►
Description
Deploying OpenShift in disconnected environments just got a little bit easier! The mirror-registry is a small-form registry to use for bootstrapping your cluster. Daniel Messer will be joining us to talk about Quay, the mirror-registry, and their features and roadmaps.
Learn more: https://cloud.redhat.com/blog/introducing-mirror-registry-for-red-hat-openshift?sc_cid=7013a000002qG1LAAU
Try Red Hat OpenShift: https://red.ht/3uVxkya
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Jonathan Rickard https://twitter.com/jrocktx1
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Jonathan Rickard sit down to answer your questions about Red Hat OpenShift.
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3rYz5ZS
OpenShift on GitHub https://github.com/openshift/
#RedHat #OpenShift #Kubernetes #ContainerPlatform
A
B
A
B
B
A
C
A
C
How
you
would
set
up
quay
if
you're
running
your
data
center
on
your
own
in
your
own
cloud
region
and
we
demo
right
setting
up
kuwait
in
an
aha
fashion,
using
traditional
virtual
machines
and
me
in
I-term,
and
free
parallel
windows,
open
receiving
broadcast
input
to
do
configurations
across
free
machines?
So
a
very
rudimentary
demo
of
how
you
would
install
it
for
sure.
B
C
A
C
We
stumble
right,
but
we
are
continuously
improving
the
service.
We've
just
actually
conducted
a
large
fairly
large
migration
of
the
code
base.
So
if
you're
familiar
with,
you
know
python
quiz
written
in
python
and
python,
the
community
essentially
discontinued
python
version
two
right,
and
so
we
had
to
migrate
the
whole
code
base
to
python
v3.
So
you
can
imagine
you
know
how
many
hundred
thousands
of
lines
of
code
of
a
large
sas.
C
B
B
B
B
So
on
social
media,
you
can
find
me
at
practicalandrew
on
twitter
and
I've
also
recently
started
paying
attention
to
reddit
as
well
the
openshift
subreddit.
So
if
anybody
happens
to
be
on
there,
it's
another
way
to
contact
us,
and
you
can
also,
of
course,
reach
out
to
me
via
email.
If
you'd
like
and
my
email
address
is
there
in
the
corner,
andrew.sullivan
redhat.com
with
that
being
said
again,
don't
hesitate
to
ask
any
questions
that
you
have
at
any
point
in
time,
we'll
keep
up
with
those
in
chat.
B
B
It's
been
a
few
minutes
since
I
had
to
think
about
right,
hyper,
threading
and
all
of
the
stuff
that's
inside
of
there,
and
this
was
a
really
fascinating
question
to
chase
down
and
work
with
our
you
know,
kvm
performance
team
to
find
out
what's
going
on
here,
so
the
short
version
is
effectively
in
red
hat
virtualization.
You
have
the
option
of
specifying
not
just
the
number
of
cores
per
cpu
or
per
socket,
but
the
number
of
threads
per
core
per
socket
and
so
effectively.
B
The
question
was,
you
know:
should
I
set
the
number
of
threads
to
be?
You
know
two
because
you
know
if
hyper
threading
is
turned
on,
then
you
know
in
theory,
each
core
has
two
threads
that
are
available
to
it,
and
the
response
that
I
got
back
was
one
that
it
makes
sense,
although
it
didn't
occur
to
me
at
the
time
when,
when
the
question
was
first
asked
and
that
is
essentially
under
normal
circumstances.
B
So,
let's,
let's
ignore
openshift
for
a
moment
under
normal
circumstances,
you
would
want
to
set
that
value
to
be
equal
to
the
number
of
cores
that
show
up
or
the
number
of
threads
that
show
up.
If
from
the
output
of
like
an
lscpu,
so
on
your
rev
hypervisor
nodes,
you
would
go
in.
You
would
look
at
that.
B
You
would
set
it
to
that
value,
and
this
is
important
when
you're
doing
things
like
cpu
pinning,
because,
as
we
talked
about
on
the
stream
things
like
pneuma
awareness
right
all
that
other
stuff,
it
can
provide
some
tangible
performance
benefits
with
openshift.
On
the
other
hand,
because
there's
now
an
additional
scheduler,
an
additional
layer
of
abstraction
inside
of
there,
the
response
I
got
back
from
the
engineering
team
was
more
or
less.
B
It
has
positive
effect
on
your
applications
that
are
running
inside
of
there,
because
you
know
best
practices
or
or
even
recommendations
are
not
always
universal
they're,
not
always
global.
So
I
always
recommend
testing
there
and
they
did
also
point
out
to
me
I'm
going
to
share
my
screen
here
see
I
want
a
window
and
I
want
this
guy,
so
they
did
point
me
to
like,
literally
as
we
were
asking
this
question,
you
can
see
last
last
thursday,
which
is
the
day
after
the
stream
was
kubevert
summit.
B
So
kubert
is
the
upstream
project
behind
openshift
virtualization
and
it
utilizes
kvm.
It
utilizes
all
of
the
same
things
that
effectively
red
hat
virtualization
and
rel
et
cetera,
do
as
well
and
basically
what
they
pointed
out
to
me
was
there's
a
session
that
is
exactly
around
what
this
particular
question
was
acting
was
asking
so
that
should
be
posted
to
the
youtube
channel,
and
I
don't
have.
I
thought
I
had
a
link,
so
it
should
be
posted
to
the
kubert
youtube
channel
in
the
coming
days.
B
I
think
they
usually
have
a
lag
of
somewhere
between
one
and
two
weeks,
but
if
that's
something
that's
interesting
to
you,
you
know
definitely
go
in
and
look
for
that.
I
I
know
that
they
do
a
great
job
of
of
getting
that
up
onto
their
youtube
channel
and
hopefully
that'll
you
know
help
us
today
to
dig
in.
B
A
A
few
coming
in
about
quay
specifically,
but
I
figure
we'll
let
daniel
answer
those
since
they
are
right
in
his
wheelhouse.
There
is
one
question
from
alvaro
and
sorry,
if
I
just
butchered
your
name
but
he's
asking
like
hey
what
do
I
need
to
keep
in
mind
when
I'm
migrating
from
rancher
to
openshift.
B
Yeah
so
in
theory,
it
should
work
exactly
the
same.
So
the
reason
why
I
say
that
is
because
rancher
is
a
quote:
unquote:
vanilla,
kubernetes
right
when
you're
deploying
like
an
rke
or
something
like
that
and
openshift
is
kubernetes
with
some
things
added
on
top.
So
usually
the
things
that
most
people
are
concerned
about
is
creating
ingresses
right,
an
ingress
object
versus
a
route
object
and
openshift
will
automatically
create
a
route.
B
When
you
create
an
ingress,
some
things
do
change
so,
for
example,
within
ingress,
you
can
specify
a
secret
to
use
for
these
certificates,
whereas
with
a
route
you
add
that
certificate
information
in
directly
to
the
route
object.
I
believe
that
it
will
automatically
accommodate
that
as
well.
Basically,
it'll
automatically
create
the
route
with
all
of
that
information
inside
of
it.
So
in
theory,
it'll
work
exactly
the
way
that
you
would
expect.
Of
course,
I
always
recommend
you
know
that
you
test
and
validate,
and
you
also
have
the
option
of
using
the
migration
toolkit.
B
B
You
can
essentially
deploy
this
into
your
openshift
cluster
and
then
point
it
at
you
know
the
existing
cluster
you're
pointed
at
the
new
cluster
and
say:
hey,
I
want
to
you,
know,
migrate,
this
application
and
all
of
the
kubernetes
objects
associated
with
it
into
my
into
my
you
know
the
destination
cluster
and
it'll
handle
doing
all
that
for
you
so
including
migrating
data.
