rework summary formatter output

@aslakhellesoy @jbpros @mattwynne
This is a rework of the progress formatter output that I am thinking about for cucumber-js and wanted to bring up to the whole cucumber community. Please tag anyone else you think should see this
Given a feature:
Feature: A feature

  Scenario: 1
    Given a passing step

  Scenario: 2
    Given a passing step
    And a failing step
    And a skipped step

  Scenario: 3
    Given a passing step
    And a ambiguous step
    And a skipped step

  Scenario: 4
    Given a passing step
    And a undefined step
    And a skipped step

  Scenario: 5
    Given a passing step
    And a pending step
    And a skipped step

The current progress formatter output is
..F-.A-.U-.P-

(::) failed steps (::)

Error: error
    at World.<anonymous> (/.../features/step_definitions/steps.js:5:11)

Failing scenarios:
features/a.feature:6 # Scenario: 2

5 scenarios (1 failed, 1 undefined, 1 ambiguous, 1 pending, 1 passed)
13 steps (1 failed, 1 undefined, 1 ambiguous, 1 pending, 4 skipped, 5 passed)
0m00.003s

You can implement step definitions for undefined steps with these snippets:

this.Given(/^a undefined step$/, function (callback) {
  // Write code here that turns the phrase above into concrete actions
  callback.pending();
});

The following steps have multiple matching definitions:

"a ambiguous step" matches:
/^an? ambiguous step$/ # features/step_definitions/steps.js:8
/^a ambiguous step$/   # features/step_definitions/steps.js:9

The fact that failed steps only lists the errors without the context (the scenario and step) has always bugged me and almost always made me rerun with pretty formatter the failing test in order to understand the context. I also dislike the that the different issues are shown in different places.
I propose the following new output
..F-.A-.U-.P-

Issues:

1) Scenario: 2 # features/a.feature:6
  Given a failing step # features/step_definitions/steps.js:4
    Error: error
      at World.<anonymous> (/.../features/step_definitions/steps.js:5:11)

2) Scenario: 3 # features/a.feature:11
  Given a ambiguous step
    Multiple step definitions match:
      /^an? ambiguous step$/ # features/step_definitions/steps.js:8
      /^a ambiguous step$/   # features/step_definitions/steps.js:9

3) Scenario: 4 # features/a.feature:16
  Given a undefined step
    Use the following snippet to implement this step
      this.Given(/a undefined step/, function(){
        // Write code to here to turn the step into concrete actions
        callback.pending();
      })

4) Scenario: 5 # features/a.feature:21
  Given a pending step # features/step_definitions/steps.js:11
    Pending

5 scenarios (1 failed, 1 undefined, 1 ambiguous, 1 pending, 1 passed)
13 steps (1 failed, 1 undefined, 1 ambiguous, 1 pending, 4 skipped, 5 passed)
0m00.003s

Thoughts?

I like this Charlie, it's something that irritates me too, but I've sort of grown used to it and stopped noticing!
When you propose is very similar to RSpec's output. In RSpec, they categorise the different kinds of issues, so you'd probably see something more like this:
..F-.A-.U-.P-

Failures:

  1) Scenario: 2 # features/a.feature:6
     Given a failing step # features/step_definitions/steps.js:4
       Error: error
         at World.<anonymous> (/.../features/step_definitions/steps.js:5:11)

  2) Scenario: 3 # features/a.feature:11
      Given a ambiguous step
      Multiple step definitions match:
        /^an? ambiguous step$/ # features/step_definitions/steps.js:8
        /^a ambiguous step$/   # features/step_definitions/steps.js:9

Undefined: (Failures listed here are expected and do not affect your suite's status)

  1) Scenario: 4 # features/a.feature:16
      Given a undefined step
        Use the following snippet to implement this step
          this.Given(/a undefined step/, function(){
            // Write code to here to turn the step into concrete actions
            callback.pending();
          })

Pending: (Failures listed here are expected and do not affect your suite's status)

  1) Scenario: 5 # features/a.feature:21
      Given a pending step # features/step_definitions/steps.js:11
        Pending

5 scenarios (1 failed, 1 undefined, 1 ambiguous, 1 pending, 1 passed)
13 steps (1 failed, 1 undefined, 1 ambiguous, 1 pending, 4 skipped, 5 passed)
0m00.003s

Personally I like this sorting as it helps you to focus on the big problems first (failures) before dealing with the less urgent undefined / pending issues. The (Failures listed here are expected and do not affect your suite's status) message is ripped off frominspired by RSpec and would not be shown if you're running in --strict mode I suppose.
Just a suggestion to consider. I like trying to make these tools converge. I wonder what @everzet does in Behat? cc @tooky

Here is what<EMAIL_ADDRESS>currently has as the output for the progress formatter (which prints the status along the way and then prints the same as the summary formatter). For reference on cucumber/cucumber-ruby#1030 and if anyone else is interested.
..F-.A-.U-.P-

Failures:

1) Scenario: 2 - features/test.feature:6
   Step: And a failing step - features/test.feature:8
   Step Definition: features/step_definitions/browser_steps.js:22
   Message:
     Error: error
         at CustomWorld.<anonymous> (/Users/charlesrudolph/github/test/features/step_definitions/browser_steps.js:23:11)
         at _combinedTickCallback (internal/process/next_tick.js:67:7)
         at process._tickCallback (internal/process/next_tick.js:98:9)

2) Scenario: 3 - features/test.feature:11
   Step: And a ambiguous step - features/test.feature:13
   Message:
     Multiple step definitions match:
       /^a ambiguous step$/   - features/step_definitions/browser_steps.js:28
       /^an? ambiguous step$/ - features/step_definitions/browser_steps.js:29

Warnings:

1) Scenario: 4 - features/test.feature:16
   Step: And a undefined step - features/test.feature:18
   Message:
     Undefined. Implement with the following snippet:

       this.Given(/^a undefined step$/, function (callback) {
         // Write code here that turns the phrase above into concrete actions
         callback(null, 'pending');
       });

2) Scenario: 5 - features/test.feature:21
   Step: And a pending step - features/test.feature:23
   Step Definition: features/step_definitions/browser_steps.js:25
   Message:
     Pending

5 scenarios (1 failed, 1 ambiguous, 1 undefined, 1 pending, 1 passed)
13 steps (1 failed, 1 ambiguous, 1 undefined, 1 pending, 4 skipped, 5 passed)
0m03.254s

For colors, the scenario name (Example: "1") and step name (Example: "And a failing step") are in bold. The relative paths (Example: features/test.feature:21) are all in gray. The failure messages are in red and the warning messages are in yellow.
If you would like to reproduce. Use the feature at the top, and the following step definitions
// features/step_definitions/test_steps.js
module.exports = function () {
  this.Given(/^a passing step$/, function() {});
  this.Given(/^a failing step$/, function() {
    throw new Error('error');
  });
  this.Given(/^a pending step$/, function() {
    return 'pending';
  });
  this.Given(/^a ambiguous step$/, function() {});
  this.Given(/^an? ambiguous step$/, function() {});
  this.Given(/^a skipped step$/, function() {});
};

Ref https://github.com/cucumber/cucumber-ruby/issues/1030

For reference, cucumber-js removed the pretty formatter but now the summary output prints the failed scenarios in the previous pretty format.


Integrated test environment does not work with PSC 2.10

PSC's current trunk changes the way datasources are defined in such a way that the HSQLDB 1.8-based integration test environment fails with lockfile errors. Disabling the lockfile is possible, but only HSQLDB 2+. Upgrading to HSQL 2+ requires changes to PSC itself.

Alternatively, we could just require PostgreSQL for the integrated tests.


Adding a Colab Notebook for ease of use

This PR adds a Colab Notebook in order to make it easier for people to try out your awesome work easily.
Note that I have just added an explicit device placement in the Grad Rollout code. That's the only change in terms of code. The Colab Notebook mostly follows code from your vit_explain.py script.
If the PR gets merged the Colab Notebook needs to be updated to accommodate for the following:

I am currently cloning the forked repository to reflect the device placement code update.
Colab Notebook link.

@jacobgil just checking to see if you had the time to consider this.


HIP17 support: add hotspot's reward scale

Each Hotspot will have a reward scale when HIP 17 is introduced. We can put it where the score used to be, but call it "Reward Scale".
If we can get a tooltip in there, it should say "A Hotspot's reward scale is determined by how many other Hotspots are nearby."

It will also be useful to know what resolution a hotspot reward scale was clipped at. i.e. a hotspot exceeds density settings at res 9, so it is clipped at res 9.
etl will have to expose this too.

Tooltip:
Reward scale is impacted by how many Hotspots are nearby (high Hotspot density means a lower reward scale). Hotspots witnessing this Hotspot will see their rewards scaled up or down accordingly.

Tooltip:
Reward scale is impacted by how many Hotspots are nearby (high Hotspot density means a lower reward scale). Hotspots witnessing this Hotspot will see their rewards scaled up or down accordingly.


Add failing tests that cover more backward compatibility cases

Pull request for @Cloudinary/Base
What does this PR solve?
Highlights some backward compatibility failed-cases. (adds the test cases).
Here are the failing cases:

"radius" does not accept a string (treats as null) or an array (crashes) - Bug is around here.
"border" should accept an object not just a string (V1 accepts an object see here)
transformation "layers" should clone before modifying "layer" options (See here)

Closing this PR, as the issues raised here we merged in #386 #384
We'll probably release these next week with a few more minor changes.

Thanks @patrick-tolosa!
Have you considered my suggestion to include tests that use the v1 SDK and compare it to the results of the V2 SDK to have a verbatim comparison? Would you like me to try and create such a PR to extend the tests?

The V2 SDK should not create the exact URL as in V1, however the backwards compatibility method should do that.
Having a PR that proves that would indeed be useful.


minion: Add golang profiler support to the minion

There is currently only a placeholder method to invoking the profiler,
which is to compile the minion to run with the profiler.

Merged


Test course model

Right now, the course model is untested. Write unit tests to ensure the model is working properly.

Just using assignees for now to track who's doing what since I forgot to do that earlier


Is there any way to bypass this restriction without custom proxies? Like Google, Cloudflare DNS?

Even https bypass doesn't works in ACT.

I am currently not aware of any techniques that are known to be fully resistant to potential censorship. As for the second point, the https:// method had previously been documented to work, though the example is a little dated from December 2019.

@captn3m0 @swapneelp Would you have any insight on this? At least as far as ACT Fibernet is concerned?

Act is pretty smart at this, they drop the connection when we try to access it with https

Accessing: http://yts.mx

Accessing with https://yts.mx:

Currently, many isp in india are using dpi based blocking. It can be evaded by tools that manipulate host header or client hello. https://github.com/zhenyolka/DPITunnel-android is an example for android and for linux https://github.com/zhenyolka/DPITunnel-cli . There are also tools like goodbyedpi etc.

Thanks @bugaddr! Closing this issue.


Eject button doesn't work for Simple Modifications

I'm on an iMac with a model A1644 bluetooth keyboard and I'm having a similar issue with Eject not being seen. 'eject' detects in the event viewer as 0xb8, but doesn't do anything if, for instance I add a Simple Modification like 'eject' to 'a', it doesn't type an 'a' when pressed.
I am on MacOS Mojave 10.14.2, and KE version 12.1.0.

