambda functions in each environment, keeping them isolated and configurable independently.

Advanced AWS Lambda Features with Terraform
1. Lambda Destinations
Lambda destinations allow you to route the result of your Lambda execution to different AWS services based on success or failure. For example, you could send successful executions to an SNS topic and failed ones to an SQS queue for further processing or debugging.
resource "aws_lambda_function" "my_lambda" {
  function_name = "my_lambda"
  runtime       = "python3.8"
  handler       = "lambda_function.lambda_handler"
  role          = aws_iam_role.lambda_role.arn
  filename      = "lambda_function.zip"
  memory_size   = 128
  timeout       = 10

  environment {
    variables = {
      "ENV_VAR_1" = "value1"
    }
  }

  # Define Lambda destinations
  dead_letter_config {
    target_arn = aws_sqs_queue.lambda_dlq.arn
  }

  # Success destination (SNS)
  destination_config {
    on_success {
      destination = aws_sns_topic.success_topic.arn
    }
    on_failure {
      destination = aws_sqs_queue.failure_queue.arn
    }
  }
}

In this configuration, successful Lambda invocations are sent to an SNS topic, while failed executions are sent to an SQS queue.
2. Provisioned Concurrency
Lambda’s Provisioned Concurrency allows you to pre-allocate a certain number of concurrent executions for low-latency, high-throughput applications. This feature ensures that your function is "warm" and ready to respond to requests immediately, without the initial cold start.
resource "aws_lambda_provisioned_concurrency_config" "example" {
  function_name                 = aws_lambda_function.example.function_name
  qualifier                     = "$LATEST"
  provisioned_concurrent_executions = 10
}

By configuring provisioned concurrency, you can reduce the cold-start time of your function, ensuring a fast and consistent response time.
3. Lambda with Docker Containers
AWS Lambda now supports running containerized applications. Instead of zipping your code, you can package your Lambda as a Docker container image. This provides more flexibility in how you build and package your Lambda code, including running custom runtimes.
To deploy a containerized Lambda function with Terraform:
resource "aws_lambda_function" "my_lambda" {
  function_name = "my_container_lambda"
  package_type  = "Image"
  image_uri     = "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-lambda-image:latest"
  role          = aws_iam_role.lambda_role.arn
  memory_size   = 512
  timeout       = 30
}

You’ll need to build your Docker image locally or in your CI/CD pipeline and push it to Amazon Elastic Container Registry (ECR) before referencing it in Terraform.
4. CI/CD with Terraform and AWS Lambda
To securely add AWS credentials for Terraform to use in a GitHub Actions workflow, you should use GitHub Secrets. This ensures that your AWS credentials are not exposed directly in your workflow YAML file.
Here’s how to do it:
Step 1: Add AWS Credentials to GitHub Secrets

Go to your GitHub repository.

Click on Settings.

In the left sidebar, select Secrets and Variables > Actions.

Click the New repository secret button.

Add the following secrets:

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY




Make sure these values are from an IAM user with the necessary permissions for Terraform to create resources (e.g., Lambda, S3, IAM).
Step 2: Update GitHub Actions Workflow to Use AWS Credentials
Now, you need to modify your GitHub Actions workflow to use these secrets for AWS authentication.
Here’s your updated workflow YAML:
name: Deploy Lambda with Terraform

on:
  push:
    branches:
      - main

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v2

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v2
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-west-2  # You can specify the region here

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 1.0.0

    - name: Initialize Terraform
      run: terraform init

    - name: Plan Terraform changes
      run: terraform plan

    - name: Apply Terraform changes
      run: terraform apply -auto-approve

Breakdown of Updates:

AWS credentials configuration:

The step Configure AWS credentials uses the GitHub action aws-actions/configure-aws-credentials@v2 to set up the environment for Terraform to authenticate with AWS.

The ${{ secrets.AWS_ACCESS_KEY_ID }} and ${{ secrets.AWS_SECRET_ACCESS_KEY }} pull the secrets from the repository settings.



AWS Region:

You can define the AWS region using the aws-region key (set to us-west-2 in this example), but you can modify it to any region you need.



By following this process, you securely add AWS credentials to your GitHub Actions workflow, enabling Terraform to authenticate and interact with AWS.
5. Cost Optimization and Monitoring
Cost optimization is an essential part of managing Lambda functions, especially as usage scales up. Here are a few ways to optimize Lambda costs:

Monitor Duration: Reduce function execution time by optimizing the code to minimize processing delays.

Optimize Memory: Use the minimum memory allocation that still allows the function to execute efficiently.

Enable CloudWatch Alarms: Set up CloudWatch Alarms for function invocation counts, error rates, and duration metrics to keep an eye on function usage and identify cost anomalies.


Terraform can also help automate the setup of these cost optimization tools:
resource "aws_cloudwatch_metric_alarm" "lambda_duration_alarm" {
  alarm_name          = "LambdaDurationExceeded"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "Duration"
  namespace           = "AWS/Lambda"
  period              = 60
  statistic           = "Average"
  threshold           = 3000  # 3 seconds
  actions_enabled     = true
}


Conclusion
AWS Lambda, combined with Terraform, offers an incredibly powerful platform for building serverless applications with infrastructure as code. By following the practices laid out in this guide, you can:

Automate the deployment and management of Lambda functions.

Integrate seamlessly with other AWS services like S3, API Gateway, and CloudWatch.

Optimize your infrastructure for cost and performance.

Maintain flexibility and scalability as your applications grow.


With Terraform, you can also scale your AWS Lambda deployment strategy to handle more complex setups involving multiple environments, reusable modules, and even containerized functions.
The possibilities are vast, but the key takeaway is that automation, consistency, and best practices with tools like Terraform will save time, reduce errors, and ensure that your AWS Lambda infrastructure is future-proof and scalable.



Infrastructure from Code (IfC): Overview and Role in Platform Engineering with StackGen
Sangam Biradar — Mon, 23 Sep 2024 14:26:59 GMT
In our previous blog, we explored the concept of Infrastructure from Code (IfC) and how it automates the generation of infrastructure directly from application code. This approach eliminates the need for manually writing infrastructure as code (IaC) and ensures that best practices are applied automatically. But how can platform engineers adopt this game-changing practice? Are there tools that can make this transition easier?
In this blog, we’ll dive into the tools available to help you adopt IfC, focusing on how they can simplify your workflows, save time, and enhance infrastructure security and scalability. We'll also highlight the practical benefits of using these tools to accelerate your platform engineering processes.
Introduction to Infrastructure from Code (IfC)
Infrastructure from Code (IfC) is a transformative approach to automating infrastructure provisioning by generating infrastructure configurations directly from application code. This reduces the need for manual infrastructure management and ensures consistency across different environments. In platform engineering, IfC enables teams to build and scale platforms quickly and efficiently.
StackGen plays a crucial role in this process, simplifying infrastructure generation by automatically creating Infrastructure as Code (IaC) and applying best practice cloud policies. Even for those with limited IaC knowledge, StackGen makes it easy to review, enhance, and provide infrastructure to DevOps teams without writing any IaC from scratch.
How StackGen Saves Time for Platform Engineers
When platform engineers manage infrastructure manually, they often face several time-consuming tasks:

Writing and Maintaining IaC: Manually writing IaC for services like Terraform, Helm, or CloudFormation requires extensive time and expertise.

Applying Cloud Best Practices: Ensuring compliance and security requires knowledge of best practices, which involves time-consuming research and validation.

Scaling Infrastructure: Manually managing infrastructure scaling in response to changing application needs requires constant monitoring and adjustment.

Collaboration with DevOps Teams: Aligning IaC with DevOps practices and ensuring smooth deployment requires careful planning and review cycles.

Security and Compliance: Ensuring infrastructure meets regulatory compliance (e.g., SOC 2, HIPAA, NIST-CSF, PCI, GDPR) and security standards can take weeks of manual effort.


Using StackGen to generate Infrastructure from Code significantly reduces the time spent on these tasks. Below is a breakdown of how much time StackGen can save platform engineers:
1. Writing and Maintaining IaC

Manual Process: Writing complex IaC from scratch for infrastructure components such as networking, load balancers, storage, and databases typically takes several days to weeks depending on the complexity of the application.

With StackGen: StackGen automatically generates IaC within minutes to hours based on your application code, eliminating the need to manually write and maintain detailed configurations.

Time Reduction: StackGen reduces time spent writing and maintaining IaC by up to 90%, turning what could be a multi-week task into just a few hours.


2. Applying Cloud Best Practices

Manual Process: Researching, implementing, and validating cloud best practices (such as security, compliance, and scaling configurations) can take several days. Engineers must ensure that the infrastructure follows the best practices for the chosen cloud provider.

With StackGen: StackGen automatically applies pre-built best practice policies for AWS, Azure, and GCP, ensuring your infrastructure is compliant and secure without the need for manual intervention.

Time Reduction: StackGen reduces this process by 80-90%, saving platform engineers several days of manual configuration and testing.


3. Scaling Infrastructure

Manual Process: Monitoring and manually adjusting infrastructure to scale with demand is a time-consuming task. Engineers may spend hours or even days each week configuring autoscaling policies and adjusting infrastructure as workloads fluctuate.

With StackGen: StackGen generates Infrastructure as Code (IaC) that defines scaling parameters upfront, ensuring that infrastructure can be easily adjusted when needed. Instead of handling scaling in real time, StackGen allows engineers to set clear, predefined scaling policies through code, reducing the complexity and effort of manual adjustments.

Time Savings: StackGen reduces the time spent on configuring and managing scaling by up to 85%, as engineers can focus on defining infrastructure via IaC rather than manually adjusting resources on the fly. This approach significantly minimizes repetitive scaling tasks while maintaining flexibility.


4. Collaboration with DevOps Teams

Manual Process: Aligning infrastructure configurations with DevOps pipelines and ensuring smooth deployment often requires several review cycles and iterations, which can delay deployment timelines by days or weeks.

With StackGen: StackGen integrates seamlessly with existing DevOps workflows, automatically generating infrastructure that is ready for deployment. Engineers can review and tweak the generated IaC before passing it to DevOps teams, streamlining the process.


5. Security and Compliance

Manual Process: Ensuring that infrastructure is compliant with security regulations such as SOC 2, HIPAA, NIST-CSF, PCI, and GDPR requires significant manual effort. Platform engineers need to stay updated with the latest security guidelines, implement controls, and validate compliance—often a 1-2 week process for each system.

With StackGen: StackGen integrates automated security best practices into the generated IaC, ensuring compliance with all relevant security standards. This feature saves engineers from manually implementing these controls, reducing errors and ensuring that infrastructure is secure by design.

Time Reduction: StackGen reduces the time spent on security and compliance by 85-90%, transforming weeks of manual work into automated, built-in processes that engineers can trust.


The Bigger Picture: Time Savings with StackGen
By automating these key areas, StackGen reduces the overall infrastructure management time by up to 70-90%. Below is a comparative example of time spent manually versus using StackGen for a typical platform engineering workflow:




Task Manual Time With StackGen Time Saved



Writing and Maintaining IaC 1-2 weeks 1-2 hours ~90%

Applying Cloud Best Practices 3-5 days Built into generated IaC ~85-90%

Scaling Infrastructure Ongoing (hours/week) Predefined in IaC (adjustments required when needed) ~85% (hours/week)

Collaboration with DevOps Teams 3-7 days (review cycles) 1-2 days ~50-70%

Security Integration 1-2 weeks Automated security best practices and compliance standards (SOC 2, HIPAA, NIST-CSF, PCI, GDPR) built into IaC ~85-90%



Get Started Now with StackGen - https://stackgen.com/developers

https://stackgen.com
 
Live Use Cases of StackGen in Platform Engineering
1. Microservices Deployment on AWS

Scenario: A team building a microservices-based application on AWS.

Manual Process: Writing Terraform or CloudFormation templates for provisioning AWS resources like VPCs, load balancers, and databases could take up to 2-3 weeks.

With StackGen: The team connects their code repository to StackGen, specifies AWS as the target, and the necessary infrastructure is automatically generated in less than a day.

Time Saved: ~2-3 weeks.


2. Kubernetes-Based Platform on AWS Cloud

Scenario: A company using Kubernetes to manage containerised workloads on AWS Cloud.

Manual Process: Provisioning EKS clusters, managing networking and storage, and ensuring best practices can take several days to weeks.

With StackGen: The Kubernetes infrastructure is generated automatically within hours, complete with security and scaling best practices.

Time Saved: ~1-2 weeks.


3. Serverless Application on AWS Lambda

Scenario: A startup deploying a serverless application on AWS Lambda.

Manual Process: Configuring Lambda functions, API Gateway, and DynamoDB manually could take a few days to a week.

With StackGen: The infrastructure is generated automatically within a few hours, fully optimized for serverless workloads.

Time Saved: ~4-5 days.


Conclusion
By leveraging StackGen, platform engineers can drastically reduce the time spent on infrastructure management—by as much as 70-90%—while ensuring compliance with best practices. Whether it's deploying microservices, Kubernetes clusters, or serverless applications, StackGen automates complex processes, saving platform teams weeks of effort and enabling faster deployment cycles. This time-saving capability allows engineers to focus on innovation and scaling their platforms, rather than getting bogged down in manual IaC tasks.



From Serverless to Kubernetes Part - 1
Sangam Biradar — Tue, 10 Sep 2024 18:45:30 GMT
Serverless has emerged as a popular way to deploy simple applications, making it easier for startups to build solutions with fewer resources. However, most serverless platforms are vendor-specific, which can limit their usefulness for modern cloud-native and AI applications. This is where projects like Knative step in. Knative combines the power of serverless with Kubernetes, allowing developers to focus solely on writing serverless functions while benefiting from Kubernetes’ robust infrastructure.
In this blog, we’ll explore how to install Knative, understand its components, and deploy a simple Knative application on Kubernetes.
Background of Knative Project
Knative created originally by google with contributor from over 50 different companies , delivery an essential set of components to build and run serverless application on kubernetes . Knative is a Cloud Native Computing Foundation incubation project .
Create k8s Cluster Locally with Kind

Install kind locally


https://kind.sigs.k8s.io


verify kind is installed or not
 kind --version


Kind ( Kubernetes in Docker ) use Docker to create Kubernetes Cluster
 Docker --version


here is Kubernetes manifest to create kind cluster which includes extraPortMapping we needed for kourier ingress later in installing Kourier


kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  image: kindest/node:v1.31.0@sha256:53df588e04085fd41ae12de0c3fe4c72f7013bba32a20e7325357a1ac94ba865
  extraPortMappings:
  - containerPort: 31080  # expose port 31380 of the node to port 80 on the host, later to be use by kourier ingress
    hostPort: 80
  - containerPort: 31443
    hostPort: 443

save above manifest with name kind-knative-cluster.yaml
kind create cluster --name knative-cluster --config kind-knative-cluster.yaml

if already cluster exist with that name kind delete cluster -n knative-cluster
get cluster info and check if the context is pointing to the right cluster
kubectl cluster-info --context kind-knative-cluster
kubectl config get-contexts

Install Knative Serving Component
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.15.2/serving-crds.yaml
kubectl wait --for=condition=Established --all crd
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.15.2/serving-core.yaml
kubectl wait pod --timeout=-1s --for=condition=Ready -l '!job-name' -n knative-serving > /dev/null

Intall kourier
kubectl apply -f https://github.com/knative/net-kourier/releases/download/knative-v1.15.1/kourier.yaml
kubectl wait pod --timeout=-1s --for=condition=Ready -l '!job-name' -n kourier-system
kubectl wait pod --timeout=-1s --for=condition=Ready -l '!job-name' -n knative-serving

Set up Magic DNS
EXTERNAL_IP="127.0.0.1"
KNATIVE_DOMAIN="$EXTERNAL_IP.nip.io"
echo KNATIVE_DOMAIN=$KNATIVE_DOMAIN
dig $KNATIVE_DOMAIN
kubectl patch configmap -n knative-serving config-domain -p "{\"data\": {\"$KNATIVE_DOMAIN\": \"\"}}"

check the config domain in configmap
kubectl describe configmaps config-domain -n knative-serving

set Kourier as the default networking layer for Knative Serving
apiVersion: v1
kind: Service
metadata:
  name: kourier-ingress
  namespace: kourier-system
  labels:
    networking.knative.dev/ingress-provider: kourier
spec:
  type: NodePort
  selector:
    app: 3scale-kourier-gateway
  ports:
    - name: http2
      nodePort: 31080
      port: 80
      targetPort: 8080
    - name: https
      nodePort: 31443
      port: 443
      targetPort: 8443

Kourier is an Ingress for Knative Serving. Kourier is a lightweight alternative for the Istio ingress as its deployment consists only of an Envoy proxy and a control plane for it.
install the Kourier controller
kubectl apply -f kourier.yaml

Configure Knative Serving to use the proper "ingress.class"
kubectl patch configmap/config-network   
--namespace knative-serving   
--type merge   
--patch '{"data":{"ingress.class":"kourier.ingress.networking.knative.dev"}}'
kubectl describe configmaps config-network -n knative-serving

check pods are up and running
kubectl get pods -n knative-serving
kubectl get pods -n kourier-system
kubectl get svc  -n kourier-system

Install Kn CLI
brew install knative/client/kn

Run first hello world serverless function
kn service create hello   
--image gcr.io/knative-samples/helloworld-go   
--port 8080   
--env TARGET=Knative

Get Service URL
SERVICE_URL=$(kubectl get ksvc hello -o jsonpath='{.status.url}')
echo $SERVICE_URL

Curl the URL in new Terminal
curl $SERVICE_URL

see the pod status
kubectl get pod -l serving.knative.dev/service=hello -w 
# NAME                                      READY   STATUS    RESTARTS   AGE

# hello-00001-deployment-659dfd67fb-5ps9x   2/2     Running   0          90s

# hello-00001-deployment-659dfd67fb-5ps9x   2/2     Terminating   0          2m25s

# hello-00001-deployment-659dfd67fb-5ps9x   1/2     Terminating   0          2m27s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     Pending       0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     Pending       0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     ContainerCreating   0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   1/2     Running             0          1s

# hello-00001-deployment-659dfd67fb-wgnkj   2/2     Running             0          1s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m55s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m56s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m56s

# NAME                                      READY   STATUS    RESTARTS   AGE

# hello-00001-deployment-659dfd67fb-5ps9x   2/2     Running   0          90s

# hello-00001-deployment-659dfd67fb-5ps9x   2/2     Terminating   0          2m25s

# hello-00001-deployment-659dfd67fb-5ps9x   1/2     Terminating   0          2m27s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     Pending       0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     Pending       0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   0/2     ContainerCreating   0          0s

# hello-00001-deployment-659dfd67fb-wgnkj   1/2     Running             0          1s

# hello-00001-deployment-659dfd67fb-wgnkj   2/2     Running             0          1s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m55s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m56s

# hello-00001-deployment-659dfd67fb-5ps9x   0/2     Terminating         0          2m56s

# hello-00001-deployment-659dfd67fb-wgnkj   2/2     Terminating         0          88s

# hello-00001-deployment-659dfd67fb-npmr5   0/2     Pending             0          0s

# hello-00001-deployment-659dfd67fb-npmr5   0/2     Pending             0          0s

# hello-00001-deployment-659dfd67fb-npmr5   0/2     ContainerCreating   0          0s

# hello-00001-deployment-659dfd67fb-npmr5   1/2     Running             0          2s

# hello-00001-deployment-659dfd67fb-npmr5   2/2     Running             0          2s

# hello-00001-deployment-659dfd67fb-wgnkj   1/2     Terminating         0          90s

if you see above pods if your accessing URL that time container creating in background instantly

another way of installing Knative quickly
brew install knative-extensions/kn-plugins/quickstart
kn quickstart kind


Lets build our newsfeed Knative application
tree
.
├── README.md
├── service.yaml
├── servingcontainer
│   ├── Dockerfile
│   ├── go.mod
│   └── servingcontainer.go
└── sidecarcontainer
    ├── Dockerfile
    ├── go.mod
    ├── go.sum
    └── sidecarcontainer.go

here we have 2 functions on as servingcontainer.go and another sidecarcontainer.go with respecting dependencies and dockerfile
function 1 - servingcontainer
 tree
.
├── Dockerfile
├── go.mod
└── servingcontainer.go


package main

import (
    "fmt"
    "io"
    "log"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
    log.Println("serving container received a request.")
    res, err := http.Get("http://127.0.0.1:8882")
    if err != nil {
        log.Fatal(err)
    }
    resp, err := io.ReadAll(res.Body)
    if err != nil {
        log.Fatal(err)
    }
    fmt.Fprintln(w, string(resp))
}

func main() {
    log.Print("serving container started...")
    http.HandleFunc("/", handler)
    log.Fatal(http.ListenAndServe(":8881", nil))
}

simple HTTP server that listens on port 8881 and forwards incoming requests to another service running at http://127.0.0.1:8882. It retrieves the response from that service and returns it to the original client
here is Dockerfile
FROM golang:1.16 AS builder  
ARG TARGETOS
ARG TARGETARCH
# Create and change to the app directory.
WORKDIR /app
# Retrieve application dependencies using go modules.
COPY go.* ./
RUN go mod download
# Copy local code to the container image.
COPY . ./
# Build the binary.
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -mod=readonly -v -o servingcontainer
# Use the official Alpine image for a lean production container.
FROM alpine:3
RUN apk add --no-cache ca-certificates
# Copy the binary to the production image from the builder stage.
COPY --from=builder /app/servingcontainer /servingcontainer
# Run the web service on container startup.
CMD ["/servingcontainer"]

Build Muti-arch images
docker buildx build --platform linux/arm64,linux/amd64 -t "sangam14/servingcontainer" --push .
[+] Building 72.9s (30/30) FINISHED                                                                                            docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 734B                                                                                                           0.0s
 => [linux/amd64 internal] load metadata for docker.io/library/alpine:3                                                                        3.8s
 => [linux/arm64 internal] load metadata for docker.io/library/alpine:3                                                                        3.8s
 => [linux/arm64 internal] load metadata for docker.io/library/golang:1.23                                                                     7.1s
 => [linux/amd64 internal] load metadata for docker.io/library/golang:1.23                                                                     6.6s
 => [auth] library/alpine:pull token for registry-1.docker.io                                                                                  0.0s
 => [auth] library/golang:pull token for registry-1.docker.io                                                                                  0.0s
 => [internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                0.0s
 => [linux/arm64 builder 1/6] FROM docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e      33.0s
 => => resolve docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e                           0.0s
 => => sha256:83f1399aa9166438efeea4696812a3fa3f3397ff114492577a919f9b09f3c1ea 126B / 126B                                                     2.6s
 => => sha256:a355a3cac949bed5cda9c62103ceb0f004727cedcd2a17d7c9836aea1a452fda 70.62MB / 70.62MB                                               9.9s
 => => sha256:ecb27c98d5b9e78892d876693427ae0a01e3113b36989718360a5aa9e319fd80 86.29MB / 86.29MB                                              15.4s
 => => sha256:843b1d8321825bc8302752ae003026f13bd15c6eef2efe032f3ca1520c5bbc07 64.00MB / 64.00MB                                              11.9s
 => => sha256:364d19f59f69474a80c53fc78da91f85553e16e8ba6a28063cbebf259821119e 23.59MB / 23.59MB                                               5.9s
 => => sha256:56c9b9253ff98351db158cb6789848656b8d54f411c0037347bf2358efb18f39 49.59MB / 49.59MB                                               3.9s
 => => extracting sha256:56c9b9253ff98351db158cb6789848656b8d54f411c0037347bf2358efb18f39                                                      0.6s
 => => extracting sha256:364d19f59f69474a80c53fc78da91f85553e16e8ba6a28063cbebf259821119e                                                      0.2s
 => => extracting sha256:843b1d8321825bc8302752ae003026f13bd15c6eef2efe032f3ca1520c5bbc07                                                      0.7s
 => => extracting sha256:ecb27c98d5b9e78892d876693427ae0a01e3113b36989718360a5aa9e319fd80                                                      1.0s
 => => extracting sha256:a355a3cac949bed5cda9c62103ceb0f004727cedcd2a17d7c9836aea1a452fda                                                      1.6s
 => => extracting sha256:83f1399aa9166438efeea4696812a3fa3f3397ff114492577a919f9b09f3c1ea                                                      0.0s
 => => extracting sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1                                                      0.0s
 => [linux/amd64 builder 1/6] FROM docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e      24.6s
 => => resolve docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e                           0.0s
 => => sha256:95c1ad979d054ab0c2824c196b59074e31870426326f3e359ca9ee12d0fcb999 127B / 127B                                                     1.1s
 => => sha256:e7bff916ab0c126c9d943f0c481a905f402e00f206a89248f257ef90beaabbd8 74.00MB / 74.00MB                                              16.9s
 => => sha256:627963ea2c8d5e7f344e68dce05f9013c8104d06e6e0d414fcbb261cc0b6bbde 92.26MB / 92.26MB                                              21.7s
 => => sha256:2e66a70da0bec13fb3d492fcdef60fd8a5ef0a1a65c4e8a4909e26742852f0f2 64.15MB / 64.15MB                                               5.4s
 => => sha256:2e6afa3f266c11e8960349e7866203a9df478a50362bb5488c45fe39d99b2707 24.05MB / 24.05MB                                              11.2s
 => => sha256:8cd46d290033f265db57fd808ac81c444ec5a5b3f189c3d6d85043b647336913 49.56MB / 49.56MB                                               7.1s
 => => extracting sha256:8cd46d290033f265db57fd808ac81c444ec5a5b3f189c3d6d85043b647336913                                                      0.5s
 => => extracting sha256:2e6afa3f266c11e8960349e7866203a9df478a50362bb5488c45fe39d99b2707                                                      0.2s
 => => extracting sha256:2e66a70da0bec13fb3d492fcdef60fd8a5ef0a1a65c4e8a4909e26742852f0f2                                                      0.7s
 => => extracting sha256:627963ea2c8d5e7f344e68dce05f9013c8104d06e6e0d414fcbb261cc0b6bbde                                                      0.9s
 => => extracting sha256:e7bff916ab0c126c9d943f0c481a905f402e00f206a89248f257ef90beaabbd8                                                      1.2s
 => => extracting sha256:95c1ad979d054ab0c2824c196b59074e31870426326f3e359ca9ee12d0fcb999                                                      0.0s
 => => extracting sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1                                                      0.0s
 => [internal] load build context                                                                                                              0.0s
 => => transferring context: 798B                                                                                                              0.0s
 => [linux/amd64 stage-1 1/3] FROM docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d          0.8s
 => => resolve docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d                              0.0s
 => => sha256:43c4264eed91be63b206e17d93e75256a6097070ce643c5e8f0379998b44f170 2.10MB / 3.62MB                                                65.7s
 => => extracting sha256:43c4264eed91be63b206e17d93e75256a6097070ce643c5e8f0379998b44f170                                                      0.0s
 => [linux/arm64 stage-1 1/3] FROM docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d          0.8s
 => => resolve docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d                              0.0s
 => => sha256:cf04c63912e16506c4413937c7f4579018e4bb25c272d989789cfba77b12f951 4.09MB / 4.09MB                                                 0.7s
 => => extracting sha256:cf04c63912e16506c4413937c7f4579018e4bb25c272d989789cfba77b12f951                                                      0.1s
 => [linux/arm64 stage-1 2/3] RUN apk add --no-cache ca-certificates                                                                          36.3s
 => [linux/amd64 stage-1 2/3] RUN apk add --no-cache ca-certificates                                                                          32.1s
 => [linux/amd64 builder 2/6] WORKDIR /app                                                                                                     0.8s
 => [linux/amd64 builder 3/6] COPY go.* ./                                                                                                     0.0s
 => [linux/amd64 builder 4/6] RUN go mod download                                                                                              0.2s
 => [linux/amd64 builder 5/6] COPY . ./                                                                                                        0.0s
 => [linux/amd64 builder 6/6] RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=readonly -v -o servingcontainer                         16.4s
 => [linux/arm64 builder 2/6] WORKDIR /app                                                                                                     0.1s
 => [linux/arm64 builder 3/6] COPY go.* ./                                                                                                     0.0s
 => [linux/arm64 builder 4/6] RUN go mod download                                                                                              0.1s
 => [linux/arm64 builder 5/6] COPY . ./                                                                                                        0.0s
 => [linux/arm64 builder 6/6] RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=readonly -v -o servingcontainer                          3.7s
 => [linux/arm64 stage-1 3/3] COPY --from=builder /app/servingcontainer /servingcontainer                                                      0.0s
 => [linux/amd64 stage-1 3/3] COPY --from=builder /app/servingcontainer /servingcontainer                                                      0.0s
 => exporting to image                                                                                                                        11.7s
 => => exporting layers                                                                                                                        0.2s
 => => exporting manifest sha256:61709c4dd0e25684749ad68c5635b481f31f24574a603bc5b556ba5d15fe79a4                                              0.0s
 => => exporting config sha256:86aac9ead5bb472bc29b4f06c66655e7883bfdb248bd321885b257563a442929                                                0.0s
 => => exporting attestation manifest sha256:fabd107bc16cbbe43c3f163dc8c4e5cb51cbaf219d4da909d4364be8b2f80045                                  0.0s
 => => exporting manifest sha256:190a25dd92a3ff04983f4fd9ec8374f7560d2273f3481e5a57b32920b16cfff3                                              0.0s
 => => exporting config sha256:842a417114450ddfbca6dc5a5248c4b64950c445bfc7ff8b811c0a75eea1aa2b                                                0.0s
 => => exporting attestation manifest sha256:9471827b65703cafd008a1c28f65ada987dff64193299db1299906d8c1bfeb0e                                  0.0s
 => => exporting manifest list sha256:9b0071778eee4f9b87c7838d90689ad2c16dbecb7f85ec419edcf54f692d40e6                                         0.0s
 => => naming to docker.io/sangam14/servingcontainer:latest                                                                                    0.0s
 => => unpacking to docker.io/sangam14/servingcontainer:latest                                                                                 0.0s
 => => pushing layers                                                                                                                          7.9s
 => => pushing manifest for docker.io/sangam14/servingcontainer:latest@sha256:9b0071778eee4f9b87c7838d90689ad2c16dbecb7f85ec419edcf54f692d40e  3.4s
 => [auth] sangam14/servingcontainer:pull,push token for registry-1.docker.io                                                                  0.0s
 => pushing sangam14/servingcontainer with docker                                                                                              8.6s
 => => pushing layer cf04c63912e1                                                                                                              8.5s
 => => pushing layer c3d694a809a6                                                                                                              8.5s
 => => pushing layer e8a452786f60                                                                                                              8.5s
 => => pushing layer 854a7d49a717                                                                                                              8.5s
 => => pushing layer ce64efdaa908                                                                                                              8.5s
 => => pushing layer c8910dfd41a3                                                                                                              8.5s
 => => pushing layer 039108769e6b                                                                                                              8.5s
 => => pushing layer 43c4264eed91

function 2 - sidecarcontainer
tree
.
├── Dockerfile
├── go.mod
├── go.sum
└── sidecarcontainer.go

package main

import (
    "fmt"
    "log"
    "net/http"

    "github.com/mmcdole/gofeed"
)

func handler(w http.ResponseWriter, r *http.Request) {
    log.Println("sidecar container received a request.")

