Route¶
A route is both a specification of how to match a request as well as in indication of what to do next (e.g., redirect, forward, rewrite, etc.).
Attention
Envoy supports routing on HTTP method via header matching.
{
"prefix": "...",
"path": "...",
"regex": "...",
"cluster": "...",
"cluster_header": "...",
"weighted_clusters" : "{...}",
"host_redirect": "...",
"path_redirect": "...",
"prefix_rewrite": "...",
"host_rewrite": "...",
"auto_host_rewrite": "...",
"case_sensitive": "...",
"use_websocket": "...",
"timeout_ms": "...",
"runtime": "{...}",
"retry_policy": "{...}",
"shadow": "{...}",
"priority": "...",
"headers": [],
"rate_limits": [],
"include_vh_rate_limits" : "...",
"hash_policy": "{...}",
"request_headers_to_add" : [],
"opaque_config": [],
"cors": "{...}",
"decorator" : "{...}"
}
- prefix
- (sometimes required, string) If specified, the route is a prefix rule meaning that the prefix must match the beginning of the :path header. One of prefix, path, or regex must be specified.
- path
- (sometimes required, string) If specified, the route is an exact path rule meaning that the path must exactly match the :path header once the query string is removed. One of prefix, path, or regex must be specified.
- regex
(sometimes required, string) If specified, the route is a regular expression rule meaning that the regex must match the :path header once the query string is removed. The entire path (without the query string) must match the regex. The rule will not match if only a subsequence of the :path header matches the regex. The regex grammar is defined here. One of prefix, path, or regex must be specified.
Examples:
- The regex /b[io]t matches the path /bit
- The regex /b[io]t matches the path /bot
- The regex /b[io]t does not match the path /bite
- The regex /b[io]t does not match the path /bit/bot
- cors
- (optional, object) Specifies the route’s CORS policy.
- cluster
- (sometimes required, string) If the route is not a redirect (host_redirect and/or path_redirect is not specified), one of cluster, cluster_header, or weighted_clusters must be specified. When cluster is specified, its value indicates the upstream cluster to which the request should be forwarded to.
- cluster_header
(sometimes required, string) If the route is not a redirect (host_redirect and/or path_redirect is not specified), one of cluster, cluster_header, or weighted_clusters must be specified. When cluster_header is specified, Envoy will determine the cluster to route to by reading the value of the HTTP header named by cluster_header from the request headers. If the header is not found or the referenced cluster does not exist, Envoy will return a 404 response.
Attention
Internally, Envoy always uses the HTTP/2 :authority header to represent the HTTP/1 Host header. Thus, if attempting to match on Host, match on :authority instead.
- weighted_clusters
- (sometimes required, object) If the route is not a redirect (host_redirect and/or path_redirect is not specified), one of cluster, cluster_header, or weighted_clusters must be specified. With the weighted_clusters option, multiple upstream clusters can be specified for a given route. The request is forwarded to one of the upstream clusters based on weights assigned to each cluster. See traffic splitting for additional documentation.
- host_redirect
- (sometimes required, string) Indicates that the route is a redirect rule. If there is a match, a 301 redirect response will be sent which swaps the host portion of the URL with this value. path_redirect can also be specified along with this option.
- path_redirect
- (sometimes required, string) Indicates that the route is a redirect rule. If there is a match, a 301 redirect response will be sent which swaps the path portion of the URL with this value. host_redirect can also be specified along with this option.
- prefix_rewrite
- (optional, string) Indicates that during forwarding, the matched prefix (or path) should be swapped with this value. When using regex path matching, the entire path (not including the query string) will be swapped with this value. This option allows application URLs to be rooted at a different path from those exposed at the reverse proxy layer. The router filter will place the original path before rewrite into the x-envoy-original-path header.
- host_rewrite
- (optional, string) Indicates that during forwarding, the host header will be swapped with this value.
- auto_host_rewrite
- (optional, boolean) Indicates that during forwarding, the host header will be swapped with the hostname of the upstream host chosen by the cluster manager. This option is applicable only when the destination cluster for a route is of type strict_dns or logical_dns. Setting this to true with other cluster types has no effect. auto_host_rewrite and host_rewrite are mutually exclusive options. Only one can be specified.
- case_sensitive
- (optional, boolean) Indicates that prefix/path matching should be case sensitive. The default is true.
- use_websocket
(optional, boolean) Indicates that a HTTP/1.1 client connection to this particular route should be allowed to upgrade to a WebSocket connection. The default is false.
Attention
If set to true, Envoy will expect the first request matching this route to contain WebSocket upgrade headers. If the headers are not present, the connection will be processed as a normal HTTP/1.1 connection. If the upgrade headers are present, Envoy will setup plain TCP proxying between the client and the upstream server. Hence, an upstream server that rejects the WebSocket upgrade request is also responsible for closing the associated connection. Until then, Envoy will continue to proxy data from the client to the upstream server.
Redirects, timeouts and retries are not supported on requests with WebSocket upgrade headers.
- timeout_ms
- (optional, integer) Specifies the timeout for the route. If not specified, the default is 15s. Note that this timeout includes all retries. See also x-envoy-upstream-rq-timeout-ms, x-envoy-upstream-rq-per-try-timeout-ms, and the retry overview.
- runtime
- (optional, object) Indicates that the route should additionally match on a runtime key.
- retry_policy
- (optional, object) Indicates that the route has a retry policy.
- shadow
- (optional, object) Indicates that the route has a shadow policy.
- priority
- (optional, string) Optionally specifies the routing priority.
- headers
- (optional, array) Specifies a set of headers that the route should match on. The router will
check the request’s headers against all the specified headers in the route config. A match will
happen if all the headers in the route are present in the request with the same values (or based
on presence if the
value
field is not in the config). - request_headers_to_add
(optional, array) Specifies a list of HTTP headers that should be added to each request handled by this virtual host. Headers are specified in the following form:
[ {"key": "header1", "value": "value1"}, {"key": "header2", "value": "value2"} ]
For more information see the documentation on custom request headers.
- opaque_config
- (optional, array) Specifies a set of optional route configuration values that can be accessed by filters.
- rate_limits
- (optional, array) Specifies a set of rate limit configurations that could be applied to the route.
- include_vh_rate_limits
- (optional, boolean) Specifies if the rate limit filter should include the virtual host rate limits. By default, if the route configured rate limits, the virtual host rate_limits are not applied to the request.
- hash_policy
- (optional, object) Specifies the route’s hashing policy if the upstream cluster uses a hashing load balancer.
- decorator
- (optional, object) Specifies the route’s decorator used to enhance information reported about the matched request.
Runtime¶
A runtime route configuration can be used to roll out route changes in a gradual manner without full code/config deploys. Refer to the traffic shifting docs for additional documentation.
{
"key": "...",
"default": "..."
}
- key
- (required, string) Specifies the runtime key name that should be consulted to determine whether the route matches or not. See the runtime documentation for how key names map to the underlying implementation.
- default
- (required, integer) An integer between 0-100. Every time the route is considered for a match, a random number between 0-99 is selected. If the number is <= the value found in the key (checked first) or, if the key is not present, the default value, the route is a match (assuming everything also about the route matches).
Retry policy¶
HTTP retry architecture overview.
{
"retry_on": "...",
"num_retries": "...",
"per_try_timeout_ms" : "..."
}
- retry_on
- (required, string) Specifies the conditions under which retry takes place. These are the same conditions documented for x-envoy-retry-on and x-envoy-retry-grpc-on.
- num_retries
- (optional, integer) Specifies the allowed number of retries. This parameter is optional and defaults to 1. These are the same conditions documented for x-envoy-max-retries.
- per_try_timeout_ms
(optional, integer) Specifies a non-zero timeout per retry attempt. This parameter is optional. The same conditions documented for x-envoy-upstream-rq-per-try-timeout-ms apply.
Note: If left unspecified, Envoy will use the global route timeout for the request. Consequently, when using a 5xx based retry policy, a request that times out will not be retried as the total timeout budget would have been exhausted.
Shadow¶
The router is capable of shadowing traffic from one cluster to another. The current implementation is “fire and forget,” meaning Envoy will not wait for the shadow cluster to respond before returning the response from the primary cluster. All normal statistics are collected for the shadow cluster making this feature useful for testing.
During shadowing, the host/authority header is altered such that -shadow is appended. This is useful for logging. For example, cluster1 becomes cluster1-shadow.
{
"cluster": "...",
"runtime_key": "..."
}
- cluster
- (required, string) Specifies the cluster that requests will be shadowed to. The cluster must exist in the cluster manager configuration.
- runtime_key
- (optional, string) If not specified, all requests to the target cluster will be shadowed. If specified, Envoy will lookup the runtime key to get the % of requests to shadow. Valid values are from 0 to 10000, allowing for increments of 0.01% of requests to be shadowed. If the runtime key is specified in the configuration but not present in runtime, 0 is the default and thus 0% of requests will be shadowed.
Headers¶
{
"name": "...",
"value": "...",
"regex": "...",
"range_match": "..."
}
- name
- (required, string) Specifies the name of the header in the request.
- value
- (optional, string) Specifies the value of the header. If the value is absent a request that has the name header will match, regardless of the header’s value.
- regex
(optional, boolean) Specifies whether the header value is a regular expression or not. Defaults to false. The entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. The regex grammar used in the value field is defined here.
Examples:
- The regex d{3} matches the value 123
- The regex d{3} does not match the value 1234
- The regex d{3} does not match the value 123.456
- range_match
- (optional, object) Specifies the range that will be used for header matching.
Attention
Internally, Envoy always uses the HTTP/2 :authority header to represent the HTTP/1 Host header. Thus, if attempting to match on Host, match on :authority instead.
Attention
To route on HTTP method, use the special HTTP/2 :method header. This works for both HTTP/1 and HTTP/2 as Envoy normalizes headers. E.g.,
{
"name": ":method",
"value": "POST"
}
Weighted Clusters¶
Compared to the cluster
field that specifies a single upstream cluster as the target
of a request, the weighted_clusters
option allows for specification of multiple upstream clusters
along with weights that indicate the percentage of traffic to be forwarded to each cluster.
The router selects an upstream cluster based on the weights.
{
"clusters": [],
"runtime_key_prefix" : "..."
}
- clusters
(required, array) Specifies one or more upstream clusters associated with the route.
{ "name" : "...", "weight": "..." }
- name
- (required, string) Name of the upstream cluster. The cluster must exist in the cluster manager configuration.
- weight
- (required, integer) An integer between 0-100. When a request matches the route, the choice of an upstream cluster is determined by its weight. The sum of weights across all entries in the clusters array must add up to 100.
- runtime_key_prefix
(optional, string) Specifies the runtime key prefix that should be used to construct the runtime keys associated with each cluster. When the
runtime_key_prefix
is specified, the router will look for weights associated with each upstream cluster under the keyruntime_key_prefix + "." + cluster[i].name
wherecluster[i]
denotes an entry in theclusters
array field. If the runtime key for the cluster does not exist, the value specified in the configuration file will be used as the default weight. See the runtime documentation for how key names map to the underlying implementation.Note: If the sum of runtime weights exceed 100, the traffic splitting behavior is undefined (although the request will be routed to one of the clusters).
Hash policy¶
Specifies the route’s hashing policy if the upstream cluster uses a hashing load balancer.
{
"header_name": "..."
}
- header_name
- (required, string) The name of the request header that will be used to obtain the hash key. If the request header is not present, the load balancer will use a random number as the hash, effectively making the load balancing policy random.
Decorator¶
Specifies the route’s decorator.
{
"operation": "..."
}
- operation
- (required, string) The operation name associated with the request matched to this route. If tracing is enabled, this information will be used as the span name reported for this request. NOTE: For ingress (inbound) requests, or egress (outbound) responses, this value may be overridden by the x-envoy-decorator-operation header.
Opaque Config¶
Additional configuration can be provided to filters through the “Opaque Config” mechanism. A list of properties are specified in the route config. The configuration is uninterpreted by envoy and can be accessed within a user-defined filter. The configuration is a generic string map. Nested objects are not supported.
[
{"...": "..."}
]
CORS¶
Settings on a route take precedence over settings on the virtual host.
{
"enabled": false,
"allow_origin": ["http://foo.example"],
"allow_methods": "POST, GET, OPTIONS",
"allow_headers": "Content-Type",
"allow_credentials": false,
"expose_headers": "X-Custom-Header",
"max_age": "86400"
}
- enabled
- (optional, boolean) Defaults to true. Setting enabled to false on a route disables CORS for this route only. The setting has no effect on a virtual host.
- allow_origin
- (optional, array) The origins that will be allowed to do CORS request. Wildcard “*” will allow any origin.
- allow_methods
- (optional, string) The content for the access-control-allow-methods header. Comma separated list of HTTP methods.
- allow_headers
- (optional, string) The content for the access-control-allow-headers header. Comma separated list of HTTP headers.
- allow_credentials
- (optional, boolean) Whether the resource allows credentials.
- expose_headers
- (optional, string) The content for the access-control-expose-headers header. Comma separated list of HTTP headers.
- max_age
- (optional, string) The content for the access-control-max-age header. Value in seconds for how long the response to the preflight request can be cached.
range_match¶
Specifies the int64 start and end of the range using half-open interval semantics [start, end). Header route matching will be performed if the header’s value lies within this range.
{
"start": "...",
"end": "..."
}
- start
- (required, integer) start of the range (inclusive).
- end
- (required, integer) end of the range (exclusive).