I'm not sure why this started working, but it works now.  I didn't do anything to KE since Jan 20 except reboot my machine.  Oh well.


Function "Search" Landed Cost it's not working

Note : should be can search GR number also.

https://github.com/nfco/netforce/commit/a4dd8ca65fadad4e3df0e18d8cc2e5a3fbbabedc


Changes to support contracts for FileDialog (and other common Dialogs)

This is a set of contract for FileDialog.cs and other classes to address #217. This is a fairly small set of contracts. Thanks again for reviewing.

Looks good.
Added few comments...

Remerged from master to help with request with merge.

@yaakov-h Could you please take a look at this stuff as well? For me everything is looks good, but would like to hear additional thoughts on this before merging this stuff.

I haven't checked absolutely everything against Reference Source, but LGTM other than the above comments. I'm still a bit fuzzy on how these system contracts work.


phy_init: failed to allocate memory for RF calibration data

Hi,
I enabled WiFi and classic bluetooth and I got that error while running the code on esp32-wroom-32 module
E (342) phy_init: failed to allocate memory for RF calibration data
I have a customized partition table
# Name,   Type, SubType, Offset,  Size, Flags
# Note: if you change the phy_init or app partition offset, make sure to change the offset in Kconfig.projbuild
nvs,      data, nvs,     0x9000,  0x6000,
phy_init, data, phy,     0xf000,  0x1000,
factory,  app,  factory, 0x10000, 2M,

any ideas?

https://github.com/espressif/esp-idf/blob/5d4c4b19d49f5a61aa3189af93e55140a841eb42/components/bt/include/esp_bt.h#L210-L236

@negativekelvin
esp_bt_controller_mem_release helped me to overcome this problem by releasing the unused BLE but in future I will use BLE beside BT classic hence this solution won't be suitable

Sorry, the memory is not enough, please release  BLE part if you do not use

@Weijian-Espressif Yes, I already released it plus I disabled unnecessary bluetooth profiles to store some memory

any way I pulled last update which eliminated this issue. Thanks!


feat: deduplicate lemmas used by rw?

Solving request 1. from @b-mehta's zulip post.

LGTM, I guess the performance is still ok?

I didn't explicitly test this. The test file still seems fast, and the method I used should be fine.

maintainer merge

Thanks :tada:
bors merge


Dynomite API calling is taking time to respond ( ~ 35 second)

Hi, I have a cluster running with Dynomite and when we trying to check for node status ( whether it is alive) using this API : /api/management/node/stop , It takes at least 35 seconds to get the response back..
Is that because Dynomite is effectively stopping the process which is taking time?

Never mind.. It is internal issue!


Start as non-root user

Hello,
In order to respect the check 4.1 from the docker security tests https://github.com/docker/docker-bench-security, is there a way to run the container without ever using root?
I know the daemon is started as root to be able to bind to privileged ports like 80 and then start child processes as the user defined in httpd.conf file (daemon or www-data usually),  but from a security standpoint, that's already a problem that the container can run as root in the beginning. Is there a workaround for this to avoid using root and if possible bind on port 80?
Thanks,

Given https://github.com/moby/moby/issues/8460#issuecomment-312459310, you should be able to get pretty far:
$ docker run -it --rm --user 1000 --sysctl net.ipv4.ip_unprivileged_port_start=0 httpd
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
[Tue Jul 10 20:36:16.676190 2018] [core:error] [pid 1:tid<PHONE_NUMBER>32256] (13)Permission denied: AH00099: could not create /usr/local/apache2/logs/httpd.pid
[Tue Jul 10 20:36:16.676463 2018] [core:error] [pid 1:tid<PHONE_NUMBER>32256] AH00100: httpd: could not log pid to file /usr/local/apache2/logs/httpd.pid

(Filesystem permissions are easier to deal with than kernel blocks, so this is good.)

I did this : setcap + chown + User www-data inside the Dockerfile + build and the image works fine on the host:
$ docker run --rm 43dee066c55f
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
[Wed Jul 11 09:51:33.316839 2018] [mpm_event:notice] [pid 1:tid<PHONE_NUMBER>51656] AH00489: Apache/2.4.33 (Unix) configured -- resuming normal operations
[Wed Jul 11 09:51:33.316997 2018] [core:notice] [pid 1:tid<PHONE_NUMBER>51656] AH00094: Command line: 'httpd -D FOREGROUND'
But when I pull the same image and run it on another node , it falls back to the first error:
$ docker run --rm 43dee066c55f
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
(13)Permission denied: AH00072: make_sock: could not bind to address <IP_ADDRESS>:80
Is this binding to port 80 denied by the container's system or the host's system?
Logically the "permission denied" was coming from the container's system and since we fixed that, the image should be able to run everywhere as non-root right?

Excuse my english but I don' t really understand "Your setcap probably doesn't round-trip through the graph drivers properly", what do you mean by that?
Is there a way to fix it and make the image portable?
Thanks,

I'm not fully understanding your use case, you mention a node, do you mean you're using swarm and stack deploying to a node, and that this worker node is experiencing an anomaly with permissions of some sort?
By my understanding you're primarily concerned with test section 4.1 of the docker-bench-security test which tests for running as normal user in the container. I'm not able to reproduce any error while deploying a stack to a swarm and testing the nodes.
Dockerfile
FROM httpd:2.4-alpine

#Custom changes
RUN apk update && apk upgrade
RUN apk -q add curl vim libcap

#Change access righs to conf, logs, bin from root to www-data
RUN chown -hR www-data:www-data /usr/local/apache2/

#setcap to bind to privileged ports as non-root
RUN setcap 'cap_net_bind_service=+ep' /usr/local/apache2/bin/httpd
RUN getcap /usr/local/apache2/bin/httpd

HEALTHCHECK --interval=60s --timeout=30s CMD nc -zv localhost 80 || exit 1
#Run as a www-data
USER www-data

docker-compose.yml
version: "3"

services:
 httpd_test:
  image: httpd_test
  deploy:
   replicas: 2

 Manager node
$ docker stack deploy --compose-file ./docker-compose.yml httpd_test
$ docker service ls
ID                  NAME                    MODE                REPLICAS            IMAGE               PORTS
qenag3z7t8t5        httpd_test_httpd_test   replicated          2/2                 httpd_test:latest
$ docker node ls
ID                            HOSTNAME            STATUS              AVAILABILITY        MANAGER STATUS      ENGINE VERSION
jroad5mqkzzzyf50xpgjd589i *   Ayanami             Ready               Active              Leader              18.03.1-ce
49hwm3mm3381mc9m7njn73ywi     Ayanami-clone       Ready               Active                                  18.03.1-ce

$ docker ps
CONTAINER ID        IMAGE               COMMAND              CREATED             STATUS                   PORTS               NAMES
943a18981350        httpd_test:latest   "httpd-foreground"   8 minutes ago       Up 8 minutes (healthy)   80/tcp              httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq

$ docker run -it --net host --pid host --cap-add audit_control     -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST     -v /var/lib:/var/lib     -v /var/run/docker.sock:/var/run/docker.sock     -v /usr/lib/systemd:/usr/lib/systemd     -v /etc:/etc --label docker_bench_security     docker-bench-security
# ------------------------------------------------------------------------------
# Docker Bench for Security v1.3.4
#
# Docker, Inc. (c) 2015-
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker Community Edition Benchmark v1.1.0.
# ------------------------------------------------------------------------------

Initializing Thu Jul 12 20:06:37 UTC 2018

[INFO] 1 - Host Configuration
[WARN] 1.1  - Ensure a separate partition for containers has been created
[NOTE] 1.2  - Ensure the container host has been Hardened
[INFO] 1.3  - Ensure Docker is up to date
[INFO]      * Using 18.03.1, verify is it up to date as deemed necessary
[INFO]      * Your operating system vendor may provide support and security maintenance for Docker
[INFO] 1.4  - Ensure only trusted users are allowed to control Docker daemon
[INFO]      * docker:x:130:rei
[WARN] 1.5  - Ensure auditing is configured for the Docker daemon
[WARN] 1.6  - Ensure auditing is configured for Docker files and directories - /var/lib/docker
[WARN] 1.7  - Ensure auditing is configured for Docker files and directories - /etc/docker
[INFO] 1.8  - Ensure auditing is configured for Docker files and directories - docker.service
[INFO]      * File not found
[INFO] 1.9  - Ensure auditing is configured for Docker files and directories - docker.socket
[INFO]      * File not found
[WARN] 1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker
[INFO] 1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json
[INFO]      * File not found
[INFO] 1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd
[INFO]      * File not found
[INFO] 1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc
[INFO]      * File not found

[INFO] 2 - Docker daemon configuration
[WARN] 2.1  - Ensure network traffic is restricted between containers on the default bridge
[PASS] 2.2  - Ensure the logging level is set to 'info'
[PASS] 2.3  - Ensure Docker is allowed to make changes to iptables
[PASS] 2.4  - Ensure insecure registries are not used
[WARN] 2.5  - Ensure aufs storage driver is not used
[INFO] 2.6  - Ensure TLS authentication for Docker daemon is configured
[INFO]      * Docker daemon not listening on TCP
[INFO] 2.7  - Ensure the default ulimit is configured appropriately
[INFO]      * Default ulimit doesn't appear to be set
[WARN] 2.8  - Enable user namespace support
[PASS] 2.9  - Ensure the default cgroup usage has been confirmed
[PASS] 2.10 - Ensure base device size is not changed until needed
[WARN] 2.11 - Ensure that authorization for Docker client commands is enabled
[WARN] 2.12 - Ensure centralized and remote logging is configured
[INFO] 2.13 - Ensure operations on legacy registry (v1) are Disabled (Deprecated)
[PASS] 2.14 - Ensure live restore is Enabled (Incompatible with swarm mode)
[WARN] 2.15 - Ensure Userland Proxy is Disabled
[PASS] 2.16 - Ensure daemon-wide custom seccomp profile is applied, if needed
[PASS] 2.17 - Ensure experimental features are avoided in production
[WARN] 2.18 - Ensure containers are restricted from acquiring new privileges

