LXC ist ein Linux Container mit eigener Linux Laufzeitumgebung aber basiert auf dem Kernel des Hosts.
Docker ist ein Application Container. Container in Container ist immer etwas kniffelig.
Daher VM ist eine VM mit eigenem Kernel und da läuft...
Richtig, es wird eine dedizierte NIC empfohlen.
Empfehlen würde ich eine Single NIC auf einem Dedizierten Switch oder bei 2 Node Clustern direkt gesteckt zu nutzen.
Wenn dein Switch ausfällt, bringt die extra NIC sonst gar nichts.
Die Quorum VM...
I still don't see where it comes from this vuln is Zapscape. POC for Zapscape was published 2 month ago, what embargo are you talking about? And there was Januscape even before, so it seems quite possible some new vulnerability was discovered...
Hi keeka,
Could you confirm with uname -r on the host that it runs 7.0.14-20-pve?
I could reproduce this in a lab with a setup like yours: a privileged Debian 12 CT exporting two ZFS datasets, and a Debian 13 client mounting with vers=4. With...
Yeah, after doing a bit of Googling as mentioned above, I also think this could potentially be a new vulnerability. In that case, the question now would be whether the claim actually holds true, i.e. whether this new vulnerability actually...
@lubosr Thanks.
I'm currently running kernel 7.0.14-20-pve. I will stick with NFS4.1 and I also disabled NFS4.2 on the lxc based server for the time being.
Re your bug report. I wondered if this issue only surfaces with that kernel and LXC or...
I still don't see where it comes from this vuln is Zapscape. POC for Zapscape was published 2 month ago, what embargo are you talking about? And there was Januscape even before, so it seems quite possible some new vulnerability was discovered...
Vielleicht sollte (und dürfte) ich einen neuen Thread dazu anlegen, mittlerweile bin ich ja deutlich weg von "FC-SAN" ...
Ich hab das NAS am Start, und installiere heute die kleine VM für mein Quorum. Dazu natürlich gleich wieder Fragen:
Soweit...
Hi keeka,
Could you confirm with uname -r on the host that it runs 7.0.14-20-pve?
I could reproduce this in a lab with a setup like yours: a privileged Debian 12 CT exporting two ZFS datasets, and a Debian 13 client mounting with vers=4. With...
Hmm, yeah, if I search for "KVM escape vulnerability" into Google's News tab and then look at other recent articles on the topic, like this one, for example: https://tech-insider.org/vercel-kvm-zero-day-vm-escape-sandbox-2026/, this might indeed...
it's not that bad for the kernel there are no 800 CVE daily against the linux kernel, just 800 released every day across the board.
And no i am not 100% sure, embargo date happened to be yesterday. I modified the title for this insecurity.
Ich habe versucht Docker auf Proxmox VE zu installieren. Es scheint, dass die Anleitung nicht so toll war, denn es klappt nicht. Ich habe einen LXC Container erstellt. Darin sollte Docker laufen. Beim Webzugriff auf die IP wird der Portainer im...
it's not that bad for the kernel there are no 800 CVE daily against the linux kernel, just 800 released every day across the board.
And no i am not 100% sure, embargo date happened to be yesterday. I modified the title for this insecurity.
Yeah, that's because the kernel project assigns a CVE to practically every bug they find, since bugs in the kernel almost always are security-related in some way, simply because they're in the kernel.
Okay, just to be extra sure, this article...
Hello,
Thanks for all the replies. I Finally figured out what the error was.
As advised here, I tried running /usr/sbin/upsd -F -DDDDD in foreground with the debug options and found that the problem was related to the interface binding. The...