►
Description
What are OpenShift sandboxed containers, and how are they more secure than "regular" containers? This week, Product Manager Adel Zaalouk joins to help us look at the use cases and benefits of OpenShift sandboxed containers and how they compare to OpenShift Virtualization. We'll cover some history with Kata containers, how Sandbox containers rely on a hypervisor to provide kernel-level isolation and demo a sandboxed container to find out what's happening at the host/hypervisor level that may be interesting. Join us to learn more about sandboxed containers and get answers to your OpenShift questions.
Learn more: https://cloud.redhat.com/blog/the-dawn-of-openshift-sandboxed-containers-overview
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, host Andrew Sullivan and guests sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan , https://twitter.com/practicalandrew
Jonathan Rickard, https://twitter.com/jrocktx1
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #ContainerPlatform
A
B
C
B
It
was
great
it
was
we
roasted
a
turkey
for
the
first
time
in
four
or
five
years.
Usually
we
do
the
fried
turkey
thing.
You
know
as
you
as
you
can
tell.
I
enjoy
eating
and
I'm
from
the
south,
so
you
know
nothing
like
a
little
fire
hazard
for
the
holidays,
but
no
this
year.
Just
through
I
don't
know
sheer.
I
don't
know
if
it
was
luck
or
bad
luck.
Our
turkey
was
too
big
for
the
fryer,
so
yeah
it
was.
It
was
great
holiday.
C
B
So
we
are
very
happy
to
be
joined
by
adele
zeluk
today.
I
hope
I'm
pronouncing
that
correctly,
as
my
children
will
tell
you,
I'm
terrible
with
names.
So
today
we
are
going
to
be
talking
about
sandbox
containers,
which
is
the
red
hat,
the
openshift
name
for
kata
containers.
So
adele,
if
you
don't
mind
introducing
yourself.
D
B
So
I
I
know
this
is
something
that
is
interesting
to
me.
It's
it's!
It's
kind
of
close
to
the
things
that
I
that
I
am
involved
in
on
a
regular
basis,
because
there
is,
there
is
some
some
fanciness
involved
on
the
back
end
right,
we're
going
to
be
talking
about
hypervisors
and
kvm,
and
all
that
other
stuff
a
little
bit
so
looking.
C
A
B
To
really
defining
and
digging
into
sandbox
containers
kind
of
containers
and
how
they
fit
in
with
openshift,
but
before
we
get
to
that.
Let's,
let's
talk
about
you
know:
let's
do
our
normal
opening
stuff
johnny.
So,
first,
the
ask
an
open
shift.
Admin
office
hour
live
stream,
I'll
get
all
those
words
out.
Eventually,
it's
like
riding
a
bike.
You
know
it's
been
two
weeks
and
it
was
two
weeks
before
that.
So
I'm
feeling
a
little
rusty
just.
B
It's
you
know
as
long
as
it's
you
know
like
riding
a
bike
and
not
falling
off
a
bike
exactly
so.
The
the
admin
askin
open
shift
admin
office
hour
live
stream
is
one
of
the
office
hours
series
of
live
streams
here
on
red
hat,
live
streaming
and
ultimately
our
goal
here
is
just
like.
If
you
had
a
professor
or
a
manager,
anybody
like
that
who
had
office
hours,
it's
an
opportunity
for
you,
our
audience
to
come
and
ask
us
anything
and
everything
that
you
would
like.
B
You
know
we
are
open
shift
experts,
johnny
and
I
are
both.
You
know
we
have
a
strong
administrator
background.
We've
been
doing
this
for
a
number
of
years,
so
we
want
to
answer
those
questions
for
you.
You
know
we
always
have
a
topic
and-
and
today
we
are
privileged
to
have
a
guest
join
us
as
well
to
to
elaborate
on
that
topic,
but
don't
withhold
or
don't
restrain
your
questions
to
just
that
topic.
You
can
ask
us
about
anything.
You'd,
like
worst
thing
that
happens.
B
Is
we
don't
know-
and
I
will
say
that
that
happens
a
lot
with
me
and
we
go
and
find
the
answer.
We
try
and
get
out
a
blog
post
after
each
one
of
these
episodes.
I
know
I'm
still
running
a
little
bit
behind
we're
catching
up
on
the
blog
posts,
but
we
try
and
get
a
blog
post
out
after
each
one
of
these.
So
that
way
we
can.
B
So
the
other
thing
that
we
tend
to
do
or
that
I
like
to
do
here
at
the
start
of
each
one
of
these
streams,
is
have
a
few
top
of
mind
topics.
These
are
things
that
kind
of
john
aaron
and
I
saw
come
across
our
desk
right
things
that
we've
seen
come
up
recently
that
we
feel
are
important
to
you
all
our
audience
and
we
want
to
make
sure
that
you're,
aware
of
them
and-
and
you
know,
can
either
be
prepared
for
something.
That's
coming
down.
B
The
line,
or
just
you
know,
general
awareness,
type
of
stuff,
so
the
first
one
of
these
top
of
mind
christian
is
awesome.
Oh
man,
I
forgot.
I
got
a
coffee
cup
that
I'm
I
keep
meaning
to
show
you
christian
I'll,
have
to
send
it
to
you
offline,
because
you're
you're,
gonna
love
it
so
the
first
one
that
I
want
to
talk
about
is
or
or
highlight,
is
if
you
missed,
kubecon
live
the
sessions
are
now
available
online.
B
So
inside
of
there
is
kind
of
the
whole
list
of
sessions
that
are
available
inside
of
there.
I
don't
have
the
link
handy,
but
they
also
published
their
transparency
reports,
which
included
the
top
10
list
of
sessions.
I
think
there
were
two
or
three
sessions
that
included
red
hat
folks.
There
was
one
on
helm,
charts
that
had
carina.
B
There
was
one
on
storage
and
disaster
recovery,
which
had
several
of
our
storage
folks
on
there.
That's
a
great
one.
By
the
way,
I'm
already
talking
with
those
folks
about
coming
on
to
discuss
ramen,
not
the
dish
but
the
service
for
doing
effectively
volume
replication
with
openshift
data
foundation,
so
an
entirely
kubernetes
native
way,
using
crds
to
set
up
volume
replication
between
two
clusters,
so
lots
of
really
cool
stuff
going
on
there
but
yeah.
I
know
there
was
a
bunch
of
sessions.
B
I
don't
remember
how
many
sessions
were
in
kubecon,
but
they're
all
available
on
youtube
now
so
definitely
check
those
out.
If
you
happen
to
miss
any
of
them,
I'm
going
to
skip
over
the
next
one
and
save
it
for
last
johnny.
