1
00:00:00,000 --> 00:00:07,100
Well, I was going to say it's fall down here, but I realize aside from the other side of the world, it's fall everywhere, if I recall.

2
00:00:07,320 --> 00:00:12,160
So it's it's which which over over over there, I think it's upside down fall.

3
00:00:12,160 --> 00:00:16,720
If I remember, I forget. But I my my wife and my son are up.

4
00:00:17,000 --> 00:00:19,940
It's like the day before elections are up block walking in Ohio.

5
00:00:19,940 --> 00:00:25,420
So they send me all these lovely pictures of like these these red and yellow colored leaves.

6
00:00:25,540 --> 00:00:28,560
It's not nice down here in Texas. We don't have that.

7
00:00:28,560 --> 00:00:31,760
It's either green, brown or gone. There's no there's no variance.

8
00:00:31,860 --> 00:00:36,200
So I was wondering, do you guys in your neck of the woods, do you have pretty fall colors?

9
00:00:36,660 --> 00:00:39,460
What do you and what do you do for that? Like there's lots of pumpkins.

10
00:00:39,460 --> 00:00:41,340
What's the fall decoration that's rolling in?

11
00:00:42,780 --> 00:00:46,920
Yeah, here in here in Seattle, we have, as you'd expect, fall weather.

12
00:00:47,080 --> 00:00:49,120
It's cold. It's wet. There's red leaves everywhere.

13
00:00:49,300 --> 00:00:50,660
But it's actually really nice to have seasons.

14
00:00:50,800 --> 00:00:54,380
I moved up from L.A. a year ago where it was either hot or not as hot.

15
00:00:54,520 --> 00:00:58,080
So it's nice to have proper seasons now.

16
00:00:58,560 --> 00:00:59,960
How about yourself, James?

17
00:01:00,080 --> 00:01:00,680
The Bay Area.

18
00:01:01,300 --> 00:01:02,360
Oh, no, go ahead. Sorry.

19
00:01:03,240 --> 00:01:07,400
That's fine. I feel like the Bay Area is the land of the perpetual almost nice.

20
00:01:07,800 --> 00:01:12,160
Depends on what you like, but it's always just a little too cold all year round.

21
00:01:12,660 --> 00:01:14,720
And so the trees just don't know what to do with it.

22
00:01:14,900 --> 00:01:15,160
Oh, yeah.

23
00:01:15,160 --> 00:01:23,580
So I hear that in some parts of the Bay Area, they've actually genetically modified the trees to turn fall colors at like higher temperatures.

24
00:01:23,580 --> 00:01:25,300
But that's probably not true.

25
00:01:26,020 --> 00:01:29,500
Now, this raises another thing I'm always envious of y'all who live over in the Bay Area.

26
00:01:29,500 --> 00:01:31,460
It's like you can always wear a light jacket.

27
00:01:31,920 --> 00:01:34,740
Like if that's just the thing that you feel like that day, put on a light jacket.

28
00:01:35,120 --> 00:01:35,640
It's fine.

29
00:01:35,920 --> 00:01:38,100
So you must always wear a light jacket.

30
00:01:38,100 --> 00:01:41,960
I guess it's just a different – you can always versus must.

31
00:01:42,160 --> 00:01:42,840
I agree.

32
00:01:43,580 --> 00:01:44,020
Equivalent.

33
00:01:44,360 --> 00:01:45,380
Just subtly different.

34
00:01:46,160 --> 00:01:46,880
Subtly different.

35
00:01:47,760 --> 00:01:50,320
I value the thickness of my hoodie based on the sequence.

36
00:01:50,640 --> 00:01:51,060
That's right.

37
00:01:51,400 --> 00:01:51,980
There you go.

38
00:01:52,260 --> 00:01:52,440
Yeah.

39
00:01:53,000 --> 00:01:53,260
Yeah.

40
00:01:53,400 --> 00:01:53,620
Yeah.

41
00:01:53,680 --> 00:01:54,780
Well, you know, it would be nice.

42
00:01:55,380 --> 00:01:57,260
I mean, do you concur with that, James?

43
00:01:57,460 --> 00:01:59,020
You have sort of like the one thing?

44
00:01:59,740 --> 00:02:06,280
We have some trees in our – I live in Palo Alto, so it's slightly different than the – like Berkeley where Aruncia is.

45
00:02:06,860 --> 00:02:11,860
So we definitely get some of the trees, turn colors, and lose their leaves.

46
00:02:13,180 --> 00:02:18,580
But it's – I grew up in Nebraska, and that was a much more intense fall and transition.

47
00:02:19,580 --> 00:02:22,000
Nebraska, where they have winter, as I recall.

48
00:02:22,260 --> 00:02:22,560
Yes.

49
00:02:22,640 --> 00:02:23,440
That's quite a thing.

50
00:02:23,760 --> 00:02:23,940
Yeah.

51
00:02:24,320 --> 00:02:24,560
Huh.

52
00:02:24,940 --> 00:02:27,160
That's one thing I've never really experienced.

53
00:02:27,420 --> 00:02:30,060
We don't really have winter anywhere I've ever lived.

54
00:02:30,800 --> 00:02:31,760
Well, it's probably for the better.

55
00:02:31,840 --> 00:02:36,880
Well, why don't – we've got a couple of, as you've heard already, guests with us this week.

56
00:02:37,380 --> 00:02:38,740
Why don't you guys introduce yourself?

57
00:02:38,800 --> 00:02:41,740
Why don't we go in the order that you answered the leaf question?

58
00:02:44,120 --> 00:02:44,920
If anyone remembers.

59
00:02:44,920 --> 00:02:45,080
Sure.

60
00:02:45,140 --> 00:02:46,360
I guess that would be me first.

61
00:02:46,500 --> 00:02:48,220
So my name is Unsi Fakhri.

62
00:02:48,220 --> 00:02:52,220
I run R&D for Cloud Foundry at Pivotal.

63
00:02:54,500 --> 00:02:56,060
My name is James Baer.

64
00:02:56,460 --> 00:02:59,060
I work on the product side of Cloud Foundry.

65
00:02:59,140 --> 00:03:02,840
I've been working on the team a little over five years now, so I've been around for a while.

66
00:03:05,260 --> 00:03:05,940
Very good.

67
00:03:07,220 --> 00:03:12,420
So we brought you characters on today because there's – you know, containers are a hot topic.

68
00:03:12,940 --> 00:03:14,960
It's a lot of good information out there.

69
00:03:15,020 --> 00:03:16,780
There's a lot of, frankly, bad information out there.

70
00:03:16,820 --> 00:03:22,420
So we thought it would be good to bring you on and just talk a little bit about, you know, no FUD, no BS.

71
00:03:22,700 --> 00:03:26,960
Let's just talk about containers and PCF and containers in general from a couple of smart folks.

72
00:03:26,960 --> 00:03:29,140
So we're going to pepper you with a few things here today.

73
00:03:30,580 --> 00:03:31,280
Sounds good.

74
00:03:31,780 --> 00:03:32,000
Yeah.

75
00:03:32,060 --> 00:03:34,260
So first off, I'll start with you, James.

76
00:03:35,280 --> 00:03:36,360
What the hell is a container?

77
00:03:36,640 --> 00:03:38,020
Why do devs even care about them?

78
00:03:39,440 --> 00:03:41,340
Well, that's a great question.

79
00:03:41,460 --> 00:03:57,620
I think there's been a lot of confusion about this because one of the things that has happened, especially ever since Docker really took off on popularity, things get very confusing because people first hear – a lot of people first hear about containers with Docker.

80
00:03:58,040 --> 00:04:05,740
And it turns out that with Cloud Foundry, we've been using containers well before there was Docker for several years.

81
00:04:06,420 --> 00:04:15,440
And really, it's about an isolation property in the Linux kernels is what we started with with Cloud Foundry.

82
00:04:15,440 --> 00:04:31,200
And what we realized early on is that the first versions of isolation we had in Cloud Foundry were just using very simple isolation mechanisms, and they weren't very robust to something that an enterprise would expect.

83
00:04:31,360 --> 00:04:35,440
Certainly not as robust as the level of isolation you get in a complete virtual machine.

84
00:04:36,300 --> 00:04:43,600
And so one of the things we've done is increase the levels of isolation by using more advanced features of Linux.

85
00:04:43,600 --> 00:04:47,220
And you get these great properties compared to a virtual machine.

86
00:04:47,300 --> 00:04:55,000
These containers are really fast to start up, and really quickly you can get benefits out of them, and so they feel faster.

87
00:04:56,120 --> 00:05:09,380
And so that's probably the biggest benefit to using these containers is you get this improved isolation from really something that just would be something basic, like using a separate Linux processor or a separate Linux directory.

88
00:05:09,380 --> 00:05:19,100
You can actually make it such that those things don't see each other, but you get the better speed than you would if you used a complete separate virtual machine.

89
00:05:19,340 --> 00:05:20,340
Yeah.

90
00:05:20,340 --> 00:05:21,340
Good.

