►
Description
Larry Garfield presents:
Containers are all the rage these days. They’re fast, they make deployment easy, they handle dependencies, they slice, they dice, they make julienne fries! But... what are they? What exactly is a container and how does it work? Just how does a container differ from the “old” silver bullet, virtual machines?
Here’s a hint: It has nothing to do with boats, or whales, or shipping. That’s all marketing fluff.
Containers are simply a shorthand name for leveraging newer features of operating system kernels that let the OS lie to programs about how they’re running. In fact, all modern software is built on lies. That’s what’s useful about it!
To understand how that works, why it’s so useful, and where it’s not, let’s dive into how software actually works on a modern Linux system to see how those kernel features fit into the big picture, building up to “containers” along the way. Pull back the veil of lies and see how your computer really works.
Get Social!
Website: jakarta.ee
Subscribe: https://www.youtube.com/user/EclipseF...
Follow us on Twitter: https://twitter.com/JakartaEE
Like us on Facebook: https://www.facebook.com/JakartaEE/
Join us on LinkedIn: https://www.linkedin.com/groups/13597
Tag us: #JakartaEE
Want more great Eclipse Community webinars? Become a member of our Jakarta Tech Talks Meetup: https://www.meetup.com/jakartatechtalks
A
All
right,
I
think,
we're
all
here,
so
let's
go
ahead
and
get
started.
Thank
you.
Everyone
for
coming
we're
gonna
be
talking
about
lies
today.
My
name
is
larry
garfield.
You
may
know
me
online
as
krell.
If
you
want
to
make
fun
of
me
on
twitter
during
the
talk,
that's
where
you
do
so.
I
generally
encourage
it.
A
I'm
a
long-time
member
of
the
php
community
in
a
number
of
different
roles.
Among
other
things,
I'm
a
member
of
the
php
fig
core
committee
fig
is
kind
of
php's
de
facto
standards
body,
so
I've
been
in
that
for
a
while,
I'm
also
the
author
of
exploring
php
and
thinking
functionally
in
exploring
php,
8.0
and
thinking
functionally
in
php,
and
I'm
actually
going
to
be
raffling
away.
A
A
copy
of
thinking
functionally
at
the
end
of
this
talk.
So
stick
around
for
that.
If
you
have
any
interest
in
php,
which
you
really
should
it's
a
nice
language,
but
that's
not
what
we're
here
to
talk
about
we're,
not
here
to
talk
about
php
today,
we
are
instead
here
to
talk
about
clouds
wrong
clouds.
A
I
actually
mean
cloud-based
hosting,
because
that's
the
big
thing
these
days,
that's
what
people
talk
about
all
the
time.
You
know
cloud
this
cloud
that
cloud
computing
cloud
hosting
great.
What's
the
cloud,
what
does
that
actually
mean?
Well,
usually,
when
people
talk
about
clouds,
they're
talking
about
things
built
with
containers,
great,
what's
a
container.
A
A
Oftentimes
I
hear
containers
being
spoken
of
like
shipping
containers
and
okay,
not
quite
yeah.
I
don't
think
that's
a
server
farm,
at
least
I
hope
not
the
ping
time
is
going
to
be
terrible
oftentimes.
I
hear
containers
talked
about
with
whales
for
some
reason-
and
I
mean
okay,
that's
a
container
for
plankton,
but
probably
not
the
kind
of
container
we're
talking
about.
A
A
Basically,
everything
you
have
been
told
or
heard
about
containers
before
is
a
lie,
including
the
containers
themselves.
Containers
are
fundamentally
a
lie,
they're
a
very
useful
lie,
and
that's
not
a
bad
thing.
In
fact,
all
modern
software
is
built
on
lies
all
everything
you're
doing
all
hosting
systems
all
programming
is
built
on
lies
so
to
understand
what
containers
are.
We
need
to
first
understand
all
of
the
lies
that
build
up
two
containers
and
that
we're
going
to
start
with
the
very
first
lie,
and
that
is
this
concept
of
a
process.
A
What
is
a
process?
Well,
this
is
a
cpu,
it's
a
very
old
cpu
at
this
point.
There's
an
old
intel,
pentium
mmx
for
those
of
you
who
remember
those
this
is
the
one
that
can
actually
do
math,
not
the
one
that
had
broken
math
to
see.
