So welcome everyone, and thanks for being here. I think there was a lot of competition and other very interesting thoughts right now, but really appreciate it. We decided to come here. We will talk again after an amazing talk about containers, again, about containers in privacy, hot topic of the day. Because the previous talk was already about what is a container, I will be very fast on that. I also would like to be filled with you. I will talk about kind of things. What is part and what we reach so far? And then I have a couple of provocative thoughts about how to move forward and what are, in my opinion, some non-technical obstacles that we are facing to reach the next point. Who am I? My name is Luca Pizzamiglio, complicated last name. I am previously port committer since 2017. Again, reach out to me for any additional questions. This is my email address. Working at E4, I don't know, 25 years now. But yeah, what is a container? Do you have any easy, I mean, what is, in your opinion, a container? Good.  If I ask you, OK, someone asking your partner or whatever. I heard container. What is it? Secure sandbox. Hopefully, secure sandbox. Secure sandbox. Interesting. Provide my solution by the network or allow it to be done in some amount of time. An isolated environment to run the stuff. OK. Yep. Sandbox. I'm not asking property. That's really, what is it? I mean, OK, it's self-contained, but it is an isolated environment. If I ask you ahead, what is it? Yeah, it's a subsistence where you can do your stuff, get rid of it, that sort of stuff. Most of not, for example. You can do the left and the right. That sort of sandbox. That sort of sandbox. The physical you can. It doesn't have to get done. You can't come to other. It can actually mix with other containers on the shelf. That's not a problem. OK. It doesn't have to be a sandbox, but it has to have a specific purpose. Well, the purpose is that you should be able to get rid of it. So really, something you can have multiple of them and get rid of them. So the first, I mean, very different definitions. My problem is there is no standard definition for a container. Nobody define a container. It's not like posits with processes. There is no very nice definitions. Container is a naive, not naive. Not well-defined concept. Everyone tends to see container on what they work on. Here is the community. A lot of focus on the runtime part of the containers. If you read the definition in the Docker website, the thing that the container is a way to distribute applications with a lot of focus on application is that they even see this as a kind of a replacement for package management. It was today in the talk in the keynote. It said, oh, Docker enabled what? Oh, I'm a developer. I have a dependency as a subsystem. I need, in my local environment, this authentication application, whatever it is nowadays with all those microservices, not just a lot of the Docker container. It runs. And the authentication application that my company is there. So I installed, double-level quote, an application to a container. That is somehow what Docker somehow put in mind. And the focus was developer at first. So containers somehow created a bridge between developers and operations as, OK, I don't give you the source quote. You build it and you deploy it. I give you an image with my application and you deploy it. It's already built, it's already there. It just somehow moved the focus. So a container might be seen as a way to distribute an application and has two main factors, an image and a runtime. It's not just a runtime. A lot of the answers were focused on a runtime because in our community there is a lot of focus on the runtime. And also the cool stuff is in the runtime. All security, isolation, properties, and nobody has focused on the image.  Any additional thoughts about it? I mean, there is more or less an acceptable definition. Zoom a little bit out from the typical runtime part. And that is also why the OCI specification actually contains two specifications. One from the runtime and one for the image. You cannot live without them. So there are two basically. You can see, in my opinion, the best parallel is the image is the program. The runtime is the application, is the process. So if you see container as one single application, I think the analogy is between process and program. Container basically means both. So there is no precise nomenclature, but the container image is your program. And the container runtime is the process. Just to give you some idea. What is part? So back in the day, I saw people using Docker. I was really jealous. So easy to, oh, I don't have to download different. We're probably with engineers, different versions. I cannot install them for the different version of engineers. It's only the package that is only one. Oh, but you can use Docker. No, I cannot. And basically, it allows you to do many nice things, and it's container work. And there is nothing of this kind of support for FreeBSD. So I'll just say that FreeBSD has a lot of cool technologies in it. J is the first one. What is missing to FreeBSD to have a container alike