►
From YouTube: The Level Up Hour (E31): Deep Dive into UBI
Description
What makes UBI images special? Is a UBI image already hardened? We've had several questions about the UBI container images' inner details, so we invited Scott McCarty back to the show to help us answer them. If you've found anything about UBI images to be confusing or mysterious, here's a chance to finally get your UBI questions answered once and for all.
Follow us:
Scott McCarty https://twitter.com/fatherlinux
Langdon White https://twitter.com/1angdon
Chris Short https://twitter.com/ChrisShort
What is the Level Up Hour?
Every Wednesday at 9am ET we stream live demos on how Red Hat Enterprise Linux (RHEL) users and admins can benefit their organizations and improve their careers by learning how to use containers, Kubernetes, and Red Hat OpenShift.
Learn more at:
https://red.ht/leveluphour
http://red.ht/3ayHlHI
How to participate in the The Level Up Hour:
Watch on YouTube every Wednesday at 9amET
Chat with us on Discord https://discord.gg/5VMVGJt
Check out our GitHub repo https://github.com/level-up-hour/
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
https://www.openshift.com/
https://github.com/openshift/
#RedHat #OpenShift #tluh
B
Good
morning,
good
afternoon,
good
evening,
wherever
you're
hailing
from
welcome
to
another
episode
of
the
level
up
hour
with
the
one
and
only
the
illustrious
langdon
white
today,
we're
joined
by
the
marvelous
and
ultra
well
traveled
scott
mccarty.
We
were
discussing
where
he
lives
versus
where
I
lives
prior
to
the
show,
so
welcome
scott
welcome
langdon
to
the
channel
lingan.
Do
you
want
to
kind
of
go
through
our
normal
rigmarole
or
let
scott
yeah
himself?
First.
C
Let's,
let's
do
the
normal
rigmarole
and
then
we'll
do
the
introductions,
so
I
can
give
a
little
bit
of
context,
and
so
I
will
share
my
awesome,
slides,
which
are
awesome.
Scott
has
been
on
the
show
before
and
so
I'm
sure
he
appreciates
seeing
these
brilliant
slides
again.
You
know
because
I'm
sure
everyone
does
so.
C
This
is
the
level
up
hour
where
we
talk
about,
why
containers
rock
and
why
you
might
want
to
start
using
them
and
we're
trying
to
convince
you,
and
then
we
also
are
we've
actually
been
doing
a
lot
of
interviewing
of
people
about
kind
of
the
ins
and
outs
of
containers
and
about
how
they
get
deployed
and
and
the
kind
of
architecture.
For
that
we
also
tend
to
talk
about
openshift
as
well.
C
You
know,
I
think
it's
up
to
16
that
you
can
run
yourself,
so
you
can
definitely
play
with
everything
that
we're
talking
about
here.
If
you
have
any
trouble
trying
to
play
with
those
things,
let
us
know
and
we
will
help
you
solve
them
and
speaking
of
which
you
can
find
myself
and
chris
on
twitter,
I'm
langdon
with
a
one-
and
chris
short,
is
chris
short
and
speaking
of
mr
mccarty.
C
Here
he
is
father
linux
on
twitter,
so
you
can
go
check
out
his
twitter
feed
and
all
his
millions
of
followers.
But
if
you
want
to
chat
with
us
kind
of
you
know,
with
more
kind
of
long
form
chatting,
I
guess
we
also
have
a
discord
that
you
can
check
us
out
on
where
there
is
sometimes
some
active
discussion
around
the
various
shows,
including
the
level
of
hour,
but
also
like
the
gaming
show
that
we
do
so,
which
is
later
today
by
the
way.
Oh,
is
it
today?
C
C
We
have
talked
about
ubi
on
the
show
before
and
as
we
were
joking
around
earlier,
this
is
not
a
universal
basic
income,
but
instead
a
base
container
image
that
uses
red
hat
provided
software,
but
in
the
idea
being
that
you
can
kind
of
have
a
redistributable
container
for
all
the
things
you
might
want
to
build.
You
know,
rather
than
the
things
that
red
hat
wants
to
build
and
ship.
We
also
have
show
notes
from
last
time.
Oh
so
before
I
move
on.
C
C
Oh
cool
thanks:
I
actually
have
them
nicely
copied
over
somewhere,
so
that
I
could.
I
could
do
that
too,
but
so
I
I
got
the
show
notes
done
for
the
episode
before
last
and
last
episode.
Those
were
interesting
topics,
particularly
the
podman
v3
kind
of
deep
dive.
We
had
one
of
the
architects
that
of
the
podman
project
on
the
show,
brent,
bowdy
and
he's
always
a
lot
of
fun.
You
know,
I
think
that
was.
I
think
it
was
really
successful.
C
We
are
gonna,
have
chris
wright,
cto
of
red
hat
on
the
show,
and
we're
gonna
be
talking
about
some
of
the
kind
of
like
future
ideas
around
kubernetes
and
like
how
to
maybe
kind
of
wrap
how
you
think
about
kubernetes
around
a
little
bit.
It's
not
just
it's
not
just
a
way
to
deploy
software
necessarily,
and
we
want
to
get
into
that
a
little
bit
be
primarily
driven
from
a
show.
C
He
did
like
a
quick
hit
show
called
technically
speaking
about
with
he
and
kelsey
hightower
that
they
did
they
recorded
a
couple
of
weeks
ago,
but
it
will
be
also
dropping
during
the
show.
So
we're
going
to
feature
that
and
talk
with
him
about
that.
Hopefully,
we'll
also
talk
about.
What's
coming
up
at
red
hat
summit,
which
is
the
following
week
and
kubecon
eu,
which
is
the
week
after
that,
and
what
he's
really
interested
in
going
to
see
and
what,
as
hopefully
by
extension,
you
might
be
interested
as
well.
C
Please
remember
we
are.
We
are
running
a
contest.
We
decided
we're
going
to
try
to
extend
it
a
little
bit
if
you
want
to
go
to
kubecon
eu.
Please
share
somewhere
on
the
social
media,
about
what
you
have
learned
on
the
show
and
then
come
and
bring
us
a
link
to
it
on
our
discord
so
that
we
can
enter
you
into
a
raffle
for
free
tickets
to
both
red
hat
summit
and
cubecondiu,
except
the
red
hat
summit
ones.
Everyone
is
free,
so
everybody
on
the
show
gets
a
ticket.
C
A
B
A
A
C
C
A
A
A
A
Yep
and
it
remained
tech
preview
for
two
dot
releases
and
we'll
end
up
gaining
it.
Dan
walsh
ended
up
getting.
I
finally
roped
him
into
getting
interested
in
it,
paying
attention
to
it
more
and
we
have
all
kinds.
So
it
was
hard
for
me
to
educate
people.
Why
that?
Why?
Why
we
want
that
like
everyone's
like?
Why
do
we
want
that?
Why
don't
they
just
use
private,
I'm
like
like?
