►
Description
Join Jay Vyas and Nishad Mathur as we look at
the evolving data model for pods: container lifecycle events, hooks, init pods, hostProcess containers, and other heebie-geebies in the "what's a container" domain.
- 0:00 week in review
- 1:00 surprise guest , tgik Vet mauilion from Isovalent joins us!
- 5:00 HostProcess container blog post by perithompson
- 5:31 Kubernets on Windows book
- 7:00 Ebpf summit, netns cookies, routing improvments
- 11:00 Nishad introduces his nested docker+celery problem
- 12:20 "Its friday were gonna do things right, said nobody ever"
- 15:30 PIDs inside a kind cluster is weird
- 19:15 Kernel tasks have weird names
- 23:00 containerd shim synthetic parent to the pause/runsvcdir startups,
- 24:00 pause container holding namespaces for sharing
- 25:00 containers sharing PID namespaces
- 32:00 runc creating the process for containerd/dockershim
- 33:00 containerd-shim as the holder for runc's process
- 48:00 After TerminationGracePeriods, SIGKILL
- 49:30 SIGTERM sent first before the Kill happens
- 56:00 Init pods, pods, processes, postStart, preStop hooks
- 58:00 no gaurantee that the preStop will finish
- 1:01:00 container lifecycle hooks docs page
- 1:07:00 kind cluster became a zombie, killing mirror pods is meaningless
- 1:08:00 "Shadow pods" oops mirror pod
- 1:09:00 trying to fix my borked kind cluster
- 1:14:00 Fei joins us
- 1:17:00 kindnet , dualstack
- 1:20:00 systemctl -flu
- 1:23:00 cillium port ranges pleeease so we can graduate networkpolicy API improvements to GA !
- 1:32:00 containers in the same pod have DIFFERENT pid namespaces normally unless you configure explicitly
- 1:35:00 CGroupFS vs Systemd allocator
- 1:39:00 CgroupFS controller doesnt know about space allocated by others
A
Hey
everybody:
okay,
we're
live
it's
tgik,
and
so
today,
duffy
is
here,
he's
my
friend
and
he's
over
from
my
surveillance
and
so
like
we're
real
excited
to
have
duffy
and
nishad
is
my
friend
from
vmware
and
of
course
I'm
jay.
So
we're
I
mean
I
guess
we're
just
gonna
get
started
the
week
in
review.
There's
I
don't
really
have
much
here,
so
maybe
we
can
dig
up
some
other
news
while
we
get
started
and
see
well,
you
know.
A
Actually
I
have
one
other
thing,
because
we
have
this
kubernetes
on
windows
book
that
just
came
out
so
I'll
I'll
kind
of
do
a
shameless
plug
for
that.
So
this
is
I
just
this.
So
I'll
do
I'll
do
a
plug
for
that
right
right
at
the
end
of
this,
but
let's
first
get
started
with
like
the
week
in
review
here.
A
A
A
Have
you
seen
this
evidently
there's
a
there's,
a
regression
in
1.22
yeah?
This
is
cool,
so
if
you
create
a
evidently,
if
you
create
a
static
pod,
we
can
actually
do
this
as
our
first
thing
that
we
do
today.
So
let's
actually,
let's
put
this
down
in
the
notes
here.
Let's,
like
we'll,
try
to
reproduce
this
so
yeah
yeah.
A
B
C
B
E
A
Okay,
cool,
so
then,
if
you
so
okay,
so
so
it's
so
this
is
specific
to
like
you,
rewriting
the
exact
same
manifest,
I
guess
so
anyways
yeah!
This
was
an
interesting
regression.
I
thought
I'd
bring
it
up,
because
today
we're
going
to
be
talking
about
pods,
and
so
now
this,
like,
I
think,
hey,
what's
up
rajas,
what's
up
jukka
wha,
wha,
wha,
what's
up
everybody?
What
time
is
it
in
india
right
now,
rajas.
A
Let's
see
here,
this
is
likely
to
be
caused
by
the
pod
cleanup
being
keyed
by
uid
and
not
handling
overlapping.
So,
okay,
we
can
dig
more
into
that
later.
If
folks
want
to
now.
This
is
we're
real
flexible
in
what
we
do
here
today.
So
you
know
if
folks
want
to
dig
into
something
else,
that's
related
to
pods
and
the
kubelet,
and
all
that,
like
we're
happy
to
right.
If
you
have
any
stuff
you
want
to
look
at.
So
this
is
something
else.
That's
it's
exciting
to
me.
We
have.
A
We
have
experimenting
with
windows
cni
in
a
pod.
So
now
we've
got
the
ability
to
run
host
process
containers
as
of
1.22
and
in
alpha
for
windows.
So
this
allows
you
to
run
like
your
cni
on
windows
and
so
on
and
so
forth.
So
this
is
a
blog
sort
of
hackmd
by
perry
that
he
wrote
up.
That
shows
how
to
do
that.
So
that's
some
more
news
and
then
what
else
any
other
news?
Oh
you
got
ebpf
summit,
so
we'll
do
that
next:
cool,
okay,
more
windows,
news!
A
We
I
got
a
book
that
just
came
out
kubernetes
on
windows,
so
you
don't
have
to
go,
buy
my
book,
but
but
if
you
want
you
can,
but
I
think
you
can
click
on
these
and
manning
will.
Let
you
like
learn,
learn
a
bunch
of
like
it
goes
through
andrea
and
open
v,
switch
in
depth
and
all
that
so
yeah.
If
you
want
to
really
learn
how
the
internals
of
kubernetes
on
windows
work,
like
that's,
that's
kind
of
probably
the
only
way
that
I
can
think
of
that.
I
know
of
at
least.
A
B
So
this
actually,
we
just
held
we
held
this
week
before
last,
and
it's
an
incredible
two-day
summit
and
the
recording
links
are
right
there.
So
you
go
live
stream
day.
One
live
stream
day
two.
This
was
an
evp
summit
that,
like
talks
about
all
things
ebpf,
and
so,
if
you're
interested
in
learning
more
about
evpf
or
psyllium,
or
what
I've
been
working
on
lately
or
any
of
that
stuff,
then
definitely
go
check
out.
Those
two
streams
there's
lots
of
great
content
in
there.
B
A
A
C
B
On
the
psyllium
side,
like
some
of
the
fun
stuff
is
like
in
handling,
you
know,
there's
been
a
lot
of
code
changes
in
the
eupf
code
base,
like
you
know,
introducing
things
like
ns
cookie
and
the
ability
to
actually
understand
where
a
packet
is
sourcing
from.
So
we
can
make
better
routing
decisions
for
those
packets,
even
if
it's,
even
in
the
in
the
case,
where
we're
doing
things
like
replacing
q
proxy
and
just
using
evpf
to
handle
all
of
the
routing.
B
So
like
that's,
some
of
the
changes
that
are
that
are
happening
and
like
it's
interesting
because,
like
some
of
those
changes
are,
are
inside
the
code
base
for
like
kernels
after
like
5.4,
so
like
five,
seven
and
up
have
those
changes,
but
lots
of
things
happening
in
inside
the
space.
We've
been
working
on
a
lot
of
really
exciting
things
at
psyllium
and
we're
and
we're
hiring.
There's.
You
know
tons
of
stuff
happening.
A
B
C
C
A
A
A
D
A
D
Yeah,
okay,
so,
basically
long
short,
is
we
currently
deploy
everything
on
top?
I
basically
wanted
to
move
our
system
over
to
running
onto
pods
and
we've
been
hit.
It's
been
running
fine
for
the
most
part,
but
the
problem
is
right.
Now,
when
we
drain
those
pods,
we
run
into
an
issue
of
oh
actually,
I
just
go
step
back
a
second,
so
the
what
happens
is
we
basically
deploy
a
pod
and
inside
those
pods?
We
have
two
containers
and
maybe
something
more.
I
don't
like
to
remember.
A
D
A
C
E
C
A
A
Okay,
yeah
because
this
is
for
ci
right
so,
like
think
of
it
that
way,
I
know
this
sounds
people
are
like.
Why
are
you
creating
a
docker
container
to
that
tells
it?
But
the
reason
is
because,
like
you
know,
for
ci
jobs,
you
might
want
to
have
multiple
containers
that
go
off
and
create
virtual
environments
and
all
sorts
of
other
things
for
developers.
That's.
This
is
not
an
uncommon
problem.
It's
not
just
a
problem
that
cloud
companies
have
right
so
yeah,
okay,.
A
A
A
Okay
and
then
we've
got
a
doctor,
daemon
right
so
and
then
you're.
So
these
are
both.
These
are
both
processes
inside
of
your
container
lgtm.
Thank
you,
choco.
What's
up
choco,
oh
brighter,
can
I
make
it
brighter?
Maybe
it's
a
little
brighter.
Now,
oh,
the
red
was
what
he
wasn't
working
for:
okay,
cool,
so
all
right,
so
docker.
So
so
all
right!
A
If
we
look
at
the,
if
we
look
at
the
what's
going
on
in
here,
if
I
do
ps
dash
a
x
right,
I've
got
pid
one
in
my
in
my
this
is
essentially
we're
like
here
right
now,
right
we're
at
the
sorry.
I
lost
the
diagram.
We're
here
right
now,
right,
we're
we're
here
and
we're
looking
here.
We've
got
like
pid
one,
and
that's
this
right
here.
This
has
been
in
it
right.
So
if
I
go
to
pid
one
in
here,
my
vm
is
saying
this
is
the
init
process.
A
B
But
this
is
a
kind
container
and
it's
a
very
special
con,
a
very
special
container,
because
we're
kind
of
overloading
the
whole
definition
of
containers
in
this
model
right
yeah
for
the
most
part,
vast
majority
of
the
cases.
You
would
never
run
systemd
inside
of
a
container.
It's
just
not
a
thing
yeah
you
would.
B
We
are
running
systemd
in
there,
but
if
you
were
to
do
a
docker,
inspect
you'd
realize
that,
like
there's
all
kinds
of
stuff,
we
have
to
do
to
get
system
d
to
even
start
inside
of
a
container
we
have
to
mount
or,
like
particular
paths
we
have
to
mount.
It
has
to
be
running.
It's
privileged,
there's
all
kinds
of
wacky
stuff
that
we
have
to
do.
A
Yeah,
so
this
is
a
weird
yeah.
These
are
really.
I
didn't
really
mention
this.
So
is
everybody
familiar
with
kind?
I
kind
of
I
think
we're
kind
of
skipping
ahead
here.
Do
folks
do
folks,
everybody
know
what
kind
is
I
didn't
think
about
that.
I'm
glad
I'm
glad
you.
You
mentioned
that
duffy,
I'm
assuming
everybody's,
like
kind
of
familiar
with
kind
and
stuff,
but.
A
We
live
in
that
world.
Let's
assume
they
are
until
folks
tell
us
otherwise,
like
so
yeah,
so
I
have
a
maybe
we
should
just
get
into
a
vm
and
actually
compare
it,
so
so
choco's
like
yeah.
So
let's
maybe
we
should
just
because
nishad
gave
me
a
private
key
to
another
vm
that
we
have.
This
is
in
what
azure
nishan
and
then
let
me
get
into
another
okay.
Did
you
give
me
the
ip
address
of
this
thing?
20.?
Whatever?
Okay,
I
see
it
yeah,
okay,
so
I
can
ssh
mod.
A
A
Okay,
so
if
I
was
to
go,
I'm
gonna
become
root
right
and
I
can
do
pssax
now.
We
can
actually
look
at
actual
real
processes
in
a
real
vm.
So,
let's
see
what's
so,
let's
look
at
what
duffy
was
just
talking
about
so
okay,
so
so
this
is
what
a
real
computer
does
yeah.
So
what
are
all
these
things?
In
brackets.
B
Those
are
running
processes.
Most
of
the
time
like
the
stuff
in
brackets
is
gonna,
be
it's
gonna
be
stuff
that
you're
like
measuring
this
part
of
the
the
kernel
code.
It's
not
necessarily
programs
that
you're
running,
but
so,
like
you
see,
ns
and
like
task
stuff.
So
this
is
like
you
could
think
of
it
almost
like
background
processes
that
are
part
of
the
the
the
kernel
that.
B
A
A
A
C
B
It'd
probably
be
a
little
tricky,
because
okay,
because
like
as
you
can
see
with
the
rest
of
these
processes,
right
like
you'd,
have
to
start
it
in
a
way
that
the
path
to
that
process
would
resolve
to
what
you'd
want
the
name
to
be.
I
think
there
might
be
there
might
be
a
way
to
get
around
it,
but
kind.
A
E
C
D
C
C
A
A
A
A
We've
got
all
these
kernel
tasks
and
those
are
like
pid
one
through
whatever
one
through
700
or
something
like
that.
It's
got
all
these
other
things
and
then,
after
that,
we've
got
a
whole
bunch
of
other
processes.
Here's,
oh
here's,
chrome!
Here's!
The
ntp
thing
right!
So,
okay,
we
all
know
what
a
lot
of
this
stuff
is
and
then
finally
we
start
seeing
some
stuff-
that's
like
that's
kubernetes,
ish,
so
sis.
So
where
does
systemd
go
on
here?
A
Effectively
system,
d-
okay-
I
didn't
know
that
all
right
so
s-bin
and
it's
winds
up
starting
system
b.
I
I
didn't
okay,
so
so,
if
you're
looking
okay
and
then
so
then
these
there
here
are
some
other
things
that
are.
