►
From YouTube: The Level Up Hour (E45): UBI-micro hits the scene
Description
How can the UBI Micro image help reduce your attack surface? What is an attack surface anyway? Join us while we talk to Red Hat's Scott McCarty about universal base images and why you might want to use the new ubi-micro. UBI Micro is a stripped down image that uses the package manager on the underlying host to install packages, typically using Buildah, or Multi-stage builds with Podman.
Learn more:
https://www.redhat.com/en/blog/introduction-ubi-micro
Follow us:
Scott McCarty https://twitter.com/fatherlinux
Randy Russell https://www.linkedin.com/in/randy-russell-0312243
Jaafar Chraibi https://twitter.com/ChraibiJc
What is the Level Up Hour?
Every Wednesday at 9am ET we stream live demos on how Red Hat Enterprise Linux (RHEL) users and admins can benefit their organizations and improve their careers by learning how to use containers, Kubernetes, and Red Hat OpenShift.
Learn more at:
https://red.ht/leveluphour
http://red.ht/3ayHlHI
How to participate in the The Level Up Hour:
Watch on YouTube every Wednesday at 9amET
Chat with us on Discord https://discord.gg/5VMVGJt
Check out our GitHub repo https://github.com/level-up-hour/
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
https://www.openshift.com/
https://github.com/openshift/
#RedHat #OpenShift #tluh
A
A
C
A
C
Yeah,
so
I
always
talk
about
the
journey
as,
like
you
know
when,
when
I
first
discovered
docker
containers,
basically,
you
know
back
2013-14
time
range.
You
know
the
first
thing
you
did
was
you
installed
this
piece
of
software.
Then
you
pulled
down
a
container
image
and
you
ran
it
and
you
were
like
oh
wow,
this
kind
of
looks
like
a
vm.
I
can
imagine.
C
I
could
use
this
for
all
kinds
of
interesting
things
like
looking
up
man
pages
on
other
versions
of
rel,
which
is
what
I
used
to
do
back
then,
because
I
was
a
solutions.
Architect
and
people
are
like
hey.
How
do
you
run
this
clustered
thing
in
rail
five
and
I'm
like?
I
don't
know
how
to
do
that.
I
can't
remember
that
at
all
and
I
don't
have
row
five
installed,
so
let
me
run
this
container
image
and
do
a
man
and
from
there
I
kind
of
had
the
epiphany.
I
was
like
oh
wow.
C
This
is
pretty
cool
it
like
unlocks
me.
You
know
from
from
these
different
versions,
and
so
I
realized
the
first
thing
that
mattered
was
the
container
images
right
like.
I
need
container
images
for
like
the
different
versions
of
an
operating
system
to
make
it
useful
essentially,
and
then
eventually,
you
like,
want
to
build
on
it
and
build
something
useful,
because,
basically,
all
software
development
is
about
collaboration
and
building
something
new
and
adding
some
kind
of
differentiated
value.
And
then
you
want
to
share
that.
C
So
in
a
nutshell,
red
hat
you
know
had
historically
had
this
sort
of
the
way
we
do
our
end
user
license
agreement.
You
know
servers
weren't
done
like
that
servers
where
I
got
the
flower,
sugar,
eggs
and
water
and
baked
the
cake
myself
and
then
I
shared
it
in
my
house.
Containers
is
like
all
right.
I
want
to
deliver
pieces
of
the
cake
to
everyone
and
so,
like
we
kind
of
had
this
tension
between
the
way
we
monetized
rel
and
the
way
we
wanted
to
do
containers.
C
And
so,
when
we
launched
rel8,
we
changed.
We
essentially
released
a
subset
of
rel
as
free.
You
know
free
to
redistribute
so
that
it
could
be
used
in
container
images,
and
we
called
that
ubi
and
so
red
hat
universal
base
image
and
we
basically
made
at
the
time
three
base
images,
a
bunch
of
layered
images
that
were
things
like
python,
ruby,
php,
you
name
it
like
all
these
different
programming,
languages,
java.net
and.
C
Yeah,
all
these
years,
technically
I'm
lying
about
job.
It
took
us
a
little
while
to
get
job
out
the
door.
The
way
people
wanted
it,
they
were
mad
and
they
didn't
know
that
it
was
not
on
purpose.
It
was
just
logistics,
you
know
software's
hard
and
then
the
final
thing.
The
third
piece
is,
we
have
a
bunch
of
rpm
repo
like
a
set
of
rpm
repos.
C
Yeah,
that's
exactly
right.
I
think
I
think
paths
was
really
easy.
Not
enough
control.
Just
doing
rpms
on
a
rail
system
was
a
lot
of
control,
but
not
as
easy
and
like
in
the
middle
there
somewhere,
as
kind
of
like
containers
were
like,
I
can
do
some
of
the
things
of
the
operating
system.
I
want
to
do
mostly
I'm
focused
on
the
app,
but
I
can
still
do
some
of
the
operating
system,
things
that
make
it
flexible
enough
that
it
meets
like
80
of
the
use
cases.
You
know
maybe
90.
B
One
of
the
things
we've
heard
over
years
of
you
know:
software
development
and
and
working
with
rel
is
that
rpm
packaging
is
hard
right
and
so
containers
actually
provides
kind
of
a
alternate
method
for
packaging.
So
you
can
still
use
rpms.
If
you
want,
we
provide
all
of
our
software
as
rpms,
but
I
mean
you
could
untar
a
tar
archive
into
the
file
system
of
your
container
and
then
still
pass
it
around
as
a
single
unit
of
of
software,.
C
Oh,
the
java
you'd
have
the
java
people,
the
linux,
unix
people
and
then
like
developers
on
top
of
that
and
by
java
people
I
met
like
there
was
like
java
app
people
that
kind
of
like
knew
the
infrastructure
and
I'd
laugh
you're
like
your
job
as
a
system
and
was
like
go
spin
up
the
server.
So
I'd
go
spin
up
the
server
and
we
used
like
cf
engine
at
the
time,
which
is
fine.
It
was
config
management.
It
was
pretty
good
in
late
90s.
I
think
we
were.
C
C
Reproducible
builds
they're,
just
like
no
man,
it's
cool,
we
just
pulled
tar
balls
down
like
the
java,
guys
are
totally
hippies
and
then
and
then
you
know
the
app
developers
are
pulling
down
war
files
and
running
them
inside
an
app
server.
So,
like
I
remember
about
2005,
I
was
like.
Oh
my
god.
This
is
horrible,
but
like
so
we're
all
speaking
different
languages
right,
like
mostly
systems,
are
speaking
rpms.
C
Mostly
the
java
infrastructure
guys
are
speaking
like
tarballs,
and
then
the
java
app
programmers
are
speaking
wars
and
you're
like
this
is
clearly
not
gonna
work
right.
