ContainerDays 2023
as the organisers put it
Join us for ContainerDays 2023 Hybrid from September 11-13! Meet and exchange with other cloud native enthusiasts from across the globe in person or in the virtual world.
| title | author | length |
|---|---|---|
| Scaling Kubernetes up to 1,000 Control Planes - Dario Tranchitella | Dario Tranchitella | 34m |
Kamaji implements a control plane as a service by running API servers as pods, using Cluster API and kubeadm for bootstrap, supporting OpenStack, Equinix, AWS… | ||
| Looking at the Past to Understand our Future — Jorge Castro | Jorge Castro | 19m |
Argument presents cloud-native as an ecosystem that needs long-term stewardship rather than quarterly metrics, urging analysis of project-to-project and… | ||
| Get to know Envoy - the modern proxy for cloud-native infrastructure - Baptiste Collard | Baptiste Collard | 33m |
Envoy runs as a C++ nonblocking proxy with dynamic config without restart and a thread model that multiplexes many sockets per worker; it routes via listeners… | ||
| Lessons learned writing 10+ Kubernetes Operators - Lars Francke and Jannik Heyl | Lars Francke, Jannik Heyl | 36m |
Claims a portfolio of 15+ operators, built in Rust with generics to extract reusable code, and reports concrete pain points: no operator design standards… | ||
| ContainerDays 2023 Aftermovie | 02m | |
Thank you for an incredible ContainerDays 2023!
#cloud #kubernetes #cloudcomputing #cloudnative #k8s #devops #gitops #edgecomputing #multicloud… | ||
| Secret Management in Kubernetes: The GitOps Way - Benjamin Ritter | Benjamin Ritter | 26m |
Compares concrete GitOps secret patterns: kubeseal sealed-secrets (CLI + controller, cluster-rooted asymmetric encryption, per-cluster seals, 30‑day key… | ||
| 10 minutes from bare metal to KubeVirt - Robin Nepomuk Mai and Usman Malik | Robin Nepomuk Mai, Usman Malik | 36m |
MAAS PXE boots bare metal into an OS image, Juju uses Juju charms to deploy a bundle that installs Kubernetes (containerd), Ceph OSD/mon storage and exposes… | ||
| From Spreadsheets to "Everything as Code" — Joel Studler and Jéremy Weber | Joel Studler, Jéremy Weber | 34m |
Swisscom replaces scattered spreadsheets with a GitOps pipeline that stores LLD as code (Ansible inventory of IPs), pulls vendor artifacts into JFrog, and uses… | ||
| Cilium & Grafana LGTM! - Raymond de Jong | Raymond de Jong | 36m |
Cilium uses eBPF to emit Prometheus metrics and Hubble to surface rich layer‑7 HTTP metrics that feed Grafana dashboards; a live demo increases request volume… | ||
| Next-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz | Nico Meisenzahl, Philip Welz | 35m |
Cilium uses eBPF to replace iptables latency with identity‑based network security and implements CNI, Hubble observability, and Envoy-based L7 proxying; demo… | ||
| Large-scale kubernetes deployment, which tools to use and how - Rachid Zarouali | Rachid Zarouali | 45m |
Experience report on running hundreds of Kubernetes clusters using Cluster API versus Crossplane, showing a working pipeline that uses Argo CD to drive… | ||
| Magic of Kubernetes Sidecar Injection: Present and Future - Anton Ovchinnikov | Anton Ovchinnikov | 33m |
Explains how automatic sidecar injection actually works: Kubernetes uses mutating admission webhook calls to send pod-creation JSON to an HTTP TLS server which… | ||
| Turn Your Kubernetes Cluster Into a Castle Using Advanced Cilium Network Policies - Philip Schmid | Philip Schmid | 35m |
Practical steps to lock down a Kubernetes cluster with Cilium CNPs: enable hostFirewall: enabled=true and apply Cilium HostPolicies that target node labels… | ||
| Docker exec without Docker - Oliver Seitz | Oliver Seitz | 40m |
Claim: you can replicate docker exec using only native Linux tools and it works. Uses unshare/nsenter to join mount, network, PID and user namespaces… | ||
