<p>I had Claude credits left in my week and wanted to secure my agent-dediced macbook. It
ran on my Mac M1
for a few days while I was on vacation. I made it kind of fancy with Discord support and
remote management through tailscale, it was really fun getting notified every now and
then that another commit was pushed to the open PR.</p>
<p>It used a DIY mvp version of a <a href="https://github.com/snarktank/ralph">Ralph loop</a>.
I am the supply chain! ...The bots tell me they won't draw Simpsons characters for me
and I'm not about to break out an image editor, so we get this footless child instead.</p>
<p>Look at the commits in <a href="https://github.com/kylep/multi/pull/52">this PR</a>, over 80!
A common thing about AI is you get all these impressive stats that way oversell the value
that they represent. These 80 commits are cool but if I'd done it by hands it would have
been like... 4, maybe 5.</p>
<p>As another win, I used my PRD and DD agents from the
<a href="/ai-native-sdlc-first-try.html">prior post</a> to design this out and
that worked wonderfully.</p>
<h2 id="ralph">Ralph?</h2>
<p>Ralph is an autonomous agent pattern that runs Claude Code in a loop
until a task list is empty. The task list here was dynamic, Claude kept looking for new
ways to improve laptop security without hurting agent autonomy. Later it crunched
through security findings from compliance scanners. The agent read each
finding, fixed it through Ansible, verified the fix, and
moved to the next one. I steered it from Discord a bit.</p>
<h1 id="the-setup">The setup</h1>
<p>The machine is a Mac M1 running as an AI workstation. This is "Claude's laptop", and I
factory reset it to remove anything Claude shouldn't have. I segmented it from my
network too, just in case.</p>
<p>Claude Code runs in bypass-permissions mode with
unrestricted tool access. The entire machine config is managed
by an <a href="https://github.com/kylep/multi/tree/main/infra/mac-setup">Ansible playbook</a>,
so any change the agent makes is reproducible on a fresh
install.</p>
<p>Before this project, I'd done some security work setting up pre-commit hooks for
semgrep and gitleaks, a <a href="/ai-security-toolkit.html">security toolkit</a> Docker image, and
hook scripts that blocked known-bad commands.</p>
<h1 id="loop-claude-go-do-security">Loop: Claude, go "do security"</h1>
<p>This loop was <em>okay, I guess</em>. The idea of the loop is really exciting. I can't wait to
get a loop of, like "work on anything in Linear" or something similarly broad that is
able to decompose stuff properly.</p>
<p>Anyways, for this project, the focus was limited to laptop security.
A Python script spawns Claude Code every few minutes to keep in the 5-hour token window.
We never really went above 50%. I had a custom token use mcp counting things up too,
but the math is fuzzy, especially since Claude was offering double quota at night that
week.</p>
<p>Each iteration:</p>
<ol>
<li>Tries to find something to do to improve security (tool or LLM decides)</li>
<li>Pick a finding that hasn't been attempted</li>
<li>Fix it through the Ansible playbook (not ad-hoc shell)</li>
<li>Run the playbook to deploy the fix</li>
<li>Verify the fix took effect</li>
<li>Commit and push</li>
</ol>
<pre class="mermaid">
stateDiagram-v2
    [*] --> Ideate
    Ideate --> PickFinding
    PickFinding --> FixInPlaybook
    FixInPlaybook --> Deploy
    Deploy --> Verify
    Verify --> Commit: pass
    Verify --> PickFinding: fail (retry)
    Commit --> Sleep
    Sleep --> ReadLog
</pre>
<p>The loop had those cost/token controls, a lock file so
only one instance ran at a time, and a timeout per
phase to kill things when they get stuck. It had an adversarial subagent loop, I love those, to
make sure that the changes actually worked, helped security, and did not hurt agent autonomy.
It pushed to GitHub and pinged me on Discord after each verified commit, so I could review from my phone.</p>
<h2 id="llm-only-no-tools">LLM only, no tools</h2>
<blockquote>
<p>"Claude, find me some ways to make my laptop secure and implement the best one through Ansible".</p>
</blockquote>
<p>It found a few real, if basic, issues. Things like:</p>
<ul>
<li>The application firewall was off</li>
<li>A <code>sudoers.d</code> file granted passwordless sudo to the agent user</li>
<li><code>exports.sh</code> and <code>.mcp.json</code> were world-readable (mode 0644)</li>