So,
like
the
beauty
of
a
container,
is
you
kind
of
boil
it
down
to
like?
Okay,
we
have
this
dockerfile
container
file,
that's
kind
of
a
blueprint
that
shows
how
to
build
this
packaged
thing
and
we're
all
speaking
the
same
language.
Now
now
in
that
dockerfile
container
file,
I
can
go.
Do
whatever
nasty,
weird
stuff.
I
want
to
do
and
hide
that
from
everybody
else
like
so.
D
C
B
C
D
D
C
Kind
of
three
different
constituencies,
all
speaking
three
different
languages.
Now
the
beauty
of
this
is
you
have
at
least
even
in
the
java
world.
You
have
all
three
of
those
constituencies
speaking
the
language.
Now
you
can
even
have
the
php
guys
and
the
ruby
gals
and
the
you
know
like
all
these
different
groups
of
people.
They
can
all
speak
the
same
language
and
it's
not
it's
not
a
language.
That's
too
complex,
like
I
think
I
think
we
love
just
enough.
A
Well,
there's
one
other
thing
that
has
come
up
in
discussions
about.
You
know
the
thinking
behind
ubi
the
universal
base
image,
and
that's
that's
something
that
you
don't
always
hear
about
and
that's
gpl
compliance.
You
know
gpl,
of
course,
being
that
that
governing
set
of
rules
around
the
sharing
of
software
that
has
been
released
under
the
gpl.
D
C
Bit
about
that
yeah,
so
that's
that's
one
that
we
worked
on
for
a
long
time.
Actually
like
we
worked
for
a
couple
of
years,
trying
to
figure
out
the
right
way
to
do
this,
and
essentially
what
people
don't
understand
is
like.
Okay,
so
a
couple
things
about
licensing,
I
think
the
hipster
world
has
went
to
like
apache
licenses
and
bsd
style
licenses
where
they're
like
whatever
dude.
We
just
put
it
everywhere.
C
It
doesn't
matter
and
they
don't
really
think
about
attribution,
even
though
technically
they
still
are
on
the
hook
for
attribution
in
a
lot
of
these
licenses,
and
then
red
hat
goes
above
and
beyond,
and
pretty
much
provides
the
code
for
almost
everything
for
everything.
Basically,
because
the
easiest
way
to
attribute
code
is
to
just
provide
the
code
because
the
people's
names
are
in
there.
C
So
what
a
lot
of
people
don't
realize
is
the
gpl
mandates
that
you
should
be
delivering.
So
if
you
deliver
a
binary,
you
actually
theoretically
should
be
delivering
the
source
code
in
like
and
kind
which
basically
means.
If
you
put
it
out
on
an
ftp
server,
the
binaries.
You
should
have
the
code
out
on
ftp
server.
If
you
deliver
a
cd,
you
know
like
1990s
style,
to
your
customers.
C
You
know
in
in
best
buy,
then
you
should
deliver
the
source
code
on
that
cd
in
that
same
box
set
or
or
at
least
through
the
mail
in
a
fairly
like
and
kind
manner
right
like
it
might
take
about
the
same
amount
of
time
to
get
in
and
you
get
it
in
the
same
format
essentially
well.
What
people
didn't
realize
is
when
we
went
to
containers
and
you
dumped
containers
all
over
the
world
and
literally
there's
like
a
bunch
of
public
registries
and
all
the
cloud
providers.
C
C
And
they
are
not
attributing
the
code
and
not
actually
delivering
the
source
code
for
basically
everything
that's
out
there,
so
there's
definitely
kind
of
a
hairball
out
there
that
I
think
a
lot
of
people
aren't
thinking
about,
and
so
we
kind
of
thought.
How
could
we
make
this
easier,
especially
for
our
partners
that,
like
actually
care
about
this
and
don't
want
to
get
in
trouble
or
like
have
any
kind
of
static
or
problem
from
this?
And
so
we
said
well
what?
C
If
we
could
tuck
source
code
in
a
container
registry,
and
so
this
is
becoming
a
very
common
pattern
by
the
way.
So
we
looked
at,
we
looked
at
like
what
was
going
on
in
the
helm
world
and
they
were
starting
to
like
deliver
helm
charts
in
the
container
registry.
We
also
were
looking
at
we're.
Actually
this
will
get
into
the
roadmap,
but
we're
actually
planning
on
implementing
sig
store
and
doing
that
with
podman
and
with
openshift,
and
that
delivers
the
container
signatures
in
the
registry,
which
is
beautiful,
because
now
I
want
to
spit
it
up.
C
I
want
to
create
the
source
code.
I
want
to
sign
it
all,
and
I
want
to
shove
all
that
in
a
registry
like
that's
beautiful
and
I
have
one
place
like
and
kind
it's
all
the
same,
and
so
with
ubi
we
launched
like
source
this
concept
of
source
containers
and
so
with
ubi,
it's
actually
very
easy
to
build.
What's
called
a
source
container,
actually
pull
down
the
corresponding
source
container
for
any
any
base
image
that
you
pull
for
almost
any
image.
C
Actually
any
of
the
images
that
are
in
the
ubi
family,
pull
them
down,
get
the
exact
corresponding
source
code,
so,
like
you're,
like
oh,
the
ubi
micro
image,
only
has
these
27
packages
in
it.
I
want
the
27
source.
You
know
rpms
that
go
along
with
this,
and
I
only
want
those
I
don't
want
all
the
I
don't
want
to
deliver
10
gigabytes
of
source
code.
Just
so
I
can
deliver
27
megabyte.
You
know
image,
so
you.
C
The
like
and
kind
corresponding
you
know,
source
code
for
all
of
our
images
now
and
that's
actually
pretty
cool.
And
then,
if
you
are
an
end
user
and
you
want
to
then
go
push
those
binaries
out
anywhere,
you
want
to
redistribute
them.
You
can
also
push
that
source
code
and
say
hey.
I'm
meeting
my
obligation
to
the
gpl,
I'm
meeting
my
obligation
to
attribution
for
bsd
and
apache
licenses
and
all
the
other
licenses.
D
A
You
know
the
thing
about
it
is
is
that
is
that
sort
of
the
compliance
piece
here
is
a
thing
that,
as
you
mentioned,
it's
very
easy
to
to
miss,
because
you
know,
fundamentally,
though,
you
know,
the
high
level
story
is
all
about
sharing
and
caring
right,
but
there
are
some
rules
here.
There
are
some
things
about
attribution
that
are
required,
and
so
it's
really
fascinating
to
hear
about
how
that's
been
factored
in
and
and
and
addressed
in
this
way,
that's
actually
very
manageable
and
scalable.