    // Parse the RSS feed
    fp := gofeed.NewParser()
    feed, err := fp.ParseURL("https://news.ycombinator.com/rss") // Replace with the desired RSS feed URL
    if err != nil {
        http.Error(w, "Failed to fetch newsfeed", http.StatusInternalServerError)
        log.Println("Failed to parse newsfeed:", err)
        return
    }

    // Display the feed title
    fmt.Fprintf(w, "Feed Title: %s\n\n", feed.Title)

    // Display the titles and links of the first few items
    for i, item := range feed.Items {
        if i >= 10 { // Limit to first 5 items
            break
        }
        fmt.Fprintf(w, "Item %d: %s\nLink: %s\n\n", i+1, item.Title, item.Link)
    }

    fmt.Fprintln(w, "\nYay!! multi-container works")
}

func main() {
    log.Print("sidecar container started...")
    http.HandleFunc("/", handler)
    log.Fatal(http.ListenAndServe(":8882", nil))
}

a simple HTTP server in a Go-based sidecar container that fetches and parses an RSS feed (from Hacker News in this case) and serves the results. It uses the gofeed package to handle RSS parsing.
# Dockerfile

FROM golang:1.23 AS builder 

ARG TARGETOS
ARG TARGETARCH

# Create and change to the app directory
WORKDIR /app

# Retrieve application dependencies using go modules
COPY go.* ./
RUN go mod download

# Copy local code to the container image
COPY . ./

# Build the binary
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -mod=readonly -v -o sidecarcontainer

# Use the official Alpine image for a lean production container
FROM alpine:3
RUN apk add --no-cache ca-certificates

# Copy the binary to the production image from the builder stage
COPY --from=builder /app/sidecarcontainer /sidecarcontainer

# Run the web service on container startup
CMD ["/sidecarcontainer"]

Build Dockerfile
docker buildx build --platform linux/arm64,linux/amd64 -t "sangam14/sidecarcontainer" --push .
[+] Building 44.1s (29/29) FINISHED                                                                                            docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 741B                                                                                                           0.0s
 => [linux/amd64 internal] load metadata for docker.io/library/alpine:3                                                                        1.0s
 => [linux/arm64 internal] load metadata for docker.io/library/alpine:3                                                                        0.9s
 => [linux/amd64 internal] load metadata for docker.io/library/golang:1.23                                                                     1.0s
 => [linux/arm64 internal] load metadata for docker.io/library/golang:1.23                                                                     1.0s
 => [internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                0.0s
 => [linux/arm64 builder 1/6] FROM docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e       0.0s
 => => resolve docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e                           0.0s
 => [linux/amd64 stage-1 1/3] FROM docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d          0.0s
 => => resolve docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d                              0.0s
 => [linux/arm64 stage-1 1/3] FROM docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d          0.0s
 => => resolve docker.io/library/alpine:3@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d                              0.0s
 => [internal] load build context                                                                                                              0.0s
 => => transferring context: 1.83kB                                                                                                            0.0s
 => [linux/amd64 builder 1/6] FROM docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e       0.0s
 => => resolve docker.io/library/golang:1.23@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e                           0.0s
 => CACHED [linux/amd64 stage-1 2/3] RUN apk add --no-cache ca-certificates                                                                    0.0s
 => CACHED [linux/arm64 stage-1 2/3] RUN apk add --no-cache ca-certificates                                                                    0.0s
 => CACHED [linux/arm64 builder 2/6] WORKDIR /app                                                                                              0.0s
 => [linux/arm64 builder 3/6] COPY go.* ./                                                                                                     0.0s
 => CACHED [linux/amd64 builder 2/6] WORKDIR /app                                                                                              0.0s
 => [linux/amd64 builder 3/6] COPY go.* ./                                                                                                     0.0s
 => [linux/arm64 builder 4/6] RUN go mod download                                                                                              4.5s
 => [linux/amd64 builder 4/6] RUN go mod download                                                                                              5.4s
 => [linux/arm64 builder 5/6] COPY . ./                                                                                                        0.0s
 => [linux/arm64 builder 6/6] RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=readonly -v -o sidecarcontainer                          4.0s
 => [linux/amd64 builder 5/6] COPY . ./                                                                                                        0.0s
 => [linux/amd64 builder 6/6] RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=readonly -v -o sidecarcontainer                         18.0s
 => [linux/arm64 stage-1 3/3] COPY --from=builder /app/sidecarcontainer /sidecarcontainer                                                      0.0s
 => [linux/amd64 stage-1 3/3] COPY --from=builder /app/sidecarcontainer /sidecarcontainer                                                      0.0s
 => exporting to image                                                                                                                        11.8s
 => => exporting layers                                                                                                                        0.3s
 => => exporting manifest sha256:743e5367746604219e7d8070490a9e49b78f8a41542f08f1d3fd683fc58cf7f0                                              0.0s
 => => exporting config sha256:c68b9afe107cf0ffdc9f2ae0eaf878de2431213bbc036891f36f3a9e2f619c5e                                                0.0s
 => => exporting attestation manifest sha256:f33bf8633f608ee8d0a807cf0adbcfde2335d0a38026fc9d95fc390af4b4ace6                                  0.0s
 => => exporting manifest sha256:84ac4119bdbdfad3828ee69ce192331177a392a68ba3438582852edff1424cbb                                              0.0s
 => => exporting config sha256:48b111bd6dffb0730a19cb2c0f8aab4d1b5bdff7577392d6f90c09eaea2a4fb0                                                0.0s
 => => exporting attestation manifest sha256:e133468d18aad6fb9d11448bf18cd5d70c93b128a125df0e2e3f830e374a4756                                  0.0s
 => => exporting manifest list sha256:ea149847fd05e1b469ce86835cf7f4722a3cba6590e302ebf3d3e7869e42da90                                         0.0s
 => => naming to docker.io/sangam14/sidecarcontainer:latest                                                                                    0.0s
 => => unpacking to docker.io/sangam14/sidecarcontainer:latest                                                                                 0.0s
 => => pushing layers                                                                                                                          8.0s
 => => pushing manifest for docker.io/sangam14/sidecarcontainer:latest@sha256:ea149847fd05e1b469ce86835cf7f4722a3cba6590e302ebf3d3e7869e42da9  3.5s
 => [auth] sangam14/sidecarcontainer:pull,push token for registry-1.docker.io                                                                  0.0s
 => [auth] sangam14/servingcontainer:pull sangam14/sidecarcontainer:pull,push token for registry-1.docker.io                                   0.0s
 => pushing sangam14/sidecarcontainer with docker                                                                                              4.7s
 => => pushing layer c3d694a809a6                                                                                                              4.6s
 => => pushing layer cf04c63912e1                                                                                                              4.6s
 => => pushing layer e8a452786f60                                                                                                              4.6s
 => => pushing layer 62ffe345c65c                                                                                                              4.6s
 => => pushing layer 4d650751acc4                                                                                                              4.6s
 => => pushing layer ec4bf944c859                                                                                                              4.6s
 => => pushing layer 1b45ea6e206a                                                                                                              4.6s
 => => pushing layer 43c4264eed91                                                                                                              4.6s

here is knative service
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: multi-container
  namespace: default
spec:
  template:
    spec:
      containers:
      - image: docker.io/sangam14/servingcontainer:latest
        ports:
          - containerPort: 8881
      - image: docker.io/sangam14/sidecarcontainer:latest

After the build has completed and the container is pushed to Docker Hub, youcan deploy the app into your cluster. Ensure that the container image value in service.yaml matches the container you built in the previous step. Applythe configuration using kubectl
kubectl apply --filename service.yaml
service.serving.knative.dev/multi-container created

check kn service to get url
kn service list 
NAME              URL                                               LATEST                  AGE    CONDITIONS   READY   REASON
multi-container   http://multi-container.default.127.0.0.1.nip.io   multi-container-00001   51s    3 OK / 3     True


With Knative, you can easily run serverless applications on Kubernetes, combining the power of Kubernetes and the flexibility of serverless. The multi-container approach showcased here opens up even more possibilities for deploying complex applications



Infrastructure from code is new trend ?
Sangam Biradar — Tue, 10 Sep 2024 11:16:05 GMT
Infrastructure from Code a New Trend?  
Wait! I know Infrastructure as Code (IaC), that's Terraform. Terraform has been a cornerstone of IaC, providing developers with the ability to manage and automate infrastructure efficiently. However, recent events have made me concerned about its future, especially following HashiCorp's decision to switch Terraform's licensing to the Business Source License (BSL) and IBM’s intention to acquire HashiCorp. 

However, as the complexity of cloud environments and microservices architectures grows, there's an increasing need for even more dynamic, context-aware infrastructure that can adapt to changes in real-time. This is where "Infrastructure from Code" comes in - it takes the principles of IaC a step further by directly linking infrastructure creation and management to the application code itself.
What is Infrastructure from Code ?
Infrastructure as Code (IaC) like Terraform allows you to define your infrastructure using code, but Infrastructure from Code (IfC) takes it a step further by generating infrastructure directly from the application code itself.
In simpler terms, IfC automates the creation of infrastructure resources based on the requirements defined within your application code without requiring a separate infrastructure definition file. This concept bridges the gap between application development and infrastructure management by analyzing the application code, understanding its dependencies, and then automatically generating the necessary infrastructure.
https://blog.stackgen.com/what-is-infrastructure-from-code
 
Why is it a New Trend?
Yes, Infrastructure from Code (IfC) is an emerging trend, particularly in the context of modern DevOps practices and cloud-native development. As organizations increasingly adopt microservices, serverless architectures, and continuous delivery pipelines, the need for more streamlined and automated infrastructure management has grown. IfC addresses this need by making infrastructure provisioning a more integrated part of the development process.

refer - https://www.gartner.com/en/documents/5519995

Automation and Efficiency: Developers and operations teams are always looking for ways to reduce manual effort and increase efficiency. IfC automates the infrastructure provisioning process directly from the application code, reducing the need for separate infrastructure scripts.

Tight Integration: As applications become more complex, there's a growing need for infrastructure that is tightly integrated with the application itself. IfC ensures that the infrastructure is directly aligned with the codebase, reducing issues related to infrastructure drift and misconfiguration.

Context Aware: Based on the code requirements and available cloud resources, infrastructure is provisioned with security and application requirements covered. 

Serverless and Microservices: These architectures naturally lend themselves to Infrastructure from Code. In serverless, for instance, the boundaries between application code and infrastructure are often blurred. IfC fits well in these environments by allowing infrastructure to be defined and provisioned in a way that is tightly coupled with the application logic.

Tooling and Ecosystem: The trend is supported by new tools and frameworks that enable Infrastructure from Code. These tools are becoming more sophisticated, allowing for more complex infrastructure to be automatically generated from code. Examples include StackGen, AWS CDK (Cloud Development Kit) and Pulumi, which enable developers to define cloud infrastructure using familiar programming languages.

DevOps and GitOps: As DevOps practices evolve, there is a push towards making all aspects of development and operations code-centric. GitOps, for instance, emphasizes the use of Git as the single source of truth for both application code and infrastructure. IfC aligns with this philosophy by embedding infrastructure definitions within the application code itself.


Infrastructure from Code is indeed a new trend, driven by the need for more efficient, integrated, and automated infrastructure management in modern cloud-native development environments. It represents a natural evolution of DevOps practices, pushing towards even tighter integration between code and infrastructure with security best practices included by default.



Dockerizing Golang CLI Tool - A Step-by-Step Guide
Siddhesh Khandagale — Fri, 22 Sep 2023 18:30:15 GMT
Introduction
In the ever-evolving landscape of software development, where rapid deployment and seamless scalability are key, Docker has emerged as a game-changer. Whether you're a seasoned developer or just starting your journey into the world of containers, understanding Docker's core concepts and practical applications can significantly boost your development workflow.
This blog post aims to demystify Docker and guide you through the process of Dockerizing your Golang Command Line Interface (CLI) tool. We'll start from the ground up, covering Docker's fundamental principles, and then seamlessly transition into hands-on implementation. By the end of this guide, you'll not only grasp the essentials of Docker but also have a Dockerized Golang CLI tool ready to conquer your development tasks.
So, whether you're looking to improve the reproducibility of your projects, simplify deployment, or just harness the power of containerization for your Golang applications, you're in the right place. Let's embark on this journey to explore Docker and elevate your development process.
Understanding Docker
In today's fast-paced world of software development, agility and reproducibility are paramount. This is where Docker comes into play. Docker is a powerful platform that simplifies the way you create, deploy, and run applications. In this section, we'll lay the foundation by exploring the fundamentals of Docker.

What is Docker?
 Docker is an open-source platform designed to automate the deployment of applications inside lightweight, portable containers. These containers are self-sufficient units that encapsulate everything an application needs to run, including code, runtime, libraries, and system tools. Think of Docker containers as standardized, consistent environments that can run seamlessly on any system that supports Docker.
Key Advantages of Docker:

Isolation: Containers provide process and file system isolation, allowing applications to run independently without interfering with each other.

Portability: Docker containers are highly portable, making it easy to move applications across different environments, from development to production.

Resource Efficiency: Containers share the host operating system's kernel, which results in minimal overhead and faster startup times compared to traditional virtual machines.

Version Control: Docker allows you to version your containers and images, ensuring that your application behaves consistently across different stages of development and deployment.





Docker Components
 To better understand Docker, it's essential to be familiar with some of its components:
Image :

Definition: An image is a lightweight, standalone, and executable package that includes everything needed to run a piece of software, including the code, runtime, libraries, and dependencies.

Usage: Images serve as the blueprint for containers. When you run a container from an image, you're essentially starting an instance of that image.




Container :

Definition: A container is a runnable instance of an image. It encapsulates the application and all its dependencies while providing isolation from the host system and other containers.

Usage: Containers are where your applications execute. They are ephemeral, which means they can be created, started, stopped, and destroyed without affecting other containers or the host system.


Registry :

Definition: A registry is a centralized repository for storing Docker images. The most well-known registry is Docker Hub, which hosts a vast collection of publicly available images.

Usage: You can pull (download) and push (upload) Docker images to and from registries. This sharing of images enables collaboration and distribution of applications.



Docker v/s Virtual Machines
 
 Docker containers are often compared to virtual machines (VMs) because they both provide isolation. However, there are significant differences between the two:
Docker Containers :

Lightweight: Containers share the host OS kernel, making them smaller in size and more resource-efficient.

Faster Startup: Containers start quickly, often in seconds.

Resource Sharing: Containers are efficient at sharing resources with the host and other containers.




Virtual Machines :

Heavier: VMs include a full OS, making them larger in size and resource-intensive.

Slower Startup: VMs take longer to start, typically in minutes.

Resource Overhead: VMs have more significant resource overhead due to running a full OS.


    In summary, Docker containers offer a lightweight, efficient, and consistent way to package and run applications, making them an ideal choice for modern software development and deployment.
Getting Started

Installing Docker Desktop
 Now, you need to install the latest version of Docker Desktop. (You can download it here, do follow the steps given in it to start the Docker Desktop).

Building the CLI tool
 After installing the Docker Desktop, you need to have Golang and Cobra cli installed before building the CLI.
 For installing Cobra-CLI you can go to Cobra or run go install github.com/spf13/cobra-cli@latest in the terminal.
 After completing the Installation part to get started make a folder for eg. go-docker-cli , run the given command


go mod init github.com/Siddheshk02/go-docker-cli

(In place of Siddheshk02 use the name in which your project directories are. Now the structure will look like this)
Cobra-cli init

This command initializes the CLI and creates a main.go file along with cmd folder containing root.go

Now, we are going to build a simple Calculator CLI.
Let's add the commands for Addition, Subtraction, Multiplication and Division.
To add a new command run the following code,
Cobra-cli add add //adds an "add" command for addition
Cobra-cli add subtract //for subtraction
Cobra-cli add multiply //for multiplication
Cobra-cli add divide //for division

Now, let's define flags for the two integer values we need to take for the arithmetic operations.
package cmd

import (
    "fmt"

    "github.com/spf13/cobra"
)

var (
    num1, num2 int
)

// addCmd represents the add command
var addCmd = &cobra.Command{
    Use:   "add",
    Short: "Addition of two integers",
    Run: func(cmd *cobra.Command, args []string) {
        result := num1 + num2
        fmt.Printf("Result of %d + %d = %d\n", num1, num2, result)
    },
}

func init() {
    rootCmd.AddCommand(addCmd)

    addCmd.Flags().IntVar(&num1, "num1", 0, "First integer")
    addCmd.Flags().IntVar(&num2, "num2", 0, "Second integer")
}

This is how the add.go file will look after updating. Similarly, update the subtract.go , multiply.go and divide.go .
subtract.go :
var subtractCmd = &cobra.Command{
    Use:   "subtract",
    Short: "Subtraction of two integers",
    Run: func(cmd *cobra.Command, args []string) {
        result := num1 - num2
        fmt.Printf("Result of %d - %d = %d\n", num1, num2, result)
    },
}

func init() {
    rootCmd.AddCommand(subtractCmd)

    subtractCmd.Flags().IntVar(&num1, "num1", 0, "First integer")
    subtractCmd.Flags().IntVar(&num2, "num2", 0, "Second integer")
}

multiply.go :
var multiplyCmd = &cobra.Command{
    Use:   "multiply",
    Short: "Multiplication of two integers",
    Run: func(cmd *cobra.Command, args []string) {
        result := num1 * num2
        fmt.Printf("Result of %d * %d = %d\n", num1, num2, result)
    },
}

func init() {
    rootCmd.AddCommand(multiplyCmd)

    multiplyCmd.Flags().IntVar(&num1, "num1", 0, "First integer")
    multiplyCmd.Flags().IntVar(&num2, "num2", 0, "Second integer")
}

divide.go :
var divideCmd = &cobra.Command{
    Use:   "divide",
    Short: "Division of two integers",
    Run: func(cmd *cobra.Command, args []string) {
        result := num1 / num2
        fmt.Printf("Result of %d / %d = %d\n", num1, num2, result)
    },
}

func init() {
    rootCmd.AddCommand(divideCmd)

    divideCmd.Flags().IntVar(&num1, "num1", 0, "First integer")
    divideCmd.Flags().IntVar(&num2, "num2", 0, "Second integer")
}

Let's update the description for our CLI in the root.go , (update the rootCmd variable)
var rootCmd = &cobra.Command{
    Use:   "go-docker-cli",
    Short: "A Calculator CLI tool",
}

Now, Build and Run the CLI. Run the command go build . . This command compiles Go source code files in the current directory into an executable binary with the same name as the directory, allowing you to run the resulting program.
Run the CLI using the command ./go-docker-cli , This will give the output as shown below.
A Calculator CLI tool.

Usage:
  go-docker-cli [command]

Available Commands:
  add         Addition of two integers
  completion  Generate the autocompletion script for the specified shell
  divide      Division of two integers
  help        Help about any command
  multiply    Multiplication of two integers
  subtract    Subtraction of two integers

Flags:
  -h, --help     help for go-docker-cli
  -t, --toggle   Help message for toggle

Use "go-docker-cli [command] --help" for more information about a command.

Try running the other commands, ./go-docker-cli add --num1 3 --num2 4 this will give the output as Result of 3 + 4 = 7 . You can try other commands.
So, it's running and giving the results as expected :)
Now, let's delve into the steps for dockerizing our CLI app.
Dockerizing the CLI tool
Dockerization involves packaging your application and its dependencies into a Docker container, ensuring consistent and reproducible execution across different environments.

Creating the Dockerfile
 The first step in Dockerizing your Golang CLI tool is to create a Dockerfile. This file contains instructions for building a Docker image that encapsulates your application. Let's create a basic Dockerfile for our CLI calculator:
 # Use an official Golang runtime as a parent image
 FROM golang:alpine

 # Set the working directory inside the container
 WORKDIR /app

 # Copy the local package files to the container's workspace
 COPY . /app

 # Build the Go application inside the container
 RUN go build -o go-docker-cli

 # Define the command to run your application
 ENTRYPOINT ["./go-docker-cli"]

 Explanation:
 FROM golang:alpine: This states that Docker should start building your Docker image using the official Golang image that is based on Alpine Linux, a lightweight Linux distribution. This Golang image provides the base environment for building and running Go applications.
 WORKDIR /app : Here, we set the working directory inside the container to /app. This means that any subsequent commands in the Dockerfile will be executed in the context of the /app directory within the container. It's like changing to a specific folder when you're working on a computer.
 COPY . /app : This line copies the contents of your local directory (the directory where you have your Dockerfile and Golang code) into the /app directory inside the Docker container. It effectively transfers all your application files and code into the container's workspace.
 RUN go build -o go-docker-cli : Here, we instruct Docker to run a command inside the container. Specifically, it tells Docker to execute the go build command, which compiles your Golang code into an executable binary. The -o go-docker-cli part specifies that the output binary should be named "go-docker-cli."
 ENTRYPOINT ["./go-docker-cli"] : This line defines the entry point for your Docker container. When you run a container from this image, it will execute the specified command. In this case, it tells the container to run the "go-docker-cli" binary, which is the Golang application you compiled earlier.

Building the Docker Image
 Now, let's build the Docker Image. Run the following command,
 docker build -t siddheshk02/go-docker-cli:latest .

 Here, siddheshk02 is the username (use your username from the Docker Hub)
 This command builds a Docker image from your Golang CLI tool's source code and Dockerfile. The -t flag tags your image with a name and version (in this case, "siddheshk02/go-docker-cli:latest"). The . at the end specifies that the Dockerfile is in the current directory. This step creates a container image ready for distribution.
 Now, we'll push this Image to the Docker Hub. (Docker Hub is a central registry for Docker containers, enabling users to store, share, and distribute container images, making it an essential resource for containerization and application deployment.) Run the following command :
 docker push siddheshk02/go-docker-cli:latest

 After successfully building your Docker image, you can use this command to upload it to Docker Hub, a public registry for Docker images. By doing so, you make your Dockerized Golang CLI tool publicly accessible for anyone to download and use.
 For pulling the Image from the Docker Hub the command is :
 docker pull siddheshk02/go-docker-cli:latest


Running the Docker Container
 Now to run the Image you've built, use the following command :
 docker run go-docker-cli add --num1 2 --num2 4

 The specified subcommand "add" and accompanying flags "--num1" and "--num2" are passed to your Golang CLI tool inside the container. This step demonstrates how to execute your CLI tool within a containerized environment.
 Similarly to Subtract, Multiply and Divide you just need to use subtract, multiply and divide is instead of add along with the "--num1" and "--num2".


Conclusion

In conclusion, this blog has walked you through the fundamentals of Docker and how to Dockerize your Golang CLI tool, facilitating consistent deployment across diverse environments. By following the steps outlined here, you've learned to build, share, and run your containerized application, empowering you to harness the power of Docker for seamless software distribution and execution.
The complete code for this tutorial is updated on GitHub.
To get more information about Golang concepts and to stay updated on the Tutorials follow Siddhesh on Twitter and GitHub.
Until then Keep Learning, Keep Building 🚀🚀



eBPF for Cybersecurity - Part 4
Sangam Biradar — Fri, 19 May 2023 22:10:26 GMT
What is LSM?
The Linux Security Module is a framework that allows the kernel to support multiple security models simultaneously. It provides a way for security policies, such as access control or integrity checking, to be added to the kernel without requiring modifications to the kernel itself.
LSM enables the kernel to enforce security policies based on the security attributes of various objects, such as files, processes, or network connections. Some examples of security modules that use the LSM framework include SELinux (Security-Enhanced Linux), AppArmor, and Smack.
The use of LSM makes it easier to develop and integrate security policies in the Linux kernel and provides a more flexible and extensible approach to enforcing security.
LSM for eBPF
The eBPF LSM provides a security model that is based on the eBPF bytecode, which is a flexible and extensible mechanism for processing and filtering network packets and system calls. The LSM for eBPF allows users to attach eBPF programs to specific security hooks in the kernel, enabling fine-grained control over the behaviour of the system.
The eBPF LSM can be used to enforce security policies related to networking, system calls, file access, and other system resources. For example, it can be used to filter network traffic based on specific criteria or to monitor and restrict the behaviour of user processes.
The LSM for eBPF is a powerful tool for enhancing the security of Linux systems, and it is gaining popularity among developers and security experts due to its flexibility and versatility.
LSM Hooks and Documentation
all lsm hooks are documented here by categories
https://elixir.bootlin.com/linux/latest/source/include/linux/lsm_hooks.h
Contain full parameter passes to hook
https://elixir.bootlin.com/linux/latest/source/include/linux/lsm_hook_defs.h
hooks named different from caller
https://elixir.bootlin.com/linux/latest/source/include/linux/security.h
LSM + BPF

LSM hooks
Linux Security Modules (LSM) are a set of kernel features that allow for the customization of the security policy of the Linux kernel. LSM hooks are points in the kernel where LSM modules can be inserted to intercept and modify system calls. EBPF is a technology that allows programs to be written in the form of bytecode that can be executed directly in the Linux kernel.
Monitoring and enforcement via LSM hooks EBPF is a technique that uses LSM hooks and EBPF to monitor and enforce security policies on a Linux system. This technique can be used to monitor and enforce a wide variety of security policies, including:

File access

Network access

Process execution

System calls


Monitoring and enforcement via LSM hooks eBPF is a powerful technique that can be used to improve the security of a Linux system. This technique is relatively new, but it is gaining popularity due to its flexibility and performance.
Here are some of the benefits of using monitoring and enforcement via LSM hooks EBPF:

Flexibility: LSM hooks eBPF can be used to monitor and enforce a wide variety of security policies.

Performance: LSM hooks eBPF is a very efficient technique, and it does not have a significant impact on the performance of the system.

Scalability: LSM hooks eBPF can be used to monitor and enforce security policies on large systems.


Here are some of the challenges of using monitoring and enforcement via LSM hooks EBPF:

Complexity: LSM hooks eBPF is a complex technique, and it requires some knowledge of the Linux kernel.

Tooling: There are a limited number of tools available for developing and debugging LSM hooks EBPF programs.

Support: LSM hooks eBPF is a relatively new technique, and it is not yet widely supported by operating systems and security products.


Overall, monitoring and enforcement via LSM hooks EBPF is a powerful technique that can be used to improve the security of a Linux system. This technique is relatively new, but it is gaining popularity due to its flexibility and performance.
What can an LSM program do?
An LSM program can do a lot of things, but some of the most common things include:

Auditing system calls: An LSM program can be used to audit system calls, which means that it can track what system calls are being made and by whom. This can be useful for troubleshooting security problems or for gathering information about how a system is being used.

Controlling access to files and directories: An LSM program can be used to control access to files and directories. This can be useful for preventing unauthorized users from accessing sensitive data.

Monitoring system activity: An LSM program can be used to monitor system activity, such as which processes are running, which files are being accessed, and which network connections are being made. This can be useful for detecting security problems or for gathering information about how a system is being used.

