►
From YouTube: Surviving Serverless Battle By Secure Runtime, CRI and RuntimeClass - Xiaoyu Zhang & Lei Zhang
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Surviving Serverless Battle By Secure Runtime, CRI and RuntimeClass - Xiaoyu Zhang & Lei Zhang, Alibaba
Why Google released gVisor, AWS developed Firecracker, and Kata is on the fire?
In this talk, we will discuss the unrevealed connection between secure container runtime and Serverless based on our observation and research in public cloud and OpenFaaS community, and then explain why we think CRI & RuntimeClass will contribute to this new "battle field". With this context, we will share a matrix of secure container runtimes from CRI perspective. For example, what's the attacking surface & isolation mechanism? Is there independent guest kernel? Does it support certain CRI feature? We will discuss which dimension will be hidden by CRI and which will not, and what this means for Serverless & its users. We will also share how we map CRI Matrix into RuntimeClass, choose proper runtime, and then setup Serverless platform. The design & adoption of RuntimeClass will be evaluated here as well.
https://sched.co/MPe9
A
So
let's
go
through
this
topic
today
and
before
I
talk
about
container
runtime
I
will
I
would
like
to
give
you
the
very
brief
introduction
about
how
kubernetes
is
actually
designed
so
increment
is
we
actually
have
two
concept?
The
first
concept
is
control
plan
of
control,
plan
control
panel
or
control
plan.
So
in
control
panel
you
actually
can
think
it
about
three
components.
A
The
first
of
all
is
API
server,
which
is
a
component
to
handle
all
the
requests
from
users
from
the
up
layer
systems,
and
also
there
is
a
controller
manager
which
is
responsible
for
the
workload
situation,
for
example,
deployment
staple
state
all
of
these
concepts.
They
are
actually
using
controllers
to
handle
the
request
and
the
workloads
from
the
end
users,
and
also
there
is
the
third
part
of
the
control
plan-
is
scheduling
the
Kuby
scheduler
and
italy
responsible
to
find
a
proper
node
for
every
pod
created
by
Euler,
and
he
started
the
control
plan.
A
The
the
other,
the
other
parts
with
kubernetes
it
is
the
code
of
the
nose.
So
every
group,
every
motion,
machine
or
host
machine
of
a
kubernetes
will
have
a
engine
which
named
it
the
crew
blade
running
inside.
So
it
will
be
responsible
to
watch
it
a
pod
list
and
then
created
pod
only
in
doubt
for
you,
so
in
most
general
cases,
crew
beta
will
trying
to
call
the
dark
API
or
contain
the
API
for
them
to
do
them.
A
But
if
you
want
to
install
a
kubernetes
cluster
I
think
they're,
either
stable
than
the
you
need
to
consider
is
what
kind
of
a
runtime
to
choose.
Just
as
I
mentioned
today
at
least
you
can
choose
to
use
docker
or
community
right
so
actually
in
the
community.
There
are
multiple
open-source
container
run
time
for
you
to
make
choice.
For
example,
candy
and
Alibaba
has
its
own
pouch
container.
You
can
choose
cryo
from
right
hat.
You
can,
of
course
the
docker.
A
Call,
for
example,
clone
state
English,
or
something
like
that,
and
at
least
Linux
kernel
will
be
responsible
to
translate
that
to
use
this
system
call
to
created
a
real
container
for
you.
But
what
is
container
in
this
case,
as
long
as
you
are
using
linux
kernel
than
what
you
are
creating
is
a
Linux
container.
The
Linux
container
can
be
separated
to
true
concept.
A
The
first
concept
is
container
runtime,
which
is
implemented
by
using,
for
example,
C
groups
to
as
a
resource
limitation,
and
the
second
thing
is
namespace
to
do
a
isolated
review
for
you,
so
namespaces,
basically
to
create
an
isolated
environment.
So
the
process
in
static
container
cannot
see
the
processing
another
namespace
or
own.
A
house,
and
the
C
groups
are
used
to
give
you
resource.
A
Ballantrae
of
this
container,
for
example,
I
only
want
to
I
want
only
want
to
this
container
to
use
at
most
the
one
CPU
core
and
and
200
mega
better
memory
that
you
just
said
this
limits
to
say
groups.
