If you run Authentik (a good homelab-friendly SSO provider for logins), you may have mounted the Letsencrypt /etc/letsencrypt folder into the Authentik worker as /certs, following the Docker Compose installation instructions. What’s supposed to happen is that Authentik runs a cron job to scan the contents of /certs, recognizes and picks up any certificates along with private keys and imports them for use in the built-in web server. Supposedly, Authentik recognizes the certbot-style folder and can handle it.
A bug in Authentik 2026.5.x causes the certificate_discovery task to spam entries into the authentik_tasks_task table — sometimes ballooning to millions of rows and gigabytes of bloat:
SELECT count(*) FROM authentik_tasks_task WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'; count --------- 4899978 (1 row)
SELECT schemaname, relname AS table_name, pg_size_pretty(pg_total_relation_size(relid)) AS total_size, pg_size_pretty(pg_relation_size(relid)) AS table_size, pg_size_pretty(pg_total_relation_size(relid) - pg_relation_size(relid)) AS indexes_toast_size FROM pg_catalog.pg_statio_user_tables ORDER BY pg_total_relation_size(relid) DESC LIMIT 10; schemaname | table_name | total_size | table_size | indexes_toast_size ------------+-----------------------------------------------------------------+------------+------------+-------------------- public | authentik_tasks_task | 4705 MB | 2100 MB | 2605 MB public | authentik_tasks_tasklog | 355 MB | 242 MB | 113 MB ...
Predictably, this ballooned the size of the PostgreSQL database on disk, and created some very unexpected problems for a Docker container that uses overlayfs.
There are related issues identified on GitHub (#19299, #22742) but no one has posted a precise cleanup solution for this. Cleanup worker tasks hang and stall other tasks. Postgres is itself in a dire condition.
Marvel at the size of the tables:
$ docker compose exec postgresql psql -U authentik -d authentik -c "select actor_name, count(*) from authentik_tasks_task group by actor_name ORDER BY count DESC;"
$ docker compose exec postgresql psql -U authentik -d authentik -c "SELECT actor_name, pg_size_pretty(SUM(pg_column_size(t))) AS total_size, COUNT(*) AS row_count FROM authentik_tasks_task t GROUP BY actor_name ORDER BY SUM(pg_column_size(t)) DESC;" actor_name | total_size | row_count --------------------------------------------------------------------------------------+------------+----------- authentik.crypto.tasks.certificate_discovery | 1009 MB | 4899978
Solution
Before doing anything destructive, take a backup of your VM, or at the very least, of the current contents of the Postgres database.
You may need to stop the Authentik containers, keeping only Postgres running, then clean up the data manually. Rather than pasting commands that use sudo docker compose exec..., start up a Postgres shell with docker compose exec -i postgresql psql -U authentik -d authentik first.
First, figure out how many tasks there are to clean up in the authentik_tasks_task table:
SELECT count(*) FROM authentik_tasks_task WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery';
There are foreign key constraints, so you can’t just drop these rows; you’ve got to delete the other references in other tables first.
Run a sanity check to see how many rows would be deleted if you did a purge of anything older than 14 days:
SELECT
(SELECT count(*) FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days') AS task_rows,
(SELECT count(*) FROM authentik_tasks_tasklog
WHERE task_id IN (SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days')) AS tasklog_rows,
(SELECT count(*) FROM authentik_tasks_taskdependency
WHERE task_id IN (SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days')
OR dependency_id IN (SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days')) AS taskdependency_rows;
If you get a sane output like this, you are ready to go. For safety, use a transaction (start with BEGIN; and, only when all commands have returned, COMMIT;).