I
guess
the
way
I'd
call
it.
A
B
C
You
know
back
in
the
day.
I've
been
in
this
way
too
long,
but
I
remember
back
when
I
was
in
the
python
committee
a
lot
and
the
guy
that
wrote
grails.
It
was
like
it
was
a
different
language.
I
think
that
was
in
ruby,
but
not
grails.
It
was.
It
was
one
of
the
web
servers.
The
guy
wrote
in
ruby,
and
I
remember
he
was
an
interesting
cat.
I
can't
remember
his
name
on
top
of
my
head,
but
but
basically
he
got
annoyed
because
this
other
company
had
built.
C
He
had
released
a
bunch
of
code
under
like
I
think
it
was
mit
or
apache
license
and
they
basically
consumed
all
this
stuff,
and
then
they
had
customers
and
they're
like
oh
yeah,
it's
this
upstream
stuff
that
guy
screwed
it
up
and
he's
like
dude.
It's
like
it's
the
non-repudiation
problem
right
they're
like
they're
like
they're,
like
blaming
it
on
this
other
guy
that
like
gave
them
this
code
for
free
and
he's
like.
Why
are
you
blaming
me
for
that?
C
Like
what
the
hell,
and
so
he
literally
swore
he
would
never
use
attribution-only
code
again,
he
would
only
release
gpl
v3.
So
that
it
was
always
copy
left
and
then
basically
they
had
to
release
the
source
code.
You
could
prove
non-repudiate
who,
who
you
know,
whose
fault
it
really
was,
and
so
this
open
source
there
are
some
of
these
edge
cases
that
people
don't
realize
like
when
you're
building
your
brand
in
this
open
source,
world
and
you're,
releasing
all
this
code
honestly
con
out
of
the
good
to
sell
your
heart
in
a
lot
of
ways.
C
D
A
Well,
it
comes
down
to
accountability
right.
So
can
you
tell
us
something
about
the
existing
family
of
ubi
images
because
there's
actually
multiples
of
these
or
some
variants
and
then
we'll
maybe
focus
on
our?
You
know
move
on
to
our
principle
topic
for
today,
but
can
we
talk
a
little
bit
about
the
family
of
them
and
and
sort
of
why
there's
a
family.
C
Yeah,
so
when
we
first
launched
ubi
with
relate,
which
is
a
two
and
some
change
years
ago,
we
we
launched
three,
we
launched
a
minimal
a
standard
and
an
init
container
image
and
the
minute
we
basically
planned
the
standard
was
kind
of
the
middle
of
the
road
one.
We
thought
80
of
people
would
use
that
one
that
looked
like
very
similar
to
a
fedora
image,
very
similar
to
a
debian
image,
an
ubuntu
image.
It
just
looks
like
a
standard
linux,
distro
image.
It.
D
C
Yum
and
dnf
in
it
blah
blah.
You
can
just
pull
down
packages
install
them.
It
works
in
a
docker
file
or
container
file,
and
it's
totally
fine.
The
interesting
thing
was
we
created
this
other
one
called
minimal,
because
people
are
complaining
about
size,
everybody's
trying
to
minimize
size,
there's
this
concept
of
attack
surface.
Although
I
critique
the
way
people
apply
this
concept
wrongly
sometimes,
but
nonetheless
we
did.
It
is
always
wise
to
try
to
trim
down
the
size
of
container
images.
C
So
I
remember
colin
walters
was
working
on
this
thing,
called
micro,
dnf
and
like
he,
I
remember
we
were
at
a
conference
he's
like.
I
think
I
could
knock
this
out
by
like
this
afternoon,
and
he
literally
like
worked
on
this
thing
and
was
like
I
figured
out
how
to
like
basically
install
rpm
packages
with
just
a
small
c
binary
instead
of
pulling
in
python
and
all
these
dependencies
and
blah
blah.
C
So
he
was
able
to
save
like
a
couple
hundred
mega
like
a
hundred
ish
megabytes
like
maybe
even
a
little
more
than
that
again,
I'm
saving
like
120
140
megabytes,
so
you're
getting
now
like
a
70
80
megabyte
image
instead
of
like
a
200,
210
megabyte
image,
and
so
we
created
this
thing
called
minimal
and
that
was
still
good.
It
didn't
have
all
the
functionalities
to
like
in
your
dockerfile
or
container
file.
C
You
would
need
to
kind
of
know
the
syntax
of
microdnf,
but
it
was
pretty
cool
because
you
didn't
have
to
have
a
full-fledged
package
manager
in
there,
so
that
was
kind
of
our
first
step
on
the
journey
is
when
we
released
that
and
then
on
the
other
side,
we
had
like
the
regular
image
plus
systemd-
and
this
is
a
somewhat
controversial
controversial
use
case
with
some
people,
but
I
think
they
just
don't
really
think
about
like.
Sometimes
it's
really
nice
to
just
do.
C
Yum
install
mysql,
yum,
install
httpd
system,
ctl
enables
hdbd
system
ctl
enable
mysqld
and
it
just
works
and
you're
like.
I
don't
have
to
know
how
any
of
this
freaking
crab
works.
I
don't
want
to
have
sme
knowledge
on
how
to
start
mysql
right
and
collect.
You
know.
You
know
zombie
processes
and
all
these
wacky
things
that
happen.
You're
like.
Oh,
you
just
run.
There's
this
argument.
You
run
one
process
per
container,
which
doesn't
even
make
any
sense,
because
mysql
runs
multiple
processes
in
and
of
itself.
Apache
runs
multiple
processes.
Nginx
runs
multiple
processes.
C
C
But,
needless
to
say,
we
try
to
create
three
different
options:
to
try
to
tackle
a
lot
of
different
use
cases
that
we
think
are
pretty
much
the
nana,
the
99
percent.
But
then,
if
you
look
in
rel84,
we
released
something
called
ubi
micro.
So
now
we
have
actually
four
base
container
images.
So,
on
the
very
tiny
side
at
like
coming
in
at
like
37
36
ish
megabytes
uncompressed
and
like
12
and
a
half.
C
Which,
I
think
is
pretty
damn
good.
We
have
that
micro,
but
it
has
no
package
manager
in
it
and
none
of
the
dependencies.
It
has
a
very,
very
minimal
set
of
things
like
standard
tz
data
standard.
You
know
like
lang
pack
like
like
not
not
like
nothing
beyond
like
standard
utf-8
like
english
language
pack,
things
like
that
very
minimized
set
of
things
in
ubi,
micro
and
and
to
install
anything
into
it.
C
You
actually
have
to
use
the
package
manager
on
the
host
or
down
the
road,
we're
kind
of
looking
at
how
we
could
use
the
package
manager
from
a
different
container
image
to
essentially
remotely
install
packages
on
ubi
micro,
but
not
actually
install
the
package
manager
in
ubimicro
in
the
middle
deliver.