Presumably
we
could
ps
tree
this.
What
are
we
doing?
Why
didn't?
We
just
do
that
right.
So,
okay,
there
we
go
so
now
we
can
see.
Systemd
is
what's
spawning
all
of
these
right,
so
these
are
the
processes
that
are
running
in
a
normal
vn.
A
A
B
A
Yes
dash,
this
is
cool
okay,
so
you
don't
need
ps3.
You
could
just
do
dash
ef
and
you'll
get
a
tree
of
all
the
process,
all
right,
cool,
okay,
so
does
so.
So,
let's
look
in
here
like
what's
going
on
so
we've
got,
we've
got
a
pause
container
running.
We've
got
another
pause
container
running.
We've
got
coupe
proxy,
it's
running
as
a
privileged
as
a
privileged
pod,
and
then
we've
got
another.
We've
got
this
container
d
shim
and
then
that's
the
parent
of
like
this
pause,
and
is
that
so
does
that
mean?
A
A
B
Please
do
when
we
look
at
that,
like
the
continuity
scheme
runs
cp's
right
because
we're
running
inside
of
kubernetes
we
get
this
infrastructure
container
for
free
and
the
infrastructure
container
is
referred
to
as
a
pos
container
and
that
post
container
holds
namespaces
that
we
will
share
with
any
other
container
that
is
within
the
pod
in
docker.
Typically,
you
would
only
have
like
the
container
and
all
of
the
namespaces
that
it's
associated
with,
but
inside
of
kubernetes
you'll
have
a
pod,
which
means
that
every
container
within
that
pod
will
share
the
same
network
name
space.
B
It
will
show
this.
It
can
share
the
same
host,
pid
name
space.
It
can
share
the
same
a
bunch
of
different
other
name
spaces
that
it
can
share,
but
it's
by
default,
going
to
share
the
same
networking
space
and
so
for
that
trick
to
work.
We
need
to
have
some
place
to
hold
it
right,
so
we
have
to
hold
that
network
namespace
in
the
pods
container
and
then
any
subsequent
container.
That
is
part
of
that
pod.
We're
just
going
to
bind
mount
if
you
will
into
the
networking
space
associated
with
that
pause
container.
B
A
A
B
So
if
you
have
a,
if
you
do
docker
run
bash,
then
what
will
happen
is
that
it
will
assume
docker
will
assume
based
on
those
parameters,
that
it
will
create
a
new
container
based
on
the
file
system,
that
it
pulls
down
for
that
image,
and
it
will
give
it
its
own
network
name
space.
It
will
give
it
its
own
pid
name
space,
we'll
give
it
its
own
file
system
view
it
won't
mount
any
volume.
B
A
B
A
B
B
That's
packaged
inside
the
container,
and
that's
just
one
of
the
many
examples
of
like
a
container
in
it
that
you
can
run
this
is
actually
I
think
this
comes
initially
from
alpine
or
something
like
that.
But
I
I
think
it's
like
the
built-in
init
process
that
that
comes
with
a
bunch
of
different
containers,
including
this
one.
A
B
B
So
if
you
look
at
the,
if
you
look
at
the,
if
you
do
a
docker
inspect
of
this
container,
okay,
our
kettle
inspect
of
this
container,
then
you'll
see
that,
like
the
the
run
command
or
whatever
like
the
the
the
command,
that's
running
when
you
start
the
container
up,
docker
run
would
be
user.
Local
bin
run,
svd
or
dash
p.
B
Because
that's
an
init
process
just
like,
if
you
were
to
look
at
your
system,
you
do
psi
minus
cf
on
the
bigger
box
you're
going
to
see
like
your
you
know,
s
being
init,
and
then
everything
else
is
a
child
of
that
same
thing.
Right,
run.
Sv
deer
is
the
init
process
and
it
will
become
the
parent
of
any
long-running
processes
defined
within
that
services.
Directory.
C
A
B
E
B
So
docker
run
bash
is
sort
of
kind
of
a
translated
version
of
ctr
run
container,
but
it's
yeah.
It's
mapped
to
an
api
that
people
are
used
to
in
docker.
So
if
you
could,
you
could
get
the
same
container
running
just
by
using
ctr
commands
against
the
container
d
socket
as
you
could
using
docker
run
commands
against
the
docker
socket.
So
the
docker
is
the
consumer
of
container
d
yeah
we're
so
far
or
the
good
data
depart.