If
you're
looking
at
the
notes,
so
another
announcement
that
we
have-
and
this
one
I
thought
was
kind
of
quiet-
was
that
aro
azure
red
hat
openshift
has
been.
B
So
yesterday's
slides,
I
will,
I
know
they
updated
the
link
and
we'll
talk
about
that
in
just
a
moment.
They
updated
the
what's
new.
What's
next
link
with
the
video,
they
have
not
posted
the
slides
if
they
I'm
gonna,
send
an
email
as
soon
as
we're
done
with
the
stream.
Today
I
can
post
those
I
now
have.
B
This
is
a
question
that
has
it's
come
up
kind
of
periodically
over
the
last
couple
of
years,
but
there's
been
a
rash
of
these
questions
that
I've
seen
internally
over
the
last
couple
of
weeks
and
it's
mostly
focused
on
rev
and
vsphere
customers
who
they
want
to
move
open,
shift,
compute
nodes
and
sometimes
control
plane,
nodes
between
clusters.
So
moving
between
you
know
two
drs
clusters
or
two
rev
clusters
right
compute
clusters,
you
know
hey,
I
am,
maybe
life
cycling,
the
hardware
inside
of
there.
B
I
need
to
expand
capacity
for
whatever
reason
it
happens
to
be
and
effectively.
The
question
is,
you
know,
is
this
possible?
Is
it
supported
for
me
to
be
able
to
do
this
and
the
answer
can
be
it's
not
necessarily
straightforward,
so
johnny,
keep
me
honest
here,
make
sure
that
I'm
not
talking
about
a
line.
B
So
if
you're
using
a
non-integrated
right
a
platform,
none
deployments,
then
absolutely
you
can
of
course
do
that
we
have
no
visibility
into
the
underlying
infrastructure.
You
know
you
could
you
could
put
them
on
different
continents
if
you
wanted
to
so
long
as
the
latency
and
all
the
other
requirements
for
openshift?
Are
there
openshift
itself
wouldn't
know
the
difference
you
would
just
have.
B
You
know
probably
other
issues
if
they're
on
different
continents,
but
so
if
you
are
using
upi
or
ipi,
when
there
is
a
cloud
provider
involved,
essentially
you
need
to
be
cognizant
of
what
integrations
are
being
utilized.
So
what
do
I
mean
by
that?
If
you
are
using
say
the
csi
provisioner
or
the
you
know
the
vsphere
csi
provisioner
or
the
vsphere
entry
provisioner?
B
It
needs
to
be
able
to
access
those
pvcs,
regardless
of
where
the
nodes
are
at.
So
if
you
have
two
clusters
or
three
or
five
clusters-
and
you
have
one
data
store-
that
all
of
those
pvcs
are
provisioned
into
that
data
store
needs
to
be
accessible
across
all
of
those
different
clusters
that
the
nodes
may
potentially
be
on,
and
I
will
note
that
this
is
not
a
tested
scenario,
so
it
is
in
theory,
supported,
but
it
is
probably
going
to
be
a
gray
area
because
it's
not
explicitly
tested.
B
So
the
safest
way,
if
you
need
to
say,
move
my
cluster
or
move
my
openshift
cluster
from
say,
vsphere
drs,
cluster
1
to
drs
cluster
2.,
if
you're
using
ipi,
is
to
add
a
new
machine
set
with
the
new
cluster
and
then
stand
up
nodes
in
the
new
cluster
and
destroy
nodes
from
the
original
cluster,
including
doing
a
basically
a
disaster.
Recovery
right,
a
destroy,
a
control,
plane,
node
and
then
create
a
new
one
and
do
a
recovery
on
it
and
everything
else.
B
That
is
going
to
be
the
safest
and
probably
the
recommended
way.
If
you
were
to
pick
up
the
phone
and
call
us
in
theory,
it
is
possible
to
shut
down
the
whole
cluster
and
migrate.
Everything
over
that
gets
complex
again.
If
you're
using
pvcs,
because
the
pvcs
won't
move.
If
they
do
move,
they
will
effectively
be
lost.
If
you
will
by
the
storage
provisioner,
and
it
won't
be
able
to
connect
them
to
the
nodes.
B
So
just
make
sure
you
disconnect
those
pvcs
make
sure,
wherever
they're
at
they're
accessible
in
the
new
location
as
well,
and
then
you
would
need
to,
of
course,
configure
or
reconfigure
the
vsphere
stuff.
You
know
there's
a
kcs
for
that.
Let
me
see
if
I
can
find
it
real,
quick,
but
there's
a
kcs
for
both
rev
and
openshift
on
how
to
reconfigure
the
the
machine
sets,
etc.
Here's
the
kiss,
yes,
I'm
gonna,
post
that
into
twitch
here
for
those
things,
so
I
I
think
I
think
that
covers
the
basis
associated
with
that.
B
You
know
by
far
by
far
the
safest
thing
to
do
stand
up
a
new
cluster.
Next
to
that
is
deploy
new
nodes
in
the
new
location,
and
you
know
basically
recreate
the
cluster
in
flight.
If
you
will
right
the
the
next,
I
won't
say
it's
the
safest,
but
the
next
option
would
be
to
power
down
and
move
all
of
those
things,
taking
into
account
any
of
the
dependencies
that
exist,
particularly
pvcs
and
networking.
Of
course,
those
are
kind
of
the
options
you
cannot
do
I
mean
I
technically,
you
probably
could
do
a
live
migration.
B
I
would
say
that
that
is
definitely
not
tested
and
probably
not
supported
if
something
goes
wrong.
Definitely
same
for
a
storage
live
migration
right.
The
the
risk
with
storage
migration
in
particular,
is
mounted
pvcs
right.
If
they're
you
know
coming
from
the
vmware
csi
driver
or
entry
driver,
it'll
storage
live
migrate.
Those
pvcs
with
it
and
again
those
will
get
lost
so
just
be
careful.
C
You
know
reflect
that
cluster
name
and
all
that
stuff
too,
so
just
something
to
keep
in
mind
that
it's
a
little
bit
more
involved
once
you
start
doing
that
yeah
yeah
there
was
one
question
in
the
chat
about
you
know:
14
logs
from
one
you
know
from
you
know
like
your
cabana
logs
up
to
a
third
party
logging,
our
hope,
nine.
Thank
you
for
posting
the
link
to
the
to
the
documentation,
but
yeah.
That's
that's
the
right
answer.
C
B
Yeah,
there's
also,
if
I
remember
correctly,
with
the
log
forwarding
api
there's
a
filter
option,
so
you
can,
you
know
essentially
set
it
to
forward
all
logs
that
either
match
or
don't
match
the
filter
which
might
might
help
cut
that
down.
I
know
we
used
to
have
customers
talking.