BEGIN;
DELETE FROM authentik_tasks_taskdependency
WHERE task_id IN (
SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days'
)
OR dependency_id IN (
SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days'
);
DELETE FROM authentik_tasks_tasklog
WHERE task_id IN (
SELECT message_id FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days'
);
DELETE FROM authentik_tasks_task
WHERE actor_name = 'authentik.crypto.tasks.certificate_discovery'
AND mtime < now() - interval '14 days';
COMMIT;
Depending on how many rows remain that are newer than 14 days, you may need to repeat this exercise and just drop rows older than 1 day (keeping some more recent tasks in case for some reason you need to audit more recent events).
You might want to check the Postgres logs too, but when it’s all done, likely a VACUUM FULL or VACUUM ANALYZE is needed to recover the disk space. Gigabytes and gigabytes of disk space.
I use a Grandstream GRP2616 SIP deskphone—I’m a lawyer after all, and teleconferences are no fun on a cell phone when working from home. When I put stuff away during the pandemic, I lost track of the RJ9-to-QD cord that allowed an analog Jabra Biz 2400 II QD (quick disconnect) headset to work with the phone. The Cisco-compatible Jabra cord, 8800-00-37 that I had does not work on the Grandstream phone: I could hear, but the mic was clearly not transmitting.
There are forums online where people complain about the same issue. It’s because all the companies vary in how they utilize the 4 pins of the RJ9 cable.
Grandstream’s outdated compatibility charts point to the GN1200 smart cord, but did not say which setting to use. The GN1200 cable has a dip switch for those various headset cabling standards, and it turns out that I needed setting 4 (“Japanese phones, NEC, Nitsuko”) which has the M+ and M- wires reversed from the standard setting. This works with both the earpiece (for listening) and the microphone (for talking).
This post represents the views of the undersigned author only. You should consult a lawyer of your own if you want advice on your situation. See disclosures.
On April 1, 2023, Zoom sent an email to users stating that it had updated its Terms of Service. Purportedly those changes had an effective date of March 31, 2023—ponder how that works for formation of a valid contract, and just how much “bargaining” power consumers really had in that.[1]
If you are a Zoom user, you should opt out to preserve your rights in case a future dispute arises and you want to be able to sue them in real court (or benefit from a federal class action brought by others). Here’s how to do it:
27.11 Opt-Out. You may reject this Arbitration Agreement and opt out of arbitration by sending an email to opt-out@zoom.us within (i) thirty (30) calendar days of April 1, 2023 if you are an existing user, or (ii) thirty (30) calendar days of the date you created your account if you are a new user. Your opt-out notice must be individualized and must be sent from the email address associated with your individual Zoom account. An opt-out notice that purports to opt out multiple parties will be invalid as to all such parties. No individual (or their agent or representative) may effectuate an opt out on behalf of other individuals. Your notice to opt-out must include your first and last name, address, the email address associated with your Zoom account, and an unequivocal statement that you decline this Arbitration Agreement. If you do decide to opt out, that opt out will apply to this Arbitration Agreement and all previous versions thereof, and neither party will have the right to compel the other to arbitrate any Dispute. However, all other parts of this Arbitration Agreement will continue to apply to you, and opting out of this Arbitration Agreement has no effect on any other arbitration agreements that you may enter into in the future with us.
The new arbitration agreement is incredibly long—and different from what used to be standard arbitration provisions.
Unlike normal arbitration agreements of years past, which (simply) banned class actions and forced people to proceed individually and confidentially in arbitration, this version dictates what happens if a lot of customers individually sue in arbitration.
So these contractual changes try to get back some of the efficiency of aggregation, while still denying people a chance to have that fight in real courts—courts that are accustomed to supervising class actions and deciding claims on an aggregate basis. Ask yourself: what’s the point? Why try so hard to avoid going to a real federal or state court, unless this works out better for the company?
“The [mandatory arbitration] system is set up to produce skewed, pro-defendant results, because defendants are buyers in the market for private judging: the initial choice of private judging over public dispute resolution belongs solely to the defendants. … This means that arbitration vendors’ biggest marketing incentive is to make arbitration attractive to defendants—more attractive than courts.”