B
B
E
B
B
C
A
B
B
D
A
C
D
E
C
B
A
B
A
A
E
A
A
A
A
B
B
What
can
we
do
instead
and
that's
where
the
whole
idea
of
shims
came
along
was
like
well,
if
we
made
it
so
that
we
were
able
to
disconnect
the
running
container
from
the
parent
process
of
docker,
then
we
would
be
able
to
upgrade
docker
and
not
worry
about
having
to
restart
every
process.
That's
running
inside
of
a
container
yeah,
and
that
is
a
configurable
thing
in
docker.
But
it's
not
the
default.
That's
still
so
like
if
you're,
using
docker
at
all.
B
That's
the
thing
that
you
can
actually
set
in
your
docker
dockerdaemon.com
or
whatever
your
docker
daemon
conf.
That
will
allow
you
to
like
make
it
so
that
you
can
restart
the
doctor.
Daemon
and
all
of
those
shims
will
continue
be
running
happily
in
the
background
and
when
you
restore
and
when
you
restart
the
doctor,
daemon
it'll,
just
re-plumb,
all
of
those
shims
and
you'll
still
be
able
to
do.
Docker
run
docker
exec.rps.
D
A
E
B
E
B
Cleaner
way
way
cleaner
way
of
installing
and
actually
like
it
follows
whatever
the
distribution
you're
in,
so
if
you're
on,
like
ubuntu
or
debbie,
and
a
red
hat
or
whatever,
if
you
do
like
get
docker
dot,
io
slap
type
or
pipe
sudo
bash.
I
know
I
I
hate
to
recommend
that
but
like
if
you
don't
want
to
do
it
properly,
like
you
just
want
to
do
it
quickly.
This
is
a
great
way
to
do
it.
A
A
B
B
A
D
B
So
the
answer
to
that
question:
conrad
is
no.
You
can
write
kind
anywhere.
You
can
run
docker,
so
kind
can
run
on
linux
docker.
It
can
run
on
docker
desktop
if
you're
on
a
mac.
So
the
real
question
comes
down
to
like
if
you're
running
on
windows
or
mac,
the
way
to
get
to
a
running,
docker
daemon.
One
way
to
do
that
is
to
use
docker
desktop.
D
C
A
For
most
people,
typically
most
people
running
kind
typically
are
yeah
they're
running
it
on
a
desktop
but
like,
for
example,
when
you
run
tanzu
kind
is
kind
of
requirement
at
this
point.
So
like
there's
a
lot
of
people
that
run
tanza
that
bootstrap
it
from
a
linux
node
without
any
kind
of
desktop
and
for
life.
A
A
The
initial
thing
we
were
going
to
talk
about
was
post
pre-stop
pre-start
hooks
all
that
stuff
so
like.
If
I
go
back
to
nishad's
original
problem
right-
and
we
say
well,
what
was
the
like-
the
what
the
kind
of
the
original
problem
statement
that
shot
had
was
that
we
were
going
to
was
that
he's
got
this
docker
daemon
and
the
doctor
damon
and
the
celery
process.
So
these
these
are
both
processes
that
are
running
inside
of
a
pod
right
and
oh
here,
I'm
using
red
again.
Let
me
get
back
to
here.
A
He
was
running
these
inside
of
a
pod
and
then
the
problem
he
had
was
that
this
celery
process
like
if
he
kills
this,
if
he
kills
this
whole
thing
right
like
this
docker
worker
may
have
other
things
going
on
right.
It
may
have
like
some
other
stuff.
That's
going
on
and
like
your
goal
was
that
the
celery
worker
was
in
control
of
when
the
docker
process
died.
Right,
nishad.
D
A
D
A
D
I
was
gonna
say
what
I
really
wanted
was
I
wanted
docker
to
turn
termination
to
wait
until
salary
is
actually
done
in
a
lot
of
ways.
I
think
what
this
came
up
earlier
was.
This
is
a
lot
like
a
sidecar
container,
where
we
want
to
wait
until,
like
the
primary
process,
salary
is
exited
cleanly.
The
salary
will
basically
wait
till
everything's
processed
before
exiting,
but
docker
is
just
like.
I'm
just
going
to
stop
everything
and
then
exit
right
now.
A
Yeah,
because
it's
because
these
are
receiving
and
the
root
cause
of
this
is
that
this
is
these-
are
both
research.
Those
these
are
both
are
receiving.
The
same
kills,
kill
switch
at
the
same
time,
so
there's
so.
Let's
go
over
the
pre-start
and
the
post
or
the
pre,
the
posts
start
and
the
pre-stop
hooks
right.
So
before.
B
E
B
B
B
And
everybody
gets
it
right.
