(gdb) break php_handler
Breakpoint 1 at 0xffffb5f004c8
(gdb) continue
Continuing.
Breakpoint 1, 0x0000ffffb5f004c8 in php_handler () from /usr/lib/apache2/modules/libphp.so
(gdb) bt
#0 0x0000ffffb5f004c8 in php_handler () from /usr/lib/apache2/modules/libphp.so
#1 0x0000aaaaea10d474 in ap_run_handler ()
#2 0x0000aaaaea10dbf4 [PAC] in ap_invoke_handler ()
#3 0x0000aaaaea12777c [PAC] in ap_process_async_request ()
#4 0x0000aaaaea127938 [PAC] in ap_process_request ()
#5 0x0000aaaaea12380c [PAC] in ?? ()
#6 0x0000aaaaea117834 [PAC] in ap_run_process_connection ()
#7 0x0000ffffb6bf43c0 [PAC] in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#8 0x0000ffffb6bf476c [PAC] in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#9 0x0000ffffb6bf4e6c [PAC] in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so
#10 0x0000aaaaea0eb498 [PAC] in ap_run_mpm ()
#11 0x0000aaaaea0e20bc [PAC] in main ()~
(gdb) info address php_handler
Symbol "php_handler" is at 0xffffb5f004c4 in a file compiled without debugging.
(gdb) x/i $pc
=> 0xffffb5f004c8 <php_handler+4>: adrp x1, 0xffffb6ace000 <ini_entries+208>
(gdb) p/x $pc
$1 = 0xffffb5f004c8
(gdb) info args
No symbol table info available.
(gdb) gdb locals
Undefined command: "gdb". Try "help".
(gdb) info locals
No symbol table info available.
(gdb) info frame
Stack level 0, frame at 0xffffca360170:
pc = 0xffffb5f004c8 in php_handler; saved pc = 0xaaaaea10d474
called by frame at 0xffffca3601a0
Arglist at 0xffffca360150, args:
Locals at 0xffffca360150, Previous frame's sp is 0xffffca360170
Saved registers:
x29 at 0xffffca360150, x30 at 0xffffca360158
終了する場合は quit です
その他
gdb には他にもたくさんのコマンドがあります
info proc exe
info sharedlibrary
最後に
AI 先生に教えてもらえば覚える必要はないですが理解するとなるとやはり自分の手で実行したほうが良いと実感します
Compatibility Note: Strix relies on advanced agentic capabilities (tool use, multi-step planning, self-correction). Most local models, especially those under 70B parameters, struggle with these complex tasks.
For critical assessments, we strongly recommend using state-of-the-art cloud models like Claude 4.5 Sonnet or GPT-5. Use local models only when privacy is the absolute priority.
curl -fsSL https://chatgpt.com/codex/install.sh | sh
モデルダウンロード
ollama pull gemma4:26b
ollama 設定
sudo systemctl edit ollama.service
### Editing /etc/systemd/system/ollama.service.d/override.conf
### Anything between here and the comment below will become the contents of the drop-in file
[Service]
Environment="OLLAMA_CONTEXT_LENGTH=66536"
### Edits below this comment will be discarded
### /etc/systemd/system/ollama.service
# [Unit]
# Description=Ollama Service
# After=network-online.target
#
# [Service]
# ExecStart=/usr/local/bin/ollama serve
# User=ollama
# Group=ollama
# Restart=always
# RestartSec=3
# Environment="PATH="
#
# [Install]
# WantedBy=default.target
Get:1 https://cli.github.com/packages stable InRelease [3,917 B]
Hit:2 https://aquasecurity.github.io/trivy-repo/deb generic InRelease
Err:1 https://cli.github.com/packages stable InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5612B36462313325
Hit:3 https://download.docker.com/linux/ubuntu noble InRelease
Get:4 https://apt.releases.hashicorp.com noble InRelease [12.8 kB]
Err:4 https://apt.releases.hashicorp.com noble InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FC9CA96ACA026560
Hit:5 http://repo.mysql.com/apt/ubuntu noble InRelease
Hit:6 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:7 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:8 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:9 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease
Hit:10 https://ppa.launchpadcontent.net/git-core/ppa/ubuntu noble InRelease
Get:11 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease [8,371 B]
Get:12 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease [8,220 B]
Get:13 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease [8,235 B]
Get:14 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease [8,213 B]
Fetched 49.8 kB in 4s (12.9 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
3 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://cli.github.com/packages stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5612B36462313325
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://apt.releases.hashicorp.com noble InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FC9CA96ACA026560
W: Failed to fetch https://cli.github.com/packages/dists/stable/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5612B36462313325
W: Failed to fetch https://apt.releases.hashicorp.com/dists/noble/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FC9CA96ACA026560
W: Some index files failed to download. They have been ignored, or old ones used instead.
root@ubuntu:/etc/apt/preferences.d# apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
docker-buildx-plugin is already the newest version (0.38.0-1~ubuntu.22.04~jammy).
docker-buildx-plugin set to manually installed.
docker-compose-plugin is already the newest version (5.6.0-1~ubuntu.22.04~jammy).
docker-compose-plugin set to manually installed.
The following packages were automatically installed and are no longer required:
libfwupd2 libfwupdplugin5 libgcab-1.0-0 libgusb2 libltdl7 libmbim-glib4 libmbim-proxy libmm-glib0 libqmi-glib5 libqmi-proxy libsmbios-c2 libtcl8.6 modemmanager
tcl tcl8.6 usb-modeswitch usb-modeswitch-data
Use 'apt autoremove' to remove them.
Suggested packages:
cgroupfs-mount | cgroup-lite docker-model-plugin
The following packages will be upgraded:
containerd.io docker-ce docker-ce-cli
3 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.
Need to get 65.4 MB of archives.
After this operation, 22.6 MB of additional disk space will be used.
N: Ignoring file 'docker.pref.back' in directory '/etc/apt/preferences.d/' as it has an invalid filename extension
Do you want to continue? [Y/n] Y
Get:1 https://download.docker.com/linux/ubuntu jammy/stable amd64 docker-ce-cli amd64 5:29.9.1-1~ubuntu.22.04~jammy [17.6 MB]
Get:2 https://download.docker.com/linux/ubuntu jammy/stable amd64 containerd.io amd64 2.4.2-2~ubuntu.22.04~jammy [23.3 MB]
Get:3 https://download.docker.com/linux/ubuntu jammy/stable amd64 docker-ce amd64 5:29.9.1-1~ubuntu.22.04~jammy [24.6 MB]
Fetched 65.4 MB in 1s (48.8 MB/s)
(Reading database ... 109872 files and directories currently installed.)
Preparing to unpack .../docker-ce-cli_5%3a29.9.1-1~ubuntu.22.04~jammy_amd64.deb ...
Unpacking docker-ce-cli (5:29.9.1-1~ubuntu.22.04~jammy) over (5:25.0.5-1~ubuntu.22.04~jammy) ...
Preparing to unpack .../containerd.io_2.4.2-2~ubuntu.22.04~jammy_amd64.deb ...
Unpacking containerd.io (2.4.2-2~ubuntu.22.04~jammy) over (2.4.1-2~ubuntu.22.04~jammy) ...
Preparing to unpack .../docker-ce_5%3a29.9.1-1~ubuntu.22.04~jammy_amd64.deb ...
Unpacking docker-ce (5:29.9.1-1~ubuntu.22.04~jammy) over (5:25.0.5-1~ubuntu.22.04~jammy) ...
Setting up containerd.io (2.4.2-2~ubuntu.22.04~jammy) ...
/usr/sbin/policy-rc.d returned 101, not running 'restart containerd.service'
Setting up docker-ce-cli (5:29.9.1-1~ubuntu.22.04~jammy) ...
Setting up docker-ce (5:29.9.1-1~ubuntu.22.04~jammy) ...
invoke-rc.d: policy-rc.d denied execution of restart.
/usr/sbin/policy-rc.d returned 101, not running 'restart docker.service docker.socket'
Processing triggers for man-db (2.10.2-1) ...
Scanning processes...
Scanning candidates...
Scanning linux images...
Running kernel seems to be up-to-date.