You
know
the
I
pay
for
my
third
party.
You
know
log
analysis
tool
by
ingest
bandwidth
and
you
know
there's
there's
a
lot
of
stuff
here
that
I
just
don't
need
you
know.
How
can
I
cut
it
down?
B
B
C
B
Okay,
so
the
last
thing
that
I
held
off
until
the
end
there
is
in
case
you
missed
it
and
somebody
maybe
it
was
our
hope.
9,
you
know
mentioned
it.
We
did
do
an
update
to
the
openshift
roadmap
yesterday,
so
it
is
posted
into
the
into
the
youtube
channel.
You
can
go
back,
you
can
look
at
it
do
be
aware
that
the
first
roughly
11
and
a
half
minutes
were
bad.
B
We
had
some
issues
with
the
so
the
way
that
it
works
is
we
do
the
the
road
map
broadcast
internally
at
red
hat
using
blue
jeans,
and
then
we
take
that
blue
jeans
and
we
stream
it
publicly.
So
you
all
our
public,
you
know
streaming
audience
and
the
internal
red
hat.
You
know
employees
all
see
that
presentation
literally
simultaneously.
B
It
just
so
happened
that
the
machine
that
was
being
used
for
that
blue
jeans
restream
was
having
issues
for
whatever
reason,
so
it
took
him
a
little
over
10
minutes
to
get
that
figured
out.
Fortunately,
during
that
first
10
minutes,
it
was
just
kind
of
an
overview
of
you
know:
high
level
open
shift
strategy
things.
It
wasn't
detailed
roadmap,
so
you
didn't
miss
anything
there,
but
we'll
get
all
of
those
slides
posted
it'll
it'll
have
all
of
the
slides
when
we
get
those
up
there,
slack
dns,
post
modem
was
great.
B
Yes
christian!
You!
You
posted
that
yesterday
into
our
internal
slack.
Let
me
see
if
I
can
find
that
or
if
you
have
the
link
handy.
You
know
I,
I
know
you're
a
dns
nerd,
I'm
I'm
a
little
bit
of
a
dns
nerd.
I
I
can
spell
it
usually
but
yeah.
If
you
remember
slack,
had
some
issues
back.
I
think
it
was
august
august
september
time
frame
when
they
were
trying
to
implement
dns
sec
and
that
blog
post
does
a
great
job
of
walking
through
all
the
issues
they
saw.
B
B
C
So
that's
gonna
be
really
awesome
and
then
the
other
one
is
the
aro
and
rosa
user
experience
where
you're
deploying
like
they're
it's
it's
just
that
whole
workflow
is
going
to
get
a
lot
better
from
a
from
a
visual
standpoint
and
just
like
you
know,
just
making
it
easier
for
everyone
to
deploy
and
then
the
last
one
is
really
for
a
friend
of
mine,
an
old
customer
of
mine
who's
really
been
looking
forward
to
this
for
a
long
time
and
that's
ocp
on
arm.
That's
going
to
be
huge.
C
I
know
that
there's
a
lot
of
people
out
in
the
world.
Looking
for
that-
and
you
know
I'm
really
excited
about
that,
especially
for
my
friend,
derek
who's-
who's
been
all
over
this
stuff
from
you
know
getting
getting
as
far
out
on
the
edge
as
you
can.
With
the
you
know,
the
minimal
footprint
as
you
possibly
can
so
all.
C
B
The
only
the
only
one
that
I'll
highlight
again,
you
know
it
was
they
did
a
great
job
with
the
time
yesterday
it
didn't
we
used
to
those
would
run
like
two
and
a
half
hours.
They
did
a
phenomenal
job
yesterday.
I
think
it
was
like
an
hour
and
ten
minutes,
so
it's
not
too
much
to
to
watch.
In
the
background,
the
only
one
I'll
highlight
is
the
targeted
edge
upgrade
or
targeted
update
edge
blocking
so
we've
talked
many
times
about.
B
You
know:
hey,
they
pulled
this
update
edge
and
you
know
it's
a
bug
most
recently
it's
been
bugs
and
things
like
the
vmxnet
driver.
That's
you
know
specific
to
vmware,
and
you
know
a
lot
of
customers
are
like.
Well,
I
don't
use
vmware.
Why
is
that
blocking
me
from
upgrading
so
engineering?
Is
they
hear
you
engineering
and
product
management?
They
hear
you
they're
working
on
it.
So
that's
one
of
the
things
that
they
that
we'll
be
adding
in
the
hopefully
not
too
distant.
Future
of
you
know,
hey
here's
you
know
there
are.
B
B
Let's
see
just
looking
at
the
chat
here,
real
quick,
I
would
like
to
put
open
shift
on
my
raspberry
pi
cluster
running
k0s
at
the
moment.
Zaffy's.
That's
that's
an
interesting
one.
I
so
open
shift
on
arm
is
in
tech
preview.
Today,
with
aws
and
whatever
their
arm
variant
is.
I
know
we're
working
on
expanding
that
the
biggest
issue
with
openshift
on
things
like
the
raspberry
pi.
Is
you
know?
B
Quite
simply,
you
know
memory
compute
right
now,
the
the
smallest
footprint
that
we've
crammed
it
down
into,
if
you
will
is
you
can,
at
the
command
line
force
a
single
node
open
shift
into.
I
think
it's
two
or
three
vcpus
or
cpus
and
16
gigabytes
of
ram,
but
you
don't
have
really
any
room
for
anything
else
at
that
point,
so
it's
possible
to
get
down
to
that
small
footprint
today.
You
know,
I
know
that.
B
I'm
sure
engineering
would
love
to
get
it
smaller
than
that,
but
unfortunately,
today
that's
where
we're
at
so
I'm
interested
to
see
over
the
next.
You
know
six
to
nine
months
where
we
go
with
that
and
especially
getting
it
away
from
just
data
center
arm
because
yeah
I,
like
everybody
else
I
was
actually
this
morning.
While
I
was
waiting
for
for
the
stream
to
happen.
I
was
perusing
amazon.
B
C
We
all
are,
if
you,
if
you're,
really
crazy
about
the
nuts,
also
look
at
the
asus,
because
they
have
a
small
form
pc
as
well.
That's
like
it's
a
competitor
to
the
nook,
and
hopefully
with
like
the
the
pies
as
the
pies.
Are
you
know
advancing?
You
know
right
now,
it's
like,
I
think,
a
quad
core
and
eight
gigs
of
ram
so
soon
we'll,
hopefully
get
to
16
gigs,
and
then
we
should
be
able
to
support.
You
know
some
of
these
bigger,
bigger
platforms
on
top
of
them.
B
B
B
So
in
theory
you
can
deploy
and
to
be
clear.
Andrew
is
not
a
service
mesh
expert
and
I
have
not
deployed
it
to
a
production
cluster.
I've
deployed
it
to
a
couple
of
test
clusters
stuff
like
that,
but
from
my
understanding
when
you
deploy
it,
it
doesn't
actually
do
anything
until
you
configure.
You
know
the
side
cars
to
be
attached
or
you
know
the
other.
Basically
you
have
to
say
now
go
use
it
type
of
thing.
So,
if
you
wanted
to,
you
could
effectively
have
so.
B
D
Yeah,
I
think
I
think
that's
about
right.
I
we've
used
it
before
and
I
have
used
it
in
different
lives
and
I
think
the
networking
is
a
bit
complicated.
So
you
have
to
make
sure
that
you
know
you're
getting
what
you
want
or
you
have
a
goal
in
mind
before
you
actually
opt
in
and
install
in
your
cluster.
Not
only
is
it
extra
resources
but
also
makes
debugging
a
bit
more
complicated,
but
we're
working
openshift
to
make
that
much
better.
Whether.
C
D
C
D
And
just
for
information
like
in
openshift,
we
did
a
lot
of
effort
to
actually
remove
a
past
container,
which
was
not
a
side
car
but
was
like.
I
don't
know
how
to
call
it
another
container
that
persists
networking,
so
we
removed
that
now
in
openshift
and
cryo
with
spin
and
s.
So
that
is
not
a
huge
improvement,
but
we're
optimizing
at
that
level.
So
adding
service,
mesh
and
side
cars
to
all
your
containers
has
to
be
thoughtful,
but
it's
it's
a.
B
D
Yeah,
it's
it's
actually
called
infra
container
pause
container
is
the
name
that
we,
like
the
the
slang
name
of
it,
but
infra
container
is
the
more
official
one.
It's
still
I
I
kind
of
think
of
it
as
a
side
car
that
helps,
but
it
is
a
main
building
block
for
networking
it
was,
and
now
we
have
a
workaround
to
prevent
having
it
in
a
pot.
So
it's
very
clean.
If
you
look
at
the
processes
running
in
your
host,
you
just
see
the
actual
workload
and
nothing
else.
B
That's
really
cool
that
that
would
certainly
make
troubleshooting.
Well,
I
guess
in
some
some
cases
easier,
some
cases,
maybe
a
little
harder,
but
that's
interesting
yep.
So
yeah,
I
don't
see
so
zaffy's.
I
see
talking
about
running
memory
compression.
I
have
no
idea
how
that
would
work
with
openshift
and
kubernetes.
B
So
if
you're,
using
compression
or
or
even
swap
space
right,
that
was
the
big
thing
bef.
You
know
a
few
years
ago
swap
space
with
kubernetes.
You
know
openshift
virtualization.
They
went
through
a
big
debate
on
using
the
transparent
page
sharing
feature.
You
know
for
virtual
machines
and
all
that-
and
it
was
one
of
those
like
we
don't
want
to
mac.
You
know
we
don't
want
to
mess
with
the
scheduler,
but
I
can
see
certainly
on
a
non-production
cluster,
that
that
would
be
an
option.
C
B
Oh
good
eyes
on
that
one
johnny,
I
I
missed
that
one.
Thank
you!
No
problem.
If
I'm
being
honest,
I
don't
know
the
answer
to
that.
So
what
I
think
you
can
do
so
assisted
installer.
It
will
generate
a
iso
and
that
iso
has
you
know
you
boot
the
node
to
the
iso
and
then
it
registers
up
with
the
assisted
installer.
B
Assisted
installer
starts
on
management
network,
want
to
configure
two
production
networks
with
bond
plus
static
ip
and
install
openshift
using
static,
ips,
so
static
ips.
If
they're
not
already
there.
I
believe
that
they're
adding
static
ips
as
far
as
configuring,
bonds
and
stuff,
like
that
on
those
initial
networks,
I'll
have
to
check
with
them
on
the
same
thing.
So
we'll
we'll
take
notes
and
I'll
kind
of
collect
these
things.
B
If
you
want
to
follow
up
and
send
me
those
questions
and
then
I'll
just
you
know
forward
them
right
over
to
that
team
and
see
if
we
can
get
answers,
if
not,
then
next
week
or
as
soon
as
I
can
get
answers,
we'll
we'll
talk
about
those
in
the
top
of
mind
topics,
so
adele
we're
we're
a
little
bit
past,
where
I
normally
start
with
the
main
topic
of
the
day.
I
hope
you
don't
mind
but
yeah
johnny.
Thank
you
for
posting
that
in
the
chat
there,
these
are
really
great
questions.
B
You'll,
you
know
plea,
please
don't
stop
with
the
questions
so
adele
sandbox
containers,
product
containers.
This
was
something
that
I
said
at
the
beginning
right,
it's
really
cool
to
me.
It's
really
excited
me,
but
when
we
first
announced
it
internally,
there
was
a
bunch
of
questions
and
even
a
little
bit
of
confusion
around
kind
of
what
it
is,
how
it
works
and
where
we
should
use
it.
So,
if
you
don't
mind,
please.
D
Yeah
so
usually
like,
I
have
an
entire
slide
deck,
but
I
don't
think
we
have
the
time
to
go
through
it.
So,
let's,
let's
do
it
like
you
know,
advocate
openshift
sandbox
containers
is
the
product.
Kata
containers
is
the
project
and
what
we
do
is
is
basically
wrap
kata
containers
and
make
it
supported
in
red
hat.
We
provide
an
operator
with
openshift
sandbox
containers
to
do
the
heavy,
lifting
and
installation
tasks
which
I
will
show
you
later
just
like.
D
Now
that
does
not
prevent
us
in
the
future
from,
for
example,
picking
up
another
sandbox
if
we
have
enough
use
cases,
but
for
now
it's
like
I'm
saying
this,
because
I
I
usually
see
the
mapping
the
one-to-one
mapping
between
kata
containers
and
sandbox
containers,
but
it's
really
just
an
umbrella
term,
like
the
sandbox
containers
for
for
a
broader
set
of
use,
cases
which
might
or
might
not
evolve
in
the
future,
based
on
the
use
cases
that
we
see
and
the
questions
that
we
asked
get
asked.
So
that's
in
a
nutshell.
D
D
A
B
Understanding
you
correctly,
sandbox
containers
is
kind
of
a
umbrella
term,
we're
using
for
kind
of
sandboxing
technologies
and
there's
only
one
right
now
cata,
but
there
could
be
others
potentially
in
the
future,
and
I
don't
want
to.
I
have
no
idea
whether
or
not
they
will
I'm
just
saying
that
it
sounds
like
that.
