Container Camp
Container Camp
  • Видео 138
  • Просмотров 566 418
Don’t be a fail whale, secure your containers - Sarah Young (Versent)
In the talk, Sarah will look at the different layers of security that can be applied to a container ecosystem and the different team's responsibility in the ecosystem to deliver security. From the sysadmin's point of view, how do I make sure the container orchestrator is secured, what official hardening guides are out there to follow. From an application developers point of view, how does secomp/appapparmor work? To make sure that only the process from the application has access to the host machine. Now that we have the local container secured, how do we make sure our deployments follow the same structure and security profiles. Lastly with our developer's hat on we will look at least priv...
Просмотров: 764

Видео

Running Kubernetes in Production A Million Ways to Crash Your Cluster - Henning Jacobs (Zalando)
Просмотров 8264 года назад
Bootstrapping a Kubernetes cluster is easy, rolling it out to nearly 200 engineering teams and operating it at scale is a challenge. In this talk, we are presenting our approach to Kubernetes provisioning on AWS, operations and developer experience for our growing Zalando developer base. We will walk you through our horror stories of operating 80 clusters and share the insights we gained from i...
Pragmatic Pod Patterns: Leveraging sidecar containers in Kubernetes - James Relph (Capgemini)
Просмотров 4824 года назад
While it's easy to take a pod=container approach when working with Kubernetes, taking comprehensive advantage of Kubernetes' pod's ability to share resources between containers on a node can have significant benefits. In this talk I will share some of the patterns and concepts we've used which have helped to speed delivery, spread best practice and improve security. James is a Senior Platform E...
Container Images Considered Harmful - Aleksa Sarai (SUSE)
Просмотров 4644 года назад
Effectively all modern container image formats are based on tar, and many proposed improvements to formats are only surface-level changes. In an attempt to make their images smaller, a lot of users end up patching over the underlying issue by using smaller distribution images and stunting their container images. In this talk, we will discuss the many drawbacks of using tar and outline how image...
Container Images Considered Harmful - Aleksa Sarai (SUSE)
Просмотров 1474 года назад
Lightning talk session at Container Camp AU 2018
Filesystem mounts in user namespaces - Christian Brauner
Просмотров 1,7 тыс.4 года назад
User namespaces have become one of the most important security features for container workloads. But since they can be created by any user on the system they restrict access to a wide range of features including mounting of filesystems. In recent years a lot of work went into making mounts of filesystems from non-initial user namespace safe. Starting with kernel 4.18 it is possible to mount FUS...
The Route To Rootless Containers - Claudia Beresford (Pivotal)
Просмотров 2,9 тыс.4 года назад
Rootless containers are a new and exciting development in the container community, offering the ability to create and manage containers as a completely unprivileged, non-root user. During this presentation, Claudia will share her team's learnings from the journey to adopting rootless containers in production for a large multi-tenant PaaS (Cloud Foundry). The talk contains a technical overview o...
In the beginning was the server - Matt Butcher (Microsoft)
Просмотров 2644 года назад
The opening keynote from Container Camp UK 2018. Matt Butcher is the head of the CNCF Helm project. He is a principal engineer at Microsoft, where he leads the cloud native open source team that works on Draft, Brigade, Kashti, and Helm. He is the author of eight technical books (most recently "Go in Practice" with Matt Farina). He also wrote the Illustrated Children's Guide to Kubernetes. Matt...
Consuming cloud services with the Kubernetes Service Catalog - Neil Peterson (Microsoft)
Просмотров 1274 года назад
In a cloud native world, managed services such as database, storage, and event processing systems can be utilized by applications without the overhead of total service ownership. Kubernetes provides an extension mechanism for dynamically requesting and consuming managed services through the Kubernetes Service Catalog API. Using the service catalog, you can deploy applications into your Kubernet...
Istio: Weaving, Securing and Observing microservices - Lin Sun (IBM)
Просмотров 2304 года назад
With the rapid adoption of microservices, Istio has become the de facto framework to load-balance, route, secure and monitor the traffic that flows between microservices. Istio provides a common networking, security, policy and telemetry substrate for services that we call a 'Service-Mesh'. Come learn how the service-mesh helps with the transition to microservices, to empower operations teams, ...
Istio 1.0: time for production! - Craig Box (Google)
