Thank you. So I've been a WordPress web developer and designer since about 2005 and before that I worked in print and advertising. So, but actually officially I started at 10 years old. My father was an ad executive and he had some principles that he used that he taught me when I started to do layout design for him at 10. I'm gonna share those with you now. So these were the key principles my father taught me when I started to do layout for him. If everything is important, then nothing is important. White space is good and whenever you add something, something else is taken away. Now, that wouldn't necessarily apply so much the last point with CMS, but definitely for your home page or landing page, you have a limited amount of space. So what are you gonna put there? What's your point? Make it easy, make it accessible for people.  He'd show them an ad real fast and kind of flash out of them and then say, what did you get? What did you see? So I put two examples up here. One on the left is a busy ad, which if someone flashed that in front of you, you probably wouldn't get the message of what they're trying to say. The one on the left, well, we're probably more familiar with it, but you get a message right away. The branding's there. How many people are familiar with the eye movement charts and the heat maps? Some of you. Okay, so most people read the headlines first and then if they're interested, they'll continue reading, but there's a lot of information. And I think they were talking about Crazy Egg earlier, the speaker before me. And that can kind of show you where I flow goes. So Chartbeat, which is a company, says that 55% of visitors spend fewer than 15 seconds on your website. But some stats say that it's less than six seconds. So you really have a short amount of time to capture someone's attention. How many people have heard of David Ogilvy or Ogilvy on advertising? Okay, a few of you. He says that on average, five times as many people tend to read the headline as read the body copy. When you have written your headline, you have spent 80 cents of your dollar. So that's really where you should spend your time. And that applies to traditional advertising and also website design. So how does that tie into Zen or into WordPress websites? Well, there's many different Zen principles, but here are a list of the basics. Do one thing at a time, do it slowly and deliberately, do it completely. Now, there's been a lot of studies out about multitasking and how it's not really effective. And it goes back to the Zen principles, one thing at a time. You're actually more effective working that way. Do less, that's back to keep it simple. Put more space between things. That goes back to white space is good. Just don't dilute your point, your branding. Develop rituals, always a good business habit. Designate time for certain things. Devote time to sitting. Smile and service to others. Gratitude is always effective. The two last ones, think about what is necessary and live simply. I'm probably the most important that relate to WordPress design. So what should you include or what should you not include? Timothy Ferris says pack, put half back and bring more money. And that can apply to web design also. A lot of people, especially with open source software, the tools are there, they're free, they're easy to put on. You just want to load your site up more and more and more and more. But does it really apply and how much maintenance are we going to be talking about? So then you have to think about what not to pack, which is something that a lot of people don't think about. People have a certain absorption rate.  Or do you need, for example, chat features, events, online shopping cart? That may completely apply to the business model, but it may not. And some business owners want you to add it just because they want to have this big site and have those tools to load on. So I spend a lot of time with my clients kind of talking them out of doing things sometimes for the benefit of their business in the long run. So then we have maintenance. What is the cost of the maintenance over time? Some business owners want to maintain sites themselves after the initial build. They may think they have the skill to do it and then realize that they don't later on and then they don't have the money to pay for the maintenance and then a bind and then their site starts to go down and then they have security issues. So maintenance can end up spiraling down a business, an online business. And it can also affect the branding. Let's say they have a great look. We make it bright and shiny and it looks beautiful on launch. They keep adding things themselves or requests for a little this change, add this without thinking about the branding and eventually the site, the branding gets diluted and the site doesn't look as nice as it originally did. So it's things to consider on the initial build. And then there's refinement, a review process on a regular basis. Now, depending on the size of the business and how much activity and traffic they have, this could be done weekly, quarterly, or annually, but there should be a plan for reviewing all the elements and deciding, do we need that chat room? Do we actually have events? We loaded an event calendar and we never have any events. So you have this thing on the website saying no events all the time. So you want to review that on a regular basis so that the site looks fresh and the branding stays consistent. So why simple?  Simple seems to be effective and we kind of lose it as we have so many tools available in our fast-paced world. So it's something to consider. And why would you consider it? For time, for security, when people can't update or they don't know how to update, you can have security issues. Again, what we talked about maintenance, clarity. An important point that's actually not listed up here is agility. Some people want every widget, every plugin that's available, put it on a site and then once they have the website up for a year, their business model may change. And then they don't have the agility to change. So back to Timothy Ferriss's about put, you know, pack, put half back and bring some more money can really help with agility and also financially for small business startups. So I seem to have breezed through that. So any questions? Yes. Good questions. Question is, how do you know when it's too simple? And too simple can be, is usually when someone is lazy and doesn't think about the design thoroughly. Back, I don't know if we had those slides, but Hemingway's quote, if I had more time, I'd write more short stories. That it actually took him longer to write short stories than it did to longer stories because you're refining it. So it would be a different process actually to refine something takes longer than to just go, okay, I'm going to make this really simple and I'm going to one, two, three, pick two, three things and then put it up. Too simple would be to have no thought in it or if you do put the thought in it, you need to think about have you covered all the elements that you're trying to achieve with your business? Does it cover your goals? Does it have your branding? Does it have everything that you're looking for in your business model? Yes, sure. In design, there's positive and negative space. The tech step here would be positive space and all that white space around would be the negative space. The border around the edges here, that's called passive space and both the negative space and the passive space help readability and absorption. So you have to have a balance and not use up all that white space or people can't absorb the information. Yes, it's always good if you, I know some people who always do their accounting in the morning for their business or you review, let's say you review your website design and branding consistency every Monday morning or something. Then you're on a ritual and you're doing on a consistent basis and it becomes automatic, kind of an automated procedure because we're creatures of habit. Yes. Do I have any? Yes, I recommend picking a time in the morning to do whatever you think is most important for your work and that can be either right away first thing. In the morning or if you work out, do you work out and then do it immediately first thing in the day. Anyone else? Yes. They talk about whether you're doing chores around the house or work as a meditation and I've seen people cook this way and it's kind of amazing that they, I'm not at that part point with my work but you kind of get into a sink with it. Probably, do you ever garden? Yes.  That's a kind of flow that you could get into your work and that's usually from the ritual of a habit of I'm going to do this between 10 a.m. and 11 a.m. or a certain hours that you get into a habit and you'll get into a flow which kind of becomes a meditative state. There's a rhythm to it. Yes. Yes. She was saying that about the ritual, if you are very intentional about it and you kind of get into the rhythm, right? That it helps. Any other questions? Yes. That's kind of tied into the rituals. It can either be sitting and working or time to meditate and just relax. And sometimes when you overthink, Ogilvy had another saying about just absorb as much content and information on your material as possible. Absorb, soak it in and then kind of let it go and then kind of the essence of what you're trying to achieve for your project or whatever you're working on will just kind of come to you. So I use that. There's a great book called The Artist's Way. Has anybody heard that? By Julia Cameron and I love that because with writer's block it's like a creative block.   Instead of sitting there and trying to force the ideas to come I'll go out take a walk or go somewhere where there's things that are stimulating like a part gallery or something and I'll come back and I'll have new ideas. So those are ideas from that book that I still use. Yes. How do you decide what is necessary to choose from?  What's more applicable to the project? I mean if I don't know I'm trying to think of an example for a website. I have a website, a client, the radio station. So I would apply things to what their needs were for the radio station and then think about that and then it would kind of come to me or research things that they need and then pick the best of that. Do you have a question? Yes. Things have changed a bit. It makes it a little bit more challenging in a way for the mobile responsive because when you're working with a fixed area it's easier to design than something that's moving. So in a way you have to get simple but then you want things to still pop. So white on black text and black on white text has been used for decades as a technique when I used to work in print advertising I'd look at what the competitors' ads were and if they were all white backgrounds with black text I'd make my ad black background with white text and it would pop off the page and it would be the ad and it would be the same thing now because they're usually a single column websites, you know the side columns are kind of going away so you need things to have it pop. They're talking about the web experience now instead of the click factor so there's actually websites that you can go to to check how effective that is that's one of the techniques being used is to vary that. Yeah I kind of I always put myself in the place of someone that was viewing it and what they would want to see so I'm not a big fan of pop up forms and things like that I don't think anybody really likes that in their face or to be locked out of a website before signing up to see the content behind it but so I just think about what the user the user experience would be and kind of design from that okay his question is how do you reconcile the need for a pop up form or to have a lead generator on your website but that it's obnoxious basically so one way is there are pop ups now that instead of going to we'll go to the side so they're not blocking the text it's just like would you like to sign up and then if you ignore it it'll go away for a while at least for that visit that's less in your face the aggressively generation will work if for example I had a client who was a real estate agent in Florida and he was in a region that had a database of the properties in this very nice area so he put an aggressively generator form where you had to fill it out to see the content otherwise you can't you just get the teaser the house is around and you didn't see the properties now that worked for him because there wasn't any free options when there are other sites that have the same material you don't have to fill out the form those forms are just going to annoy people and they're not really effective I think that business would be better off with a softer form maybe like I was suggesting have it go to the bottom corner and say please sign up instead of forcing you to sign up you're welcome any other questions? thank you