We're
leaving
that
door
open.
If
you
will.
D
Yeah,
it's
it's
the
I
mean
that's
now,
it's
a
one-to-one
mapping,
but
that
umbrella
term.
That
gives
us
the
flexibility
there's
a
lot
of
sandboxing
techniques
there,
and
now
we
have
a
generic
one
that
works
for
us
and
for
our
use
cases
in
the
future.
If
we
decide
to
go,
you
know
another
way
based
on
users
requests.
Then
we
can.
But
it's
just
not
one
exactly
one-to-one
mapping.
B
D
It's
so
it's
actually
what
we
have
is
we
have
the
container
runtime
interface.
That's
the
interface
that
higher
layer
runtimes
like
cryo
or
container
d
in
other
environments,
implement
that's
the
high
level
runtime.
It
gets
the
commands
from
clients
like
crycottle
or
cubelet
in
in
cube
and
openshift,
and
then
basically
does
multiple
things.
B
Okay,
okay,
yeah!
So
that's
a
good
good.
A
good
point
of
I
think
I
confused
maybe
a
little
the
the
oci
and
cri
too
many
acronyms
there
tlas
so
yeah
khalid
highlights
g-visor
is
another
form
of
isolation,
and
that
kind
of
brings
me
to
the
next
question
that
I
had
in
mind,
which
was
you
know?
Yes,
there
are
other
isolation
techniques
out
there.
B
You
know
amazon
made
a
big
splash
with
firecracker,
not
so
long
ago,
which
I
think
a
lot
of
people
lump
these
together,
even
though
they're
not
quite
the
same
internally.
There
was
a
lot
of
questions
around
well.
What's
the
difference
between
kata
and
openshift
fertilization,
for
example?
So
if
you,
if
you
could
elaborate
on
that.
D
D
The
container
world
that
we
live
in
today
is
a
form
of
sandboxing.
Some
people
even
call
it
software
virtualization,
it's
basically
you're
taking
a
process
and
making
it
a
super
process.
By
adding
you
know,
process,
name,
space,
pid,
namespaces,
all
network
namespaces,
all
these
things
that
basically
take
a
container
and
a
process
and
make
it
a
container
now
the
problem
or
not
the
problem
that
the
thing
that
is
left
out
in
that
equation
is
that
containers
by
default
share
the
same
kernel.
D
I'm
using
the
kernel
features
to
do
the
name
spacing
but
the
isolation,
but,
however,
in
in
some
scenarios
right
it.
That
is
not
enough.
There's
there's
even
like
some
people
might
argue
that
you
know
there's
new
username
spaces,
which
is
a
new
nice
feature
coming
in
that.
Allow
me
rootless
access,
I'm
not
rude
in
that
process,
but
still
there's
a
lot
of
limitations.
To
that
it's
an
ongoing
effort.
D
D
But
then
you
can't
really
do
privileged
things
inside
the
container,
because
it's
uid
guest
map-
and
there
is
a
lot
of
dependencies
to
help
you
map
that
that
uid
to
another
non-root
user
and
these
dependencies
actually
require
root
access
to
do
that
work.
So
it's
not
100
rootless,
there's
a
lot
of
layers
like
there's
the
demon
or
the
socket
or
the
runtime.
That
needs
to
be
ruthless
and
then
the
process
that
needs
to
be
rootless
and
then
the
shared
kernel
problem,
like
I'm
mapping
to
actual
user
ids
in
the
host.
D
So
I
cannot
really
do
two
containers
gives
them
root
id
inside
because
that's
still
a
map
map
to
the
same
user
id
on
the
host.
So
again,
there's
a
lot
of
things
to
make
that
mapping
to
mount
file
systems
there's
a
set
of
file
systems
that
are
now
supported
like
vfs
or
fuse
fs
overlay
fs
is
not
usually
supported.
C
groups:
v2
is
the
only
supported
version
of
user
namespaces.
D
That's
why
you
don't
see
it
mainstream
and
kubernetes,
kubernetes
or
other
environments,
because
so
far
some
environments
are
using
c
group
b1
and
you
see
a
push
for
people
moving
to
see
group
b2.
So
all
of
that
kind
of
bring
brings
us
to
adding
another
tool
tool
in
our
toolbox,
which
is,
I
want
to
add,
a
virtualization
layer.
I
want
to
add
another
sandboxing
layer
to
my
equation
that
I
could
use
for
multiple
reasons.
D
D
Yeah
exactly
and
then
other
people
might
run
ci
cd
jobs.
These
jobs
are
coming
from
different
places,
they're
hosting
those
in
their
environment,
and
you
don't.
You
can
100
guarantee,
but
we
have
of
course
like
we
have.
The
entire
stack
was
image
registries,
private
registries,
vulnerability,
scanning
acs
and
all
these
things,
that's
just
an
additional
layer
that
we're
adding
to
run
this
set
of
untrusted
code
or
if
you
have
trusted
code
that,
for
example,
acts
like
a
sas.
D
Imagine
I
have
a
service
that
takes
pdfs
and
transform
them
into
markdown
that
pdf
is
code.
It
can
have
code
injected
that
you're
running
your
your
application,
which
is
trusted
a
trusted
image,
but
it
takes
input
from
a
user
and
that
user
could
be
malicious
or
could
be
an
attacker
and
then
basically
injects
code,
because
they
know
a
lot
about
your
environment
and
there's
a
lot
of
ways
to
know
about
one's
environment
through
exploration
and
so
on.
So.
B
D
In
that
case,
we're
using
like
kata
containers
and
kata
containers
has
a
stack
that
makes
use
of
hardware.
Virtualization
makes
use
of
kernel
virtual
machine
kvm.
It's
a
linux
module,
unlike
other
virtualization
platforms,
that
has
you
know,
l
zero,
let's
say
virtualization
the
this
one
is
running
on
the
os,
so
any
vm
that
you
spawn.
A
B
D
Yeah
so
I'll
answer
the
second
question:
first,
because
it's
easier
yes,
we
currently
require
bare
metal
and-
and
that's
that's,
a
requirement
for
our
da
as
well
for
multiple
reasons,
because
you
know
in
the
cloud
there
is
not
really
a
clear,
consistent
way
of
having
nested
virtualization
supported,
but
in
the
future.
If
there's
a
use
case
for
it,
we
might
think
about,
like
clouds
that
enable
and
help
us
support.
Nested
virtualization
there
coming.
B
Yeah
and
I
know
for
openshift
virtualization
there's
been
a
lot
of
questions
around
nested,
verts
and
there's
some
very
good
and
valid
reasons
why
they
don't
support
it,
and
they
tell
me
that
they
will
never
support
it.