So
I
think
there
is
two
strategies
for
that
right
where
you
can
think
I
don't
need
a
subscription
so
where
you
can
either
have
it
literally
copy
the
data.
B
So
you
know
mount
the
pvc
in
the
source
cluster
mount
a
new
pvc
in
the
destination
cluster
and
have
it
copy
the
data
from
one
to
the
other,
or
you
can
have
it
remember
the
terminology
they
move.
They
use
it's
either
move
or
re-home,
or
something
like
that
where,
assuming
it's
an
on
an
external
storage
system
that
is
accessible
by
both
clusters,
it'll
create
a
new
pvc
or
a
new
pv
in
the
destination
cluster
and
a
pvc
to
map
to
it
so
that
it
can
connect
to
both.
We
should
really.
A
A
So
that's
going
to
be
an
issue
if
you're
coming
from
kubernetes
and
you
haven't,
you
haven't
built
your
application
for
security
right
or
I
hate
to
say
it
like
that,
but
like
if
you,
if
you're,
not
using
sccs
or
pod
security
policies,
or
anything
like
that,
then,
if
you're
running
everything
is
rude
or
trying
to
use
any
any
uid,
that's
going
to
be
an
issue
when
you
come
over
to
openshift.
So
it's
just
something
to
be
aware
of.
B
B
B
B
I
I
don't
know
I
I
described
john
yesterday
johnny
and
I
were
chatting-
and
I
described
my
my
day
yesterday-
is
basically
like
imagine
a
ball
of
cats
that
you
just
like
set
in
the
middle
of
the
floor
and
let
go
and
they
all
scatter
in
a
hundred
different
directions
that
that's
been
my
week
the
last
week.
So
my
apologies-
if
I
already
mentioned
this,
but
the
the
two
big
updates
that
we
had
in
this
particular
release
are
one
and
I
think
I
scrolled
to
the
right
place
one.
B
We
specifically
highlighted
that
with
open
shift,
virtualization
guest
entitlements
for
rel
virtual
machines
are
included.
So
if
you
are
using
openshift
virtualization
you
deploy
rel
vms.
Those
are
those
entitlements
are
included
as
a
part
of
your
openshift
subscription
and
then
the
other
one
which
is
related.
You
know
tangential
to
today
is:
there
has
been
a
number
of
updates
to
include
the
various
openshift
platform
plus
components.
B
You
know
quay
is,
of
course,
a
part
of
that
we'll
talk
more
about
that
in
just
a
few
minutes,
but
they
added
in
the
openshift
data
foundation,
essential
essentials
stuff
in
here.
So
if
you
happen
to
be
interested
in
that,
we
talked
briefly
about
data
foundation
essentials
recently,
it's
included
with
those
platform
plus
openshift
platform
plus
entitlements
up
to,
I
think
256
terabytes
of
capacity,
so.
B
And
I'm
not
paying
attention,
I
think
stephanie
yeah
stephanie's,
she
she's
on
it
stephanie.
In
the
background
here
posting
links
before
I
even
remember
that
I
need
to
post
links
here.
So
thank
you,
stephanie
all
right,
just
I've
got
a
couple
of
other
ones
here.
I
just
want
to
hit
them
quickly,
so
we've
had
a
number
of
questions.
It's
one
of
those
you
know
when
it
when
it
rains
it
pours
thing
things.
B
So
I've
been
asked
a
number
of
times
recently
of
specifically
to
openshift
virtualization
for
some
reason,
but
can
we
deploy
rel
core
os
as
a
standalone
operating
system
so
kind
of
like
we
used
to
be
able
to
do
with
atomic,
or
you
know
core
os
container
linux
so
before
coreos
became
a
part
of
red
hat?
The
answer
to
that
is
no
rel
core
os
is
a.
B
It
is
not
meant
to
be
used
standalone.
It
can
only
be
used
as
an
open
shift
node
and
only
supported
when
used
in
conjunction
with
openshift
right.
You
can't
we
sort
of
alluded
to
that
or
or
it's
sort
of
the
same
as
when
we
talked
about
the
the
various
cves
and
security
bulletins
and
all
that
they
don't
call
out.
You
know
red
hat
enterprise,
linux
coreos
as
being
an
affected
platform.
It's
openshift
is
the
affected
platform
because
you
can't
get
core
os
without
openshift
next
one.
B
This
is
one
that
I
I
didn't
know
about
this
and
it's
more
because
I
like
the
docs
are
just
huge
and
massive,
but
somebody
had
asked.
Is
there
a
way
that
I
can
limit
the
bandwidth
that
a
pod
is
consuming
and
it
turns
out?
Yes,
it's
actually
a
built-in
functionality,
so
you
can
see
it's
very
simple
annotation
to
go
in
and
say
I
want
to
limit
the
ingress
and
egress
bandwidth.
B
So
this
came
up
in
the
context
of
you
know.
I
I
want
to
figure
out
or
I
want
to
find
out
what
happens.
If
I
limit
my
application
to
a
very
low
bandwidth
right.
Is
it
going
to
cause
a
ripple
effect
of
other
things
to
my
application
and
I
was
watching
the
email
thread
about
it
and
was
interested
and
turned
out.
It
was
a
very
easy
thing
to
do.
B
So
johnny
and
I
have
been
planning
out
the
next
few
streams
that
are
coming
up
next
week,
we're
we
are
probably
going
to
look
at
and
not
just
next
week,
but
maybe
the
week
after
as
well,
we'll
be
looking
at
some
openshift
4.10
stuff.
So
last
week
we
didn't
have
this
stream
because
of
the
what's
new
presentation
from
the
product
management
team,
daniel
included
in
that.
But
we
want
to
dig
into
some
of
the
features
some
of
the
things
that
are
coming
out
so
rather
than
having
that
kind
of
high
level.
B
Here's
what's
happening,
it's
let's
dig
in
and
let's
see,
what's
really
changed
and
how
it
works.
So
we've
got
some
ideas
for
things,
there's
some
stuff
that
johnny
and
I
are
both
interested
in.
If
there's
anything
that
you
all
the
audience
are
interested
in.
If
anything
you'd
like
to
see
us
dig
into,
please
send
us
a
message.
B
Please
reach
out
we'd,
be
happy
to
to
look
at
that
and
see
if
we
can
find
some
smes
if
needed
in
order
to
bring
on
and
really
to
talk
about
and
dig
down
into
those
so
and
then
also
coming
up
in
march.
We
have
finally
our
hope,
nine,
I
see
you're
in
the
chat
there.
We
have
finally
identified
somebody
who
is
willing
to
come
on
and
talk
about
service
mesh.
B
I
feel,
like
we've
been
trying
to
find
somebody
for
the
last
year
or
so,
but
one
of
one
of
the
folks
on
my
team
ortwin
is
going
to
be
coming
on
to
the
stream
to
talk
about
service
mesh
and
all
the
really
cool
stuff
that
we
can
do
there.
So
I'm
looking
forward
to
finally
getting
that
on
the
stream
here
so
be
sure
to
subscribe
to
the
channel.
B
B
C
Sure,
maybe
just
to
level
set
at
this
point.
We
want
to
assume
that
everybody
kind
of
knows
what
a
container
registry
is
like
at
a
very
fundamental
level.
So
I'm
going
to
skip
that
part.
