►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18).
SIG Node Deep Dive – Dawn Chen, Google (Intermediate Skill Level)
"About Dawn
Dawn Chen (dchen1107@github) is a Senior Staff Software Engineer from Google Kubernetes Team. She has been one of tech leads in both Kubernetes and GKE, mostly focus on Node area. Prior Kubernetes, she was the one of the tech leads for Google internal container infrastructure for about 6 years."
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
So
actually,
today
we
talk
about
a
couple
people
and
wish
we
decided
this
time
we
are
doing
the
unconference
style
and
so
I
briefly
and
I
invited
the
people
here
many
experts
here
we
have
invited
a
few
people.
We
have
the
Google
have
the
this
time
for
the
crippled
Kong
and
we
allow
us
to
devise
their
open
source.
So
I
mean
why
did
the
two
expert
from
the
devisor
team,
Aiden
and
sorry
I
was
promised
your
name.
A
Can't
you
help
you
from
Brazil,
yes
and
you're
here
they
are
the
expert
and
they
are
in
the
inventor
of
the
divisor
so
and
we
also
invited
the
shri
from
the
hyper
company
and
he
is
a
part
of
the
tech
community
of
the
cata
container.
We
also
invited
the
Steven
and
from
the
darker.
He
is
the
leader
leading
engineer
working
on
the
continuity,
so
both
continuity
and
the
crowd
in
this
year
is
in
the
production
stage.
A
So
if
you
have
the
question-
and
we
started
talking
about
how
to
make
sure
those
Center
box
solution-
integrates
those
container
Wrentham
at
OCA
level
and
the
continent
Wrentham
level,
so
then
we
can
have
the
very
easy
simulation
of
the
X
user
experience
for
our
customer.
So
basically
we
try
to
have
the
single
container
in
time
for
your
caster
and
but
you
can
support
and
the
Renick
Windows
application.
You
can
support
or
have
the
secure
part
available
for
some
and
trusted
code.
So
I
invited
those
customer
and
fortunate.
A
We
don't
have
neck
the
representative
from
the
crowd,
because
there's
the
time,
conflict
or
schedule
conflict
from
the
open
shift
Samhita
next
week,
and
we
also
invited
our
leading
engineer
from
the
signaled
and
the
VG
and
talked
about
the
CI
talked
about
not
confirm
test
and
there
I
test
the
policy
so
help
us
in
the
future
to
choose
what
can
have
the
content
container
on
time.
You
want
and
will
enough
actual
feature
you
enable
through
those
tests.
A
So
for
you,
sir,
there
can
easy
to
using
those
kind
of
things
and
analogy:
I
did
leave
which
it
is
leading
of
the
effort
under
the
back
part,
and
we
last
I
think
last
cubicle
I
announce
the
focus
for
signaled.
It
is
the
to
focus
when
it
is
secured
here
so
another
one.
It
is.
It
is
the
introspection,
the
back
up,
Enid
here,
to
help
the
user
so
to
what
happened
on
the
node.
A
What
happened
to
the
Cuban
eight,
what
happens
to
the
two
your
powder,
so
actually
the
least
work
is,
can
help
us
on
that
area.
So
this
is
all
in
stock
unconference
and
if
you
have
any
concern
and
the
talk
and
if
you,
if
there's
nobody
to
talk
and
where
you
adding
those
expertise
on
stage
and
give
you
brief
or
summary
what
we
are
doing
and
the
roadmap.
What's
the
plan
here,
okay,.
A
A
So
this
is,
it
is
the
right
forum
to
talk
about
this
well
signaled.
At
least
it
is
right-
and
in
signal
also
sponsored
the
resource
management
work
group
to
discuss
those
pressing
and
I
all
limit
I'll
control,
IOT
anyways.
Actually
it
is
one
of
the
topical
we
discussed
there
and
it's
just
priority
lies
yes
and
there's
the
several
proposal.
We
have
been
reviewed
and
but
none
of
the
proposal
now
it
is
the
part-
has
to
be
available.
Yes,
we
are.
We
are
working
on
those
things.
Yes,
anymore.
B
C
Hi
everyone,
so
we
started
I
back
in
nineteen
2015
and
now
it's
right
now
it's
getting
mature.
We
have
different
implementations
that
are
production,
ready,
cryo,
for
example,
I
think
is
right
now,
GA
in
open
shift
and
continuity
right
now,
the
one
the
latest
version
1.1
supports
a
CRI
CRI
plugin
natively,
so
you
can
use
it
out
of
the
box
and
there
are
other
implementation
to
like
fact,
II
and
which
deals
with
more
hypervisor
based
runtimes.