91
00:05:21,340 --> 00:05:24,340
Unsee, do containers get you excited?

92
00:05:24,340 --> 00:05:28,340
When this came out, did this light you up, or was this just interesting to you?

93
00:05:28,340 --> 00:05:47,220
I think at some level it was mostly an implementation detail around isolation, and then I think the brilliance of what Docker ended up doing was making it fairly easy for folks to interact with these containers and create them, tear them down.

94
00:05:47,640 --> 00:05:50,360
But most importantly, specify what goes in them.

95
00:05:50,680 --> 00:05:53,660
So when I get asked what is a container, I like to think of it as three separate things.

96
00:05:53,660 --> 00:06:02,240
It's the isolation primitives that James is talking about, which if you step back and think about it, it's really impressive what the kernel folks have done.

97
00:06:02,340 --> 00:06:14,180
They've taken a single-tenant system and wedged multi-tenancy into it and made it possible to isolate processes across different axes within the one kernel.

98
00:06:14,300 --> 00:06:17,780
So that's just bonkers that it works, but it works, and it's been getting better and better and more advanced.

99
00:06:18,240 --> 00:06:21,420
So it's isolation and resource constraining.

100
00:06:21,740 --> 00:06:24,500
And then it's sort of a description of what goes in the containers.

101
00:06:24,620 --> 00:06:26,020
Now you have your box.

102
00:06:26,360 --> 00:06:27,660
You've put up the isolation walls.

103
00:06:27,700 --> 00:06:30,040
And when you put in the box, what's that file system?

104
00:06:30,780 --> 00:06:33,760
What are the files and the configurations that get mounted in?

105
00:06:33,760 --> 00:06:39,300
And the last thing is sort of this metadata of, okay, now that you have your box with stuff in it, what do you want to run?

106
00:06:39,700 --> 00:06:40,920
What do you want to do with your box?

107
00:06:40,940 --> 00:06:43,860
And how do you communicate what you run to other people?

108
00:06:44,300 --> 00:06:52,680
And what Docker really did, I think, was made it easy to create the container, easy to define what goes into it, and easy to sort of specify what you want to run.

109
00:06:53,540 --> 00:06:59,120
And that just makes it more, I think, accessible, especially primarily right on the local development environment.

110
00:07:00,840 --> 00:07:02,900
The thing that, I have a story.

111
00:07:03,100 --> 00:07:10,240
So when I was in grad school, I took a really silly little CS class about, the details don't matter.

112
00:07:10,660 --> 00:07:17,480
But anyway, I just remember we spent the first two classes trying to configure our workstations, right?

113
00:07:17,720 --> 00:07:20,680
Like this is the bane of developers everywhere.

114
00:07:20,840 --> 00:07:22,660
It's like, oh my God, I don't care about the configuration.

115
00:07:22,840 --> 00:07:24,620
And I just want to get started from a known good point.

116
00:07:26,140 --> 00:07:31,220
And so I think one thing that we've seen is containers help make that easier.

117
00:07:31,680 --> 00:07:38,080
And by containers, I specifically mean having like a community of those base images makes that easier.

118
00:07:39,100 --> 00:07:40,740
Yeah, you know, that's a weird thing.

119
00:07:40,960 --> 00:07:43,040
I forget when I started paying attention.

120
00:07:43,180 --> 00:07:44,340
This is back when I was an analyst.

121
00:07:44,340 --> 00:07:48,520
And like, initially, you read about like containers and LXE and all this stuff.

122
00:07:48,600 --> 00:07:57,980
And from my perspective, being a very way above the value line type of person, as it were, I'm just like, what is all this nonsense, right?

123
00:07:58,020 --> 00:08:01,200
Like about isolation and stuff like this is, I hate security.

124
00:08:01,320 --> 00:08:02,440
I don't want to read about security.

125
00:08:02,800 --> 00:08:08,680
And then somewhere in the last maybe two years, there's been this flip of like, no, no, it's not about security.

126
00:08:08,680 --> 00:08:10,260
It's about developer productivity.

127
00:08:10,680 --> 00:08:23,580
And it's like, I don't know if there's other sort of historic things where something so annoying as, I mean, I guess all of computers, but like, you know, as weird as security isolation turns into this almost, from my perspective, polar opposite thing.

128
00:08:23,660 --> 00:08:30,400
And it seems like that's the huge jump of reorientation that makes a lot more sense nowadays.

129
00:08:30,400 --> 00:08:45,020
And it is, I don't know why it seems weird to me, but it seems weird that this, this essentially security thing, like makes developers more productive, which I don't think most people would ever associate security and developer productivity together.

130
00:08:45,020 --> 00:08:53,720
But I guess, I guess what it does is sort of freeze up, to put it in another wacky way, it allows developers to be a lot more sloppy in this, therefore quick.

131
00:08:53,960 --> 00:09:03,680
They don't have to worry about their entire stack of things, but it is an odd, you know, and it's also like, I always love it when all the Solaris weirdos come out and they're like, we've had this forever.

132
00:09:03,940 --> 00:09:08,520
Right. It's like, it's like when the mainframe people come out and tell you how they did DevOps in the 1910s or whatever.

133
00:09:08,900 --> 00:09:18,620
And so it's, it's a good, uh, it's a good rebuke for like, you know, well, you did have that, but it didn't really like wrap around this usage of it or, or get so, so much widespread acceptance.

134
00:09:20,920 --> 00:09:31,580
So, I mean, given the, as it, whether it's the, uh, mainframe guys from the 1910s or, uh, or Docker today, I mean, so all, are all these container products using different engines?

135
00:09:31,580 --> 00:09:33,460
Like, is there commonality here?

136
00:09:33,580 --> 00:09:34,740
I mean, I guess, James, start with you.

137
00:09:35,180 --> 00:09:40,300
When you look at these sort of components, yes, there's Rocket, there's Docker, there's all these other components, there's orchestration on top.

138
00:09:40,480 --> 00:09:46,100
When you look at these components, you know, where do you, where are you starting to see some standardization?

139
00:09:47,380 --> 00:09:48,680
Yeah, so that's a great question.

140
00:09:48,980 --> 00:09:59,700
In the, when we first started working with the technology, we, we actually started in Cloud Foundry using, uh, um, some very basic stuff that I referenced earlier was really primitive stuff.

141
00:09:59,700 --> 00:10:09,900
Like, we're, we're just make up a Linux, uh, user on the fly and, and using basic Linux user permissions and, uh, file, file permissions in the file system.

142
00:10:10,040 --> 00:10:12,220
And we quickly found that that wasn't going to be good enough.

143
00:10:12,260 --> 00:10:20,380
So one of the other things that, in addition to the security that you may not, you think like, oh, sure, it's the really, um, paranoid enterprise security person.

144
00:10:20,380 --> 00:10:38,040
But there's also something that with multi-tenancy, this noisy neighbor property, that when you use the, the better levels of Linux isolation in a container, now you have a lot more confidence that you can put mixed workloads, um, from different tenants on the same place and they're not going to disrupt each other.

145
00:10:38,720 --> 00:10:44,440
And so we started looking at, uh, other engines and one of them was called LXC.

146
00:10:44,900 --> 00:10:48,500
And we, uh, we, we played around with it for a while.

147
00:10:48,600 --> 00:10:53,020
We found was, uh, this, it wasn't giving us, it was too much of a black box.

148
00:10:53,120 --> 00:10:56,080
We couldn't quite understand what was happening under the hood.

149
00:10:56,400 --> 00:11:00,360
And so we evolved to, um, this was before Docker was even available.

150
00:11:00,920 --> 00:11:18,700
Um, we evolved and wrote our own, uh, low level tool called Wharton and, you know, time goes on and that was really successful for us because we could really go down deep and, and control all the things we wanted to do to provide our, our enterprise platform, the properties we wanted.

151
00:11:18,820 --> 00:11:23,840
And then time went on and, uh, Docker emerges and gets a lot of adoption.

152
00:11:24,080 --> 00:11:26,180
Uh, we saw other projects come out from Google.

153
00:11:26,340 --> 00:11:28,480
There was one called, uh, let me containerize that for you.

154
00:11:28,520 --> 00:11:32,320
And so we started seeing that, okay, there's a lot of other stuff going on out here.

155
00:11:32,760 --> 00:11:43,460
And what I'm really pleased to say now is that we've actually gone far enough to where we actually share the same, uh, Linux, uh, container runtime that Docker has.

156
00:11:43,560 --> 00:11:49,860
It's called run C a whole bunch of, uh, the industry got together for this thing called the, um, open containers project.

157
00:11:50,620 --> 00:11:57,920
And Docker took the core part of their insides of their, of Docker engine and made it, uh, open source.

158
00:11:58,540 --> 00:12:03,140
Um, and which it had been the entire time at this time, they said the governance of this thing will be open source.

159
00:12:03,140 --> 00:12:05,640
We can all work and, and move on this together.