You
know
who's
that
old
and
cpus
are
fundamentally
single
threaded
devices.
A
They
have
a
very
basic
set
of
instructions
that
they
can
understand
that
are
very
low
level
move.
You
know,
add
these
two
numbers
put
result
here
copy
this
number
from
this
register
to
this
register
and
so
on,
and
they
will
execute
those
instructions
one
by
one
in
sequence,
and
they
have
a
special
register
called
a
program
counter
that
tracks.
What
the
next
instruction
to
register
to
use
to
execute
is,
and
some
of
the
instructions
go
and
directly
modify
that
program
counter
to
tell
it
to
skip
over
or
skip
back
in
that
list.
A
A
A
Enter
an
operating
system,
an
operating
system,
a
lot
of
different
on
the
market
is
a
very
special
piece
of
software,
a
series
of
instructions
that
sits
on
a
computer
and
coordinates
with
the
cpu
and
its
primary
job.
It
actually
just
does
a
lot
of
things,
but
its
primary
job
that
we
are
concerned
with
is
that
it
is
software
that
manages
software
and
an
operating
system
conspires
with
the
cpu
to
lie
to
you
about
what
is
actually
what
series
of
instructions
the
cpu
is
actually
running.
A
The
operating
system
has
this
chunk
of
it
called
a
scheduler,
again
lots
of
other
pieces.
This
is
the
part
we're
concerned
with
the
scheduler,
coordinates
with
the
cpu
and
manages
this
thing
called
context:
switching
periodically
the
cpu
will
tick
and
when
it
ticks
it,
fires
a
timer
interrupt
in
which
the
cpu
will
stop.
Whatever
it's
doing
and
update
its
program,
counter
to
say,
hey,
go,
look
up
this
exact
piece
of
code
out
of
memory
and
execute
that
and
that
place
in
memory
has
a
piece
of
the
operating
system
called
an
interrupt
handler
that
interrupt
handler.
A
A
Now
these
days,
most
systems
have
multiple
cores
or
a
lot
of
programs
have
multiple
threads
conceptually.
What
you
have
there
are
then
multiple
program
counters.
If
you
have
multiple
cores,
then
you
have
multiple
program
counters
on
different,
each
working
on
a
different
stream
of
instructions,
or
you
have
in
threads
multiple
program
counters
working
on
a
single
stream
of
instructions.
A
A
That
is
called
a
process.
A
process
is
a
logical
construct
that
exists
in
the
cpu
and
the
operating
system
that
bundles
together
a
stream
of
code,
a
program
counter
some
kind
of
id
to
keep
track
of
the
processes.
So
it
can
refer
to
them
by
some
identifier
and
a
block
of
memory
that
the
process
is
working
with,
where
it
stores
its
variables.
A
That's
what
a
process
is.
It
is
a
shorthand
for
bookkeeping
for
all
of
this
stuff.
Now
processes
when
run
in
any
modern
operating
system
know
about
each
other.
They
can
ask
the
operating
system
hey
what
other
processes
are
running
when
it's
their
turn
to
run
and
get
back
an
answer,
and
they
will
all
get
back
the
same
answer
and
they
can
then
communicate
with
other
processes
by
sending
them
messages
through
the
operating
system.
By
saying,
hey,
send
this
message
to
process
47
or
whatever,
and
they
can
get
the
same
information
from
the
operating
system.
A
A
Processes
can
also
spawn
new
processes
either
by
forking,
meaning
you
take
one
process
duplicate
it
in
memory,
but
it
doesn't
actually
duplicate.
It
just
duplicates
the
program
counter
and
then
those
processes
continue
their
merry
way
or
by
telling
the
operating
system
hey
operating
system.
You
see
that
file
on
disk
over
there
load
that
into
memory.
A
Stick
the
program
counter
at
the
beginning
of
it
and
run
and
that's
a
new
process,
and
in
this
way
we
create
a
hierarchy
of
processes
where
process
one
starts
process
two
starts
process
three
and
process
four
and
process,
five
and
so
forth
and
generally
the
first
process
that
starts
after
the
operating
system
gets
called
init.
It's
the
init
process
and
its
job
is
to
control
and
coordinate
all
of
the
other
processes.
A
There
are
a
number
of
different
init
systems
available
on
unix's.
The
big
ones
are
the
old
init.d
system
run.
