Hāʻawi ʻo RHEL 8 Beta i nā mea hoʻomohala i nā hiʻohiʻona hou, hiki i ka papa inoa ke lawe i nā ʻaoʻao, akā naʻe, ʻoi aku ka maikaʻi o ke aʻo ʻana i nā mea hou i ka hoʻomaʻamaʻa, no laila ke hāʻawi nei mākou i kahi papa hana no ka hana maoli ʻana i kahi ʻōnaehana noi e pili ana i ka Red Hat Enterprise Linux 8 Beta.
E lawe kākou iā Python, he ʻōlelo hoʻolālā kaulana i waena o nā mea hoʻomohala, ma ke ʻano he kumu, kahi hui o Django a me PostgreSQL, kahi hui maʻamau no ka hana ʻana i nā noi, a hoʻonohonoho iā RHEL 8 Beta e hana pū me lākou. A laila e hoʻohui mākou i ʻelua mau meaʻai (unclassified).
E hoʻololi ke kaiapuni hoʻāʻo, no ka mea he mea hoihoi ia e ʻimi i nā hiki o ka automation, e hana pū me nā ipu a me nā wahi hoʻāʻo me nā kikowaena lehulehu. No ka hoʻomaka ʻana me kahi papahana hou, hiki iā ʻoe ke hoʻomaka ma ka hana ʻana i kahi prototype liʻiliʻi a maʻalahi ma ka lima i hiki iā ʻoe ke ʻike pono i nā mea e pono ai a pehea e launa pū ai, a laila neʻe i ka automate a hana i nā hoʻonohonoho paʻakikī. I kēia lā ke kamaʻilio nei mākou e pili ana i ka hana ʻana o ia prototype.
E hoʻomaka kākou ma ka lawe ʻana i ke kiʻi RHEL 8 Beta VM. Hiki iā ʻoe ke hoʻouka i kahi mīkini virtual mai ka wā ʻōpala, a i ʻole e hoʻohana i ke kiʻi malihini KVM i loaʻa me kāu kau inoa Beta. Ke hoʻohana nei i kahi kiʻi malihini, pono ʻoe e hoʻonohonoho i kahi CD virtual e loaʻa i nā metadata a me nā ʻikepili mea hoʻohana no ka hoʻomaka ʻana o ke ao (cloud-init). ʻAʻole pono ʻoe e hana i kekahi mea kūikawā me ka hoʻolālā disk a i ʻole nā pūʻolo i loaʻa; e hana kekahi hoʻonohonoho.
E nānā pono kākou i ka hana holoʻokoʻa.
Ke hoʻouka nei iā Django
Me ka mana hou o Django, pono ʻoe i kahi kaiapuni virtual (virtualenv) me Python 3.5 a i ʻole ma hope. Ma nā moʻolelo Beta hiki iā ʻoe ke ʻike aia ʻo Python 3.6, e nānā inā ʻo ia ka hihia:
[cloud-user@8beta1 ~]$ python
-bash: python: command not found
[cloud-user@8beta1 ~]$ python3
-bash: python3: command not found
Hoʻohana ikaika ʻo Red Hat iā Python ma ke ʻano he ʻōnaehana ʻōnaehana ma RHEL, no laila no ke aha kēia hopena?
ʻO ka mea ʻoiaʻiʻo he nui nā mea hoʻomohala Python e noʻonoʻo nei i ka hoʻololi ʻana mai Python 2 a i Python 2, ʻoiai ʻo Python 3 ponoʻī ma lalo o ka hoʻomohala ikaika, a ʻoi aku ka nui o nā mana hou e ʻike mau ʻia. No laila, no ka hoʻokō ʻana i ka pono o nā ʻōnaehana paʻa i ka wā e hāʻawi ana i nā mea hoʻohana i nā ʻano hou o Python, ua hoʻoneʻe ʻia ʻo Python system i kahi pūʻulu hou a hāʻawi i ka hiki ke hoʻokomo iā Python 2.7 a me 3.6. Hiki ke loaʻa ka ʻike hou aku e pili ana i nā loli a me ke kumu i hana ʻia ai ma ka paʻi ʻana ma (Langdon White).