framework? We have decided this project as educational project. And yeah, to prove that FreeBSD was container ready somehow. In some ways, the choice was to use transcripts only, because it means that I don't have to write additional complicated features. Everything is already there. So I just use the utilities out there as a way to prove that everything is already available. Started in November of 2017, and somehow is still progressing, still living in a way. If you ask yourself what is part, basically part is heavily based on jails. I'm focusing only on the, at the beginning was a lot of confusion, because it's a naive approach. So we just say, oh, we can have an easy jail kind of approach. We can have a single data set. I'm only focusing on the container-like framework, meaning that part is a unique, let's say, ZFS data set with everything that you need, base, packages, application, configuration. Everything that you need is basically part of the image. To create an image in a way that way, just add a support for scripts, usually what you need. And the problem, as I said, oh, there are many others framework back in the day that were already managing jails. All of them didn't support images. So we say, OK, what is the easiest way to create an image? Well, you have one ZFS data set, take a snapshot, then compress an image. And if you copy that file over, well, you reverse it. You just extract it, do the best receive, and then you can clone it. And then you have the image moved back and forth. So it was very working solution. So still using that. The focus was also on a couple of different areas of the typical jails usage. The one was to have not persistent jails. For instance, in IOCH, back in the day, I remember talking to developers, I said, no, we only support persistent jails. Because of the problem we already saw, if you read Joel's JSTOP, is the command that is executing pre and post hooks and is doing all the cleanup operations. Jails is a structure inside the kernel. If the jails disappear, there is no way to hook outside and run post script. You have to run it directly on. Of course, we only want to run a process in each jail, not back one in the start script, and not the jail to run through the position of one. So the question is about not using RSC, RSC basically as something that was the other area of focus. So we wanted to have, we currently, a lot of them, a lot of those frameworks, focus on using jails as light virtual machines. So we have a subsystem running its own Chrome job, running its own Chrome D, Cyslope, and so on. So basically replicating a typical food system, or at least never done, but there's a system, is not an application. The idea was to, OK, what if you only want to run one process, not many? And there was kind of not too much there. So the RSC, in frame SD, is jail aware. So when you have your minutes there, it's running few services. The services are aware that you are in a jail or not. We want to skip that entirely. Just run, OK, we want to run NGINX, not RSC with NGINX start. We just want to strip down everything and focus only on one application. The reason why is container best practices says a container contains one process only, not multiple process. It's a best practice. You can do it, but usually there's a source of pain. If you imagine, for instance, if you have, this is the concept of pod in Kubernetes. Pod is multiple containers. And you have containers running your application, but then you have another, for instance, running an exporter and another do anything else. But you have multiple containers sharing something in between, and that's container false. But you have several other containers. If one container's live, you will need to restart everything. You only restart the single container that died, and everything will start at its rooter. If the application sells for a sub-process, then not one works, right? So if the application has a sub-process, then you will have multiple containers. So multi-process application usually are a very bad idea in containers. The container idea is to exploit horizontal auto-scaling, not vertical auto-scaling. So it means that you have a, if you have a performance issue, you scale horizontally the same stuff, but you don't make the single unit more performant. So basically you want to have this so-called horizontal scaling, and you put just in parallel multiple stuff, if you can. Would you also apply this to forking demons like Pothgrass? Forking demons? No, but it was a thing. Yes. We'll talk about that later, because exactly with Nomad, this is a problem. You shouldn't fork anything. You should keep the share where you're running it. Yeah, no fork. I have a bit of runtime, so basically the choice is that, obviously, we used everything that was available in FreeBSD, so JAILs. Not only, there was, I think, a KubeCon, where basically there was some sort of the history of containers, and they declared that JAILs was the first container idea that came out to the world. So actually there was some sort of, oh, JAILs is obviously the natural way to implement containers, but also was somehow the first idea of