ContainerDays Conference 2024
2024-09-03..2024-09-04
-- online --
as the organisers put it
Join us at ContainerDays Conference 2024 to immerse yourself in the latest trends and innovations in container technology. Explore expert insights, networking opportunities, and cutting-edge solutions shaping the future of cloud native.
| title | author | length |
|---|---|---|
| Fireside Chat with Kelsey Hightower & Sebastian Scheele | Kelsey Hightower, Sebastian Scheele | 44m |
A firsthand account of Kubernetes origins recounts getting Google’s pre-release, compiling the code on CoreOS and shipping a tutorial, explains why kubectl… | ||
| Coping with Zero Days with Cilium Tetragon | Liz Rice | 42m |
Demo shows Cilium Tetragon using eBPF to detect and forensically log use of liblzma versions 5.6.0 and 5.6.1 tied to the XZ utils backdoor, emitting rich JSON… | ||
| Building Trust in Fintech: DevSecOps Strategies at Saxo Bank | Jinhong Brejnholt | 36m |
Saxo Bank runs a DevSecOps platform that shifts security left with automated checks: SonCube code quality and test coverage, JFrog and "jrog" scanning for… | ||
| Seven years and counting – The DevOps journey at Hermes Germany | Stephan Stapel | 34m |
Hermes Germany moves from siloed functional teams (planning, dev, test, ops) in 2015 to cross-functional product teams with T‑shaped skills, invests heavily in… | ||
| From Isolated Services to Integrated Ecosystems: Platform Evolution at Deutsche Bahn | Gualter B | 36m |
Cloud migration starts with selling data centers in 2016 and a hard deadline (no on‑prem DCs by 2021), driving a devops, self‑organized rollout that enables… | ||
| Confidential Cloud Computing How to get healthcare data securely | Giovanni Coppa | 34m |
Proof-of-concept confidential cloud for the European Health Data Space is underway, aiming for an MVP by Q1 next year and six applications already live in… | ||
| Building an IoT & Data Ecosystem for one of the Globe's Largest Container Fleets | Martin Lipphardt | 32m |
Hapag-Lloyd equips ~2.2 million containers with IoT trackers that record GPS, impact, temperature and humidity every 15 minutes, generating ~60 million… | ||
| Running AI Workloads in Containers and Kubernetes | Kevin Klues | 30m |
Containers inject host GPU user space libraries at runtime using CDI specs so Docker 25 and runtimes can expose GPUs without bundling drivers and Nvidia ctk… | ||
| Building and Operating a Highly Reliable Cloud Native DNS Service With Open Source Technologies | Hoang Anh MAI | 35m |
On‑prem cloud native DNS for Swisscom 5G is implemented with PowerDNS and ExternalDNS backed by per‑cluster databases and a CoreDNS forwarding layer; it serves… | ||
| Sandbox to confidential containers: A brief on the evolution of container isolation | Akash Gautam | 19m |
Containers run as host processes using namespaces and cgroups, so sandboxing adds a kernel boundary: kata-containers puts each pod in a lightweight VM and… | ||
| Kubernetes Observability with OpenTelemetry | Mirko Novakovic | 34m |
Argues OpenTelemetry actually standardizes collection across logs, metrics and traces, with otel collector as DaemonSet and auto-instrumentation for six to… | ||
| Guardians of the Cloud Navigating the Depths of Cloud Threat Hunting | Thomas Laubrock | 32m |
Research finds concrete incidents and tools: 80% of a sample of 50,000 repos had orphan commits containing secrets discovered by crawling with git clone… | ||
| This won't hurt a bit: Taking Kubernetes to thousands of dental offices | Pedro Oliveira | 33m |
Dentsply Sirona runs Kubernetes on GPUs at the edge to power intraoral scanners across 3,000+ dental clinics, using Kyros + Pallet Edge to deliver zero-touch… | ||
| Balancing Act: HanseMerkur's Regulatory Preparation through Process and Tool Innovation | Rico Oldenburg, Thorben Theil | 31m |
HanseMerkur replaces brittle multi-tenant clusters with a bare‑metal platform (three clusters, ~400 CPU cores, 6 TB RAM) using Calico Enterprise for… | ||