Well,
let
me
give
you
some
crazy
ideas.
A
So,
like
I'm,
a
sys
admin
and
I
need
to
run
this
version
of
podman
in
it,
I'm
not
allowed
to
install
it
on
the
system
because
we
certify
on
rel
8.2,
okay.
Well
now
I
can
use
a
podman
container
and
get
the
version
from
8.4
which
is
3.0
running
on
my
8.2
system.
I
don't
break
any
of
the
compliance
stuff
at
my
company
and
I
still
get
to
use
the
new
version
of
podman.
C
C
You
know
using
a
container
we
actually
opened
like
this.
We
started
the
series
of
the
show
really
about
like
how
do
you
build
an
application
container
that
kind
of
contains
all
the
tools
that
you
want
to
use
and
then
ship
it
around
your
data
center
and
have
it
kind
of
wherever
you
want
it
so
that
you
don't
have
to
muck
with
the
systems
that
are.
A
A
Stuff,
let's
give
you
the
even
crazier
ones,
so
we
had
a
problem
where
a
partner
of
ours
was
running
rel7
and
they
were
locked
into
rail,
seven
for
a
hardware
solution
after
delivering
and
they're
like,
but
we
need
pod
man,
3.0
or
whatever
you
know
command
2.2.
It
has
some
bug
1.64
that
we
released.
That's
the
last.
Like
you
know,
rel7
is
in
the
sunset
now
I
mean
like
it's.
The
sun
is
setting,
the
sun
is
still
over
the
horizon
and
we
do
cves
and
that's
about
it.
A
You
know,
and
it's
very
stable
but
like
podman
people
always
want
the
latest
greatest
version.
So
they're
like
hey,
we
need
2.2.3
and
I'm
like
nah
ain't
gonna
happen
like.
We
cannot
update
that
ever
again.
The
real
program
will
kill
me
like
they.
Don't
they
do
not.
Let
me
do
this,
and
so
I
was
like,
but
we
do
support
rel
eight
containers
on
rel,
seven
like
we
do
support
that
at
tier
two.
So
let's
bring
a
podman
container
back
and
run
podman
in
a
container
using
the
version
apartment.
A
B
C
I
will
I
will
plug
the
alternate
route
there
with
kind
of
relate
beyond
right.
Is
that
the
that's?
This
is
actually
the
goal
of
something
like
app
streams.
Right
is
also
part
of
trying
to
solve
that
same
problem,
and
we,
when
we
were
developing
that
project
you
know
we
we
often
refer
to
the
too
fast,
too
slow
problem,
and
you
know
so.
We
have
customer
a
right
who
says
I
need
the
latest
version
of
podman.
C
Oh,
but
don't
change
anything
else,
right
yeah,
you
know,
but
then,
at
the
same
time
you
have
someone
else.
Who's
like.
Oh,
my
entire
infrastructure
is
working
on
podman.
You
know
ancient
right
or
whatever,
but
I
need
new
hardware,
so
you
know,
please,
you
know,
use
the
older
version
of
podman
on
the
latest
version
of
things
yeah.
So
I
think
when
you're
for
coming
from
the
perspective
of
a
kind
of
a
single
customer
or
a
single
user,
you
always
have
a
complaint.
B
A
To
ubi
build
a
and
scopia
will
drop
in
ubi
in
relate
four
and
then
the
plan
is
to
add
podman
in
related
five.
So
there's
a
podman
image
today,
that's
tech
preview,
but
you
have
to
have
a
real
subscription
and
you
have
to
authenticate
to
grab
it
but
like
in
and
but
in
when
rel84
drops
here
in
a
few
weeks,
you'll
you'll
see
build
it
in
scorpion.
Those
are
those
are
fully
supported
on
rel,
but
they're
also
g8.
A
C
So
so
it
is
accessible
for
you
know
without
paying
money,
it's
just
that
it's
not
accessible
without
kind
of
agreeing
to
the
t's
and
c's
at
the
moment.
That
brings
up
a
really
good
point.
We
actually
had
the
question
with
brent,
you
know,
but
we
were
joking
around
about
how
we
never
actually
know
when
anything's
going
to
release.
So
it's
nice
to
have
product
managers
on
occasionally
who
who
are
like
oh
yeah
here,
is
exactly
when
this
is
going
to
happen.
So
it's
good
to
hear
so.
A
Well,
technically,
today,
even
in
ireland,
three
is
when
we
released
a
podman
container.
To
be
honest
with
you,
I
wasn't
happy
with
the
ux
of
it.
I
think
the
ux
is
a
little
funky.
You
still
have
to
run
it
as
a
privileged
container,
which
is
fine
yeah,
but
you
have
to
run
it
as
dash
dash
privilege.
We
are
working
on
like
dan,
especially
this
week.
I
know
he's
been
working
on
all
kinds
of
different
ways.
A
You
can
run
it
and
we're
looking
at
like
what
modifications
we
can
make
in
the
container
image
to
make
it
easier
to
use
etc.
Like
we're
looking
at
improving
the
ux
over
the
next
dot
release,
so
that
like
when
we
release
it
and
roll
it.
You
know
we're
gonna,
ga
podman
in
a
container
on
rel
in
eight
five
is
the
plan
and
then,
when
we
ga
so
I
have
this
rule,
I
don't
really
say
anything
into
ubi
unless
it's
ga
so
like
that's.
A
Why
build
and
scope
you
are
dropping
in
in
in
ubi
and
eight
four,
because
they've
those
container
images
are
already
ga
and
then,
when
podman
ga
is
in
a
container
and
then
the
ux
is
good,
I
feel
like
it
passes.
All
the
sniff
tests
like
qe
is
good.
Our
docs
are
good,
then
we
j
it
and
then
it'll
drop
in
ubi,
so
it'll
be,
like
you,
said,
redistributor
without
a
subscription
and.
C
Just
you
can
test
it
today
for
anybody
who's
new
to
the
show
build
so
pod
man,
as
we
jokingly
refer
to,
is
often
referred
to
as
a
rapper.
Yes,
you
know,
and
so
it's
podman
the
rapper,
which
we
still
don't
have
t-shirts
for.
No,
I
have
a
t-shirt
for
it,
you
don't,
I
don't
have
a
t-shirt
for
it.
That's
true,
but
so
build
is
kind
of
the
build
component
of
podman.
Scopio
is
kind
of
the
search
and
and
kind
of
delivery
side
of
body
man.
C
Right,
okay,
so
and
then
so,
pogba
is
kind
of
an
experience
for
the
for
the
overall
set
of
things
that
you
need
to
do
with
containers.
But
if
you
want
to
do
like
build
a
ci
engine,
for
example,
you
might
want
to
just
include
builda,
for
example,
because
you
don't
you
don't
need
all
of
podman.
You
just
want
to
build
infrastructure.
So
that's
why
it's
it's!
You
know
it's
kind
of
built
in
the
unix
philosophy
of
you
know.