So
this
is
what
container
runtime
is
doing
for
you,
but
the
second
thing
is
container
image,
which
is
actually
a
wonderful
creation
by
dollar
company,
and
the
container
image
is
actually
a
static
view
of
your
program,
and
it
actually
includes
everything
your
program
need
to
run.
A
For
example,
the
operating
system
directories,
the
files
all
the
dependencies
develop
applications.
So
the
container
image
use
overlay
file
system
to
to
wrap
everything
inside
a
package
and
this
package,
which
normally
technically,
can
be
called
Andrew
TFS.
So
in
this
photo
in
this
picture,
you
can
see
how
the
container
runtime
and
a
container
image
are
combined
together
to
create
a
container
for
you.
So
you
are
basically
have
the
process
running
on
top
of
a
group
of
rooted
faces
and
this
process.
This
process
is
a
normal
process
on
your
hosts.
A
The
only
difference
is
that
this
process
is
isolated
in
by
a
group
of
namespaces
and
the
resource
it
can
use
is
restricted
by
still
groups.
That's
also
that's
why
we
say.
Lina's
container
is
just
another
kind
of
process,
but
here
is
the
problem.
So
today
we
are
talking
about
service,
we're
talking
about
managing
huge
clusters
on
capital
cloud,
but
one
thing:
if
we
want
to
use
service
you
have
to
face
or
you
have
to
fix.
The
issue
is
the
hard
multi-tenancy.
A
So
when
you
are
using
Linux
container
and
I
said
this
content,
its
container
runtime,
it
actually
implemented
by
name
space,
instakills,
namespaces
and
seat
groups
are
one
herbal
against
hikers.
For
example,
you
I
think
you
guys
might
heard
about
the
term
of
jailbreaker
right.
If
you
had
a
process
running
on
Linux
container,
for
example
darker
on
energy,
it's
actually
very
easy
for
these
container
process
to
get
out
of
to
escape
the
container.
This
is
actually
one
of
the
important
issue
we
have
to
face
today
and
that's
why
I
think
for
for
every
public
cloud
provider.
A
They
will
give
you
which
machines
first,
the
Royal
container
inside,
because
we
need
to
rely
on
the
virtual
machines
to
do
to
add
the
multi-tenancy
resource
boundary
for
you.
Instead
of
these
three
groups
and
namespaces,
but
as
a
community
is
involving,
there
began
to
become
more
and
more
technologies
for
you
to
achieve
stronger
isolation
in
the
runtime
layer.
So
first
of
all,
I
think
it
kinda
make
heard
about
the
card.
A
Containers
I,
actually
work
for
hyper
before
so
I'm
likely
and
one
of
the
member
of
cutter
teams
and
also
Amazon
open
sourced
its
own
version
of
virtual
machine
based
container
mhmm,
which
name
it
firecracker.
But
firecrackers
works
more
on
the
virtual
machine
management
manager,
layer
so
and
also
we
know,
Google
has
open
source
divider,
which
is
originally
from
the
Google
Google
a
Google
App
Engine
team.
A
So
it
will
give
you
another
approach
by
implementing
a
guest
kernel
using
go
language,
so
you
basically
will
have
a
very
small
kernel
to
roil
container,
so
it
different
from
what
we
are
using
in
card
containers,
which
we
will
use
whether
to
do
that.
But
if
you
looking
at
this
container
one
time
zero
fat,
you
will
find
that
there
are
essential
difference.
No
matter,
you
are
using
GUI
there
or
car
containers.
A
So
the
difference
in
here,
for
example,
if
you
are
in
cata,
for
if
you're
in
cata
the
container
runtime
is
not
implemented
by
C
groups
or
namespace
at
all,
it
is
actually
implemented
by
hardware
virtualization.
Just
like
a
normal
virtual
machine
and
the
most
important
thing
is,
you
will
have
a
guest
colonel
in
this
container,
instead
of
instead
of
sharing
the
guest
Colonel
of
the
instead
of
sharing
the
colonel
of
your
host
machine.
A
This
is
also
the
case
for
G
of
either
party
you
either
actually,
as
I
said
before,
will
implement
a
guest
Colonel
for
you,
it's
a
quarter-century,
but
no
matter
woodcutter
technology
are
using.
