►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
You Ever Wonder Why We're Here? - Sarah Christoff, Cloudreach (Beginner Skill Level)
Let's journey back to the 1960s, and start with the beginning of Virtual Machines. Why were these old behemoths made, and how do they work again? Let's recall when to use Virtual Machines, and their best practices. Then we'll travel to the dawn of containers, exploring their conception, birth, and where we are today. Finally, wrapping things up with figuring out why were are here, right now, at KubeCon! We'll unwrap Container Orchestration, container runtimes, and the many acronyms buzzing around.
About Sarah
Sarah has been virtualizing her environment since college, and has researched her way out of a VirtualBox. She is known for her outreach for Project Calico, a CNI open source project. She believes your infrastructure should be like a cat: agile and easy to take care of.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Alright,
let's
go
ahead
and
get
started
a
little
late,
so
my
name
is
Sarah
Christophe
I
am
a
cloud
systems
engineer
at
cloud
reach
and
I
figured
instead
of
telling
you
all
about
cloud
rage.
It
would
be
useful
to
tell
you
why
I'm
giving
this
talk
so
a
couple
months
ago,
around
the
deadline
for
the
CFP
for
kubb
Khan,
my
boyfriend
and
I
got
in
a
huge
fight,
see
I
said:
I
was
gonna
apply
for
coop
con,
but
I
realized
there's
no
way
in
hell.
I'm
gonna
get
accepted,
so
I
told
him
I'm,
not
gonna.
A
Do
it
and
I
was
adamant
about
it
after
he
left
the
room,
I
went
and
I
applied,
anyways
I
figured
if
I
got
accepted.
I
could
rub
it
in
his
face
and
if
I
didn't
get
accepted,
he
didn't
have
to
know
so.
I
had
to
come
up
with
an
idea
and
at
midnight
the
only
thing
that
you
can
think
about
is
why
we're
here
on
earth
and
all
the
other
stuff
that
runs
on
your
head,
so
I
wondered:
why
do
people
go
to
coop
conned?
Why
is
there
a
con,
and
why
are
we
here?
A
So
I
stole
a
fifteen-year-old
joke.
If
any
of
you
guys
know
red
vs.,
blue
and
I
made
it
into
a
talk
kind
of,
but
instead
of
starting
at
the
beginning
of
time
and
space,
we'll
start
in
the
1960s
I
wasn't
born
yet
and
I.
Don't
really
know
what
happened
then,
but
my
parents
were
alive.
There
was
some
drama
with
missiles
and
Star
Trek
came
out,
but,
more
importantly,
someone
asked
a
really
important
question.
Someone
wanted
to
make
a
computer
do
two
things
crazy
right
at
one
time
now.
A
At
this
time,
batch
processing
was
used,
which
was
tedious
and
time
consuming
see.
After
about
an
hour
of
collecting
batch
jobs,
the
cards
were
read
onto
a
magnetic
tape.
Seen
here,
which
was
carried
into
a
machine
room
where
it
was
then
mounted
on
a
tape
drive
the
operator
loaded.
It
up
ran
it
through
the
input
system,
output
came
out
and
I
mean
at
those
time.
Your
programmers
are
doing
something
like
this
kind
of
waiting
for
things
to
finish
so,
managers
weren't,
really
happy
and
time
wasn't
being
used
efficiently.
So
someone
was
like
hey.
A
Why
don't
we
make
this
more
efficient
and
talked
about
time?
Sharing
time
sharing
is
when
the
CPU
tries
it's
best
to
divvy
up
its
time
between
different
processes.
The
time
sharing
operating
system
assures
that
all
tasks
get
access
to
the
CPU
one
by
one
for
a
fixed
small
interval
of
time.
That
interval
is
known
as
the
time
quantum,
and
that
way
computers
can
provide
fast,
interactive
services
to
users
and
perhaps
also
be
working
on
big
things.
A
In
the
background,
this
is
used
a
lot
today
so
now
that
we
understand
where
we're
going,
let's
go
a
little
bit
in
the
history
right.
Where
did
this
all
begin?
So
in
1963
MIT
announced
project
Mac
standing
for
multiple
access
computer.
It
was
funded
by
a
2
million
grant
by
DARPA
MIT
looked
at
two
providers
for
Hardware,
GE
and
IBM
IBM
said:
hey
man
batch
processing
is
super
cool,
so
we're
gonna
stick
with
it
and
so
am
I
teach
went
with
GE
in
1967
Bell
Labs
had
a
similar
needs.
