Paul Querna

This is a really great step forward - thanks Mitchell!

I've recently spent a couple of weeks doing a deep dive into Docker, so I'll share some insights from what I've learned.

First, it's important to understand that Docker is an advanced optimization. Yes, it's extremely cool, but it is not a replacement for learning basic systems first. That might change someday, but currently, in order to use Docker in a production environment, you need to be a pro system administrator.

A common misconception I see is this: "I can learn Docker and then I can run my own systems with out having to learn the other stuff!" Again, that may be the case sometime in the future, but it will be months or years until that's a reality.

So what do you need to know before using Docker in production? Well, basic systems stuff. How to manage linux. How to manage networking, logs, monitoring, deployment, backups, security, etc.

If you truly want to bypass learning the basics, then use Heroku or another similar service that handles much of that for you. Docker is not the answer.

If you already have a good grasp on systems administration, then your current systems should have:

- secured least-privilege access (key based logins, firewalls, fail2ban, etc)
- restorable secure off-site database backups
- automated system setup (using Ansible, Puppet, etc)
- automated deploys
- automated provisioning
- monitoring of all critical services
- and more (I'm writing this on the…

this is our ssl optimisation list. it has some tradeoffs like using small keys (1024bit) which may not be appropriate in a lot of situations.

1. Don't use ephemeral diffie helman for key negotiation. This means if an attacker compromises your private key in the future he can decrypt all your past transactions he has recorded. But it does give a nice speed boost. Understand the security implications and if you are happy with the tradeoff do it. More information here: http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck_at_ssl/ur

2. Use RC4_128 + SHA1. Force clients to use this use server cipher order. (google does this) http://journal.paul.querna.org/articles/2010/07/10/overclocking-mod_ssl/

3. Use 1024 bit keys. (google does this) 2048bit is much much more expensive.

4. Use ssl session caching and make sure you have some kind of sticky session support or have some way of sharing sessions between your web nodes. haproxy can do it by ip or by ssl session id.

5. When you are dealing with a lot of traffic understand whether you can handle keep alives or not. If you can't handle keep alives turn them off. Keep-alives will improve ssl performance by quite a big deal if clients are doing multiple requests but if you don't have the resources to handle them then they kill your servers.

When you use a remote blockstore like they are as your storage, you also generally are always booting via PXE, and so far have a provider controlled kernel.

I used to work on Rackspace OnMetal:
http://www.rackspace.com/cloud/servers/onmetal

https://journal.paul.querna.org/articles/2014/07/02/putting-teeth-in-our-public-cloud/

In OnMetal this not the case -- you get local storage, you have your local kernel that you can re-install or do whatever you want to -- and if we have a control plane outage, you can reboot -- there is no dependency once your server is created on a provider hosted PXE server.

OnMetal isn't cheapo-ARM servers, but it is possible to build a "bare metal" cloud, which is truly bare metal, like you would normally get, and no remote block stores for your root FS.

So on most real world applications, you shave perhaps a second or two off compilation and linking times.

That's great, but... why does Go still have such an abysmal regexp package that is an order of magnitude slower than C and C++?[1]

Why does encoding/json still rely on reflection, making it slow compared to other approaches?[2]

In other words, I guess I feel like there are areas with more bang for the buck. The changes in 1.3 are great (100% precise garbage collection!), but I'm hoping improvements to regexp and encoding/json are somewhere on the roadmap as well.

[1] http://benchmarksgame.alioth.debian.org/u64q/performance.php?test=regexdna&sort=elapsed

[2] https://journal.paul.querna.org/articles/2014/03/31/ffjson-faster-json-in-go/

My time as a system administrator makes me rather fond of logging as text into files. They're simple, easy to scale, to rotate, to compress and to throw away. One variation on this theme that I read about recently is to produce log lines as JSON objects rather than more "traditional" printf-formatted text.

This gives machine readability but also makes for really simple tools for extracting whatever "traditional" log lines you like. (see: https://github.com/trentm/json) You can also easily add new fields without breaking existing log parsing code.

I believe I first read about logging in JSON here: http://journal.paul.querna.org/articles/2011/12/26/log-for-machines-in-json/

While this is probably security related, disabling compression is actually a good practice for clients which make a large number of SSL requests (like a browser). OpenSSL allocates alot of memory per connection for compression/decompression. See http://journal.paul.querna.org/articles/2011/04/05/openssl-memory-use/ for a great discussion of why SSL_OP_NO_COMPRESSION might make sense for you.

Even if you don't have direct access to the library code creating SSL objects, there are still some tricks with ctypes, ffi, dlopen that have the same effect.