160
00:12:05,640 --> 00:12:15,740
And so now all of cloud foundries, uh, um, container systems, whether it's the hosted versions we have, uh, pivotal web services, or it's our, um, enterprise product that we ship to customers.

161
00:12:15,740 --> 00:12:29,260
All of those customers have this, uh, shared run C backplane now that does all of the really basic fundamental stuff, like setting up the container file system, setting the Linux namespaces, setting up the C groups, all that stuff is shared now.

162
00:12:29,320 --> 00:12:31,080
So that's, that's something we're really excited about.

163
00:12:33,320 --> 00:12:38,720
So like, uh, I think, uh, going back to your question, you know, what, what are the shared components?

164
00:12:38,800 --> 00:12:44,400
I think it's just really important to always remember that at the end of the day, all the heavy lifting is being done by the kernel.

165
00:12:44,960 --> 00:12:51,780
The nice thing about something like run C is that it's, it's almost like the thinnest possible layer on top of that.

166
00:12:52,440 --> 00:12:55,560
Um, to provide a bit more of a user friendly API.

167
00:12:55,560 --> 00:13:05,980
Um, and so having, you know, cloud foundry and Docker and other things begin to shift and, and run on top of run C, um, helps in many ways.

168
00:13:05,980 --> 00:13:16,120
And the one that really, I think is the most compelling to me is there's this shared shim layer, the shared code base that is doing a lot of the finicky kernel calls.

169
00:13:16,300 --> 00:13:19,200
Um, that's where you're likely to, you know, mess up.

170
00:13:19,200 --> 00:13:24,620
That's where you're likely to like, you know, have a, a security vulnerability or an issue if you do that wrong.

171
00:13:24,620 --> 00:13:28,040
And, and what's nice is now there's this shared thing that has just a ton of eyeballs on it.

172
00:13:28,580 --> 00:13:36,660
And we all get to, to benefit from, um, that shared community ownership of that, but then have our own opinions on top of it.

173
00:13:36,920 --> 00:13:46,080
And so garden, for example, garden run C specifically gets to implement the garden API, which is, uh, you know, we, we see it as like the orchestrator friendly API.

174
00:13:46,080 --> 00:13:49,140
It does just enough to support an orchestrator and like get out of the way.

175
00:13:49,200 --> 00:13:51,320
Um, Docker on the other hand, right.

176
00:13:51,360 --> 00:14:04,240
They take run C and then they just start to layer on more and more and more stuff to the point where it's this sort of massive thing that can do, you know, local workstation and multiple, you know, clusters.

177
00:14:04,240 --> 00:14:09,360
And it's just, which sounds good on paper, but like really it becomes, it becomes a very leaky abstraction.

178
00:14:09,360 --> 00:14:19,800
That's very hard for, um, you know, others to either wrap around or use or really trust as it sort of moves and breaks and evolves, um, frankly, too quickly.

179
00:14:20,040 --> 00:14:23,460
So what's nice is when, when run C came out, we immediately jumped on that.

180
00:14:23,520 --> 00:14:29,800
We, we resisted like switching cloud foundry to run on top of Docker for a long time because there wasn't that clear governance.

181
00:14:29,800 --> 00:14:34,340
There, there was a sense that, you know, what Docker is today and what Docker will be in the future.

182
00:14:34,340 --> 00:14:35,940
Like what, what is that?

183
00:14:36,020 --> 00:14:40,320
You know, there's not a lot of control, not a lot of stability or, or, um, certainty there.

184
00:14:40,360 --> 00:14:42,800
But when run C came out, we're like, oh, that's, that's perfect.

185
00:14:42,940 --> 00:14:45,280
That's exactly the right abstraction that we want to build on top of.

186
00:14:45,340 --> 00:14:58,880
And so, so we did, and not only did we like build on top of it, we then like shipped up an update that like helped just move all of our customers over transparently, um, from our old sort of homegrown, uh, solution on top of run C.

187
00:14:59,620 --> 00:15:07,060
So let's drill on it just a little more cause I know, Hey, maybe we're to blame for it sometimes, but there gets to be confusion about PCF and Docker.

188
00:15:07,280 --> 00:15:08,360
Like, do we support that?

189
00:15:08,420 --> 00:15:15,020
Are we somehow, you know, mortal enemies sworn to the death or, you know, are we, what are we trying to do to help customers with this stuff?

190
00:15:15,060 --> 00:15:19,240
So I guess the first question, aunty, even for you is sure does cloud foundry support Docker?

191
00:15:20,540 --> 00:15:20,640
Yeah.

192
00:15:20,640 --> 00:15:24,040
So, so I go, I go back to like, what is a container, right?

193
00:15:24,040 --> 00:15:28,620
Um, and, and, and that, that mental model of, uh, isolation.

194
00:15:29,620 --> 00:15:35,900
Container content, like the file system that gets mounted in and then the metadata to run, run and launch stuff.

195
00:15:36,100 --> 00:15:43,180
So, you know, we, we use the same Docker primitives to build the isolation that, that, you know, run C basically.

196
00:15:43,740 --> 00:15:53,720
And we, uh, support 100% fetching Docker images, sort of the Docker tarball as it were, um, and mounting it into the container.

197
00:15:53,720 --> 00:15:54,700
Like, we don't mess with it.

198
00:15:54,700 --> 00:15:59,660
We just grab it using all of the same layer and caching technology that Docker's built.

199
00:15:59,740 --> 00:16:00,980
We, in fact, use the same libraries.

200
00:16:00,980 --> 00:16:04,700
This is all open source stuff after all to mount your container in.

201
00:16:05,100 --> 00:16:16,380
And then we can fetch and translate as much of the Docker metadata as makes sense to run on a 12 factor platform, um, to, to then enable you to just basically run your Docker images on the platform.

202
00:16:16,380 --> 00:16:18,140
So, yeah, we, we, we support Docker.

203
00:16:18,700 --> 00:16:26,180
Um, so if I've built some beautiful container and I love immutable infrastructure and then, you know, James for you.

204
00:16:26,280 --> 00:16:37,000
So if I take that Docker image and I point PCF at it and say, go pull this image and run it, do we break that thing apart and, and PCF it ties it and kind of break the immutability up?

205
00:16:37,320 --> 00:16:40,160
Or is, or is, do we just take that container and run it the same way Docker does?

206
00:16:41,400 --> 00:16:51,440
Yeah, it's, it's very, you're going back to NC's answer, um, to provide a little bit more depth, uh, the, the Cloud Foundry user is going to reference a Docker image to the platform.

207
00:16:51,940 --> 00:16:57,160
And what the platform does is hand, hands that off to this, uh, you know, run C based layer.

208
00:16:57,440 --> 00:17:04,580
And it's going to talk to the Docker registry V2 API, pulling down the layers, just like it would happen in the Docker engine.

209
00:17:04,580 --> 00:17:06,840
But in this case, inside of a PCF platform.

210
00:17:06,980 --> 00:17:08,580
So all that stuff is exactly the same.

211
00:17:09,160 --> 00:17:12,840
The V2 registry is going to say, here's the list of layers that you need.

212
00:17:13,140 --> 00:17:20,720
And then the, the local, um, uh, run C based, uh, container runtime is going to say, well, these are the ones that I, these are ones that I already have.

213
00:17:20,780 --> 00:17:22,140
So I guess I won't download those.

214
00:17:22,140 --> 00:17:27,720
And then they get assembled and started up into, uh, the container aspects that the Nancy was talking about.

215
00:17:27,760 --> 00:17:29,400
So all that stuff is exactly the same.

216
00:17:29,400 --> 00:17:30,340
It's not different.

217
00:17:30,680 --> 00:17:38,760
We don't do something special, um, for retrieving a Docker image, putting it on disk and starting it into a container.

218
00:17:39,000 --> 00:17:43,080
There are some additional things we do around that, that supplement the experience.

219
00:17:43,140 --> 00:17:46,440
For example, we have this concept called application security groups.

220
00:17:46,880 --> 00:18:03,340
And what that allows us to do is to set up a default policy that, um, Cloud Foundry administers can assign to all the applications that run on the platform to whitelist specific network endpoints that you can get to inside of your container.

221
00:18:03,900 --> 00:18:06,160
Um, but you can do some other things like log.

222
00:18:06,540 --> 00:18:09,100
This is a very kind of enterprise feature for enterprise security people.

223
00:18:09,100 --> 00:18:14,440
So you can log the first, um, outbound packet that's from a TCP connection.

224
00:18:14,560 --> 00:18:22,820
So now, like if someone's doing a bunch of port scanning, um, inside your, inside your platform, you can figure out who is doing that because we can log that.

225
00:18:22,900 --> 00:18:29,300
So those are some of the things that we, you know, add in and around, uh, the, the Docker support that we have.

226
00:18:29,300 --> 00:18:34,180
But fundamentally, it's the same as running a Docker image of Docker engine.

227
00:18:34,280 --> 00:18:36,640
It's just that we have some extra things that, that we do.

228
00:18:36,880 --> 00:18:40,540
Once you have that, um, that the platform adds as advanced features.