| Cloud Native Hacks for the Real World: Solve your daily struggles with tech | Francisco Escobar | 24m |
Applies concrete cloud-native patterns to everyday problems with interactive Slido votes and live analogies: uses a load balancer to split a cafeteria queue, a… | ||
| Did you sign this (image)? | Jan Bruder | 42m |
Container image signing moves from theory to practice: Docker Content Trust appears in 2015, Kubernetes images start being signed in 2022, and Gartner predicts… | ||
| Fast & Secure: Package, Sign, Verify, and Deploy | Koray Oksay, Batuhan Apaydin | 31m |
Demonstrates packaging a Helm chart, pushing it to an in-cluster Zot registry, signing it with Cosign (keyless via GitHub and with digest hashes), and having… | ||
| Container Security Made Easy – Tools and Techniques for Developers | Nico Meisenzahl, Philip Welz | 36m |
A small .NET weather API is built with a multistage Dockerfile, an SBOM is generated and stored, and dependency updates are opened by depender board pull… | ||
| Optimizing Resource Usage in Kubernetes | Carlos Sanchez | 32m |
Adobe Experience Manager runs on more than 40 Kubernetes clusters and hundreds of thousands of environments; engineers report cluster autoscaler tuning… | ||
| Migrating 2 million CPU cores to Kubernetes | Lucy Sweet | 32m |
Uber migrates its stateless compute fleet from Peloton to Kubernetes, moving over 2 million CPU cores by running Peloton and K8s backends side by side and… | ||
| Demystifying Container Images: Understanding Multi-Architecture, Manifests, IDs, and Digests | Karsten Gresch | 29m |
Local builds produce separate digests for manifest, config (image ID) and each layer, and pushing to a registry often changes the manifest digest because… | ||
| What the heck is Platform-as-a-Product? - How product thinking drives your platform maturity | Dominik Kress | 35m |
Argues that mature platforms require treating the platform as a product using the CNCF Platform Engineering Maturity Model, not just renaming ops roles… | ||
| UX: the missing cloud native ingredient | Andrew Randall | 15m |
A CNCF sandbox GUI called Headlamp aims to be a vendor‑neutral, multicluster Kubernetes UI that actually lowers the learning curve: web and desktop apps, local… | ||
| Navigating the Seas of Transformation: Migrating from EC2 to Kubernetes | Bob Walker | 33m |
Migrates a SaaS from 1800 EC2 instances into Kubernetes over a nine‑month 2019 effort, converting to Linux containers, porting to .NET Core (about 10–15% code… | ||
| Cloud Native Security: A New Paradigm for a New World | Mario Fahlandt | 34m |
Perimeter defenses fail as humans, third‑party packages and sprawling clusters bypass static controls; CVE counts spike dramatically since May after kernel.org… | ||
| Improve container security with automated base image updates | Wietse Venema | 32m |
Google runs automated base image updates for all App Engine and Cloud Functions customers and avoids rebuilding millions of deployed apps by rebasing —… | ||
| Elephant in the room | Sebastian Scheele, Fabian Deutsch | 31m |
Kubernetes is positioned as a platform that can run containers and VMs side‑by‑side using KubeVirt control plane for KVM, but KubeVirt alone lacks VMware‑level… | ||
| Road to a self-healing infrastructure with HolmesGPT and a private LLM | Victor Getz, Artem Lajko | 37m |
Builds a private on‑prem, containerized LLM served via OpenWebUI and AMA, wired into Terraform and Kubernetes for code generation and automated repairs; demo… | ||
| DevOps to DevSecOps journey: what is possible to cover with free and open source tools | Aleksandr Zharkov | 39m |
Two-year migration from DevOps to DevSecOps standardizes pipelines across ~17 product teams and automates artifact and dependency tracking with GitLab + GitHub… | ||
| Continuous CVE Scanning with Trivy Operator | Vitaliy Schreibmann | 16m |