Просмотров 674 года назад
Istio 1.0 (has/will have) been released, so it's safe to move from "looking at it" to "putting it into production". Craig will talk about the history of the Istio project, the use cases at Google which inspired it, and the actual customer problems it is solving today, which you can apply to your business.
kubecfg: express the patterns in your declarative Kubernetes config - Angus Lees (Bitnami)
Просмотров 2084 года назад
Declarative configuration goes by several names (desired state, gitops, etc), and is a subtle but important shift in process that leads to more predictable and lower risk changes. Kubernetes is built around these principles, but most users encounter it as a ""wall of YAML"" that is difficult to use in practice. This talk introduces the ""kubecfg"" tool from the ksonnet project, heavily inspired...
The second revolution of Unikernels: Unikraft - Wei Chen (ARM)
Просмотров 9424 года назад
In the last few years, several open source projects had started to use Unikernels to create faster, more secure and scalable applications for cloud. For example: MirageOS, HalVM, ClickOS, Rump kernels, OSv etc. Developing applications for all these projects was not easy though. One had to re-write almost all the existing applications for Unikernels. This process was time consuming and prone to ...
Deep dive on the AWS CNI Plug-in for Kubernetes - Mitch Beaumont (AWS)
Просмотров 9 тыс.4 года назад
AWS recently introduced AWS Elastic Container Service for Kubernetes (EKS), it also open-sourced a new CNI plug-in that enables pods within EKS to use VPC networking fabric. This greatly simplifies the network connectivity within a Kubernetes cluster. The CNI is the primary plugin that is used to power Amazon EKS, and is being developed in collaboration with the community. This talk will share ...
Lessons learnt while operating multi-tenant kubernetes cluster in production - Prateek Nayak (MYOB)
Просмотров 2004 года назад
At MYOB, as part of the Platform Enablement group we operate a multi-tenant kubernetes cluster in production. Our cluster come with sane, sensible defaults around monitoring, logging alert built out of the box for delivery teams meaning our devs can focus on delivering customer value. We have learnt quite a few lessons on our kubernetes journey mainly through investigation and sometimes through...
Going crazy with Docker multi-stage build - Jorge Arteiro (IBM)
Просмотров 3854 года назад
Going crazy with Docker multi-stage build - Jorge Arteiro (IBM)
Set up and manage multi-cloud clusters using the Cluster API - Karan Goel (Google)
Просмотров 1,4 тыс.4 года назад
Set up and manage multi-cloud clusters using the Cluster API - Karan Goel (Google)
Building a Kubernetes distro the easy way - Scott Coulton and Dave Try (Puppet)
Просмотров 1664 года назад
Building a Kubernetes distro the easy way - Scott Coulton and Dave Try (Puppet)
Security Considerations for Containers as a Service & Serverless Architectures- Tsvi Korren (Aqua)
Просмотров 534 года назад
Security Considerations for Containers as a Service & Serverless Architectures- Tsvi Korren (Aqua)
Lessons from Production Incidents at Monzo Bank - Oliver Beattie (Monzo)
Просмотров 1 тыс.4 года назад
Lessons from Production Incidents at Monzo Bank - Oliver Beattie (Monzo)
Storing is Boring: Managing Persistant Storage - Phoebe Goh (NetApp)
Просмотров 654 года назад
Storing is Boring: Managing Persistant Storage - Phoebe Goh (NetApp)
Creating Effective Images - Abby Fuller (AWS)
Просмотров 1,2 тыс.4 года назад
Creating Effective Images - Abby Fuller (AWS)
Dockerless Container Builds with Buildah - William Henry (Red Hat)
Просмотров 4,2 тыс.4 года назад
Dockerless Container Builds with Buildah - William Henry (Red Hat)
Keeping an eye on your serverless containers - Prateek Nayak (Innablr) and Arjen Schwarz (DigIO)
Просмотров 1004 года назад
Keeping an eye on your serverless containers - Prateek Nayak (Innablr) and Arjen Schwarz (DigIO)
Introducing a Kubernetes Operator for Azure Databricks - Azadeh Khojandi (Microsoft)
Просмотров 1 тыс.4 года назад
Introducing a Kubernetes Operator for Azure Databricks - Azadeh Khojandi (Microsoft)
libp2p and the cloud - Adrian Lanzafame (Protocol Labs)
Просмотров 2134 года назад
libp2p and the cloud - Adrian Lanzafame (Protocol Labs)
Building with Buildkit - Sam Cochran (Buildkite)
Просмотров 4,9 тыс.4 года назад
Building with Buildkit - Sam Cochran (Buildkite)
Dockerised local build and testing environments made easy - Charles Korn (Thoughtworks)
Просмотров 8864 года назад
Dockerised local build and testing environments made easy - Charles Korn (Thoughtworks)
Using Kubernetes in IOT Edge Node Development - Katherine Lim (Inabblr)
Просмотров 1,1 тыс.4 года назад
Using Kubernetes in IOT Edge Node Development - Katherine Lim (Inabblr)
Building Native Kubernetes Integrations with Operators - Nick Schuch (PreviousNext)
Просмотров 1664 года назад
Building Native Kubernetes Integrations with Operators - Nick Schuch (PreviousNext)