Biden threatens North Korea with annihilation. U.S. President Joe Biden declared that a North Korean nuclear attack on his country or South Korea would spell doom for Pyongyang. Under a new agreement between Washington and Seoul, the U.S. would respond to such an attack with nuclear weapons, South Korean President Yoon Suk-yol added. A nuclear attack by North Korea against the United States or its allies or partners is unacceptable and will result in the end of whatever regime were to take such an action. Biden told reporters at the White House, speaking alongside Biden, Yoon declared that sustainable peace on the Korean Peninsula does not happen automatically. We can achieve peace through the superiority of overwhelming forces and not a false peace based on the goodwill of the other side. Biden said, adding that in the event of a nuclear attack from the North, the U.S. and South Korea would respond swiftly, overwhelmingly and decisively using the force of the alliance, including U.S. nuclear weapons. Biden's words echo those of his predecessor Donald Trump, who in 2017 warned North Korea that he would respond with fire and fury like the world has never seen if the country threatened the U.S. with nuclear weapons. Although the North tested a nuclear bomb a month later, Trump and North Korean leader Kim Jong-un agreed to a detent and went on to meet several times, and the North's missile tests came to a halt for most of Trump's remaining time in office. These tests have since restarted and ramped up. Pyongyang has test fired more than 100 missiles since the beginning of 2022, and this month tested its first solid fuel intercontinental ballistic missile and a nuclear-capable underwater attack drone. Officials in Washington and Seoul have claimed since last year that the North is gearing up for its seventh underground test of a nuclear weapon.


In the previous video we looked at how infrared light induces molecular vibrations. This is because as the electromagnetic field oscillates backwards and forwards it pushes and pulls the dipole moment of a molecule and if the frequency of the vibration and that change in the dipole matches the incoming radiation, it's absorbed. But why would this be quantized? Why can't it just produce any vibration whatsoever? For this we're going to look at the simplest case that we've already seen for rotational spectrums to be the case of the heteronuclear diatomic molecule. Just like with rotations we need to reach into our physics toolbox and dig out the reduced mass. This means that we can model two atoms vibrating against each other as just one mass vibrating against a fixed point. As the mass moves towards the fixed point the potential energy increases and the restoring force increases. As it moves away, energy also increases and the restoring force also increases. It's also worth pointing out that force and energy are related by integrating and differentiating over distance. This is known as the harmonic oscillator and the frequency associated with it is the harmonic frequency. And technically this is a very strong simplification because it implies the potential well is symmetrical. This isn't the case with the real system as we will see later. Again, the details of this are covered across both quantum mechanics courses particularly when we look at the creation and annihilation operators later on. Solving the Schrodinger equations for this quadratic potential well gives us quantized energy just as with particle in a box. The shapes of the waves are different but there's still quantization. Solving for the energy of each level shows us that there is an even progression in the energy levels where each is separated by the reduced Planck's constant multiplied by the fundamental frequency of the vibration. There's one more complicating factor to add to this model but it is important to remember. If you plug in zero for the vibrational quantum number that is v equals zero, you still get some energy. It's equivalent to half the reduced Planck's constant multiplied by the fundamental frequency. This comes down to some quantum mechanical properties namely the Heisenberg absurdity principle. If you remove all possible energy from atoms there is still some vibration of sorts there because there's still uncertainty in the position of these molecules so still a little bit of vibration. This is known as the zero point energy. Contrary to a lot of science fiction you can't actually extract this zero point energy there is no state lower in energy so you can't possibly extract it. Now we're going to look at how to extract force constants from vibrational data. Now the restoring force in the harmonic oscillator model is directly proportional to that distance of displacement so the force constant is that proportionality constant. As a result it's a sort of measure of the stiffness of a bond. The harmonic frequency is a function of both the force constant and the reduced mass. It's a fairly simple relationship. However it's absolutely essential to check the units on these equations as there are a number of very similar equations each expressing this energy in different units. Dividing the frequency by the speed of light gets us the wave number multiplying by the speed of light gets us the wavelength. So that's the main formula you'll need to work out a force constant. Obviously you'll need to do some rearrangement to yourself and also check units to make sure you're not accidentally calculating wavelength when you should be calculating wave number and so on. But next we'll look at the next level of complexity and with a little bit more maths on top. We've just seen the harmonic oscillator. What about the anharmonic oscillator?


truly no better time to wear my game theory shirt than for today's video sorry i look like crap but don't i always oh what what what is this you ask well that's my my game theory pin because i'm totally now part of the game theory squad oh my god this is not a good intro but we're gonna roll with it in all seriousness though guys this is a really really important video to make and it's one that honestly has been long overdue i gotta go back to see when it was actually uploaded let's see october 26th i uploaded the every easter egg in curse of dreadmare video and i did i'm just i'm still absolutely amazed by how much support that video is gone it's currently sitting at 41 208 views 99 comments and 963 likes this is after the uh the the game theory but we're gonna we're gonna get to that very shortly to those people that are new to the channel i do like to show you guys the analytics and all that stuff i'm not gonna go too into it because it's not really what this video is about but if you look up all curse of dreadmare easter eggs it's the first video to come up which is just absolutely insane first video to come up with curse of dreadmare easter eggs insane dreadbear secrets dreadbear by itself it's i still can't believe it now i'm not entirely sure how accurate this is right here i don't think it is accurate because i'm it's it's got to be way more but at least 262 people subscribe just because of that one video and that's just insane and again i don't think that's accurate because i was at like i think i just passed like 500 at the time and then we just blew up we went from 500 all the way to 8000 so maybe this is accurate or not 8000 jesus what's wrong with me 500 to 800 like just like that within a few days it was insane and then 900 and then very recently a thousand which is what this video is kind of all about and then very recently uh you guys may have seen this over on twitter because i tweeted about it but the fnaf switchboard screenshots that video has been blowing up recently well not blowing up like the easter eggs video has but it's been getting a lot of attention so much so that it might not be it now but um ah yeah no it went back down to number two but if you had looked up five minutes at freddy's ports into youtube just just that it was the first thing that came up and again that still is just crazy to me so we're gonna return to talk about cursive red bear easter eggs in a second but i just want to talk about what we're really here to talk about and that is the fact that the johnny blocks channel has now surpassed 1000 subscribers and that is just absolutely insane and i hate to go into like you know money and monetization and stuff but if you guys remember in my one year on youtube video i was talking about that and i was like oh you know that'd be cool but it's not a goal of mine and here we are today something that i am able to do obviously i gotta wait like a few months to uh get it reviewed but that's just insane something that like a year and a half ago i was saying i don't think we would do that and then i think it would be cool to do that but i didn't think we were actually going to do it and now here we are actually freaking doing it it's just absolutely insane oh my god i just i don't believe it i really don't and then to top it all off to top off today matpat released a game theory now i was originally going to be doing a reaction to it as i normally do with finnaf game theories but just based off of the title in the thumbnail i knew um that it was on something that we were already aware of you know vanny and her presence within the franchise and the cult of glitch drab so i was like i already know about that i don't think it's really important to do a reaction to it but it just so happens and if you guys have seen the theory you know what i'm talking about it just so happens that i was featured in game theory and i'm not even saying