having this kind of containerized environment. So using JAIL was obviously a no-brainer. So I think that there was a lot of other stuff, like RCTL. We want to have resource limitation. We use VNet for network. Talk about network a bit more later. Bridges, PF, everything that is basically there. Open-ended choices. I remember the first issue that I got in Pothgrass was, oh, can you support a PFW? I mean, that's a welcome, but it's a lot of work. So I just decided to use PF, but it's just a choice because I knew how PF works. But as usual, that's a welcome. So if you want to support other firewalls, just do. Network, so it's a lot of opinionable and bad choices when it comes to network. I'm not very strong in network. So I think basically what it was working. And we had basically four different network setups. Everything that JAIL was providing was just a no-brainer to make it available outside. So he narrowed it, he narrowed the stack of the machine who typically is good if you have a process that needs to fetch from outside, not to expose network services. Alias is the other typical way. You just put an alias on the network card and then you attach it to a JAIL. And then we have a couple of things using the bridge. The bridge is a way to create an internal network that is completely internal and virtual. And then completed detached. And the idea is to use PF to provide connectivity to the outside a little bit more later. Then if you have a lot of JAILs, they share the same bridge. That could be some performance issues. So we also added the ability to have a private bridge. That means, okay, you can create smaller, basically bridges where you have fewer JAILs that communicate to each other to just reduce potential bottleneck on the bridge.  So that's why I developed a small application just to manage this IP address space there to... Sorry. No problem. So that was one of the few addition that we had to do, but it's just to manage the IP address space. It's not really needed person, but yeah, something that was somehow needed. The latest addition is, one of the latest addition is support of multiple IP stacks. It's easy with JAILs to have IPv6. It's less easier to have an environment where you can try IPv6 addresses that is not usually so easy. But the idea was to have IPv4, IPv6, and dual stack. With the host machine, obviously supporting IPv6, you can give IPv6 to your JAILs. You cannot have the other way around for obviously. And yeah, few choices. So as I said before, the IPv4 implementation, basically you have a bridge where all JAILs lives. You just put the vehicle gateway address on the bridge, and then you just configure your PF to do the nut for the album traffic, and then you add dynamically redirect rules for the inbound traffic. So if your service is proposing a network service, then you can basically create a redirection rule to use the network interface of the host to connect your services there. So you have the redirection there. And the IPv4 is fully isolated. You define basically which IP address to use, and then you just use everything, and this is a network that is not visible at all from outside. The idea there was to have some sort of docker-like experience all around on my laptop. I don't know in which network I'm going to attach. So managing the addresses of everything all the time was kind of, you cannot do it, complicated. So I want to basically remove from the use of this burden and say, okay, we just give me an range that is never conflicting. The default is basically 10.192. So this is the default, but you can change it. And then all the machines live in this virtual network that hopefully is not conflicting with anywhere else where you are. And fully-assisted, fully-isolated works pretty well and automatically managed by parts where you don't have to know P.F. how it works and it was just fine. On IPv6, I didn't know how to proceed. So I just asked people, and they said, come on, on IPv6 you don't do net entry direction. I mean, it's so IPv4, IPv6 is there to have all those kind of things. So you don't do that. You just attach directly your jails to the network. This is how you do it on IPv6. Cool. Went through this idea fully. So on IPv6 you have a different bridge only for IPv6 because what you need to say, okay, you take the network card, you just put it in the bridge and then your jails will just get the address from the network with the RT-SOL. So basically just get some isolated request and then set configure. You don't have to do anything. Several problems with this approach. The network card goes in promiscuous mode because then every jail has, using VNet, they have their own MAC address. With VLAN, if you run on a Wi-Fi, well you only receive the traffic for your MAC address. So this doesn't work on your laptop. It works if you have a physical network card with IPv6 and you attach them, it works just fine. But it's run basically promiscuous mode, has to basically all the traffic just to capture the traffic that is defined for the jails. Why would that be so much of a problem if you have a switched network? And that's the overall, it can be taken on