Enforcing security policies: An LSM program can be used to enforce security policies. This can be useful for preventing unauthorized users from accessing sensitive data or for preventing malicious software from running on a system.


LSM programs are a powerful tool that can be used to improve the security of a Linux system. They are flexible and can be used to implement a wide variety of security policies.
Introducing eBPFGuard
https://github.com/deepfence/ebpfguard
 
Clone the ebpfguard repository
ubuntu@ip-172-31-56-217:~$ git clone https://github.com/deepfence/ebpfguard
Cloning into 'ebpfguard'...
remote: Enumerating objects: 820, done.
remote: Counting objects: 100% (147/147), done.
remote: Compressing objects: 100% (100/100), done.
remote: Total 820 (delta 61), reused 56 (delta 46), pack-reused 673
Receiving objects: 100% (820/820), 4.52 MiB | 25.14 MiB/s, done.
Resolving deltas: 100% (398/398), done.

update LLVM
sudo apt-get install libllvm-15-ocaml-dev libllvm15 llvm-15 llvm-15-dev llvm-15-doc llvm-15-examples llvm-15-runtime

check if your kernel has BPF LSM support:
$ cat /sys/kernel/security/lsm
lockdown,capability,landlock,yama,apparmor

in my case, it's not installed follow prerequisites
https://github.com/deepfence/ebpfguard/blob/main/docs/gh/prerequisites.md
updated bpf lsm
Install required packages and tools
$ sudo apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    clang \
    libclang-dev \
    linux-tools-$(uname -r)

$ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
$ rustup target add x86_64-unknown-linux-musl
$ cargo install bindgen-cli
$ cargo install bpf-linker --git https://github.com/noboruma/bpf-linker

mount
The mount example shows how to define a policy for sb_mount, sb_remount and sb_umount LSM hooks as Rust code. It denies the mount operations for all processes except for the optionally given one.
in following folder examples/mount/examples/mount.rs
use std::{
    fs::{create_dir_all, remove_dir_all},
    path::PathBuf,
};

use clap::Parser;
use ebpfguard::{
    policy::{PolicySubject, SbMount, SbRemount, SbUmount},
    PolicyManager,
};
use log::info;

#[derive(Debug, Parser)]
struct Opt {
    #[clap(long, default_value = "/sys/fs/bpf")]
    bpffs_path: PathBuf,
    #[clap(long, default_value = "example_sb_mount")]
    bpffs_dir: PathBuf,
    /// Binary which should be allowed to mount filesystems.
    #[clap(long)]
    allow: Option,
}

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    let opt = Opt::parse();

    env_logger::init();

    // Create a directory where ebpfguard policy manager can store its BPF
    // objects (maps).
    let bpf_path = opt.bpffs_path.join(opt.bpffs_dir);
    create_dir_all(&bpf_path)?;

    // Create a policy manager.
    let mut policy_manager = PolicyManager::new(&bpf_path)?;

    // Attach the policy manager to the mount LSM hooks.
    let mut sb_mount = policy_manager.attach_sb_mount()?;
    let mut sb_remount = policy_manager.attach_sb_remount()?;
    let mut sb_umount = policy_manager.attach_sb_umount()?;

    // Get the receiver end of the alerts channel (for the `file_open` LSM
    // hook).
    let mut sb_mount_rx = sb_mount.alerts().await?;
    let mut sb_remount_rx = sb_remount.alerts().await?;
    let mut sb_umount_rx = sb_umount.alerts().await?;

    // Define policies which deny mount operations for all processes (except
    // for the specified subject, if defined).
    sb_mount
        .add_policy(SbMount {
            subject: PolicySubject::All,
            allow: false,
        })
        .await?;
    sb_remount
        .add_policy(SbRemount {
            subject: PolicySubject::All,
            allow: false,
        })
        .await?;
    sb_umount
        .add_policy(SbUmount {
            subject: PolicySubject::All,
            allow: false,
        })
        .await?;
    if let Some(subject) = opt.allow {
        sb_mount
            .add_policy(SbMount {
                subject: PolicySubject::Binary(subject.clone()),
                allow: true,
            })
            .await?;
        sb_remount
            .add_policy(SbRemount {
                subject: PolicySubject::Binary(subject.clone()),
                allow: true,
            })
            .await?;
        sb_umount
            .add_policy(SbUmount {
                subject: PolicySubject::Binary(subject),
                allow: true,
            })
            .await?;
    }

    info!("Waiting for Ctrl-C...");

    // Wait for policy violation alerts (or for CTRL+C).
    loop {
        tokio::select! {
            Some(alert) = sb_mount_rx.recv() => {
                info!(
                    "sb_mount: pid={} subject={}",
                    alert.pid,
                    alert.subject,
                );
            }
            Some(alert) = sb_remount_rx.recv() => {
                info!(
                    "sb_remount: pid={} subject={}",
                    alert.pid,
                    alert.subject,
                );
            }
            Some(alert) = sb_umount_rx.recv() => {
                info!(
                    "sb_umount: pid={} subject={}",
                    alert.pid,
                    alert.subject,
                );
            }
            _ = tokio::signal::ctrl_c() => {
                break;
            }
        }
    }

    info!("Exiting...");
    remove_dir_all(&bpf_path)?;

    Ok(())
}

create two directory inside ebpfguard repo
$ mkdir /tmp/test1
$ mkdir /tmp/test2

run policy program without binary
~/ebpfguard$ RUST_LOG=info cargo xtask run --example mount
    Finished dev [unoptimized + debuginfo] target(s) in 0.09s
     Running `target/x86_64-unknown-linux-musl/debug/xtask run --example mount`
       Fresh unicode-ident v1.0.8
       Fresh proc-macro2 v1.0.58
       Fresh libc v0.2.144
       Fresh quote v1.0.27
       Fresh syn v2.0.16
       Fresh bitflags v1.3.2
       Fresh io-lifetimes v1.0.10
       Fresh linux-raw-sys v0.3.7
       Fresh cfg-if v1.0.0
       Fresh rustix v0.37.19
       Fresh glob v0.3.1
       Fresh utf8parse v0.2.1
       Fresh anstyle-parse v0.2.0
       Fresh memchr v2.5.0
       Fresh is-terminal v0.4.7
       Fresh colorchoice v1.0.0
       Fresh anstyle v1.0.0
       Fresh minimal-lexical v0.2.1
       Fresh core v0.0.0 (/home/ubuntu/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core)
       Fresh anstyle-query v1.0.0
       Fresh rustc-std-workspace-core v1.99.0 (/home/ubuntu/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/rustc-std-workspace-core)
       Fresh anstream v0.3.2
       Fresh nom v7.1.3
       Fresh libloading v0.7.4
       Fresh either v1.8.1
       Fresh regex-syntax v0.7.1
       Fresh clap_lex v0.4.1
       Fresh heck v0.4.1
       Fresh strsim v0.10.0
       Fresh clap_derive v4.2.0
       Fresh clap_builder v4.2.7
       Fresh regex v1.8.1
       Fresh which v4.4.0
       Fresh clang-sys v1.6.1
       Fresh cexpr v0.6.0
       Fresh log v0.4.17
       Fresh compiler_builtins v0.1.91
       Fresh prettyplease v0.2.5
       Fresh thiserror-impl v1.0.40
       Fresh shlex v1.1.0
       Fresh once_cell v1.17.1
       Fresh peeking_take_while v0.1.2
       Fresh lazy_static v1.4.0
       Fresh lazycell v1.3.0
       Fresh fastrand v1.9.0
       Fresh rustc-hash v1.1.0
       Fresh tempfile v3.5.0
       Fresh bindgen v0.65.1
       Fresh clap v4.2.7
       Fresh thiserror v1.0.40
       Fresh anyhow v1.0.71
       Fresh rustversion v1.0.12
       Fresh aya-tool v0.1.0 (https://github.com/deepfence/aya-rs?branch=btf-fixes#611950e7)
       Fresh aya-bpf-cty v0.2.1 (https://github.com/deepfence/aya-rs?branch=btf-fixes#611950e7)
       Fresh aya-bpf-bindings v0.1.0 (https://github.com/deepfence/aya-rs?branch=btf-fixes#611950e7)
       Fresh aya-bpf-macros v0.1.0 (https://github.com/deepfence/aya-rs?branch=btf-fixes#611950e7)
       Fresh aya-bpf v0.1.0 (https://github.com/deepfence/aya-rs?branch=btf-fixes#611950e7)
       Fresh ebpfguard-common v0.1.0 (/home/ubuntu/ebpfguard/ebpfguard-common)
       Fresh ebpfguard-ebpf v0.1.0 (/home/ubuntu/ebpfguard/ebpfguard-ebpf)
    Finished dev [optimized + debuginfo] target(s) in 0.16s
   Compiling ebpfguard v0.1.0 (/home/ubuntu/ebpfguard/ebpfguard)
   Compiling mount v0.1.0 (/home/ubuntu/ebpfguard/examples/mount)
    Finished dev [unoptimized + debuginfo] target(s) in 6.68s
[2023-05-19T21:35:30Z INFO  mount] Waiting for Ctrl-C...

open new terminal bind mount the directory it will fail
$ sudo mount --bind /tmp/test1 /tmp/test2
mount: /tmp/test2: permission denied.

check it out more example https://github.com/deepfence/ebpfguard/tree/main/examples
Reach out to me on Twitter @sangamtwts
Thanks for reading! give a star to https://github.com/deepfence/ebpfguard project !



Simplifying open-source contributions & Git-GitHub: A Practical Guide
Ayush Tripathi — Tue, 09 May 2023 15:22:23 GMT
In this blog, I'll be explaining Git-GitHub to the extent that is enough to do open-source contributions like a professional. I'll also demonstrate a straightforward approach to contributing, you can use this approach without a second thought for most of your contributions.
Open source refers to software whose source code is freely available to the public and can be modified, studied, and distributed by anyone. Open-source software is often created collaboratively by a community of developers who share their work and contribute to the improvement of the software.
Why contribute to Open Source?

Open source is the future, day by day we see more and more freely available open-source software (Hashnode being one of them) coming to the tech world.

You get to connect with a lot of folks, work and learn under their guidance.

It opens the doorway to remote jobs where you can work at your leisure.


Let us start with the basics (If you are familiar with the basics, feel free to jump to the last section)
What is Git?

Git is a VCS (Version Control System) used to track changes in a repository (repo) or folder.

Both code and non-code (documentation) changes are tracked using Git.

Git is used to collaborate on code (multiple developers working on the same code).
 When you make a change in your project, you won't have to send the files to all the team members, just send a PR. (Pull Request)


What is GitHub?

GitHub is a web-based platform for hosting and managing Git repositories. It provides developers with a centralized location to store and manage their code, collaborate with others, and track changes over time.

It is like Google Drive for all your code with collaboration features :)


Installation

Go to this link: Git download

Download the version as per your system and install it.

Make sure to go with the recommended options.

Lastly, make sure the path in the system is enabled for all terminals (even 3rd party) and not just Git Bash.



Verifying installation
git --version


This command shows the version of Git installed on your system. Next, you can go around exploring Git using by writing just "git" or ''git --help'
git 
git --help

Configuring Git for the first time
git config --global user.name “”
git config --global user.email “”

Fork & Pull Request
The forked repo is the clone of the main repo that you want to contribute into. It is the copy of the main repo, it is made to ensure that the main code is not directly affected.
Any change made in the forked repo does not affect the main repo. When you make a change in your forked repo by pushing the changes (sending the changes) you get the option of creating a Pull Request.


Pull Request is the request you send to the maintainer or owner of the main repo to merge your code in their codebase. The name “pull request” comes from the idea that you're requesting the project to “pull” changes from your fork.

Basic Git commands and features
git init: To initialize an empty git repository on your local system.
This means that every change in the folder in which this command is executed will be tracked by git.
git init

git remote: To check and manipulate the URLs associated with the repository.
URLs mean the GitHub repo link that you need to collaborate on.
git remote specifies the names of the URLs associated with the git local repo.
git remote -v is the verbose version of this, that is, it shows the names of the URLs along with the URLs. (output attached in last section)
git remote
git remote -v

git remote add : To add a remote URL. The URL name can be anything, but the standard convention is to name the forked repo URL "origin" and the main repo URL "upstream".
git remote rm : To remove a URL from the list of remote URLs for a repo.
A local git repo can have any number of remote URLs, just make sure that names are unique.
Remote URLs are nothing but GitHub repo links.
git remote add  
git remote rm 

git branch: To check which branch is currently active. All the changes done in one branch are associated with that branch only and do not have any effect on any other branch.
git branch

git branch : To create a new branch.
git branch 

git checkout : To change the current working directory. (to move to a different branch)
git checkout 

git checkout -b : This is a shortcut to create and move to the branch in just one command.
git checkout -b 

git status: To check the status and changes in the working directory. (any and every change in the repo is tracked, but this command shows the changes associated only with the current branch)
git status

git add: Adding the changes / staging the changes.
In Git, there is a concept of a staging area and working directory.
Working directory - the directory/folder of the current branch constitutes the working directory, the WD is different for different branches. It means that every branch has different files because every branch is used to develop a different feature without any over-ridding of any other branch.
Staging area - Here we don't make any changes, it is automatically handled by Git, a file is said to be in the staging area when it is added to it using the git add command.
git add 
git add .

git commit: Committing the changes with a custom message. This creates a commit for all the files added previously using git add.
git commit -m "commit-message"

git push: Pushing the changes to the repo.
Remember, only one PR (Pull Request) is associated with one branch. So, if you push another change through the same branch before merging of PR, it will just get added to the same PR.
git push  

If you are the maintainer then no Pull Request is required but in the case of collaborators a PR or Pull Request needs to be sent to the main repo from your forked repo.
git merge: To merge any branch with any other branch. This is generally used to merge any other branch with the main branch.
git merge 

git log: To check the commit history of the working directory of the current branch.
git log

Rolling back to previous versions is one of the most important features of a VCS. In the case of Git, this can be done in many ways: git reset, git revert, etc. But to keep the process simple and easy to understand I'll stick to git reset.
git reset: To move to any previous commit from the history.
There are two types of reset - hard and soft, but for simplicity purposes, just use the command as written. You will eventually have to learn the advanced commands as per your needs.
There is also a command known as git revert, now this command is the same as git reset with the only difference being that it created a new commit to go back to any commit. For a straightforward approach, let's stick with git reset.
git reset 

git clone: To create a copy of the fork that you have created of any GitHub repository on your local system.
git clone 

git pull  : To pull the changes in the upstream GitHub repository onto your local system.
If multiple developers are working on a project, it generally happens that before you submit your PR some other developer's PR is already merged and the entire codebase is updated on GitHub. So, it is advisable to pull changes onto your local system and forked repo from time to time. It is especially important before submitting a new PR.
git pull  

git stash: To stash all changes which were being tracked by Git. This rolls back the entire branch to the way it was before any change was done (Note: doesn't rollback a commit)
git stash pop: To bring back the changes saved in the stash.
git stash drop: To delete the stash files and changes.
For example, you were working on a feature but due to time constraints have to work on some other feature, so you just stash the changes and after completing the required work you pop the stash back and continue your work.
git stash 
git stash pop
git stash drop

Possible Roles in Open-Source
There are three roles possible - Owner, Maintainer and Collaborator.
Owner - In this role, you are the one who has created the repo and is responsible for maintaining it.
Maintainer - This role is found in projects which are considerably large and cannot be maintained by a single developer. Maintainers have certain admin rights given to them by the owner and they make sure that the codebase doesn't break.
Collaborator - In this role, you have forked (explained ahead) the repo for collaboration purposes and are responsible for pushing changes to the code.
(For open-source contributions, you are the collaborator or contributor)
Approach for open-source contributions
1. Fork the repo you want to contribute in


This is the forked repository, the top-left corner shows the "forked from" repo.
2. git clone (init is included)


3. git branch (never make changes on the main branch)


Creating a new branch and then moving to that branch.
4. Add the required remote URLs

5. git pull (always make sure your local repo is up to date with the main repo)

6. git ACP - add, commit, push (make changes / create new feature)
First, make some changes / Add a feature.


You can make changes in a branch and merge (git merge) it with the main branch then push the main branch instead as well.


7. Opening a PR
Go to the GitHub page of your forked repository.

Click on "Compare and pull request" -> "Create pull request"

Now you can find your PR in the upstream repository. Then, wait for a comment from the maintainer or merge successful mail.


I have tried to simplify the entire Git-GitHub into a streamlined approach because a lot of developers get confused with multiple commands. As a beginner in open-source, you can follow this exact procedure without any second thoughts. Hope it helped you!
Connect with me on my socials: https://linktr.ee/ayusht02



Caching in Golang
Siddhesh Khandagale — Fri, 05 May 2023 11:18:56 GMT
Introduction
Caching is an important technique used in web development to improve the performance of applications. It involves storing frequently accessed data in a temporary storage area, such as in-memory, to reduce the amount of time required to fetch the data from its source.
There are different types of caching, including in-memory caching, database caching, and file-based caching. Each type has its advantages and disadvantages, and choosing the right one depends on the specific use case and the requirements of the application.
In-memory caching is one of the simplest and fastest caching methods available, making it a popular choice for many applications. It involves storing data in the memory of the server, making it quickly accessible to the application without the need for any external dependencies.
In this blog post, we will focus on in-memory caching in Golang and demonstrate its implementation using a simple API as an example. By the end of this blog, you'll have a solid understanding of in-memory caching works.
Prerequisites
To continue with the tutorial, firstly you need to have Golang and Fiber installed.
Installations :

Golang

Fiber: We'll see this ahead in the tutorial.


Getting Started 🚀
Let's get started by creating the main project directory Go-Cache-API by using the following command.
(🟥Be careful, sometimes I've done the explanation by commenting in the code)
mkdir Go-Cache-API //Creates a 'Go-Cache-API' directory
cd Go-Cache-API //Change directory to 'Go-Cache-API'

Now initialize a mod file. (If you publish a module, this must be a path from which your module can be downloaded by Go tools. That would be your code's repository.)
go mod init github.com//Go-Cache-API // is your github username

To install the Fiber Framework run the following command :
go get -u github.com/gofiber/fiber/v2

For implementing the In-Memory Caching we are going to use go-cache , to install it run the following command :
go get github.com/patrickmn/go-cache

go-cache is an in-memory key: value store/cache similar to memcached that is suitable for applications running on a single machine.
Now, let's make the main.go in which we are going to define the routes.
package main

import (
    "time"
    "github.com/gofiber/fiber/v2"
    "github.com/Siddheshk02/Go-Cache-API/middleware"
    "github.com/Siddheshk02/Go-Cache-API/routes"
    "github.com/patrickmn/go-cache"
)

func main() {
    app := fiber.New() // Creating a new instance of Fiber.

    //cache := cache.New(10*time.Minute, 20*time.Minute) // setting default expiration time and clearance time.

    app.Get("/", func(c *fiber.Ctx) error {
        return c.SendString("Hello, World 👋!")
    })
    //app.Get("/posts/:id", middleware.CacheMiddleware(cache),   routes.GetPosts) //commenting this route just to test the "/" endpoint.
    app.Listen(":8080")
}

In the main.go file, the first step is to initialize a new Fiber app using the fiber.New() method. This creates a new instance of the Fiber framework that will handle the HTTP requests and responses.
We are going to use https://jsonplaceholder.typicode.com/ for fetching example data. We are going to fetch data from /posts endpoint. Jsonplaceholder provides fake data for many other api endpoints you can try for any.
The cache.New() function takes two arguments:

The first argument is the amount of time that a cache entry should live before it's automatically evicted. In this case, it's set to 10 minutes.

The second argument is the amount of time that a cache entry can remain idle (without being accessed) before it's automatically evicted. In this case, it's set to 20 minutes.


After running the go run main.go command the terminal will look like this,

You can now uncomment all the code lines.
As you can see a middleware function is added to the /posts route. When a request is made to this endpoint, the server will first execute the CacheMiddleware function with a cache parameter. This middleware function is responsible for checking if the requested data is already cached and returning it from the cache instead of making a new API call. If the data is not present in the cache, the middleware function will pass the request to the next function in the middleware chain, which is routes.GetPosts.
routes.GetPosts is a function that will be executed when the request reaches this point. This function will handle the request by making a GET request to the external API at https://jsonplaceholder.typicode.com/posts/:id to fetch the post data. The :id part of the URL is a placeholder that will be replaced with the actual ID of the post being requested.
Let's define the CacheMiddleware() function for this, make a folder middleware in the main directory. In this make a file cache.go.
package middleware

import (
    "encoding/json"
    "time"

    "github.com/gofiber/fiber/v2"
    "github.com/patrickmn/go-cache"
)

type Post struct {
    UserID int    `json:"userId"`
    ID     int    `json:"id"`
    Title  string `json:"title"`
    Body   string `json:"body"`
}

func CacheMiddleware(cache *cache.Cache) fiber.Handler {
    return func(c *fiber.Ctx) error {
        if c.Method() != "GET" {
            // Only cache GET requests
            return c.Next()
        }

        cacheKey := c.Path() + "?" + c.Params("id") // Generate a cache key from the request path and query parameters

        // Check if the response is already in the cache
        if cached, found := cache.Get(cacheKey); found {
            return c.JSON(cached)
        }
        err := c.Next()
        if err != nil {
            return err
        }

        var data Post
        cacheKey := c.Path() + "?" + c.Params("id")

        body := c.Response().Body()
        err = json.Unmarshal(body, &data)
        if err != nil {
            return c.JSON(fiber.Map{"error": err.Error()})
        }

        // Cache the response for 10 minutes
        cache.Set(cacheKey, data, 10*time.Minute)

        return nil
    }
}

The middleware function CacheMiddleware that takes a pointer to a cache.Cache object as an argument and return a fiber.Handler function.
The middleware function first checks if the HTTP method of the request is GET. If it is not a GET request, it simply passes the request to the next middleware function.
If it is a GET request, it generates a cache key by concatenating the request path and query parameters. It then checks if the response for that cache key is already present in the cache by using the Get method of the cache.Cache object. If the response is present in the cache, it returns the cached response using the JSON method of the fiber.Ctx object.
If the response is not present in the cache, it calls the next middleware function by using the Next method of the fiber.Ctx object. It then creates a new cache key by concatenating the request path and query parameters, and reads the response body using the Response().Body() method of the fiber.Ctx object. It then unmarshals the response body into a Post struct using the json.Unmarshal method.
If there is an error in unmarshaling the response body, it returns an error response using the JSON method of the fiber.Ctx object.
If there is no error, it caches the response for 10 minutes using the Set method of the cache.Cache object and returns nil to indicate that the middleware function has completed processing the request.
Now, let's define the GetPosts() function for this, make a folder routes in the main directory. In this make a file routes.go.
package routes

import (
    "encoding/json"
    "io/ioutil"
    "log"
    "net/http"

    "github.com/gofiber/fiber/v2"
)

type Post struct {
    UserID int    `json:"userId"`
    ID     int    `json:"id"`
    Title  string `json:"title"`
    Body   string `json:"body"`
}

func GetPosts(c *fiber.Ctx) error {
    id := c.Params("id") // Get the post ID from the request URL parameters
    if id == "" {
        log.Fatal("Invalid ID")
    }

    // Fetch the post data from the API
    resp, err := http.Get("https://jsonplaceholder.typicode.com/posts/" + id)
    if err != nil {
        return c.JSON(fiber.Map{"error": err.Error()})
    }
    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        return c.JSON(fiber.Map{"error": err.Error()})
    }

    var data Post
    err = json.Unmarshal(body, &data)
    if err != nil {
        return c.JSON(fiber.Map{"error": err.Error()})
    }

    return c.JSON(data)

}

This function first extracts the ID parameter from the URL using c.Params("id"). If the ID is not provided or is invalid, it logs a fatal error.
It then makes an HTTP GET request to the https://jsonplaceholder.typicode.com/posts/ API with the provided ID as the endpoint. It checks for any errors during the request and returns an error response if an error occurs.
The response body is then read using the ioutil.ReadAll() function and unmarshaled into a Post struct using json.Unmarshal(). If an error occurs during the unmarshaling, an error response is returned.
Finally, the function returns a JSON response with the Post data. this data is then stored in the cache by the CacheMiddleware() function.
Now, if we want to determine if the response is coming from the cache or the API server, we'll add a header to the response indicating whether the response was served from the cache or not. We'll add a custom header named Cache-Status and set its value to HIT or MISS depending on whether the response was served from the cache or not. So, the CacheMiddleware() function will look like :
package middleware

import (
    "encoding/json"
    "time"

    "github.com/gofiber/fiber/v2"
    "github.com/patrickmn/go-cache"
)

type Post struct {
    UserID int    `json:"userId"`
    ID     int    `json:"id"`
    Title  string `json:"title"`
    Body   string `json:"body"`
}

func CacheMiddleware(cache *cache.Cache) fiber.Handler {
    return func(c *fiber.Ctx) error {
        if c.Method() != "GET" {
            // Only cache GET requests
            return c.Next()
        }

        cacheKey := c.Path() + "?" + c.Params("id") // Generate a cache key from the request path and query parameters

        // Check if the response is already in the cache
        if cached, found := cache.Get(cacheKey); found {
            c.Response().Header.Set("Cache-Status", "HIT")
            return c.JSON(cached)
        }

        c.Set("Cache-Status", "MISS")
        err := c.Next()
        if err != nil {
            return err
        }

        var data Post
        cacheKey := c.Path() + "?" + c.Params("id")

        body := c.Response().Body()
        err = json.Unmarshal(body, &data)
        if err != nil {
            return c.JSON(fiber.Map{"error": err.Error()})
        }

        // Cache the response for 10 minutes
        cache.Set(cacheKey, data, 10*time.Minute)

        return nil
    }
}

Let's test the API, run go run main.go in the terminal, after getting the same output as earlier, open any API testing tool for example Postman.
Enter the URL : http://127.0.0.1:8080/posts/1 then press enter.
Output :
{
    "userId": 1,
    "id": 1,
    "title": "sunt aut facere repellat provident occaecati excepturi optio reprehenderit",
    "body": "quia et suscipit\nsuscipit recusandae consequuntur expedita et cum\nreprehenderit molestiae ut ut quas totam\nnostrum rerum est autem sunt rem eveniet architecto"
}

Now click on the Headers option, you can see Cache-Status : MISS. Press Enter again for the same ID and see the Cache-Status. Now it is changed to HIT. This shows that the second time when the same parameters were passed the response was sent through the cache.
This is the Basic implementation of In-Memory Caching in Golang.
Conclusion ✨💯

You can find the complete code repository for this tutorial here 👉Github.
In Golang, you can implement caching using in-memory cache systems like the one we discussed in this blog post. By using a middleware function, you can easily integrate caching into your Golang web applications and reduce the response time for your users.
However, caching can also lead to stale data if not managed properly. It is important to consider the cache expiration time and update the cache whenever the underlying data changes.
Overall, caching can be a great addition to your web development toolkit, and I hope this blog post has provided a useful introduction to in-memory caching in Golang.
To get more information about Golang concepts, projects, etc. and to stay updated on the Tutorials do follow Siddhesh on Twitter and GitHub.
Until then Keep Learning, Keep Building 🚀🚀



Build your first Docker Extension
Shravani Kadam — Mon, 10 Apr 2023 09:14:41 GMT
TABLE OF CONTENTS :

Introduction to Docker Extensions.

Prerequisites.

Getting Started.

Building the Extension.

Installing the Extension in the Docker Desktop.

Updating and Rebuilding the Extension.

Open Chrome Dev Tools.

Validate your Extension.

Build the extensions for multiple architectures.


Introduction:
What are Docker Extensions?

Docker Extensions are a way to add new functionality to the Docker Desktop Application.

Developers can easily integrate their preferred development tools into their application development and deployment workflows via extensions.

Communities, Partners, and Individuals can contribute to Docker Desktop by building and publishing their extensions.

It is a way to discover new tools to solve existing problems.


Prerequisites:
To follow along with this tutorial, you'll need

The latest version of Docker Desktop.

Install the latest version of Docker Desktop.
Getting Started!!
Create the extension file
Type the following command in your CLI to create an extension file.
docker extension init my_extension

A few questions to set up your "my_extension" directory will be asked as you start with this command in your CLI.

cd my_extension

You should be able to see these files in your directory ( I have opened the directory in my VS Code ) recommend you do the same.

Here, the ui folder contains a react application and the backend folder contains a Go backend service for the application.
Makefile helps you run things locally, ensuring that the environment is exactly what it will be when you run it on your servers. On top of that, it removes the need to install every tool locally and instead allows you to simply run a docker command to have your application running.
Dockerfile is a text file of instructions that are used to automate the installation and configuration of a Docker image.
Docker Compose.yaml is used for running multiple containers as a single service. Each of the containers here runs in isolation but can interact with each other when required. With Compose, you use a YAML file to configure your application's services.
metadata.json contains information about the extension.
Building the Extension
A docker extension is the Docker image, so first let's try to build the extension image.
docker build -t my/docker-extension:latest .


