Cloud Native Computing Foundation KubeCon + CloudNativeCon North America 2017 (Austin), 15 Dec 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Keynote: Introducing Kata Containers - Imad Sousou, VP, Intel Corporation

Description

Keynote: Introducing Kata Containers - Imad Sousou, VP, Software Services Group & GM, OpenSource Technology Center, Intel Corporation

What happens when you need to get software to run reliably when moving from one computing environment to another? Imad Sousou, Vice President of the Software and Services Group and General Manager of the Open Source Technology Center for Intel Corporation, will highlight how we can use open source software to support our rapidly changing world.

About Imad Sousou
Imad Sousou is vice president in the Software and Services Group at Intel Corporation and general manager of the Intel Open Source Technology Center, a position he's held since its founding in 2003. Sousou is responsible for Intel's efforts in open source software across a wide range of technologies and market segments, including enterprise Linux and related technologies such as virtualization, data center, and cloud software; embedded market segments; and client Linux programs.

The Center also focuses on operating system (OS) stacks, including Android and Chrome OS for Intel architecture and Yocto, in addition to Linux kernel and related projects, user experience, and Web and HTML5 technologies on top of client operating systems. He sits on the board of directors at the OpenStack Foundation and is on the advisory board for the Core Infrastructure Initiative at The Linux Foundation.

Sousou joined Intel in 1994 as a senior software engineer. Before moving into his current role, he was director of telecom software programs in the Intel Communications Group and director of client software engineering in the Home Products Group. He began his career as a software engineer at Central Point Software working on system utilities for the Apple Mac OS.

Sousou holds a bachelor degree in computer science and mathematics from Portland State University.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

Today, this morning, I am going to talk to you about a new container run time and something that we just announced cata containers. So when you look at when you look at the isolation spectrum, on the one hand you have containers on the on the other end, you have virtual machines. Containers are awesome. Containers are very, very fast, very simple, very easy to use, and they just like you know, very, very easy to bring it up really quickly. Let it down run your app whatever you want to do.

A

Virtual machines are amazing in that they're very, very secure and they're secured by hardware, and they can run a full operating system, and so on. The the drawback to containers is that you have many many containers typically running on one kernel, so if that one kernel is compromised, all of the containers that are running on one current and that one kernel are basically compromised virtual machines. The drawback is that they're slow so and you can't run some of the modern applications and cloud and native applications that you would want to run with that.

A

You know with that amount of at that kind of speed. So so you basically end up with making a choice, speed versus security and sure you know some people would just run a container on top of a VM, but but not sure how much that that would get you and what we. What we really really wanted was both speed and security, and this is a project and when we started thinking about this few Intel engineers about a couple of years ago started the project.

A

That's called the Intel, clear containers and, and the objective of that of that project was how do you make containers more secure and and the the one thing that we ended up looking at closely is how do you use the technology that made virtualization so secure the virtualization technologies, whether it's an intel, vt-x instructions and so on to make you know in a container context without bringing and the drawbacks of being able of renting a full virtual machines? So so, at the same time, this was a couple of years ago.

A

At the same time, another company hyper came up with a similar concept and they implemented it in a very, very similar way, a similar way which and that project was run v, which effectively does the same thing. So yesterday we announced the new project. Basically that merges both of these projects into one, and that is called the cotta containers. So cata containers is basically a new container runtime. It's it's a hardware, accelerated containers that uses virtualization technology and it basically runs at the speed of containers.

A

So you get that advantage at the same time it uses under in its underlying implementation. It uses virtualization technology that makes it far far more secure than containers, but it is, it does look and behaves like a container, so boot time is sub, 100 millisecond and it's very, very lightweight, and so on and more importantly, it completely integrates with the container ecosystem, so it complies with it complies with with the container runtime interfaces.

A

It is managed and looks and behaves. You know and integrates really well with, with all the container ecosystem, with the kubernetes and and and all the orchestration and manage management software. That's that that is designed for container, so it looks completely like, like a container by the way cut up. The word cotta is from Greek. That means thrust.

A

The project itself is a completely independent, open project with many supporters from the start, as you can see, but also it's and it is hosted by the OpenStack foundation and and and one of the unique things that we are doing with this project is is, is a slightly modified version of a governance process that that does not have any kind of a pay-for-play kind of governance or any kind of boards and business boards and any of those things, and instead it's only a technical steering group that is completely based on contributions and and what we're doing with that is and the initial the initial technical sitting, and that gets it elected every six months.

A

But the initial technical steering group, it's just a few of the key contributors and and people who are working on the projects from I, think it's in a few engineers from Intel, Google, Huawei and anti /. So also another thing about cotta containers that it does supports the multiple hypervisors, multiple architectures and and multiple and integrates with multiple software stacks. Multiple software stacks like like kubernetes, open stacks and so on so get involved. We ask you to get involved the work. The amount of work that it takes to do I mean cotta.

A

Containers is not a simple one technology. It touches a lot of things. You know many optimizations in qmu many optimizations and in the kernel in systemd and just to create to create a runtime that can behave like a container at runtime. So, finally, I'd like to thank that I'd like to thank the OpenStack foundation for bringing all of this together and I, would like to also thank the CNC F and the Linux Foundation for all the help that they gave us and into integrating this into a larger ecosystem.

A

Thank you very much and have a good conference.