Today
you
will
have
an
independent
Colonel
while
compared
to
that,
if
you
want
to
achieve
hard
water
tendency
when
using
Linux
container,
there
are
a
bunch
of
things
you
need
to
do.
A
For
example,
in
to
you
figure
out
how
to
job
some
Malini's
capabilities,
you
don't
want
to
expose
to
a
user
or
you,
and
also
you
may
need
to
mount
a
read-only
mount
constant
inside
a
container,
and
you
will
have
to
use
several
kinds
of
technologies
like
security
news
app
armour,
to
give
you
a
stronger
isolation
from
for
your
Linux
containers
and
so
on.
So
this
is
actually
two
different
approaches.
A
So
today,
I
would
like
to
talk
little
bit
more
about
the
container
runtime,
which
has
a
independent
guest
colonel,
for
example,
G
Valerie
container
I
will
use
calculator
as
an
example
here.
So
if
you
are
using
card
containers,
you
will
basically
have
two
basically
different
implementation
for
container
runtime,
but
the
same
implementation
for
containing
image
and
the
difference
for
container
runtime.
The
most
important
thing
is,
first
of
all,
it
will
have
interrogate
kernel
and
you
are
using
hardware
virtualization
technology
to
implement
the
resource
boundary
of
isolation.
A
Boundary
of
your
container,
but
another
thing
need
to
pay
attention
to
that
for
COD
containers,
because
it's
basically
a
virtual
machine.
So
this
concept,
this
visuals
boundary,
will
be
matching
to
the
pod
concept
instead
of
container
itself,
as
I
mentioned
at
the
beginning.
Kubernetes
use
apart
to
run
application
and
the
pod
is
a
group
of
containers.
A
So,
if
you
actually
create
apart,
including
kubernetes,
which
is
Akata
at
the
runtime,
you
will
actually
create
a
virtual
machine
as
a
pod
and
then
you
will
run
containers
inside
of
this
virtual
machine
and
this
containers
are
still
implemented
by
namespaces
and
estate
groups.
So,
as
you
can
see
here
and
the
work
machine
of
kadha
is
actually
mapped
into
pod.
A
Ok,
so
here
the
first
thing,
as
I
said,
we
can
use
kata
or
any
kind
of
standard
box
container
one
time
to
implement
multi-card
multi-tenancy
in
runtime
layer.
But
the
question
is
how
kubernetes
use
these
runtimes
and
the
key
key
of
sandbox
the
runtime
in
kubernetes.
It
actually
called
container
random
interface,
which
can
be
shown
as
CRI,
so
in
kubernetes
it
actually
has
no.
It
is
not
aware
of
the
underlying
content
1
times.
Kubernetes
only
know
it
is
actually
talking
this
interface,
which
name
is
CRI.
For
example,
you
can
see
this
example
here.
A
The
CRI
is
an
interface
building,
crew,
blade
aka,
the
ancient
of
kubernetes,
and
it
is
actually
a
gr
PC
based
interface.
That
means
every
container
runtime
which
one
to
integrate
based
kubernetes
have
to
implement
its
own
version
of
CI
implementation
between
our
community.
It
is
named
CI
regime
and
a
single
stream
is
actually
a
grcc
server
and
it
will
translate
your
CI
request
to
the
underlying
container
runtime
api.
For
example,
if
you
are
using
content
d,
the
CR
stream
of
a
community
will
actually
call
the
content
the
API
to
do
rest
of
the
things.
A
This
is
actually
how
the
eye
works
so,
and
you
can
see
here,
the
CI
is
actually
describing
container
runtime
for
kubernetes.
So
kubernetes
only
understand
what
it
is,
the
I
it
will
never
understand
what
is
darker
and
only
option.
We
were
actually
working
on
another
proposal
to
remove
the
building
darker
shame
from
kool-aid,
because
I
think
you
guys
might
know
that
the
coolant
has
a
building
in
shame
for
darker
right
now
that
we
are
removing
that
part,
so
in
a
few
sure,
kubernetes
will
not
have
a
so-called
default
one
time.
A
The
default
container
runtime
for
kubernetes
will
always
be
CI,
and
also,
if
you
pay
attention
to
the
implementation
of
a
CI,
you
was
even
notice
that
it
is
actually
a
container
stay
in
shape
interface,
if
there's
not
pod
stuff
in
the
RCI.