like you know a picture of me popped up for a few seconds no matpat showed the curse of dreadware secrets video twice showed the the logo of the channel and said the name of the channel directly and you know we can do a bit of a reaction to it even though i haven't already seen it but i was freaking the freak out i was screaming i was jumping up and down i ran downstairs to my brother i was like bro you won't believe this and he was just lying on the couch watching tv because uh you know he had a he came home late last night so he was just chilling for today and he was like what what is it and i was like i was in a game theory and then you know he jumped right up on the couch was like what see how he showed him we freaked out i called loads of my friends i tweeted about i posted on instagram and it's just oh my god so much has happened today that feels like changed my life forever it's just it's crazy feels like this day has gone on for so long there's been so many awesome things that have happened and you know because the game theory a few more people have subscribed um uh today we started out at like 998 an hour as i'm recording this in 2012 which is again it's just oh it's unbelievable i i i oh my god i can't put it in the words i can't thank you guys enough thank you so so much so um yeah i'll pull up the game theory right now it's just my god it's crazy actually before we get into the reaction quickly i do want to point this out because it is absolutely amazing uh matt louis and mark are doing something that's absolutely insane and i just want to talk about it for a little bit because again it is really really awesome on december 3rd they're going to be doing a charity live stream for saint jewds to hashtag cancel cancer as it says right here now apparently scott is making a dedicated fnaf game for this stream and i think that's really really awesome think it's really really sweet of him to do and i think it's amazing to see three four and just thousands of people come together in the fnaf community to do something this amazing um there's been a lot of sadness within the fnaf community because of um skylar's passing a week or two ago and so i think this is the type of thing we need right now is to all come together like we did with skylar's passing in the book that um direct doggo made with the community and i think this is going to be just something absolutely incredible scott said on twitter or not on twitter sorry he said on reddit that he was going to be donating half a million dollars which you know people call scott greedy for control c and control ving his games and then he goes out and does stuff like this his past few games that he has made have been 100 free pizza sim custom night and this game which is going to be on game joel we will be playing it on the channel all of those have been completely free and it's just amazing to see him donating such a large amount of money out of his own pockets to something like this so um yeah so i would talk on uh so much about this topic but it is really really important so december third it's going to be on the game viewers channel so if you can make it please i recommend you do watch it i i think it's on a tuesday though yeah it's on a tuesday so depending on what time it's at hopefully it's uh not too too early because you know people got school and people got work so um yeah if you can make it i would really it would just be amazing to see is what i'm trying to say anyways let's move on i honestly still cannot believe that i'm in a freaking game theory and you know what to all of those haters of my reaction to game theory he's like oh he hates matt pad how can he say stuff like this look where we are now haters featured in it twice called out directly look at that you guys can't see my face cam because i'm blocking it ironically with my face cam but it is my video you can see every easter egg in course of dreadbear exclamation point five minutes if we were how pointed by johnny blocks on youtube oh thank you matt pad and then we skip a little bit farther and we get something absolutely incredible oh my god i might just let it play out um and then we can go back and talk about it scott don't do coincidences it's also worth noting that i've seen one channel johnny blocks that really clown pictures after throwing a dart at each one the barn suddenly switched over to rave mode the black lights on for the party becoming possessed by golden freddy we can tell that as evidenced by the manor hanging over the top my god now i can't confirm whether this is real because it is the only place you've been able to do this and also spawning three clown pictures randomly it took me like an hour to do that so uh and also it's weird because from a lord person i just oh it's it's been so eventful today boys and this is just absolutely incredible you know been watching matt basically since fnaf came out i think it was around the fnaf two era when he was like you are the monster i think that's when i really got into it and i've been watching him ever since then um and it's it's it's such a milestone honestly when you think about people in the fnaf community you know they have certain milestones uh you know like meeting scott and maybe beating a really difficult challenge like 50 20 or something you never really think about getting into game theory which is just it is an awesome milestone it's just one you don't think about and it's one that i'm proud of i can say that i'm part of game theory even though i'm not i was just featured in it but i i think that's absolutely incredible so again not only does he show the video twice he notes that this is the he's first of all he knows that he's seen it which is just kind of it makes me nervous to think about that someone as high up as mad pad has seen my video um he then calls out the channel directly pronounces it correctly which i'm honestly surprised about um and then shows the the logo like that's so it hits you right here man so uh yeah that's why i'm sport sporting all my game theory merchandise even though it's really not much so uh yeah for all those people saying that i hate mad pat well look at me now we're practically best friends aren't we now as you guys may or may not be aware of especially for all these newcomers i do love to do videos celebrating certain milestones i did one for every hundred uh subscribers 100 200 300 400 500 um and then you know six through 900 i didn't get to do just because there was so much stuff happening not only were we growing at such an unbelievable rate that i couldn't even keep up myself but then we also had for example the curse of dreadbear secrets curse of dreadbear itself and more recently you know um that baby gamer sent me a uh special demo for ultimate and tender night two which as far as i'm aware i was like the only person on youtube to get that which is just crazy so i had to get that out and then we started getting all the fnaf ar things and i am meaning to do an update video on that because quite a few things have happened so yeah i'm expect that soon probably tomorrow or something so um yeah there was just so much stuff happening and then i just didn't have time such a bad excuse i did no no i don't even need these it's just a bad excuse that i didn't have time um because it's something i should do more often as thank you guys for you know all of this stuff i'm not good at this maybe that's why i haven't been doing it i'm just not good at things look i haven't even changed the whiteboard i just realized that oh my god what is wrong with me there we go one thousand subs you can't really read it but it's fine so um yeah i don't want this video to drag on for too much longer so as final thoughts i just want to thank you guys so so much for you know it's only been two and a half years and we're already at one thousand subs and that doesn't sound like a lot but when you imagine just how many people are out there on youtube how many channels there are and the odds of someone finding me the odds of someone finding me is just so so low in the fact that they not only found me but also liked the channel and the content so much that they subscribe that's just absolutely incredible and then time seeing that by a thousand and then some so it's just it's crazy to think about it really is and i am working on a secret project i mentioned this over on twitter that if we hit a thousand before the end of the week which we are no the start of next week sorry so by monday i would release a teaser for this project and i am working on the teaser i am working on the project it is the uh one thousand subs special originally i wanted it to be something else but then i had this new idea for something and i've just been working on that ever since in fact i'm probably gonna work on a bit more of it after i make this video so yeah stay on the lookout for the teaser it's gonna be on my instagram and my twitter which is linked down below obviously don't forget to use my support to create a code because i can now have one of those i actually have no clue how to get one of those so yeah thank you guys so so much for a thousand subs i'm absolutely flattered to be uh featured in game theory again i just thank you guys so so much for the support over the past month in particular like i said the freaking uh easter eggs for a curse of dreadbear was released what 20 days ago if it was on the 26th and we like more than doubled our sub count and that's just oh i can't wrap my head around it it's it's unbelievable but i guess what i'm trying to say here is just thank you guys so so much um i really really hope you guys do enjoy the uh the channel and the con the content and you'll set the comments and it's not just you guys as well i also had loads of my friends comment or not comment why do i keep wanting to say comment i had loads of my friends text me today like you know congrats on a thousand subs or you know congrats on making it into game theory and it's just damn my friends are the best it's not insulting any of your guys's friends but honestly i just i love my friends so much and a non gay way i love my friends so so much they're absolutely incredible and i just i can't wish for better friends and i can't wish for a better audience so thanks everyone so much for watching thanks for the thousands time for the support and i'll see you all on the flip side goodbye


