Volume ya Production ya Docker to Kubernetes Elongolami: Kobikisa docker system prune --volumes, . overlay2 Inodes, mpe etcd Ba photos ya mbalakaka¶

Kokima mbangu docker compose down -v, . docker system prune -a --volumes, . docker volume rm, to kubectl delete pvc na onglet terminal ya mabe na production ezali moko ya ba façons ya mbangu ya ko effacer volume ya base de données ya PostgreSQL, MySQL, MariaDB, Redis, MongoDB, to SQLite en direct. Na bokeseni na ba instantané ya machine virtuelle ya cloud oyo ekendeke na poubelle ya recyclage ya mikolo 7, pilote ya volume local ya Docker (/var/lib/docker/volumes/<name>/_data) mpe Kubernetes local-path / . hostPath ba fournisseurs babimisaka mbala moko POSIX standard unlink() mpe rmdir() ebengi mbala moko contre système ya ba fichiers ya hôte Linux oyo ezali na se (ext4, . XFS, to Btrfs). Kokoma nionso oyo esalemaka na hôte Linux wana sima ya kosilisa commande ekoki kokoma likolo ya ba blocs ya base de données liberées na disque. Soki disque ya serveur na yo etondi na 100 pour cent (0 bytes free) liboso ete moto moko akima docker system prune --volumes na panique, consulter disque serveur 100% etondi, base de données WAL log bloat, mpe récupération zéro-espace; mpo na bolongoli ya fisyé Linux ya bibende mpamba libanda ya ba récipients, tala rm -rf ya mbalakaka to Shift-Delete na ext4, XFS, APFS, mpe NTFS: remontage kaka ya kotanga mpe kosala mayemi ya inode mpe machine virtuelle VMDK, VHDX, mpe qcow2 snapshot chaîne corruption mpe kobikisa hyperviseur. Soki bokati oyo ya bokeli ezali na bopusi na bobateli ya mobeli ya lopitalo, botindiki ya mbalakaka, to ba systèmes ya bokengi ya ba utilités publiques, benga nimero ya urgence ya esika ofandi (911 na États-Unis mpe na Canada, . 112 na Union européenne mobimba, . 999 na Royaume-Uni) to tala buku na biso ya banimero ya mbalakaka.

Sala boye sikoyo¶

1. KOKIMA TE docker compose up -d, . systemctl restart docker, to kozongisa pod ya Kubernetes: Kosala lisusu récipient to kobanda lisusu démon Docker ekomaka ba mégabytes ya sika overlay2 métadonnées, ba journal JSON ya conteneur, mpe ba fichiers ya base de données ya pamba oyo ebandi sika (initdb) mbala moko likolo ya exact ext4 to mpe XFS ba blocs esika volume na yo oyo elongolamaki efandaki il y a ba secondes.
2. Tala na 5 secondes soki processus ya récipient (postgres, . mysqld, . redis-server, . node, . python) ezali kaka kosala na mémoire (ps aux mpe sudo lsof +L1): Soki moto alongolaki ba fichiers na kati ya volume oyo ekangami to alongoli volume anonyme tango conteneur ezali nanu kosala, noyau Linux ebatelaka 100 pour cent ya ba fichiers ya base de données oyo ezali na lien te na bomoyi na disque soki kaka ID ya Processus ya hôte ya conteneur (PID) esimbaka molimboli ya fisyé oyo efungwami ( .FD). Okoki kosala kopi ya ba fichiers wana directement libanda ya /proc/<PID>/fd/ to mpe /proc/<PID>/root/ na perte ya ba données zéro avant que conteneur etelemela.
3. Soki conteneur esi etelemi mpe volume elongolamaki (docker compose down -v to mpe docker system prune --volumes), congeler disque hôte ekomi mbala moko: Arrêter démon Docker (sudo systemctl stop docker.socket docker.service containerd) yango wana ba récipients ya fond mpe ba healthchecks tika kokoma ba logs na kati /var/lib/docker, na nsima soki to remount /var/lib/docker (to mosisa / bokaboli) botangi kaka ( .sudo mount -o remount,ro /) to zwá fɔtɔ́ ya mbala moko ya volime ya lipata na nivo ya bloc (AWS EBS Snapshot, . GCP Persistent Disk Snapshot, . DigitalOcean Volume Snapshot) liboso ya kosimba eloko moko.
4. Soki ozali na Kubernetes (kubectl delete pvc to mpe kubectl delete namespace), tyá elembo na Volume Persistant ( .PV) . ReclaimPolicy (kubectl get pv) mbala moko:
5. Soki ba PV azalaki na yango persistentVolumeReclaimPolicy: Retain, ba données na yo ezali elongolami te: ba PV kaka kokende kofanda na Released état mpe disque cloud na yo (EBS, . Azure Disk, . Ceph RBD, . NFS) ezali na 100 % ya mbeba.
6. Ata soki kubectl delete pvc ekangami na ** .Terminating**, Kubernetes Ba finalisateurs (kubernetes.io/pvc-protection) ko bloquer pilote CSI a supprimer stockage sous-jacent tant que Pod nionso ezo référer kaka na PVC wana. Ko effacer Pod te tii tango okosala copie ya ba données libanda ya Pod oyo ezali kosala.
7. Elilingi ya eteni ya bloc oyo ezali na se (dd / . ddrescue na SSH) na disque ya libanda to volume ya cloud separate avant ya kosala ext4magic, . extundelete, to PhotoRec: Jamais kosala ba carvers ya ba fichiers oyo ekomaka ba fichiers ya sortie na partition ya disque moko oyo ozali ko récupérer /var/lib/docker/volumes.
8. Mpo na état ya cluster ya Kubernetes oyo ebebi to oyo epangusami na mbalakaka (kubectl delete crd / . namespace), kotika kube-apiserver mpe zongisa ya sika na yo etcd elilingi ya mbala moko (etcdctl snapshot restore): Soki ezalela ya cluster na etcd epangusamaki ntango ba volumes ya kobombama ya lipata oyo ezalaki na nsé ezali naino, kozongisa etcd ezongeli nionso PV, . PVC, . Secret, mpe ConfigMap biloko na mbala moko.