It
systemd
is
the
big
name
in
the
linux
world
these
days
and
so
on.
They're
all
doing
essentially
the
same
thing.
They
are
a
way
to
coordinate
all
of
these
other
things
outside
of
the
operating
system.
All
of
these
other
processes-
okay,
but
there's
more
than
just
the
stream
of
code,
there's
also
memory,
because
all
of
these
programs
are
sharing
the
same
memory,
and
that
means
that
the
their
addresses
need
to
be
different.
A
The
physical
address
in
ram
that
a
program
lives
at
or
that's
variables
live
at.
They
need
to
be
unique.
Are
you
as
a
developer,
going
to
be
able
to
keep
track
of?
Oh,
my
variable
is
at
address
47
in
memory,
but
wait
the
operating
system
just
moved
it
to
make
room,
and
now
it's
been
relocated
to
address
419..
A
A
A
What's
going
on
inside
a
cpu
and
inside
of
a
an
operating
system.
Yes,
I
am
skipping
over
caching
details.
I'm
skipping
over
complex
instruction
sets
whole
lot
of
things.
I'm
skipping
here
just
for
the
sake
of
keeping
this
talk
to
only
an
hour,
but
what
if
we
could
tell
different
lies
to
different
processes?
A
A
A
A
namespace
is
a
way
to
cluster
processes
together
and
say
this
group
of
processes.
I'm
going
to
tell
this
lie
to
and
this
other
group
of
processes
I'm
going
to
tell
this
other
lie
to
and
there's
six
or
seven
types
of
namespace
in
linux.
At
this
point,
I'm
going
to
go
through
the
big
ones
that
most
people
are
actually
going
to
are
going
to
run
into
the
simplest
is
the
uts
namespace.
A
The
uts
namespace
keeps
track
of
the
hostname
and
domain
name
that
a
computer
thinks
it
is.
Basically,
there
is
in
memory
a
global
variable
that
is
the
hostname
of
the
computer
and
it's
originally
set
from
the
etsy
hostname
file,
but
you
can
change
it
in
memory
and
then
it
changes
for
every
process.
However,
if
you
set
up
an
uts
namespace,
then
you
can
create
this
namespace
in
just
code
in
your
kernel,
commands
and
then
put
process
seven
and
process
8
into
that
namespace
and
inside
that
namespace.
A
A
Uts
stands
for
unix
time
sharing
system,
which
is
the
name
that
this
memory
structure
was
given
back
in
1971,
and
it's
still
here
because
you
can't
change
apis.
So
beware
with
your
name
things
they
may
stick
around
for
a
very
long
time.
The
next
namespace
we
want
to
talk
about
is
the
process
namespace.
A
We
said
before
that
a
process
has
an
id
that
the
operating
system
can
use
to
refer
to
it
and
that
the
other
processes
can
use
to
refer
to
each
other.
With
a
process
namespace,
you
can
put
processes
into
a
bundle
and
then
inside
that
bundle
they
have
a
different
id
and
that
id
is
local
to
that
package.
To
that
name
space.
A
So
here
process
12
has
two
ids:
it
has
the
operating
system
knows
it
as
process
12.
It
knows
itself
as
process
2.
if
it
asks
the
operating
system
hey.
What
processes
exist
on
this
machine,
it'll
get
told
process
two
and
process
three
and
that's
it.
It
has
no
way
of
knowing
that
process.
14
the
green
one
over
on
the
right
or
process
one,
the
red
one
over
on
the
left,
even
exist
process.
One
will
get
told.
Oh
there's
process,
1,
12,
13
and
14.
A
process
14.
If
it
asks
it'll,
get
told
you're
process
1
and
that's
the
entire
thing
you're
the
only
process
running
this
is
really
cool.
Now
we
can
isolate
processes
from
each
other
so
that
they
cannot
interact.
They
can't
send
a
message
to
a
process.
They
don't
know
how
to
reference
cool
one
slight
problem,
though:
a
lot
of
the
inter-process
communication.
The
way
linux
works
happens
through
a
virtual
file
system
called
proc,
but
okay,
what
about
the
file
system?
How
do
we
split
that
up?
Can
we
do
that
sure?
That's
called
the
mount
namespace.
A
The
mount
namespace
is
kind
of
a
super
ch
route.
Ch
root
is
a
feature.
That's
been
part
of
linux
since
forever.
I
don't
even
know
when
it
was
added,
and
normally
you
have
your
file
tree
with
a
root,
node
and
then
directories
off
of
that
ch
root.
Lets
you
say
for
this
process
and
any
of
its
children
move
that
root
node
down
to
this
other
subdirectory.
A
So
the
whole
system
knows
about
this
full
file
tree,
but
this
one
process
its
root
is
this
child
of
that
root?
Instead,
a
mountain
namespace
does
more
and
allows
you
to
sign
completely
new
independent
route
nodes
that
do
not
overlap
at
all,
so
you
can
have
a
a
root
namespace
or
a
root
mount
node
for
the
whole
computer
and
then
inside
amount
namespace
say:
oh
it's
this
other
other
tree.
That
is
completely
separate
and
could
be
a
partition
on
disk
or
it
could
be
a
file
system.
A
A
A
A
This
also
limits
what
processes
can
start.
We
said
before
that.
One
way
a
process
can
start
a
new
process
is
by
pointing
to
a
file
on
disk
and
saying:
hey
operating
system
start
that
if
it
can't
point
to
it
on
disk,
because
it's
in
a
different
mount
name
space,
it
can't
even
start
it
does
again.
It
doesn't
know
how
to
reference
it.
Therefore,
it
cannot
tell
the
operating
system
to
start
it.
This
again
allows
us
to
further
isolate
processes
from
each
other.
A
The
network
namespace
this
one's
a
little
bit
weird.
You
first
have
to
understand
this
idea
of
a
physical
device.
A
physical
device
in
linux
speak
is
a
logical
construct
in
memory
that
refers
to
a
physical
piece
of
hardware,
an
ethernet
jack,
a
mouse,
a
monitor
and
and
so
forth,
and
you
cannot
name
space.
These.
A
Linux
also
has
this
idea
of
a
virtual
device,
which
is
a
lie.
It
is
a
data
structure
in
memory
that
looks
and
acts
an
awful
lot
like
a
physical
device,
but
there's
no
actual
real
network
jack
or
mouse
or
monitor
or
whatever.
Behind
it
most
processes.
You
can
actually
put
into
multiple
namespaces
and
you
can
nest
them
virtual
devices
you
can
put
into
namespaces,
but
only
one
at
a
time.
A
In
this
case
we
have
one
physical
device,
each
zero
and
we
have
the
operating
system
and
the
operating
system
knows
about
eth0,
and
then
we
create
two
network
namespaces
a
and
b
and
create
virtual
devices
vf0
and
vf1,
which
get
different
internal
ip
addresses
within
the
computer.
So
there's
this
virtual
network
happening
just
inside
the
operating
system
and
we
put
vf1
into
one
namespace.
A
So
now,
process,
42
and
process
1337
can
both
listen
to
a
virtual
ethernet
device
on
port
80,
because
it's
a
different
device,
so
it
has
a
different
set
of
ports.
It's
a
different
ip
address
internally,
so
you
now
have
multiple
processes
listening
on
the
same
port
and
you
have
some
translation
rules
in
the
operating
system
that
tell
okay,
if
a
request
comes
in
via
eth0
and
it
matches
these
rules
forwarded
to
vf0,
which
gets
forwarded
on
to
vf1
and
process,
42
gets
it
and
then
it
can
respond
back.
A
A
We
mentioned
before
the
processes
have
ids,
they
also
have
a
user
and
a
group
that's
associated
with
them,
and
this
user
and
group
affects
access
control.
Generally
speaking,
a
process
can
only
send
messages
to
another
process
owned
by
the
same
user
unless
it's
owned
by
root,
and
then
it
can
send
messages
to
anything
we
say
signals
here.
The
most
important
is
terminate
to
hey
shutdown,
but
there
are
other
messages
too.
A
So
globally,
certain
users
can
access
it
and
locally
different
set
of
users
can
access
it.
Then
we
have
another
namespace.
That's
a
sub
namespace
of
that,
where
we
have
processes
owned
by
different
users
that
are
local
to
that
namespace.
You
can
do
some
really
weird
stuff
with
this.
You
probably
don't
want
to
get
too
weird,
but
the
main
point
here
is
process
37,
the
green
one
at
the
top
left,
because
you
can
have
a
root
user
that
is
root
only
with
regard
to
certain
processes.
A
A
And
finally,
we
need
to
talk
about
control
groups.
Control
groups
are
the
only
thing
I'm
talking
about
here.
That
is
not
a
lie.
Control
groups
are,
in
fact
scheduler
tweaking.
We
talked
before
about
the
scheduler,
which
works
with
the
cpu
to
jump
between
different
processes
at
different
times,
and
it
tries
to
be
fair
figuring
out
what
fare
means
in
terms
of
making
sure
every
process
gets.
The
appropriate
amount
of
time
on
the
cpu
is
a
really
tricky
problem
and
it's
really
easy
for
a
program
to
cheat
either
deliberately
or
by
accident.
By
just
running
away.
A
A
Control
groups
are
also
defined
in
a
hierarchy
which
is
totally
separate
from
the
process
hierarchy
and
totally
separate
from
the
disk
hierarchy.
It's
completely
different
hierarchy
and
it
also
lets
you
define
nodes
and
then
assign
processes
to
those
nodes
and
then
attach
controllers
to
those
nodes,
and
these
controllers
there's
a
dozen
or
so
that
are
little
operating
system
routines.
That
can
do
a
lot
of
tracking
or
auditing
or
capping
of
what
processes
in
that
node
or
its
child
nodes
are
allowed
to
do
for
our
purposes.
A
The
only
ones
we
care
about
are
the
control
group
controllers
that
allow
us
to
cap
how
much
cpu
and
memory
those
processes
can
use.
So
we
can
say:
hey.
I've
got
12
gigabytes
of
memory
on
this
system,
but
I'm
only
going
to
give
one
gigabyte
of
memory
to
all
the
processes
collectively
on
this
group,
and
that's
this
other
subgroup
of
that
is
only
allowed
to
use
as
much
as
25
of
that
total
memory.
A
A
It's
it
has
that
cpu
core
to
itself.
Meanwhile,
this
other
core
we're
going
to
say
all
right.
All
of
our
nginx
processes
live
on
that
core
and
that
core
only
you
can
have
they
can
spawn
multiple.
You
know,
nginx
can
spawn
multiple
processes.
That's
fine,
but
they're
just
going
to
live
on
that
cpu
core
and
the
everything
else
is
going
to
run
on
the
other
two
cores.
However,
they
want
so
now,
no
matter
what
happens
mariadb
getting
slow
will
not
impact
nginx.
A
The
nginx
will
still
get
us
the
same
amount
of
cpu
time
and
murraydb.
It
may
lock
up
itself.
A
slow
query
may
run
wild
and
slow
down
the
database,
but
that
will
not
impact
any
of
the
other
processes
on
the
computer
unless
they're
waiting
on
each
other
for
communication,
but
they're
not
going
to
out
starve
each
other.
A
You
could
also,
instead
of
making
it
per
core
to
say,
hey.
This
process
gets
20
of
the
cpu
time,
whatever
core
doesn't
matter,
these
processes
over
here
get
15,
regardless
of
core
again
tons
of
flexibility,
for
how
you
can
configure
this,
but
it
lets
you
really
tune
at
a
fine
grained
level.
What
processes
are
allowed
to
use?
What
resources.
A
So
you
may
be
asking
at
this
point:
is
it
possible
to
use
multiple
at
the
same
time?
Can
you
put
a
process
into
both
a
mountain
namespace
and
into
a
uts
namespace?
Absolutely
in
fact,
it's
very
common
to
put
them
into
multiple
namespaces.
You
can
mix
and
match
even
overlap
them.
So
you
have
this
group
of
five
processes,
that's
in
a
process
namespace,
two
of
which
are
also
in
a
mountain
name,
space
that
they
share
with
this
other
process
and
that
other
process
is
in
a
uts
namespace.
You
can
do
some
really
seriously
weird
stuff.
A
Take
a
group
of
processes
and
put
them
into
a
mountain
namespace,
a
process
namespace
a
set
of
c
groups,
a
uts
namespace
network,
namespace,
the
whole
nine
yards-
and
we
end
up
with
something
like
this,
where
we
have
two
processes
that
are
in
a
uts
namespace,
so
they
have
a
local
host
name
they're
in
a
local
username
space.
They
have
local
set
of
users,
they
have
a
network
namespace,
so
they
have
a
local
network
device.
They
have
a
mount
namespace.
A
A
A
A
So
really
is
that
any
different
than
being
on
their
own
computer.
This
seems
really
useful
that
we
can
create
a
fake
virtual
computer
out
of
just
a
pile
of
lies
and
bookkeeping
by
combining
all
the
namespaces
together.
This
is
so
useful.
We
should
just
come
up
with
a
name
to
refer
to
this
whole
pattern
of
use
all
the
namespaces.
A
A
A
A
A
A
A
Kubernetes
is
the
big
name
in
this
space
right
now,
but
docker
compose
is
the
same
idea
and
there's
others
as
well
that
you
can
use
I'm
not
going
to
get
too
far
into
how
those
work
there's
other
talks
for
those
they
are
usually
grossly
over-engineered.
In
my
experience,
but
that's
a
different
matter,
you
may
also
often
hear
about
containers
being
read-only,
and
we
mean
specifically
here
the
file
system.
Image
used
by
a
container
in
the
mount
name.
Space
is
read-only.
A
Why
is
this
good?
It's
not
required,
but
why
is
it
good?
Well,
the
couple
of
reasons
for
one
the
operating
system
is
smart,
which
means
you
can
create
multiple
containers
off
the
same
file
system
image
and
the
cost
doesn't
go
up.
The
cost
is
just
the
one
file
system
image
and
all
of
these
containers
can
recognize:
hey,
I'm
using
the
same
file
system
image,
so
I'm
not
going
to
duplicate
memory.
A
A
If
the
file
system
image
is
immutable,
it's
going
to
change
out
from
under
you
that
gets
harder
to
do.
It
also
means
you
have
no
right
collisions,
because
if
you
have
multiple
processes
in
multiple
pseudo
computers
writing
to
the
same
file
system,
you
can
potentially
have
collisions
and
they
make
it
weird.
A
A
A
A
A
A
Any
dependencies
you've
installed
the
instance
of
the
version
of
php
that
you're
using
the
exact
version,
the
exact
compiler
that
was
used
to
compile
it,
the
version
of
nginx
you're,
using
the
version
of
the
compiler
that
we
use
to
compile
that
any
to
see
libraries
that
has
it
runtime
like
libsy
java
same
thing,
you
know
the
j
you
have
the
exact
version
of
the
jvm.
You
have
the
exact
version
of
your
code,
the
exact
version
of
your
dependencies.
A
A
A
That
is
the
idea
behind
containers
and
portability
is
you're
shipping,
the
entire
computer.
This
is
also
why
languages
like
go
work
really
well
in
containerized
environments,
because
they
are
already
designed
to
have
all
their
dependencies
compiled
into
a
single
giant
binary,
and
that
means
the
size
of
the
file
stem
image.
You
need
is
very,
very
small.
It's
just
your
compiled
application,
plus
any
text
files
that
go
with
it.
That's
it
any
language
can
work
this
way,
languages
that
produce
static,
compiled
binaries
by
default
work
better.
A
They're
still
a
good
company,
though,
and
just
compare
not
better
or
worse,
but
see
how
they
work
differently
at
platform.
Their
system
is
built
directly
in
lxc.
It
does
not
use
docker,
it's
fine
and
they
use
squash
fs
as
the
file
system
image.
Squash
fs
is
a
file
system
optimized
for
producing
a
read-only
file
system
image
that
is
very
small
and
very
fast
to
unpack.
A
It
takes
longer
to
zip
up,
but
it's
and
compress,
but
then
it
decompresses
quickly
and
is
read
only
which,
as
we
said,
is
a
good
thing
and
there's
no
separate
orchestration
tool.
Orchestration
is
just
a
built-in
part
of
the
the
whole
system
you
push
code
to
get
and
the
automation
system
checks.
The
code
out
runs
a
shell
script
that
does
some
kind
of
compilation,
step
which
could
be
compiling
java.
A
It
could
be
compiling
go,
it
could
be
downloading
dependencies
for
your
python
app
or
your
javascript
app
or
your
php
app,
and
the
output
of
that
is
a
squash
fs
image
and
that
squash
fs
image
is
then
mounted
into
a
container
file
system
in
layers,
not
using
anything
fancy.
Just
normal
unix
umout
commands
your
base,
os
image
says,
has
a
or
your
application
has
a
file
in
it
in
yaml
that
says,
hey
I
want
php
7.4.