This
thing
that
a
lot
of
people
call
that
a
distro-less
image,
because
you
once
it's
baked,
you
can't
add
more
packages,
it's
done
even
in
production,
you
look
at
there's
nothing.
C
You
can't
really
muck
with
it
and
and
they're,
usually
pretty
small,
but
there
is
still
a
dependency
tree.
There
is
still
a
c
library.
There
is
still
an
open,
ssl
library.
There
are
these.
You
know
apache
the
quality
of
how
it's
patched
still
matters
like
all
of
those
security
things
you
would
think
about
in
that
family
of
software
still
matters,
but
we
do
get
it
down
to
pretty
darn
small.
I
mean
I've
built.
I
think
I've
built
an
open,
sl
image
is
around
63
megabytes
and
apache.
Image
based
on
micro
is
about
156
ish.
A
Yeah,
that's
absolutely
microscopic
what
you're
describing
it.
You
know.
We've
talked
a
little
bit
about
things
from
the
past.
I
can
remember
my
my
second
linux
distro
ever
was
installed,
maybe
40
meg,
and
that
was
a
long
time
ago,
and
that
now
you
know
you
think
about
now
doing
something
in
was
it
37?
You
said.
A
That's
unbelievable,
so
yeah,
so
micro
really
pairs
it
down
to
the
absolutely
essential
elements.
You
know
we
don't
have
the
package
manager
in
there,
but
there's
some
interesting
approaches
to
to
getting
packages
in
there
and
even
if
you're
doing
something
like
apache
or
nginx
or
whatever
you.
You
know,
it
still
remains
something
that
you
know.
If
I
think
about
how
rel
has
grown
over
time
to
think
now
about
having
a
a
container
usefully
doing
something
at
those
sizes
that
you're
talking
you
know
is
amazing,
really
so
quick
question.
C
You
go
ahead
and
randy.
I
was
going
to
add
a
little
more
color,
so
so
upstream
in
fedora,
for
a
couple
years
now,
they've
been
working
on
this
minimization
effort
to
essentially
go
back
and
clean
up
the
supply
chain
and
trim
down
the
dependencies
so
in
in
dnf
there's
this
concept
of
soft
dependencies.
These
are
these
are
rpm
packages
you're
like
hey.
C
This
rpm
depends
on
this
other
one,
but
it's
a
soft
dependency
like
you
can
actually
have
a
command
line,
flag
and
dnf
to
basically
say
don't
install
the
soft
dependencies
only
install
the
hard
ones
where
this
software
will
actually
break
if
this
other
thing's
not
there,
but
there's
optional
ones.
That,
like
you
know,
unless
it's
a
full-fledged
server,
you
don't
necessarily
care
about,
or
maybe
you
want
to
pick
and
choose
which
dependencies
you
actually
want
to
add,
and
so
we're
actually
expecting
the
rel
nine
base
images.
A
C
Right,
yeah,
there's
no
such
thing
as
dystralis,
there's
only
somebody
else's
district
that
you
rely
on
so
even
like
the
google
distros
project
relies
on
debian
underlying
for
a
lot
of
the
dependencies,
and
so,
if
you
look
like,
if
you're
building
a
mysql
container,
it's
still
a
c
program,
that's
compiled
against
a
c
library.
Let's
be
honest,
nobody
wants
to
maintain
a
c
library
like
if
you
don't
have
to
and
then.
Let's
also
be
honest.
This
is
the
dirty
secret
that
nobody
wants
to
talk
about
in
container
world.
C
The
c
library
is
probably
the
most
important
library
from
a
getting
hacked
perspective
like
if
you
look
at
most
of
the
things
that
happen.
There's
a
few
entry
points,
there's
the
kernel
which
now
you're
talking
about
the
container
host
quality,
but
the
in
the
container
image,
the
most
important
thing,
the
equivalent
of
the
kernel
in
a
container
images
of
the
c
library,
basically
and
so
having
a
high
quality
c
library
that
has
a
proactive
security
team.
C
That's
like
literally
looking
at
it
and
analyzing
it
and
double
checking
and
a
bunch
of
people
that
can
commit
code
and
fix
cves
and
blah
blah
blah
that
quality
of
that
c
library,
in
my
mind,
is
probably
that's,
probably
a
a
plurality
of
what's
important
in
the
container
image.
From
an
attack
surface
perspective.
You
know
you
could
have
time
zone
data
and
all
kinds
of
other
like
dead
files
that
sit
there
and
don't
do
anything.
But
you
better,
be
you
better,
be
careful
that
c
library.
A
C
Yeah,
so
the
official
place
where
they
reside,
like
sort
of
the
the
canonical
place
where
they
reside,
is
small
c
canonical
the
place
where
they
reside
is
on.
You
know:
acc,
essentially
a
registry.access.redhat.com
which
is
an
open
registry,
that
red
hat
runs
where
you
can
go
and
pull
them,
and
then
they're
also
now
available
on
docker
hub.
As
of
like
may
20th
something
20,
something
ish,
I
forget
when
those
went
live
but
end
of,
may
we
put
them
up
on
docker
hub2.
C
A
B
Well,
I
did
want
to
point
out
that
we
maintain
all
those
ubi
images,
so
we
rebuild
them
every
six
weeks
automatically
and
then
we
will
kick
off
a
spurious
rebuild
if
something
like
a
critical
or
important
security
vulnerability
is
discovered
in
one
of
the
software
packages
that
comes
with
it.
If
you
look
at
the
red
hat
catalog
for
containers
and
the
ubi
listing
there,
you
can
actually
get
access
to
the
rpms
that
are
a
component
of
it.
B
We
do
a
scoring
of
all
of
the
containers
that
are
provided
through
our
registry,
that
include
things
like
open
vulnerabilities,
age
and
some
other
factors
which
is
a
little
bit
different
than
some
other
container
registries.
That
rate
things
by
like
number
of
downloads
or
number
of
likes
people
have
committed
over
time.
So
if,
if
you
are
interested
in
more
metadata
about
your
containers
from
red
hat,
I
think
that
the
red
hat
registry
is
good,
but
I
mean
docker
is
kind
of
the
as
mccarty
said,
the
friendly
neighborhood
purveyor
of
container
images.
B
B
I'm
sorry
randy.
There
has
been
some
chatter
in
the
chat
that
I,
since
we
have
this
the
principal
product
manager
for
containers
here,
red
hat.
So
one
person
asked
what
about
doing
hardened
container
images
for
people
who
want
hardened
container
images,
and
my
response
was
that
if
we
made
a
thousand
different
derivative
container
images,
we'd
then
have
to
maintain
a
thousand
different
derivative
container
images.