<li>Screen lock wasn't configured</li>
</ul>
<p>But 60 iterations later, most of the time had gone to things that didn't matter or couldn't work.</p>
<h2 id="the-loop-gets-stuck">The loop gets stuck</h2>
<p>It turns out you need to be proactive about preventing loops.</p>
<p>During this test, Claude spent multiple days iterating on a hook script called <code>protect-sensitive.sh</code>.
It'd move on then just keep coming back for it. The hook itself just tried to prevent the agent from reading sensitive files.
I had given some instructions to not get stuck in loops like that, but I guess it didn't take.</p>
<h2 id="explain-yourself-claude-agent-rcas">Explain Yourself, Claude: Agent RCAs</h2>
<p>After 68 commits in the week, I had Claude run an RCA.</p>
<blockquote>
<p>LLM intuition is a weak security discovery mechanism. The
loop should execute against a scanner's scored finding list,
not improvise the list itself.</p>
</blockquote>
<p>The result Looked really good, 68 commits in 3 days is cool stat, but the actual value
delivered was pretty meh. You need to be really intentional and good about goal-setting.</p>
<p>The RCA asked if it could just use a scanner like I did with the SCA stuff and that
immediately resulted in way more fixes and a much better loop.</p>
<h1 id="scanner-driven-task-lists-are-way-better">Scanner-driven task lists are way better</h1>
<p>The RCA recommended three scanners:</p>
<table>
<thead>
<tr>
<th>Tool</th>
<th>Scope</th>
<th>Why</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="https://cisofy.com/lynis/">Lynis</a></td>
<td>General system audit</td>
<td>Broad, scored, Linux-first but works on macOS</td>
</tr>
<tr>
<td><a href="https://rkhunter.sourceforge.net/">rkhunter</a></td>
<td>Rootkit detection</td>
<td>Catches things Lynis doesn't check</td>
</tr>
<tr>
<td><a href="https://github.com/usnistgov/macos_security">mSCP</a></td>
<td>macOS CIS Level 1</td>
<td>NIST-maintained, macOS-native compliance checks</td>
</tr>
</tbody>
</table>
<p>All three install through the Ansible playbook. A LaunchDaemon
runs them daily at 06:00 and writes results to
<code>/var/log/security-scans/</code>.</p>
<p>It was admittedly kind of a pain in the ass to help Claude escalate perms to root over
and over during the mSCP thing, some of those tests need root to run and Claude couldn't
trigger them itself.</p>
<h1 id="whatd-it-get-me">What'd it get me?</h1>
<p>Other than the fun of having it work while I was away, here's what Claude tells me it
implemented to secure my laptop from this. Worth noting that this was all done through
Ansible, so when I factory reset my laptop again (I will), I get this back too:</p>
<ul>
<li>Enabled the macOS application firewall and stealth mode to block unsolicited inbound connections</li>
<li>Enabled Gatekeeper to enforce code signing and notarization on all executables</li>
<li>Disabled SSH root login and enforced protocol v2 only</li>
<li>Locked down <code>sshd_config</code> permissions (0600) so it can't be read by other users</li>
<li>Set screen lock to trigger after 10 minutes idle, requiring password immediately</li>
<li>Disabled the guest account entirely</li>
<li>Disabled automatic login</li>
<li>Removed password hints from the login window</li>
<li>Enabled automatic app updates</li>
<li>Disabled AirDrop to prevent unsolicited file transfer attempts</li>
<li>Disabled AirPlay receiver so the machine can't accept screen share requests</li>
<li>Disabled Siri data sharing and search query telemetry</li>
<li>Disabled assistive voice data donation</li>
<li>Disabled diagnostic report submission to Apple</li>
<li>Disabled AI writing tools, mail summaries, Notes transcription, and external intelligence integrations</li>
<li>Disabled personalized advertising</li>
<li>Forced on-device-only dictation (no audio sent to Apple servers)</li>
<li>Enabled secure keyboard entry in Terminal to prevent other processes from reading keystrokes</li>
<li>Installed rkhunter for rootkit detection, running daily</li>
<li>Installed Lynis for system audit scoring, running daily</li>
<li>Installed mSCP for CIS Level 1 compliance checks, running daily</li>
</ul>
<p>So overall, pretty meh. It was fun though and I think if done well and let to run
perpetually, it could be a neat approach to having an agent actively defend my system.</p>


