Premium Only Content

DebConf24 - Leveraging Deterministic Updates to Improve the Customer Experience on Debian
Speakers: Maulik Shah & Noah Meyerhans & Koshy John
Track: Security
Type: Long talk (45 minutes)
Room: Bada
Time: Jul 29 (Mon): 14:30
Duration: 0:45
Every change to a production system carries risk, and this risk is magnified when applications are distributed across hundreds or thousands of hosts. Security updates to Debian are published on an as-needed basis with no ability to predict in advance what package will change at any given moment, which means that an update from the repositories is nondeterministic over time. The apt update/apt upgrade operation performed today may behave differently from the one performed yesterday.
In this talk we present a deterministic update strategy based on snapshot support introduced with apt 2.7.0. Using apt snapshots, administrators can lock their systems to a specific point-in-time view of the Debian package repositories backed by snapshot.debian.org. This approach provides repeatable and deterministic update behavior with a number of safety benefits that the administrator can incorporate into their infrastructure testing and deployment strategy in a variety of ways:
Pre-production testing that reflects what’s subsequently going to be deployed to production
The ability to execute phased updates following a ring-based deployment pattern
Building on this foundation, Microsoft has added support for Debian within Microsoft Azure Guest Patching Service. We describe this service and how it can be used to safely and reliably manage fleets of any size within the Microsoft Azure cloud computing environment; while providing the capabilities listed above.
Azure’s Safe Deployment Principles monitor the rollout of an update on VMs. Azure pauses a rollout and pushes a new update if a regression is detected on a VM. The same safety mechanism will be in place with Debian Snapshots.
By pinning an update for a customer’s fleet across regions, Azure is simplifying the way customers keep their assets secure through Debian Snapshots.
etherpad
https://pad.dc24.debconf.org/p/131-leveraging-deterministic-updates-to-improve-t
-
LIVE
Lofi Girl
2 years agoSynthwave Radio 🌌 - beats to chill/game to
2,040 watching -
FreshandFit
6 hours agoAfter Hours w/ Girls
219K87 -
2:33:36
Badlands Media
7 hours agoOnlyLands Ep. 21: From Trump’s VP Pick to Green Energy Grift
57.7K6 -
1:07:26
Inverted World Live
10 hours agoThe War Against Robots w/ Joe Allen
90.9K4 -
6:08:31
SpartakusLIVE
10 hours agoWARZONE NUKE IS BACK?! || Solo Challenge CHAMPION to start, duos w/ the Dawg later
92.1K -
1:00:18
Man in America
12 hours agoBig Pharma’s Empire of Lies Is COLLAPSING as People Turn to Natural Medicine
56K20 -
LIVE
Drew Hernandez
14 hours agoGHISLAINE MAXWELL SAYS CLAIMS EPSTEIN WAS INTELLIGENCE ASSET ARE BULLSH*T?!
804 watching -
29:54
Afshin Rattansi's Going Underground
21 hours agoUkraine: Prof. Anatol Lieven SLAMS Europe’s ‘BLOODY STUPIDITY’ as Trump Negotiates with Putin
31K6 -
15:27
robbijan
1 day ago $2.45 earnedThe Emperor’s New Labubu & The Spiritual War Behind Everything
52.4K43 -
LIVE
GritsGG
19 hours ago36 Hour Stream! Most Wins 3420+ ðŸ§
864 watching