Комментарии

  • @cookiebinary
    @cookiebinary 4 месяца назад

    TL;DR: chroot && mount proc

  • @konstantingeyst4568
    @konstantingeyst4568 7 месяцев назад

    Note that child processes can call chroot() again and break outside of this container easily. Docker doesn't use chroot.

  • @GerinoMorn
    @GerinoMorn 8 месяцев назад

    Why am I watching 7yo video about sth I don't do very often in a language I don't use, I don't know. But it''s good xD

  • @minyakonga8897
    @minyakonga8897 8 месяцев назад

    this video makes me want to more about docker and snap.

  • @LilRofl
    @LilRofl 10 месяцев назад

    🤯

  • @obrien8228
    @obrien8228 11 месяцев назад

    wait this is so easy

  • @rohitm8526
    @rohitm8526 Год назад

    Woah... very nice explanation 🔥

  • @ChuckNorris-lf6vo
    @ChuckNorris-lf6vo Год назад

    Excellent work. When IPO?

  • @derekreed6798
    @derekreed6798 Год назад

    Nice

  • @derekreed6798
    @derekreed6798 Год назад

    Nice

  • @RockwellAIM65
    @RockwellAIM65 Год назад

    Where is the network stack+virtualization for that? How does that work?

  • @GreyDeathVaccine
    @GreyDeathVaccine Год назад

    Too much weird sounds from Liz (don't how to say it since I am not good with english) but good presentation.

  • @idiotshypocrites9547
    @idiotshypocrites9547 Год назад

    06:35 cringe, with respect for trying

  • @idiotshypocrites9547
    @idiotshypocrites9547 Год назад

    Min 05:00 and I don't know what the heck she is doing. And yes as she said, this is quite dull. And Go, why?

  • @zakariachahboun
    @zakariachahboun Год назад

    Thanks

  • @loupax
    @loupax 2 года назад

    Looks like my favorite presentations are those that start so simple you almost think they are jokes, until suddenly they are not.

  • @joepoptiya
    @joepoptiya 2 года назад

    Really good walk through. The container doesn't have internet access. Is there a way to provide the container with internet access?

  • @piyushsingh178
    @piyushsingh178 2 года назад

    wow..this is super awesome!! ps not showing host processes was very nice. But why Go though. As someone who doesnt speak Go, what I understood was you did some syscalls, cloned UTS namespace, changed rootdir, and invoked a new /bin/bash as a fork process. Same thing can be done in any language cpp/python/java right?

    • @RockwellAIM65
      @RockwellAIM65 Год назад

      Efficiency. You can build a completely self-contained binary that does everything. If you add https or a straight TLS socket you only need the exe and a cert file... it's super clean. With Python you may have versioning/suppor issues. Java is a pig - it latches onto cpu+memory resources. Not really apropos. C++ is ok for this, but younger engineers may not know it + unix command programming in C++ can be a bit tricky. Golang makes it (and certain other tasks) pretty straightforward. I would use either C or golang. Maybe Rust but I don't know it yet.

    • @piyushsingh178
      @piyushsingh178 Год назад

      @@RockwellAIM65 yeah I think outside of Go, c++ would be the best choice

    • @RockwellAIM65
      @RockwellAIM65 Год назад

      @@piyushsingh178 A C based solution would be clean; you'd have to add lots of external libraries tho' ... would have been nice if C had a standard add-on for managing databases, doing all the simple network type transactions w/ a second thread perhaps (application+background processing thread) + an easy-to-interface string based hierarchical data store. C++ wasn't really necessary... it turned into the Cobol of the 1990s!