No laila, e kiʻi i ka Python hana, pono ʻoe e hoʻokomo i ʻelua pūʻulu, me ka python3-pip i hoʻokomo ʻia ma ke ʻano he hilinaʻi.
sudo yum install python36 python3-virtualenv
No ke aha e hoʻohana ʻole ai i nā kelepona module pololei e like me ka manaʻo a Langdon a hoʻokomo i ka pip3? Ke hoʻomanaʻo nei i ka automation e hiki mai ana, ua ʻike ʻia e koi ʻo Ansible i ka pip i hoʻokomo ʻia e holo, no ka mea ʻaʻole kākoʻo ka module pip i nā virtualenvs me kahi pip maʻamau.
Me kahi unuhi unuhi python3 ma kou makemake, hiki iā ʻoe ke hoʻomau i ke kaʻina hana hoʻonohonoho Django a loaʻa kahi ʻōnaehana hana me kā mākou mau mea ʻē aʻe. Nui nā koho hoʻokō i loaʻa ma ka Pūnaewele. Aia kekahi mana i hōʻike ʻia ma aneʻi, akā hiki i nā mea hoʻohana ke hoʻohana i kā lākou hana ponoʻī.
E hoʻokomo mākou i nā mana PostgreSQL a me Nginx i loaʻa ma RHEL 8 ma ka hoʻohana ʻana iā Yum.
sudo yum install nginx postgresql-server
Pono ʻo PostgreSQL i ka psycopg2, akā pono e loaʻa i loko o kahi kaiapuni virtualenv, no laila e hoʻokomo mākou iā ia me ka pip3 me Django a me Gunicorn. Akā pono mākou e hoʻonohonoho i ka virtualenv.
Nui nā hoʻopaʻapaʻa ma ke kumuhana o ke koho ʻana i kahi kūpono e hoʻokomo ai i nā papahana Django, akā inā kānalua, hiki iā ʻoe ke huli mau i ka Linux Filesystem Hierarchy Standard. ʻO ke kikoʻī, ʻōlelo ka FHS ua hoʻohana ʻia /srv e: "kūʻai i nā ʻikepili kikoʻī hoʻokipa - nā ʻikepili i hana ʻia e ka ʻōnaehana, e like me ka ʻikepili pūnaewele a me nā palapala, nā ʻikepili i mālama ʻia ma nā kikowaena FTP, a me nā ʻōnaehana hoʻonohonoho mālama." -2.3 i ka makahiki 2004).
ʻO kēia kā mākou hihia, no laila hoʻokomo mākou i nā mea āpau a mākou e pono ai i / srv, nona ka mea hoʻohana i kā mākou mea hoʻohana (cloud-user).
sudo mkdir /srv/djangoapp
sudo chown cloud-user:cloud-user /srv/djangoapp
cd /srv/djangoapp
virtualenv django
source django/bin/activate
pip3 install django gunicorn psycopg2
./django-admin startproject djangoapp /srv/djangoapp
He maʻalahi ka hoʻonohonoho ʻana iā PostgreSQL a me Django: hana i kahi waihona, hana i mea hoʻohana, hoʻonohonoho i nā ʻae. Hoʻokahi mea e hoʻomanaʻo ai i ka hoʻokomo mua ʻana iā PostgreSQL ʻo ia ka postgresql-setup script i hoʻokomo ʻia me ka postgresql-server package. Kōkua kēia palapala iā ʻoe e hana i nā hana maʻamau e pili ana i ka hoʻokele pūʻulu waihona waihona, e like me ka hoʻomaka ʻana o ka cluster a i ʻole ke kaʻina hana hoʻonui. No ka hoʻonohonoho ʻana i kahi hiʻohiʻona PostgreSQL hou ma kahi ʻōnaehana RHEL, pono mākou e holo i ke kauoha:
sudo /usr/bin/postgresql-setup -initdb
Hiki iā ʻoe ke hoʻomaka i ka PostgreSQL me ka hoʻohana ʻana i systemd, hana i kahi waihona, a hoʻonohonoho i kahi papahana ma Django. E hoʻomanaʻo e hoʻomaka hou i ka PostgreSQL ma hope o ka hoʻololi ʻana i ka faila hoʻonohonoho hōʻoia o ka mea kūʻai aku (maʻamau pg_hba.conf) e hoʻonohonoho i ka waiho ʻōlelo huna no ka mea hoʻohana. Inā loaʻa iā ʻoe nā pilikia ʻē aʻe, e hōʻoia e hoʻololi i ka hoʻonohonoho IPv4 a me IPv6 ma ka faila pg_hba.conf.