If
there's
interest
in
that,
you
do
that.
Just
let
us
know
to
check
but
yeah.
So
it
turns
out
that
openshift,
but
really
any
code
that
has
to
work
needs
a
registry
right.
C
Openshift
is
a
bit
more
special
in
that
sense,
in
the
sense
that
all
of
its
parts
are
also
containerized
right.
So
if
you
look
at
what
runs
on
archives-
and
these
are
containers
right,
so
the
api
server,
the
scheduler
lcd-
all
of
these
fundamental
things
run
as
containers
as
well,
and
if
you
know
a
little
bit
about
containers,
you
know
that
they
have
to
come
from
somewhere.
The
place
where
they're
running
is
is
not
the
place
where
they
are
stored
right.
C
You
pull
them
down
from
these
registries,
so
openshift
has
a
day
zero
requirement
for
a
registry
when
you
wanna
install
it
from
now.
Normally
you
don't
really
see
or
know
about
this,
because
when
you
are
using
the
openshift
installer
you're
connected
to
the
internet
and
that's
where
the
container
images
are
downloaded
for
red
hat
registry,
it's
actually
going
to
be
koi.o,
but
also
registry.redhead.I
o,
which
is
a
proxy
for
audio.
C
So
for
customers
who
are
not
connected
to
the
internet,
you
have
a
little
bit
of
a
problem
right
because
you're
behind
your
firewall
and
you
have
a
green
field
right,
nothing
is
running
there.
You
have
a
bunch
of
new
servers.
You
want
to
run
openshift
from
them.
So
how
do
you
do
that?
If
you
don't
have
registry
right,
you
can't.
So
you
need
to
think
about
that.
C
Have
done
so
far
about
this
is
either
they
had
already
some
registry
running
behind
the
firewall
out
of
historic
reasons,
so
people
use
cue
hours,
use
other
registries
again,
others
kind
of
resort
back
to
a
upstream
solution.
Where
you
have.
You
know
upstream
cncf
distribution
registry
running
in
parkman.
You
know
in
a
single
in
the
node
system,
using
this
storage
and
that's
fine
right
technically.
This
will
work,
but
it
creates
a
couple
of
problems
right.
C
So
that's,
maybe
not
a
long-term
strategy
right-
and
I'm
saying
this
because
you
will
want
to
update
this
registry
over
time
just
for
the
mere
purpose
of
getting
rid
of
ces
and
what
you
also
want
is
getting
rid
of
content
that
you
don't
need
anymore
right,
and
maybe
you
want
to
also
manage,
can
actually
access
that
content
right.
It's
essentially
licensed
software
or
software
that
you
pay
subscription
money
for
that's
in
there.
C
B
I
want
to
highlight
that
very
much
to
your
point
here.
You
know
when,
when
johnny
and
I
did
the
disconnected
deep
dive
four
months
ago,
you
know
we
weren't
ready
to
show
the
mirror
registry
at
that
point.
So
I
think,
and
I
can
dig
up
the
gist
like
we
use
the
upstream
docker
registry
and
and
all
of
the
stuff
associated
with
it,
and
you
know
one
of
the
challenges
of
that
is,
you
know.
Koi.
B
Has
this
really
nice
really
robust
management
interface
where
I
can
go
in,
and
you
know
exactly,
as
you
just
said,
manage
that
content
and
and
all
that
other
stuff.
So,
whereas
with
the
the
upstream
registry
that
isn't
there
like?
Yes,
you
can
technically
go
in
and
prune
re
images
using
the
api
and
stuff
like
that,
but
it's
kind
of
rough.
So
for
me
who
is
going
through
and
it's
you
know
now
it's
well,
I
I
still
have
a
registry.
You
know
in
my
in
in
my
lab
environment
that
I
want
to
continue
to
use.
B
But
how
do
I
prune
off
the
tens
of
gigabytes
of
images
that
I
need
to
and
so
yeah
I'm
I'm
very
excited.
I'm
I'm
happy
to
roll
over
everything
that
I
have
in
my
lab
over
to
the
mirror
registry
and
to
me,
and
you,
you
kind
of
touched
on
it,
but
didn't
outright.
Call
it
out,
which
is
for
me
having
a
a
mirror
of
the
registry
for
an
install
on
premises
is
really
helpful
because
I
mean
yeah,
it's
my
home
lab
right.
A
There,
daniel
is
you
guys,
are
doing
you
guys,
you're
checking
all
the
boxes
that
a
lot
of
our
enterprises
are
having
problems
with
right
now
with
the
upstream
registry
right,
where
they're
trying
to
use
like
a
nexus
or
a
an
artifact,
or
something
like
that.
So
that
way
they
have
authentication
built
in
and
tls
and
stuff
like
that,
because
I
mean
with
with
docker,
you
can
do
tls,
but
to
get
an
authenticated
registry
you
actually
have
to
kind
of
work.
Some
magic
to
kind
of
you
know
put
something
in
front
of
it.
A
C
So
that's
the
whole
premise
right.
We
want
to
make
the
disconnected
installation
easier.
We've
received
a
lot
of
feedback
over
the
last
couple
of
years,
since
openshift
4
was
brought
into
the
world
that
this
part
of
it
is
where
you
have
to
do
more
pre-work
right
and
it's
involving
a
lot
of
different
tools
and
in
case
of
registry
third-party
upstream
tools.
So
that's
really
what
we
wanted
to
kind
of
simplify.
So
you
don't
have
to
worry
about
where
this
comes
from,
how
this
is
maintained,
how
you
update
it?
C
You
just
download
a
thing
from
red
hat
that
gives
you
that,
and
that
thing
is
called
the
mirror
registry,
and
it
has
this
installer
right,
which
has
literally
one
command,
which
is
installed,
and
it
will
install
a
streamlined,
reduced
coin
deployment
on
the
system.
So
you
just
need
well
eight
and
apartment
and
that's
pretty
much
it,
and
then
you
get
going
to
next
step.
This
is
what
we
wanted
people
to
do
right.
We
don't
want
people
to
be
stuck
with,
or
how
do
I
set
up
a
registry?
C
How
do
I
make
sure
people
have
access?
How
do
I
ensure
it's?
You
know
properly
secured
with
credentials
or
tls
certificates,
so
all
of
that
is
like
out
of
the
box
there
with
the
installer.
So
it's
just
a
checkbox
and
you
can
check
and
then
you
proceed
to
the
next
step,
which
is
actually
what
takes
more
time,
which
is
mirroring
all
these
images
down
right.
So
there
was
a
question
in
chat.
It's
quite
the
only
thing
where
I
can
mirror
stuff
into
right
and
the
answer
is
no.
C
B
C
Know
quay,
amongst
other
things
like
artifactory
or
nexus,
so
all
of
these
are
supported
options
for
a
commercial
enterprise
customer.
But
if
you
don't
have
anything
now
you
have
the
mirror
registry
and
it's
part
of
openshift,
it's
part
of
the
subscription
there's
no
additional
cost
to
it.
You
just
get
it
with
your
first
cluster.
You
get
support
of
it
as
part
of
your
openshift
entitlement
and
then
you
kind
of
are
able
to
proceed
to
the
next
step.
C
B
So
I
think
I'm
going
to
actually
skip
doing
the
demo.
I
just
wanted
to
kick
off
the
install
process,
which
is
really
straightforward
and
actually,
instead
of
showing
that
I'm
going
to
paste
the
video
that
you
created
daniel
here
into
chat.
So
that
way,
if
folks
do
want
to
see
what
it
looks
like
to
deploy
it,
they
can.