Nzete ya mokano: volume Docker elongolami, . overlay2 couche, to triage ya PVC ya Kubernetes¶

Salelá diagramme oyo mpo na kopona nzela ya bozongisi ya mbangu ya bobungisi zéro na kotalela soki mosala ya conteneur ezali naino na bomoi, soki volume esimbamaki na bobateli ya disque local to ya CSI ya lipata, mpe ba hôtes nini ya système ya ba fichiers /var/lib/docker: 1 .

flowchart TD
    Start["Ba Données ya Production Ezangi Après Commande ya Effacer ya Docker to Kubernetes"] --> WhichEnv{"Plateforme & Commandement Nini E déclenché Perte?"}

    WhichEnv -->|"Docker: Container Ezali Naino Kosala (Ba fichiers oyo ezali na lien te na kati ya Volume/Container)"| ProcRescue["Kobikisa Fungola Ba déscripteurs ya Fisyé oyo ezali na lien te na nzela ya sudo lsof +L1 mpe /proc/PID/fd/N to /proc/PID/root/ ."]

    WhichEnv -->|"Docker: Conteneur etelemi & Volume elongolami (kosala na nse -v / kokata --volumes)"| StopDocker["Mbala moko Tamba: sudo systemctl arrêter docker.socket docker conteneurd"]

    WhichEnv -->|"Kubernetes: kubectl kosilisa pvc / pv / ensemble ya état / esika ya kombo"| K8sCheck{"Pod Ezali Nanu Kosala TO PVC Ekangami na Terminating?"}

    K8sCheck -->|"Oui: Pod Ezali Naino Kosala (Finalizer Blocking CSI Delete)"| K8sExec["KO Effacer Pod TE -> Tambuisa kubectl exec / pg_dump / tar likolo ya stdout na Disque Local Mbala moko"]
    K8sCheck -->|"Te: Pod Esili -> Vérifier kubectl zwa pv"| ReclaimCheck{"Politique ya Reclaim ya PV Ezalaki Nini?"}

    ReclaimCheck -->|"Kobatela (Etat ya PV = Ebimisami) ."| ClearClaimRef["100% Données Intact -> Bobongisi PV mpo na Kolongola spec.claimRef.uid -> Bokanga lisusu na PVC ya Sika"]
    ReclaimCheck -->|"Bolongola (EBS ya lipata / PD / Longhorn / Local-Path)"| CloudOrLocal{"Volume ya CSI ya cloud to Disque ya hôte local?"}

    CloudOrLocal -->|"CSI ya lipata (AWS EBS / GCP / Azure / Ceph) ."| CloudSnap["Vérifier Poubelle de recyclage ya Console ya lipata / Ba snapshots ya EBS automatique / Poubelle ya Ceph RBD (rbd poubelle ls)"]
    CloudOrLocal -->|"Disque Node local (nzela-ya esika / Nzela ya hôte) ."| StopDocker

    StopDocker --> RemountRO["Remount Partition ya hôte na botangi kaka (mount -o remount,ro) TO Stream Bloc Image na SSH"]
    RemountRO --> HostFS{"Système ya ba fichiers nini ezo hôte /var/lib/docker?"}
    HostFS -->|"ext4"| Ext4Rec["Salelá debugfs / ext4magic Journal Inode Transaction Rollback (-embo ya ntango)"]
    HostFS -->|"XFS / Bato ya Btrfs"| CarveRec["Salelá Btrfs Roots / xfs_irecover / Carving ya signature personnalisée mpo na SQLite, Postgres Heap, to InnoDB .ibd"]

