Dairon M. codeadict

How to install and configure gVisor for K3s

This gist is a quick explainer on how to install and configure gVisor on K3s. There is a sort of hidden gotcha if you aren't reading the documentation thoroughly. If you already have a K3s cluster setup skip to the appropriate section below.

Install K3s

Install K3s as described in the documentation.

Install gVisor

Technical Details: It's possible to conduct SSRF attacks because of the way URLs are parsed by URI built in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will see host as 127.2.2.2/ . This can be abused to conduct SSRF attacks where a user is relying on the URL function for host checking. See POC below

import :hackney

defmodule MyApp do

  # Helper function to print the URL components
  def parse_and_print_url() do
    attack_string = "http://127.0.0.1?@127.2.2.2/"

Here's an example of how to do it.

def with_performance_log(options, body, context) do
  quote bind_quoted: [
          context: Macro.escape(context),
          options: Macro.escape(options),
          body: body
        ] do
 module = "#{context.module}"

I recently made a cross-platform GitHub action out of this (using outputs instead of environment variables) Check it out at https://github.com/paulo-ferraz-oliveira/parse-tool-versions/.

The script

In e.g. .github/parse-tool-versions.sh, do:

#!/bin/bash

	Mix.install(
	[
	{:phoenix_playground, "~> 0.1.6"},
	{:phoenix, "~> 1.7.14"},
	{:phoenix_live_view, "~> 1.0.0-rc.1"},
	{:chroma, "~> 0.1.3"},
	{:text_chunker, "~> 0.3.1"},
	{:nx, "~> 0.9.0"},
	{:exla, "~> 0.9.1"},
	{:axon, "~> 0.7.0"},

	# -----------------------------------------------------------------------------
	# AI-powered Git Commit Function
	# Copy paste this gist into your ~/.bashrc or ~/.zshrc to gain the `gcm` command. It:
	# 1) gets the current staged changed diff
	# 2) sends them to an LLM to write the git commit message
	# 3) allows you to easily accept, edit, regenerate, cancel
	# But - just read and edit the code however you like
	# the `llm` CLI util is awesome, can get it here: https://llm.datasette.io/en/stable/

	gcm() {

	#!/bin/bash
	# Updates either the Elixir or erlang version everywhere in the project

	set -e

	if [ "$#" -ne 2 ]; then
	echo "Usage: $0 old_version new_version. Example: $0 1.15.7 1.16.1"
	exit 1
	fi

	defmodule MyApp.Http do
	@moduledoc """
	Exposes functions to make HTTP requests and optionally cache the response.

	If you want to cache the request, simply add `cache: true` to the
	request options. You can also define an option time-to-live (TTL) with
	`cache_ttl: ttl_in_milliseconds`. The default TTL is 5min.

	Only caches 2xx responses.
	"""

	import os

	from datadog_api_client import Configuration, ApiClient
	from datadog_api_client.exceptions import ApiAttributeError
	from datadog_api_client.exceptions import ApiTypeError, ApiValueError
	from datadog_api_client.v1.api.dashboards_api import DashboardsApi
	from datadog_api_client.v1.api.monitors_api import MonitorsApi
	from datadog_api_client.v1.model.formula_and_function_metric_data_source import FormulaAndFunctionMetricDataSource
	from datadog_api_client.v2.api.metrics_api import MetricsApi