But
I
wanted
to
get
the
hot
take
from
scott
mccarty
on
it.
C
Yeah
and
I'll
say,
like
I've,
looked
at
like
a
bunch
of
different,
you
know
hardening
guides
like
the
the
stigs
there's
like
these
stigs
so
government.
I
forget
what
stig
stands
for
it's
an
acronym,
but
it's
a
famous
federal
government,
one
that
that
a
lot
of
the
federal
government
uses
to
harden
systems
and
servers,
and
so
there's
a
stig
it's
this
set
of
standards
for
how
to
harden
an
image.
C
The
problem
with
some
of
these
things
is
ones,
there's
a
bunch
of
problems
with
all
these
things,
but
the
first
thing
is:
if
you
harden
all
the
images
like
you
said,
you
have
two
options.
You
can
either
have
one
for
each
of
these
flavors,
which
would
mean
we'll
have
like
10,
different
hardened
images
or
we'd
have
to
pick
a
few
and
then
the
the
third
problem
is
is
like
once
you
harden
them,
they're
they.
C
Basically
security
is
always
a
trade-off
of
ease
of
use
and,
and
you
know,
more
security,
and
so
you
got
to
look
at
like
if
I
get
a
one
percent
improvement
in
security,
but
it's
99
harder
to
use.
That's
almost!
Never
like.
Basically,
you
know,
sc.
Linux
was
probably
like
47
53
and
people
disable
it
all
the
time
you
know
like
you
get
into
that
middle
road
where
you're
like.
C
People
analyze
it
that
are
actually
trying
to
to,
for
example,
prevent
problems
with
like
the
container
engine,
as
opposed
to
what's
wrong
with
the
actual
image,
and
so
like
some
of
these
things,
one
could
argue
where
it's
better
fixed
like.
Is
it
better
fixed
in
the
container
host
with
the
container
engine,
or
is
it
better
fixed
by
like
hamstringing
a
container
image?
C
So
it
can't
do
things,
and
so
you
know
there's
a
lot
of
debate
about
where
you
harden
these
things,
and
so
I
would
argue
that,
like
the
red
hat
ones
are
hardened
out
of
the
box
like
it's
not
like.
These
things
are
not
hard,
and
I
would
argue
that
our
again,
our
c
library
is
hardened
out
of
the
box,
our
kernel's
hard.
Now
the
box
so,
like
you
know
like
when,
when
a
binary
is
compiled
in
rel,
it
has
all
of
these
like
there's
like
five
six
different
security
technologies.
C
You
know
that
we
basically
compile
into
those
binaries
and
all
those
binaries
in
there
have
that
the
way
we
analyze
the
c
library
it's
hardened,
you
know
like
we
have
and
then
on
the
host
side.
You
know
we're
doing
things
like
sc
linux,
our
our
default
profiles
for
seo.
Linux
are
actually
very
hardened,
and
so
one
could
argue
that,
like
some
of
these
hardened
image,
things
is
like
adding
a
0.01
percent.
You
know
it's
a
warm
and
fuzzy,
but
it's
not
actually
providing
much
value,
and
so
that's
that's.
The
challenge.
C
B
C
B
And
I
will
say
that,
like
the
disaster,
for
example,
it's
about
servers
and
so
there's
a
whole
bunch
of
things
in
there
about
like
managing
user
access,
which
in
the
container
world
is
not
really
applicable
and
then
also
like
depends
a
lot
on
the
container
host
like
if
you're
running
rootless.
Then
it
doesn't
matter
that
your
container
thinks
that
it
has
root
access
for
running
services
or
doing
tasks,
because
on
the
actual
host,
it's
not
doing
those
things
yeah
and
then
like.
B
D
B
C
C
It's
great,
but
three
months
later,
not
so
great,
I
don't
care
how
good
a
quality
components
you
have,
because
the
world
discovers
new
problems
with
the
software
in
your
container,
and
so
you
know
we're
constantly
discovering
new
cds,
et
cetera
and
so
cbes
build
up
on
old
software,
and
so
velocity
is
a
huge.
You
know
time
and
space
are
linked.
A
Yeah,
so
along
those
lines,
would
you
say
that
that
sort
of
the
security
aspects
are
one
of
the
principal
things
that
are
bringing
people
to
ubi
micro?
Or
is
it
perhaps
some
of
the
other
advantages
that
accrue
to
having
this
small
very
tightly
packaged
piece?
You
know
what
what
what
is
driving
customers
most?
Is
it
the
security
thing
or
is
it
you
know?
Are
there
some
other
things
that
are
maybe
driving
people
to
this
particular
choice?.
C
I
think
it's
a
little
bit
of
both
being
very
honest
with
myself.
You
know
as
a
product
manager
I
have
to
be
willing
to
like.
I
have
a
technical
brain
and
I
have
a
business
brain
and
I
have
a.
I
have
a
cool
brain
like
everybody
else
like
I
just
want
to
do
cool
stuff
sometimes,
and
I
will
admit
that
all
three
of
those
things
have
an
actual
effect
on
people
and
if
we
don't
admit
that
to
ourselves,
there
are
functional
requirements
same
thing,
but
there
are
also
emotional
and
social
requirements.
C
Like
I
mean
this
is
even
in
finance,
we're
starting
to
realize
this,
like
with
with
esg
and
things
like
that.
So
like,
if
you're
more
honest
with
yourself
about
why
people
are
selecting
your
product,
you
know
you
could
do
a
lot
better
job.
I
think
part
of
it
is
to
your
point.
It
just
makes
you
feel
good
you're,
like
I
know,
nothing's
there,
you
remember
the
first
time
you
ever
installed
a
linux
server
when
you
ran
in
production
and
you're.
Like
I'm,
I
remember
the
first
time
I
had
a.
C
Nobody
got
in
my
servers,
and
I
was
like
yes
like,
like
that,
feeling
that
you
get
you're
like
I
knew
I
minimized
everything
on
those
servers
and
it
worked
like
and
and
mind
you
is
that
the
reason
why
they
didn't
break
into
myself,
who
knows
like
I
could
be
getting
the
right
answer
for
the
wrong
reason,
but
it
feels
good.
So
there
is
some
element
of
like
it
emotionally
feels
good.
When
you
know
that
you
just
don't
have
anything
you
don't
need,
I
have
to
admit,
I
think
that's
about
33
of
it.
C
I
think
33,
though,
is
attack
surface,
like
I
think
it's
reasonable
to
say
once
you've
standardized
on
a
core
build
like
this
is
anything
I
don't
care
if
it's
desktops
phones,
laptops,
routers,
whatever
once
you've
standardized
on
one
version
of
a
thing,
so
you
can
that
truly
minimizes
your
attack
server.
