►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
Keynote: Craig Box, Staff Developer Advocate, Google
About Craig
Craig Box leads the Cloud Native advocacy team at Google Cloud. He has worked with customers and communities since the launch of Kubernetes in 2014, and last year delivered talks on 5 continents. He is the co-host of the Kubernetes Podcast from Google. Craig started his career in systems administration, and has over 15 years of experience in development, deployment, DevOps, consulting, advisory and management roles around the world.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
It's
been
an
amazing
journey
over
these
last
four
years.
The
first
time
I
showed
people.
What
Google
was
doing
with
kubernetes
was
to
a
startup
accelerator
with
an
audience
of
six,
and
so
it's
great
to
see
so
many
of
you
here
today.
Thank
you
so
much
for
coming
we'd
like
to
talk
about
a
couple
of
the
things
that
we've
been
working
on
at
Google
and
the
we've
announced
today.
The
first
thing
I
want
to
tell
you
about
today
is
a
new
open
source
project
advancing
the
container
security
field.
A
It's
called
G
Weiser,
so
like
kubernetes
sto,
G,
RPC,
G
visor
is
built
on
the
same
design
principles
that
we
use
internally
at
Google.
It's
a
new
kind
of
sandbox
that
provides
isolation
for
containers,
it's
more
lightweight
than
a
VM,
but
it
provides
you
with
a
similar
level
of
isolation.
It
gives
you
that
strong
boundary
by
intercepting
application
system
calls
and
acting
as
a
gift
kernel
all
while
running
entirely
in
user
space,
and,
as
you
see
there
it's
available
to
download
today
at
github.
A
Let's
have
a
look
at
a
quick
example.
I
know
this
one
works,
it
is
recorded.
This
is
a
VM,
that's
vulnerable
to
the
dirty
cow
exploit,
so
you
see
the
a
no
CI
bundle.
This
is
running
a
container
using
run.
C
G
visor
is
implemented
as
an
OC
I
runtime.
So
we're
going
to
be
able
to
take
that
exact,
same
bundle
and
run
it
under
G
visor
to
show
you
the
situation
where
we
are
not
exploitable.
A
What
we
have
here
is
a
alluded.
Elided
version
are
very
exploit
where
we
can
see
that
we've
managed
to
change
the
password
file
inside
this
container.
So
we
have
a
user
process
running
and
user
space.
That's
able
to
access
a
file
that
it
should
not
be
able
to.
So
you
can
imagine
that
that's
said
something
which
would
reset
the
password
and
now
I
have
control
of
that
container.
We
don't
want
that.
A
So,
let's
look
at
exactly
the
same
thing
again,
exactly
the
same
configuration
file
exactly
the
same
bundle,
but
now
we're
going
to
run
it
under
run
SC,
which
is
the
G
visor
OCI
runtime,
will
enable
some
debug
functionality
will
actually
let
you
see
the
system
called
as
they
go
through,
and
that
gives
you
a
little
insight
into
how
the
exploit
actually
works.
It's
causing
a
race
condition
in
the
kernel
by
alternating
very
quickly
between
two
system
calls
and
that
will
eventually
give
you
root
access,
but
gee
vines
is
intercepting
those
system
calls.
A
A
A
Let's
have
a
quick
look
at
stack
driver
at
the
top.
You
see
the
event
timeline,
which
is
a
heat
map
of
violations
of
incidents
or
alerts.
We
have
views
here
as
systems
operator.
We
might
want
to
drill
down
into
our
node
and
then
look
at
the
work
that
running
on
that
node.
As
a
developer.
We
might
prefer
to
look
at
it
from
the
controllers.
The
workloads
then
under
the
pods
or
for
a
customer
centric
view.
A
We
can
look
at
it
from
the
services
and
the
pods
that
run
under
them
as
we
drill
into
one
of
our
objects.
We
can
click
and
see
detailed
information
such
as
memory
or
CPU
utilization,
and
then
we
can
see
the
logs
and
context
you
can
see
at
that
point
in
time.
These
are
the
logs
that
were
generated
by
that
particular
pod.
If
we
want,
we
can
drill
into
the
full
logging
interface
and
then
we
can
even
use
bigquery
to
do
queries
across
the
entire
log
system,
but
for
now
let's
use
the
metrics
Explorer.
A
So
we
had
some
sort
of
spike
with
the
networking
on
the
customer
service.
We
want
to
find
out
why
so
we'll
select
what
type
of
object
we
want
to
look
at
when
I
look
at
a
kubernetes
pod
and
it's
metric
of
bytes
transmitted
and
you
can
use
again
metrics
from
kubernetes
or
any
Prometheus
metrics
that
you've
provided
yourself
will
filter
for
the
service
that
we
want
to
look
at,
and
then
we
can
group
by
services
or
cluster
name,
and
we
can
aggregate
with
functions.
A
Like
sum
Max
95th
percentile,
and
get
a
view
of
what's
happening
at
that
particular
point
in
time,
so
stackdriver
kubernetes
monitoring
helps
you
get
faster
time
to
resolution
working
with
any
cloud
working
on
premise,
providing
views
for
both
operators
and
developers.
It's
built
on
our
many
years
of
experience,
running
large
clusters
at
scale
built
on
the
advice
from
our
SRE
team
and
it's
fully
integrated
with
gke
it's
available
in
alpha
clusters.
Today,
one
quick
thing
I'd
like
to
tell
you
about,
is
Liz
mentioned.
A
My
colleague,
Adam
and
I
have
just
launched
a
new
communities
podcast,
which
is
a
weekly
show,
focusing
on
news
and
insight
from
the
kubernetes
and
cloud
native
ecosystems
we've
just
published.
Our
first
show
so
please
take
out
your
phones,
go
to
your
favorite
podcast
application,
just
search
for
cuban
areas.
Podcast
you'll
find
us.
We
have
some
great
interviews
published
and
coming
up
so
please
take
a
look
at
a
new
project,
feel
free
to
come
out
and
see
us
at
the
Google
cloud
booth.
We
have
a
great
program
running
in
our
lounge.