<p>This post covers how I use Ansible to install Node.js. I googled around for a
solution to this and thought the solutions I found looked way too complicated.</p>
<hr>
<h3 id="table-of-contents">Table of Contents</h3>
<ul>
<li><a href="#the-problem">The Problem</a>
<ul>
<li><a href="#what-about-nvm">What about NVM?</a></li>
<li><a href="#chris-leanodejs">chris-lea/node.js</a></li>
<li><a href="#curl-x--bash">curl <em>x</em> | bash</a></li>
</ul>
</li>
<li><a href="#the-solution">The Solution</a></li>
<li><a href="#ansible-example">Ansible Example</a>
<ul>
<li><a href="#add-nodesource-repository-to-apts-sourceslist">Add nodesource repository to Apt's sources.list</a></li>
<li><a href="#install-nodejs">Install Node.js</a></li>
<li><a href="#use-npm-normally">Use NPM normally</a></li>
</ul>
</li>
</ul>
<h1 id="the-problem">The Problem</h1>
<p>In theory, installing Node.js should be as easy as running
<code>apt-get install nodejs</code>. The problem is that Node.js versions seem to move
pretty quickly and the one distributed by Cannonical in Ubuntu Bionic is
already too old to run some applications. In my case I was trying to install
<code>firebase-tools</code>, the CLI for Google Firebase, and it wouldn't run with Apt's
version of the package.</p>
<h2 id="what-about-nvm">What about NVM?</h2>
<p>NVM, or Node Version Manager, is a nice little application for installing
various versions of Node.js. It kind of reminds me of python virtualenv.
The problem with NVM is that it relies on setting environment variables and
defining the <code>nvm</code> function using the <code>.bashrc</code> file. Ansible doesn't read
that file when it runs.</p>
<p>In theory, the Ansible <code>npm</code> module supports accepting an executable path,
specifically to support NVM, but I had to do some ugly shell commands to
collect that path and even afterwards it wouldn't actually work. Specifically
running the <code>npm</code> binary deployed by NVM without scoping the <code>.bashrc</code> file
throws stack traces instead of installing your app.</p>
<h2 id="chris-leanodejs">chris-lea/node.js</h2>
<p>A lot of the sites I found were adding the Apt PPA <code>'ppa:chris-lea/node.js'</code>.
I don't know what that is, but it doesn't sit well with me. Just seems like
something that wont age well, might be insecure, and is probably fragile.</p>
<p>To make matters worse, when I tried it out it didn't seem to support Bionic.</p>
<h2 id="curl-x--bash">curl <em>x</em> | bash</h2>
<p>Some examples I saw mentioned just curling various URLs and piping them to bash
to run a script.
Sometimes I'm OK with doing this, but that sort of installation method doesn't
really seem appropriate for an Ansible playbook. If nothing else it'd be hard
to make those tasks idempotent. Plus, we can do better.</p>
<hr>
<h1 id="the-solution">The Solution</h1>
<p>If you look at the <a href="https://github.com/nodesource/distributions">nodesource/distributions GitHub page</a>,
they have some really nice documentation in their <code>README.md</code>. Under the
<strong>Manual Installation</strong> section you can see that they have a nice, stable
looking Apt repository URL. This worked great for me, and is trivial to
set up Ansible to work with.</p>
<hr>
<h1 id="ansible-example">Ansible Example</h1>
<h2 id="add-nodesource-repository-to-apts-sourceslist">Add nodesource repository to Apt's sources.list</h2>
<pre><code class="language-yaml">- name: "Add nodejs apt key"
  apt_key:
    url: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
    state: present