They
can
go
and
see
that.
B
But
what
I
wanted
to
do
instead
of
that,
because
we
do
still
want
to
see
quay
itself,
which
you
have
up
and
running,
is
let's,
let's
spend
a
couple
minutes
on
the
questions
that
have
come
in
so
far
and
see.
If
we
can,
we
can
answer
a
number
of
those
for
folks,
so
johnny,
I'm
scrolling
back
through
the
chat
here,
just
to
just
define
what
we
haven't
answered
yet,
do
you
have
a
list.
A
Yep,
so
I
put
it
in
our
internal
chat.
It's
basically,
I
think
daniel
started
keying
in
on
some
of
them,
but
the
one
was
about
like,
if
I
have,
is
it
possible,
with
quite
a
high
availability
to
set
up
different
retention
policies
for
images.
For
example,
I
have
one
node
keeping
images
for
a
different
period
of
time
over
the
others.
C
So
in
in
the
registry,
you
don't
think
about
nodes
right.
The
registry
is
like
a
service
that
consists
of
multiple
nodes
for
high
availability
and
scale-out
reasons.
So
the
registry,
you
kind
of
think
about
it
as
a
big
bucket
of
container
images,
and
you
manage
these
buckets
at
the
contents
inside
at
the
registry
level.
So
we
actually
segregate
the
registry
into
what
we
call
organizations.
Others
call
these
namespaces,
but
really
what
it
is.
C
I
need
to
kind
of
keep
the
storage
growth
in
check
because
they
are
eating
up
all
my
precious
expensive
enterprise
storage
right.
So
I
need
to
kind
of
put
some
barriers
up.
So
one
thing
we
are
going
to
do.
The
next
version
of
coin37
is
we're
going
to
have
a
quota
management
being
implemented,
so
you
can
actually
put
a
limit
up
per
tenant
or
organization
how
many
gigabytes
of
images
they
can
store
inside
so
and
that
will
be
enforced
at
some
point
with
a
heart
limit.
C
A
little
bit
more
intelligent
about
it,
we'll
allow
people
to
define
retention
policies
that
tell
you
or
to
tell
quest
what
should
happen
if
that
limit
is
reached
right.
Maybe
you
want
to
delete
some
of
the
older
attacks
right
and
maybe
you
want
to
sort
by
selected
versioning,
because
you're
losing
software
that
way,
and
it's
probably
fine
for
developer
clusters,
so
that
the
version
of
like
0.5.7
from
four
weeks
ago,
isn't
there
anymore
right.
So
that's
how
you
can
keep
growth
in
check,
but
tag
expiration
is
what
we
have
today.
C
C
The
ubi
base
layer
will
only
be
stored
once
in
the
whole
creator,
io
department,
so
red
hat
create
a
downstream
product
which
is
using
the
same
code.
Basically,
it
does
the
same
when
you
you
know
kind
of
delete
or
orphan
an
image.
What
happens
is
that
the
tag
may
be
removed,
but
the
layers
may
not
be
removed
if
they
are
referenced
by
other
images,
because
you
have
layer
sharing
going
on
right
so,
but
from
a
user
perspective
the
image
tag
will
sort
of
be
gone.
B
I
I
think
you
might
have
just
skipped
over
something
pretty
important
there,
which
is.
You
just
said
that
quaid
at
io
and
quay
are
the
same
code
base,
so
it
you
know
for
folks
who
are
wondering
like
like
scalability
and
performance
and
all
that
other
stuff.
We
have
a
pretty
good
idea
of
what
that
looks
like.
C
C
Pretty
impressive,
so
that
if
you
look
at
the
numbers
pretty
confident
this
is
one
of
the
largest
public
registry
services
out
there.
So
we
have
like
over
2.4
billion
container
images
pulled
through
every
month
right
so
there's
a
sizable
traffic.
It
comes
from
clusters,
but
there's
also
a
very
large
audience
of
community
projects
out
there
that
are
using
crater
rail
to
distribute
their
containers
right.
Some
of
that,
so
the
numbers
and
like
storage,
consumption
and
type
traffic
that
it
generates
out
through
the
cpn
is
just
mind-boggling.
C
But
that's
what
quays
you
know
designed
to
do.
It's
a
scale
out
registry
and
that's
important,
because
if
you
think
about
kind
of
where
the
future
is
going
right,
kubernetes
and
objects
is
so
ubiquitous
right.
Then
you're
going
to
get
a
cluster
in
like
10
minutes,
and
when
you
have
things
like
hypershift,
you
may
get
them
in
like
two
minutes.
So
getting
a
cluster
is
very
cheap
and
now
you're
able
to
say
yeah.
Every
development
team
gets
the
cluster
if
they
want
even
for
a
temporary
thing,
because
it's
it
becomes
cheap
right.
C
So
with
that
in
abundance,
you
need
a
sort
of
a
central
approach
to
software
management,
which
is
what
quake
gives
you
right.
It's
containerized
software
and
it's
the
central
source
of
truth
for
distributing
that.
So
when
you
do
that,
when
you
put
all
your
apps
in
one
basket
like
this,
you
better
make
sure
that
basket
is
a
pretty
big
and
also
very
stable
right,
because
if
you
use
that
center
registry,
even
for
just
five
minutes,
trust
me-
you
will
know
in
your
running
classes
very
very
soon
that
this
is
the
case
right.
C
So
registries
need
to
have
a
very
high
uptime
and
quay.
Is
you
know
geared
toward
that
in
the
first
design
principle,
because
it's
scaled
up
right,
the
whole
design
of
the
registry
is
scaled
out.
It's
the
presentation
there,
like
the
image
serving
as
essentially
stateless.
There
are
stateful
parts
of
the
background,
like
the
blob
storage,
for
instance.
That
actually
holds
the
image
layers
right.
It's
also
a
database
that
you
know
indexes
where
all
the
layers
are
or
what
your
username
is,
which
potentials
are
but
the
serving
there.
C
B
It's
funny
because
you
know
I
kind
of
poked
at
it
earlier
when
you
said
you
know
that
it's
it's
the
the
platform
behind
the
platform
and
stuff
like
that,
and
you
know
the
the
registry
should
absolutely
be
considered
a
core
service
right.
In
my
opinion,
it's
in
line
with
things
like
dhcp
and
dns,
as
you
know,
providing
that
you
know
core.
If
it's
down
things
aren't
going
to
work
type
of
functionality.
B
You
know
rail
nodes,
they're
running
on
individual
nodes,
you
know
all
across
the
data
center
and
the
edge
and
everywhere
in
between
you
know,
they're
running
applications
and
containers.
So
it's
the
registry
is
a
core
and
central
part
of
that,
so
I
I
did
want
to
touch
on
I'm
I'm
reading
through
chat
here.
There's
a
couple
of
of
questions
here.
What
is
an
image
stream?
It's
quite
something
like
satellites
khalids,
so
that
one
that's
an
interesting
one.
B
Is
it
the
same
as
openshift
serverless?
No,
so
serverless
or
I
usually,
I
don't
think
they're
the
same.
This
is
andrew,
showing
his
ignorance.
When
it
comes
to
these
things.
I
don't
think
serverless
and
functions
as
a
service
are
sort
of
similar
to
me,
so
serverless
would
be.
I
am
able
to
define
and
and
provide
a
code,
a
piece
of
code
directly
to
the
cluster
and
the
cluster
takes
that
piece
of
code
and
any
triggers
around
it
and
and
implements
that.