  • @TheBendixSA
    @TheBendixSA 2 года назад

    Badass

  • @profetik777
    @profetik777 2 года назад

    Ok love the hammer vs malet analogy

  • @cronx1337
    @cronx1337 2 года назад

    Fuck go modules and fuck whoever broke 'go get'.

  • @ahmedifhaam7266
    @ahmedifhaam7266 2 года назад

    great explanation. Thank you 👍

  • @KeithMakank3
    @KeithMakank3 2 года назад

    Really good talk

  • @edgeeffect
    @edgeeffect 2 года назад

    I've watched Liz write about 4 slightly different versions of this program now. ;) Working out the difference between Podman and Docker is kinda simple is you watch a scaled down version of the code get written. :)

  • @alitajvidi5610
    @alitajvidi5610 2 года назад

    Thank you 🙏

  • @gangsterholla179
    @gangsterholla179 2 года назад

    This was amazing. Simple and easy to digest, but packed with information.

  • @fredrikhansen75
    @fredrikhansen75 2 года назад

    Great pres!

  • @junaidkhan-xh4wx
    @junaidkhan-xh4wx 2 года назад

    Good explanation, thanks

  • @pclokcer
    @pclokcer 2 года назад

    Likee

  • @billvvoods
    @billvvoods 2 года назад

    Awesome video and a great intro to how containers are constructed

  • @alexwexov4298
    @alexwexov4298 2 года назад

    Came for Vim, saw Sublime, leave.

  • @abstractplanet6018
    @abstractplanet6018 2 года назад

    Made me want to learn Go. Thanks.

  • @chiragsingla.
    @chiragsingla. 2 года назад

    Thanks

  • @zoltanarvai9924
    @zoltanarvai9924 3 года назад

    Seriously underrated talk. This should have like a million views!

    • @nig3ldoug1as63
      @nig3ldoug1as63 2 года назад

      Every Liz Rice talk should have like, a million views 🙂

  • @kokizzu
    @kokizzu 3 года назад

    never knew that jenkins that such UI like in gitlabci '__')

  • @HaiNguyen-cf1ji
    @HaiNguyen-cf1ji 3 года назад

    I just have lxd up and running, love it 😘

  • @freakybaby1012
    @freakybaby1012 3 года назад

    Great tutorial thank you!

  • @RichardBuckerCodes
    @RichardBuckerCodes 3 года назад

    The best part of this demo is that it makes containers more like jail and addresses the trust issue.

  • @maurobarros8265
    @maurobarros8265 3 года назад

    Very good

  • @codelucky
    @codelucky 3 года назад

    Did I just watch Go programing in Downtown Abbey?

  • @techindia3602
    @techindia3602 3 года назад

    Does anyone have the link to the talk by Julian Friedman she is talking about ?

  • @mahdijh1
    @mahdijh1 3 года назад

    Thanks, It was the best way someone can show me concept of a container.

  • @anshubehera2600
    @anshubehera2600 3 года назад

    "You are my peer reviewers"... what a lass <3

  • @jonbv2434
    @jonbv2434 3 года назад

    this is by far very short and well explained how the container can expand the possibilities how GO can do it.

  • @memeplex1
    @memeplex1 3 года назад

    I must say that a company whose CEO knows and still remembers how to operate a terminal makes me feel confident.

    • @omarzakai4905
      @omarzakai4905 2 года назад

      i know Im asking the wrong place but does anybody know of a trick to get back into an instagram account?? I stupidly forgot the password. I appreciate any help you can offer me!

    • @anonymousanonymous1934
      @anonymousanonymous1934 2 года назад

      @@omarzakai4905 write to support

    • @dhruvakhera5011
      @dhruvakhera5011 2 года назад

      @@omarzakai4905 if you have 2FA then you can get the account back

  • @sunwoojang6888
    @sunwoojang6888 3 года назад

    really good

  • @rewanthtammana
    @rewanthtammana 3 года назад

    Thanks for adding a sequel with the addition of rootless containers content in golang. Truly amazing :-)

  • @raghunathmahakud4270
    @raghunathmahakud4270 3 года назад

    Is it possible to stop helm upgrade or how to do immutable config map using helm with kubernates v1.13

  • @invokesus
    @invokesus 4 года назад

    Great talk!

  • @wrestlord
    @wrestlord 4 года назад

    zaaa