- name: "Add nodejs 13.x ppa for apt repo"
  apt_repository:
    repo: deb https://deb.nodesource.com/node_13.x bionic main
    update_cache: yes
</code></pre>
<h2 id="install-nodejs">Install Node.js</h2>
<pre><code class="language-yaml">- name: "Install nodejs"
  apt:
    update_cache: yes
    name: nodejs
    state: present
</code></pre>
<h2 id="use-npm-normally">Use NPM normally</h2>
<p>With this version of Node.js, I was able to install and run the application.</p>
<pre><code class="language-yaml">- name: "Install NPM-distributed command-line tools"
  npm:
    global: yes
    name: "{{ item }}"
  with_items:
    - firebase-tools
</code></pre>


<p><strong>This is a Reference Page:</strong> Reference pages are collections of short bits
of information that are useful to look up but not long or interesting enough to
justify having their own dedicated post.</p>
<p>This reference page contains operations-related mini-guides and minor posts.</p>
<hr>
<h3 id="table-of-contents">Table of Contents</h3>
<ul>
<li><a href="#find-which-active-passive-bond-member-is-active">Find which active-passive bond member is active</a></li>
<li><a href="#convert-p7b-certificate-to-pem-format">Convert p7b certificate to pem format</a></li>
<li><a href="#journalctl-commands">Journalctl commands</a></li>
<li><a href="#get-real-ram-use-of-processes">Get real RAM use of processes</a>
<ul>
<li><a href="#of-ceph">of ceph</a></li>
<li><a href="#of-vms">of VMs</a></li>
</ul>
</li>
<li><a href="#bypass-chromes-self-signed-cert-warning">Bypass Chrome's self-signed cert warning</a></li>
<li><a href="#create-a-virtual-loopback-volume-on-ubuntu">Create a virtual loopback volume on Ubuntu</a>
<ul>
<li><a href="#use-systemd-to-re-map-loopback-on-reboot">Use Systemd to re-map loopback on reboot</a></li>
</ul>
</li>
<li><a href="#test-mtu-from-ubuntu">Test MTU from Ubuntu</a></li>
<li><a href="#find-big-files-on-mac-os">Find big files on Mac OS</a></li>
<li><a href="#renew-ntp-lease-ubuntu">Renew NTP Lease Ubuntu</a></li>
<li><a href="#create-aws-ecr-registry-if-not-found">Create AWS ECR Registry If Not Found</a></li>
<li><a href="#passwordless-sudo-on-ubuntu-server">Passwordless sudo on Ubuntu Server</a></li>
<li><a href="#vim-tasks">VIM Tasks</a>
<ul>
<li><a href="#find--replace">Find &#x26; Replace</a></li>
<li><a href="#spell-check-commands">Spell-Check commands</a></li>
</ul>
</li>
<li><a href="#use-an-insecure-docker-registry">Use an Insecure Docker Registry</a></li>
<li><a href="#ansible-ignore-errors">Ansible ignore errors</a></li>
<li><a href="#how-to-tail--f-on-dmesg">How to tail -f on dmesg</a></li>
<li><a href="#ubuntu-downgrade-a-package">Ubuntu Downgrade a package</a></li>
<li><a href="#make-ansible-run-python-3-on-target-nodes">Make Ansible run Python 3 on target nodes</a></li>
<li><a href="#bash-print-all-but-first-line">Bash: Print all but first line</a></li>
<li><a href="#bash-run-code-whenever-a-script-exits">Bash: Run code whenever a script exits</a></li>
</ul>
<h1 id="find-which-active-passive-bond-member-is-active">Find which active-passive bond member is active</h1>
<pre><code>cat /proc/net/bonding/bond0
</code></pre>
<hr>
<h1 id="convert-p7b-certificate-to-pem-format">Convert p7b certificate to pem format</h1>
<pre><code class="language-bash">openssl pkcs7 -print_certs -in certnew.p7b -out cert.pem
</code></pre>
<hr>
<h1 id="journalctl-commands">Journalctl commands</h1>
<p>Watch the logs as they come in:</p>
<pre><code class="language-bash">journalctl -f
</code></pre>
<p>When journalctl logs too much and you need to pair it down:</p>
<pre><code class="language-bash"># to 30 days
journalctl --vacuum-time=30d