There
are
other
challenges
because
supporting
my
hypervisor
space
runtime
is
not
just
a
CRI
level
stuff.
C
We
need
kubernetes
api
level
changes
as
well
and
more
changes
in
communities
overall
and
in
the
m-19
we
actually
deprecated,
rocking
natives,
the
old
rocket
integration,
I
think
I've
seen
people
mentioned
in
the
talk
that
this
is
still
available,
which
is
not
true.
It
was
deprecated
in
one
night
and
in
one
time
we
actually
remove
all
the
code.
C
So
all
the
pre
CRI
integrations
are
gone
so
right
now
we
have
the
entry
darker
stream
and
different
implementations
in
other
repositories
and
as
for
the
API,
in
the
past
few
releases,
we
were
trying
to
wrap
up
and
tying
up
some
loose
ends.
Mostly,
we
work
on
stats,
log
stats
and
a
lot
of
LOC
stuff.
We
finished
the
log
format
to
actually
support
partial
lines
and
we
are
working
on
getting
plenty
to
support
us
natively
and
we
have.
C
Apart
from
that,
we
are
working
on
the
conformance
testing,
so
basically,
we
want
to
leverage
the
no
conformance
test.
I,
don't
know
how
many
people
are
familiar
with
an
old
e
2e
test,
it's
kind
of
in
a
weird
place,
because
we
do
use
it
a
lot
in
pap
smear
test
and
also
all
kinds
of
CI
testing
jobs.
But
the
tests
are
some.
Some
of
the
tests
are
shared
with
kubernetes
cluster
test.
Some
are
not,
and
many
few
of
them
are
actually
marked
conformance.
C
So
no
one
is
actually
just
running
the
conformance
test
suite
for
now
we
have
one
test.
Job
is
failing,
so
one
of
the
goal
for
this
work
is
to
recategorize
all
the
tests
so
that
we
have
a
component
test
suite
and
we
can
have
all
the
different
CI
imitations,
just
publish
their
test
results
in
the
dashboard,
and
we
can
see
like
whether
they
are
passing
all
the
conformance
test
suite
and
what
optional
features
they
actually
support.
C
So
it
be
easy
for
users
to
track
for
each
release,
what
the
runtimes
actually
support
and
whether
they
are
passing
or
not.
We
have
a
CI
CI
testing
policy
in
proposal
already
merged,
I,
think
I.
Think
in
the
community
repository
you
can
take
a
look
if
you
like,
but
the
actual
work
is
still
in
progress
because
of
the
win
structure.
We
have
right
now,
and
some
of
the
tests
in
the
null
e
to
e
suite
are
part
of
the
conformance,
kubernetes
conformance
test,
which
now
has
a
more
strict
guideline
and
requirements.
C
So
as
part
of
this
work
I
would
like
to.
We
would
like
to
move
on
and
by
having
a
set
of
known
exclusive
test
attacks
so
that
we
can
sort
of
evolve
the
no
conformant
test
independently
from
the
kubernetes
conformance
test,
until
we
are
sure
what
we
will
actually
want
to
include
and
what
this
conformance
test
actually
means,
and
those
are
open
questions
so
like
what
does
the
note
women's
tests,
which
include,
and
also
how
is
it
different
from
the
kubernetes
conformance
test
suite?
Should
they
be
included
as
part
of
it?
C
Should
it
should
it
be
different?
For
example,
we
have
a
lot
of
tests
that
rely
on
direct
access
to
the
hosts
file
system
and
those
are
not
those
I
think
our
strict
strictly
excluded
from
the
kubernetes
conformance
test.
But
those
are
useful
tests
for
us
if
we
exclude
all
of
them
or
it
spends
so
much
time
to
confer
them.
We
may
not
make
enough
progress
for
the
for
qualifying
our
CRI
run
times.
C
So
the
proposal
right
now
is
working
on
this
for
the
long
term,
but
also
have
a
workaround
so
that
we
can
have
a
different
complements
test.
Suite
found
communities
and
the
next
thing
is:
we
have
CII
tools
repository
which
we
have
a
CI
validation,
test,
suite
and
also
CRI
control,
PI
control,
which
is
a
CLI
to
come
in
light
or
for
all
the
CII,
runtimes
and
I
think
it's.