David S. Schwartz, Mandatory Arbitration and Fairness, 84 Notre Dame L. Rev. 1247, 1338 (2009)
The new provisions say, in effect, that if more than 50 people represented by the same lawyers/organizations have similar claims against Zoom, 16 of them get hand-picked and decided first, while everyone else’s claims get paused. Once those 16 “bellwether” claims are decided, everyone else is then forced to mediate (i.e., negotiate), under the theory that the parties will likely settle based on how the bellwether cases fared.
Yet at the same time, the agreement provides separately that the outcome of any one arbitration (e.g., if a consumer wins against the company) shall have “no preclusive effect” in any other one—a rule that, if enforceable, is net helpful to the company because adverse rulings can’t be held against it and have to be re-fought each time. So if the claimants want to pursue their case, they still face the procedural hurdles of arbitration, like limited discovery, almost no option to appeal, and the unavailability of meaningful injunctive relief.[2]
Consumers already don’t read terms of service when they click through a sign-up online. Indeed, many “consumers are unaware of forced arbitration clauses … sometimes hidden inside of envelopes, delivery boxes, and privacy policies”—yet courts have enforced arbitration agreements against consumers who had no actual awareness of the provisions.[3] But how many people understand what this agreement is doing and what it means for their rights? Under what theory of the formation of a valid contract can we really say that a consumer—other than a savvy lawyer—knew what they were “agreeing” to?
This quote shows how long some of the new provisions in Zoom’s arbitration agreement are—and it’s just an excerpt:
27.6 Mass Action Waiver. You and Zoom agree that, except as specified in Section 27.7 below, each of us may bring claims against the other only on an individual basis and not on a class, collective, representative, or mass action basis, and the parties hereby waive all rights to have any Dispute be brought, heard, administered, resolved, or arbitrated on a class, collective, representative, or mass action basis. Subject to this Arbitration Agreement, the arbitrator may award declaratory or injunctive relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by the party’s individual claim. Notwithstanding anything to the contrary in this Arbitration Agreement, if a court decides by means of a final decision, not subject to any further appeal or recourse, that the limitations of this Section 27.6 are invalid or unenforceable as to a particular claim or request for relief (such as a request for public injunctive relief), you and Zoom agree that that particular claim or request for relief (and only that particular claim or request for relief) shall be severed from the arbitration and shall be pursued in the state or federal courts located in San Jose, California. This subsection does not prevent you or Zoom from participating in a class-wide settlement of claims.
27.7 Bellwether Arbitrations. To increase the efficiency of administration and resolution of arbitrations, you and Zoom agree that if there are fifty (50) or more individual arbitration demands of a substantially similar nature brought against either party by or with the assistance of the same law firm, group of law firms, or organizations within a one hundred and eighty (180) day period (“Mass Filing”), the parties shall select sixteen (16) individual arbitration demands (eight (8) per side) for arbitration to proceed (“Bellwether Arbitrations”). Only those sixteen (16) arbitration demands shall be filed with the arbitration provider, and the parties shall hold in abeyance, and not file, the non-Bellwether Arbitrations. Zoom will pay the arbitration provider’s costs for the sixteen (16) Bellwether Arbitrations. The statutes of limitation, including the requirement to file within one (1) year in Section 27.10 below, shall remain tolled when non-Bellwether arbitration demands are held in abeyance. While the Bellwether Arbitrations are adjudicated, no other demand for arbitration that is part of the Mass Filing may be processed, administrated, or adjudicated, and no filing or other administrative costs for such a demand for arbitration shall be due from either party to the arbitration provider. If, contrary to this provision, a party prematurely files non-Bellwether Arbitrations with the arbitration provider, the parties agree that the arbitration provider shall hold those demands in abeyance.
