# \[20160606214509\] VPC Security, Docker Daemon and Papertrail Changes

**URL:** <https://community.convox.com/t/20160606214509-vpc-security-docker-daemon-and-papertrail-changes/380>\
**Category:** Releases\
**Created:** [June 6, 2016, 9:44pm UTC](https://community.convox.com/t/20160606214509-vpc-security-docker-daemon-and-papertrail-changes/380 "2016-06-06T21:44:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddollar](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.convox.com/ddollar/32/3_2.png) [@ddollar](https://community.convox.com/u/ddollar)\
**Post date:** [June 6, 2016, 9:44pm UTC](https://community.convox.com/t/20160606214509-vpc-security-docker-daemon-and-papertrail-changes/380/1 "2016-06-06T21:44:45Z")

</div>

## VPC Security Enhancements

The Rack VPC Security Group no longer exposes the SSH port to the world (0.0.0.0/0). It now accepts traffic only from inside the Rack VPC, which is sufficient because of the `convox instances ssh` websocket tunneling.

Thanks [@beedub](https://github.com/beedub) for the security improvement!

For more info see PR [#716](https://github.com/convox/rack/pull/716): Change ssh port sg to use vpc cidr, not 0.0.0.0.

## Docker Daemon Changes

This week we discovered that Docker 1.11 was surprisingly showing up in production environments, and causing `convox run` to errantly exit non-zero in some cases.

The new update no longer applies updates on boot for anything but critical system security, effctively pinning Docker back to 1.09.

We will update Docker to 1.11 along with new ECS AMIs in the near future.

This update also changes the Docker Daemon limit for number of open files from 1024 to 1024000.

[@awsmsrc](https://github.com/awsmsrc) found a great suggestion for a higher limit by [[@pahud](https://github.com/pahud) on Medium]([https://medium.com/](https://medium.com/)[@pahud](https://github.com/pahud)/ulimit-of-nofile-in-amazon-ecs-optimized-ami-6790aedee582) as a much better setting for modern web applications.

For more information see PR [#704](https://github.com/convox/rack/pull/704) Up ulimit for dockerd and PR [#728](https://github.com/convox/rack/pull/728) dont upgrade all packages.

## Papertrail Deprecation

In anticipation of [removing Kinesis to save us all money](https://github.com/convox/rack/pull/722) this update blocks `convox service create papertrail`.

Now you should use `convox services create syslog --url tcp+tls://logs1.papertrailapp.com:12345` to forward logs from CloudWatch Logs to Papertrail via secure syslog. See the [Syslog Docs](https://convox.com/docs/syslog/) for more information.

For more information see PR [#719](https://github.com/convox/rack/pull/719) Syslog bugfixes and Papertrail deprecation.

## Scale Down to Delete Unneded ELBs

[@mwarkentin](https://github.com/mwarkentin) reported a couple bugs in the new feature that removes unneeded ELBs. You can now run `convox scale redis --count=-1` to remove ELBs, even if they are linked to another process. You can also still `convox run redis bash` even if the process type is not running.

For more information see PR [#721](https://github.com/convox/rack/pull/721) and [#726](https://github.com/convox/rack/pull/726)