C
We
are
trying
to
improve
the
UI
of
the
cry,
control
and
I
encourage
everyone
to
try
it
out
and
give
us
feedback
and,
at
the
same
time,
we'll
try
to
remove
all
the
director
COI
usage
in
the
kubernetes
repository
and
try
to
replace
them
with
the
PI
control.
So
if
you
can
help
us
and
give
us
feedback,
that
would
be
great
I
think
that's
about
it.
C
A
So
Lex
what
we
wanted
Stephen
give
out
like
the
updated
status
of
the
CI
continuity,
which
is
actually
it
is
the
continuity.
So
in
q1
q2
you,
the
one
of
the
so
continuity,
have
the
one
that
one
release
and
the
major
effort
we
did.
It
is
merges
their
continuity
into
the
continuity
so
continuing
it
is.
You
have
to
literally
support
a
CI
interface.
So
actually
he
just
show
you
that,
though
the
confirmed
has
to
help
to
validate
to
the
continuity
ever.
D
Yeah
well
what
she
said.
So,
yes,
I'm
going
to
show
you
around
the
note
in
didn't
tests
a
little
bit
and
you
can
see
here
we're
passing
I
guess
there
was
a
time
out
here.
Is
that
that's
red?
But
you
can
go
through
here
and
look
at
the
various
running
and
we
can
see
here's
the
container.
Do
you
running
tests
and
stuff
like
that?
So
there's
only
thing
you
want
to
be
show
specifically
in
here:
okay,.
C
These
are
actual
like
note
e
to
eat,
our
sweets
and
class
ready
to
eat,
has
sweets,
and
the
part
of
effort
is
try
to
formalize
this.
So
you
don't
have
to
run
all
the
sweets
here
and
it
would
be
easier
to
track
what
features
you
support.
So
once
that
is
actually
done,
this
will
be
much
easier
and
you
don't
have
to
run
ten
tests
for
your
run
time,
yeah.
D
D
D
So
we
can
see
here
we
have
the
pause
containers
and
then,
like
DNS,
cube,
DNS
sidecar,
cube
proxy
cube
controllers.
All
the
way
through.
Do
we
want
to
go
deeper?
Is
there
is
this
of
any
interest?
Okay?
So
so
so,
for
instance,
here's
like
the
cube
scheduler.
So
we
can
take
that
container
inside
a
container
D
and
we
can
start.
We
can
look
at
it
and
we
can
see
both
the
like
CR
ipod
config,
as
well
as
the
run
c
spec
within
container
d.
I'll
show
you
that
really
quick.
D
D
So
we
can
see
the
exact
run
suspect
that's
going
on
with
that,
all
with
all
with
tools
that
are
available
in
the
open
source
projects
and
then
there's
also,
this
feature
called
extensions
in
container
D.
So
the
CRI
and
integration
with
container
D
is
storing
everything
natively
in
container
D.
So
we
can
pull
out
that
extensions
field.
Let's
hope
I,
hopefully,
can
get
the
syntax
correct.
D
So
here
so
here
is
the
actual
I.
Don't
know
what
the
exact
terminology
for
this,
but
it's
basically
the
pod
configuration
is
that
oh,
it
says
it
right
here
it
that
there
should
be
a
type
somewhere,
but
you
can
see
here,
here's
the
ID,
here's
the
actual
pod
name,
and
then
we
can
see
the
sandbox
ID
as
well
as
like
the
so.
We.
B
D
D
D
D
Oh
yeah,
so
1.2
so
right
now
the
biggest
thing
that
they're
working
on
is
windows,
support
and
there's
definitely
PRS
coming
through
I
saw
that
they
updated
HDS
gym
the
other
day,
but
at
the
best
the
best.
If
you
want
to
know
it's
going
on
in
container
D,
there's
there's
two
avenues:
there's
the
the
milestones
and
the
actual
project,
and
you
can
come
here
and
you
should
put
a
milestone
link
on
the
front
page
on
github.
If
anybody
from
github
is
here,
so
you
can
see
here's
the
1.2
milestone.
Oh
there's,
there's
two
things.
D
So
yeah,
it's!
If
there's
anything
you
you
want
to
see
in
1.2,
it's
really
easy
to
engage
with
the
team
by
either
you
can
file
an
issue
and
maybe
request
it
or
you
can
directly
engage
the
team
through
the
docker
community,
slack
and
I'm
also
available
on
sig
node
as
Steve
Oh
safely.
The
spelling
is.
D
A
Stephen
and
actually
City
range
is
not
just
show
this
continuity
and
also
show
off
so
as
a
powerful
tool,
which
is
a
beaut
also
lead
by
the
signaled.