229
00:18:41,240 --> 00:18:47,300
One, one thing I might add to that, like the, the things that we do on top, they're really to contextualize, right?

230
00:18:47,340 --> 00:18:50,460
They're to contextualize the application within the context of Cloud Foundry.

231
00:18:50,640 --> 00:18:54,000
And so the application security group is a good example of that.

232
00:18:54,400 --> 00:18:59,980
Another example is that you get all of the environment variables that you may have defined in your Docker metadata.

233
00:19:00,380 --> 00:19:03,520
Remember, that's that third category of what a container is, that metadata, that's important.

234
00:19:04,020 --> 00:19:08,980
But you also get, um, the environment variables that Cloud Foundry will typically provide.

235
00:19:09,200 --> 00:19:10,860
And those would not have been baked into your container.

236
00:19:10,980 --> 00:19:12,860
In fact, those are, those are more dynamic, right?

237
00:19:13,120 --> 00:19:17,360
They would be the services that you've bound your application to, um, at runtime.

238
00:19:17,680 --> 00:19:23,800
Uh, they would be information about, um, your application within the context of a running Cloud Foundry cluster.

239
00:19:24,100 --> 00:19:30,200
And so we do, you know, we do layer that, uh, that value on top, um, and we manage it for you.

240
00:19:31,380 --> 00:19:36,600
And so, uh, again, that it's important to have that mental model, the, the, the bits themselves, those are not changed.

241
00:19:36,600 --> 00:19:39,200
They come in and, and we just, we just mount them directly.

242
00:19:39,740 --> 00:19:45,240
So, so when, when, what, uh, like that process that you guys just went through, what, what do people call that?

243
00:19:45,300 --> 00:19:55,100
Cause, and, and I asked that because, uh, the, uh, uh, the vocabulary of container fun, as far as I can tell, has two words, container and orchestration.

244
00:19:55,340 --> 00:20:03,640
But I imagine it's a lot more like, uh, Baroque and, and, uh, varied than that, but like, what's, what's that one that, the part of, uh, initializing and setting up?

245
00:20:03,800 --> 00:20:05,380
Is there a name for that thing?

246
00:20:07,240 --> 00:20:09,860
Uh, I don't, honestly, I don't really don't think so.

247
00:20:10,000 --> 00:20:16,720
Um, that's, you know, it's creating the container and by that, I mean the isolation groups and it's mounting the file system.

248
00:20:16,820 --> 00:20:22,900
And then it's, it's, it's launching, uh, the processes within the correct context and configuration.

249
00:20:23,260 --> 00:20:25,360
Just like a good old fashioned booting up.

250
00:20:26,020 --> 00:20:26,560
Just about.

251
00:20:26,840 --> 00:20:26,980
Yeah.

252
00:20:26,980 --> 00:20:27,540
That's, that's right.

253
00:20:27,760 --> 00:20:27,960
Yeah.

254
00:20:28,400 --> 00:20:28,560
Yeah.

255
00:20:28,560 --> 00:20:28,720
No.

256
00:20:28,840 --> 00:20:29,080
Yeah.

257
00:20:29,220 --> 00:20:31,960
So, so then, so then how does that, so we kind of went through that process.

258
00:20:31,960 --> 00:20:34,560
How does that compare with like what happens when you use a build pack?

259
00:20:34,820 --> 00:20:37,600
How, how are those two things, uh, different or similar?

260
00:20:39,380 --> 00:20:40,160
Uh, sure.

261
00:20:40,200 --> 00:20:40,760
James, do you want to?

262
00:20:41,700 --> 00:20:42,220
Yeah, sure.

263
00:20:42,220 --> 00:20:44,920
I can, I can, I can talk to that and you can add some color.

264
00:20:44,920 --> 00:20:53,140
I mean, to me, the, the big difference with, with build packs and Nancy has this awesome haiku that the people reference a lot.

265
00:20:53,240 --> 00:20:55,980
It's here's my source code running on the cloud for me.

266
00:20:56,080 --> 00:20:57,000
I do not care how.

267
00:20:57,280 --> 00:21:07,000
And when you're using something like a build pack as a developer, that's primarily doing something like Java or node or Ruby, I'd actually don't have to think about how to construct my image.

268
00:21:07,000 --> 00:21:09,340
I can, you know, give my source code to the platform.

269
00:21:09,340 --> 00:21:21,720
So we call that CF push where my, my application artifacts get handed to Cloud Foundry and Cloud Foundry will go through this life cycle of inspecting that source code saying, oh, it looks like a Java application.

270
00:21:21,720 --> 00:21:29,420
I'm going to give you the latest secured version of the JVM and the latest secured version of Tomcat if you're running that kind of application.

271
00:21:29,740 --> 00:21:31,560
And it puts it all together for you.

272
00:21:31,720 --> 00:21:42,540
And you don't actually have to take responsibility for the, any of the, the base level operating system components or the middleware runtime that, that's on top of that.

273
00:21:42,700 --> 00:21:49,000
If you contrast that with the Docker, um, you're running a Docker image, that responsibility is put onto the developer.

274
00:21:49,000 --> 00:22:00,060
And that's, that's something that might be surprising to developers that they really have to start thinking about, well, is the version of bash that's in my container, um, up to date and secured is the version of open SSL.

275
00:22:00,680 --> 00:22:02,580
Um, I actually don't normally pick that.

276
00:22:02,680 --> 00:22:08,040
That's something that the operating system middleware administrator does, but now I'm responsible since I'm producing this artifact.

277
00:22:08,480 --> 00:22:15,660
So that's really the big difference to me is, is the, do you want the extra levels of control and responsibility?

278
00:22:16,200 --> 00:22:21,540
Um, it's a trade-off for the, for the additional control and the ability to specify everything.

279
00:22:21,720 --> 00:22:27,780
Um, I, now I also have the responsibility to, to maintain it and you get that with the Docker image and we support that completely.

280
00:22:27,980 --> 00:22:38,380
We find that a lot of developers really like the simplicity of just giving the platform, their application and having the platform responsibility for the assembling of that.

281
00:22:38,480 --> 00:22:44,840
Um, image and they actually don't have to think about that too much because they can just say, here's my, here's my code.

282
00:22:45,080 --> 00:22:46,960
You create the image for me and you run it.

283
00:22:47,100 --> 00:22:56,820
And, and that's really the, it's a, it's a dramatic simple, um, simplification of the user experience because, um, otherwise you have to think about all those lower layers.

284
00:22:57,240 --> 00:22:57,640
Yep.

285
00:22:58,380 --> 00:23:02,580
So, so conceptually, I like to think of it, um, this way, right?

286
00:23:02,580 --> 00:23:09,940
So with the, with the, with the build pack approach, um, we end up with three independent, uh, sort of layers, conceptual layers.

287
00:23:10,300 --> 00:23:17,920
There's the operating system layer that has, you know, tar and gzip and lib open SSL, stuff like that.

288
00:23:18,480 --> 00:23:21,820
Um, there's the source code layer, which we can then compile.

289
00:23:22,060 --> 00:23:27,460
And then there's the dependencies that the source code needs to pull in in order to run layer, right?

290
00:23:27,600 --> 00:23:32,340
And so the build pack is responsible for, for managing those dependencies and compiling the source.

291
00:23:32,560 --> 00:23:38,120
And then the underlying, uh, root file system, that operating source layer, that's something that, you know, we are responsible.

292
00:23:38,220 --> 00:23:45,120
Cloud Foundry is responsible for providing, um, that multi-layered approach means that we can actually independently swap those layers out.

293
00:23:45,120 --> 00:23:55,740
So if there's a vulnerability in open SSL, we just need to ship a new version of that lower, lower layer, that operating system layer, run a rolling deploy.

294
00:23:56,640 --> 00:23:58,640
Automatically, everything is patched with no downtime.

295
00:23:58,820 --> 00:23:59,680
No one has to wake up.

296
00:23:59,740 --> 00:24:00,540
No one has to do anything.

297
00:24:00,540 --> 00:24:14,180
It just works, um, with, uh, with a sort of Docker image approach where you choose to specify the contents of your container as basically a single tarball or a collection of, you know, Docker layers,

298
00:24:14,180 --> 00:24:16,820
but that are then ultimately like sort of conjoined to form the image.

299
00:24:17,160 --> 00:24:21,980
Um, we don't have that much flexibility or really the ability to manage that as a platform.

300
00:24:22,100 --> 00:24:32,740
It's sort of a bit more of a free for all where the developer has opted for flexibility, but at the cost of taking over complete control of the whole enchilada, right?

301
00:24:32,740 --> 00:24:33,900
All of these layers.

302
00:24:34,540 --> 00:24:44,020
So now in that context, when there is a, when there is a vulnerability, you would have to sort of manage your whole fleet of Docker images and Docker image producing pipelines.

303
00:24:44,020 --> 00:24:47,560
It's to make sure that they're up to date and have the latest security patches.

304
00:24:49,180 --> 00:24:57,240
So I know what I, yeah, I mean, I know when I came over here and it started at pivotal and started to really see what the platform was, was really doing.