| Airgapped Kubernetes - Hannes Probst | Hannes Probst | 22m |
Demonstrates that production Kubernetes can run isolated by routing all package and OCI pulls through a central artifact store (JFrog/Nexus/Harbor) and using… | ||
| Automation with Kubernetes – Creating an operator - Johann Gnaucke | Johann Gnaucke | 33m |
Shows a concrete operator built with Kubebuilder and Go that manages a simple password CRD and writes generated secrets via controller-runtime create/patch… | ||
| From Monitoring to Observability: eBPF Chaos - Michael Friedrich | Michael Friedrich | 36m |
eBPF moves observability into the kernel to give SRE and DevSecOps access to syscalls, packets and resource events for debugging, security and profiling… | ||
| DevOps is for startups!Enterprises do platform engineering and here is why - Jürgen Süßner | Jürgen Sußner | 40m |
Enterprise with ~8,500 employees and ~2,000 developers builds a self-service platform that uses Kubernetes clusters as a self-service, Cloud Foundry, Flux… | ||
| A story about platform engineering — Niklas Voss | Niklas Voss | 38m |
A fictional fintech called FlinFunch builds an internal developer platform on Kubernetes using the Kubernetes Resource Model as the API surface. CI runs on… | ||
| Look Ma, No secrets in my Kubernetes Cluster! - Vijay Dharap | Vijay Dharap | 30m |
Compares four secret workflows (plain Git, git-crypt, Sealed Secrets, External Secrets) and demos a CSI-based alternative: Secret-Store-CSI mounts cloud… | ||
| Auto-scaling party:VPA, HPA, KEDA, nodes, how do they dance?-Nic Vermande & Oluebube Princess Egbuna | Nicolas Vermande, Oluebube Princess Egbuna | 37m |
Explains how VPA, HPA, KEDA and Cluster Autoscaler actually behave together and what to install to make them work: metric-server and Prometheus for metrics… | ||
| Beyond Logs, Metrics and Traces. The Data Analytics Paradigm Shift in Observability — Dotan Horovits | Dotan Horovits | 35m |
Claims that observability is observability = data analytics not just logs+metrics+traces, demonstrates OpenTelemetry’s pipeline… | ||
| Kubernetes Multi-Cluster Made Easy - Federica Ciuffo and Marco Ballerini | Federica Ciuffo, Marco Ballerini | 36m |
Demonstrates using AWS VPC Lattice plus a custom Gateway API + MCS controller to expose and import Kubernetes services across clusters and VPCs without layer‑3… | ||
| Multi-Cluster Management Made Easy - Tsahi Duek and Dima Breydo | Tsahi Duek, Dima Breydo | 35m |
Builds reproducible EKS clusters with eks blueprints for CDK that encode defaults so teams instantiate clusters with few parameters. Uses Carpenter + Fargate… | ||
| Balancing Service Centralisation &Team Autonomy in DevOps Organisation Anna McDougall, Andreas Prang | Anna J McDougall, Andreas Prang | 32m |
75% of teams pick a centralized platform so Maps becomes the chosen solution; Maps 1 takes ~4 weeks to provision an environment, Maps 2.0 reduces that to under… | ||
| Live Hacking Cloud Architectures - Thorsten Jakoby and Mirna Alaisami | Thorsten Jakoby, Mirna Alaisami | 33m |
Attackers brute force a Jenkins instance using the rockyou password list, extract an encrypted credential blob from the Jenkins credentials plugin by asking… | ||
| Forensic container checkpointing and analysis - Adrian Reber | Adrian Reber | 42m |
Kubernetes 1.25 adds forensic container checkpointing that uses creu to write a tar checkpoint archive containing changed rootfs files plus raw memory pages… | ||
| Enabling event-driven automation using Knative - Robert Guske | Robert Guske | 40m |
Knative is shown installed via VMware Tanzu Application Platform and Cloud‑Native Runtimes and used to run request‑driven services that scale from zero with… | ||
| Datacenter in a Suitcase - a real small edge case - Mario Fahlandt | Mario Fahlandt | 32m |