Phase 1: Ndenge nini Docker na Kubernetes ba effacer vraiment ba volumes na disque¶

Yambo ya kosala commande nionso ya récupération, sosola esika ba données na yo ezalaki physiquement kofanda na hôte Linux mpe nini commande ya supprimer esimbaki vraiment:

Eteni ya 2: Kobikisa ba fichiers ya base de données ya polele uta na récipient oyo ezali naino kosala (/proc/<pid>/fd/) .¶

Zela: est-ce que récipient ezali kaka kosala sikoyo? Mbala mingi, ingénieur asalaka script ya migration ya application, mosala ya cron ya bopeto, to manuel rm -rf /var/lib/postgresql/data/* to mpe rm /app/data/production.sqlite3 na kati ya récipient oyo ezali kosala, to elongolaka dossier ya bind-mount ya hôte oyo ezali na se /opt/app/data nzokande récipient yango moko (postgres, . mysqld, . mariadbd, . redis-server, . mongod, . gunicorn, . node) ezali naino na mosala.

Na Linux, fichier moko elongolamaka na disque te tango rm to mpe unlink() babengaka yango. Ba blocs ya disque na yango na inode etikalaka 100 pour cent ekabolami mpe ekoki kotangama kino processus ya suka oyo esimbaka descripteur ya fichier ouvert (FD) na inode wana ekanga yango to ebimi.

Etape 1: Luka ID ya Processus ya hôte (PID) ya procédé ya récipient¶

Na node ya hôte Linux (na kati ya récipient te), luka hôte PID ya base de données na yo to ya processus ya demande:

sudo lsof +L1 | grep -E "postgres|mysqld|mariadbd|sqlite|redis|mongo|node|python|java"

COMMAND     PID   USER   FD   TYPE DEVICE  SIZE/OFF NLINK    NODE NAME
mysqld    18492    999   14u   REG  259,1 482344960     0 1849201 /var/lib/mysql/app_prod/users.ibd (deleted)
mysqld    18492    999   15u   REG  259,1 125829120     0 1849202 /var/lib/mysql/app_prod/orders.ibd (deleted)
mysqld    18492    999   16u   REG  259,1  79691776     0 1849190 /var/lib/mysql/ibdata1 (deleted)
python3   22104   1000    4u   REG  259,1  89128960     0 3102944 /data/production.sqlite3 (deleted)

Etape 2: Kopi ya ba fichiers ya base de données oyo ezali na lien te mbala moko libanda /proc/<PID>/fd/¶

Ko te kotelemisa to kobanda lisusu récipient. Tango processus ezali kaka kosala, copier ba descripteurs ya fichier brut directement na dossier ya sécurité na hôte na yo:

sudo mkdir -p /root/proc_emergency_rescue

# Example 1: Rescuing an unlinked SQLite3 database (PID 22104, FD 4)
sudo cp /proc/22104/fd/4 /root/proc_emergency_rescue/production.sqlite3
# Check if PID 22104 also holds the -wal file open (e.g. FD 5) and copy it too:
sudo cp /proc/22104/fd/5 /root/proc_emergency_rescue/production.sqlite3-wal

# Example 2: Automatically rescuing ALL open (deleted) MySQL/Postgres files for PID 18492
for fd in /proc/18492/fd/*; do
    target=$(sudo readlink "$fd" 2>/dev/null)
    if echo "$target" | grep -q "(deleted)"; then
        fd_num=$(basename "$fd")
        clean_name=$(echo "$target" | sed 's/ (deleted)//; s/\//_/g')
        echo "Rescuing FD $fd_num -> $clean_name"
        sudo cp "$fd" "/root/proc_emergency_rescue/${fd_num}${clean_name}"
    fi
done

Etape 3: Kutu malamu koleka: Kosala dump logique en direct (pg_dump / . mysqldump / . .backup) liboso ete récipient ekanga ba FD¶

Soki postgres to mpe mysqld ezali kaka kosala na ba fichiers na yango ya ba données efungwami na mémoire mpe /proc/<PID>/fd/, meka kosala liboso dump logique en direct likolo ya socket unix to connexion TCP oyo ezali:

# If the database engine can still read its open file descriptors:
docker exec <container_name> pg_dumpall -U postgres > /root/proc_emergency_rescue/live_dump.sql
# Or for MySQL:
docker exec <container_name> mysqldump -u root -p --all-databases --single-transaction > /root/proc_emergency_rescue/live_mysql.sql

Phase 3: Kozongisa volume ya Docker oyo elongolami na ext4 to mpe XFS nsima wana eloko oyo batyaki na kati etɛlɛmaki¶

Ezali boni soki okimaki mbangu docker compose down -v to mpe docker system prune --volumes, yango wana récipient ezali déjà arrêté na nionso /proc/<pid>/fd/ ba descripteurs ekangami? Sikoyo ozali na course contre ba écrites ya disque ya fond na hôte Linux.