[INFO] 3 - Docker daemon configuration files
[INFO] 3.1  - Ensure that docker.service file ownership is set to root:root
[INFO]      * File not found
[INFO] 3.2  - Ensure that docker.service file permissions are set to 644 or more restrictive
[INFO]      * File not found
[INFO] 3.3  - Ensure that docker.socket file ownership is set to root:root
[INFO]      * File not found
[INFO] 3.4  - Ensure that docker.socket file permissions are set to 644 or more restrictive
[INFO]      * File not found
[PASS] 3.5  - Ensure that /etc/docker directory ownership is set to root:root
[PASS] 3.6  - Ensure that /etc/docker directory permissions are set to 755 or more restrictive
[INFO] 3.7  - Ensure that registry certificate file ownership is set to root:root
[INFO]      * Directory not found
[INFO] 3.8  - Ensure that registry certificate file permissions are set to 444 or more restrictive
[INFO]      * Directory not found
[INFO] 3.9  - Ensure that TLS CA certificate file ownership is set to root:root
[INFO]      * No TLS CA certificate found
[INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictive
[INFO]      * No TLS CA certificate found
[INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root
[INFO]      * No TLS Server certificate found
[INFO] 3.12 - Ensure that Docker server certificate file permissions are set to 444 or more restrictive
[INFO]      * No TLS Server certificate found
[INFO] 3.13 - Ensure that Docker server certificate key file ownership is set to root:root
[INFO]      * No TLS Key found
[INFO] 3.14 - Ensure that Docker server certificate key file permissions are set to 400
[INFO]      * No TLS Key found
[PASS] 3.15 - Ensure that Docker socket file ownership is set to root:docker
[PASS] 3.16 - Ensure that Docker socket file permissions are set to 660 or more restrictive
[INFO] 3.17 - Ensure that daemon.json file ownership is set to root:root
[INFO]      * File not found
[INFO] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive
[INFO]      * File not found
[PASS] 3.19 - Ensure that /etc/default/docker file ownership is set to root:root
[PASS] 3.20 - Ensure that /etc/default/docker file permissions are set to 644 or more restrictive

[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created
[NOTE] 4.2  - Ensure that containers use trusted base images
[NOTE] 4.3  - Ensure unnecessary packages are not installed in the container
[NOTE] 4.4  - Ensure images are scanned and rebuilt to include security patches
[WARN] 4.5  - Ensure Content trust for Docker is Enabled
[WARN] 4.6  - Ensure HEALTHCHECK instructions have been added to the container image
[WARN]      * No Healthcheck found: [httpd:2.4-alpine]
[WARN]      * No Healthcheck found: [alpine:3.7]
[WARN]      * No Healthcheck found: [mysql:latest]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-proxy-amd64:v1.10.5]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-scheduler-amd64:v1.10.5]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-apiserver-amd64:v1.10.5]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.5]
[WARN]      * No Healthcheck found: [postgres:latest]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-proxy-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-apiserver-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-scheduler-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [quay.io/calico/node:v3.1.3]
[WARN]      * No Healthcheck found: [quay.io/calico/kube-controllers:v3.1.3]
[WARN]      * No Healthcheck found: [quay.io/calico/cni:v3.1.3]
[WARN]      * No Healthcheck found: [owncloud:latest]
[WARN]      * No Healthcheck found: [mongo:latest]
[WARN]      * No Healthcheck found: [httpd:latest]
[WARN]      * No Healthcheck found: [centos:7]
[WARN]      * No Healthcheck found: [k8s.gcr.io/etcd-amd64:3.1.12]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3]
[WARN]      * No Healthcheck found: [quay.io/coreos/flannel:v0.10.0-amd64]
[WARN]      * No Healthcheck found: [alpine:latest]
[WARN]      * No Healthcheck found: [k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64:1.14.8]
[WARN]      * No Healthcheck found: [k8s.gcr.io/k8s-dns-sidecar-amd64:1.14.8]
[WARN]      * No Healthcheck found: [k8s.gcr.io/k8s-dns-kube-dns-amd64:1.14.8]
[WARN]      * No Healthcheck found: [k8s.gcr.io/pause-amd64:3.1]
[WARN]      * No Healthcheck found: [hello-world:latest]
[WARN]      * No Healthcheck found: [quay.io/coreos/etcd:v3.1.10]
[INFO] 4.7  - Ensure update instructions are not use alone in the Dockerfile
[INFO]      * Update instruction found: [httpd_test:latest]
[INFO]      * Update instruction found: [mysql:latest]
[INFO]      * Update instruction found: [postgres:latest]
[INFO]      * Update instruction found: [owncloud:latest]
[INFO]      * Update instruction found: [mongo:latest]
[INFO]      * Update instruction found: [httpd:latest]
[NOTE] 4.8  - Ensure setuid and setgid permissions are removed in the images
[INFO] 4.9  - Ensure COPY is used instead of ADD in Dockerfile
[INFO]      * ADD in image history: [docker-bench-security:latest]
[INFO]      * ADD in image history: [httpd_test:latest]
[INFO]      * ADD in image history: [httpd:2.4-alpine]
[INFO]      * ADD in image history: [alpine:3.7]
[INFO]      * ADD in image history: [mysql:latest]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-proxy-amd64:v1.10.5]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-scheduler-amd64:v1.10.5]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-apiserver-amd64:v1.10.5]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.5]
[INFO]      * ADD in image history: [postgres:latest]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-proxy-amd64:v1.10.4]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-apiserver-amd64:v1.10.4]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-scheduler-amd64:v1.10.4]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.4]
[INFO]      * ADD in image history: [quay.io/calico/node:v3.1.3]
[INFO]      * ADD in image history: [quay.io/calico/kube-controllers:v3.1.3]
[INFO]      * ADD in image history: [quay.io/calico/cni:v3.1.3]
[INFO]      * ADD in image history: [owncloud:latest]
[INFO]      * ADD in image history: [mongo:latest]
[INFO]      * ADD in image history: [httpd:latest]
[INFO]      * ADD in image history: [centos:7]
[INFO]      * ADD in image history: [k8s.gcr.io/etcd-amd64:3.1.12]
[INFO]      * ADD in image history: [k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3]
[INFO]      * ADD in image history: [quay.io/coreos/flannel:v0.10.0-amd64]
[INFO]      * ADD in image history: [alpine:latest]
[INFO]      * ADD in image history: [k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64:1.14.8]
[INFO]      * ADD in image history: [k8s.gcr.io/k8s-dns-sidecar-amd64:1.14.8]
[INFO]      * ADD in image history: [k8s.gcr.io/k8s-dns-kube-dns-amd64:1.14.8]
[INFO]      * ADD in image history: [k8s.gcr.io/pause-amd64:3.1]
[INFO]      * ADD in image history: [quay.io/coreos/etcd:v3.1.10]
[NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles
[NOTE] 4.11 - Ensure verified packages are only Installed

[INFO] 5  - Container Runtime
[PASS] 5.1  - Ensure AppArmor Profile is Enabled
[WARN] 5.2  - Ensure SELinux security options are set, if applicable
[WARN]      * No SecurityOptions Found: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.3  - Ensure Linux Kernel Capabilities are restricted within containers
[PASS] 5.4  - Ensure privileged containers are not used
[PASS] 5.5  - Ensure sensitive host system directories are not mounted on containers
[PASS] 5.6  - Ensure ssh is not run within containers
[PASS] 5.7  - Ensure privileged ports are not mapped within containers
[NOTE] 5.8  - Ensure only needed ports are open on the container
[PASS] 5.9  - Ensure the host's network namespace is not shared
[WARN] 5.10 - Ensure memory usage for container is limited
[WARN]      * Container running without memory restrictions: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[WARN] 5.11 - Ensure CPU priority is set appropriately on the container
[WARN]      * Container running without CPU restrictions: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[WARN] 5.12 - Ensure the container's root filesystem is mounted as read only
[WARN]      * Container running with root FS mounted R/W: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.13 -  Ensure incoming container traffic is binded to a specific host interface
[WARN] 5.14 - Ensure 'on-failure' container restart policy is set to '5'
[WARN]      * MaximumRetryCount is not set to 5: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.15 - Ensure the host's process namespace is not shared
[PASS] 5.16 - Ensure the host's IPC namespace is not shared
[PASS] 5.17 - Ensure host devices are not directly exposed to containers
[INFO] 5.18 - Ensure the default ulimit is overwritten at runtime, only if needed
[INFO]      * Container no default ulimit override: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.19 - Ensure mount propagation mode is not set to shared
[PASS] 5.20 - Ensure the host's UTS namespace is not shared
[PASS] 5.21 - Ensure the default seccomp profile is not Disabled
[NOTE] 5.22 - Ensure docker exec commands are not used with privileged option
[NOTE] 5.23 - Ensure docker exec commands are not used with user option
[PASS] 5.24 - Ensure cgroup usage is confirmed
[WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges
[WARN]      * Privileges not restricted: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.26 - Ensure container health is checked at runtime
[INFO] 5.27 - Ensure docker commands always get the latest version of the image
[WARN] 5.28 - Ensure PIDs cgroup limit is used
[WARN]      * PIDs limit not set: httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
[PASS] 5.29 - Ensure Docker's default bridge docker0 is not used
[PASS] 5.30 - Ensure the host's user namespaces is not shared
[PASS] 5.31 - Ensure the Docker socket is not mounted inside any containers

[INFO] 6 - Docker Security Operations
[INFO] 6.1  - Avoid image sprawl
[INFO]      * There are currently: 31 images
[INFO]      * Only 6 out of 31 are in use
[INFO] 6.2  - Avoid container sprawl
[INFO]      * There are currently a total of 6 containers, with 2 of them currently running

[INFO] 7 - Docker Swarm Configuration
[WARN] 7.1  - Ensure swarm mode is not Enabled, if not needed
[PASS] 7.2  - Ensure the minimum number of manager nodes have been created in a swarm
[WARN] 7.3  - Ensure swarm services are binded to a specific host interface
[INFO] 7.5  - Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster
[WARN] 7.6  - Ensure swarm manager is run in auto-lock mode
[NOTE] 7.7  - Ensure swarm manager auto-lock key is rotated periodically
[INFO] 7.8  - Ensure node certificates are rotated as appropriate
[INFO] 7.9  - Ensure CA certificates are rotated as appropriate
[INFO] 7.10 - Ensure management plane traffic has been separated from data plane traffic

[INFO] Checks: 104
[INFO] Score: 10

 Worker node
$ docker ps
CONTAINER ID        IMAGE               COMMAND              CREATED             STATUS                    PORTS               NAMES
de2b60a5bd1b        httpd_test:latest   "httpd-foreground"   10 minutes ago      Up 10 minutes (healthy)   80/tcp              httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl

$ docker run -it --net host --pid host --cap-add audit_control     -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST     -v /var/lib:/var/lib     -v /var/run/docker.sock:/var/run/docker.sock     -v /usr/lib/systemd:/usr/lib/systemd     -v /etc:/etc --label docker_bench_security     docker-bench-security
# ------------------------------------------------------------------------------
# Docker Bench for Security v1.3.4
#
# Docker, Inc. (c) 2015-
#
# Checks for dozens of common best-practices around deploying Docker containers in production.
# Inspired by the CIS Docker Community Edition Benchmark v1.1.0.
# ------------------------------------------------------------------------------

Initializing Thu Jul 12 20:07:58 GMT 2018

[INFO] 1 - Host Configuration
[WARN] 1.1  - Ensure a separate partition for containers has been created
[NOTE] 1.2  - Ensure the container host has been Hardened
[INFO] 1.3  - Ensure Docker is up to date
[INFO]      * Using 18.03.1, verify is it up to date as deemed necessary
[INFO]      * Your operating system vendor may provide support and security maintenance for Docker
[INFO] 1.4  - Ensure only trusted users are allowed to control Docker daemon
[INFO]      * docker:x:129:rei,root
[WARN] 1.5  - Ensure auditing is configured for the Docker daemon
[WARN] 1.6  - Ensure auditing is configured for Docker files and directories - /var/lib/docker
[WARN] 1.7  - Ensure auditing is configured for Docker files and directories - /etc/docker
[INFO] 1.8  - Ensure auditing is configured for Docker files and directories - docker.service
[INFO]      * File not found
[INFO] 1.9  - Ensure auditing is configured for Docker files and directories - docker.socket
[INFO]      * File not found
[WARN] 1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker
[WARN] 1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json
[INFO] 1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd
[INFO]      * File not found
[INFO] 1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc
[INFO]      * File not found