C
Each
tool
does
a
job,
but
then
sometimes
you
want
to
wrap
those
together
to
give
you
a
full
experience.
So
we
had
a
question
come
up
in
the
chat.
We
had
a
couple
questions.
Do
you.
I
was
gonna,
go
off
and
talk
about
ubi
versus
ubi,
minimal
versus
the
rel
image.
But
is
there
another
question
we
should
answer
before?
That's
quicker
than
that.
B
C
Right,
so
we
can
eliminate
confusion
so,
okay,
so
that's
what
I
was
going
to
kind
of
go
to
scott
was
is
like
okay.
So
if
I
go
and
look
for
a
base
image
from
red
hat,
let's
ignore,
for
the
sake
of
argument
of
the
kind
of
the
strongly
built
images
so
like
the
ones
that
already
have
apache
and
php
and
all
that
jazz
right.
Instead,
let's
just
talk
about
kind
of
the
more
basic
ones,
so
we
have
to
the
best
of
my
knowledge.
C
A
Yes,
so
so
in
rel
how
to
word
this
so
in
rel,
seven,
let's
start
with
the
history,
so
in
rail
seven
we
had
that
the
end
user
license
agreement
was
only
the
the
rel
end
user
license
agreement
which,
which
back
in
the
day,
the
way
you
would
install
software.
Was
we
delivered
industrial-grade,
flour,
industrial-grade
sugar,
you
know,
industrial-grade,
you
know
water
like
in
big
bins
bags
and
boxes
and
barrels
to
our
customers,
and
then
they
mixed
it
all
together
and
they
made
cakes
at
scale
right
like
that.
A
That's
what
we
sold
enterprise
software,
and
so
it
was
really
fine.
When
the
when
the
you
know
the
sysadmin,
architects
and
developers
all
mix
the
cake
on
premise
in
a
data
center
or
a
shared,
you
know
blah
blah
blah.
That's
how
our
original
entitlement
model
was
based
around.
All
of
that
like
we
would
sell
the
company
a
subscription
and
then
they
could
use
whatever
they
wanted
in
that
industrial
data
center
you
know
or
whatever
they
had
they
bought
whatever
subscription.
A
These
locks,
keep
honest
people,
honest
and
that's
all
this
is.
This
is
like
a
legal
agreement
to
keep
honest
people
honest
now
that
said
that
breaks
down
when
you
get
into
containers
and
when
we
released
docker
and
rel7,
we
still
had
the
container
images
protected
by
the
exact
same
end,
user
license
agreement
as
the
bits
for
the
servers,
and
so
we
had
customers
that
couldn't
they
would,
they
would
create
a
container
image
with
rail
seven
and
then
they
would
go
to
redistribute
it
to
their
friends.
But,
oh
I'm
not
allowed
to
do
that.
A
You
know
like
I
contractually
I'm
not
supposed
to
do
that,
and
it
took
us
a
while
to
figure
out
how
to
do
this
in
a
way
that
was
that
made
sense,
and
so
when
we
launched
rail
eight,
we
came
up
with
this
concept
of
ubi,
which
is
really
just
a
yua.
To
be
honest
with
you,
it's
a
legal.
It's
a
different
end
user
license
agreement.
A
It
is
not
actually
different
bits,
although
people
perceive
it
as
that,
because
it's
just
how
human
brains
work,
but
it's
actually
nothing
more
than
a
different
end
user
license
agreement
that
allows
people
to
redistribute
the
set
of
content,
that
is
in
ubi,
which
is
a
subset
of
rel.
And
it's
not
all
the
things
that
red
hat:
it's
not
layered
products,
it's
not
openshift.
It's
not.
I
mean
it
is
openshift
because
openshift
comes
with
rel,
but
it
it.
It
comes
from
rel,
it's
always
a
subset
of
raw.
A
Now
that
said,
there
are
three
ubi
base
images.
I
manage
the
base
images,
other
people
manage
the
layered
ones
like
python
and
ruby.
Actually,
brian
galahar
manages
ruby
and
python
and
all
the
layered
ones
that
are
like
programming
and
actually
other
people
manage
other
ones
like
because
there's
a
bunch
of
different
subsystem
teams
in
rel
so
like.
A
I
will
specifically
talk
about
the
base
images,
even
though
I
know
how
all
the
others
they
all
fall
under
that
same
ubi,
eula,
so
they're
all
ubi
in
people's
minds,
but
they're,
really
just
rel
released
under
a
different
end
user
license
agreement.
Now
that
said,
there
are
three
based
images.
Today
there
is
minimal
standard
and
the
one
that
has
system
d
in
it.
A
You
know,
like
it'll,
trim
out
a
few
megabytes.
I
think
it's
like
a
hundred.
I
forget
what
the
latest
version
in
relate
is
but
call
it
110,
ish
megabytes
and
then
the
standard
is
about
you
know,
or
maybe
it's
about
130
megabytes.
The
standard
is
about
205
ish
and
then
the
init
is
about
like
208
ish.
You
know
it
adds
another
couple
megabytes
for
the
few
things
we
had
for
systemd.
A
Those
are
the
three
ones
today,
now
being
honest,
80
of
the
users
end
up
just
seeing
ubi
minimal
and
just
going
for
that,
and
then
what
happens
is
a
lot
of
times.
They'll
add
packages.
Sometimes
it
even
ends
up
adding
regular
yum,
because
yum
or
you
know,
yum
slash,
dnf
gets
pulled
in
as
a
dependency,
and
so
it
ends
up
having
micro,
dnf
and
dnf.
And
you
know,
and
next
thing.
A
But
it's
what
happens.
It
still
doesn't
matter.
I
look
at
her
download
numbers.
Eighty
percent
of
the
people
are
using
ubi
minimal
right,
or
at
least
eighty
percent
of
the
automated
builds
that
are
probably
driving.
This
are
now
in
rel
84,
we're
adding
one
more
we're
adding
ubi
micro,
ubi
micro
is
special.
It
is
actually
truly
different
than
the
other
ones.
It
has
no
yum
and
dnf
installed.
It
has
no
rpm
command,
it
has
nothing,
you
can
fire
it
up
and
you'll
be
like.
Oh,
this
is
cool.
I
can
run
bash.
C
A
A
A
You
know
slash
dnf
in
relate
for
on
the
host
to
then
like
do
the
dash
o,
you
know
install
into
a
directory
and
you'll
like
basically
install
into
a
mounted
ubi,
and
then
you
will
create
another
layer,
and
then
you
will
commit
that
layer.
But
the
beauty
of
this
is
this:
has
three
beautiful
things
like
you're
using
trusted
rail
content?
So
the
quality
of
the
content
is
really
good.
You
are
not
adding
new
packages
into
your
environment
that
are
not
already
part
of
rel,
so
you're
not
expanding
your
attack.