Restarting services...
systemctl restart fwupd.service irqbalance.service multipathd.service open-vm-tools.service packagekit.service polkit.service rsyslog.service ssh.service systemd-timesyncd.service systemd-udevd.service udisks2.service unbound.service upower.service
Service restarts being deferred:
systemctl restart ModemManager.service
systemctl restart containerd.service
/etc/needrestart/restart.d/dbus.service
systemctl restart docker.service
systemctl restart networkd-dispatcher.service
systemctl restart systemd-logind.service
systemctl restart unattended-upgrades.service
No containers need to be restarted.
No user sessions are running outdated binaries.
No VM guests are running outdated hypervisor (qemu) binaries on this host.
docker 再起動
systemctl restart containerd.service
systemctl restart docker.service
確認
docker version
Client: Docker Engine - Community
Version: 29.9.1
API version: 1.56
Go version: go1.26.9
Git commit: dfc520d
Built: Wed Oct 14 18:32:26 2026
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 29.9.1
API version: 1.56 (minimum version 1.40)
Go version: go1.26.9
Git commit: b26fb77
Built: Wed Oct 14 18:32:26 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.4.2
GitCommit: b7a25261e029d68978bbf290df0a62fc819b3c51
runc:
Version: 1.5.2
GitCommit: v1.5.2-0-g29dd3dc2
docker-init:
Version: 0.19.0
GitCommit: de40ad0
最後に
今回は Docker CE のバージョンを APT preferences で指定しています。次回以降に更新する場合は、リポジトリの更新候補を確認し、必要に応じてピン留め設定を変更します。
semgrep:# A Docker image with Semgrep installed.image: semgrep/semgrep
# Run the "semgrep ci" command on the command line of the docker image.script: semgrep ci
rules:# Allow triggering a scan manually from the GitLab UI-if: $CI_PIPELINE_SOURCE == "web"
# Scan changed files in MRs, (diff-aware scanning):-if: $CI_MERGE_REQUEST_IID
# Scan mainline (default) branches and report all findings.-if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
variables:# Connect to Semgrep AppSec Platform through your SEMGREP_APP_TOKEN.# Generate a token from Semgrep AppSec Platform > Settings# and add it as a variable in your GitLab CI/CD project settings.SEMGREP_APP_TOKEN: $SEMGREP_APP_TOKEN
こんな感じらしいです
当然ですがローカルで実行してエラーをすべて解消しないと CI してもエラーになるので注意してください
cat> /tmp/sshd-legacy-test/sshd_config <<'EOF'
Port 2222
ListenAddress 127.0.0.1
HostKey /tmp/sshd-legacy-test/ssh_host_rsa_key
PidFile /tmp/sshd-legacy-test/sshd.pid
LogLevel VERBOSE
UsePAM no
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PermitRootLogin no
AllowUsers devops
X11Forwarding no
AllowTcpForwarding no
PrintMotd no
Subsystem sftp internal-sftp
KexAlgorithms +diffie-hellman-group14-sha1
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
EOF
Hermes CLI + litellm でカスタムエンドポイントを設定する方法を紹介しました
Hermes CLI 自体は Google AI Studio に対応しているので使えます
設定しているカスタムエンドポイント側の gemini が function calling や web_search に対応していなかったりリクエストやレスポンスの形式が少し異なる場合にはそのままでは使えません
services:litellm:image: docker.litellm.ai/berriai/litellm:latest
container_name: litellm
environment:- AI_SERVICE_API_KEY=${AI_SERVICE_API_KEY}ports:-"4000:4000"volumes:- ./litellm_config.yaml:/app/config.yaml
restart: unless-stopped
command:["--config","/app/config.yaml"]gemini-proxy:# Python proxy for gemini CLI (native Gemini API format).# Replaces nginx because request body JSON transformation is required:# strips unsupported 'id' field from function_call/function_response,# rewrites :streamGenerateContent?alt=sse → :streamGenerateContentSse,# and injects AI_SERVICE_API_KEY as x-goog-api-key header.# Configure gemini CLI to use port 4001 instead of 4000.build:context: .
dockerfile: Dockerfile.proxy
container_name: gemini-proxy
environment:- AI_SERVICE_API_KEY=${AI_SERVICE_API_KEY}ports:-"4001:4001"restart: unless-stopped
proxy.py
API を互換させるためのプロキシです
先ほども紹介しましたが custom endpoint が完全互換の場合は不要です
#!/usr/bin/env python3"""
Proxy for gemini CLI → Your custom Gemini endpoint.