the top of the back switch. It's not a problem. As I said before, I'm very bad with network compared to the average and the NBSD conference. So this is a never-of-improvement. We'll talk a bit more later because also this is not a very good idea. Pitches are welcome. Be free to have any, I mean, I'm happy to really, it's really probable. But what we did later, so the idea was to develop part only to imitate Docker, so to focus only on the container kind of features and not to care about the orchestration. But then a certain point of the way, but orchestration is the way to go nowadays. Back in the days, we look at Nomad. Nomad is an open source container orchestrator. It's a sort of competitor to Kubernetes, developed by Ashikov. The biggest advantage of Nomad is that Nomad is from the beginning designed to run on different operating systems. Ashikov has a lot of enterprise customers. They run on Solaris, on other stuff. So there was already a Nomad part on Fribisly, so I didn't have to do anything. Oh, Nomad is there. So basically you can run Nomad on Fribisly already. Kubernetes, forget about it. Doesn't compile. I mean, it's a nightmare. But for Nomad, Ashikov care about having Nomad running on multiple operating systems. So being not one operating system centric is one of their things. So it's already somehow designed to be more flexible. What you have to do, if you have a different container type, you just create a driver. You basically expose the features that Nomad needs to schedule or to start basically a container. And that's it. So I'm a color colleague, a student, just vote a driver. Vote a driver for Nomad to interact with POT. And yeah, Kubernetes is a like experience. What it means, very high level. I don't want to spend too much time on that, but basically you define some sort of job that is Nomad names, you specify a kind of service, other details like where the image is and so on. And for instance, you can say, oh, I want two instances of that service. What happened is those in the middle are different Nomad worker kind of specifically if you choose, oh, this is a POT thing. So I want to, you need those as to have the driver to speak to. So let's say this is some sort of the control plane where you decide what to run and so on. And those are the worker. And what you can have, you know, multiple nodes, then you can have multiple instances of your stuff. I put the IP addresses just to specify the IPv4 on the bridge. So basically this is the internal virtual network, the 192, blah, blah, blah. And they can have all of them the same IP, who cares? Because there is PX here to do all this translation. What it matters is the IP of the machine because the service is not reachable from here, but it's reachable from here. Nomad is an orchestrator. It doesn't manage the service catalog. It's console on the other side is basically another service that just managed the service catalog. What it means? It means that, oh, I have two instances. Nomad decides where the instances are running, which port to expose and so on. And console keep track of those. So if you want to reach Fubar, that is here, you use this IP with this port. And here there is part that is doing, is injecting those PF rules on the fly and do all the magic to make the Fubar service running in a jail exposed outside. This is the cloud wave of services. Additionally, you can have ingress. That is basically some sort of look balancer to dynamically understand how to reach a service. You have only one single point of entry. And you say, oh, for instance, in mini port there is some sort of reconfigured system. Traffic is configured to have one content, depending on the host header, decide, oh, if your host header is Fubar, it's looking for the service Fubar. Traffic is picking with console to see who is implementing the service Fubar and then is directing accordingly. So the list of the backend is automatically updated all the time. When you do a new deployment and the partner number changes and so on, traffic will update the list of backends automatically. And this is the Kubernetes alike environment. And it works. We have it, upper running. The problem is you need to know more or less how normal that console were all those kinds of services to be proficient on that. Because it's a different world and it can be complicated. But when those with images, we needed a repo for the image. The image was very naive. I didn't want to write a register because I say security issues over everywhere.  Bad idea, usually. So I didn't want to have this burden.  