Three steps of a multi-stage Dockerfile are offered while building our extension :
The first builds the backend service, the second the React app, and the third copies the backend binaries and the React components. The backend service is then launched with the CMD command, which uses a socket to watch for requests from the React app.
To build the extension, use either docker build or the preset make build-extension command.
Installing the Extension in the Docker Desktop
docker extension install my/docker-extension:latest

y


Open your Docker Desktop application, you'll be able to see your Extension named My Extension as well as the container for the Extension.

Click on My Extension
Your very first Extension is ready. Hurraayy!!!

Now click on the Call backend button and you'll be able to see the response from the Backend saying ''hello''.

We can check that the extension has been installed using the following CLI command
docker extension ls

Output:

Updating and Rebuilding the Extension
Let's make minor changes to our Code
In the main.go file, we have made the changes in our message from "hello" to "hello, this is our First Extension!!!"
Save the file.

In the App.tsx file,
We have added an Extension UI API (The extension UI API provides a way for the frontend to perform different actions and communicate with the Docker Desktop dashboard or the underlying system.)

Toasts provide a brief notification to the user. They appear temporarily and shouldn’t interrupt the user experience. They also don’t require user input to disappear.
The Success!!! message will be displayed on the Docker Desktop Dashboard.
Visit https://docs.docker.com/desktop/extensions-sdk/dev/api/dashboard/ for more such toast messages.
Let's build our application again in order to affect the changes that we made in our code.
docker build -t my/docker-extension:latest .


NOTE: After building your application you cannot try to install it again with the same command you used to install your application for the first time as it will throw an error saying the application is already installed.
We need to update our extension :
docker extension update my/docker-extension:latest

y



Congrats!! We have successfully updated our Extension...
Open Chrome Dev Tools
In order to open the Chrome Dev Tools for your extension when clicking on the extension tab, run:
docker extension dev debug my/docker-extension:latest


In order to stop the debug mode, use the following command:
docker extension dev reset my/docker-extension:latest


Validate your Extension
Validate your extension before you share or publish it. Validating the extension ensures:

That the extension is built with the image labels it requires to display correctly in the marketplace

That the extension installs and runs without problems

The validation checks if the extension’s Dockerfile specifies all the required labels and if the metadata file is valid against the JSON schema file.


To validate your extension, run:
docker extension validate 

If your extension is valid, you will receive the message as:
The extension image "name-of-your-extension" is valid

Build the extensions for multiple architectures
Docker Desktop retrieves the extension image according to the user’s system architecture.
If the extension does not provide an image that matches the user’s system architecture, Docker Desktop is not able to install the extension. As a result, users can’t run the extension in Docker Desktop.
To build the extension for multiple architectures, use the following command
Here the username should be your docker hub username.
docker buildx build --push --platform linux/amd64,linux/arm64 --tag username/my-extension:0.0.1 .


TAKE A LOOK AT THE ERROR MESSAGE...
The issue is that the default driver for docker(which is named docker) does not support multi-architecture builds.
Multi-architecture images are images that can be used on multiple platforms. For example, images that can run on Intel Macs(amd64) and M1 Macs (arm64). You will find this useful, as most users of your images would use them on various platforms.
To solve this create a new builder, using a different driver like docker-container which supports multi-architecture builds.
STEPS FOR CREATING YOUR CUSTOM BUILDER

Create your custom builder by running
  docker buildx create --name mycustombuilder --driver docker-container --bootstrap





Ask docker to use this new builder for future builds by running
  docker buildx use mycustombuilder


Inspect buildx to see if docker has indeed switched builders to the new one you asked it to use by running
  docker buildx inspect

  


Good! Now you can build extension for multiple architectures by running the following command
DO NOT FORGET TO SPECIFY YOUR DOCKER HUB USERNAME
docker buildx build --push --platform linux/amd64,linux/arm64 --tag username/my-extension:0.0.1 .


Once the build is complete, go to your docker hub account and check the newly pushed image in your repository

Click on the Image which you pushed recently

We can now see that the image supports multi-architecture..
THANK YOU FOR READING...



Exploring the Features and Functionality of Traefik Yaegi
Kiran Satya Raj — Sun, 26 Feb 2023 13:07:41 GMT
Why?
Well, I want to understand the project, so that I can get involved with it because it seems complex, at least at this point, Yes it does
I spent a reasonable amount of time learning Go, but I didn't harness it by building projects and contributing to open source projects, I believe this can help me understand Golang even better.
I'm unfamiliar with the terminology of the project, I don't understand the idea and why we have it.
How To Use Yaegi CLI
Installation steps
# you may get permission denied error so it's better to execute it as sudo
# Output:
$ sudo curl -sfL https://raw.githubusercontent.com/traefik/yaegi/master/install.sh | sudo bash -s -- -b $GOPATH/bin v0.9.0
traefik/yaegi info checking GitHub for tag 'v0.9.0'
traefik/yaegi info found version: 0.9.0 for v0.9.0/linux/amd64
traefik/yaegi info installed /bin/yaegi


Despite being static and strongly typed, Go feels like a dynamic language. The standard library even provides the Go parser used by the compiler and the reflection system to interact dynamically with the runtime. So why not just take the last logical step and finally build a complete Go interpreter? - Announcing Yaegi


Here's an example of it, it's a simple program that prints the average of a slice of numbers, and I've added a new function that gives the median of that slice of ints, the code is pretty self-explanatory
  Sample code: RUN
  # Creating a go file
  $ cd 
  $ mkdir yaegi-test && cd yaegi-test
  $ code main.go 
  # pasting the sample code given above and saving it(ctrl + s)
  package main

  import "fmt"

  var nums = []int{1, 2, 3, 4, 5}

  func main() {
      sum := 0
      for _, num := range nums {
          sum += num
      }
      average := float64(sum) / float64(len(nums))
      fmt.Println("The average is", average)
  }

  output:
  # opening the terminal in vscode(ctrl + `)
  $ go run main.go

  The average is 3

  yaegi run main.go interprets the program, and compiles at runtime, one way to check is to declare a variable and don't use it, and print a simple message
  package main

  func main() {
      var k int
      println("Hello, 世界")
  }

  $ go run main.go
  # command-line-arguments
  ./main.go:4:6: k declared and not used
  $ yaegi run main.go
  Hello, 世界

  Note that, you need to have the file saved first before you run the interactive yaegi REPL on the program
  Now in the program's home directory, I'm executing this
  yaegi run -i main.go
  i - the program runs and this flag starts a new interactive REPL within the program's context, any program we run within the reply belong to this interpreter context
  sample program: RUN
  $ cd yaegi-test
  $ yaegi run -i main.go
  The average is 3
  # a new function within the context of main.go
  > func median(nums []int) float64 {
      sorted := make([]int, len(nums))
      copy(sorted, nums)
      sort.Ints(sorted)
      length := len(sorted)
      if length%2 == 0 {
          return float64(sorted[length/2]+sorted[(length/2)-1]) / 2.0
      }
      return float64(sorted[length/2])
  }
  The average is 3
  # this is the reflect value of function median
  : 0xc0001bf5f0
  > fmt.Println("The median is", median(nums))
  The median is 3
  The average is 3
  : 16

  In interactive mode, the stdlib packages("sort" in this case) are pre-imported so that I can use them directly
  the code in REPL is evaluated and it returns a reflect.value , value interface reflects the type and value of the Go object, we'll see how we are comparing values using the Interface() method when we are using yaegi interpreter and evaluating code with Eval()method in its dynamic extension framework

so far I see yaegi CLI is for executing a standalone script within the program's context, when I specifically know the task I'm automating, I can experiment with the existing program and also be able to test the new functionality in the interactive shell

In the above context, I'm making changes in real-time(while it's executing) and performing operations on the existing data of the program


Yaegi specs

The interpreter provides an interactive and dynamic way to run the code, I don't have to recompile the program each time I make a change, I can see the results immediately, and I am also able to test and debug individuals lines of code

Here I'm running the program or it can be a code snippet in an interactive shell on a command-line-interface(a REPL=Read-Eval-Print Loop) like the way we do with python(it's just an example)


> python
Python 3.10.7 (main, Dec 30 2022, 10:22:51) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> print("Hello, world")
Hello, world
>>> name = "spike"
>>> print(name)
spike


Motivation

Make Go programs extensible

Existing script engines less fit than Go itself

Unify scripting and implementation languages - GoLab 2019 - Marc Vertes - YAEGI, Yet Another Elegant Go Interpreter




The dynamic nature of Go and its efficiency makes it a suitable language for scripting, an interpreter like yaegi puts up a solid point to consider it as a scripting engine and use Go for scripting

Yaegi as an embedded interpreter
# command-line executable
# for adding the dependency package or upgrading it to latest version
$ cd yaegi-test
$ go mod init github.com/KiranSatyaRaj/yaegi-test
go: creating new go.mod: module github.com/KiranSatyaRaj/yaegi-test
$ go get -u github.com/traefik/yaegi/cmd/yaegi
go: added github.com/traefik/yaegi v0.15.0
$ go get -u github.com/traefik/yaegi/interp

// import path
import "github.com/traefik/yaegi/interp"


Yaegi only relies on the go standard library and no external dependencies, the only API is New(), Use(), and Eval()

For creating customs scripts on the fly, yaegi as embedded interpreter cuts in, the program itself is less tightly integrated into the source code making it easier to modify and update it

Even though I'm executing the go run command each time I run it, the program isn't recompiled every time, it's being interpreted at runtime, we'll see that in action in this article itself


New() method to create a new interpreter context

New() is a part of the yaegi interp library which provides a complete Go interpreter, interp.New() method creates a new interpreter context and returns it

It takes interp.Options{} as input, Options{} is a custom type of interp package it's a struct type, and the values it holds are:
  Run
  Output:
  # pasting code in given from RUN link and executing it
  $ go run main.go 
  {GoPath: BuildTags:[] Stdin: Stdout: Stderr: Args:[] Env:[] SourcecodeFilesystem: Unrestricted:false}



Use() method to import standard library packages into the interpreter context
It takes stlib.Symbols as input, here Symbols can be functions, variables, and data structures, the Use() method takes the binary representation of these symbols and makes them available for the code in the interpreter context, to simply put the standard library packages are imported natively as given in the import path
It throws an error if this isn't configured, we'll see this in action soon
Eval() method to evaluate the code in the interpreter context
It evaluates the source code
The Go code is represented as a string and taken as input, returns the result computed by the interpreter or else we get a non-nil error
Let's RUN this
output:
$ go run main.go
panic: 4:9: import "fmt" error: unable to find source related to: "fmt". Either the GOPATH environment variable, or the Interpreter.Options.GoPath needs to be set

goroutine 1 [running]:
main.main()
    /tmp/sandbox4073505706/prog.go:22 +0x9a

Program exited.

RUN with Use() method
$ go get -u github.com/traefik/yaegi/stdlib

import "github.com/traefik/yaegi/stdlib"

Output:
$ go run main.go 
Hello Yaegi

This is a simple implementation of the embedded interpreter
Yaegi dynamic extension framework
A dynamic function run from static code, what does that mean?
The code is being compiled at runtime, I'm not altering the behavior of the static code which is compiled ahead of runtime, and the code that's defined is only available within the interpreter context
i.Eval() returns a reflect.value
RUN
output:
$ go run main.go 
The median is 3
The average is 3

In the above code, the v stores the reflect.value which is the interface value to access the specific method providing a similar function signature as in v.Interface().(func([]int) int), where we are comparing the value types with Interface() method, which was the average function
End thoughts

The goal is to provide a Go dynamic interpreter embeddable, simple, secure and fast enough to be used as plugin engine
this is not a toy, it's for use in production - GoLab-talk-slides


It aims to unify Go as the scripting language and these are simple implementations of yaegi, it's specifically for production use cases and faster development so I'm looking forward to using yaegi on projects with large codebases(more likely to use it on an open source project)

So far I've tried my hands on the yaegi-CLI, yaegi as an embedded interpreter, and its dynamic-extension framework, and yet to be explored are its production use cases, architecture, security, and performance too, I need to understand them in detail
Do check this GitHub discussion, the issues I faced and how it was resolved
A series on Traefik-Yaegi would be a good way of continuing it Thanks for staying till the end, I hope this helped you and I'll see you in the next one. HAPPY LEARNING



eBPF for Cybersecurity - Part 3
Sangam Biradar — Wed, 22 Feb 2023 13:09:22 GMT
previously we learned the basics of Ebpf and How to use the BPF library for the Rust programming language here will see eBPF program attached to sys_enter_exeve tracepoint in the Linux kernel and is executed for each sys_execve syscall.
Unsafe Rust
for eBPF programs written using rust, it is often required to access Linux kernel data structure or call Linux kernel helper functions. Unsafe Rust is the glue that helps achieve this functionality
following are the two essential functionalities enabled by unsafe Rust concerning eBPF programs

ability to dereference a raw memory pointer that points to Linux kernel data structure

ability to call a Linux kernel helper function implemented in C


Unsafe code in Rust is enclosed in a code block or a function block marked with an unsafe keyword the best way to understand how unsafe rust enables an eBPF program to interface with the Linux kernel is via the following two simple programs
Kernel Data Structure Access
every eBPF program gets calked with context passes as an input parameter. The context is the kernel data structure pointer, its type depends on the eBPF program type. the memory referenced by the context can access only with unsafe Rust code
unsafe fn ptr_at(ctx: &Xdpcontext,offset: unsize)

-> Result<*const T ,()> {

    let start = ctx.data();
    let end = ctx.data_end();
    let len = mem::size_of::();

  if start + offset + len > end {
    return Err(());
  }  

  Ok((start + offser) as *const T)

}

In the code snippet above, the ptr_at the function used by an eBPF program of the type BPF_PROG_TYPE_XDP the function takes ctx as an input parameter, a reference to an object type XdpContext this reference represents a C struct variable of type struct xdp_md in the Linux kernel. The xdp_md data structure points to a region in memory where a network packet resides. the start and end variables store the starting and ending memory address for the packet, while offset represent an offset within the packet. ptr_at the function returns a pointer to a valid offset within the packet's memory representation
fn try_xdp_firewall(ctx: XdpContext) ->
   Result {


    let eth_type = u16::from_be(unsafe {
    *ptr_at(&ctx, offset_of!(ethhdr,h_proto))?

    });

    if eth_type != ETH_P_IP {

        return Ok(XdpContext::XDP_PASS);
    }

    let source = u32::from_be(unsafe {
        *ptr_at(&ctx, ETH_HDR_LEN + offset_of!(iphdr,saddr))?
    });
   if blocked_ip(source){

    return Ok(xdp_action::XDP_DROP)
   }

   Ok(xdp_action::XDP_PASS)
   }

the try_xdp_firewall uses the ptr_at function to get the EtherType from the raw packet. if the packet encapsulated in the ethernet frame is an IP packet, the source IP is extracted using ptr-at function. if the source IP address is blocked the packet is dropped by return XDP_DROP action.
kernel Function call
unsafe rust code also enables the calling of certain Linux kernel helper function from the eBPF programs. The kernel helper functions that the eBPF program is permitted to call are contingent on the type of the program
use aya_bpf::{

    programs::ProbeContext,

    helpers::bpf_ktime_get_ns, 
};

fn try_nfs_file_read(ctx:ProbeContext)

  - > Result {

    let start_mount_ns = 

    unsafe { bpf_ktime_get_ns()};
    ok(0)
  }

In the code snippet above, bpf_ktime_get_ns is a Linux kernel helper function that returns the number of nanoseconds since boot time and is used to compute the time delta between events or as a timestamp in this example the bpf_ktime_get_ns the function is called to record the start time of the NFS file read encapsulating the helper function call in an unsafe block.
let's install lima with ubuntu
limactl start ubuntu-lts       
INFO[0000] Creating an instance "ubuntu-lts" from template://default (Not from template://ubuntu-lts) 
WARN[0000] This form is deprecated. Use `limactl start --name=ubuntu-lts template://default` instead 
? Creating an instance "ubuntu-lts" Proceed with the current configuration
INFO[0017] Attempting to download the image from "https://cloud-images.ubuntu.com/releases/22.10/release-20221201/ubuntu-22.10-server-cloudimg-arm64.img"  digest="sha256:9575dfe9f925ec251a933b88a38c5582a18e9d19495025ac01cb2e217e5f14ca"
47.94 MiB / 664.62 MiB [-->___________________________________] 7.21% 3.52 MiB/s
limactl shell ubuntu-lts

connect Lima to your Vscode
limactl show-ssh --format=config ubuntu-lts
Host lima-ubuntu-lts
  IdentityFile "/Users/sangambiradar/.lima/_config/user"
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  NoHostAuthenticationForLocalhost yes
  GSSAPIAuthentication no
  PreferredAuthentications publickey
  Compression no
  BatchMode yes
  IdentitiesOnly yes
  Ciphers "^aes128-gcm@openssh.com,aes256-gcm@openssh.com"
  User sangambiradar
  ControlMaster auto
  ControlPath "/Users/sangambiradar/.lima/ubuntu-lts/ssh.sock"
  ControlPersist 5m
  Hostname 127.0.0.1
  Port 55305

we will see Trace Programs

Kernel Proble(kprobe)

kernel Tracepoint

User Space Probe ( UProbe)

User Space Tracepoint


Kernel Probe ( Kprobe)
Linux kernel probes enable you to attach eBPF programs to kernel functions to gather information or modify the function’s behaviour. This section will provide examples of both.
$ cat /proc/kallsyms

There are some 300+ different system calls in the Linux kernel. Applications/workloads running in the user space interact with the kernel using syscalls. e.g. if an application wants to do something like access a file, communicate using a network or even find the time of day, it will have to ask the kernel to do it on the application's behalf via a syscall; hence by attaching these probes to syscalls we're able to judiciously monitor what applications are doing in the user space. A list of all kernel syscall identifiers for a kernel can be found in this file: /proc/kallsyms. Here is an excerpt:
0000000000000000 T vs_create
0000000000000000 T vfs_mkdir
0000000000000000 T vfs_mknod
0000000000000000 T vs link
0000000000000000 T vs unlink
0000000000000000 t path_openat
0000000000000000 T vs_rename
0000000000000000 T getname kernel
0000000000000000 T putname
0000000000000000 t getname_flags.part. O
0000000000000000 T getname flags
0000000000000000 T getname

System.map file and /proc/kallsyms
System.map file format: address type notation
The type is lowercase for local symbols, and uppercase for global (external).
Focus on several types:
T, The symbol is in the text(code) section
D The symbol is in the initialized data section
R The symbol is in a read-only data section
t static
d static
R const
r static const
For example, suppose you have a Rust object file named hello.o that contains a function named hello. You can use nm to list the symbols in this object file by running the following command:
$ nm hello.o

This will print a list of symbols in the hello.o object file, which might look something like this:
0000000000000000 T hello
                 U __libc_start_main

Block Mount
start of the open_ctree function call. The eBPF helper function bpf_override_return short circuits the open_ctree function execution by returning ENOMEM. This prevents the btrfs volume from being mounted.
#![no_std]
#![no_main]

use aya_bpf::{
    helpers::bpf_override_return, macros::kprobe,
    programs::ProbeContext,
};
use aya_log_ebpf::info;

const ENOMEM: i32 = -12;
#[kprobe(name = "block_mount")]
pub fn block_mount(ctx: ProbeContext) -> u32 {
    match try_block_mount(ctx) {
        Ok(ret) => ret,
        Err(ret) => ret,
    }
}

fn try_block_mount(
    ctx: ProbeContext,
) -> Result {
    info!(&ctx, "function open_ctree called");
    unsafe {
        bpf_override_return(ctx.regs, ENOMEM as u64)
    };
    Ok(0)
}

#[panic_handler]
fn panic(_info: &core::panic::PanicInfo) -> ! {
    unsafe { core::hint::unreachable_unchecked() }
}

kernel Tracepoint
cargo generate https://github.com/aya-rs/aya-template
🤷   Project Name: tracepoint-sangam
🔧   Destination: /home/ubuntu/tracepoint-sangam ...
🔧   project-name: tracepoint-sangam ...
🔧   Generating template ...
✔ 🤷   Which type of eBPF program? · tracepoint
🤷   Which tracepoint category? (e.g sched, net etc...): sys_enter_execve
🤷   Which tracepoint name? (e.g sched_switch, net_dev_queue): systemcalls
[ 1/35]   Done: .cargo/config.toml                                                                                    [ 2/35]   Done: .cargo                                                                                                [ 3/35]   Done: .gitignore                                                                                            [ 4/35]   Done: .vim/coc-settings.json                                                                                [ 5/35]   Done: .vim                                                                                                  [ 6/35]   Done: .vscode/settings.json                                                                                 [ 7/35]   Done: .vscode                                                                                               [ 8/35]   Done: Cargo.toml                                                                                            [ 9/35]   Done: README.md                                                                                             [10/35]   Ignored: pre-script.rhai                                                                                    [11/35]   Done: xtask/Cargo.toml                                                                                      [12/35]   Done: xtask/src/build_ebpf.rs                                                                               [13/35]   Done: xtask/src/main.rs                                                                                     [14/35]   Done: xtask/src/run.rs                                                                                      [15/35]   Done: xtask/src                                                                                             [16/35]   Done: xtask                                                                                                 [17/35]   Done: tracepoint-sangam/Cargo.toml                                                                          [18/35]   Done: tracepoint-sangam/src/main.rs                                                                         [19/35]   Done: tracepoint-sangam/src                                                                                 [20/35]   Done: tracepoint-sangam                                                                                     [21/35]   Done: tracepoint-sangam-common/Cargo.toml                                                                   [22/35]   Done: tracepoint-sangam-common/src/lib.rs                                                                   [23/35]   Done: tracepoint-sangam-common/src                                                                          [24/35]   Done: tracepoint-sangam-common                                                                              [25/35]   Done: tracepoint-sangam-ebpf/.cargo/config.toml                                                             [26/35]   Done: tracepoint-sangam-ebpf/.cargo                                                                         [27/35]   Done: tracepoint-sangam-ebpf/.vim/coc-settings.json                                                         [28/35]   Done: tracepoint-sangam-ebpf/.vim                                                                           [29/35]   Done: tracepoint-sangam-ebpf/.vscode/settings.json                                                          [30/35]   Done: tracepoint-sangam-ebpf/.vscode                                                                        [31/35]   Done: tracepoint-sangam-ebpf/Cargo.toml                                                                     [32/35]   Done: tracepoint-sangam-ebpf/rust-toolchain.toml                                                            [33/35]   Done: tracepoint-sangam-ebpf/src/main.rs                                                                    [34/35]   Done: tracepoint-sangam-ebpf/src                                                                            [35/35]   Done: tracepoint-sangam-ebpf                                                                                🔧   Moving generated files into: `/home/ubuntu/tracepoint-sangam`...
💡   Initializing a fresh Git repository
✨   Done! New project created /home/ubuntu/tracepoint-sangam
ubuntu@ip-172-31-56-217:~$

its generate template
.
├── Cargo.toml
├── README.md
├── tracepoint-sangam
│   ├── Cargo.toml
│   └── src
│       └── main.rs
├── tracepoint-sangam-common
│   ├── Cargo.toml
│   └── src
│       └── lib.rs
├── tracepoint-sangam-ebpf
│   ├── Cargo.toml
│   ├── rust-toolchain.toml
│   └── src
│       └── main.rs
└── xtask
    ├── Cargo.toml
    └── src
        ├── build_ebpf.rs
        ├── main.rs
        └── run.rs


tracepoint-sangam - contains the user space program

tracepoint-sangam-ebpf - contains the epbf program

trace-sangam-common contains the code for data structure and data types common to both user space and eBPF programs


The user space program can be buit using
~/tracepoint-sangam$ cargo build

the eBPF program can be built using
~/tracepoint-sangam$ cargo xtask build-ebpf

the release version of the eBPF program can be build using
~/tracepoint-sangam$ cargo xtask build-ebpf --release

The userspace program which loads the eBPF program into kernel can be run using
/tracepoint-sangam$ cargo xtask run

above simple ebpf program attached to sys_enter_exeve tracepoint in the Linux kenel and is executed for each sys_execve syscall.
The eBPF program on execution logs a perf event and this event is returned to the user space for printing via the perf event array map. exporting the logs from the kernel to the user space is abstracted from the developer and handled by the aya-logging library
That's it for this part we will learn more about aya and ebpf .
the eBPF developer experience by allowing Rust programs to easily run within the kernel.
Aya is the first Rust-native eBPF library that is similar in nature to libbpf but entirely written in the Rust programming language, popular for its memory safety and concurrency features, among other reasons this programming language is becoming very popular for systems programming.



eBPF for Cybersecurity - Part 2
Sangam Biradar — Mon, 06 Feb 2023 20:49:58 GMT
How are ebpf programs written?

You write an eBPF program. Mostly in restricted C.

Compile the program into bytecode using tools like clang

Use bpftool or another high-level program to load bytecode into the kernel

the verification evaluates the eBPF program and ensures its safe to run

the JIT compiler converts the bytecode to native assembly for faster execution

the program is then attached/linked to is hookpoints

Anytime the hookpoint is traversed, our attached middleware gets executed.


the ebpf program you write and run can inspect data in the memory of the processed they attach to. to achieve this you can use header file #include "vmlinux.h" .
basically vmlinux.h is generated code. Linux kernel that contains definitions and declarations for the virtual memory management subsystem. This file is used by the kernel to define the data structures and functions used to manage virtual memory, such as page tables, memory zones, and page flags. It also includes definitions for macros and constants used in the virtual memory management code, such as page sizes, page flags, and memory zones. Overall, vmlinux.h is an important part of the Linux kernel that helps the operating system manage the memory resources of the system.
one of the output artefacts is a file called vmlinux It's also typically packaged with major distribution distributions. this ELF binary contains the compiled bootable kernel inside it.
here is a little walkthrough on ELF101

bpftool that maintained within the Linux repository its has features to read the vmlinux object generate a vmlinux.h
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/bpf/bpftool?h=v5.14
ubuntu $ ls
bin   dev  home  lib32  libx32      media  opt   root  sbin  srv       sys  usr
boot  etc  lib   lib64  lost+found  mnt    proc  run   snap  swapfile  tmp  var

check sys/kernel folder
cd sys/kernel
ubuntu $ ls
boot_params  config  iommu_groups        kexec_crash_size  mm         rcu_expedited  slab            uevent_helper
btf          debug   irq                 kexec_loaded      notes      rcu_normal     software_nodes  uevent_seqnum
cgroup       fscaps  kexec_crash_loaded  livepatch         profiling  security       tracing         vmcoreinfo
ubuntu $

in the btf you find vimliux object
sudo apt install  linux-tools-5.15.0-57-generic

note: Ubuntu 22.04.1 LTS (GNU/Linux 5.15.0-57-generic aarch64)
ubuntu@primary:~$ sudo bpftool prog show
62: cgroup_device  tag ee0e253c78993a24  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 416B  jited 400B  memlock 4096B
63: cgroup_device  tag 384856681694f215  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 744B  jited 644B  memlock 4096B
64: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
65: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
69: cgroup_device  tag 134b8a301991f6b7  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 504B  jited 464B  memlock 4096B
70: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
71: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
72: cgroup_device  tag 4b9ba398cc75f876  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 496B  jited 460B  memlock 4096B
73: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
74: cgroup_skb  tag 6deef7357e7b4530  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 64B  jited 96B  memlock 4096B
75: cgroup_device  tag 654d7024997e7811  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 464B  jited 436B  memlock 4096B
76: cgroup_device  tag 134b8a301991f6b7  gpl
    loaded_at 2023-01-21T11:00:09+0530  uid 0
    xlated 504B  jited 464B  memlock 4096B

"bpftool prog show" is used to list all BPF programs currently loaded on the system (loaded ⇏ attached).
cat  my_bpf_program.c 
int func()
{
        return 0;
}

run using clang
clang -target bpf -Wall -O2 -c my_bpf_program.c -o my_bpf_objfile.o

clang -O2 -emit-llvm -c my_bpf_program.c -o - |       llc -march=bpf -mcpu=probe -filetype=obj -o my_bpf_objfile.o

might need to pass the -mcpu option to llcand would use something closer to the following command instead
ubuntu@primary:~$ readelf -x .text my_bpf_objfile.o

Hex dump of section '.text':
  0x00000000 b7000000 00000000 95000000 00000000 ................

It worked! We have two eBPF instructions here:
b7 0 0 0000 00000000    # r0 = 0
95 0 0 0000 00000000    # exit and return r0

ebpf assembly instruction:- https://github.com/iovisor/bpf-docs/blob/master/eBPF.md

Compiling from C to eBPF bytecode as an object file is really useful. The ELF file produced can directly attach the programs to the various hooks , TC, XDP,Kprobes etc

writing advanced programs as bytecode would be very time-consuming

Compile from C to an eBPF assembly language. Edit the assembly, then assemble it as bytecode in an object file.