Hi everybody, thanks so much for joining today and welcome to Open Infra-Live. Open Infra-Live is an interactive show sharing production case studies, open source demos, industry conversations, and the latest updates from the global open source infrastructure community. This show was made possible by the support of our valued members, so thank you so much to them. My name is Treva, joined with my co-host Dogo, and I will be your host today. Well, we both will. We're streaming live on YouTube and LinkedIn and we'll be answering your questions during a Q&A period at the end of the show, so feel free to drop any questions in the comment section and we'll answer as many as we can. Today we're here to talk about confidential containers and Cota containers, the hot container runtimes that offer the security of a virtual machine with the speed of a container. And in today's episode, Zvanko Kaiser from NVIDIA will be sharing insights on confidential containers specifically, the security challenges in container containerization, and how sandbox environments have involved how they evolve with the use of Cota containers. Welcome, Zvanko. You want to tell us a little bit about yourself? Sure. Hello, everyone. My name is Zvanko Kaiser. I'm with NVIDIA from the Cloud Native team. Our team is mostly responsible for all things related to cloud-native technologies here at NVIDIA, and we are responsible for enabling the GPU in containers and Kubernetes. Lastly, I've been more focused on Cota and confidential computing, which also resulted in working with confidential containers. Awesome. So for the folks in the audience that aren't familiar with Cota or Coco, if you were to explain either or both of those technologies to them, say if they were just like strictly open stack, how would you explain it to them? Well, we would firstly need to start with what a container is. And simply speaking, a container is nothing else than a process with some specific views on resources which are separated by namespaces. So every container has a specific view, let's say, on PIDs, on mounts, and other resources like CPUs. The container is, simply speaking, a packaging format for user space applications, and this container can then be run, let's say, on a Kubernetes platform for scheduling and stuff like that. So the other technology that we need to explain is here, virtual machines, which is a virtualization technology, where we're essentially running a separate system inside of another system. So what Cota is, Cota is essentially using a container, packaging it in the VM, and running this container in a VM as a second line defense of isolation so that, because many of the containers have the problem that they're sharing the very same kernel, and container breakouts can take over the complete node and even a complete cluster. So what makes Cota special is that you're using or running a container inside of a VM as a second line of defense. So if you're worried about, let's say, container breakouts, you can use Cota to isolate it in a VM. And if you're worried about VM breakouts, you can even extend this to use a confidential container, which uses encryption technology to protect the VM on the host from the infrastructure, from the administrator, or from other VMs. Neat. So that would be for cocoa trusted execution environments? Yes, trusted execution environments, which is essentially a hardware technology, which is really not new, but it evolved to a more acceptable solutions in the last year with AMD, SMP, or Intel TDX. On ARM, we had trust zone. And if you look at mobile devices, every mobile device had trusted execution environments for paying systems or vaults where data, which is confidential, is secured. And along those lines, we also have sandbox environments that were evolving from time to time, especially because if you're looking at containers, you want to fortify the isolation between the container runtime and the kernel. So there were things like unikernels or IBM NABLA, which is essentially a unikernel as a process to reduce the syscall, which is essentially the attack surface between a container and the host.  And all of those technologies are essentially fortifying the isolation between the container runtime and the host operating system. They're doing it in different ways. If you're looking at G visor or IBM NABLA, they are filtering on syscalls, whereas solutions like firecracker, cube bird, and Cota are relying on half the virtualization, accelerated half the virtualization. Awesome. Neat. So I heard you mentioned G visor. And that was a question that came up during KubeCon. Sorry to throw this one out randomly. But I'm just curious. Can you run Cota containers in Windows with G visor? And if not, is that on the roadmap? Cota containers in G visor on Windows? No. We'll come back to that question. Yeah, because G visor is essentially a user space kernel, and it's process-based isolation. And you cannot run a VM in G visor. So it's just process isolation, and this does not fit together as technologies. Okay. Thank you for answering that. I'm sorry for throwing that out randomly, but it just popped into my head. No worries. Awesome. But thank you for playing along. Yeah. So I kind of did this myself at the beginning of the intro. There's a lot of crossover between the Cota containers and confidential containers communities. So are they basically the same project, or are there some key differences between Cota and CoCo that you could point out, or are they just like peanut butter and jelly, like their partner projects, or? You can say that they are partner projects, but for me, confidential containers is more of a umbrella term, because the backbone of confidential containers is really Cota.  And such things are like attestation. And confidential containers provides tools and guest components for Cota to do attestation. And attestation is simply the verification if a system is running with the proper software and proper versions that you are expecting. So essentially, it's a simple pipeline of, okay, I'm expecting specific versions of the software. Does my trusted compute base, which is Cota plus VM image kernel and stuff, are there in the right version? And then give me back a report where on which I can decide if I want to deploy my workload or not. So essentially, in short terms, Cota containers is confidential containers is Cota plus some attestation components that we need to run confidential containers. And the nice thing is about Cota and confidential containers is we have a broad support on many hypervisors. And we are the only software that supports all major trusted execution environments, be it AMD, SMP, Intel, TDX, ARM CCA support is coming up. And risk 5 is also something that we are working on. Oh, that's amazing. That's great. Because part of the draw for myself, at least, to Cota containers was how platform agnostic it is. So it's exciting to hear that that is being expanded to more agnosticity. I'm not even sure if that's a word, but I used it. So, all right, go ahead. No, nothing. Okay. So another question that comes up fairly often or very often is what's the difference between Cota containers and Dockers? If you're looking at it at a high level, then there's no difference. Because it's essentially a container runtime which runs a container on a specific host. But then looking deeper, you are seeing that Cota uses virtualization in the middle. And Docker is running a container on the bare metal without any virtualization. Well, you can say that the user space packaging is some kind of operating system virtualization because you can take a container and run it on every operating system, be it Ubuntu or Red Hat or whatever else. But as a Cota container, you still have the virtualization middleware in between where the VM is plugged in. The nice thing about Cota is and also what draw us to Cota is that Cota is CNI, CRI, CSI compatible, meaning a user running a Cota container or Docker container or any container image is completely transparent to him. All the commands that you're used to like Node CTL Docker are just working with Cota or any other Docker container. And the same applies also to Kubernetes. Anyone using Kube CTL or Kube Cattle, I don't know which pronunciation is the right one. But you will not see any major or you will not see any differences between a port which is running with the Cata runtime and a port which is running with container D. Fascinating. Okay. Thank you so much for the in-depth answer. I don't even want to go into how I've been explaining the differences, but that clears it up significantly. So thank you for that. All right. So I heard you mention, so first off my question or my first question is what is your favorite operating system? Because it's very important. That would be Linux and this is really broad. So I'm telling you also my favorite distribution, which is Gen2. I've been using Gen2 on and off since the beginning when it was firstly developed at IBM many, many years ago. But yeah, I'm doing everything on Linux with Gen2 and it works pleasantly fine compared to 15 years ago. That is hardcore. Gen2 is serious. Wow. Okay. And I phrased that question wrong. I should have assumed that it was going to be Linux, but yeah. Yeah, distro. That's cool. A second favorite because Gen2, just in case that's a little bit too... Okay. Another question. If someone wanted to get into Linux using Linux as their primary operating system, where would you recommend that they start? Like most folks start with Ubuntu, but they may not be, I don't know, comfortable with dev systems. So what would you recommend? Something which is easy, installable and maintainable. And then from there, if they are gaining more and more experience, they will automatically get into things where, okay, I just want to know everything about Linux, then somebody's looking at our Linux or Gen2 or Manjaro Linux or stuff like that. So I think they are going to hop between distributions anyway, because they are maybe getting fed up how Ubuntu is doing things, then they may be switched to Fedora and then they are fed up with RPMs. And there are always reasons to switch from distribution to distribution. But as a starting point, use something that is easy installable. When I started, I wiped out almost six gigabytes of mp3 back in 2003 or 2004, because I didn't know the difference between a logical partition and a primary partition. So yeah, it really depends. So use a blank hard drive to experiment. Do not use it on your production data. Yes, very smart. Very true. Awesome. Okay, so let's get back on topic. We're here to talk about Kata, not about distros. So what's the difference between a GPU container and a regular container or a vanilla container? I'm trying to phrase that. And will it be some use cases for sticking with a GPU container? There's no really a difference between a GPU and a regular container. You could also call a regular container a CPU container, because you are doing the number crunching on the CPU. But in the end, a container relies, so it is the user space pod, and then it relies on some hardware that you are using. And in one case, you're using just a CPU to do some number crunching. And in the other case, you are using just the GPU to do number crunching. So from the technology point of view, there's no really difference between a GPU and a CPU. The only thing may be only that you are using different software to access different accelerators, like in the case of the GPU, or the Nvidia GPU, you would use CUDA. And for the CPU, you can use almost any language. You don't have to have used any middleware or any libraries, too. Well, you may use other libraries if you want to do x-rated computing using SIMD instructions. So in the HPC use case, you have often optimized libraries. But in the end, a GPU container does not really is a difference between a CPU and a GPU container. Fascinating. Okay. So when I think about a CPU, I think about the little thinking rock that you put on your motherboard and a GPU, that's like a graphics card, right? Is that like an accurate way to think of each of those things? If you look at the GPU, you can imagine a GPU having thousands of