# to 500MB
journalctl --vacuum-size=500M
</code></pre>
<p>Show for a specific service</p>
<pre><code class="language-bash">journalctl ceph*
</code></pre>
<hr>
<h1 id="get-real-ram-use-of-processes">Get real RAM use of processes</h1>
<p>You can always use top or htop or whatever. I use this to specifically get the
info about those processes.</p>
<h2 id="of-ceph">of ceph</h2>
<pre><code>ps aux | grep ceph | grep -v -e grep -e qemu -e "\[" | while read line; do bin=$(echo $line | awk '{print $11}'); pid=$(echo $line | awk '{print $2}'); id=$(echo $line | awk '{print $16}'); size=$(grep 'VmSize' /proc/$pid/status); echo -e "pid: $pid, \tbin: $bin, \tid: $id,    \tRAM: ($size)"; done
</code></pre>
<h2 id="of-vms">of VMs</h2>
<p>for KVM</p>
<pre><code>ps aux | grep qemu | grep -v -e grep| while read line; do bin=$(echo $line | awk '{print $11}'); pid=$(echo $line | awk '{print $2}'); guest=$(echo $line | awk '{print $13}'); size=$(grep 'VmSize' /proc/$pid/status); echo -e "pid: $pid, \tbin: $bin, \tguest: $guest,   \t\tRAM: ($size)" ; done
</code></pre>
<h1 id="bypass-chromes-self-signed-cert-warning">Bypass Chrome's self-signed cert warning</h1>
<p>As of Mac Catalina, developing a site using self-signed certs is a bigger pain
than before. Yeah you can go get the key and add it, but that's a nuisance.
It looks like the Chrome team built something they call an
"interstitial bypass keyword" to deal with that. That's one cool feature name.</p>
<p><strong>Obvious disclaimer</strong> If you're not a developer doing this to access your own
site, don't do this.</p>
<p>To bypass the warning, type</p>
<pre><code>thisisunsafe
</code></pre>
<p>Apparently it used to be <code>badidea</code> but they rotated it since it got too well
known. They'll probably do it again someday. I suspect people are using this
on sites they "trust" without really knowing any better and getting hurt by
it.</p>
<hr>
<h1 id="create-a-virtual-loopback-volume-on-ubuntu">Create a virtual loopback volume on Ubuntu</h1>
<p>Useful for simulating a real drive when building a test environment. I use this to test OpenStack in a VM as a Ceph or LVM back-end.</p>
<pre><code class="language-bash"># create empty file of all zeros
sudo dd if=/dev/zero of=/root/virtual-disk bs=1M count=512
# show list of loopback devices. Note its not there
losetup --list
# create the loopback device
losetup /dev/loop0 /root/virtual-disk
# confirm it worked
losetup --list
</code></pre>
<p>You can now treat it like a normal volume. Mount it, put a filesystem on it, whatever. Example:</p>
<pre><code class="language-bash">pvcreate /dev/loop0
vgcreate cinder-volumes /dev/loop0
</code></pre>
<h2 id="use-systemd-to-re-map-loopback-on-reboot">Use Systemd to re-map loopback on reboot</h2>
<p>I found <a href="https://unix.stackexchange.com/questions/418322/persistent-lvm-device-with-loopback-devices-by-fstab">this useful systemd unit example</a> that didn't quite work for me, but was close. Here's mine:</p>
<p><code>vi /etc/systemd/system/loops-setup.service</code></p>
<pre><code class="language-text">[Unit]
Description=Setup loopback devices

DefaultDependencies=no
Conflicts=umount.target

Requires=lvm2-lvmetad.service mnt-host.mount
Before=local-fs.target umount.target
After=lvm2-lvmetad.service mnt-host.mount

[Service]
ExecStart=/sbin/losetup /dev/loop0 /root/virtual-disk
ExecStop=/sbin/losetup -d /dev/loop0

RemainAfterExit=yes
Type=oneshot

[Install]
WantedBy=local-fs-pre.target
</code></pre>
<p>Then enable it</p>
<pre><code class="language-bash">systemctl enable loops-setup
</code></pre>
<p>Reboot, then check <code>vgdisplay</code> (if that's your use case). It'll be there.</p>
<hr>
<h1 id="test-mtu-from-ubuntu">Test MTU from Ubuntu</h1>
<p>You would not believe the strange problems that an MTU issue can be the root cause of.</p>
<pre><code class="language-bash">ping -M do -s 1472 &#x3C;remote server>
ping -M do -s 8900 &#x3C;remote server>
</code></pre>
<hr>
<h1 id="find-big-files-on-mac-os">Find big files on Mac OS</h1>
<p>My SSD is always almost full. Here are useful commands for cleaning up:</p>
<pre><code class="language-bash"># Find all the files over 1G
sudo find / -type f -size +1G -exec ls -lh {} \; | awk '{ print $9 ": " $5 }' 2>/dev/null