--- layout: post title: feltron eight date: '2008-01-14T21:17:49+00:00' tags: [] tumblr_url: http://backlog.robbevan.com/post/23761305/feltron-eight ---
Feltron Eight


This is the Exceedingly GrEat Test File of Lesser Awesomeness
Whatevs this is still awesome.html
Edit Me!
Brainhoney Link
Box Link
The link of utter depression


Please take a moment to fill out this feedback survey . This helps use improve this event in the future.
Survey (~5 minutes): Click here!
The deadline for requesting a certificate has passed, but we will organize similar events in the future.
GCC 2021 will be virtual this year, and feature a week of training.
More information can be found here: VIB GCC2021 Event Page


If the attribute ng-link-stylesheet-no-destroy is found, the <link href="style.css"> inserted won't be removed when the scope is destroyed, which is the normal behavior. So the style3.css will be in the head until the page is refreshed. In this case:
body { background-color: #ffcc00!important; }


swap
问题描述 :
There’s a matrix of n rows and m columns whose elements are either 0 or 1.
If an element is 0, it is located at the i-th row and j-th column, there is at least one 1 is located at the i-th row and k-th (k < j) column, and at least one 1 is located at the i-th row and r-th(r > j) column, this element is called Cup.
You can swap any two rows and any two columns of the matrix. You can do this infinite times, to minimize the number of Cups.
If an element is 0, it is located at the i-th row and j-th column, there is at least one 1 is located at the i-th row and k-th (k < j) column, and at least one 1 is located at the i-th row and r-th(r > j) column, this element is called Cup.
You can swap any two rows and any two columns of the matrix. You can do this infinite times, to minimize the number of Cups.
输入:
Multiple test cases (no more than 50), ended with EOF.
The 1st line of each test case contains two integers n and m (3 ≤ n ≤ 10, 3 ≤ m ≤ 25), the number of rows and the number of columns of the matrix.
Then following n lines, each line has m space-separated 0 or 1, indicating the original configuration of the matrix.
The 1st line of each test case contains two integers n and m (3 ≤ n ≤ 10, 3 ≤ m ≤ 25), the number of rows and the number of columns of the matrix.
Then following n lines, each line has m space-separated 0 or 1, indicating the original configuration of the matrix.
输出:
Multiple test cases (no more than 50), ended with EOF.
The 1st line of each test case contains two integers n and m (3 ≤ n ≤ 10, 3 ≤ m ≤ 25), the number of rows and the number of columns of the matrix.
Then following n lines, each line has m space-separated 0 or 1, indicating the original configuration of the matrix.
The 1st line of each test case contains two integers n and m (3 ≤ n ≤ 10, 3 ≤ m ≤ 25), the number of rows and the number of columns of the matrix.
Then following n lines, each line has m space-separated 0 or 1, indicating the original configuration of the matrix.
样例输入:
3 3 1 1 0 1 0 1 0 1 1
样例输出:
1
H. Hunters
1000ms
1000ms
32768KB
64-bit integer IO format: %I64d Java class name: Main
Font Size:
Alice and Bob are the topmost hunters in the forest, so no preys can escape from them. However, they both think that its hunting skill is better than the other. So they need a match.
In their match, the
targets are two animals, a tiger and a wolf. They both know that the
tiger is living in the south of the forest and the wolf is living in the
north of the forest. They decide that the one who kills the tiger
scores X points and who kills the wolf scores Y points. If the one who
kills both tiger and wolf scores X+Y points.
Before the match starts,
Alice is in the east of the forest and Bob is in the west of the
forest. When the match starts, Alice and Bob will choose one of the
preys as targets. Because they haven’t known the other’s choice, maybe
they choose the same target. There will be two situations:
(1) If they choose different targets, they both are sure of killing their respective targets.
(2)
If they choose the same target, the probability of Alice killing the
target is P, and the probability of Bob killing it is 1-P. Then they
will hunt for the other prey, also the probability of Alice killing it
is P and the probability of Bob killing it is 1-P.
But Alice knows
about Bob. She knows that the probability of Bob choosing tiger as his
first target is Q, and the probability of choosing wolf is 1-Q. So that
Alice can decide her first target to make her expected score as high as
possible.
In their match, the
targets are two animals, a tiger and a wolf. They both know that the
tiger is living in the south of the forest and the wolf is living in the
north of the forest. They decide that the one who kills the tiger
scores X points and who kills the wolf scores Y points. If the one who
kills both tiger and wolf scores X+Y points.
Before the match starts,
Alice is in the east of the forest and Bob is in the west of the
forest. When the match starts, Alice and Bob will choose one of the
preys as targets. Because they haven’t known the other’s choice, maybe
they choose the same target. There will be two situations:
(1) If they choose different targets, they both are sure of killing their respective targets.
(2)
If they choose the same target, the probability of Alice killing the
target is P, and the probability of Bob killing it is 1-P. Then they
will hunt for the other prey, also the probability of Alice killing it
is P and the probability of Bob killing it is 1-P.
But Alice knows
about Bob. She knows that the probability of Bob choosing tiger as his
first target is Q, and the probability of choosing wolf is 1-Q. So that
Alice can decide her first target to make her expected score as high as
possible.
Input
The first line of input contains an integer T (1≤T≤10000), the number of test cases.
Then
T test cases follow. Each test case contains X, Y, P, Q in one line. X
and Y are integers and 1≤X, Y≤1000000000. P and Q are decimals and 0≤P,
Q≤1, and there are at most two digits after decimal point.
Then
T test cases follow. Each test case contains X, Y, P, Q in one line. X
and Y are integers and 1≤X, Y≤1000000000. P and Q are decimals and 0≤P,
Q≤1, and there are at most two digits after decimal point.
Output
For each test case, output the target Alice should choose and the
highest expected score she can get, in one line, separated by a space.
The expected score should be rounded to the fourth digit after decimal
point. It is guaranteed that Alice will have different expected score
between choosing tiger and wolf.
highest expected score she can get, in one line, separated by a space.
The expected score should be rounded to the fourth digit after decimal
point. It is guaranteed that Alice will have different expected score
between choosing tiger and wolf.
Sample Input
3 2 1 0.5 0.5 2 1 0 1 7 7 0.32 0.16
Sample Output
tiger 1.7500 wolf 1.0000 tiger 6.5968
#include<iostream> #include<cstdio> #include<cstring> #include<string> #include<cmath> #include<vector> #include<cstdlib> #include<algorithm> using namespace std; #define LL long long #define ULL unsigned long long #define UINT unsigned int #define MAX_INT 0x7fffffff #define MAX_LL 0x7fffffffffffffff #define MAX(X,Y) ((X) > (Y) ? (X) : (Y)) #define MIN(X,Y) ((X) < (Y) ?