those little CPUs. And you often run algorithms that are embarrassingly parallel, where each of the data does not is completely independent of the neighboring data. So imagine you have a picture and you have 1000 pixels pixels, and you want to shift or to do anti-aliasing or do some number crunching on a specific pixel to move it from redshift to a greenshift in color, right? On the CPU, you would go for each pixel. Well, depends if the CPU has hyperfitting or not. But essentially, you would go for each pixel, you would do the calculation for each pixel sequentially. On the GPU, you could do this in parallel for every pixel at the same time, which is called SPMD, which is single program, multiple data points. So depending on the size of your GPU, you are very fast on doing the calculations because those calculations can be then massively parallel of thousands of little, let's call them CPU cores. The architecture is different because the memory hierarchy is different. But essentially, thousands of small CPUs working simultaneously on each data point. Okay. So I was completely wrong. But that's fascinating. I didn't realize how come or I hadn't really given a whole lot of thought to how complex a GPU would be. But thank you for like a little bit more explanation. Cool. So yeah, I heard you mentioned something about sandbox environments a little bit earlier. So I'm not even going to go into my explanation about what I think about when I hear the word sandbox, like usually like a test environment. Could you explain to us a little bit of the history of sandbox environments in Cota and Coco and the importance of them? Because I'm familiar with Dragon Ball sandbox. But I guess I would like to hear more in the audience, certainly would like to hear a little bit more about it. Right. As I mentioned before, people were always looking into fortifying the isolation between a container runtime and the host operating system. And way back, people were thinking about using unique kernels, which essentially running workloads merged with a kernel in the same memory space. So that you cannot essentially change the workload because it's running as a simple kernel. And this is the only thing that you can run stripped down to the bare minimum without any additional libraries. So this simple unique kernel was only running the workload which was compiled with the kernel libraries and the kernel. And what IBM did is using this unique kernels as the scheduling unit and built the project IBM LaBla, which is essentially a small unique kernel running as a process. Additionally to this unique kernel, which is doing only one thing at a time, they introduced a layer between the container runtime. They are building to running those unique kernels as a container on this system to filter on syscalls. So the kernel had a limited attack surface because the syscalls are essentially the things that are providing the container functionality. And if you limit your unique kernel to a very, very small set of syscannels, your threat or your attack vector simplifies a lot. So it's always the goal to run as less as possible code and interfaces between a container runtime and the host operating system. And this IBM LaBla OCI competitive runtime system was run in C and they even had some Kubernetes adoption there. So you could run a unique kernel as a process inside, as a container inside of Kubernetes and also on bare metal. And there was also Google for their workloads and services. They implemented like GVisor, which is a small kernel running in user space. It's not tied only to one unique kernel or one workload. They want to run any workload. And GVisor essentially re-implements all system calls in user space so that they can do filtering or more advanced functions and security on those syscalls as well. So what they are doing is reducing, again, the attack surface between the container runtime and the host operating system with their own implementation of system calls. Not all system calls are implemented and a re-implementation of syscalls can take also some, induce some overhead if you have syscall intensive applications like IO storage networking. So people were also looking into other ways to fortify this isolation with hardware support. And the logical solution to that after that was to use AVM as an intermediate layer to protect isolation with the help of hardware accelerated instructions. So and there are two major projects that I know of which are used. One is Qbert and the other one is container. The difference between Qbert and Cata is that Qbert is running a VM in a pod and Cata is running a pod in a VM. If you're looking at Qbert, it not always fits in nicely into the cloud native space because you cannot run easily a container inside of Qbert on a Kubernetes cluster. You always have to bake your own VMI image or you're installing a Docker runtime inside of your Qbert VM which is running in a pod. But that still does not give you the nice feeling of really using like kubectl to execute this very container inside of Qbert. Whereas in Cata with the VM and all the compatible CNIC or ICSI interfaces that I mentioned before, it's a completely transparent experience on Kubernetes or on any other container on time. And there for an IEWS, for example, also went the path of virtualization. They built Firecracker which is a micro virtual machine. It's a minimal operating system and a minimal set of emulated devices. Again, an intermediate layer with virtualization to protect the the hardware from containers and other attack vectors. And you mentioned Dragon Ball before. So this is also a new micro VM that the upstream community is working on, completely implemented Rust. And the Rust runtime which goes hand in hand with that is also one thing that the upstream community is working on. So even they are reducing the attack surface and using a language which is by default more secure, let's say like C++ or any other language. Awesome. I was just about to ask you a little bit more about the rustification that's happening with Cata containers. It started at the 3.0.0 release, correct? Yes, something like that. Yeah. Awesome. So aside from the obvious, what was it that inspired the translation or the transition from GoLang to Rust for Cata containers? And is that going to be carried over into Cocoa? So Rust by default is a more secure language than GoLang. I'm not going too deep into the details of Rust versus Go because I'm going to start a flame war here. But people can read it up. And from the Rust perspective, it has more functional features, functional programming features that people are using to implement stuff, which also makes it easier to implement let's say threaded programs if you're using functional programming constructs. So if people are familiar with Haskell and know what a monad is, they're going to see a lot of similarities between the functional programming language Haskell and Rust. And there are a lot of papers describing how functional programming can help in security because you don't have no side effects. Well, you can introduce in Rust also side effects, but if you're removing side effects, you can program software more performant and more secure than in any other language. Fascinating. Okay. So some of the during the mentorship program some of the I guess like pushback we received some of the feedback we received was that GoLang was the more user approachable version or the more user approachable code versus Rust, which was a lot more complex, but was a lot more powerful. So yeah, I guess that kind of reinforces that. And please don't yell at me Rustations or GoFers. I'm just the messenger. Awesome. Okay. So another thing that another question that comes up fairly frequently that I'm also fascinated by is Cata and Coco and it's used in artificial intelligence and machine language. Back at opening for Summit in I think it was June back in Vancouver, a couple of Cata herders gave a demo where they showed where they were running a GPT bot on Cata containers, which was super fascinating. I was so thrilled by it. But anyway, could you tell us a little bit more about I guess current and possibly future implementations or integrations of AI and ML in Cata containers and or confidential containers? Sure. If we are looking if you're looking at the at AI ML, there are three main main pipelines that are executed. One is data exploration. Second one is training. And third is inferencing. And in each of those pipelines, you have personas that may have confidential data that you want to protect. My example to go is imagine you have a model trained on patients data that can dictate, let's say cancer lung cancer or something like that. So if you're doing like this training, you want to protect first the patients data because you don't want that any infrastructure administrator employees has access to this patient data. And then secondly, if you have the model trained, this is IP, this is intellectual property that you want to make money off or even with the model, people could be able to deduce confidential data from exercising, let's say wrong inputs or malicious inputs. So you want to protect also the model when it's in use. So when you're doing inferencing, you want to protect the model. And again, you are exercising inferencing with confidential data against this model. So you also want to protect all the data that's coming in and getting out. And this is where confidential containers can help protecting the model in use, protecting the data in use at any pipeline stage. And currently looking at like large language models, the inferencing pipeline is well simplified. It's a web front front end talking against a API server, which talks then to a inferencing server and some back to database. All of those components can introduce entry points for a attacker to do to to leak data or to do deny denial of service attacks. So we can use, let's say we are worried about container breakouts, so we can use Cata. And then I think about virtualization is that we can have more strict resource requirements or for each of those containers. So if we assign one CPU and only like half a gig of memory to a VM, even if the container breaks out, he will not get more resources than it gets from the VM. So this is a nice way to reduce result to save resources on per container. And things or models or data running where we can extract confidential data like the inferencing server with sophisticated attacks, there are a lot of papers out there how you can craft your inputs to extract confidential data. There needs to be also things like input and output validation, but you also want to protect a model against the infrastructure or your cloud provider or the administrator stuff like that. So you have the inferencing server and then you have oftentimes the vector database, which also it's an abstract representation of the data sources that you're feeding be it PDFs or any other input source that may be confidential, where attackers could also deduce some confidential data. So you want to run this vector database as well in a confidential environment. And this is where confidential containers come into play. So you can run, if it's really confidential, you can run, let's say the vector database and your inferencing server