[INFO] 2 - Docker daemon configuration
[WARN] 2.1  - Ensure network traffic is restricted between containers on the default bridge
[PASS] 2.2  - Ensure the logging level is set to 'info'
[PASS] 2.3  - Ensure Docker is allowed to make changes to iptables
[PASS] 2.4  - Ensure insecure registries are not used
[WARN] 2.5  - Ensure aufs storage driver is not used
[INFO] 2.6  - Ensure TLS authentication for Docker daemon is configured
[INFO]      * Docker daemon not listening on TCP
[INFO] 2.7  - Ensure the default ulimit is configured appropriately
[INFO]      * Default ulimit doesn't appear to be set
[WARN] 2.8  - Enable user namespace support
[PASS] 2.9  - Ensure the default cgroup usage has been confirmed
[PASS] 2.10 - Ensure base device size is not changed until needed
[WARN] 2.11 - Ensure that authorization for Docker client commands is enabled
[WARN] 2.12 - Ensure centralized and remote logging is configured
[INFO] 2.13 - Ensure operations on legacy registry (v1) are Disabled (Deprecated)
[PASS] 2.14 - Ensure live restore is Enabled (Incompatible with swarm mode)
[WARN] 2.15 - Ensure Userland Proxy is Disabled
[PASS] 2.16 - Ensure daemon-wide custom seccomp profile is applied, if needed
[WARN] 2.17 - Ensure experimental features are avoided in production
[WARN] 2.18 - Ensure containers are restricted from acquiring new privileges

[INFO] 3 - Docker daemon configuration files
[INFO] 3.1  - Ensure that docker.service file ownership is set to root:root
[INFO]      * File not found
[INFO] 3.2  - Ensure that docker.service file permissions are set to 644 or more restrictive
[INFO]      * File not found
[INFO] 3.3  - Ensure that docker.socket file ownership is set to root:root
[INFO]      * File not found
[INFO] 3.4  - Ensure that docker.socket file permissions are set to 644 or more restrictive
[INFO]      * File not found
[PASS] 3.5  - Ensure that /etc/docker directory ownership is set to root:root
[PASS] 3.6  - Ensure that /etc/docker directory permissions are set to 755 or more restrictive
[INFO] 3.7  - Ensure that registry certificate file ownership is set to root:root
[INFO]      * Directory not found
[INFO] 3.8  - Ensure that registry certificate file permissions are set to 444 or more restrictive
[INFO]      * Directory not found
[INFO] 3.9  - Ensure that TLS CA certificate file ownership is set to root:root
[INFO]      * No TLS CA certificate found
[INFO] 3.10 - Ensure that TLS CA certificate file permissions are set to 444 or more restrictive
[INFO]      * No TLS CA certificate found
[INFO] 3.11 - Ensure that Docker server certificate file ownership is set to root:root
[INFO]      * No TLS Server certificate found
[INFO] 3.12 - Ensure that Docker server certificate file permissions are set to 444 or more restrictive
[INFO]      * No TLS Server certificate found
[INFO] 3.13 - Ensure that Docker server certificate key file ownership is set to root:root
[INFO]      * No TLS Key found
[INFO] 3.14 - Ensure that Docker server certificate key file permissions are set to 400
[INFO]      * No TLS Key found
[PASS] 3.15 - Ensure that Docker socket file ownership is set to root:docker
[PASS] 3.16 - Ensure that Docker socket file permissions are set to 660 or more restrictive
[PASS] 3.17 - Ensure that daemon.json file ownership is set to root:root
[PASS] 3.18 - Ensure that daemon.json file permissions are set to 644 or more restrictive
[PASS] 3.19 - Ensure that /etc/default/docker file ownership is set to root:root
[PASS] 3.20 - Ensure that /etc/default/docker file permissions are set to 644 or more restrictive

[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created
[NOTE] 4.2  - Ensure that containers use trusted base images
[NOTE] 4.3  - Ensure unnecessary packages are not installed in the container
[NOTE] 4.4  - Ensure images are scanned and rebuilt to include security patches
[WARN] 4.5  - Ensure Content trust for Docker is Enabled
[WARN] 4.6  - Ensure HEALTHCHECK instructions have been added to the container image
[WARN]      * No Healthcheck found: [php_test:latest]
[WARN]      * No Healthcheck found: [docker:dind]
[WARN]      * No Healthcheck found: [php:7.0-alpine]
[WARN]      * No Healthcheck found: [php:7.1-alpine]
[WARN]      * No Healthcheck found: [php:7.2]
[WARN]      * No Healthcheck found: [httpd:2.4-alpine]
[WARN]      * No Healthcheck found: [alpine:edge]
[WARN]      * No Healthcheck found: [tomcat:8]
[WARN]      * No Healthcheck found: [postgres:latest]
[WARN]      * No Healthcheck found: [test_rabbit:latest]
[WARN]      * No Healthcheck found: [php:7.2.7-fpm-alpine3.7]
[WARN]      * No Healthcheck found: [rabbitmq:management]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-proxy-amd64:v1.10.5]
[WARN]      * No Healthcheck found: [alpine_test:latest]
[WARN]      * No Healthcheck found: [node:8]
[WARN]      * No Healthcheck found: [postgres:9]
[WARN]      * No Healthcheck found: [owncloud:latest]
[WARN]      * No Healthcheck found: [node:alpine]
[WARN]      * No Healthcheck found: [php:5.6-apache-jessie]
[WARN]      * No Healthcheck found: [percona:5.6]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-scheduler-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.4]
[WARN]      * No Healthcheck found: [gcc:8]
[WARN]      * No Healthcheck found: [ubuntu:18.04 ubuntu:latest]
[WARN]      * No Healthcheck found: [ubuntu:18.04 ubuntu:latest]
[WARN]      * No Healthcheck found: [centos:latest]
[WARN]      * No Healthcheck found: [quay.io/calico/node:v3.1.3]
[WARN]      * No Healthcheck found: [quay.io/calico/cni:v3.1.3]
[WARN]      * No Healthcheck found: [php:5.6-apache]
[WARN]      * No Healthcheck found: [busybox:latest]
[WARN]      * No Healthcheck found: [mysql:latest]
[WARN]      * No Healthcheck found: [debian:wheezy]
[WARN]      * No Healthcheck found: [mariadb:5.5.59]
[WARN]      * No Healthcheck found: [alpine:3.7]
[WARN]      * No Healthcheck found: [k8s.gcr.io/pause-amd64:3.1]
[WARN]      * No Healthcheck found: [java:openjdk-9]
[INFO] 4.7  - Ensure update instructions are not use alone in the Dockerfile
[INFO]      * Update instruction found: [httpd_test:latest]
[INFO]      * Update instruction found: [php:7.2]
[INFO]      * Update instruction found: [tomcat:8]
[INFO]      * Update instruction found: [postgres:latest]
[INFO]      * Update instruction found: [test_rabbit:latest]
[INFO]      * Update instruction found: [rabbitmq:management]
[INFO]      * Update instruction found: [node:8]
[INFO]      * Update instruction found: [postgres:9]
[INFO]      * Update instruction found: [owncloud:latest]
[INFO]      * Update instruction found: [php:5.6-apache-jessie]
[INFO]      * Update instruction found: [percona:5.6]
[INFO]      * Update instruction found: [gcc:8]
[INFO]      * Update instruction found: [php:5.6-apache]
[INFO]      * Update instruction found: [mysql:latest]
[INFO]      * Update instruction found: [mariadb:5.5.59]
[INFO]      * Update instruction found: [java:openjdk-9]
[NOTE] 4.8  - Ensure setuid and setgid permissions are removed in the images
[INFO] 4.9  - Ensure COPY is used instead of ADD in Dockerfile
[INFO]      * ADD in image history: [docker-bench-security:latest]
[INFO]      * ADD in image history: [httpd_test:latest]
[INFO]      * ADD in image history: [php_test:latest]
[INFO]      * ADD in image history: [docker:dind]
[INFO]      * ADD in image history: [php:7.0-alpine]
[INFO]      * ADD in image history: [php:7.1-alpine]
[INFO]      * ADD in image history: [php:7.2]
[INFO]      * ADD in image history: [httpd:2.4-alpine]
[INFO]      * ADD in image history: [alpine:edge]
[INFO]      * ADD in image history: [tomcat:8]
[INFO]      * ADD in image history: [postgres:latest]
[INFO]      * ADD in image history: [test_rabbit:latest]
[INFO]      * ADD in image history: [php:7.2.7-fpm-alpine3.7]
[INFO]      * ADD in image history: [rabbitmq:management]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-proxy-amd64:v1.10.5]
[INFO]      * ADD in image history: [alpine_test:latest]
[INFO]      * ADD in image history: [node:8]
[INFO]      * ADD in image history: [postgres:9]
[INFO]      * ADD in image history: [owncloud:latest]
[INFO]      * ADD in image history: [node:alpine]
[INFO]      * ADD in image history: [php:5.6-apache-jessie]
[INFO]      * ADD in image history: [percona:5.6]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-scheduler-amd64:v1.10.4]
[INFO]      * ADD in image history: [k8s.gcr.io/kube-controller-manager-amd64:v1.10.4]
[INFO]      * ADD in image history: [gcc:8]
[INFO]      * ADD in image history: [ubuntu:18.04 ubuntu:latest]
[INFO]      * ADD in image history: [ubuntu:18.04 ubuntu:latest]
[INFO]      * ADD in image history: [centos:latest]
[INFO]      * ADD in image history: [quay.io/calico/node:v3.1.3]
[INFO]      * ADD in image history: [quay.io/calico/cni:v3.1.3]
[INFO]      * ADD in image history: [php:5.6-apache]
[INFO]      * ADD in image history: [busybox:latest]
[INFO]      * ADD in image history: [mysql:latest]
[INFO]      * ADD in image history: [debian:wheezy]
[INFO]      * ADD in image history: [mariadb:5.5.59]
[INFO]      * ADD in image history: [alpine:3.7]
[INFO]      * ADD in image history: [k8s.gcr.io/pause-amd64:3.1]
[INFO]      * ADD in image history: [java:openjdk-9]
[NOTE] 4.10 - Ensure secrets are not stored in Dockerfiles
[NOTE] 4.11 - Ensure verified packages are only Installed