So
if
you
get
so
when
when
at
times
when
it
comes
time
to
kill
this
pod,
the
cubelet
will
send
a
sig
term
to
all
of
the
containers
of
the
pod.
Okay
and
what's
happening,
is
both
docker
and
celery
are
getting
them
at
the
same
time
and
doing
their
good
work
right.
So
docker's
like
okay,
I'm
out,
you
know
and
celery's
like
wait.
B
B
A
A
A
D
B
E
C
B
B
E
D
B
B
D
C
A
A
B
B
A
E
B
A
D
A
All
right,
let's
go
back
here
so
so
in
the
life
cycle
of
a
pod
right
in
the
life
cycle
of
a
pod.
You
have
we
have
we
have
these.
We
have.
We
have
post
art
we
have.
We
have
you
have
init
pods
right,
so
the
first
thing
you've
got
is
you've
got
these
in
it.
So
well,
we've
gone
through
all
this
life
cycle
stuff
right
so
like
forget
about
all
this,
like
we're
not
talking
about
that
anyway,
we're
not
talking
at
a
higher
level
where
it's
like.
A
A
My
pause
container
starts.
I
guess
in
here
right.
My
init
pods
are
all
in
a
separate
process.
Pause
names
like
they
have
separate,
pause,
containers
right
and
then
my
knit
pod
starts.
Actually
each
one
of
these
has
a
pause
container.
That
runs
also
right,
and
so
then
my
init
process,
so
then
my
knit
pods
are
done,
and
then
I
have
a
process
here
that
starts
and
that
process
right
after
that
starts
is
when
the.
A
A
A
D
No
basically,
what
happens
is
like
I
think.
Basically,
what
happens
is
it's
you'll
send
a
pre-stop
signal,
start
timer,
send
the
pre-stop
and
then
when
pre-and,
then,
if,
by
the
time,
pre-stop
isn't
done,
it'll
just
send
a
sick
kill,
and
the
problem
I
have
here
is
you
because
the
salary
process
doesn't
actually
expose
an
api
endpoint.
There's
no
easy
way
to
tell
when
salary
is
exited
and
use
that
information
and
basically
use
that
information
to
block
the
exit
of
the
docker
daemon.
D
A
B
A
A
A
B
Fails
if
the
container
is
already
terminated
or
a
completed
state,
the
hook
must
complete
before
the
term
signal
to
stop.
The
container
can
be
sent.
Oh
okay.
Well,
then,
yeah
you're
right!
This
does
interject
before
that
the
pods
termination
grace
period
countdown
begins
before
the
pre-stop
hook
is
executed.
So
weirdly
we're
both
right.
B
So,
regardless
of
the
outcome
of
the
handler,
the
container
will
eventually
terminate
within
the
pods
termination
grace
period.
So
you
can
so
basically
that's
wild
okay.
So
so
the
house
of
cards
is,
you
have
a
running
container.
You
have
a
pre-stop
hook
defined
the
pre-stop
hook.
Code
is
sent
whatever
you
would
like
to
find.
There
is
sent,
then
the
sig
term
is
sent
and
the
clock
starts
for
grace
period.
B
B
A
B
A
A
C
C
A
A
A
B
C
A
Let's
give
a
little
space
so
that
our
friends
can
say
stuff
and
be
on
the
internet
with
us
hold
on
a
second
all
right.
Let's
here
we
go
here,
we
go
eric
eric
you,
you
showed
up
like
you've
been
at
the
last
three
tgiks,
there's
nothing.
I
wouldn't
do
for
you,
man,
okay,
so
friedrich's,
here
too
and
friedrich's
always
here
friedrich's,
my
friend
me
and
him
just
did
a
kubecon
talk
today.
A
A
E
A
A
B
A
A
A
E
A
B
B
C
E
D
B
D
B
A
Cluster,
so
I
guess
we
should
ask
our
friends
here:
do
you
all
want
to
like
move
on
with
this
pre-stop
thing,
or
do
you
want
to
see
what's
wrong
with
this
cluster?
That's
in
the
weirdest
state
that
I've
ever
seen
a
cluster
in
my
entire
life,
where
we
created
a
pod
and
it's
pending
and
nothing
is
complaining
about
why
it
can't
schedule
it.
A
I
don't
think
anybody
cares.
I
don't
know,
though,
maybe
somebody
does
I
totally
I'm
whatever
okay.
So,
let's
start
doing
the
other
thing
and
if
people
are
like,
I
want
to
see
it's
cattle
eric
wins
again:
oh
eric
you're
at
the
bottom.
We're
doing
that
meta
thing
again.