Introduces Trivy Operator for continuous cluster scanning across production-critical Kubernetes, integrating with Terraform, Helm, Jenkins, Prometheus/Grafana… | ||
| Our dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue | Abdel Sghiouar | 36m |
Project supply chains are full of surprising failure modes: a backdoor in XZ, SolarWinds cascading to national infrastructure, and a Swedish supermarket outage… | ||
| Why we need to think about AI and Cloud Native NOW | Nikhita Raghunath, Rajas Kakodkar | 32m |
54% of organizations run AI on Kubernetes and the talk argues that cloud native must change now with concrete work rather than hype For GPUs it showcases… | ||
| Piraeus Datastore - Persistent Volumes for Kubernetes | Philipp Reisner | 33m |
Piraeus Datastore brings LINSTOR/DRBD into Kubernetes with an Operator, CSI driver, helm charts, kubectl plugin and HA controller to deliver RWO and ROX… | ||
| Goodbye Ingress - Hello Gateway API | Simon Pearce | 37m |
Gateway API replaces Ingress with concrete resources: Gateway class deployed by Cilium, a Gateway (LoadBalancer IP assigned) and HTTP/TLS/GRPC/TCP/UDP routes… | ||
| Evolving GitOps: Harnessing Kubernetes Resource Model for 5G Core | Alexander North | 35m |
Swisscom claims a Kubernetes Resource Model approach reduces toil for a 5G core that currently spans 2,000 pods and 5,000 interdependent configuration… | ||
| Kubernetesception: How to run a 1000 control planes | Remy Rojas | 37m |
Exoscale explains how it runs Kubernetes inside Kubernetes to provision thousands of control planes fast: an orchestrator pod set generates API servers… | ||
| How to make pod assignment to thousands of nodes every day easier | Tasdik Rahman | 36m |
New Relic runs ~270 clusters with 317,000+ pods and builds a mutating admission webhook called scheduling classes that translates a simple annotation into… | ||
| Change Your Chip Architecture and Save the World | Kornel Krysa | 16m |
Claimed energy cut by swapping legacy x86 to ARM64/Ampere servers with real benchmarks against x86 and GPUs showing higher performance per watt. Uses Ampere… | ||
| Securing Kubernetes Edge Traffic using TLS Encrypted Gateway | Swarup Ghosh, Chirag Kyal | 38m |
Demonstrates using Gateway API v1.0 GA with cert-manager issued TLS certificates and a Let’s Encrypt ACME cluster-issuer to auto-create secrets and renew certs… | ||
| VPCs in Kubernetes | Niklas Voss | 38m |
A working lab CNI is implemented in Go (~450 lines) that uses custom CNI using VXLAN plus Multus to attach interfaces, netlink libraries for device setup, and… | ||
| Demystifying DNS: A Guide to Understanding and Debugging Request Flows in Kubernetes Clusters | Qasim Sarfraz | 32m |
Shows how to trace DNS from pod → node → CoreDNS → upstream using real commands and logs: enables CoreDNS log plugin to record queries, runs Hubble (with… | ||
| Tenant Autonomy & Isolation In Multi-Tenant Kubernetes Clusters - A Comprehensive Guide | Lukas Gentele | 37m |
Claims that running a per-tenant control plane as a pod inside a namespace lets teams have full cluster APIs without thousands of real clusters, using vcluster… | ||
| Continuous Security Testing with OWASP secureCodeBox in Kubernetes | Jannik Hollenbach | 36m |
Open-source Kubernetes operator that schedules containerized scans (installed via Helm) and runs Scan custom resource objects which spawn scanner jobs (ZAP… | ||
| Of the Rejekts, by the Rejekts, for the Rejekts: Lessons from organising a community conference | Benazir Khan | 38m |
Case study of Cloud Native Rejekts describes a b-side conference launched in 2019 that gives KubeCon‑worthy submissions a second chance, runs free registration… | ||
| Unprivileged Image Builds: What are the Challenges and Where are we Today? | Felix Dreissig | 34m |
Claim: unprivileged image builds are practical now by combining user namespaces, overlayfs, and modern build tools, but they require explicit kernel/runtime… | ||
| Should I use OTel (collectors), or is Prometheus good enough? | Krisztian Fekete | 36m |