A portable datacenter fits into a suitcase by stacking ARM compute modules on a MiniITX Clusterboard, running a lightweight Kubernetes control plane from… | ||
| The global data plane for autonomous driving from Day 0 to Day 2 — Stephan Reimann and Simon Putz | Stephan Reimann, Simon Putz | 37m |
Describes a global hybrid data plane: a distributed data fabric with multi-protocol support (files, objects, Kafka, POSIX/HDFS) fronting Kubernetes so… | ||
| The Deutsche Bahn's Path to digital sustainability — Gualter Baptista | Gualter Barbas Baptista | 36m |
Deutsche Bahn frames developers as key actors for carbon reduction and proves a platform route: Kubernetes + platform engineering surface real‑time energy and… | ||
| Cilium Wars: Scaling Up Your Network with Jedi-like Cilium Handling Techniques - Yash Tandon | Yash Tandon | 16m |
Shares concrete scaling outcomes from running Cilium on multi-tenant clusters with >3 years of ops experience and a real case where defaults choked a cluster… | ||
| Service MESH without the MESS - Raymond de Jong | Raymond de Jong | 37m |
Cilium Service Mesh uses eBPF to remove sidecars by shortcutting sockets to a per-node Envoy proxy, cutting triple TCP traversals and claiming 3–4x latency… | ||
| Deploying Databases on Kubernetes: Helm vs. Operators - Eric Schäffer and Manuel Swiercz | Eric Schäffer, Manuel Swiercz | 27m |
Teams deploy Postgres and Elasticsearch daily using Helm charts and operators, and recommend Helm for packaging and composition while using operators for full… | ||
| Debugging Go: from zero to Kubernetes - Michele Caci | Michele Caci | 31m |
Step‑by‑step guide to use Delve to inspect Go programs locally, inside Docker, and inside Kubernetes: compile and start Delve with dlv debug main.go or use dlv… | ||
| k8s Validating Admission Policy And Crossplane - Viktor Farcic | Viktor Farcic | 27m |
Claim: enforce Policy-as-Code for an Internal Developer Platform by validating a single high-level resource instead of dozens of low-level objects. Uses… | ||
| Building on-Premises MLOps for ISS Columbus Ground Operations - Samo Turk | Samo Turk | 35m |
On-prem MLOps for ISS Columbus processes sensitive time series telemetry without public cloud by deploying a fully automated stack (Ansible + GitLab CI) that… | ||
| Managing and securing Kubernetes secrets - Simon Pearce | Simon Pearce | 39m |
Argues that secrets belong in an external KMS and demonstrates a working setup: Secret Store CSI Driver + Helm install syncs Vault secrets into a tmpfs CSI… | ||
| Overcoming the Challenges of Debugging Containers - Jose Blanquicet | Jose Blanquicet | 37m |
Shows an eBPF-based debugger that turns BCC and raw kernel events into container-aware BCC filters, correlates events with container metadata and the container… | ||
| Observability is Too Expensive - Chris Cooney | Chris Cooney | 30m |
Observability regularly eats 10–30% of cloud spend; indexing is the main cost and 99% of indexed logs are never searched. CorLogics rebuilds on a streaming… | ||
| Secure containers - Michael Wager and Michael Helwig | Michael Wager, Michael Helwig | 32m |
Shows a live Node.js command‑injection exploited to get a reverse shell from a Docker Hub node:16 image, then rebuilds with distroless using a multi‑stage… | ||
| Building Apps in Kubernetes - Nic Vermande and Oluebube Princess Egbuna | Nicolas Vermande, Oluebube Princess Egbuna | 34m |
95% demo that builds a five‑service Go joke generator using NATS, Redis and MongoDB and calls OpenAI Davinci for joke text, deployed to minikube with DevSpace… | ||
| OWASP Kubernetes in-depth - Nigel Douglas | Nigel Douglas | 32m |
OWASP Kubernetes T10 (launched 2022) maps ten concrete cluster risks and practical fixes: analysis of 22,000 images finds 83% of images have vulnerabilities… | ||
| 50 Shades of K8s Autoscaling - Mario Leander Reimer | Mario-Leander Reimer | 38m |