A
An
IBM
woke
up
and
created
the
CP
40
CP
stood
for
control
program,
we'll
touch
on
it
later.
It
was
never
sold
to
customers
but
involved
into
the
CP
67,
which
was
the
first
commercial
mainframe
to
support
virtualization.
Then
in
1969
ken
Thompson,
who
whose
projects
progress
with
multix
was
halted,
decided
he
was
going
to
work
on
his
own
operating
system,
which
became
UNIX
and
unix-like.
A
Users
would
have
to
compile
all
their
software.
They
wanted
to
run,
which
didn't
give
a
true
portability
of
software
Java
made
by
Sun
Microsystems
allowed
you
to
write
an
application
once
and
any
computer
with
a
the
JRE
Java
Runtime
environment,
provided
software
virtualization
in
1999
VMware
released
its
work
station
project
a
year
after
the
company
being
thousand
later.
This
product
would
be
distributed
freely
and
then
in
2018
virtualization
is
all
around
us.
You
can
see
and
all
of
our
cloud
providers
and
everywhere
there,
the
VMS
on
our
computers.
A
So
it's
a
big
deal,
but
what
is
a
VM?
So
I
always
thought
this
quote:
summarized
it
best,
but
in
case
you
don't
know,
because
I
was
that
person
who
went
to
talks
and
didn't
know.
Virtual
machines
are
an
emulation
of
your
computer
system.
It
takes
the
underlying
hardware
and
allows
you
to
partition
it
to
be
used
in
different
ways.
Instead
of
having
one
weak
box
with
one
OS,
we
can
have
one
box
with
many
OSS.
Does
this
virtualization
with
the
help
of
a
hypervisor,
a
hypervisor
or
VB
vmm
virtual
machine
monitor
control
program?
A
That's
evolved
over
time
takes
care
of
scheduling
these
guest
operating
systems
and
only
sees
them
as
processes.
These
processes
are
typically
running
in
user
mode,
which
means
it
has
restricted
access
if
the
process
needs
to
run
in
kernel
mode
or
have
unrestricted
access,
it
has
to
talk
to
the
hypervisor
now
I
know
this
process
stuff
may
sound
familiar
and
you're
like
man.
That
sounds
just
like
a
container
no,
but
bear
with
me.
I'll
explain
why
there's
some
quick
vocabulary
we
should
cover
before
I
go
on
just
so
you
don't
have
to
google
it.
A
The
CPU
has
a
couple
different
processor
modes,
usually
to
user
and
kernel
mode
and
user
mode.
It
has
restricted
access
of
things
that
can
execute
and
when
it
comes
across
a
privileged
instruction
and
must
switch
to
kernel
mode
which
allows
it
to
have
unrestricted
access
to
run
an
example
of
something
that
runs
in
kernel
mode
is
your
operating
system,
and
what
is
the
privilege
instruction?
That's
a
good
question.
Something
I've
found
important.
Is
that
how
the
virtual
machine
handles
these
privileged
instructions
is
very
important.
A
I
like
how
we
can
differentiate
it
from
containers,
so
a
privileged
instruction
is
something
that
needs
to
be
ran
in
kernel
mode
can
be
a
system
call
or
something
else,
and
then
what
something
needs
to
be
executed
in
kernel
mode,
something
called
binary
translation
occurs.
This
basically
means
we
have
the
guest
code
in
the
guest
operating
system.
So
we
copy
that
code
and
translate
it
so
it's
safe
to
be
ran
in
kernel
mode.
A
Okay,
so
there's
a
bunch
of
different
types
of
virtualization
and
I'll
just
touch
on
a
couple
of
them,
so
in
full
virtualization.
The
guest
operating-system
thinks
that's
alone.
So
when
we
execute
a
privilege
instruction,
it
traps
to
the
hypervisor
and
uses
binary
translation
to
process
and
execute
the
instruction
in
full
virtualization.
All
hardware
is
emulated
in
para:
virtualization
the
guest
operating
system
is
modified
to
be
able
to
process
those
privileged
instructions
via
special
API
uses,
to
talk
to
the
hypervisor
and
in
Hardware
assisted
virtualization.