19 July 2002
Disease Outbreak Reported
As of 6 July 2002, the Ministry of Health of El Salvador has reported 2 249 cases of dengue fever including 6 deaths and 156 cases of dengue haemorrhagic fever. (see previous report) The epidemic curve suggests the outbreak has peaked.
The Ministers of Health for El Salvador, Guatemala and Honduras will be meeting soon to discuss strategies in dengue surveillance, prevention and control.


The Kinesis connector provides access to Amazon AWS Kinesis Streams.
To use the connector, add the following Maven dependency to your project:
The flink-connector-kinesis_2.11
has a dependency on code licensed under the Amazon Software License (ASL).
Linking to the flink-connector-kinesis will include ASL licensed code into your application.
The flink-connector-kinesis_2.11
artifact is not deployed to Maven central as part of
Flink releases because of the licensing issue. Therefore, you need to build the connector yourself from the source.
Download the Flink source or check it out from the git repository. Then, use the following Maven command to build the module:
Attention For Flink versions 1.4.2 and below, the KPL client version
used by default in the Kinesis connectors, KPL 0.12.5, is no longer supported by AWS Kinesis Streams
(see here).
This means that when building the Kinesis connector, you will need to specify a higher version KPL client (above 0.12.6)
in order for the Flink Kinesis Producer to work. You can do this by specifying the preferred version via the
aws.kinesis-kpl.version
property, like so:
The streaming connectors are not part of the binary distribution. See how to link with them for cluster execution here.
Follow the instructions from the Amazon Kinesis Streams Developer Guide to setup Kinesis streams. Make sure to create the appropriate IAM policy and user to read / write to the Kinesis streams.
The FlinkKinesisConsumer
is an exactly-once parallel streaming data source that subscribes to multiple AWS Kinesis
streams within the same AWS service region, and can transparently handle resharding of streams while the job is running. Each subtask of the consumer is
responsible for fetching data records from multiple Kinesis shards. The number of shards fetched by each subtask will
change as shards are closed and created by Kinesis.
Before consuming data from Kinesis streams, make sure that all streams are created with the status “ACTIVE” in the AWS dashboard.
The above is a simple example of using the consumer. Configuration for the consumer is supplied with a java.util.Properties
instance, the configuration keys for which can be found in ConsumerConfigConstants
. The example
demonstrates consuming a single Kinesis stream in the AWS region “us-east-1”. The AWS credentials are supplied using the basic method in which
the AWS access key ID and secret access key are directly supplied in the configuration (other options are setting
ConsumerConfigConstants.AWS_CREDENTIALS_PROVIDER
to ENV_VAR
, SYS_PROP
, PROFILE
, ASSUME_ROLE
, and AUTO
). Also, data is being consumed
from the newest position in the Kinesis stream (the other option will be setting ConsumerConfigConstants.STREAM_INITIAL_POSITION
to TRIM_HORIZON
, which lets the consumer start reading the Kinesis stream from the earliest record possible).
Other optional configuration keys for the consumer can be found in ConsumerConfigConstants
.
Note that the configured parallelism of the Flink Kinesis Consumer source can be completely independent of the total number of shards in the Kinesis streams. When the number of shards is larger than the parallelism of the consumer, then each consumer subtask can subscribe to multiple shards; otherwise if the number of shards is smaller than the parallelism of the consumer, then some consumer subtasks will simply be idle and wait until it gets assigned new shards (i.e., when the streams are resharded to increase the number of shards for higher provisioned Kinesis service throughput).
Also note that the assignment of shards to subtasks may not be optimal when
shard IDs are not consecutive (as result of dynamic re-sharding in Kinesis).
For cases where skew in the assignment leads to significant imbalanced consumption,
a custom implementation of KinesisShardAssigner
can be set on the consumer.
The Flink Kinesis Consumer currently provides the following options to configure where to start reading Kinesis streams, simply by setting ConsumerConfigConstants.STREAM_INITIAL_POSITION
to
one of the following values in the provided configuration properties (the naming of the options identically follows the namings used by the AWS Kinesis Streams service):
LATEST
: read all shards of all streams starting from the latest record.TRIM_HORIZON
: read all shards of all streams starting from the earliest record possible (data may be trimmed by Kinesis depending on the retention settings).AT_TIMESTAMP
: read all shards of all streams starting from a specified timestamp. The timestamp must also be specified in the configuration
properties by providing a value for ConsumerConfigConstants.STREAM_INITIAL_TIMESTAMP
, in one of the following date pattern :
1459799926.480
).SimpleDateFormat
provided by ConsumerConfigConstants.STREAM_TIMESTAMP_DATE_FORMAT
.
If ConsumerConfigConstants.STREAM_TIMESTAMP_DATE_FORMAT
is not defined then the default pattern will be yyyy-MM-dd'T'HH:mm:ss.SSSXXX
(for example, timestamp value is 2016-04-04
and pattern is yyyy-MM-dd
given by user or timestamp value is 2016-04-04T19:58:46.480-00:00
without given a pattern).With Flink’s checkpointing enabled, the Flink Kinesis Consumer will consume records from shards in Kinesis streams and periodically checkpoint each shard’s progress. In case of a job failure, Flink will restore the streaming program to the state of the latest complete checkpoint and re-consume the records from Kinesis shards, starting from the progress that was stored in the checkpoint.
The interval of drawing checkpoints therefore defines how much the program may have to go back at most, in case of a failure.
To use fault tolerant Kinesis Consumers, checkpointing of the topology needs to be enabled at the execution environment:
Also note that Flink can only restart the topology if enough processing slots are available to restart the topology. Therefore, if the topology fails due to loss of a TaskManager, there must still be enough slots available afterwards. Flink on YARN supports automatic restart of lost YARN containers.
If streaming topologies choose to use the event time notion for record timestamps, an approximate arrival timestamp will be used by default. This timestamp is attached to records by Kinesis once they were successfully received and stored by streams. Note that this timestamp is typically referred to as a Kinesis server-side timestamp, and there are no guarantees about the accuracy or order correctness (i.e., the timestamps may not always be ascending).
Users can choose to override this default with a custom timestamp, as described here, or use one from the predefined ones. After doing so, it can be passed to the consumer in the following way:
The Flink Kinesis Consumer uses multiple threads for shard discovery and data consumption.
For shard discovery, each parallel consumer subtask will have a single thread that constantly queries Kinesis for shard information even if the subtask initially did not have shards to read from when the consumer was started. In other words, if the consumer is run with a parallelism of 10, there will be a total of 10 threads constantly querying Kinesis regardless of the total amount of shards in the subscribed streams.
For data consumption, a single thread will be created to consume each discovered shard. Threads will terminate when the shard it is responsible of consuming is closed as a result of stream resharding. In other words, there will always be one thread per open shard.
The Flink Kinesis Consumer uses the AWS Java SDK internally to call Kinesis APIs for shard discovery and data consumption. Due to Amazon’s service limits for Kinesis Streams on the APIs, the consumer will be competing with other non-Flink consuming applications that the user may be running. Below is a list of APIs called by the consumer with description of how the consumer uses the API, as well as information on how to deal with any errors or warnings that the Flink Kinesis Consumer may have due to these service limits.
DescribeStream: this is constantly called
by a single thread in each parallel consumer subtask to discover any new shards as a result of stream resharding. By default,
the consumer performs the shard discovery at an interval of 10 seconds, and will retry indefinitely until it gets a result
from Kinesis. If this interferes with other non-Flink consuming applications, users can slow down the consumer of
calling this API by setting a value for ConsumerConfigConstants.SHARD_DISCOVERY_INTERVAL_MILLIS
in the supplied
configuration properties. This sets the discovery interval to a different value. Note that this setting directly impacts
the maximum delay of discovering a new shard and starting to consume it, as shards will not be discovered during the interval.
GetShardIterator: this is called
only once when per shard consuming threads are started, and will retry if Kinesis complains that the transaction limit for the
API has exceeded, up to a default of 3 attempts. Note that since the rate limit for this API is per shard (not per stream),
the consumer itself should not exceed the limit. Usually, if this happens, users can either try to slow down any other
non-Flink consuming applications of calling this API, or modify the retry behaviour of this API call in the consumer by
setting keys prefixed by ConsumerConfigConstants.SHARD_GETITERATOR_*
in the supplied configuration properties.
GetRecords: this is constantly called
by per shard consuming threads to fetch records from Kinesis. When a shard has multiple concurrent consumers (when there
are any other non-Flink consuming applications running), the per shard rate limit may be exceeded. By default, on each call
of this API, the consumer will retry if Kinesis complains that the data size / transaction limit for the API has exceeded,
up to a default of 3 attempts. Users can either try to slow down other non-Flink consuming applications, or adjust the throughput
of the consumer by setting the ConsumerConfigConstants.SHARD_GETRECORDS_MAX
and
ConsumerConfigConstants.SHARD_GETRECORDS_INTERVAL_MILLIS
keys in the supplied configuration properties. Setting the former
adjusts the maximum number of records each consuming thread tries to fetch from shards on each call (default is 10,000), while
the latter modifies the sleep interval between each fetch (default is 200). The retry behaviour of the
consumer when calling this API can also be modified by using the other keys prefixed by ConsumerConfigConstants.SHARD_GETRECORDS_*
.
The FlinkKinesisProducer
uses Kinesis Producer Library (KPL) to put data from a Flink stream into a Kinesis stream.
Note that the producer is not participating in Flink’s checkpointing and doesn’t provide exactly-once processing guarantees. Also, the Kinesis producer does not guarantee that records are written in order to the shards (See here and here for more details).
In case of a failure or a resharding, data will be written again to Kinesis, leading to duplicates. This behavior is usually called “at-least-once” semantics.
To put data into a Kinesis stream, make sure the stream is marked as “ACTIVE” in the AWS dashboard.
For the monitoring to work, the user accessing the stream needs access to the CloudWatch service.
The above is a simple example of using the producer. To initialize FlinkKinesisProducer
, users are required to pass in AWS_REGION
, AWS_ACCESS_KEY_ID
, and AWS_SECRET_ACCESS_KEY
via a java.util.Properties
instance. Users can also pass in KPL’s configurations as optional parameters to customize the KPL underlying FlinkKinesisProducer
. The full list of KPL configs and explanations can be found here. The example demonstrates producing a single Kinesis stream in the AWS region “us-east-1”.
If users don’t specify any KPL configs and values, FlinkKinesisProducer
will use default config values of KPL, except RateLimit
. RateLimit
limits the maximum allowed put rate for a shard, as a percentage of the backend limits. KPL’s default value is 150 but it makes KPL throw RateLimitExceededException
too frequently and breaks Flink sink as a result. Thus FlinkKinesisProducer
overrides KPL’s default value to 100.
Instead of a SerializationSchema
, it also supports a KinesisSerializationSchema
. The KinesisSerializationSchema
allows to send the data to multiple streams. This is
done using the KinesisSerializationSchema.getTargetStream(T element)
method. Returning null
there will instruct the producer to write the element to the default stream.
Otherwise, the returned stream name is used.
Since Flink 1.4.0, FlinkKinesisProducer
switches its default underlying KPL from a one-thread-per-request mode to a thread-pool mode. KPL in thread-pool mode uses a queue and thread pool to execute requests to Kinesis. This limits the number of threads that KPL’s native process may create, and therefore greatly lowers CPU utilization and improves efficiency. Thus, We highly recommend Flink users use thread-pool model. The default thread pool size is 10
. Users can set the pool size in java.util.Properties
instance with key ThreadPoolSize
, as shown in the above example.
Users can still switch back to one-thread-per-request mode by setting a key-value pair of ThreadingModel
and PER_REQUEST
in java.util.Properties
, as shown in the code commented out in above example.
By default, FlinkKinesisProducer
does not backpressure. Instead, records that
cannot be sent because of the rate restriction of 1 MB per second per shard are
buffered in an unbounded queue and dropped when their RecordTtl
expires.
To avoid data loss, you can enable backpressuring by restricting the size of the internal queue:
// 200 Bytes per record, 1 shard
kinesis.setQueueLimit(500);
The value for queueLimit
depends on the expected record size. To choose a good
value, consider that Kinesis is rate-limited to 1MB per second per shard. If
less than one second’s worth of records is buffered, then the queue may not be
able to operate at full capacity. With the default RecordMaxBufferedTime
of
100ms, a queue size of 100kB per shard should be sufficient. The queueLimit
can then be computed via
queue limit = (number of shards * queue size per shard) / record size
E.g. for 200Bytes per record and 8 shards, a queue limit of 4000 is a good starting point. If the queue size limits throughput (below 1MB per second per shard), try increasing the queue limit slightly.
It is sometimes desirable to have Flink operate as a consumer or producer against a non-AWS Kinesis endpoint such as Kinesalite; this is especially useful when performing functional testing of a Flink application. The AWS endpoint that would normally be inferred by the AWS region set in the Flink configuration must be overridden via a configuration property.
To override the AWS endpoint, taking the producer for example, set the AWSConfigConstants.AWS_ENDPOINT
property in the
Flink configuration, in addition to the AWSConfigConstants.AWS_REGION
required by Flink. Although the region is
required, it will not be used to determine the AWS endpoint URL.
The following example shows how one might supply the AWSConfigConstants.AWS_ENDPOINT
configuration property:


Hi! I'm Spooky, and these are my friends! Want to play a game with us? Enter your name and click 'Play' to start!


| DOSE: |
10 mg |
oral |
2C-P |
(capsule) |
A friend acquired two hundred milligrams of 2C-P for use over the Thanksgiving holidays. We looked up the substance in PiKHAL, finding ourselves rather disappointed in Shulgin's information. The synthesis was there, to be sure, but the trip reports from his friends were remarkably unhelpful: 'Could lead to hypnotic power games', 'had a sinus-clearing effect', and so on.
On Thanksgiving night, P. and I each consumed four pieces of homemade pizza, finishing dinner around eight in the evening. We weighed 10 mg doses and placed them in gelcaps, swallowing at 10:22 PM. At the same time, V. took the drug of her choice, AMT.
2C-P produced an extremely gradual coming-on. After two hours, both P. and I felt somewhat let down. We had noticed some sensory effects, a phenethylamine buzz in the back of our heads and numbness or gravity in the extremities. I first noticed a visual effect somewhat later, looking at the black-and-white stripes on P.'s washboard and seeing them turn colors. We attributed the slow intensity rise to the food we had greedily consumed; however, later experiences on the same drug lead me to believe it is inherently gradual.
V. and I spent some time listening to Sigur Ros and comparing our experiences. This entailed a good amount of fumbling with words. We listened to the () album in its entirety; at one point, the AMT made her feel nauseous and she left for the bathroom. I sat alone, reading 'King Lear' aloud and noticing for the first time the significance of Cordelia's rhyming couplets in I, i. (Her farewell to Goneril and Regan is blank verse, ending with a couplet followed by an unpaired line. Regan and Goneril then speak, and Cordelia replies, ending in the same fashion. This gave me an extremely visceral sense of Cordelia trying to leave the stage and being restrained.)
V. returned, feeling much better, and we started wandering about. At one point, a group of people left for November Games, an event whose rules I do not understand, except that winning can be very bad for your health---my friend J. was left THC-stoned for the following week. V. contemplated leaving but decided against it.
The building's heating system picked this night to fail, leaving the front half frigid. P. had gone off to test his perceptions somewhere, so V. and I huddled next to a heating vent under an awful campfire-and-pot smelling blanket. Between the few pitiful joules leaking through the grate and our shared body heat, we got much warmer. Most of the rest of the night was spent in this fashion, sometimes milling around and talking to people and sometimes huddling for warmth.
I peaked between four to five hours after ingestion. I first detected my truly high nature when I heard myself say, 'That tin of guava paste is breathing.' This was a typical visual effect, of which I observed much that evening: objects grew and shrank, oscillating in size every few seconds with a calm, respiratory motion.
2C-P had few overtly psychological effects, producing instead a trip full of sensory distortion. I was able to converse about nonlinear dynamics, surreal number theory and body piercings with all my usual social skill. (I wish I could insert a soft tone of sarcasm in typed text right now, but the statement is factually accurate anyway.)
We decided to go to bed well after sunrise, 07:30 or so. I lay under my blankets for around an hour, experiencing closed-eye visuals composed largely of faces I had seen and talked with during my trip. The open-eye effect of oscillating object size still persisted. Sometime before 09:00, I fell asleep, waking sober an hour later.
There followed an amusing farce when P. lost his glass vial containing the other eighteen 2C-P doses. We scoured five floors of converted brownstone and overturned much of the miscellany a co-ed living group produces, before we found it in P.'s very own freezer. I did make a few bucks looking under couch cushions, though: the small-change deposits were quite lucrative.
Our second trip occured the weekend after the Thanksgiving break, five school days later. This time I again swallowed 10 mg, with my roommates D. and V. taking the same dose. In an attempt to separate variables and determine the drug's true nature, we avoided eating that afternoon. We swallowed our gelcaps an hour later than the first time, beginning our experience at 11:22. I noticed tactile numbness within an hour, much like the first time. D. and V. took longer to experience effects, a discrepancy which created an unexpectedly comic situation. A half-dozen of us were lounging together in my room's sleeping loft, listening to the godly sound of our Klipsch KLF-10 speakers. (Product placement.) That miscellaneous pile of partially clad humans, all exploring various drug-induced tactile distortions, was the closest my humble academic life has ever approached to a real orgy.  V. fairly leapt from the loft, slipping a tank top over her pierced torso. She and D. gave our visitors a tour, helped them with their scavenger hunt (the things people do for brotherhood!). In the middle of the tour, a wave of nausea hit them simultaneously, followed by open-eye visuals much like I'd seen the time before. After the fraternity brothers left, we wandered the snowy streets outside, saw a glowing light that might've been Venus, the ISS or the Mothership, and watched Kubrick's 'The Shining'. I peaked during the movie, seeing halos around the people on screen and then looking away to see the same apparitions surrounding my friends. (Dedicated to E. Shapely and G. Afrika.)
Experience Reports are the writings and opinions of the individual authors who submit them.
Some of the activities described are dangerous and/or illegal and none are recommended by Erowid.


