How to Manually Update an AWS ECS Service

When deploying changes, you should usually use a CI/CD tool such as Jenkins. However, sometimes you may need to deploy manually.

Here are the steps to deploy code changes manually for an AWS ECS service.

Assumptions:

• AWS account ID: 135937123456
• AWS ECR repository name: sandbox-jsdom
• Image version tag: v2
• Region: us-west-1

1) Make and test code changes locally

Make your code changes and run local tests before building and pushing the image.

2) Authenticate Docker to Amazon ECR

aws ecr get-login-password --region us-west-1 | docker login --username AWS --password-stdin 135937123456.dkr.ecr.us-west-1.amazonaws.com

3) Build and tag the Docker image

docker build -t 135937123456.dkr.ecr.us-west-1.amazonaws.com/sandbox-jsdom:v2 .

4) Push the image to ECR

docker push 135937123456.dkr.ecr.us-west-1.amazonaws.com/sandbox-jsdom:v2

5) Create a new ECS task definition revision

In the ECS console:

1. Open the current task definition.
2. Choose Create new revision.
3. Select Create new revision with JSON.
4. Update the container image field to the new image:

"image": "135937123456.dkr.ecr.us-west-1.amazonaws.com/sandbox-jsdom:v2"

6) Update the ECS service

Update the ECS service to use the new task definition revision.

7) Verify deployment health

• Confirm that new tasks start successfully and pass health checks.
• If deployment fails, roll back by updating the service to the previous task definition revision.
• To troubleshoot failures, open the stopped task. Click stopped column and see details in the pop up. Review the stop reason and debug.

Check MySQL Server readiness in Unit Test Setting up

#!/bin/bash

apk add mariadb-connector-c

//more codes here

//this while loop is to check Mysql server readiness
while ! mariadb-admin ping -h"$HOST" --protocol=tcp  --skip-ssl --silent; do
    sleep 1
done

//then do real stuff
 mysql --protocol=tcp  --skip-ssl -h$HOST -u$DB_USER -p$DB_PASS < ${ROOT_DIR}/library/WWAPI/recreate-schema.sql

Why needs to check server readiness

For MariaDB/MySQL, startup can include:

• reading config
• initializing storage engine internals
• crash recovery / redo log replay
• loading grant tables / auth plugins
• opening sockets
• replication setup (if any)

Why need "--protocol=tcp --skip-ssl"

those flags force a specific connection path that is often required in CI/unit-test environments.

--protocol=tcp Forces the client to connect over TCP/IP. Without it, mysql may try a Unix socket (on Linux/macOS) when host is localhost or certain defaults apply. If your test DB is in Docker/remote host/no local socket, socket connect fails.

--skip-ssl Forces a non-TLS connection. Without it, client/server may attempt SSL/TLS negotiation (depending on defaults and server settings). If certs/SSL config are missing or incompatible in the test environment, connection can fail.

Connect AWS RDS using port forward

1. find end points:

   1. AWS RDS mysql database endpoint: leo-mysql.abcde12222.us-east-1.rds.amazonaws.com
   2. AWS RDS proxy end point: ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com

2. set a jump box

   Host mm-myjump
       HostName 54.70.111.222
       User ec2-user
       IdentityFile ~/.ssh/NOC.pem
       ServerAliveInterval 60
       ServerAliveCountMax 3
       LocalForward 3333 ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com:3306
       LocalForward 3311 leo-mysql.abcde12222.us-east-1.rds.amazonaws.com:3306

3. check whether a TCP port is reachable.

   ssh mm-myjump
   nc -zv leo-mysql.abcde12222.us-east-1.rds.amazonaws.com 3306
   nc -zv ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com  3306

   Test result: see connected and it is good.