inside a confidential container, and then the web front end and the API server, maybe as a Cata container, because you want to constrain the resources that this container may have. And even if it breaks out, we still have virtualization as a second line of defense. And yeah, depending really on the threat model, you can cascade the technologies that you are using. One thing that I want to mention is also, if we're looking at KVM and QEMU, they are having the very same, I would not say the problem but the challenge that they shared the very same kernel. So a rogue QEMU VM can still do some harm on the other VMs because they are sharing the very same kernel, the same case with the containers. That's why we introduced virtual virtualization inside of containers, so that we can run our own kernel inside of the VM, which makes it kernel and user space independent, which lets you also, where updates to the kernel on the host will not really break the VM and the container inside running on the VM. So KVM is always, most of the time, seen as a type one and type two hypervisor, but it's not really a true type one hypervisor, like Xen or the hypervisor that's running in VMware, where it's only running on bare metal and you have different privilege levels, isolating the VMs more or better than, let's say, KVM and QEMU are doing that. So we are also looking upstream in enabling type two, type one hypervisors to have more control between the VMs, where we are not sharing resources. Fascinating. Okay. So I guess that explains, or I was having flashbacks to when I used to work in public cloud and how much of a lifesaver Kata and Coco would have been dealing with noisy neighbors. It sounds like it would be a perfect solution for that type of environment. Cool. All right. So this is probably something I should have asked earlier in the conversation, but I was just wondering, you mentioned that you are a super duper principal engineer over in NVIDIA, and I'm assuming that that is part of the, or at least part of the reason why you're involved in Kata and Coco because you are helping them to develop some type of awesome new implementation of Kata containers internally. Can you tell us a little bit about what you're doing? If not, then tell me, shut up, I'm going to something else. So no worries. I'm leading the Kata and Confidential Containers effort here at NVIDIA and we are trying to introduce Kata and Confidential. We are not trying, but we're doing it into products where we see that we need more isolation and a little bit maybe to the history how I came to Kata. We need to remind the time at least three years ago where we were mostly responsible or where we are executing the cloud native enablement of the GPU. You may heard about the GPU operator, the networking operator, NFD, no feature discovery, where we are working very closely with Intel on it. So we have all those components to enable the GPU in a cloud native way in containers and Kubernetes. And at this time, we were also looking into isolation techniques and how can we bring more security and stability with the GPU to workloads that are confidential or sensitive to denial of service or theft or whatever else. So that's where we come upon looking into virtualization technologies like QBird and Kata. But it fairly soon crystallized that the way to go if you want to have a cloud native way of enabling a container with virtualized isolation was Kata. As I mentioned before, it just fits in transparently in any container runtime, be it docker, podman, cryo, Kubernetes with cryo, Kubernetes with container, it just fits in transparently. And we essentially do not have to care about which CSI driver we're using, what the CRI is, because in the end, Kata is really CNI, CSI, CRI compatible. And anything that we are using in Kubernetes just plugs in neatly with Kata containers. So I've been working the last two years very actively in Kata, where we added proper GPU support on it. So Kata had got GPU support. We also enabled VGPU, virtualized GPU support. So there are two ways of looking at it. VGPU can be used as a time slice. So each of those chunks of the GPU is divided by time, or you have a more sophisticated split of virtualization of the GPU with MIG, which is essentially a hardware virtualization technology to split up the GPU in distinct compute units, where the compute capability and memory capabilities are fixed. You can think of it as a small virtual machine. So you can use the virtualized GPU also with MIG or with time-sliced virtualization. So we added support for this as well. And to have more sophisticated use cases like GPU Direct, RDMA, or GPU Direct GDS, so for people not knowing what this is, is essentially a peer-to-peer communication on the PCI Express topology without going over the CPU, meaning a NIC to send out data and getting data in can talk directly to the GPU without ever touching the memory of the CPU, because this is a lot of performance drop if you need to go over the CPU. And for GPU Direct RDMA and GDS is GPU Direct X-rated storage. So the GPU can be fed in by a storage which is attached directly to the NIC. So the GPU is talking directly to the storage without ever touching the CPU. And for those more advanced use cases, what we added to Cata is the virtualization reference architecture, which essentially describes how you need to set up your PCI Express topology inside of Cata to make this kind of sophisticated use cases work. I'm not going to in the details, but anyone who is interested can ping me. We can share the documentation on it and that's what we're currently implementing. So the end goal is really to have such use cases running inside of Cata. And the nice effect of this was and is that I'm doing the implementation to go runtime. But with this pattern that we established here in Cata, anyone can implement this virtualization reference architecture and enable CUDA and GPU Direct support. And this is exactly what's currently happening. The runtime folks who are doing the Rust implementations, they are following the steps that we outlined in the virtualization reference architecture and implementing now GPU support in Dragon Ball. So without me doing a lot of work but setting with setting this pattern, they can implement it or if it can be implemented on any hypervisor, be it Dragon Ball, Firecracker or whatever else. So they just need to apply all the lessons learned that we have and they can implement it. So we are currently very actively working on getting GPU support in Dragon Ball. Awesome. Cool. Thank you so much for the in-depth answer. So we're doing pretty good on time, but I want to make sure that you have enough time to do the super exciting demo that is coming up. But I have one more quick question or a couple of quick questions. So first off, I am wondering if Cata and Coco were the first open source projects that you got involved with and if not, which project did you start out with or yeah, which project did you start out with first and what led you over to the Cata-Coco world? I mean, aside from the obvious that we're awesome. And then the second question would be, for somebody out in the audience who's listening in and wants to get involved with open source, something, anything, how would you recommend they get started? And also, what are some of the benefits that you have gotten from being involved in open source? Because a lot of people think, oh, I'm not doing all that work for free. What's in it for me? But there's actually a ton of things in it for you, including helping out the entire global community. But anyway, so that was a lot of questions and a lot of words. But yeah, how'd you get started with open source? Has it been benefiting you? And how would you recommend somebody get started? I need to think about that. What was my first open source project? Honestly, I don't know. What was the first open source project? They've been a lot. So I can really remember I'm, I'm doing this job like for the last 12 years and always involved open source. But the very first project, I cannot remember, honestly. But the benefits would be, of course, from the confidential point of view for confidential containers point of view is that we are not providing security by obfuscation or by hiding anything. It's completely open. Everybody can take a look at the source code and exactly knows what's going on when executing Cata and what's going to happen if you're doing like a GPU pass through inside of a Cata. So compared to the cloud providers, you don't really know what's happening there because it's closed source. They can do audits on it. But then again, who is, you know, auditing the auditor and when are you stopping and how are you going to make the claim that everything is secure? We've investigated ourselves and determined there's been no wrongdoing. We've done a good job, right? So yeah, the last thing about open source is really you can see and verify what's going on. On the other side, it's a giving and taking because you implement stuff that other people are going to need. Let's say GPU support in Cata, but there are a ton of other people that are implementing, let's say the attestation agent or key broker service that we need in confidential containers, which I don't have the knowledge about to implement it in the right way, but the other people can. So everybody's working to a common goal and we are giving, let's say GPU support, but getting like a ton of other things that we need in Cata or in confidential containers. And the other benefit of course is also that you're, well, some say that it's not a benefit that there are so many eyes looking over your merge request or PRs that you are submitting. But in this process, you learn a lot about how to write your code in a way that's acceptable. You're learning a lot on the way from your first PR to your 100s PR. And I'm still, I don't know how many PRs I have made in my career, but they are still always something to nag about because I've done something wrong because I'm not seeing the forest of all the woods, right? So yeah. And you're getting into touch with people you would never meet in the office or in persons. And this also opens up career opportunities, working with a diverse set of engineers, which may refer you in the next time when there's an opening and stuff like that. So I remember like 15 years ago, that no company was talking to the other. It was all closed source. Everybody is working with elbows. But in the open source community, everybody is trying to achieve a common goal. Awesome. Awesome. I'm not sure where I was going to go with that. But yes, that is a fantastic answer. There are career benefits, but also like the difference is in points of view. I guess when you look, I guess when you think about like a tech nerd, or from a tech nerd perspective, you wouldn't think that having those other perspectives would be important, but it is absolutely crucial, especially during that learning period. Because we all learn how to do these things different types of ways. Some of us are self-taught. Some of us have PhDs, and then they're the ones that are in between. So we can all learn something from one another, and open source is a great place to do that. Cool. Awesome. So last question. How would you recommend that