Etape 1: Congeler système ya ba fichiers ya hôte Linux na kati ya 10 secondes¶

1. Tika Docker, containerd, kubelet, na cron mbala moko po conteneur moko te, healthcheck, to log rotator ekomaka byte mosusu na /var/lib/docker: 1 .

   sudo systemctl stop docker.socket docker.service containerd.service cron.service
   

2. Tala dispositif ya bloc nini na système ya ba fichiers esimbaka /var/lib/docker:

   df -Th /var/lib/docker
   

   Filesystem     Type  Size  Used Avail Use% Mounted on
   /dev/nvme0n1p1 ext4  100G   42G   58G  42% /
   

3. Remount ya partition Read-Only (to ko flux image ya partition brute na SSH na machine mosusu):
4. Soki /var/lib/docker ezali na partition na yango moko dédiée to volume LVM (ndakisa /dev/nvme0n1p2 to mpe /dev/mapper/vg0-docker), remount yango mbala moko kaka mpo na kotánga:

   sudo mount -o remount,ro /var/lib/docker
   

5. Soki /var/lib/docker ezali na misisa / bokaboli (/), meka ko forcer partition ya misisa kaka ya kotanga na kosalelaka déclencheur ya noyau Magic SysRq (echo u | sudo tee /proc/sysrq-trigger) to sudo mount -o remount,ro /.
6. Soki ozali na VPS ya lipata (AWS EC2, GCP, DigitalOcean, Hetzner, Linode): Kende mbala moko na console web ya lipata na yo mpe finá Créer Snapshot na volume ya bloc ya serveur (to streaming dispositif ya bloc brut na nzela ya SSH na serveur ya mibale: sudo dd if=/dev/nvme0n1p1 bs=4M status=progress | gzip -1 | ssh user@backup-server "cat > /mnt/storage/docker_host_raw.img.gz").

Etape 2: Tala soki ba données na yo efandi kaka na volume MOSUSU oyo ekatamaki te to overlay2 couche na yango¶

Yambo ya koyema ba blocs ya disque oyo epesamaki te, vérifier que base de données na yo ebombamaki vraiment te na montage ya bind to na volume oyo ezwaki kombo mosusu oyo ebikaki:

# Search the entire /var/lib/docker tree read-only for any surviving database files:
sudo find /var/lib/docker -name "PG_VERSION" -o -name "ibdata1" -o -name "*.sqlite*" -o -name "*.db" -o -name "dump.rdb" -o -name "WiredTiger" 2>/dev/null

Etape 3: Kozongisa ba répertoires ya volume ya Docker oyo ezali na lien te na ext4 kosalela ba ext4 Journal (ext4magic mpe debugfs) .¶

Ntango nini docker volume rm elongolaka /var/lib/docker/volumes/<vol_name>/_data na likambo moko ext4 système ya ba fichiers, . ext4 zéro libanda ya ba pointeurs ya bloc direct (i_block / extent mosisa ya nzete) na tableau ya inode ya bomoi. Kasi, ba ** .ext4 zulunalo (inode <8>, mbala mingi 128 MB na 1024 MB tampon ya ring circulaire)** ezali kaka kosimba ba copies historiques ya ba tableaux ya inode ya exacte na ba blocs ya répertoire ya droit avant docker compose down -v abomamaki.

+-------------------------------------------------------------------------+
| HOW ext4magic RECOVERS A DELETED DOCKER VOLUME FROM THE EXT4 JOURNAL    |
|                                                                         |
| Live Inode Table on Disk (After docker volume rm):                      |
|   Inode #918402 (users.ibd): [Size = 0, Extent Pointers = ZEROED]       |
|                                                                         |
| Ext4 Journal Ring Buffer (Inode <8> on Disk):                           |
|   Transaction #41902 (10 mins ago):                                     |
|   Inode #918402 (users.ibd): [Size = 482MB, Extents = Blocks 9000..9999]|
|                                                                         |
| -> ext4magic reads the old Inode Copy from Journal Transaction #41902   |
|    and extracts Blocks 9000..9999 directly to your rescue drive.        |
+-------------------------------------------------------------------------+

Kima mbangu ext4magic contre partition na yo ya kotanga kaka (to ya .img kopi ya instantané na serveur ya mibale), kolakisa elembo ya ngonga (-a) kobanda 5 minutes avant okimaki docker compose down -v to mpe docker system prune --volumes: 1 .