4. find ips of proxy

   getent hosts ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com
   10.32.111.222   vpce-0d550c1ebeb3a6159-jq0x2yyd.vpce-svc-0a3de4cabd09a2ae4.us-east-1.vpce.amazonaws.com ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com
   10.32.888.999   vpce-0d550c1ebeb3a6159-jq0x2yyd.vpce-svc-0a3de4cabd09a2ae4.us-east-1.vpce.amazonaws.com ddd-accesss.proxy-abcde12222.us-east-1.rds.amazonaws.com

5. find ip of jump box

   10-16-222-888

6. set allow host for the user and test

   # connect to data base end point directly, only need 10.16.%.%
   
   mysql --host='127.0.0.1' -P 3311  --user=tester --password='test12233*' -A revenuewireDW
   SELECT USER(), CURRENT_USER();
   
   # connect to data base proxy, only need 10.32.%.% (becuase db think the host is from proxy. 
   #Also will not match exactly to end point ip. Therefore, use wild cat here). Also need to set
   #user name and password in secret manage for this option.
   
   mysql --host='127.0.0.1' -P 3333  --user=tester --password='test12233*' -A revenuewireDW
   SELECT USER(), CURRENT_USER();

TFSA Dollar Limits

TFSA dollar limits

Yeas	Amount	Sum
2009 to 2012	$5,000	$20,000
2013 and 2014	$5,500	$11,000
2015	$10,000	$10,000
2016 to 2018	$5,500	$16,500
2019 to 2022	$6,000	$24,000
2023	$6,500	$6,500
2024 to 2026	$7,000	$21,000

Sum up all amounts in the table is $109,000

Dollar Limits

Using gpg

Create gpg key pair

gpg --full-generate-key

You’ll be prompted: Key type: choose default RSA and RSA Key size: 4096 Expiration: e.g. 1y (or 0 for no expiry) User ID: Real name (e.g. Your Name) Email (e.g. you@example.com) Comment (optional) Confirm and set a passphrase

Encrypt a file

//recipient email is the same email used to create key pair
gpg --output test.txt.gpg --encrypt --recipient you@example.com test.txt

Decrypt a gpg file

gpg --output test-decrypted.txt --decrypt test.txt.gpg

Encrypt a file using fingerprint

Step 1: find public key fingerprint

gpg --list-keys

See something like the following in the out put

pub   rsa4096 2026-05-28 [SC] [expires: 2027-05-28]
      876Dweeueuurtrotooyotyoooepepepep35A6

Step 2: encrypt using fingerprint

gpg --output test.txt.gpg --encrypt --recipient 876Dweeueuurtrotooyotyoooepepepep35A6  test.txt

GitHub Copilot Agents

Review agent in vscode

1. create a folder .github in your workspace
2. Create a agents folder in .github
3. Create Reviewer.agent.md file in agents
4. Choose reviewer as agent in chat window

Reviewer.agent.md content

---
name: "Reviewer"
description: "Review code for quality and adherence to best practices."
tools:
  ["vscode/askQuestions", "vscode/vscodeAPI", "read", "agent", "search", "web"]
---

# Code Reviewer agent

You are an experienced senior developer conducting a thorough code review. Your role is to review the code for quality, best practices without making direct code changes.

When reviewing code, structure your feedback with clear headings and specific examples from the code being reviewed.

## Analysis Focus

- Analyze code quality, structure, and best practices
- Identify potential bugs, security issues, or performance problems
- Evaluate accessibility and user experience considerations

## Important Guidelines

- Ask clarifying questions about design decisions when appropriate
- Focus on explaining what should be changed and why
- DO NOT write or suggest specific code changes directly

MySQL docker container in a host machine which has MySQL server running

Map container to another host port other than 3306

version: '3'
services:

  mysql:
    container_name: docker_mysql_1
    ports:
      - 3307:3306/tcp
    privileged: true
    restart: on-failure
    image: mysql:8.4
    volumes:
      - mysql84:/var/lib/mysql
    network_mode: bridge
    environment:
      MYSQL_ROOT_PASSWORD: test1234
    command:
      - --innodb_file_per_table=0
      - --innodb_checksum_algorithm=INNODB
      - --binlog_checksum=NONE
      - --sql_mode=NO_ENGINE_SUBSTITUTION
      - --slow-query-log=1
      - --slow-query-log-file=/var/log/mysql/my-slow.log
      - --long_query_time=1
      - --log-queries-not-using-indexes
      - --restrict_fk_on_non_standard_key=0
    security_opt:
      - seccomp=unconfined

volumes:
  mysql84:

After container is up, connect to container Mysql Server

#when ask password, type: test1234
mysql -h 127.0.0.1 -P 3307 -u root -p 

#another way using container name
docker exec -it docker_mysql_1 mysql -uroot -p

To connect MySQL running on the host machine. Assume there is MySQL user tester

mysql -u tester -p

How to check who owns 3306 now

#On host:
ss -ltnp | grep 3306
# or
lsof -i :3306

GitHub Copilot

See Github Copilot features enabled and usage for your account

• log into Github
• Copilot Features

Limitations for different plans

Plans for GitHub Copilot

GitHub Copilot in VS Code docs

Copilot in VS Code

Get Start With Github Copilot

vscode external browser

• install Live Preview extension
• go to command palette
• Live Preview: show debug preview

Shortcuts

• add inline chat. (command + i)

In this project, I have add some customerization for github copilot in .github folder. How can see it in current vscode

1. Open the project folder as your workspace.
2. Open the Command Palette (⇧⌘P) and run Chat: Open Customizations.
3. Browse the workspace sections for Instructions, Agents, Skills, and Hooks.

Instructions

//.github/copilot-instructions.md
# GitHub Copilot Instructions

- Answer questions in a friendly, casual, and supportive tone—like a helpful bro.
- Keep explanations clear, practical, and easy to understand.
- Be concise, but include enough detail to solve the problem.
- Use informal language naturally, without being rude or unprofessional.
- Provide examples or code snippets when they are helpful.
- Always end every answer with this exact sentence:

are you happy with my beautiful answer?

Also can create some instruction files in other places. Then link them in copilot-instructions.md

How to check php package in alpine linux

Go to Alpine Linux

• In Package name field, search php83, php84 or php85
• In Branch field, choose v3.23, v3.23 etc

Add Openai gpt-5.3-codex model into my Openai web application

Here is My Openai Chat Github Repository

To add gpt-5.3-codex model

• Update Dockerfile to use python:3.9 base image.
• Update requirements.txt to use Django 4.2.0 and Python openai sdk 2.26.0
• Use Python openai sdk response api to interact with Openai gpt-5.3-codex model

See affected AWS resources for upcoming events

1. log into aws console
2. go to AWS health Dashboard
3. ckick Scheduled changes
4. click Calendar
5. choose date
6. click Upcomming
7. choose one of events to see affected resourses

SFTP server

#log in
sftp leo@82.992.123.124

#after log in

# upload a file:
put test.txt

# download a file
get test.txt

# delete a file
rm test.txt

Directly copy file between the server and the local machine if can ssh to the server

# find server public ip: 100.31.47.111

# ssh to the server
ssh -i /Users/leo/path/noc.pem ec2-user@100.31.47.111

# copy file to server
scp -i /Users/leo/path/noc.pem /Users/leo/path/test.txt.gpg  ec2-user@100.31.47.111:/home/ec2-user/

# copy file from server to local
scp -i /Users/leo/path/noc.pem  ec2-user@100.31.47.111:/home/ec2-user/test.txt  /Users/leo/path/ 

Decrypt gpg file

# verify have the private key
gpg --list-secret-keys

# decrypt. when prompt, provide passphrase for private GPG key
gpg --decrypt --output mytest.csv  mytest.csv.gpg

# find key id for gpg public key
gpg --show-keys --with-fingerprint --keyid-format short mypub.asc

CORS

Error: Access to fetch at .... has been blocked by CORS

CORS stands for cross origin resource share. If use Javascript to fetch a endpoint and endpoin is not the same origin as the current page, may see the above error. Here origin is protocol + domain + port.

//host is https://examplea.com
<script>

 let endpoint = "https://exampleb.com/create-order";
 return fetch(endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(data)
    })
      .then(resp => {
        if (!resp.ok) throw new Error('Network response was not ok');
        return resp.json();
      });
</script>

To solve the issue. For that end point of exampleb.com. the response needs to set headers such as

$response = $response->withHeader('Access-Control-Allow-Origin', "*");
        
return $response->withHeader('Access-Control-Allow-Headers', 'X-Requested-With,x-api-key, Content-Type, Accept, Origin, Authorization, X-Authorization-JWT, X-CSRF-Token')
	->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
    }

Javascript Class

Class in ECMAScript 5

function PersonType(name) {
    this.name = name;
}

PersonType.prototype.sayName = function() {
    console.log("your name:" + this.name);
}

let person = new PersonType("leo");
person.sayName();