I'm not an expert. I will do disasters there. I'm really doing bad stuff here. So don't make my position worse. But definitely can I say, well, I can do this. Just as a proof of concept. There is this claimers everywhere. Use it at your own risk, whatever. But at least there is something just to play with. So there is a repository where you can create your flavors. And then this system basically will just create images for you for different previous diversions and so on. There are also additional for every image that are already predefined, command line how to use and download this image. So it's some sort of docker hop for images that was the ambitious goal. Still with a heavy disclaimer at your own risk. At the end, the registry URL is just a web server, downloading a file. Because the image, as we said before, only contains the archive. We put some attributes in the name because naive implementation. So, oh, which previous division is it? Oh, it is underscore 12, not a great implementation for sure, not OCI. But there was something to basically move on and improve the concept. So that was an additional work done by Stefan. And how far this naive implementation reached.  I need the developers need to SSH into that. So you don't SSH in containers. What you can do usually, oh, I need a shell in that container that is basically equivalent. So in a jail, what you have to do? Oh, you have to go to the developer. The developer needs to access the machine, needs to run a shell with JXAC inside the jail. A lot of permission in between.  So similar issues with, in general, container world. Now I provide a UI and there is very nice addition. This is the last addition, so how far we reached. You can run directly from the web UI, a command in the path directly. What it means, there is a nice screenshot because the demo didn't work. So the backup was having a screenshot. What it means is this is the web UI. There is somewhere a jail is running on some machine. But from the control plane, basically here is, oh, nomad, unlock, XAC, whatever. And what do you want to exact, SSH? And directly from the control plane, you reach the jails and you have an SSH running there. That is the latest achievement. So how far, in my opinion, also a naive implementation can go? Because the interface between the nomad for driver and paths is a bunch of shell scripts. Running shell scripts in production can make me nervous. So that's why I don't have any implemented. But, as I said, Grembo, Grembo is an other path committer. He has a professional, I mean, instance of this system running on .itwork. So basically, there is something in production. Even though he has a different network setup, so it's a patch version of path, still waiting to understand how we did things. He's better than me. So we need to figure out a way to improve network, but for sure his contribution was great because it moved from a proof of concept to something, I would say, semi-production ready. And basically, he needed these kinds of features implemented in paths and then in the driver deployed working. Moving to a little bit more, I would say less technical thing. Why paths reached this level was not just me. It's a community effort. As the one brought to the driver, Grembo, Aka, Iyer, run a class in a professional environment. So it just identified a lot of corner cases. We're talking about Postgres, huge amount of issues. The Postgres shared memory is not clean enough. I mean, many corner cases has to be found and addressed. He has a very, also additional use case for batch jobs. When a batch of die, you cannot go, we need to know if we're successful or not. So we had to add comments to know what was the state of the job when died because it's not an effort service, it's a different thing. Step-on, step-in, and create industry with good images. And then also very good because you reach out every quarter and say, hey, you should write something, otherwise I will just forget. So it's really a community effort. Everyone just contributed in their corner and we could basically move on. Move on with what? Load images. So basically, oh, we use ZFS, so we just create an air shield images. We are still imitating those CI somehow, but redefine everything is a lot of work. So we found a way to do it. DNS configuration, if you download, we have the DNS configuration, the rest of the content is part of the container. Well, adding comments basically would change DNS configuration on the fly because you don't know where your machine is going to run. So you have to basically strip away some of the configuration of the image when it was created to make it more agnostic. We decided just to overwrite things on the fly when the things are prepared. But still, a lot of work. Flavors at the beginning was less flexible, so now you can just isolate your flavors somewhere and then create things directly from there. I was talking about, yeah, positive shared memory at this garbage collector because, oh, the J is not dying. Why? There is nothing there. Oh, no, there is a positive shared memory. And this is a nice thing, it's in current. So those use cases when it comes out and you speak with people and they are willing to fix it. So now in current, Js are able to clean up shared memory, positive shared memory. So it's a nice two ways collaboration. So if you have use cases, people reach out and things get better. That is the example, the ZFAS encrypted data set. So basically everything that is available from the operating system, it just matter of exposing above. You don't have to do, I mean, it's already done. The operating system is developing. You have to just bring those features up and make them available. This is the nightmare. Starting and stopping a jail is not an atomic operation. Then you can, if you are, especially if you don't control it because nobody's controlling what is starting and not, it can start the same Js twice. Just few millisecond, microsecond, I mean, the operation to start the jail with POP specifically, oh, you have to modify system, prepare the file system, prepare the network stuff and then finally start the jail. So there are a lot of operations in between. It's not atomic. And because it's a shared script, it just do stuff on the way. It just check, oh, the jail is existing? No, yeah, but there is another process that is starting the jail, doing everything already.  