A
A
That
will
go
to
the
system
call
interface,
which
will
then
figure
out
exactly
what
that
system
called
needs,
which
will
then
go
into
kernel
mode,
which
will
then
use
a
table
to
figure
out
what
that
system
call
is
and
the
routine
routine
that
used
to
be
ran
once
that
is
complete.
The
output
goes
right
back
up
pretty
straightforward.
A
Now,
just
like
there
are
many
types
of
different
virtualization.
There
are
many
different
types
of
hypervisors
all
right,
so
a
type
1
hypervisor
runs
on
a
bare
metal
machine.
The
guest
operating
system
believes
it
is
running
in
kernel
mode,
it's
actually
running
in
user
mode
when
the
hypervisor
receives
an
instruction
and
specs
it
to
see
if
it
was
from
the
guest
operating
system
or
user
program
and
running
in
the
virtual
machine.
So
if
it
comes
from
the
guest
operating
system,
it
then
arranges
for
the
instruction
to
be
carried
out.
A
If
the
instruction
comes
from
a
user
program
in
the
virtual
machine,
then
it
emulates
what
the
real
hardware
would
do
when
confronted
with
the
sensitive
instruction
either
ignores
it
or
it
traps
to
the
guest
operating
system.
For
example,
a
guest
application
has
a
sis
call
that
invokes
the
hypervisor
hypervisor
looks
at
it,
Seasons
meant
for
the
guest.
The
guest
OS
invokes
the
trap,
guest
trap
handler
and
then
the
hypervisor
resumes
the
guest
application.
A
So
how
does
this
work
on
a
type
2
hypervisor,
which
is
things
we
know,
is
like
VirtualBox
right?
We
can
see
here
that
there
is
double
the
context,
which
is
then
a
type.
So
a
type
2
hypervisor
runs
off
the
host
operating
system
taking
care
of
the
guest
operating
system.
Here
the
trap
is
invoked.
The
host
operating
system
when
the
host
operating
system
ceases
no
bet
for
the
guest
operating
system
and
invokes
the
hypervisor.
The
hypervisor
in
return
asks
for
control
of
the
guest
OS.
A
The
guest
delivers
the
services
and
asked
to
return
to
his
app,
which
traps
to
the
host
operating
system
goes
up
to
the
hypervisor
and
then
resuming
the
application
and
then
with
para
virtualization.
Finally,
basically,
what
happens
is
all
some
set
of
instructions
or
hypervisor
calls,
which
means
the
guest
operating
system
act
like
a
program
and
the
hypervisor
acts
like
its
own
operating
system.
This
means
the
hypervisor
defines
a
set
of
procedure
procedures.
The
guest
system
can
use
effectively
creating
an
API
for
the
guest
operating
system
to
talk
to
the
hypervisor.
A
A
Not
only
do
we
have
contact
switches
and
hypervisors
and
all
this
stuff,
but
it
takes
a
lot
to
recreate
all
that
hardware
or
virtual
eyes
all
that
hardware
right
so
then
on
to
like
why
we're
here
at
KU,
con
containers,
they're
kind
of
cool.
Let's
do
some
history
and
you've
probably
heard
this
like
50
times
already,
so
we'll
do
it
again.
A
Linux
containers
worked
using
control
groups
and
namespaces
working
on
a
single
Linux
kernel
without
requiring
any
kind
of
patches
and
then
finally,
in
2013,
containers
boomed
with
docker
letme
container,
that
for
you
and
more
and
eighteen
containers
are
used
everywhere.
People
call
me
about
them.
We
have
cons
its
whole
thing,
so
how
those
things
work
right.
A
So
if
we
wanted
to
compare
containers
to
the
knowledge
we
just
learned
about
virtual
machines,
we
can
put
it
next
to
a
type
1
hypervisor
here
the
container
sits
on
top
of
the
Linux
OS
utilizing.
Those
kernel
features
to
run
where
a
virtual
machine
has
its
own
operating
system
in
each
environment.
However,.
A
I,
don't
know
what
that
was
but
cool.
However,
we
can
also
see
when
we
run
docker
in
Windows
or
Mac.
It
uses
the
hypervisor
to
spin
up
I,
guess
Linux
so
effectively
when
I
use
docker.
Here
it's
doing
that
which
is
cool
as
I've
stated
before
a
container
is
a
process.
That
means
when
we
call
open
it,
acts
how
it
normally
would
okay
same
old,
same
old,
but
docker
gets
a
little
complicated
and
all
the
cool
things
that
does
and
I
always
found
this
interesting.