We're
like
okay.
Let
me
move
this
back
up
to
the
top.
You
know
it's
just
like
instinct.
You
know
that
weird
instinct,
you
have
to
use
all
your
screen
real
estate,
okay,.
A
E
A
A
E
A
A
C
B
B
A
A
A
Cool
yeah
we
do
have
psyllium
in
here,
you
know
who
put
it
in
there,
a
meme
put
it
in
there.
I
don't
know
if
he's
here,
though
I
think
he
left
see.
Look
at
this,
I
mean
put
it
in
there
eight
months
ago,
come
on
mean
okay.
This
is
how
we're
doing
psyllium.
If
there's
something
wrong
with
us,
let
us
know
we
do
helm.
Psyllium
install
sounds.
B
A
Okay,
so
anyways
yeah,
so
it's
just
like
a
one.
You
can
just
do
like
cni
equals
psyllium
in
the
beginning
here.
So
I
just
use
this
anytime,
I'm
making
a
kind
cluster
so
that
I
can
have
a
cni
on
it.
Otherwise
you
always
run
into
this
weird
thing
where
you
run
a
kind
cluster
and
you
do
some
stuff
and
you're
like
oh.
I
wish
I
had
a
real
network
and
then
you
have
to
go
install.
A
A
A
C
A
C
A
A
Right
network
policies
yeah
so
so
there
was
a
port
range
feature
that
we
added
to
the
network
policy
api
and
it's
still
beta,
and
we
if
we
can
get
one
more
cni
to
adopt
the
port
range
feature,
then
we
can
graduate
that
to
ga
and
I
think
what
ricardo
is
asking
music,
whether
psyllium
can
add
those
because
I
don't
think
oven,
kubernetes
can
do
it
calico
and
andrea
both.
Do
it,
though,
just
totally
off
topic.
A
A
A
A
A
E
A
So,
okay,
so
all
right,
so
I
think
we've
got
five
minutes
left.
I
want
to
make
sure
we
at
least
briefly
talk
about
some
of
the
other
things
that
we
sort
of
brought
up
for
this
for
this
sort
of
this,
so
the
the
originally
we
we're
going
to
look
into
c
groups
hooks,
so
we
definitely
got
to
cover
the
hook
stuff.
I
wanted
to
talk
just
really
quickly
about
runtime
classes,
because
there's
like
the
the
the
so
runtime
classes,.
A
Okay,
I
mean
that
would
make
the
most
sense,
because
what
we're
expecting
is
that
thing
would
run
for
infinity
and
then
it
would
finally
get
killed.
So
that's
probably
what
what
happened
then,
so
so
we're
expecting
that
137
to
be
the
sig
kill,
so
runtime
classes
they
solve
this
fundamental
problem
of
like
you've
got
a
pod.
A
The
pod
needs
knows
how
it
needs
to
run
and
there's
like
you
could
do
a
thing
with
taints
and
tolerations,
where
you
modify
the
nodes
in
your
cluster
or
you
could
just
define,
you
could
define
a
runtime
class
right
and
then,
when
you
define
the
runtime
class,
it'll
it'll
it'll
wind
up
triggering
this
hand,
learn.
For
example.
This
is
important
for
windows
right.
You
can
have
a
windows,
runtime
class.
You
can
have
a
another
runtime
class
right
and
the
reason
I
thought
this
was
kind
of
worth
mentioning.
A
Yeah,
so
actually
I'll
show
you
first,
I'm
going
to
show
you
something
else
if
you
go
to,
if
you
jump
into,
if
you
jump
into.
Actually
I
have
an
issue
I
filed
about
this
because
I
was
really
confused
about
it
at
one
point.
So
when
I
was
first
running
containers
on
windows
a
long
time
ago,
I
was
really
confused
about
this,
because
your
runtime
class
for,
for
example,
you
know
it.
It's
actually
there's
a
name
for
the
runtime
class.
That's
actually
hard
coded
into
container
d
for
windows
by
default,
which
is
config.
A
Config
windows
go
so
you
know
that's
the
container
d.
This
this
stuff
gets
past
that
low
into
the
into
the
container
runtime
right.
So
you,
your
your
container,
run
time,
your
cri,
you
know
it
container
even
will
see
this
and
it'll
say.
Oh.
I
need
to
run
this
as
like
a
windows
process
right
and
it'll
go
trigger
the
right
windows
container
d
thing.
To
start
your
start,
your
container
right
so
like
that's!
This
whole
thing
up
here.
This
whole
thing
that
we
were
drawing
earlier,
that
I
don't
know
why.