All parties agree that arbitration demands are of a “substantially similar nature” if they arise out of or relate to the same event or factual scenario and raise the same or similar legal issues and seek the same or similar relief. Any party may request that the arbitration provider appoint a sole standing administrative arbitrator (“Administrative Arbitrator”) to determine threshold questions such as (i) whether the Bellwether Arbitration process is applicable or enforceable, (ii) whether particular demand(s) are part of a Mass Filing, and (iii) whether demands within a Mass Filing were filed in accordance with this Agreement, including Section 27.3. In an effort to expedite resolution of any such dispute by the Administrative Arbitrator, the parties agree that the Administrative Arbitrator may set forth such procedures as are necessary to resolve any disputes promptly. The Administrative Arbitrator’s costs shall be paid by Zoom.
The parties shall work in good faith with the arbitrator to complete each Bellwether Arbitration within one hundred and twenty (120) calendar days of its initial pre-hearing conference. The parties agree that the Bellwether Arbitration process is designed to achieve an overall faster, more efficient, and less costly mechanism for resolving Mass Filings, including the claims of individuals who are not selected for a Bellwether Arbitration.
Following resolution of the Bellwether Arbitrations, the parties agree to engage in a global mediation of all remaining arbitration demands comprising the Mass Filing (“Global Mediation”). The Global Mediation shall be administered by the arbitration provider administering the Bellwether Arbitrations. If the parties are unable to resolve the remaining demands for arbitration comprising the Mass Filing within thirty (30) calendar days following the mediation, the remaining demands for arbitration comprising the Mass Filing shall be filed and administered by the arbitration provider on an individual basis pursuant to the arbitration provider’s rules, unless the parties mutually agree otherwise in writing. Any party may request that the arbitration provider appoint an Administrative Arbitrator to determine threshold questions regarding the newly filed demands.
The parties agree to cooperate in good faith with the arbitration provider to implement the Bellwether Arbitration process, including the payment of filing and administrative costs for the Bellwether Arbitrations, deferring any filing costs associated with the non-Bellwether Arbitration Mass Filings until the Bellwether Arbitrations and subsequent Global Mediation have concluded, and cooperate on any steps to minimize the time and costs of arbitration, which may include: (i) the appointment of a discovery special master to assist the arbitrator in the resolution of discovery disputes; and (ii) the adoption of an expedited calendar of the arbitration proceedings. This Bellwether Arbitration provision shall in no way be interpreted as authorizing a class, collective, or mass action of any kind, or an arbitration involving joint or consolidated claims under any circumstances, except as expressly set forth in this provision. The statutes of limitation applicable to each arbitration demand within a Mass Filing, including the requirement to file within one (1) year in Section 27.10 below, shall remain tolled from the time a party makes a Pre-Arbitration Demand to the time when that party files the arbitration demand with the arbitration provider.
27.8 Settlement Offers and Offers of Judgment. At least ten (10) calendar days before the date set for the arbitration hearing, you or Zoom may serve a written offer of judgment upon the other party to allow judgment on specified terms. If the offer is accepted, the offer with proof of acceptance shall be submitted to the arbitration provider, who shall enter judgment accordingly. If the offer is not accepted prior to the arbitration hearing or within thirty (30) calendar days after it is made, whichever occurs first, it shall be deemed withdrawn, and cannot be given as evidence in the arbitration. If an offer made by one party is not accepted by the other party, and the other party fails to obtain a more favorable award, the other party shall not recover their post-offer costs and shall pay the offering party’s costs from the time of the offer (which, solely for purposes of offers of judgment, may include reasonable attorneys’ fees to the extent they are recoverable by statute, in an amount not to exceed the damages awarded).
The parties agree that any disputes with respect to settlement offer(s) or offer(s) of judgment in a Mass Filing are to be resolved by a single arbitrator to the extent such offers contain the same material terms. For arbitrations involving represented parties, the represented parties’ attorneys agree to communicate individual settlement offer(s) or offer(s) of judgment to each and every arbitration claimant or respondent to whom such offers are extended.