systemctl enable -now postgresql
sudo -u postgres psql
postgres=# create database djangoapp;
postgres=# create user djangouser with password 'qwer4321';
postgres=# alter role djangouser set client_encoding to 'utf8';
postgres=# alter role djangouser set default_transaction_isolation to 'read committed';
postgres=# alter role djangouser set timezone to 'utc';
postgres=# grant all on DATABASE djangoapp to djangouser;
postgres=# q
Ma ka waihona /var/lib/pgsql/data/pg_hba.conf:
# IPv4 local connections:
host all all 0.0.0.0/0 md5
# IPv6 local connections:
host all all ::1/128 md5
Ma ka faila /srv/djangoapp/settings.py:
# Database
DATABASES = {
'default': {
'ENGINE': 'django.db.backends.postgresql_psycopg2',
'NAME': '{{ db_name }}',
'USER': '{{ db_user }}',
'PASSWORD': '{{ db_password }}',
'HOST': '{{ db_host }}',
}
}
Ma hope o ka hoʻonohonoho ʻana i ka faila settings.py i ka papahana a me ka hoʻonohonoho ʻana i ka hoʻonohonoho ʻikepili, hiki iā ʻoe ke hoʻomaka i ka kikowaena hoʻomohala e hōʻoia i ka hana ʻana o nā mea āpau. Ma hope o ka hoʻomaka ʻana i ke kikowaena hoʻomohala, he mea maikaʻi e hana i kahi mea hoʻohana admin i mea e hoʻāʻo ai i ka pilina i ka waihona.
./manage.py runserver 0.0.0.0:8000
./manage.py createsuperuser
WSGI? Wai?
Pono ke kikowaena hoʻomohala no ka hoʻāʻo ʻana, akā no ka holo ʻana i ka noi pono ʻoe e hoʻonohonoho i ke kikowaena kūpono a me ka mea koho no ka Web Server Gateway Interface (WSGI). Nui nā hui like ʻole, no ka laʻana, Apache HTTPD me uWSGI a i ʻole Nginx me Gunicorn.
ʻO ka hana o ka Web Server Gateway Interface ʻo ia ka hoʻouna ʻana i nā noi mai ka pūnaewele pūnaewele i ka ʻōnaehana pūnaewele Python. ʻO WSGI kahi relic o ka wā i hala i ka wā e puni ana nā ʻenekini CGI, a i kēia lā ʻo WSGI ka maʻamau de facto, me ka nānā ʻole i ka pūnaewele pūnaewele a i ʻole ka Python framework i hoʻohana ʻia. Akā ʻoiai ka hoʻohana ākea ʻana, nui nā nuances i ka wā e hana ai me kēia mau frameworks, a me nā koho he nui. I kēia hihia, e ho'āʻo mākou e hoʻokumu i ka pilina ma waena o Gunicorn a me Nginx ma o kahi kumu.
No ka mea ua hoʻokomo ʻia kēia mau ʻāpana ʻelua ma ka kikowaena hoʻokahi, e hoʻāʻo kākou e hoʻohana i kahi kumu UNIX ma kahi o kahi kumu pūnaewele. No ka mea e pono ai ke kamaʻilio ʻana i kahi kumu i kēlā me kēia hihia, e hoʻāʻo mākou e hana i kahi ʻanuʻu hou a hoʻonohonoho i ka hoʻāla ʻana no Gunicorn ma o systemd.
ʻO ke kaʻina hana o ka hana ʻana i nā lawelawe socket activated he maʻalahi loa. ʻO ka mea mua, hana ʻia kahi faila ʻāpana i loaʻa kahi kuhikuhi ListenStream e kuhikuhi ana i kahi e hana ʻia ai ke kumu UNIX, a laila kahi faila ʻāpana no ka lawelawe kahi e kuhikuhi ai ke kuhikuhi koi i ka faila ʻāpana kumu. A laila, i loko o ka waihona ʻāpana lawelawe, ʻo nā mea a pau i koe e kāhea iā Gunicorn mai ka honua virtual a hana i kahi WSGI paʻa no ka UNIX socket a me ka noi Django.
