Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Received-SPF: neutral (athena.apache.org: 74.125.82.41 is neither permitted
 nor denied by domain of lbarfield@tqhosting.com)
MIME-Version: 1.0
In-Reply-To: 
 <D43103802360B147A3BAB085E3D078C1111BA0A7@AMSPEX01CL01.citrite.net>
References: <93016359-BDA3-4B25-9383-FF8213E3AF82@gmail.com>
	<CAEJ3w4X8OK=aeLawugtx5yrxPw9cdZgpS6u1kmgw_rhoE0SYFg@mail.gmail.com>
	<43A11A1933FEF445A080F7D886872646164737EF@SJCPEX01CL02.citrite.net>
	<CA+2rt40gt7uNBAmmQDE4Td0GOSWqgAVEcAAXa3iH0LhE+EN2qg@mail.gmail.com>
	<43A11A1933FEF445A080F7D8868726461647518E@SJCPEX01CL02.citrite.net>
	<43A11A1933FEF445A080F7D88687264616476BCB@SJCPEX01CL02.citrite.net>
	<43A11A1933FEF445A080F7D88687264616476C2C@SJCPEX01CL02.citrite.net>
	<CB688D716959224C95995F52DE5E82424A98E695@SINPEX01CL02.citrite.net>
	<8751caa5d8d698c4067c7a18df49250d@mail.gmail.com>
	<D43103802360B147A3BAB085E3D078C1111BA0A7@AMSPEX01CL01.citrite.net>
Date: Fri, 3 Oct 2014 11:30:19 -0400
Message-ID: 
 <CACKLxkB35pHR_fH71LDUCwVUoD6fTZB4UJNf+ZMBZR=xz0LNfg@mail.gmail.com>
Subject: Re: Shellshock
From: Logan Barfield <lbarfield@tqhosting.com>
To: dev@cloudstack.apache.org
Content-Type: multipart/alternative; boundary=f46d043747ad2858e50504866987

--f46d043747ad2858e50504866987
Content-Type: text/plain; charset=UTF-8

>From a service provider perspective I would agree that this issue needs to
be addressed as soon as possible.  In the short term it would make sense
for CloudStack to release a patched SystemVM template and upgrade
instructions.  In the long term I think the better option would be to allow
the templates to be patched more easily (i.e. make changes and save the
template).


Thank You,

Logan Barfield
Tranquil Hosting

On Fri, Oct 3, 2014 at 10:03 AM, Alex Brett <Alex.Brett@citrix.com> wrote:

> On 03 October 2014 13:52, Adrian Lewis [adrian@alsiconsulting.co.uk]
> wrote:
> > The only solution I can think of is to 'apt-get update bash' on every
> > system VM but clearly these get fired up dynamically. Is it possible to
> > boot the template, make modifications and then use as a replacement
> system
> > VM? Are there processes that happen on boot that only happen once and
> > therefore need resetting to recreate the template?
>
> This isn't a quick fix, so not suitable for this specific issue, but
> something I've wondered for a while is rather than keep having to build new
> system VM templates for every small change, would we be better integrating
> a tool such as Puppet / Chef, so we can bring a system VM 'up to date' when
> it boots, as long as it's the right 'base'.
>
> What I'm thinking here (using Puppet terminology as that's what I'm
> familiar with, but could be any similar mechanism or even just a simple
> script) is when the system VM loads up, it connects to the management
> server and retrieves a manifest, which it then applies. That manifest would
> specify:
>  - Packages to update (including if necessary any apt/yum repo information)
>  - Config files to put in place
>  - Anything else required like starting any services etc
>
> While it would slightly delay the boot process, it would ensure that on
> e.g. upgrade, you don't have to immediately replace your system VM template
> unless a substantial change (e.g. base system VM distro / partition layout)
> has been made. You could still bring in an updated template to speed things
> up, but it would be far less urgent to do so...
>
> Any thoughts on this anybody?
>
> Alex
>

--f46d043747ad2858e50504866987--