someone get involved in an open source project? Like say if they aren't confident in their tech skills, or if they don't know how to code, where would you recommend they get started? There are lots of other options, right? Right. Today, every project has at least a select channel. And they are like general channels where they could introduce yourself and ask for a where they can ask, where they can help out. And there are a lot of maintainers looking at it, and listening where they can help to assign a simple PR to this person. And he can then, you know, which is not time critical, which is not critical in the path of execution, where he could let's say update documentation, update some CI scripts, whatever else. So there's always some, some need to do some simple PRs on that. And then with time to time, people are getting more confident and confident, and then they can take up more work. Or just look into the issues or PRs that are open there. If you think you can contribute anything, just tag you on the issue, ask questions about the issue. There's always someone listening or reach out per slack and start little and then iterate. It's a learning process. Many people need some time to get into open source and how it works, and that's that PRs are looked a lot with a lot of eyes and a lot of iterations, but you will get used to it. So start simple with a simple PR issue, ask in the Slack channel if you can help out, introduce yourself. Let's say someone is, has a PhD in formal methods, and we want to do formal verification of our runtime to see if we are doing everything wrong. I mean, this would be really nice, and people would be eager to see something like that. And then maintainers can create issues, also work with this person to create PRs and explain how we could do that. Awesome. Really wish somebody with a PhD, which I mean, that's awesome. Cool. Thanks so much for the answer. And also, I'm just going to jump in and say that documentation is also a great place to jump in if you're not fans of code. We always need, everybody needs people to write out docs and try out stuff. Okay, so we are at 12 minutes, so if it is all right with you, would you like to jump into your demo? Yeah, let's do a quick demo. It's not really sophisticated, but I just wanted to show the audience how, especially the lift and shift character of GPUs. Let me just see if this is coming up. There you go. Okay. Awesome. This is a note which has the drivers installed, and what I want to show here is, so this is container D runtime that we can use any of those container frontends, be it Nerd CTL or Docker. It's the very same output.  We can use the very same container and run it on any container runtime. And as well, the very same container or other containers can also be used to run it on confidential containers. So this was also one of the nice premises with Cata containers and confidential containers that we are going to be able to run any workload unmodified on Cata and Cocoa. And what I have here is, I'm just switching the runtime from container D or any other runtime to Cata and pastoring a VFIO device, which is attached to the GPU into the VM. And yeah, don't be surprised that this takes a little bit longer. There's a lot of debugging enabled here, and we are code plugging the GPU. The GPU has a lot of memory. We are resetting the GPU at every invocation, at every invocation, because with each container startup, we want to make sure that the GPU is in a deterministic state, meaning that memory is wiped out, the settings are resetted, and the GPU as said has always a deterministic state to start from. And in a confidential environment, all those memory needs to be properly initialized, a functional level reset is done. And once this container is up, we are going to see some commands where we can get us some information about where the GPU is running, if confidential mode is enabled, which CPU is running with this confidential mode, and that the GPU is set in ready state. What we are doing at startup inside of the VM. So our complete NVIDIA stack that I showed here, which is essentially running the NVIDIA container toolkit, which enables a GPU in the container, we took it, packaged it inside of the VM, and the VM is doing what the bare metal system is doing, so that we can use reusing our stack inside of the VM and have the same functionality in Cata. We can see that we are running here again, our GPU, we can ask that if what compute mode is enabled, it's on, we can gather the CPU, which is an AMD SCP system, we can get the GPU, which is also CC capable, and we can ask it about the status, if it's ready. The reason for this is that we want to know if the configuration that we are running it, the VBIOS, the driver, and all the other things are in a state what we are expecting, and the VM will do internally at the station. It will check the measured values that we're getting from the driver against a set of gold measurements, what we expect, and then we will get a report out that we can take a look in here, NVIDIA verifier, shoot. I think I took the wrong container, something going wrong. But anyway, I just wanted to show a file here, showing that the attestation result was successful. But that this attestation was successful, we can see that the GPU is set in ready state. If attestation fails, if the VBIOS or the driver are in a wrong version, the VM will internally set the GPU to not ready, and the container will come up, but all the CUDA applications that you want to start on the GPU will just fail, because the GPU is set in not ready state. And from the container, there's no way to manipulate the GPU and set it in a state to a working state. It's all done on the VM level, completely isolated from the user, attestation is done in the VM, nothing is really running in the container. It should be completely transparent to the user without knowing the internal details if the GPU is set ready or not. This was a small demo just to showcase the lift and shift character that we implemented with the GPUs.  Awesome. Cool. Thanks for the demo. And that was very brave, I will say. So don't worry about anything that went wrong. It went like 99% smooth because live demos, there's always something that explodes. So you did a great job. Thank you so much. Thank you. All right. Awesome. So now we've got five minutes for Q&A. So all right, first question. And I'm curious about this one myself as like a piehead. So if somebody didn't want to spend a whole lot of money, but they wanted to put their hands on Cata and Coco, would it be possible to run either slash both on a small device like a Raspberry Pi? Yeah, you can run Cata on any ARM system right now. So we added a lot of support and especially we added all the GPU support on ARM platforms. So you can run Cata on a, is it a G5D metal instance in AWS, which is an ARM system with a GPU. And we are also enabled Cata on the NVIDIA ARM systems hardware that we are providing. You may have heard about the Grace hopper chip, the super chip for HPC. So we are running already Cata on the Grace hopper chip and as well on the BF3, which is the DPU, the data processing unit, which is mainly responsible to provide infrastructure as a service. And you're running firewalls and stuff like that on it. And you may also want to isolate those services that are running in your infrastructure against each other. So yeah, we are also enabled like Cata on the BF3 and we should have proper and good support for all things related to ARM and GPUs. I am not aware of any system where Cata would not run today. That's great news here. On ARM and GPU, yeah. Okay, awesome. Cool. Thanks for that. And there is a question coming in that is related. So on using GPUs, can it be split so multiple users can use parts of the GPU or is it one-to-one? And that came from Daniel. Thanks, Daniel. If you're doing a single GPU pass through, it's one-to-one, right? It's a one-user because one container. If you're doing VGPU, you can split up the GPU in multiple chunks and each chunks can be allocated to a Cata container or VM. So it's one-to-one. And depending on the resource capability of the GPU, you can have a lot of profiles running or a lot of chunks running on one single GPU. So it's a one-to-one relation. Awesome. So thank you. Thank you so much, Daniel. Another question came in. Sweet. So this one is, is there a support for live migration of Cata containers and confidential computing containers? So technically, yes, because AMD SMP supports live migration for confidential containers. Intel TTX has also live migration capabilities coming up as well. So it should work, yes. But the only thing that we need... So the only thing that I would make a point is that GPUs currently do not have checkpointing support or, well, they have some checkpointing support, but it's not integrated into Cata and confidential containers so that we can do checkpointing of GPUs, meaning that we can create a snapshot of the GPU and restore the state inside another VM. So with every X-ray that we are adding into the VM, we need to make sure that every hardware supports checkpointing. Otherwise, you can restore like the CPU and memory from AVM, but you may lose, let's say, the GPU and GPU state or NIC state. So all the components that are in the VM need to support it, as well as the trusted execution environments. Awesome. Thanks for that. Sweet. Thank you, LinkedIn user for sending such a great question. So I've got a question. So I'm just curious to know... I do not want to try it out myself, but I'm just curious. Can Cata containers and confidential compute containers be run in an air-gapped environment? Yes. There shouldn't be any problem to that because you can apply all those air-gapped mechanisms that you would use for your containers like local image caching or you're creating a local repository to store your images on this air-gapped environment. So you can use all of those technologies to create a air-gapped environment for Cata or for confidential containers. Since it's Kubernetes-compatible, all those technologies would just work. Nice. Awesome. Thanks for that. And we are at the hour. So this has been an amazing conversation, but I don't want to eat up all of your evening because I know that it's probably late over there for you and it's early over here for me. But thank you so much for joining us. This has been so much fun. Thank you. Thank you, too. I appreciate it. Absolutely. And we appreciate your time also and the audience. We appreciate you for tuning in. I want to give a special, special thank you to Zvonko for joining us today. And thanks to our audience. I'm just going to gush over you all again for tuning in. And please join us on December 7th for the next Open Infra-Live, where we'll get a recap of the virtual project teams gathering, PTG, that was just held back in October. And don't forget, if you have an idea for a future episode, we want to hear from you. So send your ideas over to ideas.openinfra-live.live And maybe we'll see you on a future show. Who knows? Thank you so much again, Zvonko, for coming. And thank you, audience, once again for tuning in. Hope we see you on December 7th. And I hope that you have a happy holiday. Thank you all so much. Bye, everybody. Bye-bye. Take care. Bye.