A
You
know
footprint
your
attack
surface,
because
if
you
already
have
these
packages
on
a
rel
host
somewhere,
somebody
can
theoretically
attack
these
you're
just
adding
the
exact
same
packages
on
a
rel
host
into
the
container
image,
so
you're,
basically
keeping
the
environment
minimal.
The
total
permutation
set
of
packages
that
you
have
in
your
environment
and
then
third,
the
actual
individual
container
image,
is
pretty
damn
tiny.
We
can
get
it
down
like
a
base
image
right
now.
It's
like
12.9
megabytes
compressed
and
about
38
megabytes
uncompressed,
and
then
we
can
build.
A
You
know
like
say
you
just
want
to
use
apache,
you
may
be
able
to
use
a
copy.
You
know
just
copy
some.
You
know
like
a
web
root
in
and
do
some
of
that
you
may
be
able
to
consume
some
of
those
without
having
to
muck
with
them,
but
the
ubi
micro,
that's
coming
out
really
you'll
have
to
use
builder
to
add
anything
to
it,
but.
C
A
C
A
I
am
planning
on
doing
is
not
even
using
a
multi-stage
build
one
of
the
features
that
got
overlooked
and
this
is
pure
incidental,
I'm
like
99
sure
this
is
incidental.
I
still
I
talked
to
valentino
about
it.
Last
week,
a
little
bit
and
talked
I
haven't
had
a
chance
to
bring
up
with
dan
and
brent,
but
but
in
a
nutshell,
the
dash
dash
mount
option
is
missing.
With
podman
build.
A
We
have
the
dash
v,
bind
mount
option,
but
we
don't
have
the
dash
mount
option.
The
dash
mount
option
does
some
really
freaking
cool
stuff.
You
can
bind
you
can
mount
container
images.
People
don't
realize
this.
You
can
actually
like
specify
a
container
image
and
then
give
it
a
mount
point
inside
of
the
container
that
you're
firing
up
and
it
will
just
show
up
as
a
directory
but
you're
like
mounting.
A
Now
imagine
a
scenario
where
I
have
a
docker
file
that
bind
mounts
regular
ubi.
I
run
the
yum
tools.
You
know
yum
and
rpm
from
the
regular
ubi
image
right
to
add
packages
into
the
ubi
micro.
Then
do
a
yum
clean
all
and
then
save
that
extra
layer,
and
I
can
do
it
with
like
two
commands
in
a
docker
file
like.
C
C
A
Doing
like
a
I
looked
last
week
at
everything
I
looked,
you
can
do
a
podman
mount
on
the
ubi
micro
image.
If
you
want
or
build
a
mount,
then
you
could
like
mount
that
into
a
container.
You
know
and
then
basically
install
into
that
directory.
You
can
do
some
hacky
things
to
kind
of
make
this,
but
I
want
to
be
super
elegant.
I
want
to
be
like
a
single
command
single,
build
command.
Very
simple,
docker
file,
like
you
know,
container
file.
A
I
want
to
be
like
two
three
lines
in
the
docker
file
and
a
single
build
command,
and
once
we
add
the
dash
dash
mount
option
to
the
build
you
know,
pod
man
build
dash,
mount
equal
and
then
you'll
build
a
specified
container.
Then
within
the
docker
file,
we'll
we'll
probably
be
able
to
do
something.
You
know
tricky
with
the
paths
and
the
library
paths
to
make
sure
that
you
can
just
run
the
young
command
and
it
looks
like
it's
natively
installed,
even
though
it's
not
it's
actually
coming
from
the
other
image.
C
C
The
rocket
model
which
very
few
people
have
any
experience
with,
which
is
that,
essentially,
you
can
kind
of
build
up
a
container
image
using
build
a
commands
and
that,
like
feeding
in
a
docker
file,
is
actually
almost
like
a
secondary
activity
like
so,
basically
what
it's
doing
is
actually
just
kind
of
feeding
that
set
of
commands
if
you're
doing
docker-
and
you
don't
know
what
you
want
to
build
right.
What
you
typically
do
is
you,
you
know,
take
some
sort
of
base
image
you
log
into
it.
Then
you
install
the
stuff.
C
You
want
and
set
up
all
the
stuff
you
want,
and
then
you
do.
Essentially
you
go
outside
and
do
a
docker
commit
right.
Podman
has
that
support
as
well,
but
if
you're
doing
it
with
builda,
it's
actually
slightly
different
in
that
you
can
actually
give
it
the
set
of
commands
that
you
want
to
build
and
you
will
get
container
images
along
the
way.
C
So
it
has
somewhat
more
flexibility
about
building
up
a
container
than
a
container
file
would
do.
The
downside
is
that
it
doesn't
have
the
the
ease
of
use
that
a
container
file
distributed
right,
but
you
can
get
to
very,
very
nice
clean,
quick
images.
You
know
essentially
with
a
bash
script.
Instead
of
feeding
in
a
container
file.
You
know.
Container
file
in
a
lot
of
ways
is
basically
a
bash
script,
but
if
you
use
an
actual
bash
script
with
builda,
you
can
actually
get
to
some
cleaner
containers.
C
C
Just
follows
that
the
style
of
how
rocket
worked-
and
it
was
interesting
in
the
early
days
right
rocket-
was
very
much.
The
tool
of
choice
for
sys,
admins
and
developers
tended
to
focus
on
docker,
and
you
know,
and
so
eventually
they
kind
of
came
together,
at
least
in
my
opinion.
Right
and
now
we
have
kind
of
build
a
which
gives
you
that
really
tight,
tight,
tight
containers.
C
If
you
want
them,
you
know
so
you
know
appealing
to
the
kind
of
sysadmin
side
of
the
world,
whereas
developers
or
casual
users
in
a
sense
can
can
still
use
something
like
container
file
and
feed.
That's
podman
and
everything
just
works.
You
can
actually
feed
it
to
build
it
directly,
but
podman
makes
a
nicer
wrapper
around
it.
A
A
Yeah
but
but
no
now,
you
asked,
though,
about
rel
images
so
like
for
each
of
these
so
rel7
they
were
all
rel
images.
They
had
the
rel
end
user
license
agreement,
there
was
no
ubi
eula,
then
we
added
the
ubi
when
we
launched
relate.
We
actually
added
a
set
of
container
images
for
rel
seven.
There
were
identical
bits
that
had
the
ubi
euler
and
then
we
did
the
same
thing
in
rel
eight
for
compatibility.
A
We
left
the
rel
eight
bass
images
in
place
just
like
round
seven.
We
don't
necessarily
recommend
that
anyone
ever
uses
them,
but
we
wanted
them
to
be
there
just
in
case
other
layered
products
and
some
companies
were
building.
You
know
like
who
knows
what
weird
stuff
in
rel
nine,
to
be
honest
with
you
will
probably
get
rid
of
you
know
there
probably
won't
be
a
rel
nine
image.