27.9 Arbitration Costs. Except as provided for in a Mass Filing (see Section 27.7), your responsibility to pay any filing, administrative, and arbitrator costs will be solely as set forth in the applicable arbitration provider’s rules. If you have a gross monthly income of less than 300% of the federal poverty guidelines, you may be entitled to a waiver of certain arbitration costs.
27.10 Requirement to File Within One Year. To the extent permitted by applicable Law, and notwithstanding any other statute of limitations, any claim or cause of action under this Agreement (with the exception of disputes under Section 27.2(2)) must be filed within one (1) year after such claim or cause of action arose, or else that claim or cause of action will be permanently barred. The statute of limitations and any arbitration cost deadlines shall be tolled while the parties engage in the informal dispute resolution process required by Section 27.3 above.
One other change of note: Whereas the older, short arbitration agreement elected to use the American Arbitration Association to decide claims, the new contract selects National Arbitration & Mediation (NAM).
Think about how the changes to the arbitration agreement reveal the imbalance in bargaining power on this supposed “agreement.” Zoom had the ability to purportedly replace its entire earlier arbitration agreement (“This Arbitration Agreement supersedes all prior versions.”)—but individual consumers have no such ability to do that. At any time, Zoom purportedly can change not just how claims are arbitrated but even who presides over the arbitration—but you, you normal person, you don’t get to do that.
In fact, Zoom even included a provision that you can’t even have an agent send your opt-out of arbitration on your behalf. You don’t get to use a lawyer. You don’t get to opt out for your minor child.
Your opt-out notice must be individualized and must be sent from the email address associated with your individual Zoom account. An opt-out notice that purports to opt out multiple parties will be invalid as to all such parties. No individual (or their agent or representative) may effectuate an opt out on behalf of other individuals.
To be clear, Zoom isn’t the only company making these changes. In recent months, Showtime (updated January 12, 2023), HBO Max (updated December 20, 2022), have all added similar mass-claim provisions that switch to using NAM as the arbitration provider. Query why they are all flocking away from AAA and JAMS to NAM, and what that suggests about what kind of incentives there are for NAM to differentiate itself from the other providers by being… more friendly to defendant companies?
And Showtime’s terms, most egregiously, even purport to limit discovery—making it that much harder for a claimant to get the internal evidence proving their claim.[4] And these agreements have suspiciously similar wording, suggesting that maybe the same lawyers are responsible for putting these changes in.
How we got here
Historically, class actions in courts allowed for aggregation of many claims (sometimes claims from people nationwide) in one case. Those rules were intended to enable efficient and fair resolution of disputes that share a common legal cause. That’s important where the actions of one national or multinational company could easily affect millions of users—and simultaneously harm millions of people with a common legal claim against the company.
To avoid mass torts and class actions, companies started putting in arbitration agreements to try to foreclose that type of lawsuit, achieving their own form of private tort reform. It is conventional for arbitration agreements to force claims to be arbitrated on an individual basis.
But clever plaintiff’s lawyers figured out how to game the system: if they had 1000 clients who were arguably harmed, they could file 1000 demands for individual arbitration, all following the express terms of the arbitration agreement. Since many agreements required the company to pay for the cost of filing the arbitration,[5] this strategy could rack up a giant bill for the company, to proceed with the arbitration.
12,500 Uber drivers did exactly that: filing many similar (even verbatim) claims individually against the company. That caused Uber to get in a legal fight with the arbitration provider, JAMS! Uber tried to weasel out of paying the arbitration fees by arguing that JAMS could aggregate the claims or work more efficiently on common issues.
This all should be banned. And lawyers who are trying to take advantage of the system this way should really question whether what they are doing is good for their clients or good for the system. Egregious abuse of mandatory arbitration is a surefire way to attract the attention of legislators.
Over the past several decades, forced arbitration clauses have become virtually ubiquitous in everyday contracts. Often buried deep within the fine print of employment and consumer contracts, forced arbitration deprives millions of Americans of their day in court to enforce state and federal rights. Because arbitration lacks the transparency and precedential guidance of the justice system, there is no guarantee that the relevant law will be applied to these disputes or that fundamental notions of fairness and equity will be upheld in the process.