WITNESS LIST Public Education Committee (Subcommittee on Safe Schools) March 19, 1997-10:30A Chapter 37, Education Code (HB1090) For: Cockerell, Carey (TPA) Eckels, Robert (Harris County Comm Ct) Gillian, Bob (himself-Bell Co Jv Prb) Lee, Donald (Conf of Urban Counties) Mayfield, Kenneth (Dallas Cnty Comm Ct) Powell, Ron (himself-probation offc.) Shaw, Carl Neil (himself-Alt Ed Prog Evl) Against: Hoffman, Shellie (herself-Tx Coun Schl At) Pierce, Denise (herself (TASB)) Thompson, David (TASA & TSA) On: Anderson, David (TEA) Bieser, Jenna (ATPE) Hartman, Eric (TFT) Scott, George (Tax Rsch Assc) Taebel, Holly (TCTA) Registering, but not testifying: For: Barrera, Ashley (229th Jud Dist Juv Dept) Ellis, Kent (Harris Co Juv Board) Garcia, Ismael (Jim Wells Cnty Prob Dep) Rodriguez, Amador (Cameron Cnty. Juv Board) JJAEP's On: Jacobs, Billy (TEA)


Opportunities to provide financial services to low-income populations in developed countries through technology
15 Sep 2015The economist article
In the September 7 version of the Economist, the magazine published a very interesting article about how low-income populations (which I will coin LIP for lack of a better word - “the poor” does not seem appropriate) in the United States (and probably other industrial nation, even though I yet have to research on it), have much worse access to financial services than higher-income populations do (you can find the article here.
Why is this the case? It is mostly the prohibitive cost. One outrageous example is the $40 per payroll check charged by 26,000 businesses to cash a check from a typical unbanked households with full-time workers. Banks and other financial institutions rake in approximately $8bn in fees this way per year (Brookings Institute, 2008). Doesn’t this call for a technological revolution, a true “disruption”? The economist article cites a few more examples how LIPs are affected:
- Overdraft fees - vary between $7 to $40 per transaction (I experienced a painful lesson in this recently, one that cost me $135 on a transactional value of $25 with Bank of America)
- Check-cashing fees - 2-5% of check value
- Cost of remittances to relatives abroad
- ATM withdrawal fees
- Pay-day lenders
- Covering the cost to pay for earned-income tax credits
The article claims that these fees can accumulate up to $40,000 over the career of a full-time worker. Assuming that such a career averages 40 years and that the average cost is more like $20,000 over a lifetime, that still equates to approximately $500 per year. Seeing the poverty line is $23,834 for a family of four (Poverty USA) that is a huge cost. That is not to say that all of these full-time workers would fall under the poverty line, but even at a higher income of say $30,000 a year for an individual, $500 is a hefty amount.
The under-banked - a market opportunity with great potential?
Seeing that around 45m US Americans live below the poverty there is a significant market for providing services for the “under-banked”. At a very modest assumption of $5 in financial services fees per month (any kind) , this equates to a market of roughly $3bn. Seeing that the fees from checking cashes only however rack up to $8bn the market is ultimately much bigger. Many companies in that space such as retail banks and check-cashers are also quite old (Western Union, Moneygram, RiteCheck) and seem ripe to see some innovation.
The US has brought about an abundance of financial technology innovation in the past few years alone. Traditional providers of financial services in spaces such as wealth management (Wealthfront, Betterment, Acorns), savings behavior (Mint, Digit.co), banking (Simple, Coin), payments (Dwolla, Stripe, Apple pay), transfers (Venmo, Square Cash) and consumer loans (Lending club, Affirm) have been thoroughly shook up.
However, almost all of these services are geared towards a technologically savvy population, usually in their 20-40s and college educated. They provide great user-experience but are usually available on smartphones and the Internet (with the exception of Digit.co which works through SMS services).
How can we utilize some of the technologies developed over the past years to provide some of the aforementioned services at a much lower cost? I see several areas that would be interesting to start in:
- Text-based banking (not necessarily on a smartphone but more akin to the examples set in developing countries such as Kenya with m-Pesa)
- Prepaid debit cards
- Tools to incentive and enable savings (see digit.co)
- Earned-income tax credit (EITC) loan instruments - this is actually a very interesting space since payouts occur once a year and can be reasonably predicted. Providing loans to finance immediate needs that can then be offset with the single, once-a-year EITC could encourage savings and more reasonable spending behavior.
- mobile-based or neighborhood-based check-cashing services
All of these niche markets could lead to the development of an integrated financial services company that specifically chooses LIP as it’s target customers.
The challenges
The challenges in this space are abundant. As technologists, business and UX experts we would be dealing with a population that does not necessarily has been exposed to technology as much as we have. Even the technological solutions would look entirely different from the high-tech, computing-intensive approaches based on the newest gadgets currently in use. LIPs do not necessarily possess smartphones, so a text-based service might be most sensible here Someone looking to approach this problem would do well looking at examples from developing countries, such as aforementioned m-Pesa in Kenya.
Besides that, many challenges can arise from the unwillingness of investors to provide the necessary capital to get a company off the ground that would like to scale and develop it’s proprietary technological solution. LIPs are not necessary the target group of most startups today. Luckily, alternative financing models are emerging through impact investing and resources such as the Venture Lab.
These are some of the challenges that I see:
- Gaining consumer trust - LIPs have more often than not been exploited by companies rather than being served in a responsible manner
- Product adoption
- Product and solution development
- Financing (particularly venture financing which might not be interested in this kind of business but which can provide the kind of expertise and connections necessary to succeed in such an endeavor)
- Identifying the right beach-head market within that specific segment
- Regulation - this might actually be the biggest challenge within the space. Financial services are strictly regulated both by federal government as well internal regulations should you cooperate with a bank
The challenges are daunting but the pay-offs could be tremendous as well.
It might be useful to recognize that there is a lot of space to innovate in under-served populations even in industrial countries, not only in the developing world (where we could learn a lot however in trying to solve our own problems). Also, as the authors of Poor Economics point out, LIPs are more than willing to pay for useful services so they should not be neglected in looking to establish successful for-profit technology companies.
I would love to hear your opinion on this matter. Shoot me an email or leave a comment, would be happy to hear what you think the challenges are, what other opportunities lie in that space or what companies are already active.