[INFO] 5  - Container Runtime
[PASS] 5.1  - Ensure AppArmor Profile is Enabled
[WARN] 5.2  - Ensure SELinux security options are set, if applicable
[WARN]      * No SecurityOptions Found: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.3  - Ensure Linux Kernel Capabilities are restricted within containers
[PASS] 5.4  - Ensure privileged containers are not used
[PASS] 5.5  - Ensure sensitive host system directories are not mounted on containers
[PASS] 5.6  - Ensure ssh is not run within containers
[PASS] 5.7  - Ensure privileged ports are not mapped within containers
[NOTE] 5.8  - Ensure only needed ports are open on the container
[PASS] 5.9  - Ensure the host's network namespace is not shared
[WARN] 5.10 - Ensure memory usage for container is limited
[WARN]      * Container running without memory restrictions: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[WARN] 5.11 - Ensure CPU priority is set appropriately on the container
[WARN]      * Container running without CPU restrictions: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[WARN] 5.12 - Ensure the container's root filesystem is mounted as read only
[WARN]      * Container running with root FS mounted R/W: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.13 -  Ensure incoming container traffic is binded to a specific host interface
[WARN] 5.14 - Ensure 'on-failure' container restart policy is set to '5'
[WARN]      * MaximumRetryCount is not set to 5: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.15 - Ensure the host's process namespace is not shared
[PASS] 5.16 - Ensure the host's IPC namespace is not shared
[PASS] 5.17 - Ensure host devices are not directly exposed to containers
[INFO] 5.18 - Ensure the default ulimit is overwritten at runtime, only if needed
[INFO]      * Container no default ulimit override: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.19 - Ensure mount propagation mode is not set to shared
[PASS] 5.20 - Ensure the host's UTS namespace is not shared
[PASS] 5.21 - Ensure the default seccomp profile is not Disabled
[NOTE] 5.22 - Ensure docker exec commands are not used with privileged option
[NOTE] 5.23 - Ensure docker exec commands are not used with user option
[PASS] 5.24 - Ensure cgroup usage is confirmed
[WARN] 5.25 - Ensure the container is restricted from acquiring additional privileges
[WARN]      * Privileges not restricted: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.26 - Ensure container health is checked at runtime
[INFO] 5.27 - Ensure docker commands always get the latest version of the image
[WARN] 5.28 - Ensure PIDs cgroup limit is used
[WARN]      * PIDs limit not set: httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
[PASS] 5.29 - Ensure Docker's default bridge docker0 is not used
[PASS] 5.30 - Ensure the host's user namespaces is not shared
[PASS] 5.31 - Ensure the Docker socket is not mounted inside any containers

[INFO] 6 - Docker Security Operations
[INFO] 6.1  - Avoid image sprawl
[INFO]      * There are currently: 43 images
[INFO]      * Only 19 out of 43 are in use
[INFO] 6.2  - Avoid container sprawl
[INFO]      * There are currently a total of 19 containers, with 2 of them currently running

[INFO] 7 - Docker Swarm Configuration
[WARN] 7.1  - Ensure swarm mode is not Enabled, if not needed
Error response from daemon: This node is not a swarm manager. Worker nodes can't be used to view or modify cluster state. Please run this command on a manager node or promote the current node to a manager.
[PASS] 7.2  - Ensure the minimum number of manager nodes have been created in a swarm
[PASS] 7.3  - Ensure swarm services are binded to a specific host interface
Error response from daemon: This node is not a swarm manager. Worker nodes can't be used to view or modify cluster state. Please run this command on a manager node or promote the current node to a manager.
[INFO] 7.5  - Ensure Docker's secret management commands are used for managing secrets in a Swarm cluster
[WARN] 7.6  - Ensure swarm manager is run in auto-lock mode
[NOTE] 7.7  - Ensure swarm manager auto-lock key is rotated periodically
[INFO] 7.8  - Ensure node certificates are rotated as appropriate
[INFO] 7.9  - Ensure CA certificates are rotated as appropriate
[INFO] 7.10 - Ensure management plane traffic has been separated from data plane traffic

[INFO] Checks: 104
[INFO] Score: 11

Manager node:
[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created

Worker node:
[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created

 Manager node container logs
$ docker logs httpd_test_httpd_test.2.1oaybpksrkqkc9gx2sutsjygq
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
[Thu Jul 12 19:57:53.206264 2018] [mpm_event:notice] [pid 1:tid<PHONE_NUMBER>88456] AH00489: Apache/2.4.33 (Unix) configured -- resuming normal operations
[Thu Jul 12 19:57:53.206318 2018] [core:notice] [pid 1:tid<PHONE_NUMBER>88456] AH00094: Command line: 'httpd -D FOREGROUND'

 Worker node container logs
$ docker logs httpd_test_httpd_test.1.k8ebms2wnnj8mdttuem6r5rxl
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
[Thu Jul 12 19:57:29.542919 2018] [mpm_event:notice] [pid 1:tid<PHONE_NUMBER>32424] AH00489: Apache/2.4.33 (Unix) configured -- resuming normal operations
[Thu Jul 12 19:57:29.543028 2018] [core:notice] [pid 1:tid<PHONE_NUMBER>32424] AH00094: Command line: 'httpd -D FOREGROUND'

"I'm not able to reproduce any error while deploying a stack to a swarm and testing the nodes." =>  Yes it is normal that you pass the test 4.1 since "USER www-data" was added to the Dockerfile, therefore the container processes run as non-root. But are your nodes on everlay2 and is apache actually running fine?
Anyway the consequence of  adding "User www-data" was that "www-data" user couldn't bind to port 80 and caused apache to fail, which led us to add the setcap instruction. Now the problem is that that new image runs normally if the node has aufs storage driver, but hits again the "Can't bind to port 80" error if you try to run it on a node with overlay2 storage driver.
Yes my initial  use case is to deploy it on a swarm (where all the nodes are on everlay2), but to not complicate things, one can simply reproduce this with 2 simple docker hosts, one with aufs and the other with overlay2 like this:
With aufs: => works OK:
$ docker run --rm image_name
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
[Wed Jul 11 09:51:33.316839 2018] [mpm_event:notice] [pid 1:tid<PHONE_NUMBER>51656] AH00489: Apache/2.4.33 (Unix) configured -- resuming normal operations
[Wed Jul 11 09:51:33.316997 2018] [core:notice] [pid 1:tid<PHONE_NUMBER>51656] AH00094: Command line: 'httpd -D FOREGROUND'
With overlay2: works not despite setcap:
$ docker run --rm image_name
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using <IP_ADDRESS>. Set the 'ServerName' directive globally to suppress this message
(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
(13)Permission denied: AH00072: make_sock: could not bind to address <IP_ADDRESS>:80

I'm using the default AUFS, if you're encountering anomalous behavior on a differing storage driver then you could create an issue on https://github.com/moby/moby as we maintain the official-images and not the underlying components of Docker
Manager node
$ docker ps
CONTAINER ID        IMAGE               COMMAND              CREATED             STATUS                   PORTS               NAMES
645f15e02290        httpd_test:latest   "httpd-foreground"   5 minutes ago       Up 5 minutes (healthy)   80/tcp              httpd_test_httpd_test.2.trty9eq62w0jo64b2h37w1cch
$ curl <IP_ADDRESS>
<html><body><h1>It works!</h1></body></html>

Worker node
$ docker ps
CONTAINER ID        IMAGE               COMMAND              CREATED             STATUS                   PORTS               NAMES
8b9061c3725d        httpd_test:latest   "httpd-foreground"   5 minutes ago       Up 5 minutes (healthy)   80/tcp              httpd_test_httpd_test.1.xx14geqpdljybirs8nkj8jhzd
$ curl localhost:80
<html><body><h1>It works!</h1></body></html>

I'm not able to reproduce any issues with the image, if you want further help troubleshooting issues you should try the Docker Community Forums, the Docker Community Slack, or Stack Overflow.

By my understanding you're primarily concerned with test section 4.1 of the docker-bench-security test which tests for running as normal user in the container. I'm not able to reproduce any error while deploying a stack to a swarm and testing the nodes.
Dockerfile
FROM httpd:2.4-alpine

#Custom changes
RUN apk update && apk upgrade
RUN apk -q add curl vim libcap

#Change access righs to conf, logs, bin from root to www-data
RUN chown -hR www-data:www-data /usr/local/apache2/

#setcap to bind to privileged ports as non-root
RUN setcap 'cap_net_bind_service=+ep' /usr/local/apache2/bin/httpd
RUN getcap /usr/local/apache2/bin/httpd

HEALTHCHECK --interval=60s --timeout=30s CMD nc -zv localhost 80 || exit 1
#Run as a www-data
USER www-data

docker-compose.yml
version: "3"

services:
 httpd_test:
  image: httpd_test
  deploy:
   replicas: 2

Manager node
Worker node
Manager node:
[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created

Worker node:
[INFO] 4 - Container Images and Build File
[PASS] 4.1  - Ensure a user for the container has been created

Manager node container logs
Worker node container logs

Helpful!!


Added conditional display of resources based on device capability. Added new resources: Qtree, Filesystem and Shares for NAS devices.

What type of PR is this?
/kind new feature
What this PR does / why we need it:
This PR adds support for conditionally displaying the resources supported by a device. SODA Delfin supports SAN, NAS and  devices with Unified capabilities. Some devices may not have all the resources supported and the Dashboard should not display the resources for such devices.
Currently Delfin supports: Storage Pools, Volumes, Controllers, Ports and Disks display. These are displayed for all devices in the tree view in the storage dashboard and tab view in storage details page.
With this PR we display the resource type only if the device model supports the capability. This capability is maintained as a map at the dashboard in the following format:
 resources:{
            volumes : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            pools : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            controllers : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            ports : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc'],
            disks : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            qtrees : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            filesystems : ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc', 'fake_driver'],
            shares: ['vmax', 'unity', 'vnx', 'oceanstor', '3par', 'vsp', 'storwize_svc']
        },

In the above Ports and Shares resources are not supported in the fake_driver devices.
The map above has to be updated with the actual support matrix based on the device capability.
This PR also adds new resource types Qtree, Filesystem and Shares to devices that support NAS capabilities.
Which issue(s) this PR fixes:
Fixes #530
Test Report Added?:
/kind TESTED
Test Report:

Special notes for your reviewer:
The device capability matrix pushed in this PR enables all resource types for all device models.
The actual support matrix must be updated before the PR is merged or in a subsequent PR.

Can we reorder the resource tabs to [Storage pool > Volume > Controller > Port ? Filesystem > Qtree > Share]

@joseph-v This is done. Please review the PR.

@NajmudheenCT @joseph-v @kumarashit
I have updated this PR and added screenshots.
The resources are now conditionally displayed.
The resources supported are maintained in the constants file in an object array as mentioned above in the PR description.
We have to update this with actual values. Please help me with the real values to update the PR.


Multiple column foreign key and associations?

I have an outputs table with the following columns: tx_hash and position which are its primary key and  an inputs table with following columns: txout_tx_hash and txout_position which respectively reference outputs.tx_hash and outputs.position.
I would like to have an 'output' relationship on my Input model that I could load like this:
someInput.load([ 'output' ]).then(function () { ... });

I tried the following without success:
Input = bookshelf.model( //....
    output: function () {
      return this.belongsTo(Output, [ 'outputs', 'tx_hash', 'position' ]);
    }

//....
)

// Results in this error:

{ [error: column outputs.null does not exist]
  name: 'error',
  length: 103,
  severity: 'ERROR',
  code: '42703',
  detail: undefined,
  hint: undefined,
  position: '41',
  internalPosition: undefined,
  internalQuery: undefined,
  where: undefined,
  schema: undefined,
  table: undefined,
  column: undefined,
  dataType: undefined,
  constraint: undefined,
  file: 'parse_relation.c',
  line: '2639',
  routine: 'errorMissingColumn' }

Is there any way I can define the relationship so that I will be able to load it with the .load() method? Also is it possible to use multiple columns for idAttribute?