Sorry,
okay,
so
the
is
the
CI
I,
sorry
CRI
cattle.
So
we
will
build
this
kind
of
things
because
we
have
the
KCI
API
project
and
then
we
want
to
change,
make
the
run
time
in
the
future
ran
time.
It
is
the
is
the
CI
compliant
a
run
time.
So
there's
a
lot
of
powerful
effort
there
and
the
people
most
constrain.
A
It
is
you
subpoenaed
here,
because
everyone
get
used
to
the
Hawker,
no
client
talk
her
seat,
say
AI
and
there's
a
lot
of
concern
about
those
kind
of
things.
It's
a
when
we
start
of
the
CI
project.
We
started
this
CLI
project,
so
it
is
portable,
so
it
is
even
I
fortune.
Today
we
don't
have
the
cryo
folks
here.
So
actually
the
same
tools
can
work
with
the
with
the
prior.
So
another
thing
it
ends
now
needs
in
right
there
to
talk
about
the
frak
T
and
talk
about
to
rev
a.
B
Sex
toy
sorry,
I,
don't
prepare
this.
This
presentation
and
firstly,
I-
will
introduce
something
about
our
our
work
on
the
cotta
containers
and
the
color
containers.
You
know
last
year
in
Austin,
the
inhale
and
and
hyper
announced
how
the
candelas
protect
that
for
the
authorizer
container,
based
on
the
original
work
by
in
her
career
containers
and
the
hyper
Ravi
and
right
now
we
we
will.
We
will.
B
We
will
release
the
table
lamp-
oh
no,
in
in
this
in
this
month,
maybe
two
weeks
later
and
the
color
containers
now
the
design
valve
the
design
Co
is
to
to
work
with
with
the
holidays,
simile
simile
three.
So
so
we
have
some.
We
have
prepared
some.
Some
integration
with
companies
in
self
first
of
all
is
to
use
the
existing
cryo
and
the
continuity,
and
we
will
maybe
because
the
because
the
calendars
will
provide
a
receipt
compatible
interface
with
the
command-line
interface.
So
we
can,
we
can.
B
We
can
use
them
with
multi
runtime
support
of
the
of
the
community
and
the
cryo
to
support
use
the
color
containers
as
a
as
a
as
a
as
a
runtime
for
the
privileged
part.
So
for
the
photo
for
the
isolation
and
at
the
move
out,
the
frac
T,
the
frac
T
itself
support
the
Ravi
for
the
as
before,
and
we
also
shipped
all
the
Ravi
api's
to
the
to
the
calendar.
Containers
1.0
and
the
work
is,
is
what
working
in
progressing
and
we
will
be
finished
before
the
land
Pony
all
release.
B
So,
as
a
result,
we
will
maybe
or
ship
shifted
the
frankly
itself
to
support
the
color
containers.
Ap
is
and
which
we
semantically,
seven,
which
term
semantics
is
compatible
with
the
already
known
run
via
API
and
also
support
of
the
CRI
semantics.
So
this
is
another
way
for
the
for
the
for
the
cotta
containers
support
in
the.
C
B
B
Letta
share
sharing
some
some
basic
basic
basic
schedule,
basic
process
in
the
in
the
continuity
and
could
could
could
request
to
the
to
the
random
API
of
Kharak
and
in
there's
more
efficient
efficiently,
and
that's
that's
part
of
the
drug
that
that's
that's
the
the
following
work
for
the
photo
practice,
and
and
also
we
will.
We
will
have
some
work
on
the
on
the
other
paths,
such
as
the
the
CRC
our
eyes.
We
are
talking
about
to
support
more
more
efficiently
for
the
for
the
photos.
B
You
know
right
now
for
the
photo
cotta
containers
and
also
for
previous
color
container
Ravi,
also
in
the
fractal.
We
use
a
operator
for
that
any
any
of
the
any
of
the
networking
supports
that
said
how,
by
existing,
since
you
know,
plugins
will
be
used,
use
a
bridge
to
to
set
up
another
link
from
the
from
the
night
as
to
the
total
total
VM
itself.
B
But
by
this
way
that's
that's
less
efficiency
so
and
in
the
in
the
public
or
in
the
in
the
production
usage,
be
we
also
use
our
own
sinaia
plugins
to
just
to
practice
practice
the
network
from
the
bridge
and
direct
to
the
directory
to
the
to
the
VMS.