Dillon Drenzek
Advanced Web Design
HOME
BUCKET LIST
ABOUT ME
Places I'd Like to Go
North America
Zion National Park
fabernova
Shutterstock
Haiku Stairs of Oahu, Hawaii
Flickr: Michael Keany
Antelope Canyon
Manamana
Shutterstock
Europe
Manarola, Italy
Image Source
Things I'd Like to Do
Text Input:


Get started with Docker Desktop for Mac
Estimated reading time: 16 minutesWelcome to Docker Desktop!
The Docker Desktop for Mac section contains information about the Docker Desktop Community Stable release. For information about features available in Edge releases, see the Edge release notes. For information about Docker Desktop Enterprise (DDE) releases, see Docker Desktop Enterprise.
Docker is a full development platform for creating containerized applications. Docker Desktop is the best way to get started with Docker on Mac.
See Install Docker Desktop for download information, system requirements, and installation instructions.
Check versions
Ensure your versions of docker
, docker-compose
, and docker-machine
are
up-to-date and compatible with Docker.app
. Your output may differ if you are
running different versions.
$ docker --version
Docker version 19.03, build c97c6d6
Explore the application
-
Open a command-line terminal and test that your installation works by running the simple Docker image, hello-world:
$ docker run hello-world Unable to find image 'hello-world:latest' locally latest: Pulling from library/hello-world ca4f61b1923c: Pull complete Digest: sha256:ca0eeb6fb05351dfc8759c20733c91def84cb8007aa89a5bf606bc8b315b9fc7 Status: Downloaded newer image for hello-world:latest Hello from Docker! This message shows that your installation appears to be working correctly. ...
-
Start a Dockerized web server. Like the
hello-world
image above, if the image is not found locally, Docker pulls it from Docker Hub.$ docker run --detach --publish=80:80 --name=webserver nginx
-
In a web browser, go to
http://localhost/
to view the nginx homepage. Because we specified the default HTTP port, it isn’t necessary to append:80
at the end of the URL.Early beta releases used
docker
as the hostname to build the URL. Now, ports are exposed on the private IP addresses of the VM and forwarded tolocalhost
with no other host name set. -
View the details on the container while your web server is running (with
docker container ls
ordocker ps
):$ docker container ls CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 56f433965490 nginx "nginx -g 'daemon off" About a minute ago Up About a minute <IP_ADDRESS>:80->80/tcp, 443/tcp webserver
-
Stop and remove containers and images with the following commands. Use the “all” flag (
--all
or-a
) to view stopped containers.$ docker container ls $ docker container stop webserver $ docker container ls -a $ docker container rm webserver $ docker image ls $ docker image rm nginx
Preferences
Choose the Docker menu > Preferences from the menu bar and configure the runtime options described below.
General
On the General tab, you can configure when to start and update Docker:
-
Start Docker Desktop when you log in: Automatically starts Docker Desktop when you open your session.
-
Automatically check for updates: By default, Docker Desktop automatically checks for updates and notifies you when an update is available. You can manually check for updates anytime by choosing Check for Updates from the main Docker menu.
-
Include VM in Time Machine backups: Select this option to back up the Docker Desktop virtual machine. This option is disabled by default.
-
Securely store Docker logins in macOS keychain: Docker Desktop stores your Docker login credentials in macOS keychain by default.
-
Send usage statistics: Docker Desktop sends diagnostics, crash reports, and usage data. This information helps Docker improve and troubleshoot the application. Clear the check box to opt out.
Resources
The Resources tab allows you to configure CPU, memory, disk, proxies, network, and other resources.
Advanced
On the Advanced tab, you can limit resources available to Docker.
Advanced settings are:
CPUs: By default, Docker Desktop is set to use half the number of processors available on the host machine. To increase processing power, set this to a higher number; to decrease, lower the number.
Memory: By default, Docker Desktop is set to use 2
GB runtime memory,
allocated from the total available memory on your Mac. To increase the RAM, set this to a higher number. To decrease it, lower the number.
Swap: Configure swap file size as needed. The default is 1 GB.
Disk image size: Specify the size of the disk image.
Disk image location: Specify the location of the Linux volume where containers and images are stored.
You can also move the disk image to a different location. If you attempt to move a disk image to a location that already has one, you get a prompt asking if you want to use the existing image or replace it.
File sharing
Choose the local directories you’d like to share with your containers. File sharing is required for volume mounting if the project lives outside of the /Users
directory. In that case, share the drive where the Dockerfile and volume are located. Otherwise, you get file not found
or cannot start service
errors at runtime`.
File share settings are:
-
Add a Directory: Click
+
and navigate to the directory you want to add. -
Apply & Restart makes the directory available to containers using Docker’s bind mount (
-v
) feature.There are some limitations on the directories that can be shared:
- It is not possible to share a directory that is a subdirectory of an already shared directory.
- The directory must not exist inside of Docker.
For more information, see:
- Namespaces in the topic on osxfs file system sharing.
- Volume mounting requires file sharing for any project directories outside of
/Users
.)
Proxies
Docker Desktop detects HTTP/HTTPS Proxy Settings from macOS and automatically
propagates these to Docker and to your containers. For example, if you set your
proxy settings to http://proxy.example.com
, Docker uses this proxy when
pulling containers.
When you start a container, your proxy settings propagate into the containers. For example:
$ docker run -it alpine env
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=b7edf988b2b5
TERM=xterm
HOME=/root
HTTP_PROXY=http://proxy.example.com:3128
http_proxy=http://proxy.example.com:3128
no_proxy=*.local, 169.254/16
You can see from the above output that the HTTP_PROXY
, http_proxy
, and
no_proxy
environment variables are set. When your proxy configuration changes,
Docker restarts automatically to pick up the new settings. If you have any
containers that you would like to keep running across restarts, you should consider using restart policies.
Network
You can configure Docker Desktop networking to work on a virtual private network (VPN). Specify a network address translation (NAT) prefix and subnet mask to enable Internet connectivity.
Docker Engine
The Docker Engine page allows you to configure the Docker daemon to determine how your containers run.
Type a JSON configuration file in the box to configure the daemon settings. For a full list of options, see the Docker Engine dockerd commandline reference.
Click Apply & Restart to save your settings and restart Docker Desktop.
Command Line
On the Command Line page, you can specify whether or not to enable experimental features.
Experimental features provide early access to future product functionality. These features are intended for testing and feedback only as they may change between releases without warning or can be removed entirely from a future release. Experimental features must not be used in production environments. Docker does not offer support for experimental features. For more information, see Experimental features.
To enable experimental features in the Docker CLI, edit the
config.json
file and setexperimental
to enabled.To enable experimental features from the Docker Desktop menu, click Settings (Preferences on macOS) > Daemon and then select the Experimental features check box.
On both Docker Desktop Edge and Stable releases, you can toggle the experimental features on and off. If you toggle the experimental features off, Docker Desktop uses the current generally available release of Docker Engine.
You can see whether you are running experimental mode at the command line. If
Experimental
is true
, then Docker is running in experimental mode, as shown
here. (If false
, Experimental mode is off.)
> docker version
Client: Docker Engine - Community
Version: 19.03.1
API version: 1.40
Go version: go1.12.5
Git commit: 74b1e89
Built: Thu Jul 25 21:18:17 2019
OS/Arch: darwin/amd64
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 19.03.1
API version: 1.40 (minimum version 1.12)
Go version: go1.12.5
Git commit: 74b1e89
Built: Thu Jul 25 21:17:52 2019
OS/Arch: linux/amd64
Experimental: true
containerd:
Version: v1.2.6
GitCommit: 894b81a4b802e4eb2a91d1ce216b8817763c29fb
runc:
Version: 1.0.0-rc8
GitCommit: 425e105d5a03fabd737a126ad93d62a9eeede87f
docker-init:
Version: 0.18.0
GitCommit: fec3683
Kubernetes
Docker Desktop includes a standalone Kubernetes server that runs on your Mac, so that you can test deploying your Docker workloads on Kubernetes.
The Kubernetes client command, kubectl
, is included and configured to connect
to the local Kubernetes server. If you have kubectl
already installed and
pointing to some other environment, such as minikube
or a GKE cluster, be sure
to change context so that kubectl
is pointing to docker-for-desktop
:
$ kubectl config get-contexts
$ kubectl config use-context docker-desktop
If you installed kubectl
with Homebrew, or by some other method, and
experience conflicts, remove /usr/local/bin/kubectl
.
-
To enable Kubernetes support and install a standalone instance of Kubernetes running as a Docker container, select Enable Kubernetes. To set Kubernetes as the default orchestrator, select Deploy Docker Stacks to Kubernetes by default.
Click Apply & Restart to save the settings. This instantiates images required to run the Kubernetes server as containers, and installs the
/usr/local/bin/kubectl
command on your Mac.When Kubernetes is enabled and running, an additional status bar item displays at the bottom right of the Docker Desktop Preferences dialog.
The status of Kubernetes shows in the Docker menu and the context points to
docker-desktop
. -
By default, Kubernetes containers are hidden from commands like
docker service ls
, because managing them manually is not supported. To make them visible, select Show system containers (advanced) and click Apply and Restart. Most users do not need this option. -
To disable Kubernetes support at any time, clear the Enable Kubernetes check box. The Kubernetes containers are stopped and removed, and the
/usr/local/bin/kubectl
command is removed.For more about using the Kubernetes integration with Docker Desktop, see Deploy on Kubernetes.
Reset
Reset and Restart options
On Docker Desktop Mac, the Restart Docker Desktop, Reset to factory defaults, and other reset options are available from the Troubleshoot menu.
For information about the reset options, see Logs and Troubleshooting.
Add TLS certificates
You can add trusted Certificate Authorities (CAs) (used to verify registry server certificates) and client certificates (used to authenticate to registries) to your Docker daemon.
Add custom CA certificates (server side)
All trusted CAs (root or intermediate) are supported. Docker Desktop creates a certificate bundle of all user-trusted CAs based on the Mac Keychain, and appends it to Moby trusted certificates. So if an enterprise SSL certificate is trusted by the user on the host, it is trusted by Docker Desktop.
To manually add a custom, self-signed certificate, start by adding the certificate to the macOS keychain, which is picked up by Docker Desktop. Here is an example:
$ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.crt
Or, if you prefer to add the certificate to your own local keychain only (rather than for all users), run this command instead:
$ security add-trusted-cert -d -r trustRoot -k ~/Library/Keychains/login.keychain ca.crt
See also, Directory structures for certificates.
Note: You need to restart Docker Desktop after making any changes to the keychain or to the
~/.docker/certs.d
directory in order for the changes to take effect.
For a complete explanation of how to do this, see the blog post Adding Self-signed Registry Certs to Docker & Docker Desktop for Mac.
Add client certificates
You can put your client certificates in
~/.docker/certs.d/<MyRegistry>:<Port>/client.cert
and
~/.docker/certs.d/<MyRegistry>:<Port>/client.key
.
When the Docker Desktop application starts, it copies the ~/.docker/certs.d
folder on your Mac to the /etc/docker/certs.d
directory on Moby (the Docker
Desktop xhyve
virtual machine).
You need to restart Docker Desktop after making any changes to the keychain or to the
~/.docker/certs.d
directory in order for the changes to take effect.The registry cannot be listed as an insecure registry (see Docker Daemon). Docker Desktop ignores certificates listed under insecure registries, and does not send client certificates. Commands like
docker run
that attempt to pull from the registry produce error messages on the command line, as well as on the registry.
Directory structures for certificates
If you have this directory structure, you do not need to manually add the CA certificate to your Mac OS system login:
/Users/<user>/.docker/certs.d/
└── <MyRegistry>:<Port>
├── ca.crt
├── client.cert
└── client.key
The following further illustrates and explains a configuration with custom certificates:
/etc/docker/certs.d/ <-- Certificate directory
└── localhost:5000 <-- Hostname:port
├── client.cert <-- Client certificate
├── client.key <-- Client key
└── ca.crt <-- Certificate authority that signed
the registry certificate
You can also have this directory structure, as long as the CA certificate is also in your keychain.
/Users/<user>/.docker/certs.d/
└── <MyRegistry>:<Port>
├── client.cert
└── client.key
To learn more about how to install a CA root certificate for the registry and how to set the client TLS certificate for verification, see Verify repository client with certificates in the Docker Engine topics.
Install shell completion
Docker Desktop comes with scripts to enable completion for the docker
,
docker-machine
, and docker-compose
commands. The completion scripts may be
found inside Docker.app
, in the Contents/Resources/etc/
directory and can be
installed both in Bash and Zsh.
Bash
Bash has built-in support for
completion To activate completion for Docker commands, these files need to be
copied or symlinked to your bash_completion.d/
directory. For example, if you
installed bash via Homebrew:
etc=/Applications/Docker.app/Contents/Resources/etc
ln -s $etc/docker.bash-completion $(brew --prefix)/etc/bash_completion.d/docker
ln -s $etc/docker-machine.bash-completion $(brew --prefix)/etc/bash_completion.d/docker-machine
ln -s $etc/docker-compose.bash-completion $(brew --prefix)/etc/bash_completion.d/docker-compose
Add the following to your ~/.bash_profile
:
[ -f /usr/local/etc/bash_completion ] && . /usr/local/etc/bash_completion
OR
if [ -f $(brew --prefix)/etc/bash_completion ]; then
. $(brew --prefix)/etc/bash_completion
fi
Zsh
In Zsh, the completion
system takes care of things. To activate completion for Docker commands,
these files need to be copied or symlinked to your Zsh site-functions/
directory. For example, if you installed Zsh via Homebrew:
etc=/Applications/Docker.app/Contents/Resources/etc
ln -s $etc/docker.zsh-completion /usr/local/share/zsh/site-functions/_docker
ln -s $etc/docker-machine.zsh-completion /usr/local/share/zsh/site-functions/_docker-machine
ln -s $etc/docker-compose.zsh-completion /usr/local/share/zsh/site-functions/_docker-compose
Give feedback and get help
To get help from the community, review current user topics, join or start a discussion, log on to our Docker Desktop for Mac forum.
To report bugs or problems, log on to Docker Desktop for Mac issues on GitHub, where you can review community reported issues, and file new ones. See Logs and Troubleshooting for more details.
For information about providing feedback on the documentation or update it yourself, see Contribute to documentation.
Docker Hub
Select Sign in /Create Docker ID from the Docker Desktop menu to access your Docker Hub account. Once logged in, you can access your Docker Hub repositories and organizations directly from the Docker Desktop menu.
For more information, refer to the following Docker Hub topics:
Two-factor authentication
Docker Desktop enables you to sign into Docker Hub using two-factor authentication. Two-factor authentication provides an extra layer of security when accessing your Docker Hub account.
You must enable two-factor authentication in Docker Hub before signing into your Docker Hub account through Docker Desktop. For instructions, see Enable two-factor authentication for Docker Hub.
After you have enabled two-factor authentication:
-
Go to the Docker Desktop menu and then select Sign in / Create Docker ID.
-
Enter your Docker ID and password and click Sign in.
-
After you have successfully signed in, Docker Desktop prompts you to enter the authentication code. Enter the six-digit code from your phone and then click Verify.
After you have successfully authenticated, you can access your organizations and repositories directly from the Docker Desktop menu.
Where to go next
-
Try out the walkthrough at Get Started.
-
Dig in deeper with Docker Labs example walkthroughs and source code.
-
For a summary of Docker command line interface (CLI) commands, see Docker CLI Reference Guide.
-
Check out the blog post, What’s New in Docker 17.06 Community Edition (CE).