Unlike the judicial system—in which courts’ decisions are generally public and, by building on precedent, cumulatively create a body of law—the results of arbitration disputes are often kept secret. …
Additionally, the company imposing arbitration often selects the presiding arbitrator or arbitration provider, creating a conflict of interest in which the purportedly neutral arbitrator may be motivated by the prospect of obtaining repeat business from the company rather than focused on fairly assessing the claim. …
As a result of the decline of enforcement of state and federal statutory protections, forced arbitration makes it more likely that corporate harms and abuse will go unchallenged. … as Professor Gilles observes, “forced arbitration is not an alternative regime for resolving claims, it is a means of suppressing legal claims altogether.” Judge William G. Young, who was appointed by President Ronald Reagan, likewise stated that the proliferation of forced arbitration clauses means that “business has a good chance of opting out of the legal system altogether and misbehaving without reproach.”
It’s time for Congress to take up this bill again. Mandatory arbitration is systematically unfair to consumers, and these recent changes show just how far companies will go to press their advantage in this private system.
Section 15.1 says it’s your responsibility as a customer to monitor their contractual changes, and “If you continue to use the Services after the effective date of the Changes, then you agree to the revised terms and conditions.” Seems dubious if the effective date was before it told customers.
“An arbitration award shall have no preclusive effect in another arbitration or court proceeding involving Zoom and a different individual.” Section 27.4. On its face, this could cut both ways, both helping the company avoid preclusive unfavorable rulings, and harming the company where favorable rulings should also apply to later claims. But under ordinary preclusion doctrines, some decisions that are favorable to the company can’t be held against future claimants who had no ability to participate in the earlier dispute or whose facts differ, whereas some decisions that are unfavorable to the company can be held against it despite the difference in the identity of the later claimant. On balance, this sort of rule probably skews slightly in favor of the company.
Section 1.3 (“Discovery During Arbitration”) in Showtime’s terms provides: “The parties shall each be limited to a maximum of one (1) fact witness deposition per side… Document requests shall be limited to documents that are directly relevant to the matter(s) in dispute or to its outcome; shall be reasonably restricted in terms of time frame, subject matter and persons or entities to which the requests pertain; shall not include broad phraseology such as ‘all documents directly or indirectly related to’; and shall not be encumbered with extensive ‘definitions’ or ‘instructions.’ … Electronic discovery, if any, shall be limited as follows. Absent a showing of compelling need: (i) electronic documents shall only be produced from sources used in the ordinary course of business, and not from backup servers, tapes or other media; (ii) the production of electronic documents shall normally be made on the basis of generally available technology in a searchable format that is usable by the requesting party and convenient and economical for the producing party; (iii) the parties need not produce metadata, with the exception of header fields for email correspondence; (iv) the description of custodians from whom electronic documents may be collected should be narrowly tailored to include only those individuals whose electronic documents may reasonably be expected to contain evidence that is material to the dispute; and (v) where the costs and burdens of e-discovery are disproportionate to the nature of the dispute or to the amount in controversy, or to the relevance of the materials requested, the arbitrator may either deny such requests or order disclosure on the condition that the requesting party advance the reasonable cost of production to the other side, subject to the allocation of costs in the final award.” How many consumers understand what the heck this is about?
Microsoft’s Facebook ad for new features in Excel highlights the Treemap visualization, but gets it totally wrong.
A treemap is supposed to visualize relative size in a hierarchy. But in the illustration here, the data don’t fit this type of visualization (it’s a time series of one flat variable—without hierarchy).
But it’s even worse than that. The relative sizes don’t make sense! Why would the 31 MPG box for January be so much larger than the 32 MPG box for May?
This seems like a great illustration of why math/statistical education should be required for everyone—even visual designers and marketers. Or at least, the people selling the product should understand what the software actually does.