First, this is not supported:
    output: function () {
      return this.belongsTo(Output, [ 'outputs', 'tx_hash', 'position' ]);
    }

belongsTo only accepts two arguments. The first being the related model (or a model name if you're using the registry plugin). The second is the model's column that references the primary key of the related model.
If I understand correctly you're trying to define a relationship with a composite primary key. ie. ...WHERE outputs.tx_hash = inputs.txout_hash AND outputs.position = inputs.txout_position.... Currently this is not supported, however it is certainly a feature we'd like to support.
For now - in short - the answer is no. You cannot use load with a relation that has two primary keys. Best workaround I'm aware of is to give the table a primary key index and apply a UNIQUE constraints to your two FK's.

Ok thanks.

@rhys-vdw Is there a roadmap for future versions of bookshelf?

@olalonde Nothing format yet. Just an idea of where we want to go and what we primarily want ot address. The creation of a roadmap will be preceded by a community discussion, and the plans will all be open for comment.


Prep bigquery docs for repo split

Toward #5912.
@tswast, the changes to biqguery/docs/index.rst to DRY it with bigquery/README.rst bring it more in line with how other library landing pages are structured:  the biggest change is that the big gray ToC at the top is gone, because I couldn't figure out how to generate it once I was using .. include:: /../bigquery/README.  The relevant pages are still linked in the sidebar menu, however.

@theacodes PTAL at 15610f2, which is my solution for adding redirects for renamed pages (as @tswast recommended).


Resolve broken evaluation/prediction for RewardTrainer

Hello!
Pull Request overview

Implement evaluation & prediction for RewardTrainer.

Update compute_average correspondingly.

Adapt tests to perform both evaluation and prediction.
Improve typing for the RewardTrainer.

Motivation
In our attempts to apply the RewardTrainer, we experienced issues with the evaluation. See below our training script for reference:
Training script
from datasets import load_dataset
from transformers import (
    AutoModelForSequenceClassification,
    AutoTokenizer,
    TrainingArguments,
)
from trl import RewardTrainer

dataset = load_dataset("argilla/dolly-curated-comparison-falcon-7b-instruct", split="train")
model_name = "distilroberta-base"
model = AutoModelForSequenceClassification.from_pretrained(model_name, num_labels=1)
tokenizer = AutoTokenizer.from_pretrained(model_name)

if tokenizer.pad_token is None:
    tokenizer.pad_token = tokenizer.eos_token
    model.config.pad_token_id = model.config.eos_token_id

def formatting_func(examples):
    kwargs = {"padding": "max_length", "truncation": True, "max_length": 512, "return_tensors": "pt"}

    # Prepend the prompt and a line break to the original_response and response-1 fields.
    prompt_plus_chosen_response = examples["prompt"] + "\n" + examples["original_response"]
    prompt_plus_rejected_response = examples["prompt"] + "\n" + examples["response-1"]

    # Then tokenize these modified fields.
    tokens_chosen = tokenizer.encode_plus(prompt_plus_chosen_response, **kwargs)
    tokens_rejected = tokenizer.encode_plus(prompt_plus_rejected_response, **kwargs)

    return {
        "input_ids_chosen": tokens_chosen["input_ids"][0], "attention_mask_chosen": tokens_chosen["attention_mask"][0],
        "input_ids_rejected": tokens_rejected["input_ids"][0], "attention_mask_rejected": tokens_rejected["attention_mask"][0]
    }

formatted_dataset = dataset.map(formatting_func)

formatted_dataset = formatted_dataset.train_test_split()

training_args = TrainingArguments(
    output_dir="./my_model",
    per_device_train_batch_size=16,
    evaluation_strategy="steps",
    logging_steps=100,
)

trainer = RewardTrainer(
    model=model,
    args=training_args,
    tokenizer=tokenizer,
    train_dataset=formatted_dataset["train"],
    eval_dataset=formatted_dataset["test"],
)

trainer.train()

When training, we experience the following error:
Traceback (most recent call last):
  File "[sic]\trl\demo2.py", line 53, in <module>
    trainer.train()
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 1664, in train
    return inner_training_loop(
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 2019, in _inner_training_loop
    self._maybe_log_save_evaluate(tr_loss, model, trial, epoch, ignore_keys_for_eval)
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 2300, in _maybe_log_save_evaluate
    metrics = self.evaluate(ignore_keys=ignore_keys_for_eval)
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 3029, in evaluate
    output = eval_loop(
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 3210, in evaluation_loop
    loss, logits, labels = self.prediction_step(model, inputs, prediction_loss_only, ignore_keys=ignore_keys)
  File "[sic]\trl\lib\site-packages\transformers\trainer.py", line 3476, in prediction_step
    outputs = model(**inputs)
  File "[sic]\trl\lib\site-packages\torch\nn\modules\module.py", line 1501, in _call_impl
    return forward_call(*args, **kwargs)
TypeError: forward() got an unexpected keyword argument 'input_ids_chosen

The cause of this bug is pretty straight-forward: the unchanged transformers Trainer evaluation/prediction loop is used, while we need a special loop that makes forward passes for both the accepted and the rejected input_ids/attention_masks.
The fix
The fix is as simple as overriding prediction_step such that the primary changes relative to the original prediction_step are:

We use compute_loss for the forward calls instead of model(**inputs).
Get the mean of the logits for each of the samples & apply a softmax so the reward for the accepted plus the reward for the rejected sum to 1.
We fix the labels to be a vector of 0's: we always prefer the accepted samples (i.e. index 0).

Because of this last change, we can simplify the compute_average to actually use the labels.
Lastly, I updated the typing on compute_loss. I recognize that the contributor guidelines specify to make those changes separately - I apologize for that.
The consequences
With these changes in place, we can run the above script just fine:

(Although in practice, we just call the forward method of our trained model using individual samples to get the logits.)
Additionally, we can run trainer.predict() and get a useful response. See this dummy example using an untrained model.
PredictionOutput(predictions=array([[0.47846982, 0.52153015],
       [0.5010128 , 0.4989872 ],
       [0.47846982, 0.52153015],
       [0.44097137, 0.5590286 ]], dtype=float32), label_ids=array([0., 0., 0., 0.], dtype=float32), metrics={'test_loss': 0.7460569143295288, 'test_accuracy': 0.25, 'test_runtime': 0.0831, 'test_samples_per_second': 48.116, 'test_steps_per_second': 12.029})

As you can see, the test accuracy is 25%, because for only one of the predictions is the reward for the first sample better.
The tests
The tests are updated to add evaluation_strategy="steps", otherwise the evaluation didn't trigger. Furthermore, I added trainer.predict calls that verify that the output is indeed of shape (4, 2) when there are 4 samples.
Alternatively, I can update the predictions to only give the "probability" of the accepted sample, or to only give the argmax (e.g. [0, 1, 0, 0]) as the prediction.
cc: @younesbelkada @lewtun @lvwerra @dvsrepo
I'm open to feedback and suggestions as always.

Tom Aarsen

Great stuff, we've found out this working on an integration example with the new Argilla Feedback feature. @younesbelkada , @lvwerra, do you have a timeline for releasing the RewardTrainer We'd love to align to officially publish the tutorial.

We discussed today that we want to merge this PR and then do a release!

Cool @lvwerra! Then I'll rush to get the tutorial finished 😄

Perfect. That should make the testing suite a bit more complete


Couldn't open file for reading:[CE]'.trashed-1694020827-ChaldeaTeaTime.png

Preparation

[X] I tested the latest release
[X] I looked at other issues (even the closed ones)
[X] I read the Troubleshooting Guide

FGO server
CN
FGA build number
2152
Describe the bug
When selecting support (Artoria Caster), FGA raises an error message saying "Couldn't open file for reading:[CE]'.trashed-1694020827-ChaldeaTeaTime.png". I tried using the regular up-to-date version on Google Play, changing CE and FGA folder directories, using the latest release .apk file on GitHub, and restarting my mobile phone, but none worked.
Error:

My FGA directory:

My CE folder:

My servant folder:

My Arotria folder:

Video
I have Andriod 13.
Device model
OPPO FindX3
Android version
13
Screen size
1440*3216
RAM
12GB

Battle Config -> Edit Config -> Preferred CEs, for some unknown reasons, my Preferred CEs were set to .trashed-16xxx-ChaldeaTeaTime.png, I changed it back to ChaldeaTeaTime.png and fixed this issue.


Update README.md

.bash_profile or .profile not working on Ubuntu 9.04 and higher, see provided link for details.

Thanks!


Not working with AFNetworking 3.0

Does this pod not work with AFNetworking 3.0? I'm not able to get it to work. I'm passing in the NSURLSessionConfiguration I'm using to create a AFHTTPSessionManager but no files are ever created. Here's the code i use to setup the recorder:
`
NSError *e;
NSArray *paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES);
NSString *bpdDir = [[paths objectAtIndex:0] stringByAppendingPathComponent:@"BPDTests"];
NSLog(@"setting up traffic recorder");

self.recorder = [SWHttpTrafficRecorder sharedRecorder];
__weak BPDKAPIClient_Tests *weakSelf = self;

// This block determines the name that will be given to the file generated
// by each http request
self.recorder.fileNamingBlock = ^NSString*(NSURLRequest *request, NSURLResponse *response, NSString *defaultName)
{
    NSString *name = [weakSelf fileNameForRequest:request];
    NSLog(@"new name: %@, default name: %@", name, defaultName);

    return name;
};

// This block determines if we will record the http request
self.recorder.recordingTestBlock = ^BOOL(NSURLRequest *request)
{
    NSString *path = [weakSelf filePathForRequest:request];
    NSLog(@"are we deciding to record?");

    return ![[NSFileManager defaultManager] fileExistsAtPath:path];
};

// This line forces the singleton configuration to initialize it's session manager and by extension the session
// configuration. This way we can actually pass in the configuration to the recorder
__unused AFHTTPSessionManager *m = self.apiClient.apiClientConfig.httpSessionManager;

NSLog(@"config passed in: %@", self.apiClient.apiClientConfig.httpSessionManagerConfiguration);

[self.recorder startRecordingAtPath:bpdDir
            forSessionConfiguration:self.apiClient.apiClientConfig.httpSessionManagerConfiguration
                              error:&e];

if (e)
{
    NSLog(@"error recording: %@", e);
}`

I wanted to point out that this might be because I use this with OHHTTPStubs, both pods attempt to register a protocol class so one of them wont be working, this is most likely why this wasn't working at the time. It should be noted in the documentation that this pod isn't compatible with pods that register a custom URLProtocol.