{% extends "layout.html" %} {%block content%}
|
Matches shown from most likely to least likely. Key for scores: 0.00 to 0.15 good match 0.15 to 0.35 likely match 0.35 to 0.55 possible match >0.55 some similarities |
Images shown for scores less than 0.5 difference
Click on the image to see full size version |
| Search: {{r.0}} |
|
|---|---|
| Found: | |
|
{{rr.0}}
|
{%if rr.1 < 0.5 %} {% else %} image link {% endif %} |


PLANET SICK-BOY: http://www.sick-boy.com
With its cast of up-and-coming non A-list stars, Suicide Kings profoundly succeeds where other all-boy ensemble casts (like The Newton Boys) generally fail. It is a wickedly dark comedy that revolves around dual kidnappings, one the daughter of a wealthy New York family and the other of an ex-Mafia boss.
The first abduction is of Lisa Chasten (Laura R. Harris), who is scooped up whilst in the throes of parking lot passion with her secret boyfriend and doctor wannabe, Max Minot (Jeremy Sisto, Clueless). Max is the only witness to the crime, but can offer precious few details.
Although he is affluent beyond my wildest dreams, Lisa's father can't get his hands on the two million-dollar ransom and misses the first payoff deadline. Then, one of Lisa's digits is delivered, so the picture shifts to a backup plan.
It seems that Lisa's brother Avery (Henry Thomas, Niagara, Niagara) decides to befriend and kidnap Charles Barrett (Christopher Walken, The Prophecy). Why Charles Barrett? Well, here's one clue – his name used to be Carlo Bertolucci. Charles decided to change it when he retired as the head of the New York crime family syndicate, on the road to the straight and narrow.
Avery, Max and their bratty socialite schoolmates, Brett (Jay Mohr, Jerry Maguire) and T.K. (Sean Patrick Flannery, Powder) figure if they can get Charles attention, he can help locate Lisa's captors and quickly resolve the whole incident. They befriend him at his daily dinner digs, convince him to take a little car ride through his `old neighborhood' and hit him with the chloroform once the trip begins.
Dragging him back to a summer home of the Chasten family, the rich kids demand assistance from the drugged Charles. Enter comic relief from geeky worrywart Ira (Johnny Galecki, Roseanne) and shoe fetishist Lono Vecchio (Denis Leary, The Ref) and that's when real fun begins.
Suicide Kings is wryly written by Wayne Rice and Gina Goldman, the latter a producer of the television series The Wonder Years. It is the feature film debut of Peter O'Fallon, an Emmy award winning director best known for his work on such shows as Northern Exposure, thirtysomething and Party of Five.
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


Ferris Fencing is a live tournament in which player-programmed bots combat each other on a RISC-V virtual machine.
It is a showcase of CKB-VM, a simple implementation of the RISC-V instruction set, written in the Rust programming language.
The Ferris Fencing tournament is not yet live (the above is a demo), but fencers may begin building their bots and testing them locally. Instructions are in the GitHub repo.
Matches are contested between two fencers, each named Ferris, and each running in their own VM.
The fencers square off on a two-dimensional grid 10 spaces wide.
Each match consists of 5 games. The player to win the most games wins the match.
Games consist of up to 20 turns. Each turn, Ferris may move forward one space, backward one space, stand in place, or lunge two spaces toward the opponent.
A game is won by lunging and landing on the spame space as the opponent lands. Beware though — a lunge can be countered, and the game won, by stepping backward into an opposing lunge, parying it.
Otherwise, colliding fencers repel each other proportionate to the relative strength of their moves.
Fencers have limited energy (CPU cycles) per game, and in the event of a tie, the fencer with the most remaining energy wins.
Ferris Fencing was created for Rust.Tokyo 2019 by Aimee Zhu and Brian Anderson.