So
what
do
I
mean
by
that?
B
Let's
say
that
I
have
a
a
function
that
just
multiplies
two
numbers,
and
then
I
have
something
that
it
subscribes
to
or
some
sort
of
trigger,
endpoint
that
it
hits
and
when
it
says
it
gets
that
input
it
fires
up
that
function,
usually
in
a
pod
and
then
executes
that
service
or
that
function
and
then
terminates,
whereas
quay
would
be
just
a
regular.
You
know:
enterprise
application,
that's
running
inside
of
there.
A
B
A
C
So
the
question
pertains
to
create..
Also,
I
think,
heroes,
thing
kind,
differentiate
between
quay
or
project,
great
app
stream
technology
and
red
hat,
create
a
downstream
product
that
you
can
install
and
run
yourself
from
the
data
center
and
then
quarterly,
which
is
our
hosted
version
of
quite
same
code
base
and
not
all
features
are
enabling
for
obvious
reasons.
But
the
answer
is
creator.
I
own
today
does
not
have
a
verified
publisher
program.
C
C
Right
so
we
have
a
jira
in
which
you
can
actually
follow
the
whole
development
screen,
like
all
the
releases,
all
the
updates,
all
the
pictures
that
are
coming
and
you
can
also
raise
rp's
right.
You
can
also
raise
github
issues
if
it's
pertaining
to
kuwait
technology
itself,
but
I
think
the
red
hat
queen
jira
would
be
a
good
place
to
kind
of
you
know
raise
those
rvs
all
you.
C
Account
and
we're
always
looking
to
hear
back
from
you
as
users
and
interested
people
to
know
about
this
right
now.
It
does
not
have
that,
but
it's
probably
an
interesting
thing
to
think
about
in
the
future.
We
have
quite
admittedly,
seen
a
bit
of
an
update
in
since
certain
our
registry
offerings
like
docker,
for
instance,
change
policies
around
you
know
how
much
of
the
free
tier
you
can
still
use.
C
That's
the
case
yeah,
that's
true!
So
what
the
bridge
operator
does
for
people
who
don't
know
it's
a
finger,
installer
in
opengl
and
bridge
operator
will
give
you
the
same
type
of
integration
that
openshift
used
to
have,
or
actually
still
has
with
the
integrated
internal
image
registry
right.
So,
if
you
think
about
image
streams,
s2i
builds
built
automation
inside
openshift,
using
these
primitives.
C
That
is
all
coming
off
the
internal
registry.
Right
where
you
transparently,
you
know,
push
the
image
to
the
internal
registry,
and
then
it's
triggering
redeployments
of
your
software.
Now,
if
you
register
you
have
quiz
outside
of
the
cluster,
that
integration
was
not
available
and
this
gap
was
filled
by
the
quakeridge
operator.
The
bridge
already
gives
you
back
all
this
automation
so
that
when
you
create
a
namespace,
an
object,
you
have
an
organization
in
kuwait.
You
have
when
you
have
an
image
stream
in
that
name,
space
and
overture.
C
If
you
have
a
repository
with
the
same
name
in
that
query
organization,
you
also
have
the
pull
secrets
and
access
credentials
be
automatically
pulled
down
into
openshift,
with
a
so-called
robot
account
that
quay
has
in
order
to
give
you
access
without
giving
out
the
equipment,
which
is
a
password
right.
So
all
of
these
things
are
all
straight.
In
the
background
by
the
quick
range
operator
which
makes
dealing
with
sy,
you
know
image
streams
and
builds
and
openshift
very,
very
natural,
as
if
it
were
the
internal
registry,
but
it's
the
external
one.
C
Qbo
makes
short
quaker
make
sure
that
doesn't
happen
because
it
prefixes
all
the
name,
spaces
and
organizations
and
report
sources
in
clay
that
it
creates.
As
part
of
that
automation
with
the
cluster
id
that
the
which
operator
is
running
on.
So
you
only
need
to
make
sure
that
your
various
clusters
by
default
have
different
cluster
ids
and
that's
what
disintegrates,
potentially
similarly
or
equally
named
spaces
in
openshift
right.
C
A
Awesome
and
then
one
last
question,
I'm
sorry
andrew
is
good,
and-
and
this
is
because,
like
this
is
coming
up
quite
a
bit
about
like
essentially
the
purpose
of
the
quay,
the
the
quay
mirror
registry
versus,
like
you
know,
getting
content
into
the
registry
right.
I
think
that,
like
there's
two
different
paths
here
right,
you
have
quay
the
mirror
registry,
which
is
really
your
mechanism
to
get
images
to
the
cluster
right
and
then
there's
mirroring
the
content
right.
It's
a
totally
separate
process
and
totally
separate
pathway,
but
there's
a
tool.
A
C
I
I
don't
think
so
to
be
honest,
because
you
know
you're
following
unix
philosophy
here,
you
know
build
the
tool.
That
does
one
thing
and
does
it
very
well,
so
the
mirror
industry's
sole
purpose
is
to
get
your
registry
in,
by
literally
under
five
minutes
right
as
simple
as
that,
and
then
there's
going
to
be
another
tool
which
is
centralizing
all
our
different,
mirroring
approaches
into
one
tool.
So
that's
going
to
be
a
separate
tool
which
has
only
that
mission.
C
You
can
use
it
with
whatever
registry
you
have
if
you
have
already
quay
properly
installed
or
you
have
another
hp,
you
can
also
use
oc
here
with
that.
But
oc
mirror
really
is
the
next
step
to
simplify
all
this
prerequisite
process
of
getting
a
disconnected
cluster,
because
today
you
need
to
follow
different
documentation,
steps
using
different
tools
to
mirror
different
parts
of
operation.
C
You
need
to
differentiate
between
the
core
images
and
the
core
cluster
operators
and
the
optional
layered
add-on
products
in
form
of
the
old
managed
operators,
so
these
operator
catalogs
are
managed
and
mirrored
in
a
different
way.
So
it's
also
different
steps
and
different
customization
mechanisms.
Oc
mirror
is
going
to
unify
all
of
that
in
one
separate
tool
that
does
all
of
this
in
one
command
and
one
go
off
of
a
central
configuration
file.
So
the
library
of
goodness.
C
Is
all
the
catalogs
I
want
to
mirror?
These?
Are
the
operators
inside
those
cameras
I
want
to
mirror
down
to
the
version
or
the
channel
and
then
off.
It
goes
right
and
you
can
do
that
with
any
registry
you
have
could
be
the
variance
free
could
be
a
production
grade
method
created
from
it.
You
name
it,
that's
why
it's
a
separate
tool
right,
but
it
both
comes
as
part
of
openshift
and
it's
both
supported
so
shouldn't
be
a
problem
with
that
mistake.
B
Yeah,
that
was
another
thing
that
we,
when
we
did
the
disconnected
deep
dive,
we
were
just
a
little
too
early
to
show
we.
Instead,
we
ended
up
walking
through
the
process
of
doing
the
you
know,
oc8,
adm,
mirror
and
all
of
that
other
stuff
and
walking
through
all
those
steps
which
has
now
been
dramatically
simplified.
B
So
I
I'm
going
to
use
this
to
to
change
directions
slightly.
So
there's
a
question
here
from
khalid
about
the
best
way
to
deploy
quay,
and
you
know
one.
I
think
we
can
use
that
as
an
opportunity
to
show
the
the
quay
instance.
That's
we
have
running,
but
two
you
know
talking
about
acm
and
quay
together.