A
So
breaking
down
docker
it's
a
container
engine
and
it
extracts
all
the
messy
stuff
like
container
D,
runs
C
and
all
this
other
stuff.
So
you
have
a
beautiful
interface
to
create
what
you
need
container
D
sits
below
it.
That's
a
daemon,
that's
in
charge
of
exposing
G,
RPC,
endpoints
and
other
low-level
container
management
tasks
below
container
D
sets
run
C,
which
is
lightweight
binary
that
interacts
with
the
actual
C
groups
and
namespaces
I
always
get
these
two
things
confused,
because
everything
has
the
word
container
in
it.
A
So
container
engine
and
container
runtime
and
actual
containers.
A
good
distinction
to
be
made
is
a
container
engine
like
darker.
A
rocket
is
an
easy
to
use
development
tool.
However,
a
container
engine
or
a
container
runtime
there
we
go,
manages
the
image
transfer,
storage
to
container
execution
supervision
and
networking.
When
kubernetes
came
a
big
deal,
people
wanted
to
use
different
container
runtimes.
A
So
kubernetes
was
like
cool,
we'll
make
you
an
interface
and
you
can
build
your
own
runtimes
or
do
whatever,
and
so
there
are
container
runtimes,
specific
container
container,
runtimes
interface,
specific
container
runtimes,
and
that's
where
you
get
those
guys,
oh
and
actual
containers,
I,
don't
know
I
needed
a
third
thing.
So
there
you
go.
A
So
I
keep
talking
about
these
kernel
features
namespaces
and
C
groups,
but
what
do
they
actually
do?
Namespaces
are
in
charge
of
the
system
resources
and
there
are
seven
different
kinds
of
namespaces.
Each
process
is
associated
with
a
namespace
can
only
see
or
use
the
resource
associated
with
the
namespace.
However,
resources
are
isolated
depending
on
what
kind
of
needs
space
we
use
so
going
over
these
real
quick
in
a
mountain
namespace.
We
can
mount
and
unmount
file
systems
without
affecting
the
hosts
file
system.
In
a
pin
namespace
your
process
becomes
pid'
one.
A
All
subsequent
processes
are
children
supposedly
killing.
The
parent
pit
will
eliminate
all
children
that
doesn't
work
out
in
a
networking
namespace.
You
can
run
programs
on
any
port
without
conflicting
with
what
might
be
already
running
on
your
machine.
The
IPC
namespace
is
used
for
isolating
inter
process
communication.
Like
says
few
message:
queues,
UTC
namespaces
are
responsible
for
a
system,
add
in
fact
identification.
A
It
allows
the
container
to
have
its
own
host
name
dependently
from
the
host
system
independently
and
finally,
the
UID
or
username
space
allows
the
users
in
the
namespace
to
equal
different
users
outside
the
namespace
and
then
control
groups
that
think
Google
made.
This
takes
care
of
monitoring
resource
usage.
If
you
want
to
limit
the
amount
of
CPU
a
process
can
use,
cgroups
will
do
that,
for
you
so
big
take
away.
A
So
now
we
can
kind
of
see
that
containers
are
not
lightweight
virtual
machines,
and
everyone
always
says
this
and
then
I
thought
containers
were
lightweight
virtual
machines
and
then
I
tried
to
give
a
talk
about
it
and
then
I
had
to
give
a
talk
about
how
I
learned
it
wasn't
that
so,
oh,
if
you
want
to
be
like
me
or
you,
don't
just
understand
that
you
wouldn't
call
a
container
or
you
wouldn't
call
a
virtual
machine,
a
heavy
container.
So
maybe
we
don't
call
them
lightweight
virtual
machines
they're
their
own
thing.
A
Here's
a
quote
I
think
just
Frisell
said,
but
I'm
not
really
sure,
but
I
like
it.
Containers
are
easy
to
use
wrappers
around
cgroups
in
8th
paces.
Keep
that
in
mind
and
another
key
point:
is
you
should
virtualized
systems
and
contain
applications
right
for
your
ease
of
testing
Portability
and
mor
your
containing
your
application?
However,
your
systems,
your
processor
architecture,
is
all
that
stuff
should
be
virtualized
and
here's.
The
key
takeaways
from
the
container
section
containers
rely
on
Snee
groups
of
namespaces.
A
We
all
know
that
they're
not
lightweight
pm's
and
they
might
not
even
be
right
for
you
like
I
get
it.