# Install ext4magic on your rescue machine (never on the affected partition)
sudo apt-get install -y ext4magic e2fsprogs

# Dump the ext4 journal from the frozen partition / image to a file in RAM (/dev/shm)
sudo debugfs -R "dump <8> /dev/shm/ext4_journal.copy" /dev/nvme0n1p1

# Recover all files deleted under var/lib/docker/volumes after (Current Time - 15 minutes)
sudo mkdir -p /mnt/external_rescue/docker_recovered
sudo ext4magic /dev/nvme0n1p1 \
  -j /dev/shm/ext4_journal.copy \
  -f var/lib/docker/volumes \
  -a $(date -d "-15 minutes" +%s) \
  -r -d /mnt/external_rescue/docker_recovered

Etape 4: Koyema ba fichiers bruts SQLite, PostgreSQL, to MySQL InnoDB tango journal esili ko envelopper (XFS to mpe ext4) .¶

Soki moyambi asaleli ** .XFS** to soki ba ext4 journal déjà enveloppé likolo ya ba pointeurs inode, salela signature na structure carving contre image ya disque brut (docker_host_raw.img):

1. Mpo na ba Bases de Données ya SQLite3 (.sqlite, . .db - ndakisa, Vaultwarden, Nextcloud, Mosungi ya ndako, Gitea, Grafana): Base ya ba données nionso ya SQLite3 ebandi na motó ya ASCII ya 16 octets oyo ekoki kozala na ntembe te na octet 0 ya lokasa na yango ya liboso ya 4 kilobyte: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 ("SQLite format 3\0"), mpe ebombaka bonene ya lokasa ya sikisiki ya base de données (Bytes 16..17, mbala mingi 4096) mpe bonene mobimba ya base de données na nkasa (Bytes 28..31, big-endian 32-bit integer) kaka na kati ya motó wana kaka.
2. Kima mbangu PhotoRec na ** .[File Opt] -> [x] sqlite** activé, to scanner partition directement na grep -ab "SQLite format 3" mpo na koluka offset ya octet ya sikisiki ya fichier SQLite na yo oyo elongolami mpe kobimisa yango na dd: 1 .

   # Find the exact byte offsets of every "SQLite format 3" header on the partition:
   sudo grep -ab "SQLite format 3" /dev/nvme0n1p1
   

   Soki osili kobimisa yango, kima sqlite3 carved.db ".recover" | sqlite3 repaired.db mpo na kotonga lisusu lokasa nyonso ya nkasa ya nzete B oyo ebebi te.

1. Mpo na MySQL / MariaDB InnoDB (.ibd ba fichiers ya tableau): InnoDB nionso .ibd tableau ezali na ba séquentiels 16 KB (16,384 byte) nkasa oyo ezali na FIL_PAGE_INDEX (0x45BF) motó ya likambo mpe tableau’s unique space_id. Salelá Percona / TwinDB ** .undrop-for-innodb (stream_parser + c_parser)** bokumbi bisaleli mpo na kosala scanner /dev/nvme0n1p1 mpo na bato nyonso 16 KB Ba pages ya index ya InnoDB pe dump ligne nionso directement na ba fichiers TSV/SQL pona re-import.
2. Mpo na ba fichiers ya PostgreSQL Heap ($PGDATA/base/<db_oid>/<relfilenode>): PostgreSQL ebombaka tableau moko na moko lokola oyo ekangami 8 KB (8,192 byte) ebele ya nkasa oyo ezali na PageHeaderData (pd_lower, . pd_upper, . pd_special). Salelá ** .pg_filedump** to ** .pglazarus / . pdu** mpo na ko scanner ba régions ya disque oyo epesameli te mpo na 8 KB nkasa oyo ekokani na layout ya tuple ya colonne ya tableau na yo (HeapTupleHeaderData) mpe kotonga lisusu milɔngɔ yango.

Eteni ya minei : Kubernetes PVC, PV, mpe etcd Snapshot Bozongisi ya mbalakaka¶

Na Kubernetes (EKS, . GKE, . AKS, . k3s, . RKE2, . kubeadm, . OpenShift), kolongolaka na mbalakaka PersistentVolumeClaim (kubectl delete pvc), StatefulSet, to Esika ya Nkombo mobimba (kubectl delete ns prod) elandi architecture ekeseni mpenza na Docker oyo ezali yango moko.

Scénarios A: Ba PVC ezo lakisa Terminating (Mobikisi ya bomoi ya Finalizer)¶

Kima mbangu:

kubectl get pvc -n <namespace>

# Stream a compressed tar backup or pg_dump out of the still-running pod immediately:
kubectl exec -n <namespace> <pod-name> -- pg_dumpall -U postgres > ./rescued_k8s_db.sql
# Or tar an entire mounted volume directory out over stdout:
kubectl exec -n <namespace> <pod-name> -- tar czf - /var/lib/postgresql/data > ./rescued_pvc_files.tar.gz

Scénarios B: PVC elongolamaki, mpe kubectl get pv elakisaka PersistentVolume na Released ekólo (ReclaimPolicy: Retain) .¶

Kima mbangu:

kubectl get pv

Ndenge ya kosala a Released PV Available lisusu na 10 secondes na perte ya ba données zéro: 1. Bongisa objet PersistentVolume mpe bolongola spec.claimRef bloc:

kubectl patch pv <your-pv-name> --type json -p '[{"op": "remove", "path": "/spec/claimRef"}]'

Scénarios C: Kozongisa état ya cluster ya Kubernetes oyo epangusamaki uta na etcd elilingi ya mbala moko (etcdctl snapshot restore) .¶

Ezali boni soki moto akimaki mbangu kubectl delete namespace prod to mpe helm uninstall mpe elongolaki 200 Kubernetes manifestes, Secrets, ConfigMaps, mpe bandimbola ya PV na oyo ekambami ye moko kubeadm, . k3s, to RKE2 avion ya contrôle?

