rat snake sizetiptip

https://media.ccc.de/c/asg2017/ASG201...



Habitat is the best way for software developers to build, deploy, and manage modern applications - regardless of their expertise. Habitat provides a self-healing, self-configuring, stack-agnostic, frictionless abstraction for running applications—regardless of their complexity on whatever infrastructure you prefer, from physical hardware and virtual machines to containers and everything in between. This session will show you how to build and run your own application. You will learn how scaffolding helps you quickly and easily package your application. Explore the build system used for generating Habitat artifacts. Run an application using the Habitat supervisor. This is the talk for anyone who's just learning about Habitat or those that are interested in seeing some of the newer features of the framework.



Jamie Winsor

https://media.ccc.de/c/asg2017/ASG201...



Containers have become a popular way of packaging and running applications, especially for server applications using microservice architectures. As containers can be started in no time, building new container images replacing old ones has become the predominant way of applying updates. Having continuous delivery pipelines for building these images becomes a key problem. This talk will show how the Open Build Service provides a way to automate container builds including tracking updates and automatic rebuilds of dependent containers. This makes it easy to create secure and up to date containers all day.



Cornelius Schumacher

https://media.ccc.de/c/asg2017/ASG201...



rkt is a modern container runtime, built for security, efficiency, and composability. It is one of the container runtimes supported by Kubernetes but the current implementation (“rktnetes”) doesn’t support the Container Runtime Interface (CRI). The work-in-progress CRI implementation is called rktlet.

This presentation will give an update on the rkt project, what new features were implemented recently and what’s coming up. It will also give an update on the state of the rktlet: what features are missing and what workarounds should be removed before it becomes a complete implementation of the CRI.



Iago López Galeiras

https://media.ccc.de/c/asg2017/ASG201...



When configuration changes, daemon-reload stops the world in an increasingly unsustainable way. The problem is getting worse for two reasons: (1) heavier use of systemd means more units and longer reload times and (2) expanded use of socket activation/D-Bus activation/automount means more things urgently need PID 1's attention. There are ways to fix this up, but we'll need to move away from stopping the world (the main event loop), throwing out most loaded state, reloading state, and then resuming event handling.



David Strauss

https://media.ccc.de/v/ASG2019-150-th...



A summary of the current state of Thunderbolt, kernel as well as user space, including the latest development where the the input–output memory management unit (IOMMU) is used to prevent Direct Memory Access (DMA) attacks. A brief explanation and discussion of such such an attack, the recent Thunderclap attacks, will be given including with a focus on how it is related to the IOMMU feature on Linux.



Christian Kellner

https://cfp.all-systems-go.io/ASG2019...

https://media.ccc.de/c/asg2017/ASG201...



To achieve faster and easier containerization at Facebook we have started utilizing Chef, Btrfs and Systemd to improve our container system. These tools helped us to design a robust base for our cluster management will allow us to concentrate more higher level functionality. Our version of image and task handling tries address some issues common both to Facebook and the industry.




Zeal Jagannatha Zoltan Puskas

https://media.ccc.de/c/asg2017/ASG201...



The container has become one of the most overloaded industry buzzwords of the last five years. From Jails to LXC to Zones to systemd-nspawn Docker to rkt - there's an assortment of different tools on different platforms that call themselves containers, and no clear consensus what it means when it comes to distributing containers or implementing the underlying technical details. The Open Container Initiative was formed in 2015 to try to remedy this situation by establishing a shared set of container standards for different implementers to agree on. With representatives from all major server operating system platforms, the Initiative has made great strides towards specifying a truly interoperable container. The two key OCI projects recently hit their canonical 1.0 version; this talk will explain what OCI is and what that milestone means for the container ecosystem.



Jon Boulle

https://media.ccc.de/c/asg2017/ASG201...



Containers are pretty cool, but in scenarios where they don't satisfy all the requirements, service providers still rely on virtualization. Hardware virtualization became mainstream 1 decade ago and it never stopped evolving. I even dare to say that virtualization is not boring anymore!
In this presentation I will talk about the most significant hardware changes in the virtualization world.



Hugo Tavares Reis

https://media.ccc.de/c/asg2017/ASG201...



We'll be talking about what we learned throughout the past year running systemd in production at Facebook: new challenges that have come up, how the integration process went and the areas of improvement we discovered. We'll also discuss our efforts building a monitoring solution for system services based on systemd.