A
There
will
only
be
ub
i9,
you
know
it's,
it's
really
a
matter
of
whether
the
eula,
whether
we
need
the
other
euro
or
not
like
do
we
need
the
regular
relu
for
some
of
the
container
images
and
some
of
them
we
did
so.
We
ended
up
having
both.
Actually
I
just
remembered,
we
made
a
decision
that
we
will
end
up
still
having
the
rel
nine
mounts.
C
A
A
Yeah
and
they're-
probably
no
that
well,
that's
not
even
how
well
yes,
because
you're
right,
you're
right,
because
ubi
does
have
an
extra
text
file
in
the
yum.d
directory
where
it
points
to
ubi
and
then
the
rel8
one
doesn't
have
that
that's
correct
and
then
okay
and
then,
but
they
both
in
the
the
rel
channels,
actually
come
from
the
host
not
from
the
image.
So
actually
there's
nothing
in
the
related
image,
that's
different!
C
A
C
That
you
know
this
hey
this
ubi.
You
know
this
image
that
I
built
or
whatever
this
container
file
isn't
gonna
work
unless
you
do
it
on
a
subscribed
machine.
There's
no
way
for
me
to
tell
a
user
that
without
essentially
a
comment
in
the
docker
or
in
the
container
file,
which
you
know
it's
unfortunate,
but
it's
kind
of
the
way
the
infrastructure
is,
and
we
don't
want
to
rock
the
the
you
know,
muscle
memory
boat
right
on
changing
how
people
do
things.
A
C
B
A
A
One
of
their
strategic
initiatives
to
basically
minimize
rel,
you
know
minimize
fedor,
I'm
sorry
because
it
not
just
for
containers
but
for
everything
for
like
a
core
os
style
use
case
for
edge
use
cases
for
all
kinds
of
things,
but
it
is
really
really
hard
to
go
to
every
think
about
how
many
packages
are
in
fedora.
There's
like
I
don't
remember,
20
000
packages
or
whatever
so
you've
got
to
go
to
every
package.
Maintainer
every
subsystem,
team
and
you've
basically
got
to
educate
them
on
why
they
have
to
go.
A
Do
a
bunch
of
work
that
they
don't
want
to
do
like
you're
like
it's
just
like
everything
else
in
the
world.
You're
like
wait
a
minute.
Why
do
I
got
to
change
this?
This
isn't
broken
like
like
and
you're
like.
Oh,
you
should
make
this
a
soft
dependency.
You
should
do
this.
You
should
do
that.
You
should,
and
you
sound
like
that
guy,
like
you're
like
you,
come
up
you're
like
you
know
what
you
need
to
do.
A
B
A
That's
how
all
these
sub
system
teams
feel
right
like
so
so,
basically
adam
built
this
really
cool
tool
and
he's
been
working
on
this
project
for
a
long
time
to
like
basically
show
people
all
the
dependencies
that
get
dragged
in
and
why
and
kind
of
get
them
to
like
open
their
eyes
and
go.
Oh,
maybe
I'm
pulling
in
some
dependencies
that
I
really
shouldn't
be
and
then
specifically
we're
working
with,
like
the
glibc
team,
to
do
all
kinds
of
cool
things
like
pull
out
all
the
tz
data,
except
for
utc.
A
C
A
To
do
that
right,
you
have
to
have
separate
packages
in
fedora
and
rel,
and
that's
why
the
gwc
team?
This
is
a
lot
of
work
for
them.
Right
like
they
got
to
basically
break
their
package
up
into
a
whole
bunch
of
other
sub
packages,
and
then
that
adds
more
metadata
to
rpm
and
and
yum,
which
then
actually
over
time
with
enough
patches
actually
slows
down
container
builds.
So
like
one
of
the
other
features
in
ubi,
is
it
only
has
the
metadata
for
the
latest
and
it
doesn't
it
doesn't
leave
it
doesn't?
A
It
only
has
the
latest
of
everything
so
like
it's
super
fast
to
build
compared
to
a
relevant
image,
because
rel
has
to
look
for
every
version
of
every
package,
pull
all
that
metadata
on
ubi
just
has
the
latest
of
everything:
that's
one
other
little
side
benefit
of
vbi,
but
but
yeah.
This
is
a
lot
of
work.
This
is
like
years
in
the
making
to
minimize
a
dependency
tree.
That's
been
built
up
over
20
years,
you
know,
so
it's.
C
A
Yes,
some
of
that
I
agree
on
that.
Another
thing
is
it's
a
misperception
like
if
you
look,
I
I
have
this
article.
That's
wildly
popular
called
comparison
of
container
images.
If
you
compare
alpine
ubuntu
fedora
rel,
centos,
blah
blah
blah
name,
another
distribution,
you
know
debian
and
you
add
java
like
headless
blah
blah
blah
jvm
they're,
all
about
the
same
size,
they're
all
about
350
megabytes,.
A
A
The
same
size
almost
and
then
and
then
I
talk
to
customers
and
partners
all
the
time
that
are
embarrassed
but
they're
like
yeah.
We
have
this
like
1.5
gigabyte
image
after
we
add
all
our
stuff
to
it
and,
like
they
kind
of
say
it
quietly
like
that
they
go.
You
know
I
mean
it's
like
1.5
gigabytes,
you
know
and
you're
like
I
mean
dude,
I'm
not
I'm
not.
Judging
you
know
like
like
I
mean
it
is
what
it
is
like.
There
was
a
saying
back
in
the
day
when
I
started
red
hat
10
years
ago.
A
A
So
like
right,
a
container
image
is
small
until
you
add
an
application
and
as
soon
as
you
add
the
actual
thing
that
you
need
to
do,
it's
going
to
get
big
like
it's
going
to
get
way
bigger
some
people,
some
hipsters,
some
cool
kids.
They
are
running
like
go
lang,
binaries
and
c
binaries,
and
those
people
have
like
five
megabyte
images.
Good.
B
C
Choice
under
some
cond
like
if
you
want
to
go,
build
that
java
image
and
go
build
it
by
hand
and
put
only
the
stuff
in
there
that
you
want.
That's
fine,
you
know.
Let
me
know
in
a
year
when
you're
done
with
that,
you
know,
instead
of
you
know
me,
be
able
to
write.
You
know
a
single
line
in
a
container
file
and
be
done.
C
That's
the
trade-off,
and
sometimes
it's
worth
it,
but
I
think
that
you
know,
as
the
the
joke
is
already
starting
in
the
audience,
and
I
was
thinking
this
too.
You
know,
but
the
the
the
shaming
of
the
container
sides
you
know
is
like
recognize
what
you're
doing
here.
This
is
a
trade
press
story,
not
a
way
of
comparison
right
I
mean,
like
I
actually
just
saw
an
article
about
how
the
new
x1
from
lenovo
is
too
thin,
like
it
doesn't
like
it's.
It's
like
they're,
like
yeah.