You
know
that
that
gets
you
from
27
different
types
of
routers
of
27,
different
versions
of
ssh,
running
to
like
one
router,
with
one
version
of
ssh
running
that
clearly
limits
your
attack
surface.
You
know.
A
C
You
know,
I
would
argue,
is
then
get
down
to
things
like
ubi
micro
and
get
rid
of
that,
and
then
true,
you
know
truly
minimize
the
the
attack
service
per
workload,
but
but
really
look
at
your
entire
environment.
First,
I
think,
is
probably
the
most
important
thing
but
yeah
so
like
getting
back
to.
I
think
people
do
it
partially
for
tech,
functional
reasons
like
oh
our
security.
I
think
some
of
our
check
box,
too,
is
the
third
thing.
I
think
it
is.
I
think
some
of
it
is
just
like
hey.
C
We
need
to
check
this
thing.
People
said
they
need
this
thing.
Let's
check
this
thing
and
then
some
people
really
do
understand,
attack,
surface
and
actually
have
real
good
security
requirements
and
then
other
people
just
like
the
way
it
feels.
I
think
is
a
big
chunk
of
it
and
I
get
that.
I
do
appreciate
that.
I,
like
ferraris,
for
a
reason
I,
like
ducati
motorcycles,
like
there's
a
reason
I
can
ducati's
not
better
than
my
suzuki,
but
yet
I
look
at
and
I
go
that.
D
C
Yeah,
I
think
containers
are
that
in
general,
like
I
think
I
think,
containers
look
so
deceptively
simple.
I
mentioned
at
the
beginning,
like
when
I
first
started
using,
I
I
remember
I
went
and
built
like
sent
to
us
four
five,
six
and
seven
images
at
the
time
this
back
like
2013-14,
and
I
had
him
up
on
docker
hub
and
they
became
pr
decently
popular
because
nobody
had
built
these
things.
I
don't
know
why,
but
for
me
I
wanted
them
all,
because
it
was
annoying
and
I
couldn't
redistribute
rel.
C
So
I
couldn't
create
real
ones,
because
our
eula
prevented
me
from
from
doing
that.
But
but
I
I
I
realized,
like
okay,
it's
pretty
easy
to
create
a
base
image,
but
then,
as
soon
as
you
go
to
put
an
application
in
to
a
container
you're,
that's
where
you
really
have
the
smack
in
the
face
of
your
like.
Oh,
this
is
really
easy
to
use
like
consume,
but
there's
a
tip
of
an
iceberg
as
soon
as
you
go
to
build
one.
C
So
a
few
I
don't
know
maybe
a
year
issue
a
year
and
some
change
ago
I
published
an
article.
I
can
share
the
link
with
you
guys,
but
I
put
three
different
applications
and
containers
kind
of
using
all
the
best
practices
I've
learned
over
the
last
seven
years
and
when
you
really
look
at
it
in
action,
I'm
not
gonna
lie.
Even
I
look
at
I
go.
This
is
a
lot
of
brain
power
like
this
is
a
lot
of
my
own
brain
power
like
I'm
operating
here
at
90,
cpu
like
sometimes
it
was
overheating.
C
You
know
I'm
like
this
is
a
lot
of
work
to
like
figure
out.
Where
do
I
put
the
config?
Do
I
put
the
config
on
this
volume
to
put
the
data
over
here
and
I
break
these
things
down
and
use
systemd,
and
I
do
use
our
init
containers
where
I
just
fire
up
mysql
and
apache
in
the
same
container,
and
I
run
them
read
only
which
is
even
funnier.
You
can
actually
run
it
with
systemd
read
only
so
I
mean
I'd
I've.
C
I've
opened
this
to
the
world
in
good,
open
source
fashion,
and
no
security
person
on
the
planet
has
attacked
me
about
it,
because
I
did
my
homework
like.
I
know
this
pretty
well
and
I'm
I'm
perfectly
comfortable
putting
it
out
there
publicly
and
I
I'd
again
challenge
anybody
to
come
talk
to
me
about
why
the
security
is
bad
or
break
into
my
server.
If
it's
that
bad,
I
I'd
shout-
I
mean
I
don't
know
if
it's
that
bad
break
into
my
server.
D
C
Know
I'm
walking
there's
still
always
ways
to
get
into
service,
but
but
mine
would
be
pretty
hard
to
get
into,
but
again
the
brain
part
you
got
to
put
into
it,
though
it's
non-trivial,
so
I
would
argue
you
need
you
need
really
strong
linux
skills
to
do.
You
know
early
on,
we
called
containerization
application
virtualization
because
you
actually
need
to
know
the
app
to
virtualize
it
when
you
virtualize
the
hardware
you
needed
to
know
the
hardware
you're
like.
Oh,
I
need
a
network
card.
I
need
a
video
card.
I
need
this
much
ram.
C
I
need
this
many
cpus
with
this
much
power.
You
know
that
was
hardware
virtualization,
and
to
do
that,
you
kind
of
had
to
understand
hardware
because
you're,
like
hey,
I'm,
going
to
put
this
app
in
a
virtual
machine.
Now
I
need
to
know
how
much
ram,
how
much
disk,
how
much
you
know
whether
it
needs
a
video
card,
whether
it
needs
a
you
know,
network
card.
Why
does
the
network
card
need
to
be
on
this
on
this
network?
Blah
blah
blah?
C
That's
hardware
virtually,
but
when
you
get
into
application
virtualization
you
need
to
know
where's
the
config
for
the
mysql
thing,
where's
the
config
for
this
apache
thing.
Oh,
the
app
that
lives
in
apache.
Has
this
other
config
I'll?
Give
you
a
perfect
example
hard
one,
a
really
hard
one
that
I
thought
deeply
on
for
a
long
time
like
wordpress,
auto,
auto,
updates
itself.
C
Let
me
do
a
read,
write
volume
for
this
area,
where
wordpress
updates
itself,
but
I'll
do
a
read-only
volume
on
this
config
file,
because
I
don't
want
some
hacker
getting
in
and
changing
my
config
file,
but
I'll
do
a
read-only
volume
for
this
and
a
read-write
volume
for
that.
You
gotta
like
do
a
lot
of
architecture
and
that
basically
takes
senior
linux
system.
C
Admin
skills
like
there's
no
other
way
to
say
it
like
when
you're
gonna,
dig
that
deep
into
an
application
and
deconstruct
it
and
then
put
in
a
container
and
actually
limit
what
it
can
do
and
do
it
in
a
secure
way
like
it's
harder
than
what
people
realize
to
do
that,
and
so
not
all
applications
are
good
candidates
for
that,
and
then
not
all
people
are
up
to
the
task
of
doing
it
in
a
way.