B
So
going
back
to
what
we
were
talking
about
before
of
quay
entitlements
are
included
as
a
part
of
openshift
platform
plus
and
so
is
acs,
and
so
is
acm,
and
so
is
open
shift
container
platform.
Ocp
entitlements,
so
you
know
you
can
absolutely
deploy
quay
via
acm.
Whether
or
not
it's.
The
best
way
in
my
opinion
is
a
very
subjective
thing
like
everything,
linux
and
kubernetes
and
openshift
there's
at
least
half
a
dozen
different
ways
to
do
things.
B
One
thing
I
will
highlight
and
daniel
please
correct
me:
if
I'm
wrong
is
that
acm
acs
and
quay
all
qualify
as
infrastructure
workloads,
so
you
can
deploy
yeah,
so
you
can
deploy
a
quote-unquote
hub
cluster
that
is
effectively
control,
plane
and
all
infra
nodes
and
requires
no
entitlements.
And
then
you
can,
you
know
in
you
can
scale.
You
know
those
services
as
you
need
to
for
all
of
the
other.
B
You
know
managed
clusters
that
happen
to
be
out
there,
that
you're,
using
and
and
again
because
it's
all
infrastructure
workloads,
there's
no
entitlements
required
with
that.
So
I
thought
that
was
a
really
cool.
You
know
thing
when
we,
when
we
announced
openshift
platform
plus
and
all
of
those
being
in
for
workload.
C
Yeah,
it's
actually
true,
also
for
regular
openshift.
So
if
you
run
well
openshift
non-platform
plus
you
have
infrastructure
nodes,
you
can
run
acm,
acs
and
quite
air.
You
obviously
need
the
subscription
for
each
of
those
components,
but
you
don't
need
the
subscription
for
the
underlying,
which
you
know
that
run
them
as
workloads
in
parts
right.
C
Obviously,
platform
plus
even
goes
a
step
further,
because
all
of
these
products
are
part
of
that
bundle
right,
so
very
simplified
way
of
buying
all
into
this
and
quay
is
actually
part
of
that
bundle
as
well,
and
not
only
that
it's
an
all-you-can-eat
clay
offering.
So
if
you
have
openshift
platform
plus
you
can
deploy
as
many
grey
instances
and
registries
independent
registries
as
you
like,
and
as
you
need.
It's
talked
to
many
customers.
We
actually
have
two
instances
always
because
they
have
a
staging
instance
and
then
a
production
instance.
C
We
also
have
customers
who
are
doing
this
with
you
know
the
geo
replication
feature
of
quay,
where
you
can
actually
deploy
koi,
let's
say
across
your
data
center
in
the
us
and
your
data
center
and
the
eu,
and
you
can
make
it
look
like
it's
one,
big,
federated
clay
with
no
difference
to
the
client
right.
So
that's
that's
all
available
and
you
don't
need
to
worry
about
any
of
that
subscription
wisely
and
we
just
talk
about
like
deploying.
C
B
Yeah
and
and
while
you're
sharing
your
screen
real,
quick
one
other
thing
I
wanted
to
highlight
with
openshift
platform
plus.
This
is
something
I
recently
learned.
So
quay
is
the
only
one
that
you
can
once
you
deploy
it.
It
doesn't
matter
what
nodes
or
what
clusters
are
accessing
it
even
nodes
outside
of
openshift.
B
So
with
openshift
platform,
plus
with
the
acm
and
acs
deployments,
you
either
have
to
use
other.
It
can
only
manage
other
platform
plus
entitled
nodes
or
you
have
to
have
add-on
licenses
effectively,
but
with
quay
and
the
quay
deployments
you
can
deploy
that.
You
know
that
qui
instance
and
then
you
know
other
kubernetes.
B
You
know
other
non-kubernetes
things
that
need
just
to
access
and
store
images
can
all
access
that
koi
instance.
So
I
thought
that
was
really
interesting
of
just
a
way
to
gain
access
to
to
quay
and
centralize
that
registry
instance,
but
so
yeah
daniel.
If
you,
if
you
don't
mind,
please
please
do
share.
We've
got
about
10
minutes-ish
left.
B
I
do
have
a
a
heart
stop
today,
so
I
want
to
keep
in
keep
an
eye
on
the
clock
for
myself
selfishly,
but
as
always
for
anybody
who's
watching,
you
can
follow
up.
You
can
send
us
emails.
You
can
send
us
messages
on
social
media,
whether
it's
twitter,
whether
it's
reddit
now,
whether
it's
linkedin
etc.
So
you're
welcome
to
send
us
any
messages
and
we'll
be
sure
to
follow
up
on
any
questions.
C
C
Actually
installed
the
red
hat
quay
operator
in
this
cluster
and
and
that's
really
how
you
deploy
quay
with
the
koi
operator,
the
query
operator
is
taking
care
of
everything,
that's
needed
to
lifecycle
quay
deployment,
and
that
makes
it
immediately
subject
to
any
kind
of
gitops
mentality
right,
because
all
that's
needed
is,
you
need
to
lay
down
an
object
called
quay
registry.
So
this
is
the
one
api
that
this
operator
has
it's
a
custom
resource
definition,
and
once
you
have
it,
you
basically
have
control
over
a
query
deployment.
C
So
I
have
prepared
one
here.
That's
you
see
the
kind
here.
It's
called
quay
registry-
and
you
see
this
operator
is
already
reporting
quite
some
information
at
this
overview
stage
right.
It
essentially
reports
general
availability
of
the
quay
instance,
as
well
as
all
the
components
that
make
up
a
great
deployment,
so
quay
deployment
really
is
many
components
working
together.
So
let's
take
a
look
at
the
components
here.
So
what
you
need
for
quay
is
the
database
we
use
postgres
for
this.
C
You
also
need
an
object.
Storage
in
that
object,
storage
quay
will
store
the
actual
layer
blobs.
So
the
individual
parts
that
make
up
a
container
image
will
be
stored
in
an
object
storage
and
we
support
various
object,
storage
providers
and
and
vendors,
but
that's
what's
needed,
there's
also
redis
redis,
isn't
necessarily
needed
for
every
deployment.
But
when
you
use
a
feature
of
quay,
that's
called
builders
which
is
create
building
your
container
images
right
inside
the
registry.
C
There's
also
route
management
with
the
operator,
so
the
operator
will
also
create
all
the
necessary
ingress
configuration
for
your
registry
to
be
available
to
the
external
world.
It
sets
up
monitoring,
of
course,
that's
integrated
in
the
openshift
monitoring
dashboard.
I
actually
haven't
looked
at
this
in
this
instance
here,
but
we
could
potentially
just
try
this
real
quick
because
it
integrates
into
openshift
monitoring.
So,
let's
see
if
it's
there
there's
quay,
so
I
use
openshift
monitoring
to
essentially
monitor
the
query
deployment.
That's
managed
by
the
operator
and
we
have
an
integrated
dashboard
here.
C
So
you
see
I've
been
fiddling
with
this
over
the
course
of
the
day
and
preparing
this
demo.
Now
it's
been
quite
down,
but
here
you
can
see
you
know
what
the
usage
of
the
registry
is.
You
know
in
terms
of
users,
reports,
cpu
percentage
memory
and
so
on.
So
it's
pretty
neat
and
integrates
right
inside
openshift's
monitoring
dashboard.
C
Is
doing
and
then
there's
tls,
this
is
the
way
of
the
operator
allowing
you
to
provide
your
own
tls
certificates.