A
So
you
do
have
some
writable
area,
but
it's
not
where
the
application
lives,
that's
a
separate
file
system,
and
so
what's
inside
the
container,
if
you're
on
ls.
This
is
all
you
get
platform
uses
run
it
as
their
edit
manager.
It
has
a
couple
of
extra
layers
of
processes
for
bookkeeping,
but
really
all
that's
running
here
is
ssh
nginx
and
php
fpm.
A
That's
it.
There
are
thousands
of
processes
running
on
that
physical
computer.
Actually,
on
that
vm
on
amazon,
but
inside
the
container
it
looks
and
acts
like
a
complete
system,
and
you
can
log
in
and
start
processes
and
kill
processes
and
use
it
as
though
it
were
a
vm,
but
there's
only
three
real
processes
running
locally.
A
A
All
of
this
can
get
deployed
at
once
and
when
you
need
to
update
it,
the
update
process
is
throw
away
the
old
one
install
a
new
one.
So
you
stop
accepting
requests.
Go
into
that
container.
You
mount
the
user
files.
You
mount
the
application
image
mount
the
new
application
image,
mount
the
user
files
again
and
open
it
up
and
poof
you're
now
running
a
new
application,
new
version
of
your
application
by
shooting
the
old
one
and
installing
a
new
version.
You
don't
need
to
update
things
in
place.
A
A
A
In
contrast,
docker
works
quite
differently.
Docker
uses
a
layered
file
system
and
does
not
actually
have
an
init
process.
Docker
is
optimized
for
having
only
a
single
process.
You
can
put
multiple
processes
into
the
same
docker
container,
but
the
init
process
that
keeps
track
of
them
and
coordinates
them
and
restarts
them.
If
one
shuts
down
isn't
there
by
default,
so
it's
possible
to
break
a
container
a
lot
more
easily.
If
you
try
to
run
multiple
processes,
it
also
uses
a
layered
file
system
which,
instead
of
having
just
you,
mount
different
pre-built
images
together.
A
A
A
A
A
If
you
want
to
have
a
lot
of
highly
variable,
containers
that
are
ephemeral
list
live
for
very
little
time
say
you
want
to
run
a
command
line
tool
locally
in
a
in
an
isolated
environment.
Docker
is
great
for
that
and
the
system
platform
uses
would
be
terrible
for
that
there
are
others
in
the
market
too,
you
may
have
heard
of
ubuntu's
snaps
system
or
red
hat
flat
pack.
A
So,
in
short,
I
would
encourage
you
to
enjoy
your
lies,
because
all
software
these
days
is
built
on
lies
from
the
process
on
up
to
cloud
computing,
and
you
can
just
embrace
that,
because
cloud
computing,
which
we're
all
supposed
to
be
doing
these
days
according
to
the
market,
droids
is
a
multi-layered
lie.
It
is
lies
all
the
way
down
to
the
cpu.
A
B
So
I'm
just
gonna
post
the
link
here
to
his
website
and
then
the
next
check
card
of
tech
talk
is
scheduled
for
april
13th
when
chad
carlson
presents
git
ops
keeps
focus
on
product,
not
an
infrastructure,
and
you
can
register
for
that
using
the
link.
I
am
just
about
to
post
now
and
finally,
we
are
always,
of
course,
looking
for
more
topics
and
presentations.
B
So
if
you're
working
on
a
cloud
native
java
project
not
even
necessarily
related
to
jakarta
ee
by
all
means
consider
signing
up
to
present
to
tech
talk
using
the
link,
I'm
about
to
post
right
now,
we
are
booking
into
june.
So
sign
up
quickly
and
get
on
our
calendar
larry.
I
know
you
mentioned
that
you
had
a
contest
that
you
wanted
to
engage
in
people.
So
I'll
turn
that
over
to
you
now.
A
Yeah,
so
just
a
quick
giveaway
I
like
to
give
away
copies
of
my
book
thinking
functionally
in
php.
Yes,
you
can
do
functional
programming
in
php,
even
if
you're
a
java
developer.
I
think
it's
still
worth
reading.
It's
been
called
by
some
of
my
readers,
the
only
explanation
of
monads
that
has
ever
made
sense
so
but
high
praise
there
to
do
that.
We're
gonna
do
a
little
quiz.