Everyone
wants
to
contain
their
stuff
and
it's
fun
and
easy
to
have
containerized
applications
kind
of
not
depending,
but
it
depends
on
your
application
in
your
use
case,
not
all
things
should
go
in
containers,
I'm,
not
going
to
tell
you
what,
because
there's
so
many
variables
but
know
your
stuff
kind
of,
and
then
kubernetes.
A
What
does
kubernetes,
if
you
don't
know,
I'm,
really
worried
about
you
so
kubernetes
is
a
babysitter
and
I
think
that's
the
best
way
to
describe
a
container,
orchestration
or
scheduler,
but
simply
put
container
orchestration
cool
tool.
What's
cool
about
it
and
other
things
like
it,
it
takes
care
of
your
workloads.
Let's
look
at
some
things,
I,
like
so
there's
more
of
these
I'm,
excluding
meso
so
I'm,
sorry,
but
to
briefly
cover
these
tools.
I
chose
swarm,
kubernetes
and
Nomad.
Swarm
was
made
by
docker
and
therefore
it
runs
very
closely
with
all
the
doctor
stuff.
A
It
can
run
up
to
a
thousand
nodes
and
docker.
Just
really
is
Dockery
e
2.0
product
which
ships
with
kubernetes
with
swarm
in
case
you
need
to
run
them
together
or
you're.
Switching
from
one
to
the
other.
Dr.
storm
is
great
for
people
who
just
really
love,
docker
and
I'm
sure
there's
other
reasons
but
go
docker.
Then
kubernetes,
which
comes
with
a
horde
of
features
that
you
can
try
out.
There's
a
lot
of
different
providers
and
things
you
can
try
too
I
like
kubernetes,
because
it's
like
plug
and
play
you
just
like
keep
trying
things.
A
I'm
praying
and
then
lastly,
you
know
mad,
which
is
my
personal
favorite
Nomad
follows
the
UNIX
philosophy.
That
is
a
simple
and
clear
cut.
It
just
wants
to
schedule
your
workloads
for
you
and
that's
all
wants
to
do
and
nothing
else
and
Hoshi
Corp
has
other
tools
to
like
manage
stuff
for
you,
but
has
one
job
I
wish
I
just
had
one
job
anyways.
A
What
I
want
to
get
out
here
there
many
different
tools
and
I
think
it's
better
not
to
look
at
a
war
between
them,
but,
like
everyone
has
like
their
own
personal
style
and
beauty,
make
it
pretty
guys.
So
what
should
you
remember
here?
You
should
contain
your
application
for
ease
of
testing
portability.
I.
Think
I
said
that
already
well,
it's
happening
again.
Kanae
are
not
wait.
Virtual
machines
and
I
think
this
is
a
repeat
slide.
So
I
was
gonna,
give
like
a
bunch
of
examples
of
like
this.
A
This
goes
in
a
VM,
and
this
goes
in
a
container
and
you
use
concur
Bernays
for
this
only
or
else,
but
then
I
got
like
a
real
job
and
I
realize.
Not
all
companies
are
the
same,
so
sometimes
I
the
right
thing
and
the
best
thing
or
two
different
options,
and
it's
up
to
you
and
your
team
and
your
company,
probably
your
boss,
to
assess
what
the
best
thing
is.
So
sometimes
the
right
thing
isn't
always
chosen
and
that
sucks,
but
you
got
to
realize,
there's
like
so
many
variables
that
I
can't
even
go
through.
A
That's
how
we
do
it.
So
that's
just
the
start.
This
is
just
kind
of
some
information
to
keep
in
the
back
of
your
head
when
you're
doing
stuff,
because
I
always
yell
about
it
and
keep
her
like
no
one
care
about
it.
So
I
gave
a
talk
about
it.
Anyways.
If
you
have
questions
comments,
you
want
to
tell
me
but
I,
don't
know
good
great
yeah
go
there
and
there's
a
Google
form.
A
You
can
fill
out
like
questions
and
stuff,
because
I
know
people
are
weird
about
questions
or
you
can
ask
them
to
me
and
I'll
be
really
sweaty
and
nervous
when
I
answer
them
cool,
we're
good,
I,
guess,
I,
don't
know
what
time
am
I
done?
Okay,
yeah
sure
do
they
don't
have
any
questions?
You
just
want
to
talk
to
me
in
my
little
form.