A
A
You
know
kubernetes,
like
scheduling
and
stuff,
so
that
was
like
one
of
the
things
that
I
thought
was
kind
of
related
to
this
that
we
should
look
into,
and
so
I
guess,
I
think,
that's
kind
of
good,
because
at
least
we
got
to
go
through
these
two.
We
didn't
really
get
to
do
much
on
c
groups,
but
like
what's
the
simplest
way
to
show
them
some
c
groups
we
can
go
into
and
if
you
all
have
done
this,
it's
kind
of
an
interesting
thing
to
do.
E
A
A
A
B
And
then
app
and
then
c
group,
so
proc,
one
five,
six
nine
c
group
enter.
Oh,
maybe
that's
not
what
I
wanted.
What
did
it
it's
there?
It
is
right.
No
that's
not
it
go
back,
do
ls
minus
slash
and
then
just
do
the
one.
Five,
six
nine
for
a
second
there's
another
folder
in
here
that
I'm
looking
for
ns.
That's
what
it
is
so.
B
B
D
B
If
they're
in
the
same
pod,
they'll
have
the
same
net,
s
they'll
have
the
same
they'll
all
be
associated
with
the
same
c
group,
because
right
now,
right
now,
they're
all
part
of
the
same
root
c
group.
So
if
you
do
system
d
systems,
system
b,
c,
gls
you'll
be
able
to
see
all
of
the
c
groups
that
are.
B
A
B
D
B
A
E
B
Let's
take
the
keyword,
for
example,
here
right
yeah,
you
have
a
choice
when
you're
configuring
docker
and
also
when
you're
configuring,
the
cubelet
and
your
choice
is
between
allowing
system
d
to
be
the
to
be
the
thing
that
doles
out
c
groups
or
allowing
or
or
creating
your
own
under
c
group
fs,
and
both
of
these
are
configurable
both
at
docker
and
also
at
the
cubelet.
But
oh
wait.
B
B
A
E
A
B
E
B
A
B
At
one
that's
using
secret
fs,
you
will
see
a
whole
different
root.
C
group
that's
been
defined
as
c
group
of
c
group
of
s,
and
that
will
be
what
you
allocate
c
group
content
from,
and
then
the
thing
that's
weird
there
is
that
now
system
d
thinks
it
has.
The
root
c
group
and
c
group
fs
thinks
that
it
has
this
root
c
group
and
so
effectively
they're
both
trying
to
allocate
the
resources
that
are
available
for
the
whole
system
and
they're
not
working
together.
B
B
B
D
B
B
A
But
where
does
it?
Where
is
the
truth
of
how
much
free
memory
there
is
like
as
soon
as
systemd
allocates
a
process,
isn't
c
group
fs
going
to
be
bound
to
the
truth
of
what
was
allocated
like
so
in
this
case?
If
I
have
this
pi
here
and
if
system
d
allocates
this
much
of
it,
even
though
these
they
don't
talk,
they
don't
like
each
other
c
group
fs
over
here.
Let's
make
him
different.
B
B
B
This
is
more
like
a
provisioner
model
right
where,
like
you're
saying
when
you
created
that
pod,
you
said,
give
this
thing:
2
gig
of
memory
and
the
c
group
controller
is
like
got
it
2gig
of
memory,
that's
what's
in
there
and
the
current
the
kernel
above
it
is
like
well
when
that
namespace
was
created,
that
was
using
two
gig
of
memory.
It
doesn't
care
that
there's
another
controller.
That's
actually
also
allocating
memory.
That's
over
subscription.
That's
not
it
doesn't
care
at
all.
If
that's
happening.
B
In
that,
as
long
as
they
don't
conflict
like
as
long
as
you
don't
have
a
hard
conflict,
then
you're
fine,
but
if
you
like,
but
if
you
like
over
allocate
things
and
the
open
killer,
has
to
come
along
and
clean
stuff
up
for
you,
what
decision
does
it
make?
Which
one
does
it
follow,
system,
d
or
secret
best
which
one's
right?
A
B
B
A
B
B
D
B
A
C
A
A
A
E
A
A
A
B
A
E
A
A
It's
good
seeing
you
duff
thanks
so
much
we
would.
I
would
have
been
like
fumbling
around
inside
of
that
run
directory
trying
to
figure
out
where
my
memory
directories
and
all
that
or
if
it
wasn't
for
you.
So
I
I
really
appreciate
you
teaching
us
all
this
stuff
today,
man
and
so
all
right,
thanks
nishad
for
coming
to
hang
out
for
your
first
tgik
and
we'll
see
you
all
next
time.