Answer is: it depends. OpenTelemetry Collector can use a Prometheus receiver to scrape metrics, tail logs and export to Tempo, Thanos, DataDog or any backend… | ||
| Efficient DevSecOps workflows with a little help from AI | Michael Friedrich | 41m |
Demonstrates concrete AI steps: use custom LLMs and RAG to answer up-to-date docs, run a local model (Olama) to debug Kubernetes via KS GPT, and auto-generate… | ||
| Container Linux: The Next 10 Years | Thilo Fromm, Andrew Randall | 38m |
Flatcar adopts system extensions (sysexts) to layer packages like containerd, Docker and multiple Kubernetes runtimes as immutable overlays, with a bakery… | ||
| Exchanging third-party tokens in Dex and how it helps you to build a secure cloud native environment | Maksim Nabokikh | 25m |
Dex adds a token exchange feature merged Nov 2023 and available Jan 2024 that validates any JWT via the OIDC discovery endpoint and issues Dex-native tokens… | ||
| K8s load testing at scale with k6-operator | Karim Shakirov | 34m |
Uses k6-operator to run distributed k6 tests inside the cluster, with JavaScript test scripts compiled to Go, integrated into GitHub Actions to deploy two… | ||
| Building large-scale Internal Developer Platforms: Core Principles | Arnold Bechtoldt | 31m |
RTL Data describes a platform used by over 30 heterogeneous teams that produces 400 GCP projects and 100 GKE clusters in 2–3 years. It centralizes metadata in… | ||
| Scaling Startup for Success: Building modern Architectures and Developer Acceleration | Dima Breydo, Tsahi Duek | 40m |
Three phases: ideation/growth/scaling phases map to concrete choices — use managed services (Lambda, ECS) to minimize ops early, introduce infrastructure as… | ||
| Lessons learnt from implementing GitOps and Continuous Delivery at scale | Mario Manno | 32m |
Describes real deployments using Argo CD for ~100–120 industrial clusters and Flux for telco fleets scaling from ~1,200 toward 5,000–6,000, and the design… | ||
| Your Pods can be stateless, your VMs cannot! How to manage state in k8s | Daniel Paul | 32m |
Shows that Kubernetes can run VMs as processes using KVM/QEMU and a VM API (VirtualMachine and VirtualMachineInstance CRDs), but storage is the blocker: a… | ||
| Introduction to Large Language Models (LLM) on Kubernetes | Alexander Schaber | 22m |
Beginner walkthrough of running a pre-trained chat LLM container on Kubernetes using the AMA runtime, showing a live demo that successfully serves chat… | ||
| Adopting Network Policies for Multi-Tenant Environments | Raymond de Jong | 41m |
Explains a practical, risk‑based path from default‑allow to default‑deny using Cilium Network Policies, showing identity‑based rules, DNS‑aware egress and… | ||
| The IaC Tooling Face-off for Modern Cloud Native Ops | Eran Elbaz | 25m |
Compares Terraform, OpenTofu, Pulumi, CloudFormation, CDK, Helm, ArgoCD and serverless with concrete tradeoffs: Terraform is industry standard but vendor… | ||
| Container Vulnerability Management in Kubernetes | Kevin Gimbel | 34m |
Pipeline enforces scanning, signing and runtime checks: 11,000 images scanned nightly by Trivy (eight workers), results stored in Harbor and exported to… | ||
| Building a Platform Engineering API Layer with kcp | Marvin Beckers | 32m |
kcp presents a horizontally scalable, modified kube-apiserver accepted into the CNCF Sandbox in 2023 that exposes logical clusters as cheap, isolated… | ||
| Docker and Databases | Andrew Pruski | 38m |
Claim: containers can host stateful databases reliably and speed workflows. Uses Docker, PostgreSQL, Docker Desktop/WSL and Docker Compose to demo three… | ||
| Start building distributed applications with ease using building block APIs | Marc Duiker | 37m |
Dapr (Distributed Application Runtime) provides concrete APIs and demos showing how to wire service invocation, state stores and pub/sub messaging with .NET… | ||
| Multi-Cluster Kubernetes Quick Delivery with IaC and GitOps | Khaled Khalifa | 36m |