And fixing in shell, so the limitation of the initial choices, not very great. And then some update also on the normal car driver has said bad jobs, periodic bad jobs, another bad thing. Ability to send signals, Xs and so on, just because the idea was, oh, you need it. You implement it here and then you expose it and then no one can use it. So still few issues. The redirection, if you use the host IP directly from the host and you do the redirection, it just doesn't work because when you are on a machine, we just saw before, if you are here, 10.003, if you ping 10.003, well, it's localhost because you don't go to the physical network. Somehow the redirection, if you try to reach FUBAR using this address, basically the one in console, it's not working. The traffic stops when it goes back from the jail. Get lost in between because it's localhost of the network, I don't know. There is something that doesn't work. We have a workaround that is horrible, really bad. And yeah, Michael said, oh, I have this patch version that uses reflect jail, but it's really, I don't know what it is. So he knows, he has a valid, we will integrate these solutions here one day. We have ability to mount stuff inside the jail. We use null FS heavily, but the typical Docker usage, oh, I just mount a file. Mount a file, if you let me use this word, we cannot do it. We have to copy it. You cannot mount a file only. You have mount point is a folder, cannot be a file. And that is somehow a limitation. Currently, oh, you just, you need a folder with one file and that is the workaround. Yes. You probably can do the same thing. Sorry? How is it going to use this file? No. Maybe, yeah, I mean, I think our workarounds to do that, it would be nice to just use the same approach for everything, let's say this way to limit the, something is possible, yep. But yeah, if you have a better idea, just write to me and I will try to use, I mean, using fuse, just add more dependencies. I'm not super, but yeah, third. Just for the, yeah, one workaround is to use, yeah. That of us. Yeah, that is the current workaround. So using a folder and put the file there and you can, the problem also, we have to always pay a lot of attention. That's in general, Dan Lange gave a good thought, a good examples. If you start to abuse sim links, then, I mean, how we copy now stuff is to, if you want to copy a file, we mount the folder in the jail, we run the copy inside the jail when everything is mounted. And the reason is, if you have sim link with a absolute path name, if you are in the host or you are in the jail, those things are resolved differently. So to avoid confusion, we just, oh, you want to copy a file? We mount all the file system, so you run the copy in the correct environment and then you go back. Yeah, that is another thing. Yeah, we want to be able to do it without running the jail. You don't want to execute the jail just to copy the file in it. So we have separated you, we have basically a way to mount, to prepare the file system only, just to copy the file and goes back. This is another topic, it's not just for us. I think there is this nasty race conditions that many has been addressed. I mean, it's not that bad as before, it was really addressed. The problem with VNet and jails is when you stop the jail and then you immediately destroy the VNet, the E pair. So basically, E pair B needs to go out and in that moment, if you destroy the jail, then the jail is removed. There is sometimes some red condition that's happened and it just explode. Easy solution, oh, we have a slip.  I know it's not nice, but I mean, it shares creep, again. But this, I mean, it's not easy stuff. One big difference compared to the, I say the Linux world is about resource limitation. There's the only, I would say, big differences about memory limitation. RCTL try to limit the memory use but it's not as nasty as C-groups. So it doesn't kill the process if you use more memory. So it just try to limit the memory use. C-groups is a typical thing. Oh, if you have a leak, just kill the process so it doesn't disturb anyone else. Yes. But you have to be careful because if you limit the resident memory size too much, you can push the process to stop swapping, really. Yeah, last time I tried, it wasn't swapping. It was just going above the limits and it wasn't stopping, it was swapping at all. But it was three years ago, so things could have been changed. I won't just do, I think we are running, yeah, five