Clang and LLVM now allow to do just that! Generating a human-readable version of the program on one side, then assembling it on the other side. Bonus: llvm-objdump can even be used to dump the program contained in an object-file.
Compiling from C to eBPF Assembly
$ cat bpf.c
int func()
{
    return 0;
}

$ clang -target bpf -S -o bpf.s bpf.c
$ cat bpf.s
    .text
    .globl    func                    # -- Begin function func
    .p2align    3
func:                                   # @func
# %bb.0:
    r1 = 0
    *(u32 *)(r10 - 4) = r1
    r0 = r1
    exit
                                        # -- End function

Great, now let’s modify it and add our instructions at the bottom!
$ sed -i '$a \\tr0 = 3' bpf.s
$ cat bpf.s
    .text
    .globl    func                    # -- Begin function func
    .p2align    3
func:                                   # @func
# %bb.0:
    r1 = 0
    *(u32 *)(r10 - 4) = r1
    r0 = r1
    exit
                                        # -- End function

    r0 = 3

Assembling to an ELF object file
we can assemble this file into an ELF object file containing bytcode
$ llvm-mc -triple bpf -filetype=obj -o bpf.o bpf.s

lets dump bytecode
$ readelf -x .text bpf.o

Hex dump of section '.text':
  0x00000000 b7010000 00000000 631afcff 00000000 ........c.......
  0x00000010 bf100000 00000000 95000000 00000000 ................
  0x00000020 b7000000 03000000 b7000000 03000000 ................

object file in human-readable format
$ llvm-objdump -d bpf.o

bpf.o:    file format ELF64-BPF

Disassembly of section .text:
func:
       0:    b7 01 00 00 00 00 00 00     r1 = 0
       1:    63 1a fc ff 00 00 00 00     *(u32 *)(r10 - 4) = r1
       2:    bf 10 00 00 00 00 00 00     r0 = r1
       3:    95 00 00 00 00 00 00 00     exit
       4:    b7 00 00 00 03 00 00 00     r0 = 3

you can see we edited r0 = 3
LLVM can embed debug symbols so they can be dumped inspection. we can give the c instruction at the same time as the bytecode . embedding instructions is done by compiling from C with the -g flag passed to clang
$ clang -target bpf -g -S -o bpf.s bpf.c
$ llvm-mc -triple bpf -filetype=obj -o bpf.o bpf.s
$ llvm-objdump -S bpf.o

bpf.o:    file format ELF64-BPF

Disassembly of section .text:
func:
; int func() {
       0:    b7 01 00 00 00 00 00 00     r1 = 0
       1:    63 1a fc ff 00 00 00 00     *(u32 *)(r10 - 4) = r1
; return 0;
       2:    bf 10 00 00 00 00 00 00     r0 = r1
       3:    95 00 00 00 00 00 00 00     exit

another way is an inline assembly (https://docs.cilium.io/en/latest/bpf/#llvm)
In short, instead of compiling an eBPF program from C to an ELF object file, you can alternatively compile it to an assembly language, edit it according to your needs, and then assemble this version as the final object file. For this, you need clang and LLVM in version 6.0 and higher, and the commands are:
$ clang -target bpf -S -o bpf.s bpf.c
$ llvm-mc -triple bpf -filetype=obj -o bpf.o bpf.s

dump in human-readable format
$ llvm-objdump -d bpf.o
$ llvm-objdump -S bpf.o         # add C code, if -g was passed to clang

https://twitter.com/qeole/status/1101450782841466880?s=20&t=dDnaTDUbT6yrTgtj2yb_XQ
 
In the whole series of ebpf we are going to use https://github.com/aya-rs/aya - Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.
So why Rust? C is fine
As you saw in the last article, BPF programs are typically programmed in C. But why couldn't we use Rust? It can be just as low level as C.
The biggest win in my mind is the ergonomics that could be achieved (which I will hopefully be able to improve across these next few posts) along with the crates ecosystem which has enormous potential when compared to the C BPF ecosystem. It could be argued that because of the verifier, the borrow checker is moot, but I don't see it in quite the same light. Sure the verifier will enforce specific checks and be arguably far more strict than the borrow checker but that
doesn't mean we can't get any use out of leaning on Rust's borrowing system.
Of course, there is the subjective benefit that I'm more productive in Rust, and far more proficient with Rust than with C. Plus if I'm writing the supporting applications/libraries in Rust it'd be nice to stay in a single language when possible.
Install rust on linux
sudo apt-get update
curl https://sh.rustup.rs -sSf | sh -s -- -y
source $HOME/.cargo/env
rustup --version
rustup install stable
rustup toolchain install nightly --component rust-src
sudo apt install build-essential
sudo apt-get update
sudo apt install build-essential

Before working with aya, you need to install bpf-linker crate. If you are running on a Linux x86_64 system, use the following command:
cargo install bpf-linker

If you are running Linux on any other architecture (e.g. arm64), you need to install LLVM 15 first (using https://apt.llvm.org/ or packages for your distribution) and then use the following command:
cargo install --no-default-features --features system-llvm bpf-linker

cargo-generate is a developer tool to help you get up and running quickly with a new Rust project by leveraging a pre-existing git repository as a template.
cargo install cargo-generate --locked cargo

use aya template to generate different type of ebpf program
cargo generate https://github.com/aya-rs/aya-template
⚠️   Favorite `https://github.com/aya-rs/aya-template` not found in config, using it as a git repository: https://github.com/aya-rs/aya-template
🤷   Project Name: aya-rust-sangam
🔧   Destination: /home/ubuntu/aya-rust-sangam ...
🔧   project-name: aya-rust-sangam ...
🔧   Generating template ...
✔ 🤷   Which type of eBPF program? · cgroup_sysctl
[ 1/35]   Done: .cargo/config.toml                                                                                                                          [ 2/35]   Done: .cargo                                                                                                                                      [ 3/35]   Done: .gitignore                                                                                                                                  [ 4/35]   Done: .vim/coc-settings.json                                                                                                                      [ 5/35]   Done: .vim                                                                                                                                        [ 6/35]   Done: .vscode/settings.json                                                                                                                       [ 7/35]   Done: .vscode                                                                                                                                     [ 8/35]   Done: Cargo.toml                                                                                                                                  [ 9/35]   Done: README.md                                                                                                                                   [10/35]   Ignored: pre-script.rhai                                                                                                                          [11/35]   Done: xtask/Cargo.toml                                                                                                                            [12/35]   Done: xtask/src/build_ebpf.rs                                                                                                                     [13/35]   Done: xtask/src/main.rs                                                                                                                           [14/35]   Done: xtask/src/run.rs                                                                                                                            [15/35]   Done: xtask/src                                                                                                                                   [16/35]   Done: xtask                                                                                                                                       [17/35]   Done: aya-rust-sangam/Cargo.toml                                                                                                                  [18/35]   Done: aya-rust-sangam/src/main.rs                                                                                                                 [19/35]   Done: aya-rust-sangam/src                                                                                                                         [20/35]   Done: aya-rust-sangam                                                                                                                             [21/35]   Done: aya-rust-sangam-common/Cargo.toml                                                                                                           [22/35]   Done: aya-rust-sangam-common/src/lib.rs                                                                                                           [23/35]   Done: aya-rust-sangam-common/src                                                                                                                  [24/35]   Done: aya-rust-sangam-common                                                                                                                      [25/35]   Done: aya-rust-sangam-ebpf/.cargo/config.toml                                                                                                     [26/35]   Done: aya-rust-sangam-ebpf/.cargo                                                                                                                 [27/35]   Done: aya-rust-sangam-ebpf/.vim/coc-settings.json                                                                                                 [28/35]   Done: aya-rust-sangam-ebpf/.vim                                                                                                                   [29/35]   Done: aya-rust-sangam-ebpf/.vscode/settings.json                                                                                                  [30/35]   Done: aya-rust-sangam-ebpf/.vscode                                                                                                                [31/35]   Done: aya-rust-sangam-ebpf/Cargo.toml                                                                                                             [32/35]   Done: aya-rust-sangam-ebpf/rust-toolchain.toml                                                                                                    [33/35]   Done: aya-rust-sangam-ebpf/src/main.rs                                                                                                            [34/35]   Done: aya-rust-sangam-ebpf/src                                                                                                                    [35/35]   Done: aya-rust-sangam-ebpf                                                                                                                        🔧   Moving generated files into: `/home/ubuntu/aya-rust-sangam`...
💡   Initializing a fresh Git repository
✨   Done! New project created /home/ubuntu/aya-rust-sangam
ubuntu@ip-172-31-56-217:~$

here the structure of the program
└── aya-rust-sangam
    ├── Cargo.toml
    ├── README.md
    ├── aya-rust-sangam
    │   ├── Cargo.toml
    │   └── src
    │       └── main.rs
    ├── aya-rust-sangam-common
    │   ├── Cargo.toml
    │   └── src
    │       └── lib.rs
    ├── aya-rust-sangam-ebpf
    │   ├── Cargo.toml
    │   ├── rust-toolchain.toml
    │   └── src
    │       └── main.rs
    └── xtask
        ├── Cargo.toml
        └── src
            ├── build_ebpf.rs
            ├── main.rs
            └── run.rs

CgroupSysctl programs can be attached to a cgroup and will be called every time a process inside that cgroup tries to read from or write to a sysctl knob in proc.
/aya-rust-sangam/aya-rust-sangam/src$ cat main.rs 
use aya::programs::CgroupSysctl;
use aya::{include_bytes_aligned, Bpf};
use aya_log::BpfLogger;
use clap::Parser;
use log::{info, warn};
use tokio::signal;

#[derive(Debug, Parser)]
struct Opt {
    #[clap(short, long, default_value = "/sys/fs/cgroup/unified")]
    cgroup_path: String,
}

#[tokio::main]
async fn main() -> Result<(), anyhow::Error> {
    let opt = Opt::parse();

    env_logger::init();

    // This will include your eBPF object file as raw bytes at compile-time and load it at
    // runtime. This approach is recommended for most real-world use cases. If you would
    // like to specify the eBPF program at runtime rather than at compile-time, you can
    // reach for `Bpf::load_file` instead.
    #[cfg(debug_assertions)]
    let mut bpf = Bpf::load(include_bytes_aligned!(
        "../../target/bpfel-unknown-none/debug/aya-rust-sangam"
    ))?;
    #[cfg(not(debug_assertions))]
    let mut bpf = Bpf::load(include_bytes_aligned!(
        "../../target/bpfel-unknown-none/release/aya-rust-sangam"
    ))?;
    if let Err(e) = BpfLogger::init(&mut bpf) {
        // This can happen if you remove all log statements from your eBPF program.
        warn!("failed to initialize eBPF logger: {}", e);
    }
    let program: &mut CgroupSysctl = bpf.program_mut("aya_rust_sangam").unwrap().try_into()?;
    let cgroup = std::fs::File::open(opt.cgroup_path)?;
    program.load()?;
    program.attach(cgroup)?;

    info!("Waiting for Ctrl-C...");
    signal::ctrl_c().await?;
    info!("Exiting...");

    Ok(())
}

The main entry point into the library, used to work with eBPF programs and maps.
#![no_std]
#![no_main]

use aya_bpf::{
    macros::cgroup_sysctl,
    programs::SysctlContext,
};
use aya_log_ebpf::info;

#[cgroup_sysctl(name = "aya_rust_sangam")]
pub fn aya_rust_sangam(ctx: SysctlContext) -> i32 {
    match try_aya_rust_sangam(ctx) {
        Ok(ret) => ret,
        Err(ret) => ret,
    }
}

fn try_aya_rust_sangam(ctx: SysctlContext) -> Result {
    info!(&ctx, "sysctl operation called");
    Ok(0)
}

#[panic_handler]
fn panic(_info: &core::panic::PanicInfo) -> ! {
    unsafe { core::hint::unreachable_unchecked() }
}

cargo configurations
~/aya-rust-sangam/aya-rust-sangam-ebpf$ cat Cargo.toml 
[package]
name = "aya-rust-sangam-ebpf"
version = "0.1.0"
edition = "2021"

[dependencies]
aya-bpf = { git = "https://github.com/aya-rs/aya", branch = "main" }
aya-log-ebpf = { git = "https://github.com/aya-rs/aya", branch = "main" }
aya-rust-sangam-common = { path = "../aya-rust-sangam-common" }

[[bin]]
name = "aya-rust-sangam"
path = "src/main.rs"

[profile.dev]
opt-level = 3
debug = false
debug-assertions = false
overflow-checks = false
lto = true
panic = "abort"
incremental = false
codegen-units = 1
rpath = false

[profile.release]
lto = true
panic = "abort"
codegen-units = 1

[workspace]
members = []

ubuntu@ip-172-31-56-217:~/aya-rust-sangam$ cargo xtask build-ebpf
    Finished dev [unoptimized + debuginfo] target(s) in 0.28s
     Running `target/debug/xtask build-ebpf`
       Fresh unicode-ident v1.0.6
       Fresh proc-macro2 v1.0.51
       Fresh quote v1.0.23
       Fresh syn v1.0.107
       Fresh core v0.0.0 (/home/ubuntu/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core)
       Fresh rustc-std-workspace-core v1.99.0 (/home/ubuntu/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/rustc-std-workspace-core)
       Fresh num_enum_derive v0.5.9
       Fresh compiler_builtins v0.1.85
       Fresh rustversion v1.0.11
       Fresh aya-bpf-cty v0.2.1 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-bpf-bindings v0.1.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-log-parser v0.1.11-dev.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh num_enum v0.5.9
       Fresh aya-bpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-log-ebpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-bpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-log-common v0.1.13 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-log-ebpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#7868fffd)
       Fresh aya-rust-sangam-common v0.1.0 (/home/ubuntu/aya-rust-sangam/aya-rust-sangam-common)
       Fresh aya-rust-sangam-ebpf v0.1.0 (/home/ubuntu/aya-rust-sangam/aya-rust-sangam-ebpf)
    Finished dev [optimized] target(s) in 0.30s

 llvm-objdump -S target/bpfel-unknown-none/debug/aya-rust-sangam

target/bpfel-unknown-none/debug/aya-rust-sangam:    file format ELF64-BPF


Disassembly of section .text:

0000000000000000 memset:
llvm-objdump: warning: 'target/bpfel-unknown-none/debug/aya-rust-sangam': failed to parse debug information for target/bpfel-unknown-none/debug/aya-rust-sangam
       0:    15 03 06 00 00 00 00 00    if r3 == 0 goto +6 
       1:    b7 04 00 00 00 00 00 00    r4 = 0

0000000000000010 LBB1_2:
       2:    bf 15 00 00 00 00 00 00    r5 = r1
       3:    0f 45 00 00 00 00 00 00    r5 += r4
       4:    73 25 00 00 00 00 00 00    *(u8 *)(r5 + 0) = r2
       5:    07 04 00 00 01 00 00 00    r4 += 1
       6:    2d 43 fb ff 00 00 00 00    if r3 > r4 goto -5 

0000000000000038 LBB1_3:
       7:    95 00 00 00 00 00 00 00    exit

0000000000000040 memcpy:
       8:    15 03 09 00 00 00 00 00    if r3 == 0 goto +9 
       9:    b7 04 00 00 00 00 00 00    r4 = 0

0000000000000050 LBB2_2:
      10:    bf 15 00 00 00 00 00 00    r5 = r1
      11:    0f 45 00 00 00 00 00 00    r5 += r4
      12:    bf 20 00 00 00 00 00 00    r0 = r2
      13:    0f 40 00 00 00 00 00 00    r0 += r4
      14:    71 00 00 00 00 00 00 00    r0 = *(u8 *)(r0 + 0)
      15:    73 05 00 00 00 00 00 00    *(u8 *)(r5 + 0) = r0
      16:    07 04 00 00 01 00 00 00    r4 += 1
      17:    2d 43 f8 ff 00 00 00 00    if r3 > r4 goto -8 

0000000000000090 LBB2_3:
      18:    95 00 00 00 00 00 00 00    exit

Disassembly of section cgroup/sysctl/aya_rust_sangam:

0000000000000000 aya_rust_sangam:
       0:    bf 16 00 00 00 00 00 00    r6 = r1
       1:    b7 07 00 00 00 00 00 00    r7 = 0
       2:    63 7a fc ff 00 00 00 00    *(u32 *)(r10 - 4) = r7
       3:    bf a2 00 00 00 00 00 00    r2 = r10
       4:    07 02 00 00 fc ff ff ff    r2 += -4
       5:    18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00    r1 = 0 ll
       7:    85 00 00 00 01 00 00 00    call 1
       8:    15 00 26 01 00 00 00 00    if r0 == 0 goto +294 
       9:    73 70 0f 00 00 00 00 00    *(u8 *)(r0 + 15) = r7
      10:    73 70 0e 00 00 00 00 00    *(u8 *)(r0 + 14) = r7
      11:    73 70 0d 00 00 00 00 00    *(u8 *)(r0 + 13) = r7
      12:    73 70 0c 00 00 00 00 00    *(u8 *)(r0 + 12) = r7
      13:    73 70 0b 00 00 00 00 00    *(u8 *)(r0 + 11) = r7
      14:    73 70 0a 00 00 00 00 00    *(u8 *)(r0 + 10) = r7
      15:    73 70 09 00 00 00 00 00    *(u8 *)(r0 + 9) = r7
      16:    b7 03 00 00 0f 00 00 00    r3 = 15
      17:    73 30 08 00 00 00 00 00    *(u8 *)(r0 + 8) = r3
      18:    73 70 07 00 00 00 00 00    *(u8 *)(r0 + 7) = r7
      19:    73 70 06 00 00 00 00 00    *(u8 *)(r0 + 6) = r7
      20:    73 70 05 00 00 00 00 00    *(u8 *)(r0 + 5) = r7
      21:    73 70 04 00 00 00 00 00    *(u8 *)(r0 + 4) = r7
      22:    73 70 03 00 00 00 00 00    *(u8 *)(r0 + 3) = r7
      23:    73 70 02 00 00 00 00 00    *(u8 *)(r0 + 2) = r7
      24:    73 70 01 00 00 00 00 00    *(u8 *)(r0 + 1) = r7
      25:    b7 01 00 00 01 00 00 00    r1 = 1
      26:    73 10 00 00 00 00 00 00    *(u8 *)(r0 + 0) = r1
      27:    bf 04 00 00 00 00 00 00    r4 = r0
      28:    07 04 00 00 10 00 00 00    r4 += 16
      29:    18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00    r2 = 0 ll
      31:    71 25 00 00 00 00 00 00    r5 = *(u8 *)(r2 + 0)
      32:    73 54 00 00 00 00 00 00    *(u8 *)(r4 + 0) = r5
      33:    71 25 01 00 00 00 00 00    r5 = *(u8 *)(r2 + 1)
      34:    73 54 01 00 00 00 00 00    *(u8 *)(r4 + 1) = r5
      35:    71 25 02 00 00 00 00 00    r5 = *(u8 *)(r2 + 2)
      36:    73 54 02 00 00 00 00 00    *(u8 *)(r4 + 2) = r5
      37:    71 25 03 00 00 00 00 00    r5 = *(u8 *)(r2 + 3)
      38:    73 54 03 00 00 00 00 00    *(u8 *)(r4 + 3) = r5
      39:    71 25 04 00 00 00 00 00    r5 = *(u8 *)(r2 + 4)
      40:    73 54 04 00 00 00 00 00    *(u8 *)(r4 + 4) = r5
      41:    71 25 05 00 00 00 00 00    r5 = *(u8 *)(r2 + 5)
      42:    73 54 05 00 00 00 00 00    *(u8 *)(r4 + 5) = r5
      43:    71 25 06 00 00 00 00 00    r5 = *(u8 *)(r2 + 6)
      44:    73 54 06 00 00 00 00 00    *(u8 *)(r4 + 6) = r5
      45:    71 25 07 00 00 00 00 00    r5 = *(u8 *)(r2 + 7)
      46:    73 54 07 00 00 00 00 00    *(u8 *)(r4 + 7) = r5
      47:    71 25 08 00 00 00 00 00    r5 = *(u8 *)(r2 + 8)
      48:    73 54 08 00 00 00 00 00    *(u8 *)(r4 + 8) = r5
      49:    71 25 09 00 00 00 00 00    r5 = *(u8 *)(r2 + 9)
      50:    73 54 09 00 00 00 00 00    *(u8 *)(r4 + 9) = r5
      51:    71 25 0a 00 00 00 00 00    r5 = *(u8 *)(r2 + 10)
      52:    73 54 0a 00 00 00 00 00    *(u8 *)(r4 + 10) = r5
      53:    71 25 0b 00 00 00 00 00    r5 = *(u8 *)(r2 + 11)
      54:    73 54 0b 00 00 00 00 00    *(u8 *)(r4 + 11) = r5
      55:    71 25 0c 00 00 00 00 00    r5 = *(u8 *)(r2 + 12)
      56:    73 54 0c 00 00 00 00 00    *(u8 *)(r4 + 12) = r5
      57:    71 25 0d 00 00 00 00 00    r5 = *(u8 *)(r2 + 13)
      58:    73 54 0d 00 00 00 00 00    *(u8 *)(r4 + 13) = r5
      59:    71 25 0e 00 00 00 00 00    r5 = *(u8 *)(r2 + 14)
      60:    73 54 0e 00 00 00 00 00    *(u8 *)(r4 + 14) = r5
      61:    73 30 3f 00 00 00 00 00    *(u8 *)(r0 + 63) = r3
      62:    b7 03 00 00 03 00 00 00    r3 = 3
      63:    73 30 37 00 00 00 00 00    *(u8 *)(r0 + 55) = r3
      64:    73 30 2f 00 00 00 00 00    *(u8 *)(r0 + 47) = r3
      65:    b7 03 00 00 02 00 00 00    r3 = 2
      66:    73 30 1f 00 00 00 00 00    *(u8 *)(r0 + 31) = r3
      67:    73 70 46 00 00 00 00 00    *(u8 *)(r0 + 70) = r7
      68:    73 70 45 00 00 00 00 00    *(u8 *)(r0 + 69) = r7
      69:    73 70 44 00 00 00 00 00    *(u8 *)(r0 + 68) = r7
      70:    73 70 43 00 00 00 00 00    *(u8 *)(r0 + 67) = r7
      71:    73 70 42 00 00 00 00 00    *(u8 *)(r0 + 66) = r7
      72:    73 70 41 00 00 00 00 00    *(u8 *)(r0 + 65) = r7
      73:    73 70 40 00 00 00 00 00    *(u8 *)(r0 + 64) = r7
      74:    73 70 3e 00 00 00 00 00    *(u8 *)(r0 + 62) = r7
      75:    73 70 3d 00 00 00 00 00    *(u8 *)(r0 + 61) = r7
      76:    73 70 3c 00 00 00 00 00    *(u8 *)(r0 + 60) = r7
      77:    73 70 3b 00 00 00 00 00    *(u8 *)(r0 + 59) = r7
      78:    73 70 3a 00 00 00 00 00    *(u8 *)(r0 + 58) = r7
      79:    73 70 39 00 00 00 00 00    *(u8 *)(r0 + 57) = r7
      80:    73 70 38 00 00 00 00 00    *(u8 *)(r0 + 56) = r7
      81:    73 70 36 00 00 00 00 00    *(u8 *)(r0 + 54) = r7
      82:    73 70 35 00 00 00 00 00    *(u8 *)(r0 + 53) = r7
      83:    73 70 34 00 00 00 00 00    *(u8 *)(r0 + 52) = r7
      84:    73 70 33 00 00 00 00 00    *(u8 *)(r0 + 51) = r7
      85:    73 70 32 00 00 00 00 00    *(u8 *)(r0 + 50) = r7
      86:    73 70 31 00 00 00 00 00    *(u8 *)(r0 + 49) = r7
      87:    73 70 30 00 00 00 00 00    *(u8 *)(r0 + 48) = r7
      88:    73 70 2e 00 00 00 00 00    *(u8 *)(r0 + 46) = r7
      89:    73 70 2d 00 00 00 00 00    *(u8 *)(r0 + 45) = r7
      90:    73 70 2c 00 00 00 00 00    *(u8 *)(r0 + 44) = r7
      91:    73 70 2b 00 00 00 00 00    *(u8 *)(r0 + 43) = r7
      92:    73 70 2a 00 00 00 00 00    *(u8 *)(r0 + 42) = r7
      93:    73 70 29 00 00 00 00 00    *(u8 *)(r0 + 41) = r7
      94:    73 70 28 00 00 00 00 00    *(u8 *)(r0 + 40) = r7
      95:    b7 03 00 00 08 00 00 00    r3 = 8
      96:    73 30 27 00 00 00 00 00    *(u8 *)(r0 + 39) = r3
      97:    73 70 26 00 00 00 00 00    *(u8 *)(r0 + 38) = r7
      98:    73 70 25 00 00 00 00 00    *(u8 *)(r0 + 37) = r7
      99:    73 70 24 00 00 00 00 00    *(u8 *)(r0 + 36) = r7
     100:    73 70 23 00 00 00 00 00    *(u8 *)(r0 + 35) = r7
     101:    73 70 22 00 00 00 00 00    *(u8 *)(r0 + 34) = r7
     102:    73 70 21 00 00 00 00 00    *(u8 *)(r0 + 33) = r7
     103:    73 70 20 00 00 00 00 00    *(u8 *)(r0 + 32) = r7
     104:    bf 04 00 00 00 00 00 00    r4 = r0
     105:    07 04 00 00 47 00 00 00    r4 += 71
     106:    71 25 00 00 00 00 00 00    r5 = *(u8 *)(r2 + 0)
     107:    73 54 00 00 00 00 00 00    *(u8 *)(r4 + 0) = r5
     108:    71 25 01 00 00 00 00 00    r5 = *(u8 *)(r2 + 1)
     109:    73 54 01 00 00 00 00 00    *(u8 *)(r4 + 1) = r5
     110:    71 25 02 00 00 00 00 00    r5 = *(u8 *)(r2 + 2)
     111:    73 54 02 00 00 00 00 00    *(u8 *)(r4 + 2) = r5
     112:    71 25 03 00 00 00 00 00    r5 = *(u8 *)(r2 + 3)
     113:    73 54 03 00 00 00 00 00    *(u8 *)(r4 + 3) = r5
     114:    71 25 04 00 00 00 00 00    r5 = *(u8 *)(r2 + 4)
     115:    73 54 04 00 00 00 00 00    *(u8 *)(r4 + 4) = r5
     116:    71 25 05 00 00 00 00 00    r5 = *(u8 *)(r2 + 5)
     117:    73 54 05 00 00 00 00 00    *(u8 *)(r4 + 5) = r5
     118:    71 25 06 00 00 00 00 00    r5 = *(u8 *)(r2 + 6)
     119:    73 54 06 00 00 00 00 00    *(u8 *)(r4 + 6) = r5
     120:    71 25 07 00 00 00 00 00    r5 = *(u8 *)(r2 + 7)
     121:    73 54 07 00 00 00 00 00    *(u8 *)(r4 + 7) = r5
     122:    71 25 08 00 00 00 00 00    r5 = *(u8 *)(r2 + 8)
     123:    73 54 08 00 00 00 00 00    *(u8 *)(r4 + 8) = r5
     124:    71 25 09 00 00 00 00 00    r5 = *(u8 *)(r2 + 9)
     125:    73 54 09 00 00 00 00 00    *(u8 *)(r4 + 9) = r5
     126:    71 25 0a 00 00 00 00 00    r5 = *(u8 *)(r2 + 10)
     127:    73 54 0a 00 00 00 00 00    *(u8 *)(r4 + 10) = r5
     128:    71 25 0b 00 00 00 00 00    r5 = *(u8 *)(r2 + 11)
     129:    73 54 0b 00 00 00 00 00    *(u8 *)(r4 + 11) = r5
     130:    71 25 0c 00 00 00 00 00    r5 = *(u8 *)(r2 + 12)
     131:    73 54 0c 00 00 00 00 00    *(u8 *)(r4 + 12) = r5
     132:    71 25 0d 00 00 00 00 00    r5 = *(u8 *)(r2 + 13)
     133:    73 54 0d 00 00 00 00 00    *(u8 *)(r4 + 13) = r5
     134:    71 25 0e 00 00 00 00 00    r5 = *(u8 *)(r2 + 14)
     135:    73 54 0e 00 00 00 00 00    *(u8 *)(r4 + 14) = r5
     136:    b7 02 00 00 0b 00 00 00    r2 = 11
     137:    73 20 5e 00 00 00 00 00    *(u8 *)(r0 + 94) = r2
     138:    73 70 65 00 00 00 00 00    *(u8 *)(r0 + 101) = r7
     139:    73 70 64 00 00 00 00 00    *(u8 *)(r0 + 100) = r7
     140:    73 70 63 00 00 00 00 00    *(u8 *)(r0 + 99) = r7
     141:    73 70 62 00 00 00 00 00    *(u8 *)(r0 + 98) = r7
     142:    73 70 61 00 00 00 00 00    *(u8 *)(r0 + 97) = r7
     143:    73 70 60 00 00 00 00 00    *(u8 *)(r0 + 96) = r7
     144:    73 70 5f 00 00 00 00 00    *(u8 *)(r0 + 95) = r7
     145:    73 70 5d 00 00 00 00 00    *(u8 *)(r0 + 93) = r7
     146:    73 70 5c 00 00 00 00 00    *(u8 *)(r0 + 92) = r7
     147:    73 70 5b 00 00 00 00 00    *(u8 *)(r0 + 91) = r7
     148:    73 70 5a 00 00 00 00 00    *(u8 *)(r0 + 90) = r7
     149:    73 70 59 00 00 00 00 00    *(u8 *)(r0 + 89) = r7
     150:    73 70 58 00 00 00 00 00    *(u8 *)(r0 + 88) = r7
     151:    73 70 57 00 00 00 00 00    *(u8 *)(r0 + 87) = r7
     152:    b7 02 00 00 04 00 00 00    r2 = 4
     153:    73 20 56 00 00 00 00 00    *(u8 *)(r0 + 86) = r2
     154:    bf 04 00 00 00 00 00 00    r4 = r0
     155:    07 04 00 00 66 00 00 00    r4 += 102
     156:    18 05 00 00 0f 00 00 00 00 00 00 00 00 00 00 00    r5 = 15 ll
     158:    71 58 00 00 00 00 00 00    r8 = *(u8 *)(r5 + 0)
     159:    73 84 00 00 00 00 00 00    *(u8 *)(r4 + 0) = r8
     160:    71 58 01 00 00 00 00 00    r8 = *(u8 *)(r5 + 1)
     161:    73 84 01 00 00 00 00 00    *(u8 *)(r4 + 1) = r8
     162:    71 58 02 00 00 00 00 00    r8 = *(u8 *)(r5 + 2)
     163:    73 84 02 00 00 00 00 00    *(u8 *)(r4 + 2) = r8
     164:    71 58 03 00 00 00 00 00    r8 = *(u8 *)(r5 + 3)
     165:    73 84 03 00 00 00 00 00    *(u8 *)(r4 + 3) = r8
     166:    71 58 04 00 00 00 00 00    r8 = *(u8 *)(r5 + 4)
     167:    73 84 04 00 00 00 00 00    *(u8 *)(r4 + 4) = r8
     168:    71 58 05 00 00 00 00 00    r8 = *(u8 *)(r5 + 5)
     169:    73 84 05 00 00 00 00 00    *(u8 *)(r4 + 5) = r8
     170:    71 58 06 00 00 00 00 00    r8 = *(u8 *)(r5 + 6)
     171:    73 84 06 00 00 00 00 00    *(u8 *)(r4 + 6) = r8
     172:    71 58 07 00 00 00 00 00    r8 = *(u8 *)(r5 + 7)
     173:    73 84 07 00 00 00 00 00    *(u8 *)(r4 + 7) = r8
     174:    71 58 08 00 00 00 00 00    r8 = *(u8 *)(r5 + 8)
     175:    73 84 08 00 00 00 00 00    *(u8 *)(r4 + 8) = r8
     176:    71 58 09 00 00 00 00 00    r8 = *(u8 *)(r5 + 9)
     177:    73 84 09 00 00 00 00 00    *(u8 *)(r4 + 9) = r8
     178:    71 58 0a 00 00 00 00 00    r8 = *(u8 *)(r5 + 10)
     179:    73 84 0a 00 00 00 00 00    *(u8 *)(r4 + 10) = r8
     180:    b7 04 00 00 17 00 00 00    r4 = 23
     181:    73 40 a5 00 00 00 00 00    *(u8 *)(r0 + 165) = r4
     182:    b7 04 00 00 10 00 00 00    r4 = 16
     183:    73 40 9d 00 00 00 00 00    *(u8 *)(r0 + 157) = r4
     184:    73 10 95 00 00 00 00 00    *(u8 *)(r0 + 149) = r1
     185:    73 30 8d 00 00 00 00 00    *(u8 *)(r0 + 141) = r3
     186:    b7 01 00 00 06 00 00 00    r1 = 6
     187:    73 10 85 00 00 00 00 00    *(u8 *)(r0 + 133) = r1
     188:    b7 01 00 00 13 00 00 00    r1 = 19
     189:    73 10 81 00 00 00 00 00    *(u8 *)(r0 + 129) = r1
     190:    73 20 79 00 00 00 00 00    *(u8 *)(r0 + 121) = r2
     191:    73 70 ac 00 00 00 00 00    *(u8 *)(r0 + 172) = r7
     192:    73 70 ab 00 00 00 00 00    *(u8 *)(r0 + 171) = r7
     193:    73 70 aa 00 00 00 00 00    *(u8 *)(r0 + 170) = r7
     194:    73 70 a9 00 00 00 00 00    *(u8 *)(r0 + 169) = r7
     195:    73 70 a8 00 00 00 00 00    *(u8 *)(r0 + 168) = r7
     196:    73 70 a7 00 00 00 00 00    *(u8 *)(r0 + 167) = r7
     197:    73 70 a6 00 00 00 00 00    *(u8 *)(r0 + 166) = r7
     198:    73 70 a4 00 00 00 00 00    *(u8 *)(r0 + 164) = r7
     199:    73 70 a3 00 00 00 00 00    *(u8 *)(r0 + 163) = r7
     200:    73 70 a2 00 00 00 00 00    *(u8 *)(r0 + 162) = r7
     201:    73 70 a1 00 00 00 00 00    *(u8 *)(r0 + 161) = r7
     202:    73 70 a0 00 00 00 00 00    *(u8 *)(r0 + 160) = r7
     203:    73 70 9f 00 00 00 00 00    *(u8 *)(r0 + 159) = r7
     204:    73 70 9e 00 00 00 00 00    *(u8 *)(r0 + 158) = r7
     205:    73 70 9c 00 00 00 00 00    *(u8 *)(r0 + 156) = r7
     206:    73 70 9b 00 00 00 00 00    *(u8 *)(r0 + 155) = r7
     207:    73 70 9a 00 00 00 00 00    *(u8 *)(r0 + 154) = r7
     208:    73 70 99 00 00 00 00 00    *(u8 *)(r0 + 153) = r7
     209:    73 70 98 00 00 00 00 00    *(u8 *)(r0 + 152) = r7
     210:    73 70 97 00 00 00 00 00    *(u8 *)(r0 + 151) = r7
     211:    73 70 96 00 00 00 00 00    *(u8 *)(r0 + 150) = r7
     212:    73 70 94 00 00 00 00 00    *(u8 *)(r0 + 148) = r7
     213:    73 70 93 00 00 00 00 00    *(u8 *)(r0 + 147) = r7
     214:    73 70 92 00 00 00 00 00    *(u8 *)(r0 + 146) = r7
     215:    73 70 91 00 00 00 00 00    *(u8 *)(r0 + 145) = r7
     216:    73 70 90 00 00 00 00 00    *(u8 *)(r0 + 144) = r7
     217:    73 70 8f 00 00 00 00 00    *(u8 *)(r0 + 143) = r7
     218:    73 70 8e 00 00 00 00 00    *(u8 *)(r0 + 142) = r7
     219:    73 70 8c 00 00 00 00 00    *(u8 *)(r0 + 140) = r7
     220:    73 70 8b 00 00 00 00 00    *(u8 *)(r0 + 139) = r7
     221:    73 70 8a 00 00 00 00 00    *(u8 *)(r0 + 138) = r7
     222:    73 70 89 00 00 00 00 00    *(u8 *)(r0 + 137) = r7
     223:    73 70 88 00 00 00 00 00    *(u8 *)(r0 + 136) = r7
     224:    73 70 87 00 00 00 00 00    *(u8 *)(r0 + 135) = r7
     225:    73 70 86 00 00 00 00 00    *(u8 *)(r0 + 134) = r7
     226:    73 70 84 00 00 00 00 00    *(u8 *)(r0 + 132) = r7
     227:    73 70 83 00 00 00 00 00    *(u8 *)(r0 + 131) = r7
     228:    73 70 82 00 00 00 00 00    *(u8 *)(r0 + 130) = r7
     229:    73 70 80 00 00 00 00 00    *(u8 *)(r0 + 128) = r7
     230:    73 70 7f 00 00 00 00 00    *(u8 *)(r0 + 127) = r7
     231:    73 70 7e 00 00 00 00 00    *(u8 *)(r0 + 126) = r7
     232:    73 70 7d 00 00 00 00 00    *(u8 *)(r0 + 125) = r7
     233:    73 70 7c 00 00 00 00 00    *(u8 *)(r0 + 124) = r7
     234:    73 70 7b 00 00 00 00 00    *(u8 *)(r0 + 123) = r7
     235:    73 70 7a 00 00 00 00 00    *(u8 *)(r0 + 122) = r7
     236:    73 70 78 00 00 00 00 00    *(u8 *)(r0 + 120) = r7
     237:    73 70 77 00 00 00 00 00    *(u8 *)(r0 + 119) = r7
     238:    73 70 76 00 00 00 00 00    *(u8 *)(r0 + 118) = r7
     239:    73 70 75 00 00 00 00 00    *(u8 *)(r0 + 117) = r7
     240:    73 70 74 00 00 00 00 00    *(u8 *)(r0 + 116) = r7
     241:    73 70 73 00 00 00 00 00    *(u8 *)(r0 + 115) = r7
     242:    73 70 72 00 00 00 00 00    *(u8 *)(r0 + 114) = r7
     243:    b7 01 00 00 05 00 00 00    r1 = 5
     244:    73 10 71 00 00 00 00 00    *(u8 *)(r0 + 113) = r1
     245:    bf 01 00 00 00 00 00 00    r1 = r0
     246:    07 01 00 00 ad 00 00 00    r1 += 173
     247:    18 02 00 00 1a 00 00 00 00 00 00 00 00 00 00 00    r2 = 26 ll
     249:    71 23 00 00 00 00 00 00    r3 = *(u8 *)(r2 + 0)
     250:    73 31 00 00 00 00 00 00    *(u8 *)(r1 + 0) = r3
     251:    71 23 01 00 00 00 00 00    r3 = *(u8 *)(r2 + 1)
     252:    73 31 01 00 00 00 00 00    *(u8 *)(r1 + 1) = r3
     253:    71 23 02 00 00 00 00 00    r3 = *(u8 *)(r2 + 2)
     254:    73 31 02 00 00 00 00 00    *(u8 *)(r1 + 2) = r3
     255:    71 23 03 00 00 00 00 00    r3 = *(u8 *)(r2 + 3)
     256:    73 31 03 00 00 00 00 00    *(u8 *)(r1 + 3) = r3
     257:    71 23 04 00 00 00 00 00    r3 = *(u8 *)(r2 + 4)
     258:    73 31 04 00 00 00 00 00    *(u8 *)(r1 + 4) = r3
     259:    71 23 05 00 00 00 00 00    r3 = *(u8 *)(r2 + 5)
     260:    73 31 05 00 00 00 00 00    *(u8 *)(r1 + 5) = r3
     261:    71 23 06 00 00 00 00 00    r3 = *(u8 *)(r2 + 6)
     262:    73 31 06 00 00 00 00 00    *(u8 *)(r1 + 6) = r3
     263:    71 23 07 00 00 00 00 00    r3 = *(u8 *)(r2 + 7)
     264:    73 31 07 00 00 00 00 00    *(u8 *)(r1 + 7) = r3
     265:    71 23 08 00 00 00 00 00    r3 = *(u8 *)(r2 + 8)
     266:    73 31 08 00 00 00 00 00    *(u8 *)(r1 + 8) = r3
     267:    71 23 09 00 00 00 00 00    r3 = *(u8 *)(r2 + 9)
     268:    73 31 09 00 00 00 00 00    *(u8 *)(r1 + 9) = r3
     269:    71 23 0a 00 00 00 00 00    r3 = *(u8 *)(r2 + 10)
     270:    73 31 0a 00 00 00 00 00    *(u8 *)(r1 + 10) = r3
     271:    71 23 0b 00 00 00 00 00    r3 = *(u8 *)(r2 + 11)
     272:    73 31 0b 00 00 00 00 00    *(u8 *)(r1 + 11) = r3
     273:    71 23 0c 00 00 00 00 00    r3 = *(u8 *)(r2 + 12)
     274:    73 31 0c 00 00 00 00 00    *(u8 *)(r1 + 12) = r3
     275:    71 23 0d 00 00 00 00 00    r3 = *(u8 *)(r2 + 13)
     276:    73 31 0d 00 00 00 00 00    *(u8 *)(r1 + 13) = r3
     277:    71 23 0e 00 00 00 00 00    r3 = *(u8 *)(r2 + 14)
     278:    73 31 0e 00 00 00 00 00    *(u8 *)(r1 + 14) = r3
     279:    71 23 0f 00 00 00 00 00    r3 = *(u8 *)(r2 + 15)
     280:    73 31 0f 00 00 00 00 00    *(u8 *)(r1 + 15) = r3
     281:    71 23 10 00 00 00 00 00    r3 = *(u8 *)(r2 + 16)
     282:    73 31 10 00 00 00 00 00    *(u8 *)(r1 + 16) = r3
     283:    71 23 11 00 00 00 00 00    r3 = *(u8 *)(r2 + 17)
     284:    73 31 11 00 00 00 00 00    *(u8 *)(r1 + 17) = r3
     285:    71 23 12 00 00 00 00 00    r3 = *(u8 *)(r2 + 18)
     286:    73 31 12 00 00 00 00 00    *(u8 *)(r1 + 18) = r3
     287:    71 23 13 00 00 00 00 00    r3 = *(u8 *)(r2 + 19)
     288:    73 31 13 00 00 00 00 00    *(u8 *)(r1 + 19) = r3
     289:    71 23 14 00 00 00 00 00    r3 = *(u8 *)(r2 + 20)
     290:    73 31 14 00 00 00 00 00    *(u8 *)(r1 + 20) = r3
     291:    71 23 15 00 00 00 00 00    r3 = *(u8 *)(r2 + 21)
     292:    73 31 15 00 00 00 00 00    *(u8 *)(r1 + 21) = r3
     293:    71 23 16 00 00 00 00 00    r3 = *(u8 *)(r2 + 22)
     294:    73 31 16 00 00 00 00 00    *(u8 *)(r1 + 22) = r3
     295:    bf 61 00 00 00 00 00 00    r1 = r6
     296:    18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00    r2 = 0 ll
     298:    18 03 00 00 ff ff ff ff 00 00 00 00 00 00 00 00    r3 = 4294967295 ll
     300:    bf 04 00 00 00 00 00 00    r4 = r0
     301:    b7 05 00 00 c4 00 00 00    r5 = 196
     302:    85 00 00 00 19 00 00 00    call 25

0000000000000978 LBB0_2:
     303:    b7 00 00 00 00 00 00 00    r0 = 0
     304:    95 00 00 00 00 00 00 00    exit

Usage: aya-rust-sangam [OPTIONS]

Options:
  -c, --cgroup-path   [default: /sys/fs/cgroup/unified]
  -h, --help                       Print help

That's it for this part we will learn more around aya and ebpf .
the eBPF developer experience by allowing Rust programs to easily run within the kernel.
Aya is the first Rust-native eBPF library that is similar in nature to libbpf but entirely written in the Rust programming language, popular for its memory safety and concurrency features, among other reasons this programming language is becoming very popular for systems programming.



Web Scraping in Golang
Siddhesh Khandagale — Sun, 05 Feb 2023 19:28:18 GMT
Introduction
Every developer uses web scraping as a necessary tool at some time in their career. Therefore, developers must understand web scrapers and how to create them.
In this blog, we will be covering the basics of web scraping in Go using the Fiber and Colly frameworks. Colly is an open-source web scraping framework written in Go. It provides a simple and flexible API for performing web scraping tasks, making it a popular choice among Go developers. Colly uses Go's concurrency features to efficiently handle multiple requests and extract data from websites. It offers a wide range of customization options, including the ability to set request headers, handle cookies, follow redirects, and more
We'll start with a simple example of extracting data from a website and then move on to more advanced topics like customizing the scraping process and setting request headers. By the end of this blog, you'll have a solid understanding of how to build a web scraper using Go and be able to extract data from any website.
Prerequisites
To continue with the tutorial, firstly you need to have Golang and Fiber installed.
Installations :

Golang

Fiber: We'll see this ahead in the tutorial.

Colly: We'll see this ahead in the tutorial.


Getting Started
Let's get started by creating the main project directory Go-Scraper by using the following command.
(🟥Be careful, sometimes I've done the explanation by commenting in the code)
mkdir Go-Scraper //Creates a 'Go-Scraper' directory
cd Go-Scraper //Change directory to 'Go-Scraper'

Now initialize a mod file. (If you publish a module, this must be a path from which your module can be downloaded by Go tools. That would be your code's repository.)
go mod init github.com//Go-Scraper

To install the Fiber Framework run the following command :
go get -u github.com/gofiber/fiber/v2

To install the Colly Framework run the following command :
go get -u github.com/gocolly/colly/...

Now, let's make the main.go in which we are going to implement the scraping process.
In the main.go file, the first step is to initialize a new Fiber app using the fiber.New() method. This creates a new instance of the Fiber framework that will handle the HTTP requests and responses.
Next, we define a new endpoint for the web scraper by calling the app.Get("/scrape", ...) method. This creates a new GET endpoint at the /scrape route, which will be used to trigger the web scraping process.
package main

import (
    "fmt"
    "github.com/gofiber/fiber/v2"
)

func main() {
    app := fiber.New() // Creating a new instance of Fiber.
    app.Get("/scrape", func(c *fiber.Ctx) error {
        return c.SendString("Go Web Scraper")
    })
    app.Listen(":8080")
}

After running the go run main.go command the terminal will look like this,

Let's create a new instance of the Colly collector using the colly.NewCollector() method. The collector is responsible for visiting the website, extracting data, and storing the results.
collector := colly.NewCollector(
    colly.AllowedDomains("j2store.net"),
)
collector.OnRequest(func(r *colly.Request) {
    fmt.Println("Visiting", r.URL)
})

The colly.AllowedDomains property in the Colly framework is used to restrict the domains that the web scraper is allowed to visit. This property is used to prevent the scraper from visiting unwanted websites. For this blog, we are going to use this site which contains sample data and the domain is j2store.net .
The Colly collector can be configured in a variety of ways to customize the web scraping process. In this case, we define a request handler using the collector.OnRequest(...) method. This handler is called each time a request is made to the website, and it simply logs the URL being visited.
Now, to extract data from the website, we are going to use the collector.OnHTML(...) method to define a handler for a specific HTML element.
This is how the sample data on the site looks,

Here are some product images, their names and their price. We are just going the extract their names, image URL and prices.
So, let's create a struct item containing these three fields i.e. Name, Price, Image URL. The data type is defined as a string. JSON field is added as we are going to return all the data in JSON.
type item struct {
    Name   string `json:"name"`
    Price  string `json:"price"`
    ImgUrl string `json:"imgurl"`
}

Now, Let's work on the OnHTML() callback.
collector.OnHTML("div.col-sm-9 div[itemprop=itemListElement] ", func(h *colly.HTMLElement) {
    item := item{
        Name:   h.ChildText("h2.product-title"),
        Price:  h.ChildText("div.sale-price"),
        ImgUrl: h.ChildAttr("img", "src"),
    }
    items = append(items, item)
})

Here, inside the OnHTML() function firstly, we added something inside quotes that is the parent element it's a CSS selector, inside this div tags all the products are added. You can see it on the page by Inspect Element and hovering over the product just like the way I did in the image below. This means that whenever this parent element comes then this OnHTML callback must be called.

We've used the child element to get only the required data i.e the Name, Price and the ImgUrl. You can see these Child elements just the way we did for the parent element.
Finally, add the product details one by one into items .
Now, the main.go will look like,
package main

import (
    "fmt"

    "github.com/gocolly/colly"
    "github.com/gofiber/fiber/v2"
)

type item struct {
    Name   string `json:"name"`
    Price  string `json:"price"`
    ImgUrl string `json:"imgurl"`
}

func main() {
    app := fiber.New()
    app.Get("/scrape", func(c *fiber.Ctx) error {
        var items []item
        collector := colly.NewCollector(
            colly.AllowedDomains("j2store.net"),
        )
        collector.OnRequest(func(r *colly.Request) {
            fmt.Println("Visiting", r.URL)
        })

        collector.OnHTML("div.col-sm-9 div[itemprop=itemListElement] ", func(h *colly.HTMLElement) {
            item := item{
                Name:   h.ChildText("h2.product-title"),
                Price:  h.ChildText("div.sale-price"),
                ImgUrl: h.ChildAttr("img", "src"),
            }
            items = append(items, item)
        })

        collector.Visit("http://j2store.net/demo/index.php/shop") // initiate a request to the specified URL.
        return c.JSON(items) //we return the extracted data to the client by calling the c.JSON(...) method.
    })

    app.Listen(":8080")
}

Now, run the command go run main.go and head to http://127.0.0.1:8080/scrape on your browser.
You'll see the data like the following,

Now, this data is from the first page but there are multiple pages on the site so we've to deal with all the pages. Colly Framework works very well with this. We need to add one more OnHTML callback for moving to the next page.
collector.OnHTML("[title=Next]", func(e *colly.HTMLElement) {
    next_page := e.Request.AbsoluteURL(e.Attr("href"))
    collector.Visit(next_page)
})

[title=Next] is the CSS selector for the Next button. You can see this by following the same way as did earlier. Now the URL added in the href tag is not an absolute URL, so we've used the AbsoluteUrl() function to convert the relative URL to an absolute URL.
Now, run the command go run main.go and head to http://127.0.0.1:8080/scrape on your browser.

You'll see all product details from all the pages.
This is the basic implementation of a web scraper using the Fiber and Colly frameworks in Go
Conclusion
You can find the complete code repository for this tutorial here 👉Github.
Now, I hope you must have a solid foundation to build more complex and sophisticated web scraping projects. Now, you can try Scraping dynamic websites along with Data storage(SQL or NoSQL), Image and file download, Distributed scraping and so on.
Until then Keep Learning, Keep Building 🚀🚀



Writing Rust CLIs - Clap
Sangam Biradar — Thu, 19 Jan 2023 10:49:49 GMT
How echo works
purpose of this is to show you how to use arguments from the command line to change the behaviour of the program at runtime.
$ echo Hello
Hello

to start echo will prints its arguments to STDOUT
➜  rustlabs echo "welcome to  rustlabs "
welcome to  rustlabs 
➜  rustlabs echo welcome to  rustlabs  
welcome to rustlabs

if you want the spaces to be prevented I must enclose them in quotes.
man echo you will see more options around it .
ECHO(1)                                                          General Commands Manual                                                         ECHO(1)

NAME
     echo – write arguments to the standard output

SYNOPSIS
     echo [-n] [string ...]

DESCRIPTION
     The echo utility writes any specified operands, separated by single blank (‘ ’) characters and followed by a newline (‘\n’) character, to the
     standard output.

     The following option is available:

     -n    Do not print the trailing newline character.  This may also be achieved by appending ‘\c’ to the end of the string, as is done by iBCS2
           compatible systems.  Note that this option as well as the effect of ‘\c’ are implementation-defined in IEEE Std 1003.1-2001 (“POSIX.1”) as
           amended by Cor. 1-2002.  Applications aiming for maximum portability are strongly encouraged to use printf(1) to suppress the newline
           character.

     Some shells may provide a builtin echo command which is similar or identical to this utility.  Most notably, the builtin echo in sh(1) does not
     accept the -n option.  Consult the builtin(1) manual page.

EXIT STATUS
     The echo utility exits 0 on success, and >0 if an error occurs.

SEE ALSO
     builtin(1), csh(1), printf(1), sh(1)

STANDARDS
     The echo utility conforms to IEEE Std 1003.1-2001 (“POSIX.1”) as amended by Cor. 1-2002.

macOS 13.1                                                           April 12, 2003                                                           macOS 13.1

by default the text that echo prints on the command line are terminated by a new line character. if you see the above manual the program has a single -n option to omit the final newline.
➜  rustlabs echo -n Hello > hello-n
➜  rustlabs echo Hello > hello-a

the diff tool will display the difference between the two files .
rustlabs echo Hello > hello-a 
➜  rustlabs diff hello-n hello-a    
1c1
< Hello
\ No newline at end of file
---
> Hello


getting started
lets a new directory with the name echor using cargo :
$ cargo new echor
     Created binary (application) `echor` package

change the new directory to see the structure
➜  rustlabs cd echor 
➜  echor git:(master) ✗ tree
.
├── Cargo.toml
└── src
    └── main.rs

1 directory, 2 files

use cargo to run the program
➜  echor git:(master) ✗ cargo run
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
    Finished dev [unoptimized + debuginfo] target(s) in 0.84s
     Running `target/debug/echor`
Hello, world!

rust will start the program executing the main function in src/main.rs all function in src/main all functions return a value and the return type may be indicated with an arrow and the type such as -> u32 to say the function returns an unsigned 32-bit integer . the lack of any return type for the main implies that the function returns what calls the unit type /
println! the macro will automatically append a new line to the output, which is a feature you'll need to control when the user requests no terminating newline.

the unit type is like an empty value and is signified with a set of empty parentheses () the documentation says this "is used when there is no other meaningful value that could be returned " its not quite like a null pointer or undefined value in other languages


Accessing the command-line arguments
getting the command-line arguments to print. you can use std::env::args here std::env to interact with the environment which is where the program will find the arguments if you look at the documentation for a function, you will see it returns something of the type args
pub fn args() -> args

edit src/main.rs to print the arguments. you can call the function by using the full path followed by an empty set of parentheses
fn main() {
    println!(std::env::args());
}

execute the program using cargo run
echor git:(master) ✗ cargo run
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
error: format argument must be a string literal
 --> src/main.rs:2:14
  |
2 |     println!(std::env::args());
  |              ^^^^^^^^^^^^^^^^
  |
help: you might be missing a string literal to format with
  |
2 |     println!("{}", std::env::args());
  |              +++++

error: could not compile `echor` due to previous error

here you can't directly print the value that is returned from the function but it also suggests how to fix the problem. it wants you to first provide a literal string that has a set of curly braces {} that will serve as a placeholder for printed value so change the code
fn main() {
    println!("{}",std::env::args());
}

execute cargo run
➜  echor git:(master) ✗ cargo run
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
error[E0277]: `Args` doesn't implement `std::fmt::Display`
 --> src/main.rs:2:19
  |
2 |     println!("{}",std::env::args());
  |                   ^^^^^^^^^^^^^^^^ `Args` cannot be formatted with the default formatter
  |
  = help: the trait `std::fmt::Display` is not implemented for `Args`
  = note: in format strings you may be able to use `{:?}` (or {:#?} for pretty-print) instead
  = note: this error originates in the macro `$crate::format_args_nl` which comes from the expansion of the macro `println` (in Nightly builds, run with -Z macro-backtrace for more info)

For more information about this error, try `rustc --explain E0277`.
error: could not compile `echor` due to previous error

there is a lot of information in that compiler message. the trait std::fmt::Display not being implemented for Args . A trait in rust is a way to define the behaviour of an object abstractly. if an object implements the Display trait, then it can be formatted for user-facing out.
The compiler suggests you should use {:?} instead of {} for placeholder . this is an instruction to print a Debug a version of the structure, which will format the output in debugging context
fn main() {
    println!("{:?}",std::env::args());
}

execute cargo run

➜  echor git:(master) ✗ cargo run
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
    Finished dev [unoptimized + debuginfo] target(s) in 0.44s
     Running `target/debug/echor`
Args { inner: ["target/debug/echor"] }

if you are unfamiliar with command line arguments, it's common for the first value to be the path of the program itself.
➜  echor git:(master) ✗ cargo run hello world
    Finished dev [unoptimized + debuginfo] target(s) in 0.00s
     Running `target/debug/echor hello world`
Args { inner: ["target/debug/echor", "hello", "world"] }

let's see with -n flag
  echor git:(master) ✗ cargo run hello world -n
    Finished dev [unoptimized + debuginfo] target(s) in 0.03s
     Running `target/debug/echor hello world -n`
Args { inner: ["target/debug/echor", "hello", "world", "-n"] }

cargo think the -n argument itself

Adding Clap as a Dependency
there are various methods and crates for parsing command-line arguments. we will use clap (https://crates.io/crates/clap)
let's add clap dependency to Cargo.toml
[package]
name = "echor"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
clap = "4.1.1"

here we are using 4.1.1 a version of clap as a dependency
run cargo build to just build the new binary and not run it :
➜  echor git:(master) ✗ cargo build             
    Updating crates.io index
  Downloaded clap_lex v0.3.1
  Downloaded io-lifetimes v1.0.4
  Downloaded is-terminal v0.4.2
  Downloaded termcolor v1.2.0
  Downloaded errno v0.2.8
  Downloaded rustix v0.36.6
  Downloaded os_str_bytes v6.4.1
  Downloaded clap v4.1.1
  Downloaded 8 crates (599.0 KB) in 0.55s
   Compiling libc v0.2.139
   Compiling io-lifetimes v1.0.4
   Compiling rustix v0.36.6
   Compiling bitflags v1.3.2
   Compiling os_str_bytes v6.4.1
   Compiling termcolor v1.2.0
   Compiling strsim v0.10.0
   Compiling clap_lex v0.3.1
   Compiling errno v0.2.8
   Compiling is-terminal v0.4.2
   Compiling clap v4.1.1
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
    Finished dev [unoptimized + debuginfo] target(s) in 13.25s


a consequence of rust placing the dependencies into a target is that this directory is now quite large. you can use the disk usage command du -shc


parsing Command Line Arguments using Clap
update src/main.rs that creates a new clap::Command struct to parsing the command line arguments
use clap::Command;

fn main() {
    let _matches = Command::new("echor-app")
    .version("0.1.0")
    .author("Sangam Biradar )
    .about("Rust echo")
    .get_matches();
}