In
case
you
have
one
in
this
configuration
it
is
actually
managed
by
the
operator,
and
that
means
it's
just
going
to
delegate
this
tls
certificate
management
to
openshift
and
then
last
but
not
least,
there's
clear
clear
is
the
image
scanner
component
of
quake
is
not
only
storing
and
protecting
access
to
your
container
images.
C
It
also
scans
them
for
security
vulnerabilities,
and
that
means
you
can
actually
look
at
your
images
before
they
hit
the
cluster
and
look
at
which
packages
are
installed.
There.
Dbm
packages
alpine
packages,
red
hat
rpm
packages
and
reasoned
about
whether
or
not
these
packages
are
actually
containing
known,
cv's
known
security
vulnerabilities
right,
so
you
can
take
a
look
at
that
up
front
before
it
even
hits
the
cluster
I
skipped
over
one
component
here,
that's
called
mirroring
mirroring
is
another
functionality
of
quay.
C
Normally
the
way
you
use
the
registry.
Is
you
push
content
inside
either
regularly
manually
with
your
apartment,
slash,
docker,
client
or
as
part
of
a
build
pipeline
right,
but
quake
can
also
ingest
content
from
other
registries
using
the
mirroring
feature,
which
means
you
can
have
quay
autonomously
mirror
every
night
at
midnight,
certain
parts
of
docker
hub
or
your
own
registry
right
for
you
know,
availability
purposes,
improving
pool
performance
and
so
on.
So.
C
Will
be
so,
we
are
working
on
that
feature
in
three
seven,
so
proxy
means
quay,
transparently,
fetches,
something
from
an
upstream
registry
like
docker,
hub
or
gcr,
and
serves
it
as
it
would
be
stored
inside
quay
itself,
and
it
does
this
transparently
and
it
caches
this.
So
it
does
this
once
the
first
time
the
client
pulls
the
image
and
then
it
downloads
it
into
its
internal
cache.
C
So
that
is
the
download
speed
is
the
same
as
if
you
would
pull
the
image
directly
from
the
upstream
registry,
but
once
you
pull
it
a
second
time
by
another
client,
for
instance,
think
of
another
node
and
goldman
shift
running
the
same
workload,
and
you
are
scaling
out
that
pool
will
be
served
directly
from
quay,
would
be
very
fast
right
and
quay
maintains
cash
coherence
by
itself,
so
this
is
going
to
be
coming
in
three
seven.
It's
a
pretty
neat
feature
because
you
know
docker
hub
put
up
these
rate
limits.
A
C
That
is
something
that
we're
working
on
at
the
openshift
side.
Right
now,
it's
not
supported.
We
only
mirror
if
you
reference
the
image
by
digest.
I
know
that
these
are
very
tightly
in
between
feature
requests,
caching
and
clay
and
mirroring
by
tag
note
shift,
because
what
it
would
allow
you
to
do
is
to
say
at
the
runtime
level
in
openshift
all
pull
attempts
to.
Let's
say
everything
in
docker
hub
library
project.
C
You
know
pretty
popular
project
is
cached
by
this
square
instance
here
right
and
that
would
be
totally
transparent
to
clients
because
of
this
mirroring
by
tag
feature.
We
are
not
there
yet.
So
last
I
heard
is
we
are
looking
at
that
for
412,
but
we
are
working
on
it
at
apartment
level.
You
can
just
do
this
with
the
registry.com
in
openshift.
We
sort
of
have
the
stance
that
you
only
do
this
for
images
referred
to
by
tag
by
digest.
A
C
Yeah,
that's
an
interesting
thing,
so
clear
scans,
everything
that's
inside
openshift
inside
quick
excuse
me,
the
scanning
part
is
actually
interesting.
So
what
it
will
do,
it
will
actually
look
at
the
image
content.
First,
images
are
immutable,
so
the
image
content,
as
in
all
the
rpms
dbm
packages,
alpine
packages,
apks
and
whatnot-
that
are
found
inside
and
stays
the
same
over
the
lifetime
of
the
image
right,
that's
the
immutable
part
so
clear
actually
starts
to
index.
C
What's
inside
all
those
images
in
all
the
layers
right,
it
understands
what
an
rpm
database
databases
you
can
read
this
and
figure
out
which
rpms
are
in
that
image
and
then
on
the
continuous
basis,
every
60
minutes
by
default.
It
will
compare
that
to
a
list
of
known
vulnerabilities
per
rpm
from
vendors
like
red
hat,
because
we
provide
this
data
as
part
of
the
subscription
value
add
to
our
customers.
C
So,
while
the
image
is
actually
exploded
on
disk,
only
once
by
clear
when
it's
being
loaded
into
quay
it'll
be
continuously
updated.
We
call
this
matching
against
cve
databases.
So
it's
not
like.
We
need
to
rescan
the
image
every
time,
which
means
you
need
to
download
the
image
you
need
to
unpack
the
tarball
and
you
need
to
figure
out.
Is
this
an
rpm
database?
Is
this
an
alpine
imaging
board?
C
Now
that
only
happens
once
that
only
has
to
happen
once
because
images
are
immutable
and
then
we
only
continuously
update
every
60
minutes
which
cves
are
known
for
these
packages.
I
identified
in
this
image
and
that
happens
autonomously.
In
the
background.
You
don't
need
to
do
anything
for
this.
It's
continuously
updated
by
clear
and
that
is
kind
of
how
it
scans
images
right.
So
the
images
available
before
the
security
vulnerability
results
are
available.
B
And
and
to
be
clear,
claire
only
operates
at
the
package
level.
It's
not
doing
like
code
analysis
or
anything
like
that.
So,
for
example,
you
know
let's
say
that
your
your
container
build
process
is
going
in
and
it's
doing
like
a
pip3
install.
You
know,
requirements.txt,
it's
not
going
to
look
at
each
one
of
the
python
modules,
that's
being
pulled
down.
It's
looking.
C
It's
actually
going
to
do
that.
No
really,
it
is
actually
going
to
do
that.
So
what
what
clear
does
is
package
analysis
could
be
operating
system
packages,
but
it
could
also
be
programming
language
package
manager,
dependencies
right,
so
pip
is
one
example
and
we
actually
support
python.
So
clear
will
report
python
vulnerabilities
in
your
image
and
we've
actually
started
to
add
more
programming
languages
as
well.
So
java
is
next.
C
A
C
Dangerous,
so
you
have
vulnerability
here
that
exposes
you
to
some
sort
of
bubble,
overflow
scenario
or
you're,
not
parsing,
that
user
input
correctly,
so
somebody
could
trigger
an
sql
injection.
So
that's
not
what
claire
does
claire
has
no
access
to
the
source
code,
but
it
has
access
to
the
binaries
and
because
there
are
databases
that
we
maintain
that
others
maintain
that
tell
you
which
binary
as
and
which
package
has
certain
cves.
You
know
attached
to
it.
We
can
create
those
reports
and
that
extends
in
the
future
way
into
programming
languages.
C
C
C
Let
me
know
if
you
can
see
the
repository
screen,
but
I
think
that's
good
yeah,
so
so
this
is
kind
of
the
user
view
of
quay,
so
I'm
a
user
in
que.
So
I
see
sort
of
my
organizations
that
I
have
access
to.
I
have
my
home
organization
that
is
named.
Like
me,
my
user
dmaster
and
I
have
also
access
to
another.
A
C
Openshift
or
namespaces
and
kubernetes
it's
the
place
where
collaboration
happens
and
you
can
dive
into
these
right
and
see
the
content
in
there.