The
reason
we
do
that
is
because
not
every
container
runtime
has
a
concept
of
a
pod.
For
example,
if
you're
in
continuing
kata-kata
has
a
concept
of
heart,
because
cotta
is
a
virtual
machine,
but
if
you're
in
darker,
if
you're
using
other
needs
containers,
they
only
know
about
containers.
A
So
there
is
no
some
kind
of
polity
in
darker,
so
we
want
to
leave
the
freedom
through
how
to
ink
them
in
a
pot.
True,
the
container
runtime
itself.
So,
in
that
case,
if
you
are
running
as
the
Irish
ring
before
darker,
for
example,
the
darker
stream,
you
are
actually
need
to
think
about
how
to
implement,
to
the
so
called
a
pod
concept
in
or
how
to
implement
the
pod
model
in
your
container
right
at
one
time.
The
container
spec
is
very
simple
in
CI
interface
and
it
actually
can
be
divided
into
two
parts.
A
The
first
part
is
sandbox.
That
means,
how
can
you
implement
is
a
pod
model
which
we
call
standard
box
and
another
again
the
example
baccata.
We
will
use
a
virtual
machine
to
implement
at
least
and
a
box,
but
if
they
using
darker,
there's
no
discernible
sandbox
and
it
will
actually
create
actually
create
a
so
called
in
for
a
container
for
you.
So
you,
if
you're
in
darker
on
in
this
container,
the
infer
container,
were
actually
mapping
to
the
standard
box
and
the
standard
box
is
exactly
equivalent
to
pod
lifecycle.
A
That
also
means,
if
you
create
a
pod
there
it.
It
can
be
true
that
this
part
does
not
have
any
container
enzyme.
That
means,
for
example,
you
only
have
in
fact
container,
but
there's
no
user
container
and
if
you're
in
kata,
that
means
you
have
the
virtual
machine,
but
there's
no
container
inside
that.
That's
that
cut
a
virtual
machine.
A
A
A
The
first
of
all
is
the
building
in
docker
she
and
I
said
they
will
trying
to
remove
that
part
later
and
a
second,
a
the
remote
remote
means
the
crew
plate
will
stand
at
grcc
call
to
the
underlying
CRE
and
for
the
rest
of
the
things
as
long
as
it
going
into
as
the
are
Shaima.
No
matter
is
darker,
shame
or
any
Qaddafi
regime.
The
rest
of
things
is
the
shame,
will
call
the
underlying
container
project
API
like
darker
or
can
Hardy
so
here's
another
question.
A
Okay,
I
know
that
you
are,
you
can
use
the
I
to
manager
a
lot
of
container
runtimes.
So
how
can
we
it?
Is
it
a
passbook
for
me
to
use
multiple
container
runtimes
in
one
class
car?
Yes,
so
one
of
the
posh
is
you
can
just
install
many
nodes
and
every
node
will
has
a
corresponding
CI
regime.
For
example,
in
this
case,
you'll
know
the
able
use
content.
Dlc
are
shame,
you'll
notice.
They
will
use
a
cryo
that
container
runtime
stream
as
a
container
runtime.
So
you
don't
need
to
handle
that.
A
The
only
thing
need
to
do
is,
for
example,
you
can
add
a
label
selector
and
we
allowed
to
say
I
want
to
schedule
this
part
to
cryo
node
or
this
part
to
control
denote.
This
actually
is
totally
possible,
and
that
also
means
in
this
case
you
can
use
a
cotton,
but
the
one
thing
you
need
to
pay
attention
to
is
kata
is
actually
equivalent
to
run
C.
So
that's
the
so-called
OCI
runtime.
So
that
also
means
in
front
of
a
kata.
A
There
should
speak
something
well,
there
should
be
something
acting
as
they
see
our
stream
and
most
:
casting
the
community
in
that
you
can
use
content
D
to
do
that.
So
in
this
case
you
need
to
first
of
all
deploy
content,
D
and
the
then
install
cut
a
run
time
to
replace
run,
see
in
this
case,
and
in
this
case-
and
you
can
see,
the
picture
here
contain
D
will
be
responsible
to
handle
the
rest
of
things
in
continuing
D.
There
is
another
interface,
so
so
please
pay
attention
to
this
part.