Import the clap::Command struct

Create a new App with the name echor app

User Semantic version information

Include your name and email address so people know where to send the help


execute cargo run
echor git:(master) ✗ cargo run -- -h
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
    Finished dev [unoptimized + debuginfo] target(s) in 0.76s
     Running `target/debug/echor -h`
Rust echo

Usage: echor

Options:
  -h, --help     Print help
  -V, --version  Print version 
➜  echor git:(master) ✗ cargo run -- -V
    Finished dev [unoptimized + debuginfo] target(s) in 0.02s
     Running `target/debug/echor -V`
echor-app 0.1.0

Inable derive flag you can create application declaratievly with struct
use std::path::PathBuf;

use clap::{Parser, Subcommand};

#[derive(Parser)]
#[command(author, version, about, long_about = None)]
struct Cli {
    /// Optional name to operate on
    name: Option<String>,

    /// Sets a custom config file
    #[arg(short, long, value_name = "FILE")]
    config: Option,

    /// Turn debugging information on
    #[arg(short, long, action = clap::ArgAction::Count)]
    debug: u8,

    #[command(subcommand)]
    command: Option,
}

#[derive(Subcommand)]
enum Commands {
    /// does testing things
    Test {
        /// lists test values
        #[arg(short, long)]
        list: bool,
    },
}

fn main() {
    let cli = Cli::parse();

    // You can check the value provided by positional arguments, or option arguments
    if let Some(name) = cli.name.as_deref() {
        println!("Value for name: {}", name);
    }

    if let Some(config_path) = cli.config.as_deref() {
        println!("Value for config: {}", config_path.display());
    }

    // You can see how many times a particular flag or argument occurred
    // Note, only flags can have multiple occurrences
    match cli.debug {
        0 => println!("Debug mode is off"),
        1 => println!("Debug mode is kind of on"),
        2 => println!("Debug mode is on"),
        _ => println!("Don't be crazy"),
    }

    // You can check for the existence of subcommands, and if found use their
    // matches just as you would the top level cmd
    match &cli.command {
        Some(Commands::Test { list }) => {
            if *list {
                println!("Printing testing lists...");
            } else {
                println!("Not printing testing lists...");
            }
        }
        None => {}
    }

    // Continued program logic goes here...
}

cargo run
cargo run -- -h     
   Compiling echor v0.1.0 (/Users/sangambiradar/Documents/rustlabs/echor)
    Finished dev [unoptimized + debuginfo] target(s) in 0.46s
     Running `target/debug/echor -h`
Usage: echor [OPTIONS] [NAME] [COMMAND]

Commands:
  test  does testing things
  help  Print this message or the help of the given subcommand(s)

Arguments:
  [NAME]  Optional name to operate on

Options:
  -c, --config   Sets a custom config file
  -d, --debug...       Turn debugging information on
  -h, --help           Print help
  -V, --version        Print version
➜  echor git:(master) ✗

add Clap withderive feature for CLI and anyhow for error propagation
cargo add clap -F derive
cargo add anyhow

organize directory with the following file structure
 src
├── commands
│   ├── cli.rs
│   └── mod.rs
└── main.rs
Cargo.lock
Cargo.toml

add the following code to src/commands/mod.rs
pub mod cli;

add the following code to src/commands/cli.rs
use anyhow::Result;
use clap::Parser;

/// Rusty example app
#[derive(Parser, Debug)]
#[command(version, bin_name = "rusty", disable_help_subcommand = true)]
pub struct Cli {}

impl Cli {
    pub fn exec(&self) -> Result<()> {
        println!("Hello, World!");

        Ok(())
    }
}

update entry point
mod commands;

use anyhow::Result;
use clap::Parser;


use crate::commands::cli::Cli;

fn main() -> Result<()> {
    let cli = Cli::parse();

    cli.exec()
}

execute cargo run
 cargo run -q -- --help
Rusty example app

Usage: rusty

Options:
  -h, --help     Print help
  -V, --version  Print version


Argument Passing
src
├── commands
│   ├── cli.rs
│   ├── exec.rs
│   └── mod.rs
└── main.rs
Cargo.lock
Cargo.toml

create the following file with content src/commands/exec.rs
use anyhow::Result;
use clap::Args;
use std::process::{exit, Command};

/// Execute an arbitrary command
///
/// All arguments are passed through unless --help is first
#[derive(Args, Debug)]
#[command()]
pub struct Cli {
    #[arg(required = true, trailing_var_arg = true, allow_hyphen_values = true)]
    args: Vec<String>,
}

impl Cli {
    pub fn exec(&self) -> Result<()> {
        let mut command = Command::new(&self.args[0]);
        if self.args.len() > 1 {
            command.args(&self.args[1..]);
        }

        let status = command.status()?;
        exit(status.code().unwrap_or(1));
    }
}

add new module
pub mod cli;
pub mod exec;

modify root command
use anyhow::Result;
use clap::{Parser, Subcommand};

/// Rusty example app
#[derive(Parser, Debug)]
#[command(version, bin_name = "rusty", disable_help_subcommand = true)]
pub struct Cli {
    #[command(subcommand)]
    command: Commands,
}

#[derive(Subcommand, Debug)]
enum Commands {
    Exec(super::exec::Cli),
}

impl Cli {
    pub fn exec(&self) -> Result<()> {
        match &self.command {
            Commands::Exec(cli) => cli.exec(),
        }
    }
}

execute cargo run
❯ cargo run -q -- --help
Rusty example app

Usage: rusty 

Commands:
  exec  Execute an arbitrary command

Options:
  -h, --help     Print help information
  -V, --version  Print version information
❯ cargo run -q -- exec --help
Execute an arbitrary command

All arguments are passed through unless --help is first

Usage: rusty exec ...

Arguments:
  ...


Options:
  -h, --help
          Print help information (use `-h` for a summary)
❯ cargo run -q -- exec ls -a
.
..
.git
.gitignore
Cargo.lock
Cargo.toml
src
target




Writing Rust CLIs - Hello World !
Sangam Biradar — Sun, 15 Jan 2023 12:43:39 GMT
organizing Rust Project Directory
create a directory structure with the following commands
$ mkdir -p hello/src

mkdir the command will make a directory the -p options create a parent directory before creating a child directory
create hello.rs with the following content :

fn main(){
     println!("hello,world!");
}

move hello.rs source file into hello/src using the mv command :
$  mv hello.rs hello/src

use the cd command to change into that directory and compile your program again :
$ cd hello 
$ rustc src/hello.rs

you should now have a hello executable in the directory.
$ tree
➜  hello tree 
.
├── hello
└── src
    └── hello.rs


Creating and Running a project with Cargo
start a new rust project is to use the Cargo tool.
➜  hello cd ..
➜  rustlabs rm -rf hello

delete the existing project. the -r the recursive option will remove the contents of a directory and -f force option will skip any errors
Then start your project in a new using Cargo like so :
$ cargo new hello
     Created binary (application) `hello` package

this should create a new hello the directory that you can change into
  Created binary (application) `hello` package
➜  rustlabs tree
.
└── hello
    ├── Cargo.toml
    └── src
        └── main.rs

2 directories, 2 files
➜  rustlabs cd hello
➜  hello git:(master) ✗ tree    
.
├── Cargo.toml
└── src
    └── main.rs

1 directory, 2 files

Cargo.toml is a configuration file for the project. the extension .toml stands for Tom's Obvious, Minimal Language
the src the directory is for rust source code files
main.rs is the default starting point for the rust program
hello git:(master) ✗ cat src/main.rs 
fn main() {
    println!("Hello, world!");
}

we use to compile projects using rustc to combine the program. to run in one command using cargo run
 hello git:(master) ✗ cargo run 
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished dev [unoptimized + debuginfo] target(s) in 0.84s
     Running `target/debug/hello`
Hello, world!

if you would like for Cargo to not print status messages about compiling and running the code use the -q or --quiet options
cargo run --quiet
Hello, world!

use ls command to list the content of the current working directory
hello git:(master) ✗ ls
Cargo.lock Cargo.toml src        target

you will see the directory target/debug that contains the build artifacts
➜  hello git:(master) ✗ ./target/debug/hello
Hello, world!

why was the binary file called hello , though, and not main? to answer that at Cargo.toml
➜  hello git:(master) ✗ ls
Cargo.lock Cargo.toml src        target
➜  hello git:(master) ✗ cat Cargo.toml 
[package]
name = "hello"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]


name = "hello" of the project created with Cargo so it will also be the name of executable

version = "0.1.0" is the version of the program

edition = "2021" ate how the rust community introduce changes that are not backward compatible

# comment line

[dependencies] where you will list any external crates your project uses this project has none at this point so it's blank



Rust libraries are called crates and they use semantic version numbers in form major.minor.patch so that 1.2.4. a change in a major version indicates breaking changes in the create's public programming interface learn more - https://crates.io


Writing and Running Integration tests
let's create a test directory, goal is to test the hello program by running it on the command line as the user will do . create the file tests/cli.rs
#[test]
fn works(0
  assert!(true);
}


#[test] attribute tells rust to run this function when testing

assert! macro assert that a boolean expression is true


now our project look lake this
➜  hello git:(master) ✗ mkdir tests 
➜  hello git:(master) ✗ cargo run 
    Finished dev [unoptimized + debuginfo] target(s) in 0.02s
     Running `target/debug/hello`
Hello, world!
➜  hello git:(master) ✗ tree -L 2
.
├── Cargo.lock
├── Cargo.toml
├── src
│   └── main.rs
├── target
│   ├── CACHEDIR.TAG
│   └── debug
└── tests
    └── cli.rs

4 directories, 5 files
➜  hello git:(master) ✗


Cargo.lock file records the exact versions of the dependencies used to build your pogram .[ Note:- you should not edit this file ]

the src the directory is for the Rust Source code files to build the program.

the target the directory holds the building artifacts

the tests the directory holds the Rust Source code for testing the program


run test
$ cargo run

➜  hello git:(master) ✗ cargo test 
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.62s
     Running unittests src/main.rs (target/debug/deps/hello-2d4f25cc5b31a396)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-4a0f9bf0df349d1e)

running 1 test
test works ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

the micro assert! will verify that expectation is true or assert_eq! to verify that something is an expected value since this test is evaluating the literal value test , it will always succeed .
#[test]
fn works() {
    assert!(false);
}

run cargo test again
 hello git:(master) ✗ cargo test 
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.58s
     Running unittests src/main.rs (target/debug/deps/hello-2d4f25cc5b31a396)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-4a0f9bf0df349d1e)

running 1 test
test works ... FAILED

failures:

---- works stdout ----
thread 'works' panicked at 'assertion failed: false', tests/cli.rs:3:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    works

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

error: test failed, to rerun pass `--test cli`

Replace the contents of tests/cli.rs with the following code :
use std::process::Command;
#[test]
fn runs() {
    let mut cmd = Command::new("ls");
    let res = cmd.output();
    assert!(res.is_ok());

}


Import std::process::Commnd. The std tells us this is a standard library and is Rust code that is so universally useful it is included with the language

create a new Command to run ls The let the keyword will bind a value to a variable and mut will make variably mutable so that it can change


run test and varify your passong test
 cargo test
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.53s
     Running unittests src/main.rs (target/debug/deps/hello-2d4f25cc5b31a396)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-4a0f9bf0df349d1e)

running 1 test
test runs ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

lets update tests/cli.rs with the following code so that the runs function executes hello instead of ls
use std::process::Command;
#[test]
fn runs() {
    let mut cmd = Command::new("hello");
    let res = cmd.output();
    assert!(res.is_ok());

}

when you run a test case its get fail because hello the program can't be found :
 hello git:(master) ✗ cargo test
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.57s
     Running unittests src/main.rs (target/debug/deps/hello-2d4f25cc5b31a396)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-4a0f9bf0df349d1e)

running 1 test
test runs ... FAILED

failures:

---- runs stdout ----
thread 'runs' panicked at 'assertion failed: res.is_ok()', tests/cli.rs:6:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace


failures:
    runs

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

error: test failed, to rerun pass `--test cli`
➜  hello git:(master) ✗

recall the binary
➜  hello git:(master) ✗ hello
zsh: command not found: hello

when you execute any command your operating system look in predefined set of directories for something by neme

 hello git:(master) ✗ echo $PATH | tr : '\n'
/Users/sangambiradar/.docker/bin
/Users/sangambiradar/Downloads/google-cloud-sdk/bin
/Library/Frameworks/Python.framework/Versions/3.11/bin
/opt/homebrew/bin
/opt/homebrew/sbin
/usr/local/bin
/System/Cryptexes/App/usr/bin
/usr/bin
/bin
/usr/sbin
/sbin
/Users/sangambiradar/.docker/bin
/Users/sangambiradar/Downloads/google-cloud-sdk/bin
/Library/Frameworks/Python.framework/Versions/3.11/bin
/opt/homebrew/bin
/opt/homebrew/sbin
/Users/sangambiradar/.cargo/bin
➜  hello git:(master) ✗

if we change the directory also it will not work if you refer current directory with binary, not the command
➜  hello git:(master) ✗ cd target/debug 
➜  debug git:(master) ✗ hello
zsh: command not found: hello

run executable binary
➜  debug git:(master) ✗ ./hello
Hello, world!


Adding a Project Dependency
we have seen so far only in the target/debug directory. if we can copy it to $PATH directory ) so it will execute and test run successfully . but don't want to copy my program and test it.
I can use crate assert_cmd to find the program in my crate directory.
[package]
name = "hello"
version = "0.1.0"
edition = "2021"


[dependencies]

[dev-dependencies]
assert_cmd = "1"

using this crate to create a command that looks in Cargo binary directories. that the following test does not verify that the program produces the correct output. update tests/cli.rs the run function will use assert_cmd::Command instead of std::process::Command
use assert_cmd::Command;
#[test]
fn runs() {
    let mut cmd = Command::cargo_bin("hello").unwrap();
    cmd.assert().success();

}


import assert_cmd::Command

Create Command to run hello in the current crate this returns a Results and code call Result::unwrap because the binary should be found if not found test will fail

use assert::success to ensure command successful


Run cargo run to verify test cases

hello git:(master) ✗ cargo test
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.32s
     Running unittests src/main.rs (target/debug/deps/hello-73f1e61ebe7b71e0)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-734782d1ff788617)

running 1 test
test runs ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.27s


Understanding Program exit values
what does it mean for a program to run successfully? command-line programs should report the final status to the operating system to indicate success or failure. ( POSIX) standards indicate that the standard exit code is 0 to. indicate success
TRUE(1)                                                                                   General Commands Manual                                                                                   TRUE(1)

NAME
     true – return true value

SYNOPSIS
     true

DESCRIPTION
     The true utility always returns with an exit code of zero.

     Some shells may provide a builtin true command which is identical to this utility.  Consult the builtin(1) manual page.

SEE ALSO
     builtin(1), csh(1), false(1), sh(1)

STANDARDS
     The true utility is expected to be IEEE Std 1003.2 (“POSIX.2”) compatible.

macOS 13.1                                                                                      June 9, 1993                                                                                     macOS 13.1

if you see the above command notes do nothing except return the exit code zero but I can inspect the bash variable $? to see the exit status of the recent command
$ true 
$ echo $?
0

the false command is will give 1
$ false 
$ echo $?
1

let's create src/bin using mkdir src/bin then create src/bin/true.rs with content:
fn main() {
    std::process::exit(0) 
}

run the program and manually check the exit value
➜  hello git:(master) ✗ cargo run --quiet --bin true 
➜  hello git:(master) ✗ echo $?
0

the --bin the option is the name of the binary target to run
add the following test to test/cli.rs to ensure it works correctly
cargo test
  hello git:(master) ✗ cargo test                   
   Compiling hello v0.1.0 (/Users/sangambiradar/Documents/rustlabs/hello)
    Finished test [unoptimized + debuginfo] target(s) in 0.48s
     Running unittests src/main.rs (target/debug/deps/hello-73f1e61ebe7b71e0)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/bin/true.rs (target/debug/deps/true-68835b704201d7bf)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-e061012399bb0d29)

running 1 test
test true_ok ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s

➜  hello git:(master) ✗

rust programmes will exit with the value zero by default . recall that src/main.rs doesn't explicitly call std::process::exit . this means that the true program can do nothing to change src/bin/true.rs to following
fun main() {}

run the test and verify its still passes
➜  hello git:(master) ✗ cargo run -q --bin true 
➜  hello git:(master) ✗ echo $?                 
0

let's write a false program at the following path src/bin/false.rs
fn main() {
    std::process::exit(1);
 }

exit with any value between 1 and 255 to indicate an error
✗ cargo run -q --bin false
error[E0601]: `main` function not found in crate `r#false`
  |
  = note: consider adding a `main` function to `src/bin/false.rs`

For more information about this error, try `rustc --explain E0601`.
error: could not compile `hello` due to previous error
➜  hello git:(master) ✗ echo $?                 
101

then add this test to tests/cli.ts to verify that the program reports a failure when run
$ cargo test

another way to write false program use std::process::abort change src/bin/false
fn main() {
    std::process::abort();
 }


Testing the program output
The hello world program exits correctly, I'd like to ensure it prints the correct output to STDOUT which is the standard place for output to appear and it is usually the console. update your runs function in tests/cli.rs to following :
#[test]
fn runs() {
   let mut cmd = Command::cargo_bin("hello").unwrap();
   cmd.assert().success().stdout("Hello,World!\n");
}

run the tests and verify the hello does indeed work correctly. change src/main.rs
fn main() {
    println!("Hello, world!!!");
}

run the tests again to observe a failing test
 hello git:(master) ✗ cargo test
    Finished test [unoptimized + debuginfo] target(s) in 0.04s
     Running unittests src/bin/false.rs (target/debug/deps/false-8eec864b008dbf20)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/main.rs (target/debug/deps/hello-73f1e61ebe7b71e0)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/bin/true.rs (target/debug/deps/true-68835b704201d7bf)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/cli.rs (target/debug/deps/cli-90bd290aca80271c)

running 1 test
test runs ... FAILED

failures:

---- runs stdout ----
thread 'runs' panicked at 'Unexpected stdout, failed diff original var
├── original: Hello,World!
├── diff: 
│   ---         orig
│   +++         var
│   @@ -1 +1 @@
│   -Hello,World!
│   +Hello, world!!!
└── var as str: Hello, world!!!

command=`"/Users/sangambiradar/Documents/rustlabs/hello/target/debug/hello"`
code=0
stdout=```"Hello, world!!!\n"

stderr=""
', /Users/sangambiradar/.cargo/registry/src/github.com-1ecc6299db9ec823/assert_cmd-1.0.8/src/assert.rs:124:9
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
failures:
    runs
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.41s
error: test failed, to rerun pass --test cli
➜  hello git:(master) ✗ cargo test

`-Hello,World!` is the expected output from the program

`+Hello, world!!!` is the output the program actually created

\`command=\`"/Users/sangambiradar/Documents/rustlabs/hello/target/debug/hello"\`\` is shortened version of the command