Davide Cavalca

https://media.ccc.de/v/ASG2018-195-be...



Open Container Initiative (OCI) started in 2015 to make different implementations of container runtimes and images compliant with well-defined specifications. Together with other folks at Kinvolk, I have been involved in various OCI projects since months, and encountered various issues that occur in runtime specs and runtime-tools for verification. Since we live in a real world, not everything works well as expected. I’m going to talk about practical issues, and possible ways to get it improved.

Open Container Initiative (OCI) defines container runtime specs ( https://github.com/opencontainers/run...) as well as container image specs ( https://github.com/opencontainers/ima...) and distribution spec ( https://github.com/opencontainers/dis...).

There is also runtime-tools ( https://github.com/opencontainers/run...) that helps container runtime to verify compliance of the runtime specifications. The standard container runtime is runc ( https://github.com/opencontainers/runc) that is included in multiple high-level container managers like Docker or containerd. Most of the practical issues arise when specification is not clearly defined in the first place, or when container runtimes have own reasons for not being compliant with the specs, or when there’s no consensus in the community how it should proceed.

On the other hand, container orchestration systems like Kubernetes have defined their own interfaces such as Container Runtime Interface (CRI). The different interfaces (OCI runtime and CRI) exist at different layers in the software stack. I'll show how CRI depends on OCI and some mismatches between them.

In this talk I want to introduce such practical issues, and try to suggest how we should proceed regarding spec compliance.


Dongsu Park

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/c/asg2017/ASG201...



As Infrastructure operators we're exposed to a lot of plumbing and not a lot of porcelain. Worse, because our concerns are often esoteric (in the eyes of application developers) we have to fix our own pipes too. Often this leads to the "homeowners dilemma"... Making the call of when to patch things up, when to rip out the pipes, and when to abandon gas lamps for electricity.

We outline a number of aging pipes, proposed (and implemented) solutions, and ideas for dragging our systems into the future.




Brian 'redbeard' Harrington

https://media.ccc.de/c/asg2017/ASG201...



Bluetooth technology has been extended with a brand new mesh feature. This presentation gives an introduction to Bluetooth Mesh and its impacts on the ecosystem. It shows the new and exciting use cases that a mesh enabled Bluetooth low energy enables. The presentation will also put a focus on Linux and Zephyr operating systems and its integration with Bluetooth Mesh.



Marcel Holtmann

https://media.ccc.de/c/asg2017/ASG201...



AgileBits, the company behind the 1password password manager, published a spec for their “opvault” format to show how confident they are in its design. This eliminates the need to reverse-engineer the encryption when trying to read from such a vault on a system where they
don’t provide their tool.

In this talk we’ll see an overview of the design of the format, such as the key derivation or the decision to split the meta-data from the details such as username and passwords.

At the same time, the talk will follow the implementation of a library to read this format in Rust, which started as a way to practice the language but now has grown a GUI to display these entries so I can use the vault on my desktop.



Carlos Martín Nieto

https://media.ccc.de/v/ASG2019-138-tr...



Testing the effectiveness of Kubernetes Network Policies can be done in different approaches. In this talk we will show you the benefits and drawbacks of different approaches and what solution we finally chose.

Probably everybody who uses Kubernetes in a productive environment with multiple users possibly has looked at policies. Often the operators of the cluster(s) just trust the policies but in some cases it might be useful to control if the policies actually have taken action and often there are just to many Policies in the cluster setup to manually test them all (and obviously you don’t want to do this). Testing the effectiveness of the Network Policies can be done in different approaches. In this talk we will show you the benefits and drawbacks of different approaches and what solution we finally chose. Also we will show you some other tools and how they complement our solution. As a takeaway you will get an overview of different testing strategies for policies, as well as understanding challenges in testing policies in general and the Kubernetes ecosystem. We will get a feeling that it’s not always the best idea to just trust other plugins to implement the policies correctly. Our solution is open-sourced under https://github.com/inovex/illuminatio/

Maximilian Bischoff Johannes Scheuermann

https://cfp.all-systems-go.io/ASG2019...

https://media.ccc.de/c/asg2017/ASG201...



Desktop application sandboxing is quite different than traditional
container isolation, learn how flatpak does it, using the concept of
portals.




Alexander Larsson