305
00:24:57,320 --> 00:25:01,920
I think that was the one that maybe is more underrated because people do think of containers as helping that upstream.

306
00:25:02,320 --> 00:25:04,000
Like, Hey, let me just bundle my app.

307
00:25:04,000 --> 00:25:05,700
And then it's the output of a CI process.

308
00:25:05,700 --> 00:25:10,100
And look, I want the control of the layers and don't, you know, don't tell me what to do.

309
00:25:10,380 --> 00:25:25,180
And so that can be very efficient for that initial push, but that operational component, when I have a thousand microservices out there with 5,000 containers and, you know, that dirty cow vulnerability comes out or an issue comes out with Tomcat or something like that.

310
00:25:25,580 --> 00:25:28,500
Can you actually repush that many containers?

311
00:25:28,760 --> 00:25:29,700
You know, do you have the source?

312
00:25:29,780 --> 00:25:30,880
Do you have it all hooked up to CI?

313
00:25:31,000 --> 00:25:35,960
That seems like that's a much more complicated process than a restage operation in PCF.

314
00:25:36,900 --> 00:25:37,260
Right.

315
00:25:37,340 --> 00:25:39,660
And for DockerCon in particular, you didn't even need to restage.

316
00:25:39,740 --> 00:25:44,540
It was literally an operator saying, okay, I have the latest root effects, deploy the platform.

317
00:25:44,920 --> 00:25:45,720
And it was done.

318
00:25:47,380 --> 00:25:59,780
Let me ask kind of like a slightly abstract question, which is, well, you know, I think even in our ancestry line of products, we used to use this word.

319
00:25:59,780 --> 00:26:08,540
People used to use this word fabric all the time to talk about like a layer of something, which I never quite understood back then.

320
00:26:08,840 --> 00:26:12,700
A layer of stuff you would run your stuff on to be mega abstract.

321
00:26:13,460 --> 00:26:22,640
And it seems like there's yet again this thing going on where there's, on the one side, no one can see, but I'm holding my two fists up.

322
00:26:22,940 --> 00:26:33,240
On the one side, there's sort of like managing by atomic unit, whether that's like a machine, a server, a VM, a container, whatever.

323
00:26:33,360 --> 00:26:40,820
But just as you guys were just outlining, you've got to go like monkey around with each of those little atomic units as needed.

324
00:26:41,400 --> 00:26:44,800
And then on the other side is yet to be named new thing.

325
00:26:44,960 --> 00:26:49,500
I guess maybe we say platform, but there's like fabric where the haiku applies.

326
00:26:50,120 --> 00:26:51,800
And it seems like, I mean, I don't know.

327
00:26:51,860 --> 00:27:01,780
I mean, first of all, like, I don't know if that idea that I'm kind of depicting is valid, but it seems like people always gravitate between those two things.

328
00:27:01,780 --> 00:27:10,560
And they really, developers at first seem to really like the atomic unit, but then sometimes they like go over to the fabric side of things and vice versa.

329
00:27:10,560 --> 00:27:17,040
But it seems like, like we've just gone over, you know, fabric is like build pack and atomic unit is like your container thing.

330
00:27:17,180 --> 00:27:30,640
And that seems to be like the eternal sort of, I always forget if this is the appropriate definition of the world word, but dichotomy of packaging applications that we, you know, run around in and sort of an infinite loop.

331
00:27:31,780 --> 00:27:37,740
So I ended a question with a period there, but like, I mean, is that, is that, uh, is that stuff you guys think through?

332
00:27:37,740 --> 00:27:40,100
Like when you're, you're messing around with our platform?

333
00:27:40,100 --> 00:27:45,540
Cause it seems like those are the two poles of how you would manage and run your software that I've seen throughout my career.

334
00:27:47,140 --> 00:27:52,500
Yeah. So I think that, so, so first off, everyone likes choice, right?

335
00:27:52,540 --> 00:27:56,200
And so like with PCF, you can, you can choose like the fabric mode or you can bring your own image.

336
00:27:56,260 --> 00:27:57,880
That's fine. Right. Just to be clear.

337
00:27:58,340 --> 00:28:04,940
Um, what, what gets interesting though, is if you think more and more deeply about the fabric and these, these are things that we want to eventually get to.

338
00:28:05,020 --> 00:28:15,620
We don't quite have them, um, like in line to, to start delivering on, uh, ASAP, but you know, what can a platform do if you've given it your source code

339
00:28:15,620 --> 00:28:28,360
and entrusted managing that source code? Like could, one could imagine a world in which you give us the source code and you give us, you know, uh, uh, like a, like a simple test or a smoke test to validate that the source code is working.

340
00:28:28,580 --> 00:28:42,260
And then we can take that, right? Compile it for you, get the dependencies for you, validate that those dependencies are, um, uh, secure and up to date, run the test, see that it works, deploy your app, perhaps a canary deploy to see that it works.

341
00:28:42,260 --> 00:28:51,120
Um, and then if there is a vulnerability in the dependencies today, we require the, um, uh, application developer to go and restage the application.

342
00:28:51,480 --> 00:28:56,320
And that's because, you know, when you change a dependency, that's a, that's a more tightly coupled piece of the application.

343
00:28:56,320 --> 00:29:00,780
And sometimes the application can break. So we, we, we defer to the developer to make sure that things work well.

344
00:29:00,800 --> 00:29:08,720
But if you, if you ship your source code with, with a, with a test, um, then you could imagine the platform automatically taking care of that sort of thing for you.

345
00:29:08,720 --> 00:29:18,320
Right. And so when you take the fabric approach, you can start to really layer on a lot of value, a lot of automation, a lot of, um, you know, like hands off, don't worry about it.

346
00:29:18,320 --> 00:29:23,100
We've got it just by enabling developers to more semantically describe their stuff.

347
00:29:23,160 --> 00:29:32,240
Like, here's my code. Here's my test. Take care of it for me. Right. Um, so those, those are some of the places that we can imagine going to, um, in the future.

348
00:29:32,680 --> 00:29:37,460
But again, back to going back to what I said for now, yeah, you're right. There's this two world universe, right?

349
00:29:37,460 --> 00:29:43,740
It's like, do I, do I, do I speak in terms of atoms or do I speak, do I break the atom and speak in terms of its constituent pieces?

350
00:29:43,900 --> 00:29:45,920
And again, cloud foundry does support both.

351
00:29:46,800 --> 00:30:01,200
And, and, and, and then, and then as an, as another, uh, uh, adjoining question there, uh, like, like, do you, uh, do you, do you think, do you think that when like developers and architects, like, are they, are they thinking through this idea of like, uh, like, uh, I don't know.

352
00:30:01,200 --> 00:30:19,280
I want some amount of AI-ness in how my code is deployed. Like, like, are people interested in that kind of thing? Or are they kind of just like heads down on like the normal mode of like, I got to have my APIs and my implementation or, or are there people who are sort of like coming up with the language to describe a lot of what you were just saying?

353
00:30:19,280 --> 00:30:30,840
Cause that, that seems to always be one of the, the main problems with programming is until you, until you actually just like the gang of four people that until you actually name these patterns that people are doing, like they don't get widely used.

354
00:30:30,840 --> 00:30:40,680
And so like, like who's, like what people are circling through, like, what does it mean to like tell the fabric, these are my tests? Like, I don't even know what you would call that kind of development.

355
00:30:40,980 --> 00:30:50,320
Sure. Sure. Uh, sorry. I just got a random text that distracted me. Um, uh, that, that's how development happens.

356
00:30:50,540 --> 00:31:00,480
Right. Exactly. Distraction. Um, I, I, uh, I think that there are examples of these sort of nouns emerge, like, you know, what is a blue green deploy?

357
00:31:00,480 --> 00:31:03,200
What is a canary deploy? These are exactly, that's a good example. Right.

358
00:31:03,400 --> 00:31:10,920
This is straight language. I look at Spinnaker as a, as a sort of an abstraction or a tool that like builds on top of these, uh, these ideas.

359
00:31:11,420 --> 00:31:15,580
And, and, um, so I think there's, there's, there's a lot of movement there.

360
00:31:15,960 --> 00:31:23,760
Yeah, no, I like that. That's, that's cause it, cause it kind of, uh, at least in my own written history of like containers where a security thing turns into developer productivity.

361
00:31:23,760 --> 00:31:35,720
It's similar where like another seemingly boring thing, pipeline management, like, like turns into a, it enables a whole different way of thinking about your application and the way you're doing it.

362
00:31:35,800 --> 00:31:41,580
So maybe there's, there's, there's, that's, that's an interesting area to go poke around in and see what, uh, vocabulary people are using.

363
00:31:43,020 --> 00:31:48,140
Yeah. If we, so I mean, back to the security part of it though, and we talk about fabrics and platforms.

364
00:31:48,140 --> 00:32:02,880
I mean, so I guess, James, where do we see where PCFs apps actually doing some good things on container security or in general, where's the industry getting better on container security, whether that's preventing things from breaking out or whether that's, you know, the security within things reaching the container.