Eia kekahi mau laʻana o nā faila unite hiki iā ʻoe ke hoʻohana i kumu. Hoʻonohonoho mua mākou i ke kumu.
[Unit]
Description=Gunicorn WSGI socket
[Socket]
ListenStream=/run/gunicorn.sock
[Install]
WantedBy=sockets.target
I kēia manawa pono ʻoe e hoʻonohonoho i ka daemon Gunicorn.
[Unit]
Description=Gunicorn daemon
Requires=gunicorn.socket
After=network.target
[Service]
User=cloud-user
Group=cloud-user
WorkingDirectory=/srv/djangoapp
ExecStart=/srv/djangoapp/django/bin/gunicorn
—access-logfile -
—workers 3
—bind unix:gunicorn.sock djangoapp.wsgi
[Install]
WantedBy=multi-user.target
No Nginx, he mea maʻalahi ia o ka hoʻokumu ʻana i nā faila hoʻonohonoho proxy a me ka hoʻonohonoho ʻana i kahi papa kuhikuhi e mālama i ka ʻike static inā ʻoe e hoʻohana ana i kekahi. Ma RHEL, aia nā faila hoʻonohonoho Nginx ma /etc/nginx/conf.d. Hiki iā ʻoe ke kope i kēia hiʻohiʻona i loko o ka faila /etc/nginx/conf.d/default.conf a hoʻomaka i ka lawelawe. E hōʻoia e hoʻonoho i ka server_name e hoʻokūkū i kou inoa hoʻokipa.
server {
listen 80;
server_name 8beta1.example.com;
location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
root /srv/djangoapp;
}
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://unix:/run/gunicorn.sock;
}
}
E hoʻomaka i ke kumu Gunicorn a me Nginx me ka hoʻohana ʻana i ka systemd a ua mākaukau ʻoe e hoʻomaka i ka hoʻāʻo.
hewa Gateway hewa?
Inā ʻoe e hoʻokomo i ka helu wahi i kāu polokalamu kele pūnaewele, e loaʻa paha iā ʻoe kahi hewa 502 Bad Gateway. Ma muli paha o ka ʻae ʻana o UNIX i hoʻonohonoho pono ʻia, a i ʻole ma muli o nā pilikia paʻakikī e pili ana i ka mana komo ma SELinux.
Ma ka log error nginx hiki iā ʻoe ke ʻike i kahi laina e like me kēia:
2018/12/18 15:38:03 [crit] 12734#0: *3 connect() to unix:/run/gunicorn.sock failed (13: Permission denied) while connecting to upstream, client: 192.168.122.1, server: 8beta1.example.com, request: "GET / HTTP/1.1", upstream: "http://unix:/run/gunicorn.sock:/", host: "8beta1.example.com"
Inā mākou e hoʻāʻo pololei iā Gunicorn, e loaʻa iā mākou kahi pane ʻole.
curl —unix-socket /run/gunicorn.sock 8beta1.example.com
E noʻonoʻo kākou i ke kumu o kēia. Inā wehe ʻoe i ka log, e ʻike paha ʻoe e pili ana ka pilikia me SELinux. No ka mea ke holo nei mākou i kahi daemon no ka mea ʻaʻohe kulekele i hana ʻia, ua kaha ʻia ʻo ia he init_t. E ho'āʻo kākou i kēia manaʻo ma ka hoʻomaʻamaʻa.
sudo setenforce 0
Hiki i kēia mau mea ke kumu i ka hoʻohewa a me ka waimaka o ke koko, akā ke hoʻopau wale nei kēia i ka prototype. E hoʻopau kākou i ka hōʻoia no ka hōʻoia ʻana ʻo ia ka pilikia, a laila e hoʻihoʻi mākou i nā mea a pau i kona wahi.
Ma ka hōʻoluʻolu ʻana i ka ʻaoʻao i ka polokalamu kele pūnaewele a i ʻole ka hoʻihoʻi ʻana i kā mākou kauoha curl, hiki iā ʻoe ke ʻike i ka ʻaoʻao hōʻike Django.