Handles:
- URL mapping: :streamGenerateContent?alt=sse → :streamGenerateContentSse
- Request body: strip unsupported 'id' field from function_call / function_response
- Auth: replace incoming key with AI_SERVICE_API_KEY as x-goog-api-key header
"""import json
import os
import httpx
from fastapi import FastAPI, Request
from fastapi.responses import Response, StreamingResponse
CUSTOM_BASE = os.environ.get("CUSTOM_BASE","https://your-gemini-custom-endpoint",)
API_KEY = os.environ["AI_SERVICE_API_KEY"]
app = FastAPI()defstrip_unsupported_fields(body:dict)->dict:"""Strip 'id' from function_call/function_response — field not supported by this endpoint."""for content in body.get("contents",[]):for part in content.get("parts",[]):for key in("functionCall","function_call"):ifisinstance(part.get(key),dict):
part[key].pop("id",None)for key in("functionResponse","function_response"):ifisinstance(part.get(key),dict):
part[key].pop("id",None)return body
@app.post("/v1beta/models/{model}:{method}")asyncdefproxy(request: Request, model:str, method:str):
is_streaming = method =="streamGenerateContent"# Custom endpoint uses a dedicated SSE endpoint instead of ?alt=sse query param
target_method ="streamGenerateContentSse"if is_streaming else method
target_url = f"{CUSTOM_BASE}/{model}:{target_method}"
body_bytes =await request.body()try:
body = strip_unsupported_fields(json.loads(body_bytes))
body_bytes = json.dumps(body, ensure_ascii=False).encode()except(json.JSONDecodeError, AttributeError):pass
upstream_headers ={"Content-Type":"application/json","x-goog-api-key": API_KEY}if is_streaming:asyncdefgenerate():asyncwith httpx.AsyncClient(timeout=120.0)as client:asyncwith client.stream("POST", target_url, content=body_bytes, headers=upstream_headers
)as resp:asyncfor chunk in resp.aiter_bytes():yield chunk
return StreamingResponse(
generate(),
media_type="text/event-stream",
headers={"Cache-Control":"no-cache","X-Accel-Buffering":"no"},)else:asyncwith httpx.AsyncClient(timeout=120.0)as client:
resp =await client.post(
target_url, content=body_bytes, headers=upstream_headers
)return Response(
content=resp.content,
status_code=resp.status_code,
media_type=resp.headers.get("content-type","application/json"),)
Dockerfile.proxy
先程の proxy.py をビルドしてイメージを作成する dockerfile です
FROM python:3.12-slim
WORKDIR /app
RUN pip install --no-cache-dir fastapi httpx uvicorn
COPY proxy.py .
CMD["uvicorn","proxy:app","--host","0.0.0.0","--port","4001"]
model_list:-model_name: gemini-3.5-flash
litellm_params:# gemini/ prefix is required to use API key auth instead of Vertex AI ADC.# Model name must match model_name above to avoid LiteLLM response model override error# that corrupts streaming responses. drop_params: true handles unsupported fields.model: gemini/gemini-3.5-flash
api_base: https://your-gemini-custom-endpoint:generateContent
api_key: os.environ/AI_SERVICE_API_KEY
max_tokens:4096temperature:0.2rpm:30tpm:60000-model_name: gemini-3.1-flash-lite
litellm_params:# gemini/ prefix is required to use API key auth instead of Vertex AI ADC.model: gemini/gemini-3.5-flash
api_base: https://your-gemini-custom-endpoint:generateContent
api_key: os.environ/AI_SERVICE_API_KEY
litellm_settings:drop_params:truegeneral_settings:global_max_parallel_requests:1max_parallel_requests:1# Pass-through: forward native Gemini API requests (/v1beta/models/...) directly# to the upstream endpoint, bypassing LiteLLM's model routing and SDK layer.# This avoids the "cannot override response model" bug caused by GenerateContentResponse# not having a 'model' attribute in LiteLLM's google_genai provider path.pass_through_endpoints:-path:"/v1beta/models/{path:path}"target:"https://your-gemini-custom-endpoint/gemini/{path}"headers:x-goog-api-key: os.environ/AI_SERVICE_API_KEY
router_settings:num_retries:0retry_after:20allowed_fails:1cooldown_time:180timeout:120stream_timeout:120server_settings:port:4000