365
00:32:03,020 --> 00:32:06,060
Are we doing better at that as an industry and how's PCF trying to help?

366
00:32:07,000 --> 00:32:08,840
Well, sure. That's true. Thanks for the question.

367
00:32:08,840 --> 00:32:35,260
I think that, uh, one of the things that we read already talked about this move for pivotal to adopt for on C and one thing that really helped with that for us, and it improved our, our container security story is that, uh, because run C has so many eyeballs on it and so much of a community behind it, as once he was referencing, um, it already works really well with app armor, which is this, um, basically a security subsystem that can be applied to Debian based systems.

368
00:32:35,260 --> 00:32:43,820
And works really well on Canonical Ubuntu, which is what, uh, the operating system that we build on top of inside of Pivotal Cloud Foundry.

369
00:32:44,260 --> 00:32:51,900
And so that just increased our ability to, um, secure these containers by using even more Linux primitives.

370
00:32:52,820 --> 00:33:02,640
Um, another thing that, that we were able to do in the last couple of months is to run our, uh, Linux containers, um, as unprivileged users by default, which is great.

371
00:33:02,640 --> 00:33:14,000
That means that, um, even if, um, even if you're able to, to get out of the container, there's still, uh, some Linux primitives that are protecting, um, you from being able to see things you're not supposed to be able to see.

372
00:33:14,240 --> 00:33:18,340
And so that, that is another example of, of container security.

373
00:33:18,640 --> 00:33:22,640
And then, so you, you might ask yourself, well, every once in a while, there's still these zero days, uh, right.

374
00:33:22,720 --> 00:33:24,780
That you mentioned dirty cows being one of them.

375
00:33:25,280 --> 00:33:42,900
And so with, with Pivotal, we've made it, uh, pretty straightforward for, um, these pipelines to always be taking in these, um, security updates that they're coming directly in from the vendors, whether that's, uh, from Canonical or something like, um, Run-C itself or, you know, wherever these vulnerabilities are being found.

376
00:33:42,900 --> 00:33:46,380
And we test them and certify all those layers together and know that they're work.

377
00:33:46,600 --> 00:33:55,140
And if that's a high CVE, we'll ship that within 48, eight to 72 hours to all of our customers and make it really straightforward for them to update those.

378
00:33:55,380 --> 00:34:00,900
So in the past, what we've seen is, you know, I, I guess dirty cow came out about a month ago, right?

379
00:34:01,480 --> 00:34:14,120
Um, I, I can't remember the exact date, but, um, I've been seeing these exploits of people sharing them on, um, the social media platforms of, you know, with, uh, some, someone using dirty cow to get out of a Docker container.

380
00:34:14,160 --> 00:34:18,120
And here, here we are a month later, um, from when the vulnerability was announced.

381
00:34:18,220 --> 00:34:28,560
And if you're a pivotal customer within two or three days of that vulnerability being announced, you can already be patched because we're, you know, have this really sophisticated, um, update mechanism.

382
00:34:28,860 --> 00:34:44,440
And so I think that's, that's one of the ways of just making security very straightforward and simple to keep up with is something that, um, is a really big challenge if you take it all on yourself, because we've seen just a lot of our customers struggle to stay up to date with patches, frankly.

383
00:34:44,440 --> 00:34:52,880
That's just that, that mundane, um, exercise of just always keeping up to date and trying to keep track of all your dependencies is really difficult to pull off.

384
00:34:53,660 --> 00:34:54,060
Yeah.

385
00:34:54,220 --> 00:35:01,660
I mean, Antti, do you see that as well when we think about trying to bake security in versus asking the developer to necessarily harden and secure it, what they're deploying?

386
00:35:02,080 --> 00:35:02,400
Right, exactly.

387
00:35:02,400 --> 00:35:05,000
I mean, you should secure your code, of course, and do good practices.

388
00:35:05,260 --> 00:35:08,340
But when you are taking on more responsibility with a container, there's a risk there.

389
00:35:08,340 --> 00:35:14,140
So where do you see that value of platforms trying to give that to you and forces forcing you to bring it yourself?

390
00:35:14,440 --> 00:35:15,480
Well, that, that's exactly right.

391
00:35:15,520 --> 00:35:21,500
So what's, what's super cool here is dirty cow is a great example of like, uh, a vulnerability in like that OS layer, right?

392
00:35:21,580 --> 00:35:22,880
Which we can patch for you.

393
00:35:23,060 --> 00:35:33,440
But if you look at what's happened over the last two or three years, um, as the container space has like really evolved rapidly, had more eyeballs on it, had more scrutiny around security.

394
00:35:33,440 --> 00:35:44,060
What we've been able to do is evolve the platform through point releases where we've, we've, um, sort of changed our security stance, changed our opinions around security, made them more robust.

395
00:35:44,160 --> 00:35:47,800
So James mentioned app armor, James mentioned, um, you know, user name spaces.

396
00:35:47,800 --> 00:35:49,540
That's what the unprivileged user thing is.

397
00:35:49,540 --> 00:35:59,340
Like we rolled that out, um, without, um, any developer having to worry about anything without any operator having to do anything except simply apply a rolling deploy.

398
00:35:59,460 --> 00:36:11,640
And so what you have is, is, you know, like the, uh, a platform that's aligning with industry standards around security and, and keeping up with them and providing that value transparently so that you don't have to think about it.

399
00:36:11,640 --> 00:36:11,800
Right.

400
00:36:11,800 --> 00:36:16,860
We're just constantly improving our stance, um, and, and, and shipping that transparently.

401
00:36:17,100 --> 00:36:19,520
And one of the ways that we can do that is because we are opinionated, right?

402
00:36:19,520 --> 00:36:22,540
We're opinionated about how we structure the workloads that land on the platform.

403
00:36:22,620 --> 00:36:24,520
We're opinionated about how we run those workloads.

404
00:36:24,520 --> 00:36:29,380
And we know that we can turn those security features on and that it will be safe that we won't break anything as we do it.

405
00:36:29,780 --> 00:36:34,620
Um, so, so I, there's, there's a ton of value there and no one has to think about it, right?

406
00:36:34,620 --> 00:36:41,020
It's just, it's just, uh, you know, the Cloud Foundry and Pivotal working hard to, to bring that value to the table.

407
00:36:41,340 --> 00:37:02,740
It's like, it's like, as, as always, my, uh, my buddy security is the, uh, is the fat boy scout on productivity. It's sort of like the, uh, it's, it's the, the one constraint limiting your whole thing. And so if you can free that up, then you can, uh, you know, I don't know. I just like saying fat boy scout, but hopefully you can, you can speed things up and, uh, not be limited by them. That, that, that would be nice.

408
00:37:02,740 --> 00:37:32,720
Uh, so, you know, I, I, along those lines, so you, you have like, what, uh, when, when, when, when you guys are talking with people and thinking through it, like if I'm like, uh, there's never one, there's always like a pack of them. I don't know what the plural is. There's always like some pack of enterprise architects who are like planning out what to do over the next, uh, six to 15 years, six months to 15 years or something. I'm being a little hyperbolic there, but like, what, like, what, what's the kind of advice you would give them about like what to do?

409
00:37:32,740 --> 00:37:54,840
with their portfolio? Like, should they just be like lift and shifting everything over or like staging things out or doing nothing? Like what, what's kind of like your default advice other than just, you know, putting everything on Pivotal Cloud Foundry as soon as possible. But like, how do you, how do you sort of advise them to meter this stuff out and identify what works in their portfolio and, and, uh, what projects to use and things like that?

410
00:37:58,880 --> 00:38:28,860
So it's, I think it's, it's this big mixed bag, right? There's, there's a lot of complexity there. There's a lot of different moving pieces. Um, I like, I always like to frame it as a journey, right? Like you're, you're on a journey towards a, a more cloud, cloud native world where you have that agility. You have that ability to put, you know, more and more of your workloads on a platform where you don't have to care about stuff that's below the value line, right? How, how you, how you make progress on that journey. I mean, it's, it's a very,

411
00:38:28,860 --> 00:38:58,840
rich and complicated question that really depends on the context and where the, the individual customer is at. Um, some things do make sense to lift and shift. Some things are like, James, what do you think of lifting and shifting then? Right. Yeah. Oh, please. Well, for, for, for me, lifting and shifting, um, you have to ask yourself why you're doing it. So, um, if something's just in keep the lights on mode and it's not being actively developed, then, and it's actually running fine where it is, then, then you have to ask yourself, why, why would I lift and shift?

412
00:38:58,840 --> 00:39:28,820
This right now? What value would I get out of doing that? Because when you lift and shift, you have to put forward some effort. And then the, then the question I'd have is the effort that the lift and shift effort, um, applied to this particular spot going to be better than the things I'm actively investing in and maybe accelerating those. And so I think that's, that's one obvious thing to look at is, um, if it's, if it's running where it is and it's okay, unless like one, one benefit you could get from lifting and shifting, for example, is, you know, we were just talking about, you know, keeping up to date with security patches.