B
C
B
B
A
A
Bmw
is
probably
one
of
the
best
cars
on
the
planet
because,
like
there's
50
million
of
them
and
they
get
all
that
user
feedback
and
it
gets
super
refined
and,
like
I'll,
be
honest
with
you
like
an
audi
a4
like
a
three
series,
a
c-class,
those
are
probably
the
best
cars
in
the
world
because
there's
enough
of
them
that
you
get
enough
feedback
that
they're
really
refined.
But
you
get
into
the
higher
end
ones.
They
have
more
quirks
even
even
the
highest
end,
mercedes
you're,
going
to
get
more
and
more
quirks
the
higher
end.
C
B
C
C
A
Yeah,
this
is
an
interesting
question.
I
get
all
the
time
like
so
so
it's
so
funny.
People
are
like.
We
need
to
harden
the
image,
I'm
like
what
does
that
even
mean
like
what
does
that
mean
like
there's
this
perception
that
I
get
this?
It's
like
it's
like
me
when
I
buy
a
new
car
and
then
I
gotta
modify
it.
I'm
like
I
wanna
tune.
The
like
my
my
crossfire
is
all
super
modified.
I
changed
the
differential.
A
A
I
can
race
this
thing,
but,
like
it's
stupid
like
like
like
for
a
daily
driver,
this
is
not
something
you
need
to
think
about,
but
like
this
is
how
people
feel
with
ubi
images
like
ubi
images
are
relevant,
so
the
the
all
the
binaries
are
hardened
with
like
pia,
and
all
these
other
things
like
in
that.
In
that
comparison
of
container
images,
I
go
through
and
show
all
the
security
technologies
that
we
use
to
harden
all
the
binaries
that
are
in
these
container
images.
A
So,
first,
let's
back
up
and
say,
containers
are
not
real,
like
like
they're
just
processes,
they're
just
fancy
processes
with
more
constraints
around
them.
The
host
is
responsible
for
placing
those
extra
constraints
around
them,
not
the
container
image.
The
container
image
is
nothing
more
than
binaries
packaged
in
a
tarball,
so
like
you're
like
well.
What
how
do
I
harden
these
binaries
packaged
in
a
tarball
like
say
that
out
loud
and
you
go.
B
A
I
mean
I'm,
I
guess
that
yeah
that
doesn't
make
a
lot
of
sense
like
like
you,
don't
harden
that,
like
not
really,
I
mean
there's
a
few
little
things.
People
do
like
I'll
admit.
There's
things
like
government
has
requirements
for
message
of
the
day.
Things
like
that
so
like
when
you
fire
a
container.
It
literally
has
to
have
a
stupid
message
of
the
day,
those
kinds
of
things.
A
So,
like
you
again
do
that
from
the
host
the
se
linux
rules
are
governed
by
podman,
which
talks
to
you
know
has
its
own
seo
linux
library,
and
then
each
of
the
containers
are
fired
up
in
their
own
sc
linux
context,
so
they're
automatically
more
isolated
than
any
binary
that
you're
running
on
a
rail
hose
so
like
today.
If
you
run
two
copies
of
apache,
they
run
in
the
same
context
like
they
can
both
access.
A
The
same
file
systems
they
can
access
the
same
ports,
blah
blah
blah
like
if
you
run
them
in
two
different
podman
containers,
they're
actually
ran
in
dynamically
generated
seo
linux
context.
They
can't
talk
to
each
other's
ports.
They
can't
talk
to
each
other's
files.
They
can't
talk
to
like,
and
nobody
even
notices
that
seo
linux
is
on
that.
In
my,
like,
I
would
say,
95
of
the
hardening
comes
from
the
host.
A
Maybe
five
percent
comes
from
the
tar
ball,
with
binaries
in
it
right
and
and
and
in
it,
and
when
I
say
that
I
mean
in
addition
to
whatever
rel
already
does
like
rel
does
all
kinds
of
crazy
stuff
to
its
binaries
to
make
sure
they're,
hardened
and
crazy.
You
know
you
know
already
so
like
those
binders
are
pretty
good,
like
there's,
definitely
work
that
gets
done
there,
but
there's
nothing
that
you
need
to
do
when
you
buy
it.
It's
like
it's
like.
I
just
bought
a
tractor
trailer
like.
A
A
Although
I
get
that
question
all
the
time
well,
there
are
dod
standards
for
certain
things
and
I
have
been
looking
at
I'll
confess
some
metadata
here,
because
since
I'm
a
pm
but
like
I
have
been
talking
to
some
dod
people
and
thinking
about
how
we
might
produce
a
dod
specific
version
of
ubi
because
they
have
their
weird
requirements,
I'm
not
even
sure
that
I
would
call
those
actually
more
secure
but
like
nonetheless,
it's
just
like
what
they
want.
So.
C
That
was
actually
specifically
why
I,
like
the
phrasing
of
this
question,
which
is
was
not
the
you
know.
What
do
I
need
to
do
to
secure
a
container,
but
instead
the
okay?
I
know
by
default
that
if
I
go
into
a
rel
container
I
can
I
can
have
an
expectation
that
red
hat
has
made
that
a
secure
thing.
Are
there
things
about
ubi
that
I
should
be
aware
of
that
you
had
to
step
back
from
that
because
it's
lighter
weight
or
redistributable
or
any
of
those
things,
and
it
sounds
like
the
answer
is
no.
A
C
C
Yeah,
actually
speaking,
which
I
finally
got
confirmation
from
somebody-
we
were
talking
about
earlier
brian
cook,
that
he's
going
to
be
on
the
show
not
for
a
while,
but
eventually
that
we're
going
to
talk
about
the
health
index
in
the
red
hat
container
catalog,
which
I
think
is
another
thing-
that
people
don't
kind
of
really
look
at
too
often,
but
basically,
everything
in
the
red
hat
container
in
a
catalog
is
scanned
quay.
Does
this
as
well?
We
were
talking
about
this
on
the
show,
but
is
scanned
for.
C
A
It's
trust
but
verify
we
try
to
show
you
the
verify
like
right
and
what
people
don't.
This
is
this
process
on
another
interesting
question:
I'm
sure
we
have
questions
around
is
container
image
scanners
so,
like
I've
talked
to
the
stack
rocks
guys
already
since
we've,
you
know,
since
we've
made
that
agreement
to
buy
them,
and
I've
talked
to
a
million
partners
of
ours
that
already
do
this
scanning
software
is
only
as
good
as
the
metadata
that
it's
consuming
or
and
or
that
company
invents.
A
It
is
a
nightmare
to
scan
container
images
that
are
built
from
scratch,
like
like
when
I
say
scratch
like
a
c
binary
that
you
compiled
yourself,
threw
it
in
a
threw
it
in
a
container,
and
you
know
tarball.
You
know
basically
and
then
sent
to
somebody
like
hey
scan.
This
tell
me
if
it's
secure,
like
I
don't
know
like.