minutes. So I need to rush a little bit. As said, initial assumption was a lot of source of pain. So ideally, we would like to have OCI support, life cycle support that is the same thing, the same struggle. Jays are an internal data structure. So to have an interaction with the user space, you need some sort of supervisor that can keep track of the status of the jail to be able to automate the different operations. Because the kernel cannot, hey, run this post-stop hook and not do it. So you need something outside to listen, basically, to the events and have those kind of managing the life cycle support. With a Nomad pod driver, oh, we've just fixed it. The driver of the Nomad is already taking care of the container life cycle. So I just said, yeah, can you run pod stop there every time, so if it doesn't exist anymore, just run spot, stop it twice. We make stop intelligent enough to not do too much, but at least is able to perform all the cleanup operation, unmounting the file system, things like that. So that was, but if you don't use the Nomad pod driver, you don't clean it up. Another thing you can do with a supervisor, ideally, the supervisor has root credentials. So the user can start a container just picking with a supervisor and you allow basically users to run jails without the needs to be root. If it's a good idea or not, I don't know, but with a supervisor, you can do it. I said shell is a lot of fun until it's really not. Just skip this. Last thing is we need to redesign many of the stuff that we are doing right now because the naive approach of stuff reached basically, in my opinion, its limit. We can do, we can still do a lot of improvements, but they are not game changer. They are not able to now be widely adopt because there are some inerring issues with the initial thought because the goal was completely different. So if you want to go from a proof of concept to a product, we have to address several stuff. And also it seems that the previously community would like to have a container implementation, but it is a community effort and not be, I mean, why there are 30 jails framework and many of them died after one or two years. If it's only me on Sunday on my couch doing stuff after a while, you just give up because life moved on. So it's a community effort. Not just because you cannot rely on one person, but there are so many subsystems. I'm not a jail expert. I'm not a ZFS expert. I'm not an ethics expert. Manage to do something, but still, if you want to reach a certain point, you need people with better knowledge, with really experience on every subsystem to give you the right hints. I mean, already now we're talking about network, how to map a system. Yeah, just come out. Oh, you can do that. You can do that. You can do that. You can do many things, but I don't know everything. And that is why it's a community effort. And the second reason also is different ways to use a stress container. I made the analogy before, program and process. It's really like that. So you can use a process in four gazillion ways. And you have three billion of use cases, and I cannot imagine all of them. So you need a community also to enrich the use cases and make these more reliable. Opinion added? But yeah, we have to get rid of Shell and use some programming language that is called programming language, not Shevskv. That is not a programming language. Provocative. Go seems a natural choice, but I'm Rust myself. So just because Go has a gazillion of modules already done for containers, so you don't have to reinvent or docker on ZetaFace exists. So, oh, we can use that for images or you don't have to do it. But we don't have any specific choice. Last but not least, that is the most complicated one in any possible community. A developer can back to the first thing. Containers for developers, not for operations. Operation was a consequence. If you want to develop or to use a container, they have to be able to use it in their own laptop, in their own development environment. Here we have few people using VSC directly on laptop, but few already here. Imagine nobody wants to have a previously laptop just to run jail, so you need to provide an abstraction. There are several things, but still it's, yeah. Exactly, but they provide it. So you have, yeah, but you have to maintain it, a product for Mac to allow Mac people to use it. You have to do for Linux, but we are using BSD as a primary driver. You don't want to develop something on Mac that emulates FibrisD. That is, I would say, a source of friction that is complicated to address, because it means that you need developers of another operating system to support your stuff outside. I think this is a problem for adoption. Developers don't run FibrisD natively, period. And if you don't, Docker was successful because they put developers first, and then an operation that would figure it out. That is why it was successful, my opinion. Thanks for listening. I think we have already a lot of questions. I saw a lot of hands. I don't know if we have time. Can you take a couple of questions? Do people mind if we have the microphone after this? So I