413
00:39:28,820 --> 00:39:43,960
Maybe that's a problem that you're, you have. And so lifting and shifting a workload can make sense. But, uh, in general, like when, when people come with this question to us, we often recommend that they take something that they're actively investing in.

414
00:39:43,960 --> 00:40:05,960
And then, uh, and then, uh, and then that they're more, more apt to be able to make, you know, their own choices. But first we'd like, we'd like to help them with something that they really care about. We'll do it with them and kind of pair up with it. And then, uh, and then, uh, they're more, more apt to be able to make, you know, their own choices.

415
00:40:05,960 --> 00:40:16,800
We'd like, we'd like to help them with something that they really care about. We'll do it with them and kind of pair up with it. And then, uh, and then they're more, more apt to be able to make that, you know, informed choice going forward.

416
00:40:16,960 --> 00:40:32,140
Yeah. I mean, I think, I think, I think to your, to, to y'all's point, like a lot of lift and shift stuff is like, uh, it's sort of like, you're thinking about technology, like it's a condiment, like, oh, here's this new container liquid in a bottle and I'm just going to squirt it on my hot dog and it tastes better.

417
00:40:32,300 --> 00:40:42,860
But like, I think there's plenty of technologies that are like that, like that you can just condiment your way to awesomeness, but it doesn't really like, it's a lot of trouble to like, just squirt some of the stuff on your hot dog.

418
00:40:42,860 --> 00:40:49,140
Whereas really like, you're talking more about like a, like a hamburger or a meatloaf or something. Like, it seems like it's a much more fundamental thing.

419
00:40:49,140 --> 00:40:59,740
And therefore you pick, you pick projects that are, uh, sort of ongoing in their creation to start using it and learning about. So you get the full benefits of everything instead of just sprinkling it on top.

420
00:41:01,360 --> 00:41:03,840
Well, I want to, I want a hot dog right now. So thank you.

421
00:41:04,220 --> 00:41:05,080
I'm getting hungry.

422
00:41:05,260 --> 00:41:07,560
I mean, I think I want a burger actually.

423
00:41:07,960 --> 00:41:30,860
Yeah. I mean, where was this condiment metaphor going to go? Aeolies, relishes, it was going to go, uh, somewhere exciting. Uh, I mean, so I wanted to ask you that kind of building on that a little bit is, you know, we talk about security, we talk about lift and shift, but where are those difficult problems that we have to solve when working with containers? I'm thinking about things like persistent storage and networking. And yes, I could containerize my Oracle database, but why would I ever do that?

424
00:41:30,860 --> 00:41:48,700
Or, you know, can I really network? Well, where are you still seeing James to start with some of these container challenges that, Hey, the industry is starting to solve, but companies who are using them should at least keep an eye out when they're trying to pick the workloads that they would containerize themselves versus where does PCF help with some of those challenges?

425
00:41:49,440 --> 00:42:04,840
Yeah, that you've nailed the ones that, uh, that come top of mind for me are persistence and networking are ones that I think, uh, you know, speaking specifically about Spivill Cloud Foundry, we're still exploring and investing in enhancing our capabilities there.

426
00:42:05,380 --> 00:42:22,060
It's a lot easier to run a stateless workload than it is to run a stateful one. There's just more to it. And so with persistence, we're actively working on, um, being able to, to mount shared volumes, something like an NFS store or something like that into, into your container.

427
00:42:22,160 --> 00:42:29,180
We've demoed that at CF Summit and, uh, uh, we're hopefully going to be exposing that, uh, into Pivotal Cloud Foundry customers relatively soon.

428
00:42:29,500 --> 00:42:43,140
And then in the networking space, uh, for a while, we've been working on this, uh, kind of network address translation. Um, is that's the, that kind of been the working model where, um, everyone, everyone's on this flat network and we're using these application security groups.

429
00:42:43,140 --> 00:42:57,540
I spoke of earlier to, to kind of control IP tables rules for, for inbound outbound traffic. Um, in the, if you look at, uh, where people want to go with networking and they want to be able to have, um, you know, more explicit controls on the networking.

430
00:42:57,540 --> 00:43:22,380
So we're looking at something, um, based off of a CNI, which is a container networking interface, uh, that, uh, is being used in the Mesos and Kubernetes communities, uh, to, um, hook into some of the other software defined networking stacks, like whether that's something like NSX or, um, Calico or any of these other, um, SDN solutions out there.

431
00:43:22,500 --> 00:43:36,380
And what that allows us to do is, is turn what has normally been a mechanism where you have to turn to network administrator via filing a ticket or something like that, actually program the network with API calls.

432
00:43:36,860 --> 00:43:49,520
And so we're, we're, we're kind of moving in that direction, um, both, uh, this persistence and networking to be able to make that more automatable self-service by developers and with some kind of guardrails that have been set up by administrators.

433
00:43:50,000 --> 00:43:54,200
Those are the kind of the, the emerging areas that we're still, you know, enhancing.

434
00:43:54,720 --> 00:44:04,220
And, uh, you know, that I mentioned before, as we enhance those things in our minor point releases, we just keep raising the waterline on, on the whole capabilities of the overall platform.

435
00:44:04,220 --> 00:44:07,380
And you'll be able to just, you know, take advantage of those as we deliver those.

436
00:44:07,960 --> 00:44:08,320
Yeah.

437
00:44:08,380 --> 00:44:12,600
I mean, honestly, where would I access stateful data in a PCF world?

438
00:44:12,680 --> 00:44:15,980
Do I call off to VMs elsewhere that are Bosch created or something?

439
00:44:16,060 --> 00:44:19,300
How, as a customer, how do I look at this environment and say, I've got some stateful data.

440
00:44:19,300 --> 00:44:21,260
It's not just, you know, elastic web apps.

441
00:44:21,260 --> 00:44:25,660
Where am I supposed to stick this stuff when I work with a container-based platform like PCF?

442
00:44:27,040 --> 00:44:32,220
So, to today, they're external to the system or, yeah, on a Bosch-managed virtual machine.

443
00:44:33,040 --> 00:44:36,260
We're, we're slowly starting to evolve that story.

444
00:44:36,840 --> 00:44:49,900
So, with the, um, sort of the first step with the persistence offering is to say, well, today, the only service you can bind is, um, uh, a service that I can connect to, like, over TCP or UDP, right?

445
00:44:49,900 --> 00:44:51,580
Over, over, over the network in that way.

446
00:44:52,040 --> 00:44:57,020
Um, and so it has to be, like, an external database or it has to be, uh, you know, an external message bus.

447
00:44:57,120 --> 00:45:04,020
But the next step is going to be that, well, actually, we can begin to mount, um, data into the container.

448
00:45:04,020 --> 00:45:09,280
So, like, with NFS or an NFS-compatible, um, uh, storage system.

449
00:45:09,720 --> 00:45:14,180
What that lets you do, it's, it's less about, now I can run my database on Cloud Foundry.

450
00:45:14,260 --> 00:45:21,220
There's a lot of just complexity to orchestrating that sort of thing correctly, managing backups, worrying about lifecycle events.

451
00:45:21,860 --> 00:45:28,220
And, you know, we're, we're still not at the point where we think that, well, I don't think we'll ever get to the point where we think that developers really should be worrying about that.

452
00:45:28,280 --> 00:45:34,720
We'd rather kind of continue our, our data service offering story on top of Bosch, where there's just a lot more control and stability.

453
00:45:35,720 --> 00:45:44,340
But, um, what you can begin to do is to say things like, well, I have just a pile of data over here, you know, in my existing, you know, disk array.

454
00:45:44,600 --> 00:45:48,400
How do I just get at it efficiently from my computer, from my, from my container?

455
00:45:48,520 --> 00:45:51,600
And I don't, you know, I don't have the option of putting it all in a blob store.

456
00:45:51,660 --> 00:45:54,680
I don't have the option of, of, of, of wrapping it in a shim.

457
00:45:54,720 --> 00:45:56,840
I just want to get at it and have my containers process it.

458
00:45:56,880 --> 00:46:04,340
We'll, we'll be able to start to have answers about that so that you can see data as just another service that you can bind to your container.

459
00:46:04,340 --> 00:46:07,900
And it will just appear, um, that's, that's the, that's the next step.

460
00:46:07,960 --> 00:46:13,720
And what we're looking to do is just play that out with a few key customers, see how that, how they, uh, how they experience that.

461
00:46:13,740 --> 00:46:23,560
See, get some feedback on it and decide whether or not that is a place to, you know, continue to invest or to pivot and look in a, in a different direction to bring this to the platform in a way that actually makes a lot of sense.

462
00:46:23,840 --> 00:46:27,300
Given, given our emphasis and our workloads that we bring on the platform.

463
00:46:28,040 --> 00:46:28,440
Awesome.

464
00:46:28,740 --> 00:46:34,320
Well, I could, I could probably ask you another four hours of questions, but let me wrap up with one that hopefully contextualize.