I
have
no
idea
if
that's
secure
like
if
you
statically,
compile
a
c
binary
or
go
link
binder
and
send
it
to
somebody,
I
will
challenge
them
to
analyze.
A
Like
sure,
there's
decomposers
and
you
can
decompile
things
and
like
look
at
them
and
like
analyze,
the
decompiled
code,
but
there's
no
way
to
truly
look
at
a
binary
most
of
the
time.
What
we
actually
mean
is
c
binaries
that
are
dynamically
linked
against
libraries
that
come
from
a
linux
distro
and
now
we're
going
and
talking
to
that
linux,
distro
and
saying:
hey:
did
you
guys
patch?
The
cv?
Did
you
patch
this
cv?
Did
you
pass
this
other
cv
and
you
go
yes?
A
Yes,
yes,
that's
called
metadata
like,
like
that's
like
red
hat,
provides
a
ton
of
xml
metadata
that
we
actually
transparently
show
people
which
cvs
we've
patched,
which
ones
we
haven't
blah
blah
most
linux
sisters.
Don't
even
have
that
like
they
don't
even
have
something
like
that.
So
most
of
the
time
scanners
are
taking
a
while
to
ask
guess
about
whether
something's
patched,
based
on
the
version
number
they're.
Like
oh
look,
that's
a
new
version
number
and
I
know
it's
patched
up
stream.
So
so
that
must
work.
C
Right
I
mean
this.
This
is
actually
a
problematic
area
in
rel
all
the
time,
because
people
will
get.
You
know
basically
bad.
You
know
security
warnings
from
you
know
like
say
particularly
like
rel,
seven
or
like
a
rel
six
library,
because
we
back
ported
a
patch
into
it,
so
the
version
number
hasn't
changed
because
it
still
has
to
be
backwards
compatible,
but
wherever
possible
we
actually
back-ported
the
cd
into
it.
So
when
you
just
go,
look
at
the
version
number,
it
doesn't
actually
tell
you
that
the
patch
is
is
there.
C
A
To
install
three
four
different
linux,
distros
analyze
them
scan
them
and
do
a
ton
of
work.
Now
they
just
do
pod
man
pull
pod
man
pull
pod
man
pull
pod.
Man
pull
run
scanner.
You
know
like
okay.
Why
is
this
different?
You
know
like
it's
a
lot
easier
to
question.
It
not
understand
it,
and
so,
like
you're,
getting
a
consumer
closer
to
a
consumer
level.
You
know
analysis.
A
A
B
C
That
I
really
wanted
to
get
to,
which
is
you
know,
and
so
we'll
give
you
scott
a
chance
to
think
about
it,
for
a
second
is
like:
what's
what
new
feature
or
features
or
whatever
that's
coming
down
the
pipe
for
ubi?
Are
you
most
excited
about
that?
We
should
get
excited
about,
but
before
we
delve
into
that,
let's
talk
about
our
sweet,
sweet
internet
points
and,
let's
see,
does
scott
remember
what
the
sweet
sweet
internet
points
are
from
the
last
time
you
were
here.
C
C
C
C
Yeah,
so
we
hope
they
come
back
and
then
detective
conan
kudos.
Definitely
you
know
making
some
forward
progress.
You
know
and
we
regularly
talk
about
fedora
as
well
with
him
and
then
lastly,
bacon
fork,
definitely
on
the
up
and
up
and
then
the
people
we
featured
from
last
time.
I
saw
some
more
points
getting
added
there,
so
we
will
feature
them
again
in
a
future
episode
once
we
we
see
their
numbers
continue
to
go
up.
C
C
C
C
C
So
you
know,
let
me
grab
a
link
to
that,
but
there's
an
activity,
oops,
there's
an
activities
page
in
the
repo
for
with
the
show
notes
which
I'm
gonna
put
the
link
in
the
chat
that
has
other
ways
that
you
can
earn
points
as
well.
So
we
always
love
people
earning
points.
I
think
they're
a
lot
of
fun,
so
you
know
please
submit
them
at
your
earliest
opportunity
if
you
join
the
discord
and
want
the
points
for
joining
the
discord.
C
C
There's
all
kinds
of
crazy
plug-ins
for
it
like
I
saw
a
calendaring
event
app
that
I've
been
trying
to
get
the
hang
of
it's
weird
it.
It
works
pretty
well,
except
it
doesn't
understand
24
hour
time,
and
I
was
just
like
really.
This
seems
really
obvious,
so
yeah,
so
actually
just
to
by
way
of
point
in
the
chat.
Narendev
has
opened
a
few
issues
and
that's
part
of
how
he
has
moved
up
in
his
points
and
some
of
those
ideas.
C
A
C
C
C
So
like
labs
or
like
you
know,
other
kinds
of
workshops,
and
so
that's
that's
kind
of
the
idea,
and
I
I
don't
know
scott
are
you
you
know,
I
don't
know
if
you
have
anything
in
the
the
pitch
bucket
for
it.
I
know
there's
container
stuff,
I
know
I
the
thing
I
reason
I
know
about.
It
is
because
my
lab
that
I've
been
doing
for
several
years
at
summit,
which
is
about
containerizing
applications
and
bringing
them
to
openshift.
That's
in
the
the
offing
for
it.
C
B
C
Yeah,
so
I
just
need
I
need
so
we're.
I
guess
we're.
We
have
a
we're
on
the
short
list
for
labs
right
now.
So
there's
I
don't
know
20
30
40..
I
have
no
idea,
but
they're
only
going
to
choose
20
of
the
total,
so
I'm
still
I'm
still
not
completely
in
yet
so
yeah.
They
know
who
you
are
you're.
The
illustrious
language
hey
yeah
by
and
my
lab
is
usually
very,
very
popular,
but
I
know
scots
have
been
in
the
past
as
well.
So
who
knows
I'll.
C
A
I'm
most
excited
about
the
road
map
for
ubmicro
and
what
else
we
can
build
using
that
I
think
it
we
have
some
just
being
super
transparent.
We
have
some
internal
build
challenges,
figuring
out
how
we're
going
to
build
on
ubi
micro,
but
once
we
figure
that
out,
then
I
think
we
can
build
out
a
family
of
other
images
that
are
built
on
ubi
micro.
Some,
my
fingers
are
crossed.
We
can
unblock
things
by
like
the
real
nine.
B
A
A
Then
I'm
excited
about
some
of
the
work.
The
glibc
team
is
doing
to
try
to
yank
out
another
couple
megabytes
here
and
there,
like
my
understanding,
is
like
we
probably
have
a
road
map
to
get
rid
of
another
12
13
megabytes.
So
now
we're
like
down
to
like
28
megabytes
uncompressed,
maybe
even
25,
megabytes
uncompressed,
and
then,
who
knows
what
compressed?
Maybe
10?
You
know.
I
don't
know
I'd
be
pretty
happy
with
that
like
if
we
can
get
to
that
level.