A friend directed my attention to a startup-y website selling “cheap smartphone [insurance] coverage” for “as little as $3 a month”. Right at the top of the Penn-branded subdomain (penn.getcovered.co) was an iPhone mockup showing the Penn shield:
Outside sponsors of University programs or activities often seek to use University names or insignia in promotional or advertising materials. While the University is pleased to recognize the contributions of sponsors, such recognition must not suggest University endorsement of the sponsor’s activities. Therefore, University names or insignia may not be used in connection with any outside entity’s name or logo without prior approval of the Secretary of the University. In general, the Secretary will approve uses which recognize or acknowledge the sponsor’s contribution to the University program or activity. Uses which, in the Secretary’s judgment, may suggest University endorsement or approval of the sponsor’s goods or services will not be permitted.
The big issue, of course, is the risk of confusion — by consumers, etc — who might think that the service is sponsored or endorsed by the university. There would be a pretty good prima facie case for trademark infringement, especially since the registrant behind the domain name appears to be a Stanford grad with no connection to Penn.
But to top it all off, the site seems to be lying on its face. The Penn page includes a quote from a “Leah B, Philadelphia, PA”:
but the exact same quote is used on the non-Penn-branded homepage of GetCovered, this time from “Leah B, Washington, DC”!
As an alum, I certainly don’t want the university’s shield to be used in connection with this company. What they’re doing is strangely reminiscent of the Campus Backup service that OCM was marketing a few years ago — which shut down after my blog post overtook their site in search engines.
They’re hidden away in the optional features (“Pan-European Supplemental Fonts”), but easily installable from Settings -> System -> Apps & features -> Manage optional features.
Most of these are a refresh on classic Windows fonts like Arial, Georgia, and Verdana, but they should come as a welcome surprise!
Georgia Pro Condensed Italic
Happy prerelease testing!
Update: upon request, here are side-by-side comparisons of the new fonts. A subset of available weights/variants is shown in each case. Note that, in most cases, the “Pro” versions add new variants (e.g. Condensed, Light, Semibold, etc) but do not differ significantly in the Regular/Bold/Italic/Bold Italic weights from their ancestors.
Arial vs. Arial Nova
Georgia vs. Georgia Pro
Gill Sans MT vs. Gill Sans Nova
Verdana vs. Verdana Pro
Rockwell vs. Rockwell Nova; in this case, the Nova font also has different metrics
For a long time, I’ve been using kickstart scripts (link to GitHub repo) to set up Fedora and CentOS virtual machines on a XenServer host. In the last year or so, the trend of cloud computing has led distributions to release prebuilt “cloud” images in OpenStack-compatible qcow2 or raw disk format, which happen to be broadly compatible with hypervisors. Fedora Cloud’s introduction with F21 prompted me to look into ways of using cloud-init/cloud-config without an entire private cloud infrastructure.
It should no longer be necessary to use a kickstart to install a new VM, because the distribution’s prebuilt images easily work on XenServer with a few conversions.
(Kickstart scripts remain useful for customizing an image, of course; they are often the mechanism with which Linux distros build such images.)
What are prebuilt images?
When I say “prebuilt images”, I mean VM hard disk files released by the Linux distribution. For instance, Fedora 22’s Cloud Base and Atomic Host images are provided in qcow2 and xz’d raw files:
These releases are designed to work in actual cloud infrastructure—meaning a compute hypervisor (usually KVM), a metadata service that supplies configuration like hostname and networking at boot time, and some APIs that can programmatically affect the virtual machine’s behaviour and configuration. OpenStack is the leading example.
But OpenStack is overkill when you’re just virtualizing a handful of VMs. You don’t need a private cloud when you’re not running a cluster or spinning up machines programmatically. That’s exactly why I found myself running XenServer.
Nonetheless, unless you’re using Xen full paravirtualization (which there are now good reasons to avoid), these images should broadly work with all major hypervisors: QEMU-KVM, VirtualBox, Xen PVHVM, VMware, etc… with minor format tweaks.