Shows concrete autoscaling setups: uses HPA (resource and custom metrics via metric-server and Prometheus adapter) to scale a PHP app from 1 to 6 replicas… | ||
| How to make Kubernetes rhyme with prod readiness - Tiffany Jernigan and Matthias Haeussler | Tiffany Jernigan, Matthias Haeussler | 36m |
Kubernetes by itself lacks logging, metrics, ingress, network policy enforcement, persistent-volume plumbing and environment-specific YAML templating, so… | ||
| Building a vendor-agnostic IAM platform using crossplane — Stefan Möhrle | Stefan Möhrle | 33m |
Centralized GitOps IAM uses Crossplane + ArgoCD to control Keycloak, Grafana and cloud accounts, converting existing Terraform providers into Crossplane… | ||
| GitOps on all layers – maintain your Kubernetes cluster! — Hafid Haddouti | Hafid Haddouti | 29m |
Shows a concrete GitOps pattern that configures entire clusters (not just apps) using ArgoCD for reconciliation, kustomize overlays for capability versioning… | ||
| The Need For Speed: Scaling Go Microservices - Artur Kondas | Artur Kondas | 37m |
Shows concrete steps to turn SEPA batch payment processing that once took hours into minutes by benchmarking before scaling and applying small targeted fixes… | ||
| How to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz | Nico Meisenzahl, Philip Welz | 36m |
Shows concrete wins: switching the base image to Wolfi base image drops vulnerabilities from 798 to 0 and uses reproducible builds with mage/apko producing APK… | ||
| Building a universal policy platform for Kubernetes - Victor Cuadrado Juan | Víctor Cuadrado Juan | 36m |
Kubewarden is a CNCF project that runs policies as WebAssembly so policies become portable OCI artifacts and can be pulled from registries; it ships a policy… | ||
| What We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli | Gal Gibli | 30m |
Kubescape scans from 10K+ unique Kubernetes clusters (about 177K scans, ~40M objects) reveal concrete failures: 91% run containers as root, widespread failures… | ||
| Exploring Container Security: A DevSecOps journey securing a fake shop - Jeremy Guerrand | Jérémy Guerrand | 39m |
Demo of Kico Cloud using Azure CNI and Calico shows concrete steps: sign up for a 14‑day trial, connect clusters in 5–15 minutes, then create Calico policies… | ||
| Switching your CNI — Simone Sciarrati & Federico Hernandez | Simone Sciarrati, Federico Hernandez | 32m |
40+ teams, 3,000+ deployments and ~10,000 pods move from the AWS VPC CNI to Cilium without creating new clusters by performing an in-place live migration over… | ||
| Systems Thinking for Dev Organisations - Lian Li | Lian Li | 37m |
Argues that systems thinking — stocks, flows, feedback loops and archetypes — gives specific levers to change developer organisations: three archetypes are… | ||
| BumbleBee: Or How I Learned To Stop Worrying And Love eBPF - Krisztian Fekete | Krisztian Fekete | 35m |
Bumblebee packages precompiled eBPF programs as OCI-compatible containers so you can build, push and run kernel probes without writing a separate userland… | ||
| Ephemeral Containers in Action - Running a Go Debugger in Kubernetes - Marvin Beckers | Marvin Beckers | 36m |
Launches Delve inside an ephemeral container so a running pod never restarts, using kubectl debug with the --target flag to share PID/NS and attach to PID 1… | ||
| Exploring OnMetal — Sebastian Sutter and Florian Fuerstenberg | Sebastian Sutter, Florian Fuerstenberg | 33m |
Gardener on Metal is a Kubernetes-driven IaaS that implements infrastructure as Kubernetes APIs and operators using KVM for VMs, Pixie boot from OCI… | ||
| Profiling in the cloud-native era - Matthias Loibl | Matthias Loibl | 36m |
Parca open-source continuous profiler scrapes process profiles (originally 100 Hz sampling, practical deployments use 19 Hz sampling (previously 100 Hz)) with… | ||
| Untrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini | Francesco Beltramini | 34m |