[platforms and players] Winlator support (windows platform)

Hi, so I wanted to ask if you can add support for Windows platform using the winlator app, winlator is basically an app that brings all the x86 translators to one place and makes it simple to run PC games and apps
the app can generate shortcuts to games and I thought it might be possible to add it as a new platform <3 thanks for the fantastic job you guys are doing already

I was about to just request the same feature to add Windows platform and winlator as the app to run them.
There is also a project called Cassia that is supposed to have a more of a Proton attempt for this (like on steam deck), so would be a good thing to keep an eye on. https://discord.gg/XnbXNQM


Translate standardized glossary Tag Workload in Korean

To fix #13175 partially.
Glossary translations for Workload tag

/assign

/lgtm
/approve

@seokho-son 감사합니다!


feat: add link to js.ipfs.io

hmm, i agree we should link  to js.ipfs.io  from the home page, but the length of "JS Implementation" really pulls focus a way from the other menu items.

There are also some  specific media queries that prevented the menu items from wrapping at any screen-size that this defeats.

I think the multi-implementations part deserves it's own section in the body of the page. The menu link would take you to #implementations and we describe the go-ipfs and js-ipfs and maybe rust-ipfs endevours with links to the repos, or fancy websites where available.

As a quick fix, we could drop it from the header nav and leave it in the footer nav.

@olizilla I like that suggestion :)

@daviddias the @ipfs/gui-team wants to update ipfs.io with links to IPFS Companion and IPFS Desktop as well, so we'll add in a section about the implementations as part of that work. I'm going to write up an issue for it now and @fsdiogo is going to take a first pass at it.

I think we can close this one in favour of https://github.com/ipfs/website/pull/282.

Closing in favour of #282


fix: keep one storage and functions instance

What kind of change does this PR introduce?
Bug fix
What is the current behavior?
Everytime calling supabse.storage you get a new SupabaseStorageClient instance, resulting in outdated auth headers after auth state change in supabase.auth.
What is the new behavior?
Keeps one storage and functions client and update their authorization header.
Additional context
close https://github.com/supabase/supabase-flutter/issues/376

I always forget that...
I can do that tomorrow.

@Vinzent03
No problem! I can do it right now and release it! Thanks for the amazing work!


Tab group component example not working

Hi, I'm trying out a simplified version of the tab group component here https://justpy.io/tutorial/custom_components/#tab-group-component, with just the first tab group.
Below is the error i got,

Can someone advise how the update vue js call works so that maybe i can try and fix up the bug? Usually clicking on new tab should trigger mount()-> this.graph_change()?
i get similar problems when i put aggrids inside different tabs.

something like the below with tabs containing pandas dataframe doesn't seem to be working,
def tab_comp_test():

    wp = jp.WebPage()

    dfs = [
        pd.DataFrame({'a':[1,2,3], 'b':[4,5,6]}),
        pd.DataFrame({'bb':range(10), 'cc':range(10)}),
        pd.DataFrame({'foo':[1001,1002,1003,1004], 'bar':range(4), 'blah':[1234, 2345, 3456, 4567]}),
        pd.DataFrame({'c1':range(7), 'c2':range(7)}),

    ]

    t = Tabs(a=wp, classes='w-3/4 m-4', style='', animation=False, content_height=550)
    for idx, chart_type in enumerate(['bar', 'column', 'line', 'spline']):
        d = jp.Div(style=Tabs.wrapper_style, delete_flag=True)
        dfs[idx].jp.ag_grid(a=d, style='width: 100%')
        t.add_tab(f'id{chart_type}', f'{chart_type}', d)

At https://github.com/elimintz/justpy/tree/master/examples/tutorial you'll now find the example from the tutorial and  module for using the component Tabs from there. The example does not perfectly work - the refresh is not done automatically but eventually the tab content shows
The example for this issues is now available at https://github.com/elimintz/justpy/blob/master/examples/issues/issue_387_aggrid_tabgroup.py and indeed it doesn't load the grid properly. I didn' ckeck whether the grids would load without the tabs and that would be the first step in finding out what is going on.  Did you find a solution workaround yourself?

I’ve try debugging/tracing from server side to the front end js. It’s hard to figure out what’s going wrong. It appears to be the caching part of the code or some refresh issue, but I’m not too familiar with vue.js to know what’s going on…

if someone could be kind enough to explain in some detail the code path from when we make the python component changes on the server side and how it transitions to the js side (is it always calling mount?), then i can delve deeper into debugging this. I'm rather new to js/vue stuff so abit of hand-holding would be helpful.

see #685


Adding a Variable Start Value in a for Loop

Please add the ability to specify the starting value of the for loop.

I would ask to add another loop iteration index step. There is a step in the standard google blockly.

@riknoll Please make an adequate for loop, which was originally in blockly. With initial value and step value. Makecode spoils the impression of programming in blocks.


fmSetupAssistant: Automation

A method is needed to make it possible to automate running / setting up particular configs.

System automation technique?
automation technique within file itself to say install settings 'X'

Assisted Setup ini file?

A basic automation for initialising or configuring a workstation has been implemented.

Initialisation is a one off configuration that does nothing on a second call, if the workstation is already configured.
Flags and info are stored in user preferences to indicate that (and what) configuration has been applied.

Two methods have been implemented for implementing an initialisation of a Workstation.

There are two API scripts, that a host app can call:

fmSA_InitWorkstation - only applies the configuration, if the workstation has not yet been configured.
fmSA_ApplyConfig - always applies the given configuration
2 . etc.

Done.
Within the app you can manually apply a config.
Solutions can call the API scripts to get a list of configurations and to apply a config.


[sival,sram_ctrl] Fix scrambled_access ECC error counts

Previously the code preserved both the pattern and backdoor fields when we scramble main SRAM. The pattern field is the one that we expect to be scrambled and trigger ECC errors. In DV-sim environments the backdoor field is magically corrected so that it's scrambled with the new key and thus doesn't trigger ECC errors.
This of course does not (and cannot) happen outside of DV sim, so the number of ECC errors was doubled.
Fixed by changing the layout of scramble_test_frame so that we can skip copying the backdoor field outside of DV-sim.
If this description makes no sense, let me know and I'll try fix up the explanation better.

CI failure (uart_baud_rate_test) unrelated.


smoke test failing due to missing mpi4py install

Now that I created a tagged version the smoke test action is running, but lacks the install mpi step that is included in testing and coverage.  Adding that into the smoke test action will likely fix the error and get things back to running.

While I'm at it, I'll update the python versions from 3.8, 3.9, 3.10 to 3.9, 3.10, 3.11 in the tests of both.

closed by #14


Major rework on friendly urls

Double check the functioning of friendly URLs on Apache and Xavante.
Add friendly urls to Nginx build

I need help with this!

Added for nginx :)
Still need to review the others

Ok, Xavante is mostly ok as well!
Only Apache and Lighttpd to go now.
It already works on Apache, though, it is just shitty.
Maybe we should rework the whole way routing is done...

I caught a problem running Sailor in my local machine through Xavante.
Sailor can't identify the parameter when starting it with friend urls on. For example, if I access the url /login/?code=<some-random-value>, I can't see the content of the page.GET.code variable.
I did a work around here, by changing the start-server.lua file. First I got the params by local get_params = req.cmd_url:gsub('%/?%?', '&'), and then I passed the string to req.cmd_url:
req.cmd_url = "/index.lua?"..conf.route_parameter.."="..vars[1].."/"..get..get_params

Do you think it is worth it opening a PR with this work around?

Not really because I'm going to rewrite this whole part to make it more maintainable and stop bugs from affecting only certain servers as much as possible.


Using Leaflet Draw and editing drawn items

Hi - after all the changes to the control functionality what is the recommended approach now to be able to edit draw items added to a map via the Leaflet Draw control.
I have reviewed many of the issues and had this working in 0.8.5. I have now updated to 0.8.7 and everything is working as expected except being able to edit the drawn items.
Can I suggest the example for using the control is extended to include the following:

Include the use of options as defined as follows:

    angular.extend($scope, {
                center: {},
                paths: {},
                controls: { draw: { draw: {   position: "topright",marker: false,rectangle: false} } },
                defaults: {},
            });

Include an example where the drawn items are editable as most use cases require this and would make it simpler to review rather than searching through all the issues which have varying examples, usually incomplete or possibly out of date.

Thanks!

I have the same issue, after updating to 0.8.8, I can't find how to enable edit controls again.

This issue was moved to angular-ui/ui-leaflet#105

I'm going to rework&redesign angular-leaflet-directive to be compatible with Leaflet v1.0. It will mantain almost all its functionality, and will be compatible with the current features of the directive, but I must start from a fresh point, so I'm going to close this issue. If you think it must be worked with the new version, please reopen it.


java out of memory error when running juicer_tools apa on server

Hi,
I am trying to run the aggregate peak analysis using juicer_tools, following the command I use,
#APA plots:
module load juicer/1.5.6
module load java/oracle/jdk1.8.0_65
juicer_tools48g apa -r 10000 out_10kb.matrix out.interactions.intra.bedpe ChIAPET_GM
I get the following error:
Picked up _JAVA_OPTIONS: -Dhttp.proxyHost=proxy.swmed.edu -Dhttp.proxyPort=3128 -Dhttps.proxyHost=proxy.swmed.edu -Dhttps.proxyPort=3128
Exception in thread "main" java.lang.OutOfMemoryError: Requested array size exceeds VM limit
at java.util.Arrays.copyOf(Arrays.java:3236)
at java.io.ByteArrayOutputStream.grow(ByteArrayOutputStream.java:118)
at java.io.ByteArrayOutputStream.ensureCapacity(ByteArrayOutputStream.java:93)
at java.io.ByteArrayOutputStream.write(ByteArrayOutputStream.java:135)
at htsjdk.tribble.util.LittleEndianInputStream.readString(LittleEndianInputStream.java:121)
at juicebox.data.DatasetReaderV2.getMagicString(DatasetReaderV2.java:113)
at juicebox.data.HiCFileTools.extractDatasetForCLT(HiCFileTools.java:57)
at juicebox.tools.clt.juicer.APA.runWithReturn(APA.java:221)
at juicebox.tools.clt.juicer.APA.run(APA.java:205)
at juicebox.tools.HiCTools.main(HiCTools.java:96)
It. seems that the java heap size needs to be changed, but I am not sure how should I do that using the command? Kindly assist in resolving the issue. Thank you!

Try running java with the Xmx flag, i.e.
java -Xmx30G juicer_tools.jar ....
Notice that there are no spaces -n -Xmx30G
Of course, replace 30G by whatever is appropriate for your system.