Package org.apache.sis.util.logging
Interface WarningListener<S>
-
- Type Parameters:
S
- the base type of objects that emit warnings (the source).
- All Superinterfaces:
EventListener
@Deprecated public interface WarningListener<S> extends EventListener
Deprecated.Replaced byFilter
.Intercepts non-fatal error messages logged byDataStore
or other SIS objects. Warnings are encapsulated inLogRecord
objects and logged atLevel.WARNING
if the emitter does not have registered anyWarningListener
. This listener allows applications to intercept warning records for displaying them in a dialog (or any other action that the application may choose) instead than logging them.Comparison with alternative approaches: it is also possible to listen to login events by registering a customHandler
to the logger. ButHandler
instances are registered on a per-logger basis and receive all messages sent to that logger regardless their emitter. By contrast,WarningListener
instances are registered on a per-DataStore
basis (or any other emitter) and receive all messages sent by that emitter regardless the destination logger. The emitter is part of the information given to thewarningOccured(Object, LogRecord)
method, in addition to the log record.- Since:
- 0.3
- See Also:
WarningListeners
,DataStore.addWarningListener(WarningListener)
,StoreListener
Defined in the
sis-utility
module
-
-
Method Summary
All Methods Instance Methods Abstract Methods Default Methods Deprecated Methods Modifier and Type Method Description default Filter
asFilter()
Deprecated.Wraps this listener in ajava.util.logging.Filter
for transitioning to the replacement of this interface.Class<S>
getSourceClass()
Deprecated.Returns the type of objects that emit warnings of interest for this listener.void
warningOccured(S source, LogRecord warning)
Deprecated.Reports the occurrence of a non-fatal error.
-
-
-
Method Detail
-
getSourceClass
Class<S> getSourceClass()
Deprecated.Returns the type of objects that emit warnings of interest for this listener. This is typically, but not necessarily, the class having the name returned byLogRecord.getSourceClassName()
, or one of its parent classes.- Returns:
- the base type of objects that emit warnings (the source).
-
warningOccured
void warningOccured(S source, LogRecord warning)
Deprecated.Reports the occurrence of a non-fatal error. The emitter process (often aDataStore
in the midst of a reading process) will continue following the call to this method.The
LogRecord
provides the warning message together with programmatic information like the source class name and method name where the warning occurred. The log record may optionally contains the exception which has been thrown.Applications may choose to ignore the warning, display a dialog or take any other action they choose. Applications do not need to log the warning, since logging will be done automatically if the emitter has no registered warning listeners.
- Parameters:
source
- the object that emitted a warning, ornull
if not available.warning
- the warning message together with programmatic information.
-
asFilter
default Filter asFilter()
Deprecated.Wraps this listener in ajava.util.logging.Filter
for transitioning to the replacement of this interface.
-
-


Adding a Glossary Term
To add a term to the glossary, access the Glossary tool and follow these steps:
- If you do not see the Glossary menu bar, click the Reset button.
- Click the Add link on the menu bar. Sakai displays the Add Glossary Term screen.
- In the Term box, enter the term you need to define.
- In the Short Description box, enter a brief definition of the term.
- In the Long Description box, enter a longer definition or description, or add more extensive information to help participants
fully understand the term. Use the icons and pulldown lists to format the text as appropriate.
- Click the Add Term button. Sakai adds the term to the glossary and displays it in the list on the home page. The new term
and the short definition you entered for it are displayed in the list.
Or, to return to the home page without adding the term, click Cancel.


{% extends "base_uikit.html" %} {% block content %} {% load static %} {% load sass_tags %}
Chetah is a search engine for UN and NGOs reports and it summarizes reports with the state of the art deep learning algorithm, BERT. Users can search by applying filters of UN Clusters. This phase 1 product has reports from IFRC, IWA and UNICEF. It retrieves evidence-based program reports and annual reports. The results have been proven better than the Google and Bing for Non-profit sector, with an F1-score of 0.78. It is developed to help NGO program managers and policy makers to design programs and grant funds. This tool aims to provide better answers for nonprofit work and eventually to help solve the crucial real problems that NGO and UN are facing.
Please use the filters for specific UN clusters:
Report Title: {{search_result.title}}
Date Published: {{search_result.date}}
Link: Go to report
Cluster(s): {{search_result.cluster}}
Summary: {{search_result.summary_short}}...


Reports: Manchester United’s eight-man transfer shortlist revealed
by HarigovindAccording to reports, Premier League giants Manchester United have assembled a transfer shortlist consisting of eight long-term, key targets ahead of the upcoming January transfer window.
Mirror claims that Manchester United’s attack is the focal point of manager Ole Gunnar Solskjaer’s attention, as an overwhelming majority of his eight-man shortlist are attackers.
It is no secret that the Red Devils are keen to sign Jadon Sancho and Erling Braut Haaland, from Borussia Dortmund and RB Salzburg respectively.
Sancho has reportedly informed Dortmund that the ongoing 2019-20 season will be his final year in Germany, ahead of a potential return to England, his home country.
Liverpool are also interested in the former Manchester City player, which is why Solskjaer has planned a bid for Haaland as an alternative.
Apart from Sancho and Haaland, Manchester United are considering offers for other attackers like Moussa Dembele of Olympique Lyonnais, Callum Wilson of AFC Bournemouth and Jack Grealish of Aston Villa.
Three midfielders – namely, Declan Rice of West Ham United, James Maddison of Leicester City and John McGinn of Aston Villa – complete Solskjaer’s wishlist.
According to Mirror, all eight players are together expected to cost Manchester United a massive transfer fee of £415million, based on their current valuations.


- establishConnection(String, String, String) - Method in class com.monk.CSV
-
This method establishes a connection to the monitoring backend
by generating an individual object depending on the backend.
- establishConnection(String, String, String) - Method in class com.monk.Influx
-
This method establishes a connection to the monitoring backend
by generating an individual object depending on the backend.
- establishConnection(String, String, String) - Method in class com.monk.Prometheus
-
This method establishes a connection to the monitoring backend
by generating an individual object depending on the backend.
- establishConnection(String, String, String) - Method in interface com.monk.spi.MonitoringBackend
-
This method establishes a connection to the monitoring backend
by generating an individual object depending on the backend.
- executeQueries() - Method in class com.monk.executor.QueryExecutor
-
Contains the logic to select which provider is used and starts execution


PLUGINVIEWER
Section: Maintenance Commands (8)Updated: Apr 10, 2006
Index Return to Main Contents
NAME
pluginviewer - list loadable SASL plugins and their propertiesSYNOPSIS
pluginviewer [-a] [-s] [-c] [-b min=N,max=N] [-e ssf=N,id=ID] [-m MECHS] [-x AUXPROP_MECH] [-f FLAGS] [-p PATH]DESCRIPTION
pluginviewer can be used by a server administrator to troubleshoot SASL installations. The utility can list loadable (properly configured) client and server side plugins, as well as auxprop plugins.OPTIONS
- -a
- List auxprop plugins.
- -s
- List server authentication (SASL) plugins.
- -c
- List client authentication (SASL) plugins.
- -b min=N1,max=N2
- List client authentication (SASL) plugins. Strength of the SASL security layer in bits. min=N1 specifies the minumum strength to use (1 => integrity protection). max=N2 specifies the maximum strength to use. Only SASL mechanisms which support security layer with strength M such that N1 <= M <= N2 will be shown.
- -e ssf=N,id=ID
- Assume that an external security layer (e.g. TLS) with N-bit strength is installed. The ID is the authentication identity used by the external security layer.
- -m MECHS
- Limit listed SASL plugins to the ones included in the MECHS (space separated) list.
- -x AUXPROP_MECHS
- Limit listed auxprop plugins to the one listed in the AUXPROP_MECHS (space separated) list.
- -f FLAGS
- Set security flags. FLAGS is a comma separated list of one or more of the following security flags: noplain (SASL mechanism doesn't send password in the clear during authentication), noactive (require protection from active attacks), nodict (require mechanisms which are secure against passive dictionary attacks), forwardsec (require forward secrecy), passcred (require mechanisms that can delegate client credentials), maximum (require all security flags).
- -p PATH
- Specifies a colon-separated search path for plugins.
SEE ALSO
- rfc2222 - Simple Authentication and Security Layer (SASL)
-
Index
This document was created by man2html, using the manual pages.
Time: 05:34:28 GMT, December 24, 2015


--- layout: default title: Registration permalink: /registration-student-dorm-late/ image: sgm_hall1.jpg modal: all --- {% include top-section.html %}
You need to submit two forms below: (i) Registration Form and (ii) Payment Form. We will send you an e-mail after we confirm your registration.