Walks through an end-to-end threat model that splits supply chains into pre-build, build, post-build stages and maps attack trees to concrete mitigations… | ||
| Save your pocket and more by implementing FinOps! — David Sterz | David Sterz | 35m |
A concise FinOps playbook: implement OpenCost centrally to get per-namespace cost transparency (resolves cloud provider blind spot), follow the FinOps phases… | ||
| Container and Kubernetes security policy design: 10 critical best practices | Jérémy Guerrand | 23m |
Calico positions itself as a pure Calico CNI + policy engine that supports IPtables, eBPF dataplane (removes kube-proxy, preserves source IP) and VPP/Windows… | ||
| Securing the Kubelet API: Why is it important? | Koray Oksay | 12m |
Kubelet API misconfiguration lets an attacker list node pods, read container logs and even exec commands remotely; the demo uses a one‑node k3s cluster on GCP… | ||
| How do you secure your SDLC | Batel Zohar, Paula Schäfer | 33m |
Practical steps for securing the SDLC with containers: enable Docker Content Trust and set resource limits to reduce attack surface and prevent privilege… | ||
| Embracing Sustainability in Cloud-Native Ecosystems | Francisco Riveros Escobar | 34m |
Cloud migration can cut energy use dramatically — cited studies show 80% energy reduction moving from enterprise data centers to cloud. Cloud providers pledge… | ||
| Now we’re all cloud natives, what’s next? | Andrew Randall, Christopher Liljenstolpe | 36m |
Kubernetes reaches mainstream adoption and the presenters argue three concrete trends shape what’s next: AI driving developer/operator productivity (citing… | ||
| Service cockpit - developer friendly Grafana based monitoring aggregator | Aleksandr Zharkov | 31m |
A Grafana-based aggregator collects Prometheus metrics, OpenSearch logs, Application Insights, Azure Monitor, Azure Data Explorer and Postgres exporter metrics… | ||
| Born in the Cloud growing at the Edge? | Sebastian Scheele | 14m |
Kubernetes moves from cloud data centers into many edge tiers — regional, access, on‑prem and tiny microcontroller devices — because AI inference and Industry… | ||
| Evolution of security strategies in K8s environments | Jose Manuel Ortega | 30m |
In the latest versions of K8s there has been an evolution regarding the definition of security strategies at the level of access policies to the cluster by… | ||
| HA and Data Mobility for persistent Volumes | Daniel Paul | 35m |
Provides a Kubernetes-native storage layer that consumes worker-node block devices (VMDK, EBS, LUNs) into a pooled abstraction, offers app-consistent snapshots… | ||
| Data Space to boost the European data economy | Giovanni Coppa | 21m |
A Walsburg city proof‑of‑concept runs on Kubernetes and Kubermatic and exposes parking occupancy, frequency, estimated arrival and reservation APIs to apps and… | ||
| The Cloud Native Journey: Navigating the Stages of Maturity in Observability | Jesus Angel Samitier | 30m |
Presents six stages of observability maturity with specific practices: start with availability dashboards and restart playbooks, add PromQL alerts (example… | ||
| Make threats visible in your cloud environment — Eric Jung | Eric Jung | 21m |
Shows concrete tooling and thresholds: Trend Micro Vision One and artifact scanner integrate image scanning, runtime sidecar monitoring and XDR-style log… | ||
| The DevOps Improv Session | Lian Li | 16m |
Improvisational session that plays specific games like Three-headed DevOps consultant and Fortunately Containers, Unfortunately Kubernetes and requires… | ||
| Put the ‘Auto’ in Autoscaling — Erwin Daria | Erwin Daria | 30m |
Storm Forge deploys optimize live as a lightweight agent single pod that scrapes cAdvisor metrics, sends them to a SaaS ML backend, and emits YAML patch… | ||
| nothing matches | ||