There's
sometimes
foot
stomping
when
they,
when
I
ask
them
again
and
again
and
again,
but
so
yeah
nested
is
hard.
So
I
just
want
to
be
cognizant
of
that,
but
sorry
to
interrupt.
You,
though,.
D
C
D
D
D
D
Usually,
if
you're
running
a
a
normal
container
a
workload
and
we
can
call
it
trusted,
so
you
know
it's
source,
you
have
done
your
vulnerability
scanning.
You
know
that
there
are
no
zero
days
attacks.
It's
it's
a
it's,
not
a
business,
critical
application
that
has
cves
discover,
but
you
want
to
run
it.
D
Then
you
can
go
the
normal
default
route.
If
you
want
with
running
normal
containers,
that's
high
layer
runtime
as
cryo
low
layer
runtime
as
run
c.
If
you,
on
the
other
hand,
want
to
run
for
whatever
reason
like
for
the
reasons
that
I've
mentioned
before
you're
running
untrusted
code
for
other
people,
you
host
you,
you
have
a
business,
critical
application
that
that
the
cve
was
discovered
for,
but
you
have
no
fix
yet
for
an
easy
way
is
to
also
put
in
a
sandbox
containers.
D
Because
then
till
did
you
figure
out
how
to
refactor
your
code
and
enter
that
cbe
and
figure
out
a
fix?
You
can
run
that
in
a
sandbox
containers
or
if
you're
running
a
cloud
native
network
function.
That
is,
you
know,
shared
in
a
host
where
other
cloud
native
network
functions
or
other
code
from
different
vendors
run
on
the
same
host.
You
could
use
openshift
sandbox
containers,
on
the
other
hand,
open
to
virtualization
is.
This
is
what
I
call
a
general
purpose
use
case
where
I
have
a
vm.
D
It's
either
running
modern
code
or
legacy
code,
but
it's
running
in
a
vm
environment,
and
I
want
to
move
that,
as
is
so,
I
haven't.
I
don't
have
a
container
image
for
it.
I
haven't
gotten
into
yet
to
my
cloud
native
journey
and
I
want
to
quickly
catch
up
and
and
run
my
stuff
on
on
on
containers
and
then
basically
refactor
my
application
or
just
wanting
to
re-host.
I
would
think
of
openshift
virtualization
as
a
good
venue
for
that
it
it
says,
lift
and
shift.
D
Basically,
a
vm
here
on
the
on
a
legacy
environment
can
run,
as
is
on
a
on
a
an
open
shift
environment
or
a
containerized
environment
versus
sandbox
containers,
which
is,
I
have
already
gotten
through
my
cloud
native
journey.
I
have
containerized
my
app.
I
have
an
image
and
I
just
want
that
extra
layer
extra
tool
set
a
tool
in
my
tool
set
for
running
my
untrusted
applications
for
running.
You
know.
D
B
It
it
does
for
me,
you
know:
where
do
you
need
just
that
security
isolation
aspect,
or
do
you
need
an
entirely
separate?
You
know
operating
system
to
do
all
kinds
of
things.
Inside
of
so
you
know.
Is
it
a
pod
that
I
want
to
treat
as
a
pod
that
I
want
to
use
as
a
pod?
That
just
happens
to
need
additional
isolation,
or
is
it
something
more
than
that
so
yeah.
B
D
B
So
actually,
I
think
the
questions
that
are
are
kind
of
popping
up
is
can
be
answered
kind
of
through
seeing
how
it
works.
So
you
know
c
c
s
santinopper,
I'm
really
sorry
about
names
so
had
asked,
and
christian
kind
of
plus
wondered
of
you
know,
can
we
or
or
how
do
we
use
a
tecton
task,
use
a
kata
container
and
I
I
think
the
answer
to
that
is
basically
the
the
run
time
that
it
uses
whether
it's
the
standard,
one
or
kata
is
a
part
of
the
pod's
definition
itself.
So
it
doesn't
matter.
B
D
Yeah-
and
I
think
tactin
now
supports
it
up
upstream
and
argo
for,
like
that
runtime
extra
runtime
edition
we
might
think
about
also
supporting
if
we
see
enough
use
cases
and
git,
ops
and
and
pipelines
and
openshift.
But
that's
it's
really
just
you
know
a
workload.
Your
jobs
are
workloads
and
the
granular
bit
is
the
pod.
If
you
switch
the
runtime
class
to
kata
or
sandbox
containers,
you're
going.
A
D
D
Let's
call
this
where
an
index
page
that
reference
a
lot
of
other
places,
including
the
openshift
blog
we're
updating
that
and
it
basically
contains-
will
contain
all
the
resources
that
we
have,
whether
it's
blog
posts,
videos
that
we
publish
on
youtube
demos
and
so
on.
So
I
I'm
gonna
share
the
link
for
yeah
and
under
yeah
cool
yeah
you're,
one
step
ahead
of
me,
andrew.
D
You
stephanie,
okay
right,
so
I
think
there
are
two
ways
to
see
how
it
works.
There's
the
right
I
had.
I
don't
think
I'm
gonna
be
able
to
cover
that,
but
I
usually
have
these
kind
of
of
drawings
that
explains
stuff
end
to
end
that
we
can
explore
or
we
can
explore
from
the
cli.
So
you
know
that
will
probably
take
about
10
minutes
which
we
all
what
we
have,
but
we
can
go
through
the
the
cli
and
do
some
some
some
some
magic.
What
do
you
think.
B
I'm
always
a
fan
of
seeing
things
in
action,
although
I
have
to
say
that
I
always
love
your
drawings
anytime.
I
see
you
post
drawings
and
stuff
like
that.
You
always
do
a
phenomenal
job
of
explaining
difficult
concepts,
but
yeah
yeah.
I
think
you
know
proof
is
in
the
pudding
so
to
speak.
So
if,
if
we
can,
let's,
let's
use
the
cli,
let's.
D
D
Here
it
is,
I'm
just
gonna
show
like
what
got
installed
by
olm,
just
to
get
to
give
you
an
idea
what
the
operator
does,
and
so
basically
that's
the
olm
stack.
We
have
a
subscription
and
when
you
once
you
apply
that
subscription
in
an
operator
group,
it
kickstarted
the
the
whole
installation
installs
an
operator
and,
as
you
see
it
here,
running
an
install
plan
that
is
automatic
by
default,
but
you
can
also
do
it
manual
and
so
on.
D
So
this
is
this:
is
the
whole
m
stack
but
then
really
what
it
created?
Is
it
created
a
machine
config
and
that
machine
conf
you're
going
to
see
here
is
to
enable
sandbox
containers
it's
running
as
an
archos
extension,
and
that
what
that
arcus
extension
does
it
just
tells
it
to
install,
and
we
have
a
mapping
inside
the
machine
config
operator
called
code
to
map
the
arcus
extension
oops
yeah.