That
makes
the
way
simpler,
but
we
need
to
have
a
have
some
some
communication
with
the
city
ipi
community
to
to
ensure
more
compatibility
with
other
thing.
I
plugins
and
another
thing
is
about
the
storage
we
we
also,
we
also
share.
B
We
also
have
a
discuss
with
the
CI
CI
Sai
community
and
have
have
some
meetings
and
instead
set
up
some
some
issues
that
we
could.
The
way
is
to
try
to
introduce
detach
the
way
to
the
to
the
storage
that
don't
need
to
follow
CICS
a
volumes.
We
don't
need
to
Hach
all
the
other
volumes
to
the
to
the
mountain
in
the
house
by
some
means
for
those
networking
storage
such
as
NFS
and
some
some
some
distributed
storage.
B
B
That's
that's
somatic
in
the
in
the
in
the
CICS
a
apart
and
its
will
be
a
quite
smart
quest,
more
change
for
the
CSI,
so
that
stream
committees,
it's
pretty
welcome
for
the
for
the
for
the
improvement,
and
you
can
you
just
mentioned
a
lock
part,
because
the
all
the
existing
cutters
will
use
the
share
the
same
log
architecture
with
the
sea
and
tourists,
and
so
so
so
because
we
could
share
the
same
log
interface
yeah
so
and
that
we
are
improving
on
the
test.
So
that's
all.
Thank
you.
F
Hi
everyone
I'm
leaving
and
I'm
a
I'm,
a
s
re
at
Google.
A
couple
of
years
ago,
we
started
looking
at
from
a
necessary
perspective,
running
some
of
our
internal
applications
on
kubernetes,
and
we
had
a
little
bit
of
trouble
at
first.
We
like
it's
because
we
like
to
use
immutable,
container
images
and
minimal
builds
and
reproducible
builds
and
and
when
we
started,
we
started
doing
that
with
kubernetes.
F
So
the
first
one
is
is
process.
Namespace
sharing
pod
share
a
lot
of
resources,
but
traditionally
they
don't
share
the
the
process
namespace.
So
you
can't
see
processes
it.
You
know
in
two
different
containers
across
the
container
boundary
and
a
pod
so
that
one
that
one's
a
pretty
simple
change
and
it's
it's
a
it's
a
feature.
F
That's
in
alpha
right
now
in
the
current
release
and
then
the
the
more
complicated
change
is
something
that
they
call
debug
containers,
and
so
this
is
the
ability
to
run
a
new
container
container
image
full
of
debug
tools
or
really
whatever
you
want
inside
of
an
existing
running
pod.
So
this
makes
it
super
easy
to
have
pod.
That's
that
really
just
has
nothing
but
your
binaries
and
then,
if
something
goes
wrong,
you
can
use
a
debug
container
in
the
running
pod
to
take.
F
Maybe
you
have
some
automated
tools
that
run
and
take
a
snapshot
of
everything
and
or
or
maybe
you
run
a
shell
so
that
you
can
start
actually
looking
at
your
mount
paths
and
then
and
ideally
will
then
kill
the
pod
afterwards,
because
we
don't
know
what
a
pod
that's
been
tampered
with.
So
that
feature
is
there's
a
couple:
PRS
open
right
now,
so
I'm
hoping
that
we
can
have
an
alpha
and
a
couple
releases,
and
that's
that's
about
it.
For
those
features,
does
anyone
have
any
questions.
F
F
So
it
was
alpha
and
the
release.
Just
do
you?
Oh
yeah.
Sorry,
how
alpha
is
is
the
is
the
process
namespace
sharing,
so
when
I
say
alpha
its
its
protect?
It's
a
it's
a
feature
flag.
It's
a
feature
gate
and
it's
classified
as
alpha.
So
it's
not
enabled
anywhere
by
default.
I
use
it
I,
don't
use
it
in
production.
I,
don't
have
any
any
workloads
that
need
that
right
now,
I
am
looking
for
feedback.
If
anyone
here
is
using
it
or
if
anyone
knows
anyone,
no
oh.
F
F
That's
one
of
the
exact
same
things
that
that
we
would
like
to
see
right
so
I
when
you're
having
a
problem,
you
can
run
a
debug
container
that
can
see
your
process
and
can
take
an
automated
core
dump
and
maybe
put
it
in
storage
somewhere
and
then
kill
the
pod.
And
then
you
can
debug
it
later
at
your
convenience.
F
G
Also
I'm
gonna
talk
just
for
a
few
minutes
about
gee
Weiser,
then
I'm
happy
to
answer
questions
we're
pretty
new
to
the
whole
kubernetes
space
and
the
project
just
launched
on
Wednesday.