A
You
will
place
it
have
to
interface.
The
first
layer.
Interface
is
CI.
The
second
layer
interface
is
in
container
D
itself,
which
name
is
called
simply
to
epi.
The
shrimp
a
to
epi
is
to
handle
how
container
runtime
talk
Visio
CI
runtime.
So
there
are
function
of
concept
here.
First
of
all,
crew
blade
CI
can
turn
D,
which
is
STR
stream
and
then
simply
choose
anyone
see
or
cut
out.
A
So
this
is
how
basically,
the
content
deep
hard
work
and
the
shim
v2
API
will
translate
your
API
request
to
the
OCI
runtime
spec,
which
will
be
handled
by
kata
project,
and
in
this
case
you
can
see
there
is
a
cut
engine
running
on
your
machine
and
translate
your
your
request
to
a
cutter,
spec
and
then
start
a
virtual
machine
for
you.
So
this
is
a
one
of
the
parts
that
you
can
use
them
the
DV
the
kubernetes
to
be
multiple
wrong
time.
B
A
So
stake
listing
our
information
in
that
it
is
actually
possible
today
that
you
can
deploy
multiple
runtime
in
single
node.
So
the
the
the
example
I
just
talked
about
is
you
can
keep
my
multiple
runtime
for
multiple
node,
but
today
you
can
use
a
feature
which
name
is
runtime
a
class
which
can
make
you
make
it
possible
for
you
to
deploy
container
runtimes
in
one
node.
This
is
the
case.
A
Ok,
so
how
can
we
choose
for
goodbye?
We
have
a
pod.
How
can
we
choose
this
powder
running
inside
kata
or
run
see
as
long
and
it
can
have
multiple
runtime
in
OneNote?
So
here
is
how
you
can
do
that.
The
feature
here,
which
name
is
vision,
aim,
is
run
timer
class,
a
wrong
time
class
in
the
featuring
recently
kubernetes,
which
has
been
become
beta.
A
You
know
what
1.14
of
kubernetes
and
it
will
be
able
you
to
say,
I,
want
to
have
this
pod
running
in
cata
and
have
this
part
running
Ingram
see,
and
it
heard
the
example.
So,
first
of
all,
we
need
to
create
a
runtime
class
example,
which
name
a
toccata
write.
The
default
container
runtime
is
a
D
for
the
runtime
class
in
kubernetes
is
in
now
for
for
Navi
runs
it.
So
if
you
want
to
use
cars,
are
you
to
create
a
container
runtime
machine
name?
A
It
cut
a
container,
for
example,
and
then
you
can
create
a
part
like
this
in
a
part
of
spec
that
are
filled
for
you
to
use,
which
name
is
runtime
class
name,
and
you
need
to
spec.
You
need
to
say:
ok,
I
want
to
use
the
cut
container,
the
Zen
kubernetes
we
are
trying
to
fight
the
content
of
runtime,
namely
the
cut
container,
and
also
you
need
to
configure
the
cutter
on
the
cutter
cut
container
as
a
runtime
name
in
your
country.
Indeed,
so
candy
is
aware
of
runtime
cos.
A
This
is
actually
how
container
this
is,
how
the
wrong
time
class
work.
So,
first
of
all,
the
part
will
have
the
field
for
you
to
say
which
container,
which
runtime
class
I
want
to
use
and
a
second
contain
D
or
any
kinds
of
CI
regime,
now
support
to
figure
out
to
read
the
specification
from
your
part
to
read
what
is
the
runtime
class
and
then
choose
the
underlying
all
CI
runtime
for
you.
So
this
is
exactly
how
the
runtime
class
for
you
to
use.
B
B
A
So
in
that
case
you
may
want
to
specify
that
this
pod
want
to
use
default,
runtime
class,
which
is
Rusted.
Another
example
is
that
you,
you
actually
have
concerned
about
the
of
examples:
the
I/o
performance
in
your
cutter
runtime.
Let's
say
you
have
the
my
C
cool
stuff
and
want
to
have
this.
My
CQ
running
learning
on
a
very
high
performs
a
node,
and
it
give
you
high
performance.
Io
you
may
want
also
want
to
consider
user
runs
the
at
one
time,
and
another
thing
we
want
to
mention
is:
actually
you
can.