Here
it
is
to
have
to
map
the
arcus
extension
called
sandbox
containers
to
an
rpm
that
contains
all
the
things
we
want.
D
D
All
the
let's
see
if
we
can
contains
all
the
things
that
we
install,
including
the
shim,
including
yeah,
I
would
have
loved
if
I
can
show
you
the
stuff
it
here
into
like,
but
this
is
the
entire
stack,
so
we
have
a
cryo.
We
have
a
monitor
all
these.
Our
packages
that
got
installed
by
just
enabled
the
extension
here
and
we
can
see
here
cryo.
This
is
a
custom
configuration,
but
we
installed
to
allow
us.
You
see
here,
that's
one
very
important
information
that
we're
switching
the
runtime
we're
adding
a
handler
called
kata.
D
That
handler
is
what
tells
cryo
or
the
runtime
what
to
do
when
it
gets
a
pod
that
has
a
runtime
class
called
kata.
So
if
I
would
map
the
real
world
as
a
client,
then
I
would
basically
just
run
time
class
right.
What
I
expect
to
see
is,
I
expect
to
see
a
runtime
class
called
kata
that
should
match
that
lost
word
in
the
dot
kata
here
at
the
exact
match.
A
D
Yeah
and
yeah,
so
basically
yeah
yeah.
Let
me
do
something
else.
I
think
it's
going
to
be
removed
by
default,
I'd
like
to
remove
the
manage
field
and
it's
cleaner.
So
basically
we
do
two
things
here.
We
define
a
runtime
class,
it's
called
kata,
that's
mapping
to
the
runtime
handler,
and
then
we
add
things
here:
oops,
okay,.
A
B
B
D
Yeah,
that's
the
mac
os
clippy,
so
we
have
here
the
overhead
bit
and
that
basically
tells
us.
So
we
are
not
running.
We
were
talking
about
the
pause
container
and
the
overhead
it
introduces
and
that
we're
removing
that.
But
you
know
with
virtualization:
that's
the
cost
that
we're
getting
it's
a
trade-off.
Basically,
it's
a
fixed
overhead,
we're
basically
telling
the
scheduler.
You
know
what
a
custom
for
this
fixed
amount
of
memory
and
cpu
when
you're
scheduling
workloads
using
that
runtime,
because
otherwise
you're
going
to
do
wrong
calculations.
C
D
Values
that
we
have
studied-
and
it's
documented
in
our
documentation
page
if
you
go
there,
you're
going
to
find
what
what
have
we
exactly
calculated
in
open
sandbox
containers
documentation
but
that
basically
maps
to
that
runtime
here.
So
once
I
create
a
pod
using
that
runtime,
it's
going
to
use
kata.
So
now,
let's,
let's
really
create
some
some
some
stuff.
D
D
D
So
once
you
share
the
host
network,
you're,
not
really
sharing
the
host
network,
you're
sharing
the
network
of
the
vm,
so
by
design
that
doesn't
mean
anything
and
so
you're
not
going
to
find
that
working
by
default
with
kata
by
design
other
things
that
we
can
explore.
Now
is
let's
log
into
privileged,
and
here
I
forgot,
which
hosted
this
but.
D
D
So
that's
a
privilege
and
what
I
basically
say
in
a
setting,
I'm
setting
the
security
context
to
true
privilege
and
what
this
does
it?
Basically
disable
all
my
security
defaults
and
accept
process
name
space
sharing.
So
I
have
access
to
my
host
devices,
my
mouse
everything
as
you
can
see
here,
so
I
can
basically
do
anything
I
can
be
root
on
the
host.
B
So
I'm
I'm
going
to
take
an
opportunity
to
interrupt
you,
real,
quick
one
to
say
that
my
dog
is
is
finally
quieted
down.
She
was
very
unhappy
with
what
appears
to
be
the
pest
control
guy,
who
is
on
our
porch,
so
apologies
for
the
barking,
but
two
since
you're
talking
about
you
know,
what's
going
on
inside
of
there
earlier
and
my
apologies.
D
D
That's
if
that
answer,
that
rootless
usually
means
I'm
using
this
base
username
spaces,
but
sharing
the
same
kernel
and
I'm
using
doing
uid
mappings
between
the
the
the
container
and
the
host
podman
is
not
like.
So
far
it's
not
running
through
cube
right.
It
is
considered
a
mapping
to
krakatoa
or
the
cubelet.
Podman
is
on
the
same
layer.
It
calls
out
to
low
layer
runtimes,
and
it
does
a
lot
of
the
work
that
cryo
does.
So
it's
a
parallel.
D
It's
in
in
a
parallel
line
with
as
as
cryo
it
it
does
run
with
rail
and
kata
runs
with
rail,
but
it's
not
supported
so
scott
mccarty
probably
have
touched
on
that
before
yeah
but
yeah.
I
don't
think
I
don't
think
it
is
supported
in
rail
now,
but
it
works
with
rail
and
it
works
with
spot
man.
So
you
can
spawn
cat
containers
with
spot
man.
B
D
D
D
Let's
see
cry,
copper,
pods
right
and
then
basically
our
test
privileged
kata,
so
that
should
be.
I
want
to
show
you
how
it
looks
like
from
the
host
and
then
basically
what
we
can.
We
can
continue
in
a
part
two
sometime
if
we
have
time
so.
Basically,
that's
act
container
that
is
running
and
second
quick.
D
Send
box
you're
going
to
see
here
the
sandbox
id
now,
let's
skim
through
the
processes
or
actually,
let's
grip
through
here
that
guy
and
you
can
see
here
two
things:
you're
gonna
see
that
sandbox
id
corresponding
to
the
container
that
I'm
running
in
qatar
running
as
a
chemo
process
or
qmu
process.
That's
our
virtual
machine
manager
and
that
camera
process
corresponds
to
my
container.
So
if
I
would,
it
was
called
testcata.
D
So
that
corresponds
to
that
guy
here:
test
privilege,
kata,
okay,
so
this
is
here
just
privileged
and
one
thing
that
we
can
see
the
differences.
If
we
look
at
the
process
and
cpu
info,
we
can
find
here,
for
example,
that
I
have
two
cores,
if
I
exact
so
now,
what
we're
trying
to
do
is
we're
trying
to
show
the
difference
between.
D
D
B
D
D
Yeah
a
feature
in
the
sense
that
you
can
actually
play
around
with
ctl
modules
and
so
on,
which
we
can
we
can
allow
you
to
do.
But
the
cursed
part
is.
We
have
done
a
lot
of
effort
to
actually
iron
out
and
harden
the
red
hat
crows
for
you
right.