A
I'm
like
super
stoked
now
we're
getting
into
that
alpine
size,
but
still
using
the
rail
content,
which
I
think
is
very
good
quality
and
and
then
also
not
expand.
You
know
if
you
use
alpine
with
a
rel
like
say
you
use
alpine
on
openshift
you're,
still
increasing
your
attack
service,
even
though
you
don't
realize
it
because
you're
bringing
in
all
the
versions
of
libraries
that
are
in
alpine,
that
aren't
in
openshift,
and
so
now
you
I
mean
by
definition,
you're,
adding
new
permutations
of
packages
and
things
so
yeah.
C
C
Yeah
and
the
thing
that
one
of
the
things
that
was
so
like
shocking
for
me
in
a
sense
is
like
they
were
talking
about.
Trying
to
get
you
know,
minimal
and
part
of
the
part
of
the
activity
was
also
trying
to
get
boot
times
faster.
That
kind
of
stuff
as
well,
and
one
of
the
things
that
just
blew
my
mind
was
how
proud
the
fedora
team
kind
of
in
general
was
that
we
had
gotten
from
four
different
encryption
libraries
that
were
required
for
boot
down
to
two
and
a
half.
A
C
C
You
know
based
on
what
language
you're
actually
building
your
software
in
and
all
that
kind
of
stuff,
and
so
you
kind
of
have
this
plethora
of
things
that
that
come
out
of
that,
but
we've
been
making
progress
like
you
know,
we've
cut
we're
kind
of
coming
together
as
a
software
community
or
open
source
software
community.
About
trying
to
solve
this
this
problem
and
trying
to
get
down
to
you
know
one
encryption
library
that
is
used.
You
know
through
boot
and
then
maybe
there's
specialized
use
cases
where
you
need
other
stuff.
C
But
you
know
for
the
vast
majority
of
it
you
know.
Maybe
we
can
get
to
something
smaller.
So
I
think
that's
that's
super
interesting.
I
you
know,
like
I
really
like
being
able
to
pick
up.
You
know
quote
unquote
off
the
shelf
software
because,
especially
with
things
like
the
apache
and
the
databases
and
that
kind
of
stuff,
because
I
trust
the
team
at
red
hat
right-
that
they
know
how
to
put
together
an
apache
like
an
htpd
that
will
run
and
be
secure
and.
A
B
A
A
A
Of
that
everywhere
that
it
was
insane
so
like
I
felt
pretty
confident.
I
know
how
to
build
the
best
one
and
I
usually
built
it
from
red
hat
bits,
but
then
I
would
tweak
it.
I
would
tune
this.
I
would
do
that.
You
know
I
was
getting
to
that
level
where
I
was
like.
Oh
yeah,
this
thing
is
warm
and
fuzzy.
Then
I
come
to
red
hat
and
I'm
like
farting
around.
A
You
know:
sales,
product
management,
product
marketing
blah,
but
like
just
last
year
year
before
I'm
building
a
php
mysql
thing
for
my
blog,
because
I'm
going
to
confess
that
I've
not
upgraded
my
blog
and
my
web,
my
wiki
for
like
10
years
so
and
and
media
wiki
will
do
that,
for
you
like
it'll,
do
that
for
you.
So
so
I
did
that
and
I
exported
it
all
reimported.
It
all
worked
by
god.
A
I
mean
it
was
actually
amazing,
but
it's
amazing,
but
when
I
go
into
rebuild
it,
I
was
like:
what's
this
fpm
stuff,
what's
this
php
fp?
What
the
hell
is
it
so
I
google
it
I
find
remy,
the
guy
that
packaged,
I
didn't
even
know
he
was
a
red
hat
guy.
I
just
oh
yeah
in
this
remy
guys
docs,
I'm
like
oh,
I
guess
I
should
move
to
fpm
it's
better
because
of
this
this
and
then
I
looked
it
up
and
I
was
like
oh
it's
already
built
into
rel.
I
was
like
dear
god.
B
C
A
C
Yeah
I
mean,
and
he
and
like
yeah
and
him
as
a
kind
of
a
canonical
example
of
like
lots
of
other
people
at
red,
hat
and
kind
of
in
the
open
source
community
in
general,
like
he
not
only
kind
of
does
his
day
job
of
packaging
php
and
all
that
other
tests.
He
maintains
an
entire
repo
on
the
side
that
has
all
the
stuff
that
he
isn't
comfortable
putting
in
rel
that
you
might
need,
because
you
know
you
might
need
it
for
something.
But
he
does
that
in
his
spare
time.
Right,
yeah.
C
A
A
C
B
B
A
C
All
right
well,
thank
you
so
much,
mr
mccarty,
for
your
time.
I
reiterate,
you
know,
follow
him
on
twitter,
father
linux.
He
says
mostly
controversial
things
on
the
internet
and
but
they're
always
entertaining
so
you
know
we
highly
recommend.
Not
you
know.
Everything
that
he
writes
is
worth
reading,
so
definitely
check
that
stuff
out.
Let
us
know
if
you
have
more
questions,
we
can
always
have
scott
come
back
and
you
know.
B
This
channel
so
next
up
at
11
a.m.
Eastern,
if
I'm
reading
the
calendar
right,
1500
utc,
we
are
going
to
be
talking
about
day,
two
operations
and
open
shift
and
we're
actually
breaking
it
up
into
multiple
parts.
Andrew
is
going
to
come
home
and
it's
like
day
two
operations,
part
one
is
what's
coming
up,
so
it's
kind
of.
B
Exactly
so,
you
know
day:
two
operations
can
be
extensive
depending
upon
your
environment,
right
like
if
you
all
of
a
sudden
you're
like
hey
great
I've,
got
this
open
shift
thing,
but
now
I
need
it
over
there
on
that
disconnected
network
yeah.
That's
that's
like
a
whole
different
ball
game
right,
so
yeah
plain
risky
wants
us
to
have
an
episode
when
ubi
micro
launches
so.
B
Like
if
you
want
to
come
on
and
highlight
that
stuff,
we'd
more
than
welcome
you
anytime,
but
then
later
today,
after
the
the
day,
two
operations
we've
got
openshift
commons
are
gonna,
be
talking
to
my
friend
baruch
from
jfrog
and
then
the
scalable
multiplayer
game
design
game
at
2
p.m.
Eastern
1800,
utc.
C
B
B
So
the
the
summit
week,
we're
kind
of
just
like
okay,
their
summit
done
okay
and
then
kubecon
week.
So
we
have
openshift
commons
gathering
day
zero
event
I'll
be
hosting.
This
will
be
on
that'll,
be
on
the
channel
during
kubecon,
and
then
we
have
various
community
office
hours,
that
kind
of
line
up
to
breaks
in
the
cubecon
schedule,
so
that
you
don't
have
to
feel
like
you're
missing
something
that
week
of
cubecon,
it's
all
on
the
calendar.
I
encourage
you
to
check
it
out
subscribe
to
the
calendar
it.