So
I
have
like
two
repositories
in
here
postgres10,
for
instance,
and
I
see
the
various
tags,
so
I
pushed
attack
here
a
couple
of
hours
ago.
That's
the
arch,
rh,
scl
official
postgres
10
image
and
that,
as
you
can
see,
has
two
vulnerabilities
right.
So
we
can
actually
see
that
the
python
package
scanner
has
detected
that
there
is
a
python
cve
in
that
package
in
the
url
lib
free
python
import.
C
C
B
So
I'm
gonna
use
the
fact
that
you
pointed
out
that
that's
an
rhcl
image,
you
know
official
image
that
has
some.
You
know
vulnerabilities
highlighted
in
it.
So
a
deal
asked
about
how
you
know:
scanning
red,
hat
images,
official,
red
hat
images
with
things
such
as
fluid
d
or
sorry
with
things
such
as
jfrog,
etc,
reveals
vulnerabilities
inside
of
there,
and
you
know,
is
that
something
that
you
know.
Basically,
what
does
that
mean?
Is
that
does
that
mean
that
there
are
you
know,
red
hat,
isn't
updating
images?
C
Yeah,
we
don't
care
about
any
of
that
like
who
needs
updated
images
right,
jokes
aside,
that's
the
that's
a
big
problem
in
industry
right
so,
like
my
engineering
manager
used
to
make
this
joke
saying
you
know,
you
asked
the
man
of
a
thousand
watches
what
time
it
is
and
he
he
will
not
know
right.
This
is
the
problem
that
you
have
when
you're,
using
third-party
vulnerability
scanners,
with
images
coming
from
red
hat,
because
these
scanners
don't
understand
how
we
back
port
security
fixes
right.
C
C
The
quay
image
will
never
be
reported
as
being
affected
by
that
cv,
because
the
red
hat
protect
team
went
in
and
looked
at
it
and
saw
there
is
no
way
you
can
feed
an
xml
file
into
query
that
it
in
that
it
would
be
processed
by
that
library.
The
only
way
the
only
place
in
query
where
we
deal
with
an
xml
file
is
a
static,
xml
file.
That's
part
of
the
image:
that's
not
user,
manipulatable
right
or
that's,
not
maintainable
by
the
user
yeah,
and
that's
why
it's
not
affected.
So
you
need
to
differentiate
between.
C
Is
there
in
cve
or
are
we
actually
affected
by
that
cve?
And
you
will
get
lots
of
false
positives
from
from
other
scanners
if
you
just
feed
them
ubi,
because
these
scanners
don't
understand
that
we
back
put
security
fixes
into
rpm
versions
that
we
we
are
not
bumping
the
rpm
version
at
the
patch
level.
We
are
appending
a
build
string
or
another
build
id
to
it,
and
these
scanners
don't
see
that
right.
They
see.
Oh,
it's
version
1.0.
C
So
it's
not
a
vulnerability
that
that's
exploitable
and
that's
why
it's
important
to
not
only
have
a
scanner
but
also
have
good
scanner
databases,
and
we
at
red
hat,
maintain
these
databases
for
red
hat
products,
all
of
the
red
hat
products,
and
these
are
the
databases
that
player
in
quay
is
using
and
that's
why
there's
a
much
higher
accuracy
about
what's
actually
vulnerable
right.
So
if
I
look
at
ubi
here,
I
pulled
every
ubi
release
that
is
currently
on
the
red
hat
registry.
C
So
all
the
way
back
to
8.3
and-
and
you
see
this
is
a
source
image
here
and
you
see
some
of
them
have
vulnerabilities
right,
take
a
time
to
load.
But
you
see
that
updating
your
images
is
also
pretty
important
and
ubi
in
particular,
because
you
need
to
update
to
the
newest
miner
version,
because
no
cves
are
back
ported
to
all
the
minor
versions
in
ubi.
A
C
Versions,
you
wouldn't
see
this,
that's
why
it's
important
to
get
images
from
red
hat,
because
we
spin
our
image
builds
very
regularly
right
so
that
they
are
running
of
the
newest
upi.
Most
of
the
vulnerabilities
actually
come
from
the
base
image
or
they
come
from
dependencies
that
your
package
manager
pulls
in
by
clay
python
or
npm
right.
So
that's
why
it's
important
to
always
pull
the
latest
software
from
redhead.com
and
scan
the
software
with
a
red
head,
approved
scanner.
C
We
actually
launched
a
scanner
certification
program
last
year
already
that
certain
versions
of
jfrog
x-ray,
for
instance,
are
part
of
so
you
need
to
also
look
at.
Are
you
using
the
newest
version
of
j
from
x-ray
and
then
this
problem
of
many
false
positives,
hundreds
of
cvs
in
one
image?
That's
just
three
gold
will
go
away,
but
not
everyone
participates
in
that
because
it
entails
to
using
our
cve
feeds,
which
not
everybody
is
doing.
C
B
So
in
the
interest
of
time
and
because
there's
supposed
to
be
somebody
ringing,
my
doorbell
at
any
minute,
I
I'm
just
going
to
ask
one
more
question
which
comes
from
user
ben
cat,
our
hope,
nine.
I
see
your
question
if
you
don't
mind
following
up
via
email,
andrew.sullivan
redhat.com,
we'll
get
that
answered
anybody
else
who
has
questions.
Please
don't
hesitate
to
reach
out
if
we
missed
your
question,
if,
like
earlier,
I
completely
missed
the
context
and
answered
your
question
wrong.
C
C
Cosine
is
a
utility
that
essentially
signs
container
images
and
stores
the
signature
as
a
oci
artifact
in
the
registry
itself.
So
it's
not
the
image
that
is
kind
of
mutated,
there's
an
additional
kind
of
payload
that
comes
with
the
image
that
looks
to
the
standard
registry
as
a
oci,
artifact
and
quay
since
version
36
and
quay
io's
last
sunday
actually
has
support
for
that.
So
you
can
use
cosine
to
sign
your
images
and
store
them
in
cradle
o
or
quay
36
or
newer,
and
you
will
see
the
signatures
appearing
there.
B
Very
cool
all
right.
Well,
as
I
said,
and
as
stephanie
posted
into
the
chat
there,
please
don't
hesitate
to
reach
out
with
any
questions.
Email
is,
of
course
fine.
You
can
also
reach
out
on
social
media
at
practicalandrew,
on
twitter
or
on
reddit
johnny.
I
will
throw
him
under
the
bus
as
well
j-o-n-n-y,
redhead.com
and
j-rocktx1
on
twitter.
B
So
just
a
quick
reminder
for
everybody
be
sure
to
subscribe,
to
whatever
platform
you
happen
to
be
on,
we've
got
a
lot
of
interesting
shows
coming
up
daniel.
Thank
you
so
much
for
coming
on
the
show
today,
I
feel
like
we.
We
might
have
put
this
one
together
slightly
last
minute,
which
was
more
my
fault
than
anybody
else's,
but
this
has
been
phenomenal.
It's
been,
you
know,
really
really
good
and
I've.
I've
learned
a
lot.
B
A
All
right,
thank
you,
yeah
good,
seeing
you
too
daniel
seriously.
Thank
you.
This
was
very
enlightening.
I
hope
that
everybody
that
watched
got
a
lot
out
of
it
and
feel
free
to
hit
us
up.
If
you
have
any
questions
stephanie.
Thank
you
for
being
awesome
and
you
know
keeping
everything
together
for
us,
because
you
know
you
are.
You
are
the
reason
why
we're
successful.
So
thank
you.