So
we're
trying
to
take
that.
You
know
give
you
another
option
for
isolating
your
workloads,
but
still
keeping
that
level
of
security
and
immutability
and
all
the
fancy
nice
things
that
we
give
you
by
default
with
archos
an
immutability
might
not
be.
D
You
know
that
most
secure,
but
it's
definitely
one
step
like
we're,
always
talking
about
layers
here
and
immutability
and
and
and
what
arcus
does
in
terms
of
se
linux
and
all
these
things
gives
you
a
default
saying,
even
if
you're
in
a
vm,
so
we're
giving
you
like
isolation
to
the
absolute
top
yeah.
That
said
like,
if
there
is
a
very
convincing
use
case,
that
someone
has
I'm
open
and
happy
to
hear
about
right.
D
So,
just
so,
basically
to
summarize
what
I
just
showed
you,
I
probably
wanted
to
show
you
also
other
things
like
we
have
a
list
of
like
five
six
containers.
What
I
was
trying
to
do
is
basically
show
you
what
enabling
each
of
the
non-secure
modes
in
a
bad
pod
like
whether
it's
host
id
a
pid
or
host
network
and
so
on
means
would
also
mean
so,
for
example,
I
can.
D
I
can
give
you
one
example,
but
before
that
we
showed
that,
like
in
in
a
sandbox
containers,
you
have
a
separate
instance
of
the
kernel.
It's
a
guest
kernel,
it's
a
different
cpu
characteristics.
Whatever
is
running,
there
is
completely
isolated,
you're,
not
sharing
the
kernel
so
and
all
the
process.
I
think
this
was
a
privileged
container.
Let's
continue
and
see
what
happens
here,
if
you
remember
what
I
showed
you
in
the
other
privileged
container.
B
D
B
D
Yeah,
I
think
you
you
can
you
can,
but
we
don't
support
that
at
the
moment.
So
for
the
same
reason,
I've
mentioned
because
that
exporting,
if
we
allow
for
like
we
can,
we
can
think
about
certain
kernel
modules
or
kernel
extensions
that
to
enable,
but
we
can't
allow
a
broad
view,
depending
on
the
use
case.
So
that's
that's
also
for
the
same
reason
I
just
mentioned
before
so
wanted
just
to
show
you
the
test,
host
or
yeah
test
privilege,
that's
privileged,
but
not
kata.
B
D
D
Yeah
see
so
this
is
this
is
privileged
normal
container.
You
can
see.
I
get
access
to
all
the
host
devices,
I'm
basically
absolute
root,
and
here
I
don't
I
get
access
to
the
vm
beneath
which
is
the
separate
guest
kernel.
So
that's
one
example:
yeah
do
we
have
time
for
another
example?
I
can
also
show.
B
D
D
D
B
D
Girl,
the
sandbox
can
be
dramatically
different
than
an
arcos,
no
for
for
openshift
sandbox
containers,
it's
the
same
kernel,
it's
a
different
instance
of
the
kernel,
so
whatever
I
see
in
that
guest
kernel,
I
don't
see
in
in
the
host.
That's
the
isolation
that
we're
talking
about.
That's
the
virtualization
layer.
However,
the
version
of
the
kernel
is
the
same:
I'm
using
the
arcus
here,
I'm
using
orcas
here,
I'm
using
linux,
4.8
and
linux
linux
4.8
here.
So
it's
it's
the
same
image
that
I
use
for
the
vm
as
I'm,
using
on
the
host
okay.
B
D
Yep,
that's
that's
it
technically
speaking
of
containers,
the
project
allows
that
we
in
the
product
do
not
for
now
got
it
yeah.
So
looking
at
the
proc,
because
you
know
everything
in
linux
is
a
is
a
is
a
file.
So
looking
at
the
processes
here,
I
have
all
the
host
processes
that
I
can
see
usb
host
pid
sharing
here
I
that's
disabled
by
default,
and
even
if
it
was
enabled,
I
would
see
that
the
process
is
running
on
the
vm.
D
So
I
guess
we
could
go
ahead
and
show
all
the
host
name
spaces,
but
the
outcome
will
be
the
same.
Whatever
you're
going
to
see
you're
going
to
see
it
in
an
isolated
kernel
versus
you
know,
sharing
the
kernel
was
the
namespace,
so
I
don't
think
it
would
make
like
we
can
go
ahead
and
show
the
rest,
but
it's
basically
adding.
Let
me
open
the
slide
here
just
to
show
you
what
I'm
doing
in
a
slide.
D
B
B
So
we
we
are
out
of
time.
So
we
we
went
about
50
minutes
over
our
hope.
Not
I
think
you
were
suggesting
a
two-hour
session
or
a
two
hour,
a
regular
two
hour
block
for
the
ask
an
openshift
admin,
so
we
we
might
consider
extending
it.
You
know
now
that
we
don't
have
there
used
to
be
an
openshift
commons
briefing
that
that
was
right
at
the
end
of
or
right
up
against
the
back
of
our
show.
So
we
might,
we
might
consider
extending
it.
I
know
sometimes
it's
hard.
B
B
B
B
Pleasure
talking
to
you,
andrew
yeah,
thank
you
so
for
our
audience,
please
don't
hesitate
to
reach
out.
You
can
contact
me
at
andrew.sullivan,
redhat.com
or
practicalandrew
on
twitter,
so,
just
like
you've
seen
me
poking
into
the
chat
on
twitch
there,
which
should
get
rebroadcast
across
all
the
other
platforms.
B
In
the
new
year
we
have
a
lot
of
stuff
planned
a
lot
of
stuff
going
on
I'm
trying
to
get
some
more
kind
of
to
our
hope.
Nines
points
kind
of
to
today's
topic,
trying
to
get
some
more
complex
things
in
here.
So
we
might
end
up
having
to
have
some
more
extended
episodes,
but
please,
whatever
platform
you're
watching
us
on
hit
the
subscribe
button
or
whatever
the
equivalent
is
so
that
way
you
can
know
when
we
do
have
those
topics
on
all
of
that
being
said,
thank
you
so
much
adele.
B
We
really
appreciate
you
coming
on
today
talking
about
this.
This
is
something
that's
exciting
and
interesting
to
me.
So
I
I
learned
a
few
things
and
I've
heard
you
talk
about
this
over
the
last
few
months
in
bits
and
pieces,
so
I
appreciate
that
and
to
our
audience.
Thank
you
all
really
appreciate
your
interactivity.
All
the
questions
today,
I'll
review.
All
of
those
we'll
make
sure
that
we
that
we
have
all
of
those
answered
in
the
blog
post
as
well
so
in
the
meantime,
have.