No laila, i ka hōʻoia ʻana i ka holo ʻana o nā mea āpau a ʻaʻohe pilikia ʻae hou, hiki iā mākou ke hana hou iā SELinux.
sudo setenforce 1
ʻAʻole wau e kamaʻilio e pili ana i ka audit2allow a i ʻole ka hoʻokumu ʻana i nā kulekele e pili ana i ka makaʻala me ka sepolgen ma aneʻi, no ka mea, ʻaʻohe palapala Django maoli i kēia manawa, no laila ʻaʻohe palapala ʻāina piha o ka mea a Gunicorn e makemake ai e komo a me ka mea e hōʻole ai i ke komo ʻana. No laila, pono e hoʻomau i ka holo ʻana o SELinux no ka pale ʻana i ka ʻōnaehana, ʻoiai i ka manawa like e ʻae i ka noi e holo a waiho i nā leka i loko o ka loiloi loiloi i hiki ke hana ʻia ke kulekele maoli mai iā lākou.
Ke wehewehe nei i nā kāʻei kapu ʻae
ʻAʻole i lohe nā kānaka a pau i nā kāʻei kua ʻae ʻia ma SELinux, akā ʻaʻole ia he mea hou. Nui ka poʻe i hana pū me lākou me ka ʻike ʻole. Ke hana ʻia kahi kulekele ma muli o nā memo loiloi, ʻo ke kulekele i hana ʻia e hōʻike ana i ka domain i hoʻoholo ʻia. E hoʻāʻo kākou e hana i kahi kulekele ʻae maʻalahi.
No ka hana ʻana i kahi kikowaena i ʻae ʻia no Gunicorn, pono ʻoe i kekahi ʻano kulekele, a pono ʻoe e kaha i nā faila kūpono. Eia kekahi, pono nā mea hana e hōʻuluʻulu i nā kulekele hou.
sudo yum install selinux-policy-devel
He mea paahana maikaʻi loa ka ʻōnaehana domain i ʻae ʻia no ka ʻike ʻana i nā pilikia, ʻoi aku hoʻi i ka wā e pili ana i kahi noi maʻamau a i ʻole nā noi i hoʻouna ʻia me ka ʻole o nā kulekele i hana ʻia. I kēia hihia, e maʻalahi ke kulekele domain i ʻae ʻia no Gunicorn - e haʻi i kahi ʻano nui (gunicorn_t), e haʻi i kahi ʻano e hoʻohana ai mākou e hōʻailona i nā mea hoʻokō he nui (gunicorn_exec_t), a laila hoʻonohonoho i kahi hoʻololi no ka ʻōnaehana e hōʻailona pololei. kaʻina holo . Hoʻonohonoho ka laina hope i ke kulekele e like me ka mea i hoʻohana ʻia e ka paʻamau i ka manawa i hoʻouka ʻia.
gunicorn.te:
policy_module(gunicorn, 1.0)
type gunicorn_t;
type gunicorn_exec_t;
init_daemon_domain(gunicorn_t, gunicorn_exec_t)
permissive gunicorn_t;
Hiki iā ʻoe ke hōʻuluʻulu i kēia faila kulekele a hoʻohui iā ia i kāu ʻōnaehana.
make -f /usr/share/selinux/devel/Makefile
sudo semodule -i gunicorn.pp
sudo semanage permissive -a gunicorn_t
sudo semodule -l | grep permissive
E nānā e ʻike inā ke kāohi nei ʻo SELinux i kahi mea ʻē aʻe ma mua o kā mākou daemon ʻike ʻole e komo ai.
sudo ausearch -m AVC
type=AVC msg=audit(1545315977.237:1273): avc: denied { write } for pid=19400 comm="nginx" name="gunicorn.sock" dev="tmpfs" ino=52977 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0
Kāohi ʻo SELinux iā Nginx mai ke kākau ʻana i ka ʻikepili i ke kumu UNIX i hoʻohana ʻia e Gunicorn. ʻO ka maʻamau, ma ia mau hihia, hoʻomaka nā kulekele e hoʻololi, akā aia nā pilikia ʻē aʻe ma mua. Hiki iā ʻoe ke hoʻololi i nā hoʻonohonoho kāʻei kapu mai kahi kāʻei kapu i kahi kahua ʻae. I kēia manawa, e hoʻoneʻe iā httpd_t i ka waihona ʻae. Hāʻawi kēia iā Nginx i ke komo pono a hiki iā mākou ke hoʻomau i ka hana debugging hou.