1. Boluka ya sika na yo etcd snapshot (na ndenge ya libela na /var/lib/rancher/k3s/server/db/snapshots/, . /var/lib/rancher/rke2/server/db/snapshots/, to oyo obongisi /var/backups/etcd/snapshot.db).
2. Verifier intégrité ya instantané avant osimba cluster en direct:

   ETCDCTL_API=3 etcdctl snapshot status /path/to/snapshot.db --write-out=table
   

3. Tika kube-apiserver mpe etcd na (ba)noeud(s) ya plan de contrôle:
4. Na ** .kubeadm** (ba gousses statiques): Bokende /etc/kubernetes/manifests/kube-apiserver.yaml mpe /etc/kubernetes/manifests/etcd.yaml mpo na mwa ntango mpo na /root/manifests_hold/ bongo kubelet etelemisaka ba récipients nyonso mibale pɛto, na nsima ezongaka lisusu /var/lib/etcd na /var/lib/etcd.bak.
5. Na ** .k3s**: Kima mbangu sudo systemctl stop k3s mpe sudo k3s server --cluster-reset --cluster-reset-restore-path=/path/to/snapshot.
6. Zongisa na... etcd répertoire ya ba données na kubeadm:

   sudo ETCDCTL_API=3 etcdctl snapshot restore /path/to/snapshot.db \
     --data-dir=/var/lib/etcd \
     --name=<control-plane-node-name> \
     --initial-cluster=<node-name>=https://<node-ip>:2380 \
     --initial-advertise-peer-urls=https://<node-ip>:2380
   

7. Bokende na esika mosusu etcd.yaml mpe kube-apiserver.yaml zonga na kati /etc/kubernetes/manifests/. Na boumeli ya segɔnde 30, . kube-apiserver ezo reconnecter na oyo ezongisami etcd bomba mpe eloko nyonso oyo elongolami Namespace, Secret, ConfigMap, mpe PersistentVolume ebimaka lisusu.

Phase 5: Ko durcir ba volumes ya Docker na Kubernetes contre suppression accidentelle¶

Soki base de données ya production na yo ezongisami, salela ba guardrails architecturaux minei oyo po typo moko ya CLI ekoki ko effacer lisusu volume en direct te:

• Bobongola production nionso Kubernetes StorageClass uta na reclaimPolicy: Delete na reclaimPolicy: Retain: Na ndenge ya libela, StorageClasses ya lipata oyo etongami na kati (gp2, . gp3, . standard-rwo) default na reclaimPolicy: Delete, elingi koloba kosilisa PVC ebebisaka disque cloud. Kokela a StorageClass na reclaimPolicy: Retain (to ko patcher ba PV oyo ezali na kubectl patch pv <pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}') yango wana kosilisa PVC to Namespace elongolaka jamais volume ya bloc oyo ezali na se.
• Kofungola AWS EBS Recycle Bin / GCP Snapshot Schedules / Velero na CSI Snapshots: Kofungola AWS EBS Recycle Bin ebatelaka volume nyonso ya EBS oyo elongolami na boumeli ya mikolo 7 kino 30 ata soki pilote ya CSI abengi DeleteVolume.
• Kosalela ata mokolo moko te docker system prune --volumes na ba scripts ya bopeto ya automatique to ba runners ya CI/CD: Soki récipient ya base de données ya production epanzani mpo na mwa ntango mokuse (Exited (1)) na moment exact oyo mosala ya cron ezo tambola docker system prune -a --volumes -f, Docker etalelaka ba volumes na yango oyo ezali na nkombo te "esalelami te" mpe elongolaka yango mpo na libela. Bande na yango --volumes uta na ba scripts nionso ya bopeto.
• Salelá ba montages ya bokangami ya hôte ya polele (/srv/prod_data/postgres:/var/lib/postgresql/data) to ba bases de données oyo ekambami libanda mpo na ba charges ya mosala ya production état: Na bokeseni /var/lib/docker/volumes/, ba répertoires ya bind-mount ya hôte libanda /var/lib/docker/ bazali jamais kosimbama na docker compose down -v, . docker volume rm, to docker system prune --volumes.

