images.tex

\label{part_images}
\part{Images}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Basic Steps}
Starting points
\begin{itemize}
\item Existing images
\item Installation media
\item Special tools for image creation
\end{itemize}
Our recommendation
\begin{itemize}
\item Existing images
  \begin{itemize}
  \item Basic images of popular LINUX distributions available
    \begin{itemize}
    \item Ubuntu
    \item Debian
    \item ScientificLinux
    \end{itemize}
  \end{itemize}
\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Starting from existing images}
\begin{itemize}
\item Download image from repository
\item Start image
  \begin{itemize}
  \item Start it as a VM
    \begin{itemize}
    \item Caveat: need local virtualization platform, e.\,g. KVM
    \end{itemize}
  \item Alternative: start as a cloud instance and create snapshot
    \begin{itemize}
    \item Caveat: creating snapshots not standardized among platforms
    \end{itemize}
  \end{itemize}
\item Make your updates and modifications
\item Clean up as you would do for a new image
\item Re-package the image
\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[fragile]
\frametitle{Image Creation}
\framesubtitle{Starting from scratch}
An example
\begin{lstlisting}
  $ truncate -s 1G debian-7.4.0.img
  $ kvm -cdrom debian-7.4.0-amd64-netinst.iso debian-7.4.0.img
\end{lstlisting}
During installation
\begin{itemize}
\item Select ``Install''
\item Give a strong root password despite it being locked later on
\item Use manual partitioning
  \begin{itemize}
  \item Avoid creating a swap partition and put everything in one partition
  \item Additional block devices can and should be added at runtime
  \item \emph{Do not} use LVM based setups
  \end{itemize}
\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Starting from scratch (cont'd)}
During installation
\begin{itemize}
\item Software installation
  \begin{itemize}
  \item Install as few packages as possible
  \item Default set of system utilities
  \item SSH server
  \end{itemize}
\item Boot loader on MBR
\end{itemize}
\end{frame}


%% Optionally go through an example installation process 
%% We have screenshots for Debian
%% If adding it here, provide a fast forward link to skip this

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Final Cleanup}
\begin{itemize}
\item Users and passwords
\begin{itemize}
\item To disallow password base logins, put * or ! in the password field in \texttt{/etc/shadow}
\end{itemize}
\item Log files
\item Excessive data
  \begin{itemize}
  \item Find it using du or ncdu
  \end{itemize}
\item ...?
\end{itemize}
\vfill\hfill\scriptsize{We posted the general procedure in the EGI Blog: \url{http://goo.gl/ju7vgP}}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[fragile]
\frametitle{Image Creation}
\framesubtitle{Log Files}
\begin{itemize}
\item Avoids leaking of potentially personal/sensitive data, though
  not likely right after installation
\item Reduces image size if lots of logging data was created during a
  longer installation process
\item We've used the option to truncate log files to size 0
  \begin{itemize}
  \item Keeps files and their permissions
  \end{itemize}
\end{itemize}
\begin{lstlisting}
  # find /var/log -type f -exec truncate -s 0 {} \;
\end{lstlisting}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Excessive Data}
\framesubtitle{}
Look for
\begin{itemize}
\item Old Linux kernels and their modules in \texttt{/boot} and
  \texttt{/lib/modules}
\item Undesired services
  \begin{itemize}
  \item some distributions install a number of services by default
  \item web, mail, etc.
  \item remove them also for security reasons
  \end{itemize}
\item Unused packages
  \begin{itemize}
  \item after removal of undesired services, some dependencies may not
    be needed anymore
  \end{itemize}
\item Clear the package cache
  \begin{itemize}
  \item apt-get clean
  \item yum clean all
  \item zypper clean --all
  \end{itemize}
\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[fragile]
\frametitle{Image Creation}
\framesubtitle{Finding Excessive Data}
You can go on a hunt for the biggest directory structures of your image. The following tools will help you
\begin{itemize}
\item du
  \begin{itemize}
  \item \lstinline{du -a / | sort -n -r| head -10}
  \item \lstinline{du -hsx *| sort -rh | head -10}
  \end{itemize}
\item ncdu
  \begin{itemize}
  \item an interactive version of the above commands
  \end{itemize}
\end{itemize}

\begin{tikzpicture}
  \node at (9, -.7) [absolute,overlay] {\pgfimage[width=.4\textwidth]{images/screenshots/ncdu.png}};
\end{tikzpicture}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Tools}
These tools can be used to deal with images after their creation. They
help to create small clean images and access the file systems within
for a final touch up.

qemu-img
\begin{itemize}
\item mainly used for image conversion, e.g. from raw to (compressed) QCOW2
\end{itemize}
zerofree
\begin{itemize}
\item zero out unused blocks in a file system
\item improves compression ratio
\end{itemize}
kpartx
\begin{itemize}
\item Make partitions within image files available as block devices in the current system
\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[fragile]
\frametitle{Image Creation}
\framesubtitle{Packaging}
\begin{itemize}
\item Use zerofree to set unused blocks in the file system to '0'
  \begin{lstlisting}
  # kpartx -av debian-7.4.0.img
  add map loop0p1 (254:4): 0 4190208 linear /dev/loop0 2048
  # zerofree /dev/mapper/loop0p1
  # kpartx -d debian-7.4.0.img
  \end{lstlisting}
\item Create compressed qcow2
  \begin{lstlisting}
  $ qemu-img convert -c -f raw -O qcow2 -p debian-7.4.0.img debian-7.4.0.qcow2
  \end{lstlisting}
\item Including zerofree, we've seen compressed image sizes up to 50\% smaller
  than without it
\end{itemize}
\hfill\scriptsize More details in the EGI Blog:
  \url{http://goo.gl/UA6t1Y}
%% \begin{tikzpicture}
%%   \node at (1,0) [absolute,overlay] {\pgfimage[width=1cm]{images/goo.gl_UA6t1Y.png}};
%% \end{tikzpicture}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Hardening}
Try and make your images secure. Some simple measures:
\begin{itemize}
\item Disable or uninstall unneeded services and other software
\item Do not allow unauthenticated access
\item Use Strong passwords or disallow passwords
\end{itemize}
\end{frame}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Maintainance}
\framesubtitle{Things to avoid}
When creating or updating images, the following can occur
\begin{itemize}
\item Unneded software may remain installed
  \begin{itemize}
  \item Particularly true for older Kernel versions and their modules
  \item Modules for a single Kernel are roughly 100MB
  \item Desktop environment
  \item Office suites
  \item Games
  \end{itemize}
\item Swap files
  \begin{itemize}
  \item Usually gigabytes in size
  \item Do not make much sense for cloud. Use a larger instance instead.
  \end{itemize}
\end{itemize}
\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Image Creation}
\framesubtitle{Updates}
\begin{itemize}
\item Steps to update contents of an image and create a new one
\item Is this really possible with \emph{only OCCI} commands?
  \begin{itemize}
  \item We'd certainly want to support this, i.\,e. take an instance,
    create a snapshot of it and use thas as a new image.
  \end{itemize}
\item It should be just as easy as creating an image from an existing one.
\end{itemize}
\end{frame}

%%% Local Variables:
%%% TeX-master: "2014-05-23_Best_Practices"
%%% End: