►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro + Deep Dive: containerd - Wei Fu, Alibaba & Mike Brown, IBM
We will show how users can enhance containerd without having to first modify containerd’s internals. We’ll also cover building custom snapshotters for special storage needs and integrating with custom runtimes for stronger isolation. Understanding containerd architecture and data flow is key to extending it’s functionality. In this talk, we’ll look at the internals of containerd (covering its components and dataflows) then dive into how external plugins work with containerd. We’ll go over using containerd’s smart client API and plugins to make new/custom integrations. We will demonstrate how various sandbox technologies can be integrated with containerd to work with Kubernetes, including Amazon’s Firecracker, Google’s gVisor etc. Attendees will leave the talk understanding how they can extend/modify containerd to support enhanced integrations for custom production deployments.
https://sched.co/MPkp
A
I'm
Mike
Brown
I
work
for
IBM
work
on
container
D
I've
been
around
for
a
long
time.
In
the
good
old
days,
I
used
to
work
on
operating
systems.
Something
called
o
is
to
her
that
dass
back
in
the
beginning,
when
I
want
to
work
on
Java
Virtual
Machines
for
a
few
years
did
the
IBM
JVM
Zahn
on
a
whole
bunch
of
various
platforms,
including
the
first
long
Linux
I
got
to
rewrite
the
core
of
the
JVM.
Make
it
really
fast.
A
You
know
changed
how
semaphores
work
all
that
guys,
though
it
had
a
lot
of
fun
in
JV
albums
and
went
on
to
work
on
WebSphere
telco
stuff,
basically
been.
You
know,
IBM
for
a
long
time,
work
on
a
lot
of
systems
code
before
I
joined,
IBM
I
was
a
programmer
doing
pretty
much
the
same
thing
and
you
guys
would
be
doing
for
insurance
company
a
lot
of
fun.
Ray
bram
was
off
a
company
for
awhile
and
Kenny
came
Dobby,
yeah
I
mean
they're
open
source.
For
now.
A
For
years
for
IBM
we
started
out
with
docker,
or
at
least
I
did
and
then
after
docker
I
started.
I
started
working
on
kubernetes
for
a
while.
In
the
meantime,
I
was
working
on
the
OCI
Committee
I
was
working
on
a
run,
see
been
doing
specifications
I'm
a
maintainer
as
well
on
the
distribution
to
the
spec
that
we're
working
on.
So
if
you're
working
in
OCI
you'll
probably
see
me
around,
or
at
least
on
the
calls,
we
get
together
a
lot
so
container
D
is
you
know
it's.
A
It's
got
a
long
history
and
it
said
the
beginning
of
container
D.
What
was
happening
is
Michael.
Crosby
was
was
trying
to
split
up
docker
into
a
bunch
of
layers,
so
will
be
easier
to
manage
little
beauties
of
service
as
well
as
to
start
to
come
up
with
this.
This
this
pattern,
where
he
could
outsource
or
open
source
re
some
of
the
componentry
for
light
container.
The
libraries
that
did
that
make
docker
work
with
you
know
Linux.
So
you
wanted
to
you
wanted
to
make
that
open
source
as
well.
A
You
know
outside
of
Dockers
other
people
could
build
products
like
rockin
at
ease
or
anybody
else
who
wanted
to
put
together.
A
container
runtime
platform
could
be
able
to
do
so
with
the
same
code
so
that
we
weren't
working
everywhere.
Creating
you
know
too
many.
It
can
be
different
models
for
you
know.
Docker
containers
didn't
want
to
have
bifurcation
in
in
the
field,
so
he
put
together
this
this
this
run
run
see
implementation,
which
was
a
note.
He
also
provided
to
the
OC
ice
pack.
A
A
It
became
clear
inside
kubernetes
that
we
needed
an
api
to
interface
with
the
various
container
runtimes,
because
it
was
a
version
of
couplet
for
docker
and
there
was
another
version
of
couplet
for
rocket.
You
might
hurt
rockin
Eddy's
and
every
time
docker
made
a
major
change
to
the
API
or
whatnot
kubernetes
will
go
down
and
Tim
would
have
to
come.
Talk
to
the
doc
arises
and
every
time
try
to
keep
things
in
sync,
because
there
was
no
real
specification
for
what
kubernetes
needed
from
a
container
runtime
alright.
A
So
this
this
content,
runtime
interface
concept,
was
getting
put
together
because
he
had
already
because
Michael
had
already
started
split
and
the
layers
of
docker
out
he
was
able
to
create
an
initial
container
D
model
that
would
start
to,
hopefully
at
some
point
in
time
host
these
container
runtimes
interfaces
that
would
come
in
the
future.
But
until
that
would
happen
there
was
a
thought
that
maybe
we
could
do
a
container
disha
or
something
to
that.
Something
like
that.
Instead
of
having
Kubla
to
run
the
dr.
Dee
sham.
A
Maybe
maybe
we
need
less
instead
of
the
whole
big
full
docker
right.
So
so
they
came
up
with
the
idea
of
the
snapshot
interface
and
its
own
content
store
API
inside
of
container
D.
The
the
congenita
client
api
is
really
cool.
You
can
you
can
write
a
small
go
program
and
create
these
service
interfaces
with
container
D,
with
just
maybe
50
lines
of
code
and
run
your
own
containers.
So
there's
been
a
lot
of
people
starting
to
use
the
canary
API
as
an
application
and
they're
using
these
interfaces.
A
So
after
the
initial
1.0
of
container
D,
which
was
really
just
there
for
doctor
only
we
started
building
a
Sora
implementation
that
was
Lantau
on
me.
That
would
actually
implement
the
sarah
interface
we
did
her
own
daemon
in
the
beginning
was
called
cry
container
D
and
it
would
call
the
container
decline
interfaces
from
remote.
So
we
had
a
G
RPC
interface
between
couplet
down
to
container
D
and
then
from
container
D
ERI
to
container
D
itself
proper.
So
we
had
two
hops
at
that
time.
The
container
to
you
guys
said
they.
A
A
So
around
that
time
cry
implementation
goes
those
alpha.
You
know
our
product
was
working.
We
got
all
the
test
cases
to
run,
for
you
know
kubernetes
when
it's
running
on
the
container
D
through
the
cry
container,
D
thing:
okay,
so
then
we,
when
beta,
we
we
built
our
plugin.
We
released.
It
was
happy.
A
Ibm
clouds
using
it
so
today,
if
you
use
you,
create
a
new
cluster
on
IKS
its
using
community
by
default.
Google
cloud
is,
is
also
using
at
gke
in
production
and
would
and
with
G
visor.
You
have
options.
Alibaba
Group,
we
have,
we
have
foo
way.
It
was
a
new
maintainer
for
a
container
D.
Although
he's
been
he's
been
a
he's
been
involved
for
a
long
time
now,
but
but
he'll
tell
you
about
pouch
and
pouch
is
using
container
D
Alibaba.
If
you
don't
know,
is
the
China's
Amazon?
A
Okay,
speaking
of
Amazon,
so
we've
been
working
a
little
bit
with
the
Amazon
guys
they've
built
a
fire
cracker
implementation.
It's
it's
a
container,
runtime
engine
I
know
this
can
get
confusing.
You
know
if
we
have
container
run
times
and
then
container
run
times,
use
container
runtime
engines
like
run
C
or
a
virtual
machine
in
this
case,
which
is
firecracker
to
create
the
isolation
layer.
A
A
We're
showing
the
the
platforms
at
the
top
systems
architecture
at
the
bottom.
It
runs
on
just
by
a
Linux
platform.
We
we
do
free,
builds
images
or
everything
from
arm
to
bun
to
or
we
do,
a
lot
of
tests
tests.
We
run
cry
tools,
test,
validation,
Suites.
We
run
the
kubernetes
cluster
Suites
every
every
pull
request.
We
do
actually
gets
shadowed
up
to
the
gke
to
run
on
GC
to
you
know,
to
run
the
full
suite
of
tests
to
make
sure
that
we
don't
break
anything
and
then,
of
course,
the
docker
team.
A
Forks
are
a
tree
and
they
you
know
they
built
their
their
own
version
for
testing
the
you
can
you
can
get
your
distribution
of
container
d
now
from
container
D
die?
Oh
just
you
know
to
get
it's
all
available
where
you
can
do
it
get
a
docker
and
because
Dockers,
depending
on
community
io,
you'll,
pull
that
down
actually
for
you
most
of
the
distributions
are
starting
to
ship
with
container
T
as
well,
some
by
default.
So
you'll
start
to
see
that
you
know
it's
easy
to
install,
because
it's
already
there
really
nice
as.
D
A
As
clients
go
the
container
D
itself,
it
has
this
client
interface,
but
from
a
Wii,
it's
not
trying
to
replace
docker.
It's
not
trying
to
replace
couplet
or
coop
CTL
or
anything
like
that.
It's
more
of
an
infrastructure
component.
We
do
have
some
client
8
guys.
You
know
some
tools
you
can
use,
but
we're
not
trying
to
replace
command
for
command
what
you
can
do
with
docker,
for
example,
we
don't
do
builds
from
within
container
D.
A
So
if
you
want
to
run
a
docker
bill
of
Duty
docker
build,
but
if
you
want
to
do
a
pull,
you
can
do
a
pull
image
from
docker
or
even
deployments
from
a
container
d,
using
either
the
cry
CTL
API,
which
is
common
for
for
all
container
runtimes
or
you
can
use
the
CTR
command
line
API
tool
which
so
that
maybe
will
show
you
that
a
little
bit
later,
if
we
have
time
the
you'll
notice,
the
architecture,
it's
it's
very
extendable.
It's
very
pluggable!
A
Of
plugins
that
you
run,
everything
is
pluggable,
everything's,
modifiable
and
configurable.
You
could,
for
example,
Dockers
initial
distribution
ran
without
the
CRI
plug-in
being
enabled,
so
I
got
a
lot
of
calls
the
the
next
day.
So
you
know
container
D
stopped
working
because
they,
when
they
installed
docker
doctor,
installed
container
D
and
it
didn't
have
the
cry
plug-in
installed
and
running.
So
when
you
rang
kubernetes
coops
group
CTL
bought
apply,
it
didn't
work
because
we
weren't
running
anymore,
the
plugins
they
had
to
stable
bit
get
for
docker.
A
A
I
mentioned
earlier:
we've
got
the
snow,
our
own
snap,
shutters
it's
exit,
pretty
cool
Stevo,
put
together
mostly
work
on
it,
and
then
jerk
McCallum
has
been
working
on
a
lot
lately
we're
getting
contributors
providing
additional
block
block
native.
You
know
snap
shutters,
you
all
the
usual
overlay
be
TFS.
You
know,
I
use
overlay,
usually
the
content
stores,
the
API
that
the
clients
use
to
to
gain
access
to
you
know,
storage
as
well
as
metadata,
and
everything
he's
done
in
this
is
in
its
own
little
namespace
environment
I
mentioned
earlier.
A
That
docker
can
use
container
D
and
kubernetes
can
also
use
container
d.
Well,
you
can
all
you
can
also
create
native
local
containers
within
container
D
and
it
starts
to
get
a
little
confusing.
So
we
created
a
brand
new
namespace
light.
The
that
isolates
when,
when
you're
in
you
want,
you
want
to
create
images
and
containers
and
pods
for
kubernetes.
You
would
use
like
a
KS
dot.
Io
namespace.
A
If
you
use
a
docker
container,
it
will
be
in
a
mobi
namespace
if
your
c
e
or
will
be
docker
if
your
e
and
you
can
create
your
own
namespaces.
So
you
could,
if
you're
writing
your
own
little
application
container
launch
or
you
could
just
say
you
know
my
name
space
and
that
way,
when
you
do
a
listing
of
containers
or
pods
from
coops,
you
tell
you
won't
see
any
containers
that
weren't
generated
from
your.
You
know.
A
You
know
Kubla
instead,
you'll
see
just
you
know
the
containers
who
name
says
she
spoke
with
you
picked,
so
we
think
that's
pretty
cool
so
in
this.
In
this
way
we
can
have
one
common
layer.
You
know
Damon
sitting
there
waiting
for
containers
to
be
created
from
all
these
different
places
and
and
got
some
pretty
good
use
cases
for
that
down
down
here
at
the
bottom
layer
to
get
depending
on
what
type
of
runtime
you
want
you
can.
You
can
pick
to
run
simultaneously
in
all
these
different
namespaces
run.
A
A
If
you
feel
like
vm's,
that's
okay,
too,
like
for
example,
one
of
the
things
we're
doing
today
when
you
create
a
pod,
you
get
a
chim
for
each
for
each
container
in
the
future,
we've
gotta
fix
where
you'll
actually
get
one
pod,
one
shim
for
the
pod
and
all
the
containers
are
isolated
within
it
he's
a
lot
less
memory,
it'll
be
faster
Icarus
to
de
he
was
there
a
minute
ago.
Oh
there
occurs
here
to
put
together
this
rootless
stuff.
You'll,
see
more
isolation
on
containers
that
way
by
by
picking
the
name
space
you
wanna.
A
A
F
A
And
go
the
implementation
that
we're
using
seems
to
be
working
pretty
clean.
We
also
have
a
thing
called
T
RPC,
which
we
use
between
the
shims.
It's
a
very
thin
version
of
G
RPC.
It's
a
lot
faster,
the
lowest
memory
requirements.
So
we
don't
have
any
issues
with
all
the
shims
we
might
create.
The
shims
are
used
to
the
host
your
net
proc
in
your
container,
so
you
can
grab
the
return
code
as
well
as
to
be
able
to
create
you
know,
streams
between
Fri.
A
Oh,
you
know
stereocenter
in
Stara
to
the
api
server
through
couplet.
So
if
you
want
to
get
her
command
line
and
do
a
you
know
exact,
you
can
get
up
through
there,
I
mean
it's,
and
earlier
we
have
a
metrics
API
and
grab
stats.
Pretty
much
any
tool
that
wants
to
do
metrics
is
seems
to
be
compatible
for
me
this
these
days.
This
we
went
that
way.
A
So
back
in
I
mentioned
the
TTR
PC,
but
you
know
we're
reusing
it
locally
Pittsboro
or
a
built-in
plugin.
So
we
have
a
little
level
now
wrapper
to
all
the
all.
The
api's
you
see
are
the
different
types
of
API
there's
a
metadata
service
and
images
service
container
service.
The
main
two
services
within
container
D
are
the
runtime
service
and
the
other
is
the
image
service
you
can.
A
If
you,
if
you
had
your
own
tooling
or
whatnot
for
grabbing
images-
and
you
didn't
want
to
use
the
the
local
cache
you
could
replace
it,
and
some
people
have
so
they
can
use
their
own
their
own
native.
You
know
image
retrieval
code,
but
then,
when
you
create
a
container,
you
can
use
the
container
D.
You
know
in
default
interfaces
for
like
using
run
C
or
B
MMS
via
the
v2m
API,
or
the
v1
API
v1
v2
v1
was
the
initial
shimmy
API
that
we
use
to
launch
run
C
there
were.
A
There
were
a
lot
of
people
that
were
writing,
run
C
implementers
like
run
V.
The
vert
rocket
was
working
on
one,
a
lot
of
different
runtimes,
but
the
the
category
min
and
they
were
they
had
hooks
and
it
wasn't
working
very
well
run.
C
has
these
hooks,
were
you
know,
grab
and
grab
the
exit
or
the
enter
code
on
any
any
container,
let's
get
launched
and
it
would
call
this
little
program
and
they
were
they
were
having,
but
anyway
long
story
short
it.
The
v1,
eat.
I,
wasn't
really
a
good
one.
A
A
Okay,
so
snapshot
are
mentioned
earlier
there,
it's
actually
a
pretty
cool
interface
that
the
same
guys
who
wrote
the
the
docker
storage
code
wanted
to
refactor
it
and
clean
it
up,
make
it
faster
and
that's
what
that's
what
these
it
was.
Steve.
Oh,
if
you
guys
Steven
Steven
day
he's
still,
you
know
major
contributors
in
maintainer
he
put
together
and
we've
got
a
lot
of
other
good
docker,
guys
that
are
working
on
this
they're
focused
on
it
they're
they're,
doing
some
work,
I
believe
to
put
docker
on
the
container
D
snapshot
or
systems
as
well.
A
A
E
A
Mentioned
earlier,
you
know
she
RI
we're
a
plug-in
interface,
so
Kubla
talks
directly
to
our
gr
PCORI
interfaces.
We
just
configure
you
say
extern
and
you
point
to
a
doctor
son
to
a
socket.
Sorry
and
you
know
Lenny
socket
and
we
host
the
G
RPC
services.
You
can
talk
to
see
all
right
directly
and
that's
what
cry
CTL
does.
A
Okay
over
here
you'll
see,
you
know,
C
and
I.
That's
how
we
do
our
networking.
We
support
all
the
plugins.
We've
got
a
lot
of
good
debug
stuff
we're
putting
in
to
help
help.
You
guys
set
up
your
network
and
see
what's
what
may
be
went
wrong
in
the
plugins,
but
for
the
most
part
you
know
once
you've
created
up
a
pod.
We,
we
instantiate,
you
know
a
new
network
interface
for
that
fit
up
for
the
knit
product
for
that
pod,
which
is
a
pause
container,
and
then
we
will
share
that
namespace.
A
A
A
A
A
C
A
A
A
E
A
C
A
Anyways
yeah,
so
that's
you
know
you
can
see
the
recent
curl
request,
so
that's
cool,
so
there
was
an
error
popped
up
in
there
so
that
that's
one
command
line,
I
mentioned
crisi
tell
the
way.
The
way
it
works
is
that
it's
just
talking
to
a
socket
crisi
tails,
pretty
cool.
It's
a
group.
That's
got
together
and
tried
to
put
together.
We
got
a
test,
not
just
not
just
a
command-line
interface,
but
also
bunch
of
test
ball
games
again
to
keep
it
running
against
the
container
runtime.
A
G
A
If
you're,
if
you're
used
to
using
you,
know
kubernetes
just
stick
with
coop
CTL
rate,
the
inspect
just
calls
down
CRI
and
does
the
inspect
from
us.
So
when
you
look
at
the
actual
log
output,
you'll
you'll
see
the
initial
set
of
oku
CTL
inspects
that
you
would
expect
to
see
from
the
doctor
sham,
but
then
at
the
bottom
of
that
you'll
see
an
extension
point
where
we'll
just
give
you
a
dump
of
everything
you
have.
You
know,
for
example,
if
you're
inspecting
a
pod,
you'll
you'll
see
the
you
know
the
pod
specification.
A
Okay,
the
pros
and
cons
in
coop
CTL
is
the
standard
API
for
all
container
runtimes
I.
Think
if
you're
doing
some
debugging
and
you
weren't
getting
the
information
you
needed
from
Coop's
detail,
then
you
might
want
to
step
down
to
the
crisi
tail
and
use
it.
I
wouldn't
use
crisi
tail
to
launch
a
pod
in
kubernetes.
That's
not
going
to
work
because
then
kubernetes
wouldn't
know
about
it
all
right.
So
it
really
comes
down
to
the
layer
of
where
you're
at
okay.
G
A
Good
good
point,
so
you
wouldn't
be
able
to
use
darker
doctors,
command-line
interface,
to
interact
with
any
any
pods
you've
created,
but
you
can
use
CTR
to
turn
rack
and
get
more
debug
information.
You
know
on
those
on
those
pods
they're
still
there
but
haven't
been
destroyed.
Yet
you
can
go
inspect
them.
You
can
actually
even
attach
and
look
at
the
you
know
the
trees
and
thank.
G
A
Right
so
yeah,
that's
a
good
point.
Yeah
I
wouldn't
use
crisi
tail
for
that.
I'd
go
right
to
CTR,
I!
Think
just
the
low
it'd
be
the
low
end
for
both
products
for
docker
and
for
you
know
you
can
only
if
you're
a
programmer
and
you're
debugging
CTR
is
a
very
low-level
interface.
It's
a
little
hard
to
use,
but.
D
D
A
F
H
Think,
at
least
is
the
like
a
lock,
you
know,
and
and
in
the
community
we
don't
provide
a
general-purpose
API
in
the
server-side
right.
We
will
do
a
lot
of
things
in
the
client-side,
so
we
might
touch
a
lot
of
service,
so
we
need
to
maintain
a
transaction,
so
we
near
least
to
lock
the
read
to
lock
the
resources.
So
a
voice
to
someone
to
teach
someone
to
t
listens
at
least
something.
So
we
can
use
the
list
to
lock
once
one
turn
sessions.
So
something
like
when
you
try
to
prove
image.
H
A
F
A
A
A
E
E
A
Yeah
today,
the
in
the
architecture
you
get
on
one
node,
you
have
an
instance
of
couplet
and
you
have
an
instance
of
coop
proxy
running
on
that
note
and
then
couplet
talks
back
to
the
rest
of
the
rest
of
the
closer
servers.
You
know
like
API
server
to
to
negotiate
hey
I'm
over
here
on
this
node
I
can
host
these
resources
that
that
sort
of
thing-
okay,
that
yeah
did
that
answer
the
question.
Maybe
maybe
you
have
to
talk
a
little
more
about
that
player?
I
love
questions,
especially
the
ones
I
can
answer.
A
Just
say:
hey
whatever
and
we'll
answer
will
answer
questions
we're
on
the
in
the
doctor.
Community
slack
right
now
want
a
better
place.
That's
where
we
started,
that's
where
we
stayed
for
a
little
for
a
while,
but
yeah
so
come
on
up
there
and
and
hook
up
to
a
container
dev
kennedy,
or
you
know
and
pop
pop
questions.
If
you
want
it
especially
wanted
to
write,
plugins
or
extensions,
you
were
always
always
looking
for
new
new
new
extensions.
We
like
that,
okay
or.
A
A
H
H
So,
okay,
my
name
is
waifu
and
software
engineering
in
the
Alaba.
So
thanks
for
joining
me-
and
today
we
were
diving
to
the
community
architecture
and
I
will
show
you
the
way
about
integration
with
Kennedy
so
so,
and
the
last
session
from
Mike.
We
learn
so
many
things
about
the
Kennedy
right,
including
history,
status,
architecture,
overview
and
demo.
So
we
know,
Kennedy
is
the
Protoss
already
project
and-
and
there
are
so
many
kinds
of
company
using
community
in
your
production
and
and
currently
runs
very
powerful
and
stable.
So
before
we
get
into
the
real
detail.
H
Point:
okay,
it's
the
whole
picture
here
and
but
let's
focus
on
this
at
this
area.
So
we
know
Kennedy
provide
a
tree,
obviously
service
to
the
user,
so
user
can
use
the
Java
C
service
to
to
build
any
application
on
on
top
of
it.
So
you
can
see
this
area
and
there's
an
application
based
on
Kennedy,
for
example,
talk
engine,
podge,
canina
and
a
few
kids.
H
The
answer
will
be
the
smart
class,
so
in
Canada,
every
components
will
maintain
a
very
low
level
resources
like
immature
local
storage
and
English
load
data
and
a
container
configuration,
and
they
are
provide
a
very
stable
and
reusable
API.
So
community
will
mirror
the
internal
components
interfaces
to
the
tree,
the
interfaces
so
for
the
clan
take
care
access
to
the
any
kind
of
resources
by
the
tree,
obviously
call
as
they
want.
So
for
the
common
requirements,
the
smack
clan.
We
can
buy
several
components
together
to
provide
a
general
purpose.
H
Api,
like
a
pull
push
so
I
think
you
may
read
rid
of
me
and
you
will
find
out.
You
can
just
write
one
line
code
to
download
image
like
a
poof
poof
function,
it's
very
convenient,
very
simple,
but
behind
a
poof
function,
it's
not
that
simple.
So,
let's
check
out
this,
the
pinup
flow
from
for
the
proof
function.
H
We
can
see
the
clan
will
attach
four
components:
four
components
service
here
and
first
one
is
the
contents
of
canoe
service
and
it
is
used
to
store
the
raw
data
such
such
as
imagery
layer,
travel
file
and
the
second
one
is
the
TIF
service.
It
is
used
to
read
a
road
data
and
unpack
the
raw
data
into
the
local
storage,
such
as
overlay
and
divestment
mapper,
those
local
storage
which
handle
by
this
network.
So
steps
of
service
and
the
last
one
is
the
images
images
service
and
it
is
not
provide
a
proof
function.
H
It
just
used
to
store
the
metadata
for
the
images.
So
with
those
information,
let's
check
out
the
place
check
out
the
data
flow
here
when
we
call
the
function,
the
clan
will
get
a
manifest
from
the
remote
registry
and
the
manifest
it
is
used
to
store
it
is.
It
is
used
to
describe
the
structure
of
image,
including
layer,
data
and
configuration.
So
when
the
client
get
the
manifest,
he
will
start
into
the
content
service
so
and
then
he
will
pass
the
manifest
and
try
to
download
each
layer
data
into
the
contents,
a
kind
of
service.
H
But
now
with
you
have
the
raw
data,
we
can
use
this
to
run
a
container.
We
need
to
unpack
it,
so
the
client
will
or
the
snaps
or
service
to
prepare
snap
so
for
the
for
the
each
layer
and
then
if
we
will
call
that
give
service
to
to
read
a
layer
data
from
the
content
service,
you
can
see
it
here
and
he
will
unpack
the
raw
data
into
the
snapshot
and
then
he
will
commit
this
natural.
H
H
This
action
will
create
a
record
in
the
images
service.
This
record
will
mapping
from
the
image
name
to
the
raw
data
and
an
unpacked
epic
one.
So
someone
asked
for
the
list
right.
So
this
is
whole
big
transaction
here.
So
we
will
use
the
list
to
lock
the
raw
data
and
unpack
later
doing
the
pull
profile
for
function.
So
so
you
can
see
in
clarity.
Each
component
service
are
very
small
and
very
very
useful
right.
They
are.
H
They
can
provide
a
very
stable
API
for
API
to
renew
to
the
user,
so
those
components
service
can
assemble
together
in
value
a
way
to
view
any
kind
of
function.
So,
for
example,
if
I
want
to
change
the
pool
function,
change
the
data
flow,
so
we
can
see
when
we
get
manifest
first,
we
will
pass
it
right,
but
we
don't
need
to
download
the
data
into
the
content,
so
the
kind
of
service
we
can
check
the
snaps
or
for
the
layer,
if
the
snap
so
for
the
layer
is
there,
we
don't
need
to
download
data.
H
We
can
check
the
next
layer.
Even
now
we
can
download
a
missing
layer
data
into
the
contents,
Konoe
service
and
encode
the
div
service
and
a
snapshot.
So
so
you
can
see
we
can
change
the
data
flow
in
the
client
side,
which
we
wish
without
changing
any
level
call
in
the
packing
side.
So
imagine
that
if
we
provide
a
general
purpose
API
in
the
server-side,
we
have
no
change.
Who
have
no
way
to
do
the
customized
things
right.
H
H
So
at
the
time
you
need
to
think
about
how
to
do
the
merge,
how
to
do
the
migration
right
so
avoid
this
case
can
only
provide
Smart
Plan,
so
so
those
photos
compose
service
can
community
community
can
be
reduced
to
do
anything
so
we
can
see,
and
we
have
images
service
and
a
condense
service
right.
We
can
combine
it
to
provide
a
push
function.
H
So
when
we
call
the
push,
the
client
will
get
the
image
metadata
from
the
images
service,
and
then
he
will
get
the
manifest
from
the
content
and
will
pass
it
and
will
gather
each
layer,
data
from
the
content
service
and
push
to
the
remote
registry.
So
you
can
see
those
component
service
can
be,
can
be
a
can
be
reusable
right
and
beside
this
kinetic
client
also
provide
our
API
set
to
control
a
container.
For
example.
H
If
you
want
to
write
wrong
a
container,
you
can
call
the
new
can
new
container
API
for
us,
this
API
will
touch
container
container
service.
This
action
will
not
run
our
processes,
you
just
created.
It
was
used
to
create
a
record,
and
then
you
can
use
the
written
written
a
variable
to
call
the
new
tasks
API.
This
API
will
touch
the
task
service.
It
not
just
create
a
record.
It
will
launch
the
community
Shem
bacon
server
as
I'm
as
we
mentioned
before
condition
is.
H
It
is
used
to
handle
the
lifecycle
of
of
the
container
and
and
kill
the
cleaner,
Killa
canina
alive,
Eve
cannon
at
ease
down.
So
imagine
that
if
we
try
to
upgrade
a
running
Canadian
virgin,
we
need
to
shut
down
and
restart
it.
If
we
weed
out
the
Canadian
banking
server,
the
running
calendar
will
be
killed
after
communities
die.
So
it
is
very
important
three
very
important
feature
here.
H
So
after
of
the
condition
which
is
studied,
we
can
call
a
star
API
to
run
a
real
process
in
the
backend,
so
we
can
call
a
star
it
if
I
here
so
for
now
we
have
a
running
process.
So
if
you
want
to
wait
for
it,
you
can
call
the
we
API.
This
API
will
block
and
you
can
sweat
until
the
colony
is
die,
so
so
we
get
there.
If
you
want
to
clean
after
that,
that
container,
you
need
to
call
the
delete
Hasker.
H
So
this
is
how
about
this
Mach
line
here
and-
and
we
can
see
community
has
been
designed
to
have
loosely
component
components
right.
Those
commoners
can
can
provide
a
very
stable
and
very
reusable
interfaces
interfaces
to
us.
So
so
we
can
see
the
smart
client
can
assemble
several
components
together
to
provide
a
very
useful
to
the
library
to
do
the
integration.
So
we
can
see
that
the
general
purpose
API
is
in
the
client
side
now
the
server
side.
H
So
we
can
do
a
lot
of
customized
things
in
a
client
side,
so
I
think
I
think
there's
always
a
requirement
to
to
to
do
in
the
in
the
pagan
science,
for
example.
We
need
to
support
a
new
image:
local
storage,
like
a
queue
code
to
fast,
and
then
we
have
a
new
generation.
We,
my
canon
Elrond
hands
like
a
G,
Weiser,
calico
neener
and
a
fried
crack.
H
So
how
cui
integrate
it
with
which
conadi
and
before
I
show
you
the
solutions
and,
let's
check
out
the
plugin
first
in
Kannada,
every
component
is
plugging,
so
we
can
see
here-
and
we
have
a
lot
of
frog
in
here-
and
we
have
the
snap
so
plugging-
contain
plugging
and
image
plugin
so
for
community.
How
does
it
to
maintain
those
plugins
and
how
to
maintain
their
relationship
between
the
plugins?
H
So,
as
I
mentioned
before,
Kennedy
has
been
designed
to
lose
most
component
and
clear
boundaries,
components
right
with
the
clear
boundaries
those
components
can
be
grouped
together
according
to
their
own
issue,
for
example,
stamps
or
parking
has
been
designed
to
handle
the
local
images
storage
issue.
So
we
have
the
snaps.
We
have
the
overlay
address,
snaps
or
and
a
device-
never
snap
short.
So
so
we
can
see,
we
can
group
those
components
together.
So
we
so
we
have
the
category
with
the
category
of
the
floggings.
H
Kennedy
has
is
easy
to
maintain
that
the
relationship
between
the
different
kinds
of
projects
so
look
at
this
picture
and
look
at
this
area.
We
can
see
the
metadata
parking
require
the
snaps
or
parking
and
a
contemporary
so
paddle
for
a
minute
data
parking.
He
doesn't
need
to
know
the
the
implementation
of
the
snaps
or
in
accounting
projects
so
for
the
fracking
itself,
it
is
represent
by
the
very
stable
interfaces,
so
based
on
tees
can
only
provide
a
simple
parking
nutrition
mechanism.
H
This
this
new
generation
action
is
very
easy
to
learn
and
very
easy
to
use.
So
look
at
this
code
here
and
this
code
is
used
to
adjust
the
pole
metadata
plugging
into
a
community.
So
so
you
can
see
you
only
need
to
fill
the
form
by
the
plugging
type
parking,
ID
request,
plugins
and
the
initialization.
It
will
be
okay,
all
the
thing
will
be
down
by
the
Kennedy
and
and
an
initialization
function
will
be
called
by
the
dependencies
order.
So
what
is
the
difference?
The
order
so
look
at
this
picture.
H
We
can
see
there's
a
lot
of
a
lot
of
plugins
in
Kennedy,
right
and
and
those
plug-in
constructor
a
very
basic,
a
dependency
tree
here.
So
all
the
plug-in
will
follow
this
pattern
and
there's
no
cycling
issue
and
and
so
with
the
flagging
registry.
We
can
easy
it
you
to
add
a
new
implementation
for
the
existing
program
or
the
new
plug-in
intro
community
in
the
color
base.
So
we
can
see
CRI
Kennedy
is
a
project
and
also
as
a
plug-in
right.
H
So
so
we
can
easy
for
the
contributor,
a
maintainer
to
add
a
new
implementation
into
the
color
base,
but
out
of
the
code
base,
how
can
we
integrate
a
community
with
the
sir
party
plugins
such
last
map,
so
plugging
and
runtime
plugging
so
so
Kennedy
provide
our
two
solutions
here.
First
one
you
can
view
your
own
community
Paris
in
Kannada.
H
He
provide
a
common
engine
point
to
set
up
a
server
by
the
buyer
:
package,
so
you
can
use
the
:
package
to
build
your
own
community
with
the
fully
fully
function
and
it
is
easy
to
upgrade
a
community
version
by
the
upgrading
:
package.
So
no
worry
about
missing
any
detail
during
the
upgrade.
So
with
the
common
engine
point
you
can
readjust
your
own
plugging
into
the
community
and
let's
check
out
example
here.
H
So
this
example
is
based
on
a
project
from
the
okey
okey.
Here
are
the
hero
and-
and
we
can
see
the
first
column
fact
is.
That
is
this
one
is.
It
is
used
to
provide
a
engine
point
combine
engine
power
to
set
up
a
community
server,
it
is
required,
and
the
second
group
is
it
is
provide
our
building
plugins
sorry,
so
it
is
easy.
It's
required
all,
also
and
and
the
third
one
is
the
linear
space
liquor
plugins.
So
we
also
need
to
import
this.
H
So
with
those
with
those
:
:
package,
we
can
build
the
community
and,
and
the
last
one
is
the
AFS
a
vastness
for
flagging.
We
can
so
we
can
see,
we
can
add
a
column
package
and
and
we'll
register
our
own
project
into
a
community.
So
basically
we
put
a
regeneration
action
into
the
:
image,
initialization
function,
so
that
when
we
import
import
a
:
package,
you
will
do
the
registration.
So
so
you
can
see
it's
very
easy
to
to
build
your
own
community
right.
H
H
H
So
when
the
kennedys
set
setup,
you
will
create
a
remote,
you
will
create
remote
privacy
frogging
if
the,
if
the
user
tried
to
configure
it
in
a
configuration.
So
for
now,
Canady
only
support
snap
saw
and
a
content
privacy
project,
but
I
know
there's
a
lot
of
surf
hockey,
snaps
or
blogging.
There
are
other
kinds
of
projects
so
for
the
prophecy
plugging
you
only
need
to
do
is
it
is
redirect
the
request
to
the
external
parking
so
for
the
external
plugging
he
has
to
implement
the
stamps
were
or
the
content
for
the
content.
H
H
So
if
we
are,
if
I
had
a
customer,
snaps
or
external
plug
in
here
first
step,
we
need
to
do-
is
to
do
the
setting
to
tell
community
what
is
yours,
customer
customer
is
turnip
ragi
and
how
to
connect
it
to
it.
So
so
you
can
see
here
the
customers
nap
so
is
the
ID
of
the
your
your
external
plugging,
and
that
habit
is,
is,
is
the
snaps
or
in
adjust.
H
It
is
used
to
tell
community
how
to
connect
it
to
your
external
pocket
and
in
a
second
step,
to
need
to
export
your
your
own
snaps
or
in
implementation
as
the
:
service
service
service
service.
So
fortunately,
community
provide
a
:
package
to
weapon
your
invitation
as
the
tree,
obviously
service.
So
so
it
is.
It
is
easy
to
setup
your
own
external
snaps
or
plugins.
So
before
just
before
the
community
start,
you
need
to
setup
your
internal
plugging
first,
so
we
can
see.
We
don't
need
to
change
any
line
of
code
in
the
backend.
H
We
can
easy
to
integrate
it
with
the
serve
Hardy
project
right
so
I
think
beside
the
sir
party
snaps
or
plugin
we
have.
We
still
have
a
lot
of
a
lot
of
new
version:
new
generation.
We
are
my
wrong
general
runtime
here
so
Canady
need
to
provide
a
mechanism
to
support
you
turnaround
time
projects
so
before
I
introduce
the
mechanism
and
Kennedy
was
used
to
the
whacking.
H
The
external
longhand
commander,
light
you
make
it
like
a
run,
see
command
line,
so
he
can
use
the
Lanza
command
I
to
call
the
external
plugging
Eastern
Atlanta
plugin,
but
each
is
its
turnaround.
Time
has
their
own
abstractions
we
can
we
can
do
is
for
we
can.
We
can
cover
all
the
external
on
a
plugin
right
and
then,
if
we
used
Kemal,
if
we
used
used
CRI
to
control
external
London
and
you
you
will
create
a
issue
with
data
with
just
with
the
container
statement,
statham
management
and
each
each
Rhonda
has
their
own
value.
H
So
so
the
mechanism
is
the
long-term
way
to
API.
We
can
call
a
stream
way
to
API
and
this
API
allow
community
to
talk
to
the
each
kind
of
the
external
runtime
plugging
and,
as
I
mentioned
before,
we
know
the
life
cycle
of
community
life
cycle
of
canary
has
been
handled
by
the
Canadian
tissue
bacon
server
right.
So
so
for
the
each
guy
of
LaRhonda,
you
have
to
implement
their
own
community
stream,
they
can
server.
H
We
know
Canady
back-end
server
is
binary,
so
it
must
follow
and
then
naming
convention
so
that
community
can
find
it
start
it
and
start
it.
So
so
if
you,
if
you
want
to
have
your
own
runtime
plugging,
you
have
to
implement
those
API
in
your
community.
Shrimp,
Atkins
server,
so
with
the
run
down
with
the
API
Kennedy,
can
talk
to
each
kind
of
the
external
and
are
plugging.
H
H
Okay,
appropriate
provide
a
naive
snaps
or
to
ronk
ronk
antenna,
but
that
this
temperature
is
the
start
hardy
plugin.
So
we
need
a
proxy
frog
in
here.
So
first
step.
We
need
you
around
a
naive
with
snaps
were
in
the
background,
so
I
use
the
no
help
here.
You
see
that
so
I
run
in
the
background.
First
second.
H
H
H
Okay,
after
communities
start,
we
can
check,
use
the
city
our
to
check
the
snaps
or
status
you
can
see.
It
is
up
and
loaded
by
the
community.
Okay,
so
we
can
use
the
city
are
communal,
I
to
download
image,
so
we
can
see
we
use.
The
snap
story
is
the
naïve
snaps,
alright
and
download
busybox?
You
will
take
a
few
seconds
here.
H
So
first
cut
is
the
external
plugin
right,
so
it
has
each
incremental
swim
way
to
AVI
here.
So,
let's
check
out
the
naming
convention.
First,
so
ironic,
Anna
used
FC,
naive
snaps
were
here
and,
and
you
can
see,
I
used
the
eternal
mountain
name
here
is
the
AWS
one
talk
fat
track
now
check
out.
The
R
is
out
here.
H
H
H
H
So
Kunis
has
introduced
the
wrong
10
class
resources
right
and
we
can
choice
the
wrong
time
for
the
each
poll.
Naturally,
one
see
we
can
use
the
divisor
in
color
in
color
container,
but
there's
two
two
concepts
here.
Why
is
wrong?
Ten
cars
name
and,
and
one
is
the
wrong
time
and
ER
for
the
London
class
name.
It
is
used
in
the
port
when
you
choice
when
choice
the
wrong
tank,
as
name
in
the
pot
common
areas
which
we
send
the
wrong
hand
handler
name
to
the
container
container
one-time
interfaces,
so
paths
for
the
community.
H
So
so
we
can
see
sorry,
so
we
can
see
with
we
need
to
do
them.
We
need
to
do
the
mapping
here.
First,
we
Paul
will
use
the
kasnian
right
and
CI
we
use
the
handler
name,
but
for
the
community
he
he
had
to
know
which
kind
of
the
Rhonda
and
flagging
will
be
used.
So
we
need
to
do
the
mapping
from
the
handler
name
to
the
external
runtime
froggy.
H
So
we
will
have
the
configuration
here
from
a
second,
so
so
we
can
see
the
kalakanya
is
the
handle
and
container
Rondon
tab
is
the
external
long-term
plug-in
name.
So
if
you
choice
the
cutter
cleaner
cut
around
him
handler
and
Canale
will
use
this,
one
can't
have
to
run
okay
Nina.
So
this
will
do
that.
Maybe
here
so
we
can
start
the
community
right
now.
H
H
H
Okay,
our
system
fires
is
direct,
is
ready
so,
but
before
we
run
a
pot,
we
need
to
let
my
local
host
be
our
schedule
so
before
I
create
power,
I
need
to
create
a
round
and
class
with
resources.
So
let's
check
out
the
Yama
file
here,
so
you
can
see
I
create
a
true
sorry,
wrong.
Turn
resources
here,
y
is
for
color
and
otherwise
for
2
4
advisor
and
and
this
one
kata
is
the
name
of
the
wrong
turn
class
and
the
handler
name
is
the
kata
wrong
hand.
H
H
H
H
H
So
the
last
one
is
is
that
is
the
out
of
the
advertising
time,
so
new
version
will
cancel
so
first
one
we
will
have
a
strong,
powerful,
plug-in
ecosystem
and
we
will
Paris
about
four
degrees
for
the
cruiser
resources
and
the
server
will
will
improve
our
city,
our
command
line
and
the
last
one.
We
we
have
a
new
idea
around
the
around
the
image.
We
will
made
an
image
distribution
faster.
E
H
G
H
H
For
now,
CGI
is
like
a
tool
you
know
it
is.
How
do
you
use?
We
will
make
a
very,
very,
very
useful
to
have
you
to
to
do
the
typical
fix.
Not
will
not
do
the
building
things.
If
you
want
to
use
the
functionality
you
can
use
the
few
kids,
you
don't
I,
think
I
think
ready
is
very
low
level.
Ng,
we
don't
do
the
we
don't
do
that
we
want
to
the
top.
We
don't
do
the
talking
in
the
community.
So
if
you
want
to
use
the
pew,
you
can
use
the
puke
it's
okay.
B
B
H
You
mean
the
status
of
Patrick
right,
you
mean
the
status
of
so
now
he's
just
like
fraught
hyper
right
now
he
can.
We
can
use
the
in
CIT
walking
on
his,
so
I
think
I
mean
it.
It
was
the
prototype
you
can
just
I
think
we
can
wait
for
several
months.
Yes,
it's
not
I
think
we
can
now
use
in
the
production.
I
think
we
can.
We
wait
for
it.
It's
not
stable
right
right
now.
Do.