How to convert a prebuilt image for use in XenServer
Broadly, there are three steps in the process, the first of which is most important:
Convert qcow2 disk image to VHD.
Import VHD in XenCenter.
Customize imported machine and convert to template.
You can optionally also export the template to an XVA file.
1. Convert qcow2 to VHD
The qemu-img utility can do this. Use your package manager of choice to install (e.g. yum install qemu-img or dnf install qemu-img on F22+). You should do this on another Linux machine (even a VM is okay), because messing with the Xen dom0 is not recommended.
Locate your downloaded *.qcow2 file, which might look something like Fedora-Cloud-Base-22-20150521.x86_64.qcow2. If it’s compressed, like CentOS-Atomic-Host-7.1.2-GenericCloud.qcow2.xz, decompress it first.
Use the command $ qemu-img convert -f qcow2 -O vpc [input file] [output file] to do the conversion. For example,
If you have XenCenter installed on Windows, use the File -> Import… option to load the VHD. Follow the prompts to set up the VM’s CPU, memory, storage, and networking allocations.
Manual import on command line
Ugh, not using the UI? That means a whole lot more work to import. Are you sure about this???
If you do not have access to XenCenter, it’s a more involved process.
Transfer the newly converted disk image to the hypervisor dom0, such as by copying it into a shared storage location (e.g. NFS image library), and you should be able to use xe vdi-import to load the VHD:
First, get the size of the disk image with $ qemu-img info [VHD file]. Note the size in bytes.
$ qemu-img info Fedora-Cloud-Base-22-20150521.x86_64.vhd
image: Fedora-Cloud-Base-22-20150521.x86_64.vhd
file format: vpc
virtual size: 3.0G (3221471232 bytes)
disk size: 516M
cluster_size: 2097152
Create a VDI in XenServer using the command line tool to hold this new data:
# set SIZE to size in bytes, e.g.
$ SIZE=3221471232
# set SR to the UUID of a storage repository in which to store the VDI
$ SR=$(xe sr-list name-label='NFS virtual disk storage' --minimal)
$ UUID=$(xe vdi-create name-label=Fedora-Cloud-Base-22-20150521.x86_64 virtual-size=$SIZE sr-uuid=$SR type=user)
If all has gone well, you get output to the effect of
[|] ######################################################> (100% ETA 00:00:00)
Total time: 00:00:24
You can check that it’s there by doing
$ xe vdi-list uuid=$UUID
It’s time to make a VM (important: must be PVHVM) to which to attach this VHD. You’ll need to create the CD drive, set up networking, etc, all on the command line. The CD drive should be installed with a cloud-init/cloud-config datasource. (Aren’t you regretting not using the GUI now?)
$ VM=$(xe vm-install new-name-label=Fedora-Cloud-Base-22-20150521 template='Other install media')
# make an optical drive, which you might need for cloud-init
$ xe vm-cd-add cd-name='cloud-init-example.iso' vm=$VM device=3
# get the list of networks and their UUIDs; select one
$ xe network-list
# the following line is an example
$ xe vif-create network-uuid=b4187ad6-916e-d1d4-90a7-2b7f1353bca2 vm-uuid=$VM device=0
Now, create the virtual block device (VBD) that associates the VHD disk image with the VM.
The VM is now ready (although you’ll need to adjust CPU and RAM, which is outside the scope of this guide), either to be booted or to be stored as a template!
3. Customize and convert to template
I like to convert the now-ready VM to a template before using it for anything. This makes it a lot easier to deploy from this point onward. It’s also helpful to tweak the default CPU/memory parameters if desired.
When it’s ready, you can select a halted VM, and choose VM -> Convert to Template… in XenCenter. The equivalent for the xe CLI is something I haven’t figured out yet; the process might require taking a snapshot, and copying the snapshot to become a template.