sudo semanage permissive -a httpd_t
No laila, inā hiki iā ʻoe ke mālama iā SELinux i pale ʻia (ʻaʻole pono ʻoe e haʻalele i kahi papahana SELinux ma ke ʻano i kaupalena ʻia) a ua hoʻouka ʻia nā kikowaena ʻae, pono ʻoe e noʻonoʻo i ka mea e pono ai ke kahakaha ʻia ʻo gunicorn_exec_t e hana pono nā mea āpau. hou. E ho'āʻo kākou e kipa i ka pūnaewele puni honua e ʻike i nā memo hou e pili ana i nā kaohi ʻana.
sudo ausearch -m AVC -c gunicorn
E ʻike ʻoe i ka nui o nā memo i loaʻa 'comm="gunicorn"' e hana ana i nā mea like ʻole ma nā faila ma /srv/djangoapp, no laila ʻo ia kekahi o nā kauoha e pono ai ka hae.
Eia kekahi, ʻike ʻia kahi memo e like me kēia:
type=AVC msg=audit(1545320700.070:1542): avc: denied { execute } for pid=20704 comm="(gunicorn)" name="python3.6" dev="vda3" ino=8515706 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0
Inā ʻoe e nānā i ke kūlana o ka lawelawe gunicorn a i ʻole holo i ke kauoha ps, ʻaʻole ʻoe e ʻike i nā kaʻina holo. Me he mea lā ke hoʻāʻo nei ʻo gunicorn e komo i ka unuhi ʻōlelo Python i kā mākou wahi virtualenv, hiki paha ke holo i nā palapala hana. No laila e kaha kākou i kēia mau faila ʻelua a nānā inā hiki iā mākou ke wehe i kā mākou ʻaoʻao hōʻike Django.
chcon -t gunicorn_exec_t /srv/djangoapp/django/bin/gunicorn /srv/djangoapp/django/bin/python3.6
Pono e hoʻomaka hou ka lawelawe gunicorn ma mua o ke koho ʻana i ka inoa hou. Hiki iā ʻoe ke hoʻomaka hou iā ia a i ʻole e hoʻōki i ka lawelawe a hoʻomaka ke kumu i ka wā e wehe ai ʻoe i ka pūnaewele ma ka polokalamu kele pūnaewele. E hōʻoia i ka loaʻa ʻana o nā lepili pololei me ka hoʻohana ʻana i ka ps.
ps -efZ | grep gunicorn
Mai poina e hana i kahi kulekele SELinux maʻamau ma hope!
Inā ʻoe e nānā i nā memo AVC i kēia manawa, aia ka memo hope i ka ʻae = 1 no nā mea a pau e pili ana i ka noi, a ʻae = 0 no ke koena o ka ʻōnaehana. Inā maopopo iā ʻoe ke ʻano o ke komo ʻana i kahi noi maoli, hiki iā ʻoe ke ʻimi koke i ke ala maikaʻi loa e hoʻoponopono ai i ia mau pilikia. Akā a hiki i kēlā manawa, ʻoi aku ka maikaʻi o ka mālama ʻana i ka ʻōnaehana a loaʻa i kahi loiloi a hoʻohana pono ʻia o ka papahana Django.
sudo ausearch -m AVC
Ua hiki mai!
Ua hōʻike ʻia kahi papahana Django hana me kahi frontend e pili ana i Nginx a me Gunicorn WSGI. Ua hoʻonohonoho mākou i ka Python 3 a me PostgreSQL 10 mai ka RHEL 8 Beta repositories. I kēia manawa hiki iā ʻoe ke neʻe i mua a hana (a i ʻole e hoʻopili wale) i nā noi Django a i ʻole e ʻimi i nā mea hana ʻē aʻe i loaʻa ma RHEL 8 Beta e hoʻomaʻamaʻa i ke kaʻina hana hoʻonohonoho, hoʻomaikaʻi i ka hana, a i ʻole containerize i kēia hoʻonohonoho.
Source: www.habr.com