Today on Nightline, the 2023 TCA conference, a chance for driver voices to be heard, and a trucker saves a woman from a burning car. I'm Megan Phillips for Nightline. This past weekend, the Truckload Carriers Association had their annual conference where panels talk about changes and trends in the industry, and notable individuals are recognized. Nightrefrigerator driver Richard Bauer was named 2022 driver of the year. Richard was born hearing impaired, but that has not stopped him from succeeding in the trucking industry. He's an exemplary driver in both his spirit and his safety record, and we're so happy to see him get his award. We'll have a full video profile on him coming out next week. And he's not the only member of the Night family who was spotlighted by the TCA. Senior VP of Equipment and Government Relations, Dave Williams, was named Chairman of the Organization. We're so excited for both Richard and Dave, and can't wait to see them flourish in their careers. Hey, do you want to win a $100 gift card?  We want to hear from you and the feedback we receive from driver surveys allows us to improve and make changes that directly impact you. You can find the survey in the menu of KT Mobile, and it will be open through March 30th. And again, you can win a little something, something just for filling it out. Last month, Night driver Tony found himself in a scary situation. With a flaming car on the side of the road and a woman in trouble, Tony wasn't faced. But you don't want to hear me recap the scenario. I chatted with Tony to get the dramatic details straight from the source. Lady passed us up. We were doing 65, she was doing about 70, 72.  And she lost control. And when she lost control, the van went this way and straight into the trees and the van was on fire.  Her face was all bloody. She broke her nose. The airbag got her. The flames were starting to go into the van by the point.  I had to break to the driver's side window. The fires was probably maybe 15, 20 seconds away from her. And another guy finally came out and helped me get her out of the van. That's a very end right there. And if he hadn't come, I don't know what I would have done. I couldn't have got her out by myself. About 10 seconds after we got her out of the van, it was gone. Thank you for your heroic actions, Tony. That horn means it's time to enter the speed zone. Facts flying in at 65 miles per hour. Hey, drivers, we want your photos. We will be having a March Madness style tournament of driver submitted photos. Pick out your best shot and send it to us via DM on Instagram or Facebook, or email it to nightcommunicationsatnighttrans.com. You could be the March Madness champion. Do you have a student going to Arizona State University? If so, they may be eligible for the Randy Knight Scholarship. This is a $10,000 scholarship that is for an ASU student who is the dependent of a night employee. This scholarship can be renewed for up to four years if all criteria is met. That's a potential of $40,000. The application deadline is March 26, so don't put this off. Click the link in the description to apply. Have you taken this month's safety course at Knight University yet? The topic for March is the Smith System. Remember, taking this course is required for you to qualify for the safety component of your monthly bonus. The goal for the fuel efficiency bonus in the month of March is 7.3 miles per gallon. If you're looking for tips on how to increase your fuel efficiency, we made a video on that. You can find it on the Driver Portal. Congrats to our newest million-milers. It would take the average American 70 years to drive one million miles. So it's going to take me a long time to catch up. Thank you to all of you for your dedication in moving freight down the highway every day. And finally, congrats to our highest performing terminals for the month of January. Our highest performing large terminal was Gulfport, and the highest performing small terminal was SoCal ports. Whether you're on the road or in the office, it's team effort. Nice job to everyone from those terminals. Are you subscribed to Knight Transportation on YouTube? If not, what are you waiting for? Get notifications for these videos and all of our latest stories. And check us out on Facebook, Instagram, LinkedIn, and TikTok, so you can keep up to date with everything we do. I'm Megan Phillips. For the latest in all-news night, this has been Nightline. Good night and good truck.


Well, Vice President Bush, members of the cabinet, members of the diplomatic corps, each and all of you who are here, Nancy and I thank you from the bottoms of our heart for coming out to give us a warm welcome home. We've had a fine trip, a full and challenging trip, and as I said this morning, a successful trip, and we think we're returning home mission accomplished. We return with warm memories of European friendship for America. The European people know the United States is working hard for freedom, democracy, and peace, and believe me, they appreciate our efforts as we do theirs. I know you've heard that because there were a few demonstrations, some things might have been going wrong, but you know, every time I noticed who was demonstrating, I felt reassured that we were saying and doing the right things. I don't mind telling you there's a very special person who does a wonderful job on these trips also, whether meeting with leaders and parents concerned about drugs in Bonn, Lisbon, or with the Holy Father at the Vatican, or doing a pretty fair flamenco in Madrid. I think Nancy's one of the best ambassadors America's ever had, and I look at the press she got, I'm taking flamenco lessons myself. Well we feel good about what's been done, and after every summit leader agreed that steady economic growth means each government getting spending under control, how sweet it is to return with a 50-49 Senate victory for spending restraint and no tax increase. And thank you, George Bush, for flying all the way back here from the West and casting the tie-breaking vote. And our thanks to Bob Dole and Pete Domenici, the Republican leadership of the Senate, their colleagues, and Senator Pete Wilson for the grit that he showed to coming back when we needed him the most. So I thank them all for a budget resolution that moves Congress toward real spending restraint and significantly lower deficits. This was a courageous and politically difficult action. During these discussions with our economic allies, concern was voiced that projected budget deficits threaten world economic growth. Well, this Senate budget resolution represents a savings of almost $300 billion over the next three years, and it reflects the Senate's willingness to bite the bullet to help sustain our economic expansion. It's easy for some to attack individual elements of the Senate package, but I'm convinced that this was the only serious deficit reduction package that could pass the Senate. Our commitment to America's security is determined by the threat posed by our adversaries. If we conclude that our national security is jeopardized, I will not hesitate to request and the Senate leaders have assured me they will consider supplemental funding for fiscal year 86. I know Americans agree with us that we must restrain the growth of this federal establishment. The Senate has made an important commitment to cut excessive spending. Now it's up to the House to do as good a job reducing the deficit by cutting spending and not raising taxes, and we urge the House to pass a responsible budget resolution as soon as possible. We're committed to reducing excessive government spending and urge bipartisan support in both Houses of the Congress to help us in that effort, and now it's time to say goodbye again. This time I don't mind, because we're just going upstairs and we'll see you all very soon. Thank you all again. God bless you all.