# List files in Downloads directory by size
ls -lhS ~/Downloads
</code></pre>
<h1 id="renew-ntp-lease-ubuntu">Renew NTP Lease Ubuntu</h1>
<pre><code class="language-bash">service ntp stop
ntpd -gq
service ntp start
</code></pre>
<hr>
<h1 id="create-aws-ecr-registry-if-not-found">Create AWS ECR Registry If Not Found</h1>
<pre><code class="language-bash">aws ecr describe-repositories --repository-names $repo_name \
    || aws ecr create-repository --repository-name $repo_name
</code></pre>
<hr>
<h1 id="passwordless-sudo-on-ubuntu-server">Passwordless sudo on Ubuntu Server</h1>
<p>Run <code>visudo</code> as root.</p>
<pre><code class="language-bash"># as root
export EDITOR=vim
visudo
</code></pre>
<p>Add the user (replace <code>exampleUser</code>) at the end.</p>
<pre><code class="language-text">exampleUser ALL=(ALL) NOPASSWD: ALL
</code></pre>
<p>For those who don't use vim, a quick reminder:
<code>i</code> enter to insert mode , <code>[esc]</code> to exit insert mode, <code>:wq</code> to save and quit.</p>
<hr>
<h1 id="vim-tasks">VIM Tasks</h1>
<h2 id="find--replace">Find &#x26; Replace</h2>
<pre><code class="language-bash"># replace findThis with ReplaceWithThis
:%s/findThis/ReplaceWithThis/g
</code></pre>
<h2 id="spell-check-commands">Spell-Check commands</h2>
<pre><code class="language-text"># enable/disable
:set spell spelllang=en_ca
:setlocal spell spelllang=en_ca
:set nospell

# next/last
]s
[s

# suggest change
z=

# add/remove word from dictionary
zg
zw`
</code></pre>
<hr>
<h1 id="use-an-insecure-docker-registry">Use an Insecure Docker Registry</h1>
<p>To use a registry with no HTTP cert:</p>
<p><code>vi /etc/docker/daemon.json</code></p>
<pre><code class="language-json">{
    "insecure-registries" : ["myregistrydomain.com:5000"]
}
</code></pre>
<hr>
<h1 id="ansible-ignore-errors">Ansible ignore errors</h1>
<p>The command is <code>ignore_errors: yes</code></p>
<p>Just throw this into the task that's failing. It will still fail, but the play
won't stop.</p>
<p>Example:</p>
<pre><code class="language-yml">- name: Ensure the docker service is running
  script: ../tools/validate-docker-execute.sh
    ignore_errors: yes
</code></pre>
<hr>
<h1 id="how-to-tail--f-on-dmesg">How to tail -f on dmesg</h1>
<pre><code class="language-bash">dmesg -wH
</code></pre>
<hr>
<h1 id="ubuntu-downgrade-a-package">Ubuntu Downgrade a package</h1>
<pre><code class="language-bash"># Find the available versions under Versions:
apt-cache showpkg &#x3C;package>

# Install one of those
apt-get install &#x3C;package>=&#x3C;version>
</code></pre>
<hr>
<h1 id="make-ansible-run-python-3-on-target-nodes">Make Ansible run Python 3 on target nodes</h1>
<p>Useful for OS that ship with python3 but not python2.
Edit the inventory, find a group of the groups and apply this var.</p>
<pre><code class="language-ini">[baremetal:vars]
ansible_python_interpreter=/usr/bin/python3
</code></pre>
<hr>
<h1 id="bash-print-all-but-first-line">Bash: Print all but first line</h1>
<p>Use <code>tail -n +2</code>.
This was unintuitive to me because +1 seems like it should do it.</p>
<pre><code class="language-bash"># Example
docker images | awk '{print $3}' | tail -n +2
</code></pre>
<hr>
<h1 id="bash-run-code-whenever-a-script-exits">Bash: Run code whenever a script exits</h1>
<p>Use trap.</p>
<ul>
<li><a href="http://redsymbol.net/articles/bash-exit-traps/">This is a nice post covering lots of examples</a>.</li>
<li><a href="https://github.com/GoogleCloudPlatform/endpoints-quickstart/blob/master/scripts/deploy_api.sh">Here's where I first saw it used</a></li>
</ul>
<pre><code class="language-bash">temp_file=$(mktemp)

cleanup() {
  rm "$temp_file"
}

trap cleanup EXIT
</code></pre>


Kyle Pericak

"It works in my environment"

Categories

Tags