Class in ECMAScript 6

class PersonType {
    constructor(name) {
        this.name = name;
    }
    sayName() {
        console.log("your name:" + this.name);
    }
}

let person = new PersonType("leo");
person.sayName();

Use class in web page

index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <script src="person.js"></script>
    <script>
        let p = new Person('leo');
        p.sayName();
    </script>
</head>
</html>

person.js

class Person {
    constructor(name) {
        this.name = name;
    }
    sayName() {
        console.log("your name:" + this.name);
    }
}

// export to global namespace so index.html can see it
window.Person = Person;

Javascript Promise

Create a promise and consume a promise

example one

let p = new Promise((resolve, reject) => {
    let n = Math.floor(Math.random() * 100);
    let good = n % 2 == 0 ? true : false;

    if (good) {
        setTimeout(resolve, 100, { "dd": 1212 });
    } else {
        setTimeout(reject, 200, "bad2");
    }
});

p.then((v) => console.log("suc", v))
    .catch((v) => console.log("failed:", v));

//this is identical as the above
p.then((v) => console.log("suc", v), (v) => console.log("failed:", v));

example two

import { readFile as _readFile } from 'fs';

let p = new Promise((resolve, reject) => {
  _readFile("./test.js", 'utf8', (err, data) => {
    if (err) {
      reject(err);
    } else {
      resolve(data);
    }
  })
});

p.then((data) => console.log("good", data))
  .catch((err) => console.log("err", err))

Use await to consume a function which return a promise

example one

function myCreate() {
    return new Promise((resolve, reject) => {
        let n = Math.floor(Math.random() * 100);
        let good = n % 2 == 0 ? true : false;

        if (good) {
            setTimeout(resolve, 100, { "dd": 1212 });
        } else {
            setTimeout(reject, 200, "bad2");
        }
    });
}

//Any exception thrown in the try block (or any rejected promise when using await) will jump to the catch.
try {
    const ans = await myCreate();
    console.log("ans", ans);
} catch (err) {
    console.log("err:", err);
}

use async function to consume the promise

function myCreate() {
    return new Promise((resolve, reject) => {
        let n = Math.floor(Math.random() * 100);
        let good = n % 2 == 0 ? true : false;

        if (good) {
            setTimeout(resolve, 100, { "dd": 1212 });
        } else {
            setTimeout(reject, 200, "bad2");
        }
    });
}

async function test() {
    try {
        const ans = await myCreate();
        console.log("ans", ans);
    } catch (err) {
        console.log("err:", err);
    }
}

test();

You still can use then to consume a promise returned by a function.

function myCreate() {
    return new Promise((resolve, reject) => {
        let n = Math.floor(Math.random() * 100);
        let good = n % 2 == 0 ? true : false;

        if (good) {
            setTimeout(resolve, 100, { "dd": 1212 });
        } else {
            setTimeout(reject, 200, "bad2");
        }
    });
}

myCreate().then((ans) => console.log("ans", ans), (err) => console.log("err:", err));

Install older version vscode

Install

• go to vscode versions
• Pick a one and download
• For mac, unzip the file. Drag app file into Application folder

Prevent from upgrading automatically

• – Open VS Code.
• – Press ⌘, (Command-Comma) to open Settings.
• – In the search box type “update”.
• – Under Features → Updates find “Update: Mode” and set it to “none”.

AWS ECR image scan reports vulnerabilities

Question:When the image was scanned one month ago, there is no vulnerability. The same image is scanned today, and reports vulnerabilities. Why?

Answser: AWS has updated its' vulnerability definitions.

Question:Sometimes, after image is rebuilt using the same docker file, these vulnerabilities are gone. Why?

Answer: When the image is rebult, it will grab the latest libraries and these vulnerabilities may have been fixed in these new libraies. In the case, use this flag.

 --no-cache

Here is an example. Scan reports vulnerabilities related to curl

Dockerfile

FROM alpine:3.19
RUN apk update && apk add curl && apk upgrade

To build

 docker image build --no-cache  -t leo_test:latest .