`code=0` exit code from the program was 0

stdout=\`\`\`"Hello, world!!!\\n"\`\` is the test that was received on `STDOUT`

---

#### exit values make programs composable

the exit value is important because a failed process used in conjunction with another process should cause the combination to failed . for instance, i can use the logical operator && in bash to chain two commands true and ls. Ony if the first process reports success will the second process run

```bash
hello git:(master) ✗ true && ls
Cargo.lock Cargo.toml src        target     tests



eBPF for Cybersecurity - Part 1
Sangam Biradar — Thu, 12 Jan 2023 02:32:20 GMT
What is eBPF ?

born out of a need for a better Linux tracing tool. first released in a limited capacity in 2014 with Linux 3.18, making full use of eBPF at least Linux 4.4 or above

eBPF can run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules

eBPf is a mechanism for Linux applications to execute code in Linux Kernal space eBPF has been used to create programs for networking, debugging , tracing, firewalls and more


to understand in more detail starting with Linux and it divides its memory into areas.

kernel space - in simple words to understand it, kernel space is where the core of the operating system resides and has all unrestricted access to all hardware - memory, storage, CPU, etc . due to the privileged nature of the kernel itself.
 kernel space is protected and allowed to run only trusted code which is kernel code and device drivers.

User space - user space is where anything is not a kernel process run e.g regular applications, user space code has limited access to hardware and replies on code running in kernel space for privileged operations such as disk or network or any I/O . this happens via kernel API referred to as "system calls"


while the system calls interface us sufficiently in most cases and developers need to add support to new hardware, implement new filesystems or even custom calls to make this possible for programmers to extend the base kernel without adding directly to kernel source code. Linux Kernel Modules (LKMs) serve this function.

LKM ( Linux Kernel Modules) are loaded directly kernel. it can load at runtime, removing the need to recompile the entire kernel and reboot the machine each time a new kernel module is required.
 

LKM is helpful but introduced risk to the system. Indeed also separations between Kernel and user space add several import security measures to the OS kernel. Kernel Services Connet user space to physical hardware.

LKMs can make the kernel Crash and kernel version upgradation can add more radius of security vulnerabilities. it's hard for maintainers too!


What does eBPF do?

" eBPF does to Linux what javaScript does to HTML " - Brenbdan Gregg , Sr Performace Engineer , Netflix


eBPF (Extended Berkeley Packet Filter) is a technology that makes it possible to run special programs deep inside the Linux operating system in an isolated way.

as it filers data packets from the network and embedded into the kernel, the BPF provides
  a network interface with a security layer that ensures the packet data is reliable and accessible using this approach teams can more easily collect the most important observability data from Linux applications and network resources.

Developed out of a need for improved Linux tracing tools, eBPF was influenced by dtrace tools available mainly for BSD and Solaris systems. unlike dtrace , Linux was not able to achieve a global overview of running systems rather it was restricted to specific frameworks for library calls functions and system calls.

Before being loaded into the kernel the eBPF program needs to pass a particular series of requirements. Verification includes executing the eBPF program in the virtual machine.
  

with 10,000+ lines of code, to carry out a set of checks the verified will go over the potential paths the eBPF program might take when executed in the kernel to ensure the program runs to completion without any looping which would result in a kernel lockup.

if all checks are cleared, the eBPF program is loaded and compiled into the kernel at a location in a code path and waits for the appropriate signal when the signal is received from an event the eBPF program loaded in the code path. once initiated the bytecode collects and executes information.

this way eBPF allows programmers to execute byte code safely within the Linux kernel without adding or changing kernel source code. It can't replace LKM altogether eBPF program introduces custom code that is related to protected hardware resources with a limited threat to the kernel.

eBPF programs are event-driven and are run when the kernel or an application passes a certain hook point. Pre-defined hooks include system calls, function entry/exit, kernel tracepoints, network events, and several others.


eBPF includes the following elements :

Predefined as eBPF is event-driven and its pass-through hook. Hooks are predefined and can include events like network events, system calls, function entry and exit kernel tracepoints. if there is no pre-defined hook for a certain requirement, you can create a user or kernel probe ( uprobe and kprobe)

Program verification - The eBPF system call can be used to load the eBPF program into the Linux kernel by using some eBPF library. when the program load into the kernel it has to verify to ensure it is safe to run

the program can only be loaded by a privileged eBPF process

the program won't crash or damage the system

It will not run in a loop. the program always runs to completion



eBPF maps - eBPF must be able to store its state and share collected data. user can access the eBPF map via system calls from both application and programs

Helper Calls - eBPF program needs to maintain its compatibility and avoid being bound to a specific Linux kernel. helper function are API provided by the kernel. helper calls allow programs to generate random numbers and receive time and date, access eBPF data, manipulate forwarding logic and network packets and more

Function and tail call - enabling function call to function to define called in the program. tails enable the execution of other eBPF programs



eBPF programs can be utilized for efficient networking, tracing and data profiling, observability, and security tooling, e.g., for threat defense and intrusion detection

why is this technology useful for security?
It extends visibility and control to all system calls as well as provides packet level visibility of all networking traffic in a singular system that doesn't have the performance implications of traditional security agents.

This allows for the following security use cases to be achieved easier than in the past:
1. Reduce alert fatigue - w/ additional insight from eBPF, teams can reduce alert fatigue by 97% with proper context, i.e. security observability
2. Security protection at point of attack
Why would a vendor implement eBPF?
1. Decouple security innovation from OS, while still allowing same deep insight as in-kernel tech
2. More system throughput
3. Consolidate sys call, network filtering & process context into single system
4. Limit overhead for observability
Conclusion
eBPF stands for the kernel and JavaScript stands for the Web browser. Although some challenges exist: eBPF development is not easy, eBPF is fast-paced and hard to keep up with, implementation details may vary by kernel version and there is no easy packaging/deployment solution. But this fundamental enabling technology is leading to a major wave of innovation in the kernel space, bringing immediate benefits in a cloud-native environment, especially due to its dynamic programmability, reliability and ability to get great workload visibility with minimal disruption.
The fact that we can inspect packets gives us extremely performant observability tools that can be mapped to other aspects such as Kubernetes metadata and get in-depth security forensics from the extracted information. We can use the ability to drop or modify packets for network policies and do encryption with eBPF for security. Also, since we can send packets and change the destination for a packet, eBPF allows us to create powerful network functionalities, such as load balancing, routing and service mesh.



OAuth 2.0 Implementation in Golang
Siddhesh Khandagale — Mon, 09 Jan 2023 19:45:22 GMT
Introduction :
Security is without doubt a very important feature for any public and even private facing service or API and it’s something that you need to pay a lot of attention to get right.
In this tutorial, we are going to see an in-depth explanation of OAuth2 and its implementation using Golang.
OAuth 2.0 :
OAuth 2.0, which stands for “Open Authorization”, is a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user.
OAuth 2.0 is an authorization protocol and NOT an authentication protocol. As such, it is designed primarily as a means of granting access to a set of resources, for example, remote APIs or user data.
OAuth 2.0 uses Access Tokens. An Access Token is a piece of data that represents the authorization to access resources on behalf of the end user. OAuth 2.0 doesn’t define a specific format for Access Tokens. However, in some contexts, the JSON Web Token (JWT) format is often used. This enables token issuers to include data in the token itself. Also, for security reasons, Access Tokens may have an expiration date.
What are we building :
In this tutorial, we are going to build a simple API using Google API for authentication and authorization of the user.

Prerequisites💯 :
To continue with the tutorial, firstly you need to have Golang and Fiber installed.
Installations :

Golang

Go-Fiber: We'll see this ahead in the tutorial.


Getting Started 🚀:
Let's get started by creating the main project directory go-oauth2 by using the following command.
(🟥Be careful, sometimes I've done the explanation by commenting in the code)
mkdir jwt-auth-api //Creates a 'jwt-auth-api' directory
cd jwt-auth-api //Change directory to 'jwt-auth-api'

Now initialize a mod file. (If you publish a module, this must be a path from which your module can be downloaded by Go tools. That would be your code's repository.)
go mod init github.com//go-oauth2

To install the Fiber Framework run the following command :
go get -u github.com/gofiber/fiber/v2

Client ID and Client Secret :
Before moving ahead let's get the Client ID and Client Secret for Google API which we are going to store in .env file in our main directory go-oauth2 .
Follow the steps below for getting the Client Credentials for Google API :

Open Google APIs console, Click on the Credentials page.

Click Create Credentials > OAuth client ID. Select the Application type as Web Application and add the name of the Application. For this tutorial, I've entered the Application as Go-Auth2 .

Click ADD URI under Authorized JavaScript origins and add http://localhost . Again click ADD URI and add http://localhost:8080 as URI 2.

Click ADD URI under Authorized redirect URIs and add http://localhost:8080/google_callback .

Copy the Client Credentials Displayed.


After getting the Credentials, store them in the .env file as shown below.
GOOGLE_CLIENT_ID :  //Replace  with your ID.
GOOGLE_CLIENT_SECRET :  //Replace  with your SECRET.

Initializing 💻:
Let's set up our server by creating a new instance of Fiber. For this create a file main.go and add the following code to it :
package main

import (
    "github.com/Siddheshk02/go-oauth2/controllers" //imoprting the controllers package
    "github.com/gofiber/fiber/v2"
)

func main() {
    app := fiber.New()

    app.Post("/google_login", controllers.GoogleLogin)
    app.Post("/google_callback", controllers.GoogleCallback)

    app.Listen(":8080")

}

Firstly, we are going to work on Google Login. So, comment on the Google Callback route for now.
Now, make a package/folder controllers , in this folder create google.go file.
We are going to create the GoogleLogin, GoogleCallback functions in the google.go file
We are going to use the golang.org/x/oauth2 package, to install it run the command,
go get golang.org/x/oauth2

Before working on these functions, we need to define the oauth2 configurations for the Google API.
Let's define oauth2.Config variable object GoogleLoginConfig in the GoogleConfig() function in config.go file. For this create a package/folder config and a file config.go inside the folder.
package config

import (
    "log"
    "os"

    "github.com/joho/godotenv"
    "golang.org/x/oauth2"
    "golang.org/x/oauth2/google"
)

type Config struct {
    GoogleLoginConfig oauth2.Config
}

var AppConfig Config

func GoogleConfig() oauth2.Config {
    err := godotenv.Load(".env")
    if err != nil {
        log.Fatalf("Some error occured. Err: %s", err)
    }

    AppConfig.GoogleLoginConfig = oauth2.Config{
        RedirectURL:  "http://localhost:8080/google_callback",
        ClientID:     os.Getenv("GOOGLE_CLIENT_ID"),
        ClientSecret: os.Getenv("GOOGLE_CLIENT_SECRET"),
        Scopes: []string{"https://www.googleapis.com/auth/userinfo.email",
            "https://www.googleapis.com/auth/userinfo.profile"},
        Endpoint: google.Endpoint,
    }

    return AppConfig.GoogleLoginConfig
}


RedirectURL: Redirect URLs are a critical part of the OAuth flow. After a user successfully authorizes an application, the authorization server will redirect the user back to the application.

ClientID: This we earlier stored in the .env file. The Client_ID is a public identifier for apps. It is not guessable by third parties, so many implementations use something like a 32-character hex string. If the client ID is guessable, it makes it slightly easier to craft phishing attacks against arbitrary applications. It must also be unique across all clients that the authorization server handles.

ClientSecret: This we earlier stored in the .env file. The Client_Secret is known only to the application and the authorization server. It is the application’s password. It must be sufficiently random to not be guessable, which means you should avoid using common UUID libraries which often take into account the timestamp or MAC address of the server generating it.

Scopes: It is a mechanism in OAuth 2.0 to limit an application's access to a user's account.


Update the main.go with the following code,
package main

import (
    "github.com/Siddheshk02/go-oauth2/config"
    "github.com/Siddheshk02/go-oauth2/controllers"
    "github.com/gofiber/fiber/v2"
)

func main() {
    app := fiber.New()

    config.GoogleConfig()

    app.Get("/google_login", controllers.GoogleLogin)
    //app.Post("/google_callback", controllers.GoogleCallback)

    app.Listen(":8080")

}

Now, let's work on the function GoogleLogin() in the google.go file.
package controllers

import (
    "github.com/Siddheshk02/go-oauth2/config"
    "github.com/gofiber/fiber/v2"
)

func GoogleLogin(c *fiber.Ctx) error {

    url := config.AppConfig.GoogleLoginConfig.AuthCodeURL("randomstate")

    c.Status(fiber.StatusSeeOther)
    c.Redirect(url)
    return c.JSON(url)
}

randomstate is called the State. It is a token to protect the user from CSRF attacks. You must always provide a non-empty string and validate that it matches the state query parameter on your redirect callback.
Now, let's test the login functions. Run the command go run main.go . Then go to the address http://127.0.0.1:8080/google_login in your browser. It must look like this,

If you are already signed in then it will show that particular mail id and Use another account option.
Now, the login function is done. Let's create the GoogleCallback function.
func GoogleCallback(c *fiber.Ctx) error {
    state := c.Query("state")
    if state != "randomstate" {
        return c.SendString("States don't Match!!")
    }

    code := c.Query("code")

    googlecon := config.GoogleConfig()

    token, err := googlecon.Exchange(context.Background(), code)
    if err != nil {
        return c.SendString("Code-Token Exchange Failed")
    }

    resp, err := http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken)
    if err != nil {
        return c.SendString("User Data Fetch Failed")
    }

    userData, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        return c.SendString("JSON Parsing Failed")
    }

    return c.SendString(string(userData))

}

Here, we are going to pass the state variable from the URL parameter and we are going to check the randomstate that we've set in the GoogleLogin function, matches the randomstate that we are getting. If it matches, then that's the correct data that we want.
Next, we are passing the code variable for getting the token from the google server using the function Exchange() .
After getting the access token, we are getting the user data in the variable resp . We are getting a JSON response and storing it in userData variable.
Let's test for the /google_callback route. Run the command go run main.go . Then go to the address http://127.0.0.1:8080/google_login in your browser. Sign in using your account. On Successful Sign-in, your data will be displayed.

So, the API is ready. Further, you can add other features by connecting it to a Database and adding new users in your App, more routes, etc.
The complete code is saved in this GitHub repository.



Build a Fullstack Application with Next.js,Tailwind  and Database ( MongoDB(or)HarperDB) with Auth(firebase)
MAHESHWARAN M — Mon, 02 Jan 2023 06:21:02 GMT
Introduction to Next.js
Next.js is a JavaScript framework for building server-rendered or statically-exported React applications. It was developed by the team at Vercel (formerly known as Zeit) and has gained popularity for its simplicity and ease of use.
One of the key benefits of using Next.js is that it allows you to build universal JavaScript applications, which means that the same code can be used on both the client and the server. This can lead to improved performance and a better user experience, as the server can pre-render pages and send them to the client, reducing the amount of work the client has to do.
Overall, Next.js is a powerful and flexible tool for building modern web applications and is well worth considering if you are looking to build a performant, scalable, and deployable app.
Here I am Writing a Few Combinations to Build a Fullstack Application using Next.js With Different databases Try your application architecture And choose Database and follow the section of the database with next.js.
Setting up a Next.js project with Visual Studio Code
To set up a Next.js project with Visual Studio Code (VS Code), you will need to have Node.js and npm (the Node Package Manager) installed on your machine. If you don't already have these tools, you can download them from the Node.js website (https://nodejs.org/) and follow the instructions to install them.

Open VS Code and click "File > Open Folder" to create a new folder for your project.

In the terminal, run the following command to create a new Next.js project using the Next.js CLI (Command Line Interface):


 npx create-next-app my-project


This will create a new directory called "my-project" with the necessary files and dependencies for a Next.js app.

Navigate into the new project directory by running the following command:
 cd my-project


To start the development server, run the following command:
 npm run dev


This will start the development server and open a new browser window with your Next.js app running at http://localhost:3000. Any changes you make to the



Setting up a Next.js project with GitHub Codespaces: (optional)

Go to https://github.com/ and log in to your account.

Navigate to the repository where you want to create your Next.js project.

Click the "Code" button and then select "Open in Codespaces" from the dropdown menu.

This will open a new Codespaces window with a terminal and code editor.

In the terminal, run the following command to create a new Next.js project using the Next.js CLI (Command Line Interface):
 npx create-next-app my-project


This will create a new directory called "my-project" with the necessary files and dependencies for a Next.js app.

To open the project in VS Code, click the "Open in Visual Studio Code" button in the top menu.

To start the development server from within VS Code, click the "Run" button in the top menu and select "Start Debugging" (or press "F5").

This will start the development server and open a new browser window with your Next.js app running at http://localhost:3000. Any changes you make to the code will be automatically reloaded in the browser.


Setting up a Next.js project with Docker:

Install Docker on your machine by following the instructions at https://docs.docker.com/get-docker/.

Open VS Code and click "File > Open Folder" to create a new folder for your project.

Create a new file called "Dockerfile" in the project directory and add the following lines to it:
 FROM node:14-alpine

 WORKDIR /app

 COPY package.json /app/package.json
 COPY package-lock.json /app/package-lock.json

 RUN npm install

 COPY . /app

 EXPOSE 3000

 CMD ["npm", "run", "dev"]


Create a new file called "docker-compose.yml" in the project directory and add the following lines to it:
 version: '3'
 services:
   app:
     build: .
     ports:
       - "3000:3000"


Run the following command to build the Docker image and start the development server:
 docker-compose up


This will start the development server and open a new browser window with your Next.js app running at http://localhost:3000. Any changes you make to the code will be automatically reloaded in the browser.


Next.js Pages
In Next.js, a page is a React component that is exported from a .js, .jsx, .ts, or .tsx file in the "pages" directory. Each page is associated with a route based on its file name. This means that if you have a file called "about.js" in the "pages" directory, it will be accessible at the route "/about".
To create a page in Next.js, you can create a new file in the "pages" directory with a relevant name and export a React component from it. For example, to create an "About" page, you could create a file called "about.js" in the "pages" directory and add the following code to it:
import React from 'react';

const About = () => {
  return (
    
      About
      This is an about page.
    
  );
};

export default About;

This will create a page at the route "/about" that displays an "About" heading and some text. You can add more content or functionality to the page as needed.
To navigate between pages in your Next.js app, you can use the Link component provided by Next.js. For example, you could add a link to the "About" page in the header of your app like this:
import Link from 'next/link';

const Header = () => {
  return (
    
      
        About
      
    
  );
};

export default Header;

This will create a link that navigates to the "/about" route when clicked. You can add more links to your app as needed by creating more pages and adding them to the "pages" directory.
Routing in Next.js
Routing in Next.js is the process of mapping URLs to specific pages or functionality in your app. Next.js offers a few different ways to handle routing, each with its benefits and trade-offs.

Automatic routing: The most basic way to handle routing in Next.js is to use automatic routing. This means that Next.js will automatically create a route for each page in your "pages" a directory based on the file name. For example, if you have a file called "about.js" in the "pages" directory, it will be accessible at the route "/about" .

Custom routes: If you need more control over your routes, you can use custom routes. This allows you to specify custom routes and map them to specific pages or functionality in your app.
 To use custom routes, you can create a "routes.js" file in the root of your project and define your routes using the Routes and Route components provided by Next.js.
 import { Routes, Route } from 'next-routes';

 const routes = new Routes();

 routes
   .add('home', '/')
   .add('about', '/about')
   .add('blog', '/blog/:slug', 'blog')
   .add('product', '/product/:id', 'product');

 export default routes;

 This will create four routes: "/", "/about", "/blog/:slug", and "/product/:id". You can then use the Link component provided by Next.js to navigate between these routes in your app.
 import Link from 'next/link';
 import routes from '../routes';

 const Header = () => {
   return (
     
       
         Home
       
       
         About
       
       
         Blog
       
       
         Product
       
     
   );
 };

 export default Header;


To use dynamic routing, you can create a file in the "pages" directory with a name that includes a placeholder, such as "blog/[slug].js". This will create a route that matches any URL that starts with "/blog/", with the remainder of the URL being passed as a parameter.
 import { useRouter } from 'next/router';

 const BlogPost = () => {
   const router = useRouter();
   const { slug } = router.query;

   return (
     
       Blog post: {slug}
       This is a blog post with a dynamic URL.
     
   );
 };

 export default BlogPost;

 This will create a page that can handle any URL that starts with "/blog/", with the remainder of the URL being passed as the "slug" parameter. You can then use this parameter to retrieve the appropriate blog post from your database or API and display it on the page.


Built-In CSS Support in Next.js

Global styles: To apply styles globally to your entire app, you can create a file called "styles.css" in the "public" directory and import it in the "_app.js" file in the "pages" directory. This will make the styles available to all pages in your app.
 import '../public/styles.css';

 const MyApp = ({ Component, pageProps }) => {
   return ;
 };

 export default MyApp;


Component-level styles: To apply styles to a specific component, you can use the style prop. This allows you to specify inline styles for a component, which can be useful for small, self-contained components.
 const MyComponent = () => {
   return (
     
       This text is red
     
   );
 };

 CSS Modules: To apply styles to a specific component and avoid conflicts with other styles in your app, you can use CSS Modules. This allows you to import a CSS file and use it to style a specific component, with the class names being automatically scoped to that component.

To use CSS Modules, you will need to install the @zeit/next-css and css-loader packages and add them to your Next.js configuration file. Then, you can create a CSS file for a specific component and import it in the component file.
 // next.config.js

 const withCSS = require('@zeit/next-css');

 module.exports = withCSS({
   cssLoaderOptions: {
     modules: {
       localIdentName: '[local]___[hash:base64:5]',
     },
   },
 });

 // MyComponent.module.css

 .red {
   color: red;
 }

 // MyComponent.js

 import styles from './MyComponent.module.css';

 const MyComponent = () => {
   return (
     
       This text is red
     
   );
 };





Tailwind CSS with Next.js

Tailwind CSS is a popular utility-first CSS framework that allows you to create custom styles by composing classes based on a set of predefined styles. You can use Tailwind CSS with Next.js to style your app

Install the Tailwind CSS package by running the following command in your project's root directory:
 npm install tailwindcss


Create a configuration file for Tailwind CSS by running the following command:
 npx tailwindcss init


Create a CSS file in your project and import the Tailwind CSS styles. You can do this by adding the following code to the file:
 @import 'tailwindcss/base';
 @import 'tailwindcss/components';
 @import 'tailwindcss/utilities';


Next, you need to configure Next.js to use the CSS file you just created. To do this, you will need to install the @zeit/next-css and css-loader packages and add them to your Next.js configuration file.
 // next.config.js

 const withCSS = require('@zeit/next-css');

 module.exports = withCSS({});


Finally, you can import the CSS file in your app and start using Tailwind CSS classes to style your components. For example, you could create a button component like this:
 import styles from './Button.css';

 const Button = ({ children }) => {
   return (
     
   );
 };

 export default Button;

 You can then use the Button the component in your app and apply Tailwind CSS styles to it using the className
 import Button from './Button';

 const App = () => {
   return (
     
       
     
   );
 };

 export default App;





you can use Tailwind CSS with Next.js by installing the Tailwind CSS package, creating a configuration file, creating a CSS file, configuring Next.js to use the CSS file, and then importing the CSS file in your app and using Tailwind CSS classes to style your components. This allows you to easily apply custom styles to your app using the utility-first approach provided by Tailwind CSS.
Mongo DB with Next.js
MongoDB is a popular NoSQL database that you can use with Next.js to store and retrieve data for your app. To use MongoDB with Next.js

Install the MongoDB driver for Node.js by running the following command in your project's root directory:
 npm install mongodb


Next, you will need to connect to a MongoDB server. You can do this by creating a file called "db.js" in your project and adding the following code to it:


import MongoClient from 'mongodb';

const uri = 'mongodb+srv://:@cluster0.mongodb.net/test?retryWrites=true&w=majority';

const client = new MongoClient(uri, {
  useNewUrlParser: true,
  useUnifiedTopology: true,
});

export default client;

Replace  and  with your MongoDB username and password.

Next, you can create a function to connect to the MongoDB server and perform operations on the database. You can do this by adding the following code to the "db.js" file:
 import MongoClient from 'mongodb';

 const uri = 'mongodb+srv://:@cluster0.mongodb.net/test?retryWrites=true&w=majority';

 const client = new MongoClient(uri, {
   useNewUrlParser: true,
   useUnifiedTopology: true,
 });

 const connect = async () => {
   try {
     await client.connect();
     console.log('Connected to MongoDB');
   } catch (error) {
     console.log(error);
   }
 };

 export { client, connect };


You can now use the connect function to connect to the MongoDB server and perform operations on the database. For example, you could create a function to insert a new document into a collection like this:
 import { client, connect } from './db';

 const insertDocument = async (collection, document) => {
   try {
     await connect();
     const result = await client.db('test').collection(collection).insertOne(document);
     console.log(`Inserted ${result.insertedCount} document(s) into the ${collection} collection`);
   } catch (error) {
     console.log(error);
   }
 };

 export { insertDocument };

 You can then use the insertDocument function to insert a
 import { insertDocument } from './db';

 const document = {
   name: 'John',
   age: 30,
 };

 insertDocument('users', document);

 his will insert a new document into the "users" collection with the name and age fields.




You can also create functions to retrieve documents from the database or perform other operations, such as updating or deleting documents. For example, you could create a function to find all documents in a collection like this:
import { client, connect } from './db';

const findDocuments = async (collection) => {
  try {
    await connect();
    const result = await client.db('test').collection(collection).find({}).toArray();
    console.log(result);
  } catch (error) {
    console.log(error);
  }
};

export { findDocuments };

You can then use the findDocuments function to retrieve all documents from the "users" collection:
import { findDocuments } from './db';

findDocuments('users');

you can use MongoDB with Next.js by installing the MongoDB driver for Node.js, connecting to a MongoDB server, and performing operations on the database using functions.
HarperDB with Next.js
HarperDB is a scalable, high-performance database that you can use with Next.js to store and retrieve data for your app. To use HarperDB with Next.js

Install the HarperDB Node.js client by running the following command in your project's root directory:
 npm install harperdb


Next, you will need to create a file called "db.js" in your project and add the following code to it:
 import HarperDB from 'harperdb';

 const client = new HarperDB({
   host: 'localhost',
   port: 9925,
   username: '',
   password: '',
 });

 export default client;

 Replace  and  with your HarperDB username and password.

You can now use the client object to perform operations on the HarperDB database. For example, you could create a function to insert a new row into a table like this:
 import client from './db';

 const insertRow = async (table, row) => {
   try {
     const result = await client.insert({
       schema: '',
       table: table,
       rows: [row],
     });
     console.log(`Inserted ${result.affected_rows} row(s) into the ${table} table`);
   } catch (error) {
     console.log(error);
   }
 };

 export { insertRow };

 This will insert a new row into the "users" table with the name and age fields.
 You can also create functions to retrieve rows from the database or perform other operations, such as updating or deleting rows. For example, you could create a function to find all rows in a table like this:


import client from './db';

const findRows = async (table) => {
  try {
    const result = await client.query({
      schema: '',
      table: table,
      action: 'select',
    });
    console.log(result.rows);
  } catch (error) {
    console.log(error);
  }
};

export { findRows };

You can then use the findRows function to retrieve all rows from the "users" table:
import { findRows } from './db';

findRows('users');

you can use HarperDB with Next.js by installing the HarperDB Node.js client, connecting to a HarperDB server, and performing operations on the database using functions. This allows you to store and retrieve data for your Next.js app using HarperDB.
Firebase with Next.js

Go to the Firebase website and create a new project.

Install the Firebase npm package by running the following command in your project's root directory:


npm install firebase


Next, you will need to create a file called "firebase.js" in your project and add the following code to it:
 import firebase from 'firebase';

 const config = {
   apiKey: '',
   authDomain: '.firebaseapp.com',
   databaseURL: 'https://.firebaseio.com',
   projectId: '',
   storageBucket: '.appspot.com',
   messagingSenderId: '',
 };

 firebase.initializeApp(config);

 export default firebase;

 Replace , , , , and  with the values from your Firebase project.

You can now use the firebase object to perform operations with Firebase. For example, you could create a function to add a new document to a collection like this:


import firebase from './firebase';

const addDocument = async (collection, document) => {
  try {
    const result = await firebase.firestore().collection(collection).add(document);
    console.log(`Added document with ID: ${result.id}`);
  } catch (error) {
    console.log(error);
  }
};

export { addDocument };

You can then use the addDocument function to add a new document to the "users" collection:
import { addDocument } from './firebase';

const document = {
  name: 'John',
  age: 30,
};

addDocument('users', document);

This will add a new document to the "users" collection with the name and age fields.
You can also create functions to retrieve documents from the database or perform other operations, such as updating or deleting documents. For example, you could create a function to find all documents in a collection like this:
import firebase from './firebase';

const findDocuments = async (collection) => {
  try {
    const snapshot = await firebase.

firestore().collection(collection).get();
console.log(snapshot.docs);
} catch (error) {
console.log(error);
}
};

export { findDocuments };

You can then use the findDocuments function to retrieve all documents from the "users" collection.
Conclusion:
In conclusion, Next.js is a powerful JavaScript framework that allows you to build full-stack applications with ease. With its built-in support for server-side rendering, automatic code splitting, and optimized performance, Next.js makes it easy to build high-performance and scalable applications. Additionally, the ability to use Next.js with a variety of databases and authentication methods, such as MongoDB, HarperDB, and Firebase, makes it a versatile choice for building full-stack applications.
If you want to build a full-stack application with Next.js, there are a few key things to keep in mind:

Set up your development environment with Next.js and your preferred code editor or development environment, such as Visual Studio Code or GitHub Codespaces.

Use the pages directory to define your application's routes and create React components for each page.

Take advantage of Next.js's built-in CSS support to style your application, or use a CSS framework like Tailwind CSS.

Use a database and authentication method to store and retrieve data and handle user authentication. Options include MongoDB, HarperDB, and Firebase.


By following these steps, you can build a full-stack application with Next.js that is fast, scalable, and easy to maintain.



Dev Retro 2022 :- Wrap up the year 2022 .... ! looking forward to 2023
Sangam Biradar — Sat, 31 Dec 2022 08:13:27 GMT
Jan 2022
started DevSecOpsConf non-profitable event and spend a lot of time organizing a standalone to empower the community as well as one of the speakers!
◉ DevSecOps Conf 2022 | Powered by CloudNativeFolks Community - Virtual Event - 8 Jan 2022
I want to thank all speakers and attendees for supporting free events!

🔻Kubernetes Security Tools , Saiyam Pathak ,Civo Cloud , CNCF ambassador
🔻Secure Infrastructure as code with GitHub action by Sangam Biradar , Technical Advocate , Tenable
🔻Open Policy Agent as a Control Engine by David Melamed , CTO and Co-Founder of Jit
🔻DevSecOps; more than just pipelines by Tanya Janca | SheHacksPurple ( best-selling author of ‘Alice and Bob Learn Application Security’)
🔻Don't just detect threats. Take pro-active Action! by Chandu P
🔻Pragmatic Security Automation and DevSecOps in the Cloud by Joshua Arvin Lat , CTO of NuWorks Interactive Labs, Inc.AWS Machine Learning Hero
🔻Diversity and Inclusion : Remote/WFH edition by Ixchel Ruiz , DA/DX at jfrog
🔻Securing Cloud Native Workloads with Istio by Software Enginee at IBM Cloud
🔻Infrastructure as Code by Kannan Anandakrishnan
🔻Why is security important in Infrastructure as code ? by Avinash Dalvi , eagleview , AWS Community builder
find my slides here - Secure IAC/k8s/Helm/Docker with Github Action
🔻Secure Infrastructure as code with GitHub action by Sangam Biradar , Technical Advocate , Tenable
Blogs

The Ultimate Docker Cheatsheet for everyone | slides | Blog |

Chaos Carnival 2022

Presented around on GitOps Meets Chaos Engineering

Feb 2022
Bugtron Conference provides crucial for coders to become a software developers
and invited me to present on DevSecOps | K8s | Docker I tried to make it a short overview with some practical hands-on.
https://youtu.be/myuaUkQnRLQ
 
excited to announce I've been selected for AWS Community Builder Program in the Container Category! Thanks for the opportunity Jason Dunn, and Shafraz Rahim!

Mar 2022
the just pandemic we all worked hard and spend time with the community its time to get back to the in-person event and meet amazing community members who always enjoyed those conversions.
◉ Demystifying Kubernetes Security - Jfrog office b'lore - March 26

slides - Demystifying Kubernetes Security


we celebrated docker's 9th birthday with all the amazing speakers and attendees
we order an amazing cake!

In March, I got promoted to Principal Security Advocate / Sr Product Marketing Manager role

Tenable is one of the best company in the cybersecurity space advocating for OSS strategy and being the first DevRel person for Tenable make me feel so proud. I miss all my co-worker's amazing team.
hosted yet another event DevOps India Conference 2022
◉ DevOps India Conference 2022 | Powered by CloudNativeFolks Community - 6 Mar 2022
once again I want to thank all speakers for presenting at this FREE event!
🔻 Keep your code safe during the development path using open source tools by Fillipi Pires
🔻Stop Committing your secrets -git hooks to the rescue by Dwayne McDaniel
🔻Managed secretes across cloud using kubernetes by Jhonnatan Gil Chaves
🔻Explore Elastic Observability & Parse different log format with elastic stack by Ashish Tiwari
🔻Distribute Deployment of a microservices applications multiple k8s clusters by Karan Singh
🔻Software BoM at the time of DevOps by Manuel Schuller
🔻Monitoring kubernetes Vs Serverless based applications by Erez Berkner
🔻Unit testing without writing test cases or mocks using keploy by Shubham Jain
🔻Demystifying Kubernetes health check by Gundeep Singh
🔻Evolving your REST APIs , a pragmatic approach by Nicolas Frankel
May 2022
DockerCon 2022 - Docker in Hindi room


Slides - Developing end to end Rust app using docker deskstop
June 2022
Docker Developer Community Meetup at Microsoft Reactor - June 11
Sangam Biradar, Principal Security Advocate, Tenable


I want to thank Microsoft Reactor and team for sponsoring the venue for this event

slides - An Ultimate Guide to Pod Security that every k8s Developers Must Know
July 2022
we did a unique meetup at Nandi Hills 😂

Presented around Gitops Security with Terrascan at Harness office - July 30
slides - Gitops Security with Terrascan

started sketchbook around CNCF and other open-source projects

Terrascan - https://github.com/tenable/terrascan - Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
https://www.linkedin.com/posts/sangambiradar_cncf-opensource-terraform-activity-6947627372518989825-T0WN?utm_source=share&utm_medium=member_desktop
 
AUG 2022
Open Source Marketplace For Kubernetes - https://github.com/alexellis/arkade
add magic to your CLI

Okteto - Instantly spin up production-like dev environments in the cloud for every developer.
reduce inner loop and focus on application and code ! Don't think much about Kubernetes Cluster


Sep 2022
yet another great journey started! Deepfence - Cloud-Native Application Protection Platform
Actionable detection, response and compliance for the cloud, without the alert fatigue.

PSP is dead and now its time to adopt Pod Security standard presented at DeveloperWeek Cloud 2022

here is a blog -
https://blog.cloudnativefolks.org/introduction-to-kubernetes-part-4-pod-security-standards
written blogpost around YaraHunter - https://github.com/deepfence/YaraHunter
YaraHunter : Malware scanner for cloud-native, as part of CI/CD and at Runtime

Thanks to docker !
Cloud Native Community Day , Nagpur 2022

amazing crowd at Nagpur!

its houseful! cheers 🥂 to all organizers and attendees!


Thanks to all organisers and speakers as well as the audience really bringing value via community-driven events and knowledge-sharing sessions
Here I have started with Securing the Software Development life cycle moving from monolithic to Microservice and entering into container and Kubernetes and breaking down security using Open Source Cloud Native Security tool Threatmapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit and new threat graph feature is amazing 🤩
And showing different integration and use cases around Google cloud and GKE
Indeed SBOM became so important as well as a lot of secrets 🤐 getting exposed via container images and file systems also we are not thinking enough of malware scanning for cloud-native runtime
And ebpf is a game changer when it’s come to security observability and networking
we planned another event in CNCF Nagpur

Avinash Upadhaya - CNCF Landscape Overview

Golang Workshop - 5hr training




decided to do a workshop track since adoption of Golang growing massively! conducted 5hr free workshop with hands-on training

Oct 2022
I meet a 16-year-old student/developer MAHESHWARAN M one of the events and he travelled from Hosur to Bangalore to attend meetups and events! I also came from a diploma background so I can understand enthusiasm to learn early can give me a lot of opportunities.
I decided to travel to his diploma colleague and conducted an in-person workshop track on Golang. seems they already know another programming language so it's easy and so interactive learning! enjoyed


Google Cloud Next Innovator Hive
Thanks to Google Cloud Team for inviting me to the Influencer table! it's great to be part of the most active techie bringing change in India!


it was great meeting with Urs Holze, SVP of Engineering and Priyanka Vargadia, Google Developer Advocate and Google India Team!


Hacktoberfest 2022: Docker Extensions "Show-n-Tell"
Deepfence's Team build 2 Docker extensions

SecretScanner - Find secrets and passwords in container images and file systems via Docker extension

YaraHunter - Malware scanner for cloud-native, as part of CI/CD and at Runtime via Docker extension




Nov 2022
AWS Community Day - 5th Nov


Thanks to AWS Jaipur User Group for the Wonderful Opportunity!

10th Nov - 7th annual All Day DevOps returns on November 10, 2022
"Demystifying Kubernetes Pod Security "
let's learn about Pod Security Standards & more

Thanks to AllDayDevOps for the amazing goodies and swag!


16th Nov visited diploma college where I started my tech journey! its refreshed my all memories!

Dec 2022
upgraded setup!


wrapped up the 2022 event! with all active community organizers and community leaders
2023 will be a great year for https://blog.cloudnativefolks.org ! officially Launched logo

Join CloudNativeFolks Community on Discord - https://discord.com/invite/9ERSnT7
Thank you for all the amazing moments, and conversions with community members we shared this year! you made 365 days feel like a few days !

Task	Manual Time	With StackGen	Time Saved
Writing and Maintaining IaC	1-2 weeks	1-2 hours	~90%
Applying Cloud Best Practices	3-5 days	Built into generated IaC	~85-90%
Scaling Infrastructure	Ongoing (hours/week)	Predefined in IaC (adjustments required when needed)	~85% (hours/week)
Collaboration with DevOps Teams	3-7 days (review cycles)	1-2 days	~50-70%
Security Integration	1-2 weeks	Automated security best practices and compliance standards (SOC 2, HIPAA, NIST-CSF, PCI, GDPR) built into IaC	~85-90%