Thanks for your reply, however, after loading the juicer module on hpc, I do not find juicer_tools.jar file
it has only these scripts for me to use from:
juicer_arrowhead.sh       juicer_hiccups.sh         juicer_postprocessing.sh  juicer.sh                 juicer_tools              juicer_tools48g


Problems publishing App

I am trying to publish my App. It used to work fine, until I updated my auth with social Provider (federation). Now i get this error message:
2020-06-23T08:11:07.616Z [WARNING]: ✖ An error occurred when pushing the resources to the cloud
2020-06-23T08:11:07.616Z [WARNING]: ✖ There was an error initializing your environment.
2020-06-23T08:11:07.616Z [INFO]: init failed
2020-06-23T08:11:07.617Z [INFO]: TypeError: Cannot read property 'Mappings' of undefined
at collectTemplates (/root/.nvm/versions/node/v10.16.0/lib/node_modules/@aws-amplify/cli/node_modules/graphql-transformer-core/lib/util/splitStack.js:78:36)
at Object.splitStack [as default] (/root/.nvm/versions/node/v10.16.0/lib/node_modules/@aws-amplify/cli/node_modules/graphql-transformer-core/lib/util/splitStack.js:208:20)
at TransformFormatter.format (/root/.nvm/versions/node/v10.16.0/lib/node_modules/@aws-amplify/cli/node_modules/graphql-transformer-core/lib/TransformFormatter.js:25:50)
at GraphQLTransform.transform (/root/.nvm/versions/node/v10.16.0/lib/node_modules/@aws-amplify/cli/node_modules/graphql-transformer-core/lib/GraphQLTransform.js:207:26)
at _buildProject (/root/.nvm/versions/node/v10.16.0/lib/node_modules/@aws-amplify/cli/node_modules/graphql-transformer-core/lib/util/amplifyUtils.js:56:37)
2020-06-23T08:11:07.629Z [ERROR]: !!! Build failed
2020-06-23T08:11:07.629Z [ERROR]: !!! Non-Zero Exit Code detected
2020-06-23T08:11:07.629Z [INFO]: # Starting environment caching...
2020-06-23T08:11:07.630Z [INFO]: # Environment caching completed

Hi @yhuber
It seems that your #current-cloud backend folder is missing amplify-meta.json file from error. Would you be able to send a zip file of your amplify folder to amplify-cli@amazon.com?It seems the amplify folder got messed up while you  applying this fix :https://github.com/aws-amplify/amplify-cli/issues/3576#issuecomment-596732233

Hey @akshbhu  thanks for your answer.
I just sent the zip file via e-mail to<EMAIL_ADDRESS>

Okay the issue ("no such file #current-cloud-backend/amplify-meta.json") was because i zipped the folder instead of the files in the order... That works now.. So I can now initialize my backend again. However, when i push to the Cloud the error "Cannot read property 'Mappings' of undefined" remains... I deleted all copied files in the S3-Bucket as well as in the amplify backend folder in my app.
The only files that appear to be twice are some resolver files which have the exact same name (without any number after it), but have a different data-size....
I sent an e-mail to<EMAIL_ADDRESS>with the new ZIP of #current-cloud-backend.

The only files that appear to be twice are some resolver files which have the exact same name (without any number after it), but have a different data-size....

Nevermind.. the files are called ".req.vtl" and ".res.vtl", my mistake..

Hi @yhuber
I did receive a mail containing a zip file for currentcloudbackend. But the zip file doesn't contain amplify resources folder like api and auth. it only has images of your directory. I need that information to reproduce this issue.
Can you try and send the zip file again which has above said data to<EMAIL_ADDRESS>

Okay i just sent it.


Be more verbose on bots when running 'pub'

Fixes https://github.com/flutter/flutter/issues/9237

The finals are there to catch cases where we accidentally change a variable we didn't meant to change.
The types are there to catch cases where we assign the variable a value that is not the type we meant to give.
The lines, though, they are indeed too long. Will fix...

There's a bigger problem though. The logs are so verbose that Travis killed the job for having too much log output. :-(
Is there an in-between stage where we can have useful output for you but not overload the bots?

Is there an in-between stage where we can have useful output for you but not overload the bots?

Nope. Crap. You might have to buffer the output and only print if there is an error...
Maybe?...

I'm going to close this PR since this approach won't work.


added EventHubFixedPartitionProcessor sample

I am from one of the MSFT CSE devcrews. I don't know if you want EventProcessor samples as part of this repo, but if you do, here is one we just used with a client.

API change check
API changes are not detected in this pull request.

Hi @plasne.  Thank you for your contribution and interest in improving the Azure developer experience.  Unfortunately, we won't be moving forward with this submission.
The Azure SDK for .NET repository prefers to format samples as markdown documents with small focused scopes intended to reduce boilerplate code and help developers locate a snippet for a specific scenario that they can paste into their application.   While we do have a small number of end-to-end samples packaged as projects, these are exception cases where we saw a large amount of developer confusion and feedback that the additional context was necessary.
After looking over your proposed approach, it isn't one that we'd be comfortable endorsing as official guidance.  For the scenario where partitions should never migrate between owners, we would suggest static partition assignment which removes the dependency on Storage and a number of the corner cases of the proposed "fixed partition" approach, making it simpler to reason about.
When compared to the standard load balancing, we don't believe that there are compelling advantages to the "fixed partition" approach.  To compare:
Partitions may change owners
Standard load balancing

When a new processor was added to the group and there are not enough unowned partitions to satisfy its fair share.

When a processor is removed from the group.

When one or more processors are unable to renew ownership of all of their partitions for longer than the ownership expiration interval.  With the default settings, this means that all owned partitions must fail to renew for three consecutive load balancing cycles. If this occurs, the processor is seen as dead and no longer considered part of the group.  If a processor owns any partitions, it is considered part of the group and the others will not adjust their calculated fair share, so partition ownership will remain stable.

Fixed partition approach

When one or more processors in the group have less than the configured maximum count and another processor misses a single lease renewal.

Partitions will go unowned
Standard load balancing

If there is an issue causing all processors in the group to be unable to interact with Storage and some partitions were not owned before the Storage failure.

Fixed partition approach

All processors have their configured maximum owned partitions and one or more processor nodes become unavailable or non-responsive.

All processors have their configured maximum owned partitions and one or more processors is unable to interact with Storage.

Storage is unavailable.

New partitions are added to the Event Hub after the processors are started.

There are more than 32 partitions in the Event Hub (processor cannot start)

Implementation notes
While I didn't do a full code review, there were a couple of things that caught my attention when looking over the implementation that I'd like to share in case it is helpful for future customer engagements or if you decide to submit this to the Azure Samples repository.

It is possible to have more than 32 partitions for an Event Hub; a non-trivial number of enterprise customers do.  The implementation does not currently handle this scenario.

Is is possible for partitions to be added to an Event Hub for most SKUs.  The implementation does not handle this scenario.

Partition identifiers are intentionally strings in the Event Hubs service and may not be in the form of consecutive numbers.  That they currently are is an implementation detail of the service that may change.  The implementation should not assume they can be parsed into an integer nor reason about the relationship between them.

Dispose can be called while the processor is running, which would corrupt its state.

Errors thrown by the OnBatchAsync handler are swallowed and ignored with only a log message written.  Despite the README stating that the error handler is invoked, it is not.  This also suppresses diagnostics, as the scope does not see the failure so OpenTelemetry traces will see the call as successful despite the application code not handling the exception.

Checkpoints are not written if processing throws.  Because OnProcessingEventBatchAsync has a try/catch guard, the processor will just continue moving forward.  This may be desired behavior but needs to be clearly documented as it is very likely to cause confusion.

The way that ownership is handled will cause the processor's load balancing loop to always attempt to manage claims, which provides no value and just eats cycles.  Better to have list ownership, claim ownership, and list partitions return the same exact set so that load balancing believes that it is the only processor in the group and no-ops.

The caller-provided cancellation token passed to StartProcessingAsync is ignored.

The blob leasing loop is started fire-and-forget style.  Exceptions will go unobserved and may crash the process or cause unexpected behavior.  I'd suggest attaching an error handling continuation via ContinueWith or using some other mechanism to detect the scenario and cancel processor start-up.

I'd advise against using multicast events;  having an arbitrary number of handlers assigned makes it easy to cause performance problems and introduce race conditions.  It also makes it harder to reason about exceptions.

I disagree with the choice to rename the event handlers rather than using the standard names.  This makes it harder to for developers to find help by looking at docs and other samples.  I don't see what value OnBatch, OnAssigned, and OnReleased offer over the standard terminology that justifies the cost to developers.


SVG layout when a minimum font size is enforced

I use my browser's minimum font size setting to prevent sites from using unreadable font sizes. Unfortunately it has this effect on shields.io SVG badges:

Is there something which could be done to make SVG badges scale instead of squishing text like this?

Thanks for this issue.
This would be great to fix. Can you give steps to reproduce the problem?

Maybe duplicate of: #746 #797


No repin anymore??

How to repin now?

I will close the issue without any details. No context, no code, just a question 🤷♂

sorry, my bad english. im wondering , how to repinning . im confused..

Sorry, the docs were broken. Here is an example - https://github.com/seregazhuk/php-pinterest-bot/blob/master/docs/pins.md#repin


Feature Request: Show hidden when notification shows up?

Hey friends!
Can we get a feature added, where if you have collapsed server list, and someone DMs you, it uncollapses until you mark as read in whatever way the user sees fit.
Currently, when it's collapsed, and someone DMs you, it's kinda hidden unless you see the red dot on the tray icon or heard the sound, etc.

For right now, I am not going to have it expand the entire server list if there is an unread DM, but in the upcoming release, I am adding the option to have an unread DM badge next to the Discord wordmark in the upper left corner (see attached image)


Resizing terminal only resizes the active terminal instance

VSCode Version: 1.3.1
OS Version: Arch Linux 64-bit (kernel: 4.6.2-1)

Steps to Reproduce:

Switch to another terminal
Resize the terminal
Switch back
The first terminal is still the old size. You have to resize it again to make it update.

Actually this was my fav. feature xD


display of large space

Would it be possible to slip the word "semantic"  before the first occurrence of "space" and then remove everything from the semicolon onward?

Are there many implications for other display issues?

There are three basic variations of the same tooltip, depending on the value of the space/@type attribute:
When @type is empty or = "semantic":

Large space (about ${quantity} ${unit}s wide); semantic space

When @type = "vacat"

Large space (about ${quantity} ${unit}s wide); vacat space; the area was left blank when the rest of the inscription was engraved, possibly with the intent to be filled later on

When @type = "unclassified"

Large space (about ${quantity} ${unit}s wide); unclassified significant space that does not fit other categories

I am not sure how to reformulate cases 2 and 3.

suggestion:

Large semantic space (about ${quantity} ${unit}s wide)
Large vacat space (about ${quantity} ${unit}s wide)
Large unclassified space (about ${quantity} ${unit}s wide)

OK, done


deps: regenerating with new Protobuf (2.12.x)

To merge into 2.12.x branch. This PR was generated using Protobuf 3.19.6. Source-Link: https://github.com/googleapis/googleapis/commit/727f08ba466745c17f71cd2084540878392de31d

"Kokoro - Test: Java 17 GraalVM Native Image" is expected because the container uses the latest GraalVM version and the configuration in 2.12.x branch is old.


Add fix to HGDP + 1KG subset dense MT

nevermind, just double checked, the other PR is not related


convert_lipd_dir_to_ref throws an error

Apparently, the underlying multi_convert_to_rdf(filemap, parallel) has a for loop calling another function which only has one positional argument

Fixed


[WIP] Properly closes Tessel connections after each use (Order: 3)

This is less of an issue for SSH connections, but the USB Daemon needs to be notified when connections are completed so it can remove that entry from its table. It can currently run 256 processes currently but if we aren't consistent about closing them, they can eventually crash the daemon with a fair amount of use.

[x] Close discovered Tessels
[x] Close Tessels used for each command
[x] Write tests to confirm that they are closed

@rwaldron is killing it.