That's
sane
and
secure
well,.
A
He
really
did
you
know
it's
one
of
those
things
that
I
think
a
lot
of
people
want
to
skip
straight
to
the
the
glories
of
of
kubernetes
and
containers
and
openshift.
But
you
know,
underneath
all
of
that
you
do
have
to
have
those
linux
skills,
and
you
know
we
made
a.
We
made
a
big
change
to
the
red
hat,
certified
system
administrator
program.
A
You
know
a
year
or
two
ago,
when
we
actually
last
year
now
that
I
think
about
it,
in
which
we
said
you
know
what
knowing
containers
is
part
of
what
you
need
to
be
a
qualified
linux
system
administrator,
but
it
works
in
reverse,
too,
is
that
you
have
to
understand
something
about
linux.
You
can't
look
at
this
at
a
container
as
a
black
box,
it's
a
convenient
box,
it's
a
tiny
box.
A
You
can
see
what's
in
the
box
and
sometimes
the
work
has
been
done
for
you
about
what's
in
the
box,
but
at
the
end
of
the
day
you
have
to
understand
a
little
bit
about
what
goes
into
that
box
and
why
it
goes
in
there
to
really
be
effective,
and
you
know
nothing
illustrates
that
more
to
me
to
your
point
about
understanding.
Linux
is
that
you
know
if
I
look
at
pass
rates
on
our
open
shift
exams.
A
People
who
are
red
hat
certified
system
administrators
do
so
much
better
than
people
who
are
coming
in
cold
because
they've
been
told,
hey
you
got
to
learn,
you
got
to
learn
openshift
and
maybe
they
haven't
got
those
underlying
skills.
So,
yes,
the
container
world
makes
for
a
lot
of
convenience
and
ease
of
use.
Yeah
here
you
know
the
the
you
know
the
whole
metaphor
of
a
container
like
a
container
ship,
and
you
know
the
the
revolution
of
container
shipping
is
the
same
thing
happening
here
that
you
just
drop
your
container.
A
C
Oh
yeah,
for
sure
I
would
argue
so
with
app
with
application,
virtualization,
aka
containerization,
there's
three
main
skill
sets
you
need.
You
need
linux
skills
straight
up.
You
need
to
know
how
config
files
work
and
where
they
go,
and
how
to
mount
devices
and
all
the
normal
stuff.
You
know
the
linux
system,
then
you
need
to
have
application
specific
subject
matter,
expertise
so,
like
I
know,
mysql
pretty
well,
I
know
php
pretty
well.
I
know
pearl
pretty
well,
I'm
dating
myself,
but
there's
certain
technologies.
I
know
pretty
damn.
Well
still,
I
don't
know
ruby
that!
C
Well,
I
don't
know
node.js
that
well
like
to
containerize.
Node.Js
would
take
me
forever
because
I
have
to
fart
around
and
get
this
container
I'd
have
to
get
the
application
specific
sme
knowledge
around
how
people
run
that
best
practice,
how
they
lock
it
down,
what
modules
they
use
with
it,
what
things
they
use
to
administer
it,
how
they
get
logs
out
of
it.
You
know
all
these
like
operational
things
that
somebody
that
knows,
node.js
or
knows
ruby
would
just
know
how
to
do
right
and
then.
Thirdly,
I
need
container
specific
skills.
C
C
Okay,
cool
now,
the
kubernetes
stuff,
in
my
opinion,
is
not
actually
as
hard
as
everyone
thinks
it
is
it's
just
they're
trying
to
bite
off
all
four
things
at
the
same
time,
they're
trying
to
fight
off
basic
container
stuff
basic
container
tools,
the
app
specific
stuff,
the
linux
stuff
and
then
also
run
it
at
scale
and
you're
like
oh,
my
god,
I
gotta
learn
distributed
systems
along
with
all
this
yeah.
Of
course,
you're
gonna
get
overwhelmed
and
fail,
I
mean,
but
if
you
look
at
this
four
separate
skill
sets
you
can
start
to
say.
C
Okay,
I
do
need
these
four
skill
sets
to
run
apache
at
scale
in
in
in
you
know,
in
kubernetes
like
I
once
I
know,
a
bind
volumes
mount
work,
pvcs
and
you
know
persistent
volumes
and
persistent
volume.
Claims
are
actually
quite
easy
to
understand.
Honestly,
like
the
kubernetes
language
is
actually
quite
elegant.
In
my
opinion,
I
think
it's
actually
quite
easy
once
you
know
what
you
want
to
do,
but
you
need
to
know
what
you
want
to
do
first
and
that's
what
I
think
most
people
don't
even
know.
B
C
Building
and
managing
a
base
image
is
a
completely
different
skill
set
trust
me
as
a
pm
that
has
to
deal
with
this.
Every
time
we
do
a
new
dot
release
versus
like
when
I
would
use
it.
When
I
was
a
sys
admin,
I
mean
I
love
using
it.
It's
so
much
easier
to
use,
but
building
it
is
a
lot
of
work.
I
mean
the
building
it
piece,
so,
of
course
you
don't
want
to
do
that
yourself.
C
Why
would
I
want
to
ever
do
that
myself
like
that
piece
is
a
pain,
but
just
like
honestly,
I
don't
want
to
build
a
kubernetes
distro
from
scratch
myself.
I
don't
want
to
do
that.
That's
why
I
use
openshift
or
I
use
a
cloud
provider,
but
I
don't
want
to
do
it
myself,
like
in
a
lot
in
most
cases,
there's
not
a
lot
of
business
value
in
building
your
own
base
images,
it's
definitely
better
to
leverage
ours
with
our
expertise.
A
All
right
well
yeah,
so
I
think
there
is
a
lot
of
truth
in
what
you're
saying
I
mean.
Fundamentally,
you
know
the
thing
that
people
have
wondered
about
open
source,
and
you
know
we've
all
been
asked
this
many
times
over
the
years.
I'm
sure
I
know
I
have
you
guys
have
been
in
this
for
quite
a
while
as
well
as
well.
Look
if
you
can
just
download
all
this
stuff
and
build
it
yourself.
Why
not
build
it
yourself?
Well,
because
you're,
an
insurance
company,
that's
normally
your
that's,
not
what
you're
in
business
to
do.
C
Yeah,
why
do
landscaping?
Companies
buy
dump
trucks,
and
why
do
they
pay
somebody
to
maintain
them
and
modify
them
and
do
all
the
things
they
do?
They
don't
do
that
themselves.
It
doesn't
make
any
sense:
you're
a
landscaping
company,
not
a
truck
truck
maintenance
company
and
so
yeah.
It's
the
same
exact
thing,
yep
well,.