465
00:46:34,340 --> 00:46:37,160
Some of this, so we could talk about containers and infrastructure forever.

466
00:46:37,360 --> 00:46:40,960
One concept that we talk about a lot at Pivotal with customers is this value line.

467
00:46:41,040 --> 00:46:43,460
The idea that, Hey, things below that, like.

468
00:46:47,380 --> 00:46:52,320
Orchestration or cloud orchestration is super necessary, but not sufficient to be a platform.

469
00:46:52,440 --> 00:46:59,480
So, I mean, when we think about containers in our world, I mean, James, you're a remarkably well-read in the community about how we all think about this kind of stuff as well.

470
00:47:00,260 --> 00:47:04,360
Ansi, as well as how should customers be thinking about containers in their ecosystem?

471
00:47:04,540 --> 00:47:10,340
When, when do they say that this is a very important enabling technology, but I don't stop here.

472
00:47:10,520 --> 00:47:15,180
So, I mean, how do you help frame that as a technology that's a piece of something more?

473
00:47:16,120 --> 00:47:16,660
James, for.

474
00:47:16,720 --> 00:47:17,600
Yeah, sure.

475
00:47:17,760 --> 00:47:22,540
I mean, I, I like to, to think about it in terms of just the developer productivity.

476
00:47:23,180 --> 00:47:27,240
It's, you know, containers aren't all that interesting unless they actually help you accomplish something.

477
00:47:27,420 --> 00:47:38,120
So, if you're, if your business is trying to be competitive in a new area and in order to do that, you, you need to evolve with software really quickly to try out new ideas and see if they can come to market fast.

478
00:47:39,540 --> 00:47:44,480
That's really what you should be focused on and, you know, picking and choosing the technologies that are going to help you do that.

479
00:47:44,940 --> 00:47:57,260
And, you know, containers are, are part of that story likely in some, in some way, shape or form, but exclusively just on containers as your primary noun that you're looking at.

480
00:47:57,480 --> 00:48:03,640
It's, it's, it's really hard to see how it ties back to, you know, enabling your, your business to do more and more with software.

481
00:48:04,820 --> 00:48:17,420
And so, I, I, I put the focus on that time to value metric and whatever, you know, technologies you can, and we have strong opinions at Pivotal about, you know, and, and a pretty good track record of actually being able to demonstrate being point to customers that we've done this with.

482
00:48:18,080 --> 00:48:30,460
And so that's, that's why we don't, you know, promote the container in and of itself as the end all be all because, you know, it's really about this, you know, time to value for your business and, you know, that's, that's where we want to focus.

483
00:48:32,360 --> 00:48:32,720
Great.

484
00:48:32,880 --> 00:48:34,120
Antti, your thoughts on that?

485
00:48:34,160 --> 00:48:35,080
How you think about that?

486
00:48:35,420 --> 00:48:36,260
I, I, I agree.

487
00:48:36,340 --> 00:48:39,420
I think that that last phrase, that time to value, you know, containers are a tool.

488
00:48:40,880 --> 00:48:42,240
There's lots of tools out there.

489
00:48:42,640 --> 00:48:52,540
What, what's going to help your developers get, you know, all of the cruft out of the way and focus on rapidly iterating what they deliver to your customers?

490
00:48:53,020 --> 00:48:56,700
Because it's only when you have that rapid iteration that you can course correct quickly.

491
00:48:56,700 --> 00:49:04,840
And it's only if you can course correct quickly in response to feedback that you can build experiences that your customers are going to love, that they're going to value.

492
00:49:05,060 --> 00:49:07,080
And that's how you win in the software economy, right?

493
00:49:07,080 --> 00:49:09,180
So, are containers an important part of that?

494
00:49:09,240 --> 00:49:17,880
Yes, they are, but they don't, they don't kind of come in like a, a magical, you know, condiment that makes all hot dogs incredibly delicious and compelling, right?

495
00:49:18,560 --> 00:49:25,200
They're, they're, they're part of a bigger recipe and you have to, you have to get the whole, the whole package deal right.

496
00:49:25,960 --> 00:49:26,400
Yeah.

497
00:49:26,480 --> 00:49:27,880
It's not just sriracha sauce.

498
00:49:28,640 --> 00:49:29,080
No.

499
00:49:31,260 --> 00:49:34,280
Which, which, as we all know, makes everything more delicious.

500
00:49:36,540 --> 00:49:40,720
Well, uh, yeah, I, I think, I, I think, I think that's, uh, that's great.

501
00:49:40,840 --> 00:49:41,740
That's actually a good overview.

502
00:49:41,740 --> 00:49:47,060
And, and, uh, I, I appreciate the, uh, uh, trying to come up with names for the nameless things there in the middle.

503
00:49:47,440 --> 00:49:54,360
But, uh, yeah, if, if people want to follow up with you guys, uh, like where, where should they, uh, where should they find you?

504
00:49:54,400 --> 00:49:55,680
You're, are you in the Twitter there?

505
00:49:57,100 --> 00:49:59,840
Yeah, I'm Jambay on Twitter, J-A-M-B-A-Y.

506
00:50:00,640 --> 00:50:01,000
Yeah.

507
00:50:01,020 --> 00:50:03,260
And I'm Unsi Jo, O-N-S-I-J-O-E.

508
00:50:03,880 --> 00:50:05,120
And, oh, that reminds me.

509
00:50:05,300 --> 00:50:06,680
I had a question for you specifically.

510
00:50:06,820 --> 00:50:12,500
So, every time I see an email from you, I see this flat field of sand and then a head.

511
00:50:12,940 --> 00:50:14,420
Like, what's the story with that picture?

512
00:50:15,720 --> 00:50:26,800
Uh, I, I, I decided to bury, yeah, no, I, we were on the beach one day and I dug a hole about as deep as I am tall and then sat in it and then took that picture.

513
00:50:26,880 --> 00:50:27,440
It was delightful.

514
00:50:27,620 --> 00:50:28,320
It was very fun.

515
00:50:28,620 --> 00:50:30,840
So, what's it like to be buried in sand up to your neck?

516
00:50:30,960 --> 00:50:32,700
Like, is it distressing or relaxing?

517
00:50:33,140 --> 00:50:34,060
Like, can you get out of there?

518
00:50:34,060 --> 00:50:38,340
It's way too, it's way too tempting to have, like, a really lame container joke in here.

519
00:50:38,400 --> 00:50:39,380
So, I'm going to avoid it.

520
00:50:40,380 --> 00:50:44,220
It's, it's, uh, it's, it's actually really calming.

521
00:50:44,700 --> 00:50:44,900
Yeah.

522
00:50:45,100 --> 00:50:48,980
It's just like, there's this uniform pressure and it's warm and it's nice.

523
00:50:49,120 --> 00:50:50,080
I, I enjoyed it.

524
00:50:50,180 --> 00:50:50,580
Yeah, yeah.

525
00:50:50,580 --> 00:50:51,080
I enjoyed it a lot.

526
00:50:51,180 --> 00:50:51,740
It does, it does.

527
00:50:51,740 --> 00:50:53,880
I've gotten a lot of mileage out of that profile pic.

528
00:50:54,180 --> 00:50:54,400
Yeah.

529
00:50:54,500 --> 00:50:56,360
I'm breaking into a sweat thinking about it right now.

530
00:50:56,400 --> 00:50:57,700
So, we need to wrap this up.

531
00:50:58,620 --> 00:51:03,180
Well, well, on that note, as always, uh, well, thanks to the two guests and thanks for listening.

532
00:51:03,280 --> 00:51:04,840
This has been Pivotal Conversations.

533
00:51:05,340 --> 00:51:10,540
You can find us in our not so secret backend at soundcloud.com slash Pivotal Conversations.

534
00:51:11,020 --> 00:51:16,580
Or if you go to, uh, I believe it's blog.pivotal.io slash Pivotal Conversations.

535
00:51:16,940 --> 00:51:21,280
It's almost a tradition that I get that URL totally wrong, but you can just search around

536
00:51:21,280 --> 00:51:24,660
for Pivotal Conversations and you'll find the extensive show notes and everything that

537
00:51:24,660 --> 00:51:25,040
we have.

538
00:51:25,180 --> 00:51:29,540
It's always great if you enjoyed this episode or if you didn't enjoy it, but still want

539
00:51:29,540 --> 00:51:30,720
to leave a favorable review.

540
00:51:30,720 --> 00:51:35,080
If you go into iTunes and leave a review, or if you're listening in overcast, you can open

541
00:51:35,080 --> 00:51:37,380
it up and click on the little recommend thing.

542
00:51:37,860 --> 00:51:41,860
Uh, and, and with that, you know, it's always nice also to just to tell people, uh, that,

543
00:51:42,000 --> 00:51:46,300
that you like it and tell us it keeps us, uh, you know, being dancing pickles and everything.

544
00:51:46,560 --> 00:51:48,280
And we'll see everyone next time.

545
00:51:48,480 --> 00:51:49,040
Bye-bye.