It
seems,
like
there's
been
a
lot
of
interest
in
it,
so
we're
kind
of
trying
to
keep
up
with
with
some
of
the
developments.
So
we
have
a
runtime
and
OCI
runtime
that
basically
sandboxes
workloads.
G
You
know,
like
the
cauda
folks,
were
really
interested
in
providing
better
container
isolation
overall,
but
our
target
is
more
for
high
density,
lightweight
services.
Right,
there's,
there's
lots
of
times.
We
want
to
run
things
they're,
not
maybe
first
party
services
that
you've
authored
or
whatever,
and
we
want
to
make
that
really
simple
and
so
we're
really
interested
in
the
evolving
sandbox
pod
spec,
which
I
think
is
there's
a
session
going
on
about
that
right.
Now,
we're
really
interested
in
understanding
things
that
she
was
talking
about.
Like
you
know,
four
volumes
and
I
guess
network-based
volumes.
G
G
G
Everything
happens
in
user
space
was
sort
of
emulating.
What
the
system
surface
looks
like
to
applications.
It's
not
exposing
any
of
the
hosts
kernel
details.
The
user
space
kernel
does
run
on
top
of
the
host
kernel,
though,
and
the
reason
it's
a
reimplementation
versus
something
like
your
mother,
big
difference
is
that
it's
aware
that
it's
a
user
space
kernel
and
it's
not
actually
providing
like
a
fixed
resource
footprint
for
these
applications.
G
So
if
you
have
an
application
that
needs
10
makes
a
memory
you're
running
in
G,
visor
it'll
use
10
Meg's
of
memory,
plus
some
amount
like
5
10
Meg's
on
top
for
the
actual
runtime.
So
so
that's
the
idea
really
excited
at
the
reception
his
head.
I
can
talk
in
detail
to
KVM
platform
as
well.
If
people
are
interested
in
that,
but
I
don't
know
how.
How
do
you
pi
should
go
yeah.
G
What
was
that
word
that
you
used
test?
Oh
that's,
a
strange
word,
I
mean
so
we've
been
using
it
internally
at
Google.
We
have
a
bunch
of
tests.
The
whole
open
source
thing
is
is
very
new
to
us
like
less
than
48
hours
old.
So
you
know
hopefully
we'll
be
able
to
to
push
some
of
that
stuff
and
evolve
the
project
a
bit
faster.
G
We
saw
there
was
a
lot
of
exciting
developments
in
this
space
and
and
the
whole
goal
is
that
we
want
to
participate
actively
and
be
able
to
talk
about
this
stuff
more
openly.
So
that's
why
the
code
is
out
there
now,
but
on
the
test
run.
Obviously
you
know
what
what's
there
doesn't
have
a
tremendous
amount
of
of
tests
so
looking
to
rank
that.
G
So
the
the
sort
of
boundary,
the
abstraction
layer,
4G
visor,
is
file
based,
fundamentally
so
we're
using
the
host
file
system
right
when,
when
an
application
in
the
sandbox
tries
to
open
something,
there'll
be
some
validation
that
occurs.
It'll
go
to
the
secondary
process,
but
it'll
ultimately
open
something
on
the
localhost.
So
in
a
traditional
kind
of
VM
model
it
can
be
a
little
bit
more
challenging.
You
have
to
introduce
some
perverse
lies
device
or
something
like
a
9p
device
there.
G
G
Sure
so
the
question
is:
what's
the
the
overhead
for
networking
the
the
network
stack,
that's
implemented
right,
so
one
of
the
design
principles
that
were
applying
here
is
that
we
really
want
to
isolate
everything
we
can
from
the
host
and
we're
starting
from
sort
of
security,
standpoint
first
and
then
optimizing
from
there,
and
so
the
network
stack
that
is
in
the
sandbox
yeah.
There's
not
that
performant
right.
If
you're
looking
at
throughput,
it's
not
gonna,
be
anywhere
near
where
you
get
native
and
then,
depending
on
the
platform
choice.
G
There's
there
could
be
pretty
high
overheads
there
as
well.
There
is
a
mode
like
if
you
go
look
at
the
repository
where
you
can
pass
through
some
parts
of
the
host
networking
stack,
so
you
can
use
some
native
sockets
a
lot
of
the
networking
overhead.
The
networking
overhead,
not
the
platform
overhead,
disappears
when
you
do
that,
but
you're
making
a
trade-off
there
right,
I.