Claim: platform provisioning drops from months to under two days by combining Terraform modules (AKS, DNS, storage, networking) with per-cluster Argo CD and a… | ||
| Safeguarding Kubernetes: Pod Security Admission, NeuVector & Kyverno in the Ring | Marie Padberg | 31m |
Compares three concrete controls and shows a working deployment: Pod Security Admission at level Restricted enforces cluster-level baseline constraints… | ||
| Scaling up to your first 10 million users - The Kubernetes Edition | Marco Ballerini | 32m |
Kubernetes practical checklist for your first 10M users with concrete limits and fixes: follow documented scale caps like 110 pods per node (soft limit), 5,000… | ||
| Unlocking Cloud-Native Efficiency: A Journey with Flatcar | Danielle Tal | 24m |
Flatcar is a minimal, read‑only container OS built from Gentoo ebuilds with A/B partitioning for atomic updates and system extensions layered on top to let… | ||
| Architecting Data Management for a Kubernetes-Native, Multi-Cluster World | Julian Fischer | 31m |
Clutch is an open source control plane (published under the uploader’s aacho license) that exposes centralized metadata and kubernetes-native CRDs so developer… | ||
| Unifying Policy Observability in Kubernetes | Frank Jogeleit | 26m |
Policy Reporter collects Kyverno validation, Falco runtime events and Trivy image scans into unifies Kyverno Falco Trivy results, deduplicates per-resource CRD… | ||
| The Art of Debugging Inside K8s Environment | Andrii Soldatenko | 35m |
Shows concrete fixes for CrashLoop pods that lack a shell: use ephemeral containers and kubectl debug to attach a full-tool image, inspect a single binary, and… | ||
| Stuffing 10K Pods on a Commodity Server - And Starting Them in Milliseconds via Kubernetes | Dr. Felipe Huici | 15m |
Claim: commodity servers host thousands of pods and start them in tens of milliseconds. Implementation uses Unikraft unikernels, a new VM runtime runu, and a… | ||
| Stop giving root access and start securing your Kubernetes clusters instead | Tiffany Jernigan | 32m |
Shows how to stop handing out cluster-admin by using RBAC, service account tokens mounted in pods, and scoped Roles/RoleBindings to give just the permissions… | ||
| APIs beyond datacenters: Architecture and Best Practices | Johann Gnaucke | 27m |
Built a centralized, customer-facing API that provides a single endpoint to manage PSK across three regions, using a stateless API server, MongoDB for… | ||
| Tips and tricks for Kubernetes storage | Tiago Castro | 36m |
Walks through Kubernetes storage mechanics and concrete fixes: PVCs/StorageClasses expose protocol, replicas and mount options; ReadWriteOnce vs ReadWriteMany… | ||
| Our journey to horizontally scalabe controllers | Jan-Gerrit Göbel | 21m |
Hobbyfarm replaces a single monolithic controller with sharded, horizontally scalable controllers that use Kubernetes CRD informers, a simple fnv hash of… | ||
| Progressive Delivery in the Kubernetes era | Alex Soto | 36m |
Demonstrates progressive delivery recipes on Kubernetes with working demos: blue‑green, percentage canaries (examples 75/25 and 80/20), traffic mirroring… | ||
| Image Compatibility spec to ensure container and host harmony | Chaoyi Huang, Marcin Franczyk | 33m |
Proposal creates machine-readable image metadata so registries carry exact OS and hardware requirements, using OCI artifact records and a prototype that maps… | ||
| ContainerDays Conference 2024 Aftermovie | 02m | |
Thank you for an incredible ContainerDays Conference 2024!
It was an inspiring event filled with innovation, collaboration, and exciting discussions around the… | ||
| Can security speed development? Network policies, but with people in mind | Ori Shoshan | 30m |
Argues that network policies can speed development by shifting access declarations into simple Intents-Based Access Control manifests and automating… | ||
| nothing matches | ||