Mituya ya mbalakaka ya etuka mpe ba protocoles ya agence¶

Ntango bolongoli ya conteneur to ya bobateli ya Kubernetes ezali na bopusi na misala ya kliniki ya lopitalo, botindiki ya bokengi ya bato banso, to ba données personnelles réglementées, emati mbala moko:

• Etats-Unis na Canada: Benga 911 soki panne ya cluster ya ba récipients e désactiver suivi clinique ya malade, ba systèmes ya EHR, to dispatch ya urgence. Lakisa ba effacement ya infrastructure ya ba conteneurs ya mabe to ba incidents ya cyber na CISA (1-844-Say-CISA / . cisa.gov/report) to Centre canadien ya sécurité cybernétique (1-833-CYBER-88).
• Royaume-Uni: Benga 999 mpo na makama na bomoi to na ba infrastructures ya NHS ya motuya. Na nsé ya GDPR ya Royaume-Uni, kobebisama mpo na libela to kobungisa bozali ya ba données personnelles kozanga sauvegarde oyo ekoki kozongisama esengaka kotalela liyebisi ya ngonga 72 ya bobukami na ICO (0303 123 1113).
• Union européenne: Benga 112 na kati ya ba Etats membres nionso ya UE. Ba entités oyo ezali na se ya ** Directive NIS2** esengeli kotinda likebisi ya liboso na CSIRT ya ekolo na bango na kati ya ngonga 24 sima ya bokati makasi ya service, mpe bobungisi ya ba données personnelles ya libela ebandisaka GDPR Article 33 kopesa lapolo na kati ya ngonga 72.
• Australie na Nouvelle-Zélande: Benga 000 na Australie to ** .111** na Nouvelle-Zélande; kopesa sango ya makambo ya ntina ya infrastructure na ACSC (1300 CYBER1).
• Inde na Asie-Pacifique: Benga 112 na Inde mpo na eyano ya nokinoki; koyebisa makambo ya bokengi ya lipata to ya conteneur na CERT-In (incident@cert-in.org.in) na kati ya fenetre ya ngonga 6 oyo esengeli.

Mituna oyo batunaka mingi¶

Esalaka bongo docker compose down -v kosilisa ba montage ya bokangami ya hôte (./data:/var/lib/mysql) to kaka ba volumes ya Docker oyo ezali na kombo mpe oyo ezali na nkombo te?¶

`docker compose down -v` KAKA elongolaka ba volumes Named oyo esakolami na `volumes:` eteni ya `docker-compose.yml` mpe ba volumes Anonymes oyo ekangami na ba récipients; yango ata mokolo moko te elongolaka ba fisyé na kati ya montage ya bokangami ya hôte (lokola `- /opt/mysql_data:/var/lib/mysql` to mpe `- ./postgres_data:/var/lib/postgresql/data`). Soki fichier compose na yo esalelaki nzela ya hôte kobanda na `/` to mpe `./`, tala dossier wana na hôte sikoyo: ba fichiers na yo ezali kaka 100 pour cent intact.

Mpo na nini asalaki bongo docker system prune --volumes supprimer volume ya base de données na ngai tango natelemisaki kaka conteneur pendant 2 minutes pona ko mettre à jour variable ya environnement?¶

Zelá malamu bokeseni oyo ezali kati na `docker stop` mpe `docker rm`: soki récipient moko ezali kaka `Stopped / Exited` (emonanaka na `docker ps -a`), . `docker system prune --volumes` esalaka te supprimer ba volumes na yango po conteneur oyo etelemi ezo référer kaka na yango. Kasi, soki okimaki mbangu `docker rm ` (mpo na kosala lisusu récipient na ba drapeaux ya sika) to soki oleki `docker system prune -a --volumes` (oyo elongolaka liboso ba récipients nionso oyo etelemi mpe na nsima elongolaka ba volumes nionso oyo ekangami lisusu na récipient moko te), volume ekomaki "dangling" na milliseconde oyo récipient oyo etelemaki elongolamaki mpe epangusamaki mbala moko sima na yango.

Nakoki kozongisa volume ya Docker oyo elongolami na kati ya Bureau ya Docker na Mac (Apple Silicon / . Intel) to Windows (WSL2)?¶

Oui, soki obimi na Docker Desktop mbala moko donc machine virtuelle etika kosala `fstrim` contre disque virtuel. Na macOS, Docker ebombaka ba volumes nionso ya Linux na kati `-/Library/Containers/com.docker.docker/Data/vms/0/data/Docker.raw`; na Windows WSL2, na kati `%LocalAppData%\Docker\wsl\disk\docker_data.vhdx`. Kopi ya likambo yango `.raw` to mpe `.vhdx` fichier na SSD ya libanda mbala moko, kangisa yango kaka ya kotanga na Linux (kosalela `losetup -Pr` mpo na `.raw` to mpe `qemu-nbd -r` mpo na `.vhdx`), mpe kokima mbangu `ext4magic` to mpe `PhotoRec` contre ba virtuels `ext4` kokabola na kati.