A
As
long
as
you
have
a
cloud
server
issue,
the
cut
a
runtime
in
the
multi-tenancy
environment.
You
can
actually
build
a
multi-port
service
project
on
top
of
that,
but,
unfortunately,
for
now,
as
we
can
see
here,
most
of
the
service
open-source
service
platform
do
not
support
runtime,
a
class
in
their
project
because
they
are
generating
the,
for
example,
the
port,
a
plant
or
deployment
paint
template
and
that
template
the.
For
now
there
is
no
field
which
name
is
runtime
castle.
You
can
now.
A
B
This
is,
this
is
a
huge
castle
from
the
canal,
prymakova
Posada,
so
your
honor,
we
want.
We
just
use
this
castle
to
test
our
canal,
so
this
square
and
have
noted
if
we
could,
we
could
define
this
border
by
this
square
Buddha.
But
if
we
enter
this
runtime
class
namo
into
this
square,
just
like
we
do
over
town
before
and
you
standard
mo,
but
you
will
fail
so
now
use
the
canal
reduce
the
idea
and
income.
So
it
doesn't
supported
this
this
spectrum,
so
just
as
to
Kublai's,
Kublai,
so
another
another
open-source
project.
B
A
But
eventually
we
hope
that
most
of
the
open
source
project
can
support
one
type
class
that
you
can
build,
it
so
lace
on
top
of
kubernetes
and
then
on
your
mortgage
on
your
multi-tenancy
resource-poor,
and
speaking
of
that,
I
want
to
share
a
small
case,
use
the
case
of
how
we
are
using
a
car
container
inside
Alibaba.
So
Alibaba
actually
maintained
a
very
huge
kubernetes
cluster,
which
has
like
five
more
than
five
thousand
nodes
to
serve
all
the
customers
in
Alibaba
and
every
business
unit
in
Alibaba
is
actually
a
tenant.
A
That's
why
we
build
a
harmonious
new
kubernetes
by
using
container
and
for
every
tenants.
The
most
interesting
part
is
we
actually
create
pertinent
per
control
play
model.
That
means
every
every
tenant
in
Alibaba
will
have
its
own
API
server,
Kuby
container
manager,
but
there's
no
sched,
but
because
we
are
using
a
unified
scheduler
here,
but
this
tenant
will
actually
have
no
real
notes.
The
only
thing
it
can
see
is
a
group
of
virtual
notes.
A
So
that's
why
we
say
this
model
is
a
virtual
cluster
based
multi-tenancy
and
the
Worsham
node
is
actually
provided
by
a
small-engined,
which
name
is
the
virtual
node
engine
that
is
a
being
an
engine
to
running
on
a
real
note,
so
it
will
actually
virtualized
nodes
of
nodes
of
API
object
in
lcd's,
then
tenant
will
see
a
virtual
cluster,
which
is
credit
which
is
provided
by
a
real
closer
underlying.
So
this
is
basically
a
kubernetes
Infernus
layer
on
kubernetes
model.
The
only
difference
is
that
there
is
no
tenant
layer
nodes.
A
The
tenant
learners
are
credit
by
using
a
version
of
the
concept
they
actually
have.
Another
implementation,
which
you
can
use
virtual
cooperate
to
create
or
to
create
a
diversion
virtual
nodes.
So
in
this
case,
in
this
concept
you
can
see.
Actually,
we
are
sharing
the
underlying
real
cluster
for
every
tenant
and
is
a
key
part
here
is
that
we
need
to
use
card
containers
as
the
default
container
runtime,
because
now
we
have
actually
a
different
tenants
running
in
the
same
cluster.
That's
why
we
need
stronger
isolation,
and
that
is
the
most
important
case.
A
We
want
to
use
code
container
or
any
kind
of
a
standard
box
container
instead
of
running
over
cluster,
and
this
and
this
architecture
will
be
open
source
too
soon,
and
we
will
announce
it
during
the
Kubik
on
host
america
of
this
year
and
we-
and
if
you
are
interesting,
that
part
you
can
check
the
option
proposal.
We
are
talking
with
the
option
working
group,
so
we
hope
that,
if
you
are,
you
want
to
cooperate
on
that
project,
you
can
just
connectivity
over
team.
Ok,
so
I
think
this
is
basically
work.