A
D
A
Maybe
you
actually
start
with
some
images
that
have
been
built,
and
you
understand
that
image
very
well
and-
and
I
think
one
of
the
beauties
of
the
way
this
works
is
you
can
you
can
start
with
that
base
image,
and
then
you
can
start
to
dig
into
it
and
understand
what
those
components
are
and
who
knows?
There's
there
probably
are
you
know
those
edge
cases
where
you
might
need
to
do
something
from
scratch,
but
better
to
be
informed
by
having
understood
what
you
know,
experts
have
built
from
scratch.
First
right.
C
Yeah-
and
I
I
mean
shout
out
to
my
old
homeboys
that
you
know
like
like
like
get-
I
still
love
gentoo
like
to
this
day.
I
remember
when
I
went
down
the
rat
hole
again
too.
I
learned
linux
better
than
I
ever
learned
in
my
life.
I
think
it's
a
great
learning
tool
would
I
ever
run
get
to
in
production.
No,
I
would
do
that
when
I'm
24,
because
I
was
an
idiot,
but
I
wouldn't
do
that
now
like
but
like.
C
C
C
Blah
blah
and
like
the
rat
hole
is
so
freaking
deep
and
it
hurts
my
brain
every
day
and
like
once,
you
see
that
and
obviously
I
think
any
senior
you
know
principal
sys
admin
probably
has
some
of
this
gut
feeling
they're
like
I
don't
want
to
know
all
this
stuff,
like
I
literally
don't
know.
I
do
because
I
have
to
build
the
damn
thing
but
like,
but
and
even
I
don't
want
to
know
it
a
lot
of
times
like
I
want
these
different
smes
to
know
it,
and
then
I
just
trust
their
opinions.
C
C
No
geez
no
building
yeah,
it's
funny,
because
people
just
think
I
am
I'm
like
no,
no,
no!
No,
I
am
not
even
close.
I
have
like
10
knowledge
in
dlt,
just
the
average
team
has
like
one
percent
knowledge,
so
mine
looks
really
impressive
and
then,
when
I
talk
to
these
guys,
I
know
nothing.
I'm
like
I
have
no
idea
what
I'm
talking
about.
A
A
D
C
A
Yeah
see,
I
think,
I
think
I
think
we
go
for
it
and
I
will.
I
will
discuss
the
sweet
sweet
internet
points
if
I
have
to
interrupt,
but
I
I
think
we
are
going
to
go
for
it
here
and
and
well,
while
I'm
thinking
about
it,
we
have
to
acknowledge
the
prom
dress
moment
here
that
you
know
scott
and
I
are
both
you
know,
wearing
our
level
up
our
swag.
So
anyway,
let's.
C
This
is
like
its
internal
representation
of
what
a
container
is
because
it's
not
defined
in
the
kernel
it's
defined
in
the
user
space
so
like
build,
it
has
its
representation.
Podman
has
its
own.
Now
I
can
do
like
a
build,
a
build
mount
and
what
this
will
do
is
it's
like.
Okay,
there's
this
container,
but
now,
let's
mount
the
storage
on
this
container,
and
then
I
can
do
a
yum
install.
C
So,
let's
like
look
at
this
guy.
So
what
I'm
doing
here
is
I'm
saying
I'm
using
this
complex
yum
command,
that's
actually
not
as
complex
as
it
looks.
The
magic
of
this
is
this
install
root,
I'm
using
the
the
yum
on
the
underlying
container
host
on
this
relate
floor
box
to
basically
install
into
this
install
root,
which
is
the
directory
that
that
build
a
command
gave
me
back,
and
what
that
is
is
that's,
that's
a
container,
essentially
that's
a
root
file
system.
C
So
what
it's
doing
is
it's
saying:
hey
I'm
going
to
install
these
packages
and
then
add
them
to
the
rpm
database
in
the
ubi
micro
image
and
you'll
see
it's
36
packages
because
dependencies
there's
a
decent
number
of
dependencies,
but
you're
actually
going
to
be
surprised
that
this
is
not
that
big.
These
are
pretty
small
dependencies.
There's
nothing
crazy
in
here
and
well.
C
C
But
you
see
glib
c
some
glypc
things.
You
start
to
get
a
feel
for
like
the
kinds
of
things
that
get
installed
here:
ca
certs
this
should
take
one
second
boom
and
now
let's
do
a
commit.
So
if
you
look
what
I
think
it
was
ubi
working
container,
I
believe
was
the
one
yep
there.
It
is
so
I
just
committed
that
bad
boy
and
then
let's
do
a
podman
images.
C
So
what
this
did
was
this
wrote
it
as
8
micro,
ssl
and
then
we'll
do
a
podman
images
and
we'll
look
for
ubi,
8
micro
ssl,
and
actually
this
is
saying
that
same
was
only
38
megabytes.
I
don't
buy
that.
I
only
created
that's
interesting
for
some
reason.
It's
saying
that
I
only
added
2.6
megabytes
that
which
seems
strikingly
fishy,
because
I
could
have
scored
the
last
time
I
built
it
was
63.
C
C
So
maybe
we
had
a
dependency
torn
out
somewhere,
but
this
is
two
megabytes
yeah,
that's
25.
that
should
have
that
should
have
added
more
than
that.
But
I
don't
know
I
don't
think
that's
actually
25
25,
though
I
think
it's
compressed
on
disk
yeah.
I
don't
know,
that's
an
interesting
one,
something
wacky
with
my
tools
going
on
there.
I
think
I
want
to
say
the
last
time
I
built
this
was
about
63
megabytes,
but
but
nonetheless
pretty
darn
tiny.
C
C
Yeah
absolutely
and
it's
a
place
where
we're
focusing
on
and
it's
a
place
where,
if
it
doesn't
break
something
we
we
might
do
and
you'll
notice
I
had
in
that
command.
I
had
some
optimizations
in
that
in
that
yum
install,
so
I
had
set
up
install
week,
depths
equal
false.
So
if
people
had
updated
their
weak
depths
list,
even
in
rel
eight,
this
would
change
over
time.
So,
since
I'm
using
an
optimization,
I
would
pick
up
those
optimizations
so
yeah.
That
is
exactly
right
and
in
real
nine.
C
A
So
in
order
to
get
into
the
sweet
sweet
internet
points,
the
ssips
hit
one
of
the
urls
below
that
you
can
see
in
this,
and
I
think
we
might
also
post
that
into
into
the
chat
and
that's
how
you
can
perhaps
try
to
get
on
the
board,
maybe
even
catching
up
good
luck
with
with
narendev,
and
so
you
know
just
last
word
here.
Thank
you,
scott
mccarty,
for
joining
this
has
been
enormously
informative
and
fun.
Thank
you
stabby.