When do apk update && apk add, it will get the latest libraries. At that time, alpine may have fix the curl issue. You may check and find that curl version has been changed.

curl --version

X-Frame-Options header for iframe

<iframe
        src="https://google.com"
        width="600"
        height="300"
        title="Demo Iframe"
        frameborder="0"
> </iframe>

Google.com will not be displayed in iframe. It is said that Google is refused to be connected. This is because that Google send out X-Frame-Options header

There are two values for this header

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

To set in apache httpd.conf

Header always append X-Frame-Options SAMEORIGIN

Header always append X-Frame-Options DENY

For the first option, will display content of the same domain. For the second option, will not display content from any domain

Overwrite for one single page in httpd.conf Therefore pay.html can be used as src of iframe on other domains

Header always append X-Frame-Options SAMEORIGIN

<Location /pay.html>
  # remove the SAMEORIGIN header
  Header always unset X-Frame-Options
</Location>

ECS service and target group

• associate ECS service to load balancer
• define target group for load balancer
• running tasks of this ECS service become targets of this target group

#cloudformation template snippet
Service:
    Type: "AWS::ECS::Service"
    Properties:
      Cluster: !FindInMap [BuildEnvironment, !Ref 'EnvironmentType', "cluster"]
      DesiredCount: !FindInMap [BuildEnvironment, !Ref 'EnvironmentType', "desire"]
      LoadBalancers:
        - ContainerName: !Sub "${EnvironmentType}-${APP}"
          ContainerPort: 80
          TargetGroupArn: my_target_group_arn

See targets in a target group

1. Go to EC2
2. In left side, under Load Balancing. Click Target Groups link
3. Search target group by name. Click that target group
4. In Registered targets section, see targets. They are running tasks. Find port
5. Go to a task. Check the Network bindings for the task to find port. These ports are matched.

Encrypt and decrypt password using PHP sodium

Encrypt password

<?php
/**
 * encrypt.php
 */
$masterKey = "canyouguess";
$passwordToEncrypt = "top-secret";

//ecncypt password
$code = encrypt($masterKey, $passwordToEncrypt);
echo "code: ", $code, "\n";

/**
 * @param $masterKey
 * @param $password
 * @return string
 * @throws SodiumException
 */
function encrypt($masterKey, $password)
{
    // Derive a subkey of the correct length for secretbox
    $key = sodium_crypto_generichash($masterKey, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES
    );

    // Generate a random nonce
    $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

    // Encrypt
    $ciphertext = sodium_crypto_secretbox($password, $nonce, $key);

    // Prepend nonce for later decryption, and base64-encode the lot
    return base64_encode($nonce . $ciphertext);
}

In the directory of encrypt.php, run:

docker run -it --rm -v "$PWD":/usr/src -w /usr/src php:8.2-cli php encrypt.php

Output:

code: qKUilnBOnSPIOmKnwIoJAdOaC+9lhud/0eiTekLPokmuImFiRpuHvKG6AoUs7eT7fBY=

Decrypt code to get password

If do not have master key, there is no way to decrypt the code

<?php
/**
 * decrypt.php
 */

$masterKey = "canyouguess";
$code = "qKUilnBOnSPIOmKnwIoJAdOaC+9lhud/0eiTekLPokmuImFiRpuHvKG6AoUs7eT7fBY=";

//decrypt password using master key
$password = decrypt($masterKey, $code);
echo "password: ", $password, "\n";

/**
 * @param $masterKey
 * @param $code
 * @return string
 * @throws SodiumException
 */
function decrypt($masterKey, $code)
{
    $raw = base64_decode($code, true);
    if ($raw === false) {
        throw new RuntimeException('Invalid base64');
    }

    // same derived subkey
    $key = sodium_crypto_generichash($masterKey, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES
    );

    $nonceLen = SODIUM_CRYPTO_SECRETBOX_NONCEBYTES;
    if (strlen($raw) < $nonceLen) {
        throw new RuntimeException('Ciphertext too short');
    }

    // extract nonce and ciphertext
    $nonce = mb_substr($raw, 0, $nonceLen, '8bit');
    $ciphertext = mb_substr($raw, $nonceLen, null, '8bit');

    // decrypt & verify
    $plaintext = sodium_crypto_secretbox_open($ciphertext, $nonce, $key);
    if ($plaintext === false) {
        throw new RuntimeException('Decryption failed or message forged');
    }

    return $plaintext;
}

In the same directory of decrypt.php, run:

docker run -it --rm -v "$PWD":/usr/src -w /usr/src php:8.2-cli php decrypt.php

Output:

password: top-secret