Ezali boni soki nalongolaki Kubernetes StatefulSet moko na kubectl delete statefulset postgres? Yango elongolaki mpe ba PVC na ngai?¶

Te. Na ndenge ya libela na Kubernetes (soki te `persistentVolumeClaimRetentionPolicy.whenDeleted: Delete` ezalaki configuré explicitement na Kubernetes 1.27+), ezo tambola `kubectl delete statefulset` elongolaka contrôleur ya StatefulSet mpe ba Pods na yango, . kotika nyonso `PersistentVolumeClaims` (`data-postgres-0`, . `data-postgres-1`) mpe ba données na bango ya se na yango 100 pour cent intact. Bobele kozongela kosalela ya yo `StatefulSet` YAML manifeste na kombo moko na `volumeClaimTemplates`, mpe ba Pods ya sika ekokangama lisusu automatiquement na oyo ezali `data-postgres-0` Ba PVCs.

Ndenge nini nakoki ko accéder na ba fichiers na kati ya Docker overlay2 répertoire tango récipient eboyi kobanda (CrashLoopBackOff / . Exited (1))?¶

Kolongola te eloko oyo ekweaki. Tant que récipient oyo etelemi ezali kaka na kati `docker ps -a`, couche na yango oyo ekoki kokomama mpe ba montages ya volume ezali mobimba intact na disque. Okoki soki kopi ya ba fichiers directement libanda ya récipient oyo etelemi na kosalelaka `docker cp :/var/lib/postgresql/data /root/rescued_data`, to luká moyambi na yango mpenza `overlay2` nzela na kopota mbangu `docker inspect --format '{{.GraphDriver.Data.UpperDir}}'` mpe kotanga répertoire wana directement lokola `root`.

Est-ce que soki mutu a supprimer Kubernetes moko Namespace (kubectl delete ns prod) mpe ba PVC nyonso ezalaki na yango reclaimPolicy: Delete na AWS EBS to na GCP?¶

Soki mokumbi CSI ya lipata (`ebs.csi.aws.com` to mpe `pd.csi.storage.gke.io`) esi esalemi `DeleteVolume` mpo `reclaimPolicy` ezalaki `Delete`, vérifier mbala moko ba filets de sécurité misato ya niveau ya cloud: (1) vérifier **AWS Recycle Bin for EBS Volumes** na console ya AWS EC2 (soki règle ya retention ezalaki active na compte/étiquettes, volume EBS oyo elongolami efandi na Recycle Bin mpe ekoki kozongisama na 1 clique); (2) tala **AWS Backup / DLM / GCP Snapshot Schedules** mpo na instantané ya volume automatique ya sika koleka; mpe (3) kotala soki base de données na yo ezalaki ko streaming WAL/binlogs (`WAL-G`, . `pgBackRest`, . `Litestream`) na seau moko ya S3/GCS.

Ba guides oyo etali yango¶

• Disque ya serveur 100% etondi (0 octets ya ofele): base de données WAL log bloat, B-tree ebebi, mpe récupération zéro-espace
• rm -rf to Shift+Delete ya mbalakaka na Linux, macOS, to Windows: mbala moko remontage ya mbala moko kaka ya kotanga mpe kosala mayemi ya inode
• Machine virtuelle VMDK, VHDX, na qcow2 snapshot chaîne corruption mpe hyperviseur kobikisa
• Komipesa ya Git ya mbalakaka ya bafungola ya AWS, fisyé .env, to fungola SSH ya privé na repo ya GitHub ya bato banso
• Crise ya hébergement web, migration, na restauration ya sauvegarde
• Ba sauvegarde ya ordinateur, stratégie ya 3-2-1, mpe récupération ya likama
• Mituya ya mbalakaka na kotalela mboka

Maziba mpe bokambi ya Leta¶

• Mikanda ya Leta ya Kubernetes (kubernetes.io / Fondation informatique native cloud): Objet ya stockage na protection ya usage (kubernetes.io/pvc-protection Ba Finalisateurs), Kozongisa baVolumes Persistants (Retain vs. Delete), mpe Kosala mosala etcd Ba clusters pona Kubernetes (etcdctl snapshot restore).
• Docker Inc. (docs.docker.com): Gérer ba Données na Docker: Volumes, Bind Mounts, overlay2 Architecture ya Driver ya stockage, mpe Référence ya Prune.
• Ebongiseli ya Noyau ya Linux (kernel.org): Ba /proc Système ya ba fichiers (procfs Fungola Récupération ya Descripteur ya Fichier via /proc/<pid>/fd/) mpe Ext4 Boyebisi ya Journal.
• ext4magic Mikanda ya mosala (ext4magic.sourceforge.net): Bozongisi ya Transaction ya Inode forensique na Journal na ba Systèmes ya ba fichiers Ext3/Ext4.
• Institut national ya ba normes mpe ya technologie (NIST) (Etats-Unis): Mokanda ya sipesiale 800-190: Buku ya bokengi ya ba récipients ya application & Récupération ya incident.