don't have to repeat it. So if you have questions, just reach the mic and shoot it. So do you have any problem with VNet, with any interface that's not E-Pair? Because my experience is that when I only use Jail with a single process, and if you assign a VNet to it, say it is a real network interface, we will never interface will disappear forever. I'll tell you, Jail dies. No, we don't have this problem. What we have, we basically to avoid using SHRC, we have a tiny RC, some sort of script that is created on the fly, depending on the configurations of the pod, to configure the network on your behalf. So basically we are injecting the configuration in this tiny script, and then this script is launching your application. But we never had any issues so far with VNet on, I mean, we had in the past, but now it seems very, very solid. So after that, it's the relocation and knowing which interface you have to destroy after the container dies, is still a hard problem because we're using Shell script. It's not actually destroyed, it's that the way you need to pass in your device to the Jail, you actually need to use an if config and a VNet device. The thing is, after the Jail die, because it's there, so you cannot use a VNet to place out from the Jail. Back to the most. Yeah, we destroy it from the host. So basically, you know, we put the B inside the Jail and we keep the A outside, basically hanging there because we have this redirection basically on the bridge, so we don't care about the if per A. But then when the Jail dies, we just use some tagging on the, and we try to understand, okay, which if per A we need to destroy and then everything is fine, so we don't care if the if per B is not there. Usually everything is fine. So that is how we, we do a lot of operations outside the Jail. We tend to do as minimum as possible inside the Jail and we prepare all the environment that is needed outside, and then we start just the process. One thing that I wanted to mention in Nomad, you cannot fork, because then Nomad want to keep the, so basically Jail start never ends. And so there is a Nomad log thing that can just grab all the standard output and standard error and just represent to the web view. So if you fork, then it thinks that, oh, the process is not there anymore. It's a typical example with engineers, for instance, if you check in Docker, they say, oh, the exact, engineers is don't go in background and you have to do the same for engineers on Nomad. You don't have to go in background, otherwise the things doesn't work. But if you run the same image on the command line, it's just still your terminal. I think our time is over. Time for lunch. So really thank you for being here.


Moving on, Governor Amadou Finterio Fadamai asked his president to collaborate with opposition parties for the state's development. They arrived in Yola, of a supreme court victory, announcing that the appeal failed, found by all progressor-congress candidates, sent into a shout of benign, was dismissal like a merit. Now, Finterio pledged to continue working for the state's people's peaceful coexistence and its development in all sectors, pledging to partner with an judiciary to build democracy in the country. I've called on all of the more students to join me, should I build all of them out of our dreams. And I want to assure you that we're on board with every student here, we're on board with our, to ensure that we take our state with a greater height. I have never lost faith in the judiciary, I have said in time with that number, that they've been standing firm, they've been doing their job, they've never allowed their judgment to be on the shelf, like who do I read.


we discuss reading, and I'm your host, Dr. Rita Forsyth, coming to you on the ThinkTap Network series, broadcasting from our studio in downtown Honolulu. Today, I'm not coming from my home on Maui, but I'm actually coming to you from Seattle, Washington. The title of today's episode is From East Garrison to the Ranch House. Joining me today is his honorable Peter Gravitt, Major General Retired, former California Secretary of Veterans Affairs and Author. Welcome, Peter. Thank you for having me. I appreciate that. There's so much to talk about with your life and your history and your book. You were promoted to Major General becoming the first African-American in the 225-year history of the National Guard to earn the rank of division commander and simultaneously you worked in law enforcement and then you were also appointed to be the California Secretary of Veterans Affairs. So, so much to break down and talk about. Where would you like to start? Well, I'd like to start with my, at my beginning and where I come from and then just travel through my life. Great. I'm from the South, I was born in the South. My parents were sharecroppers in the South and pretty much lived the life of most sharecroppers, picking cotton and sharing the proceeds with the landowner and if they're worrying the profits at all after a year of picking cotton. And my parents lived in a county where the schools only went to eighth grade for color kids, color children. So they decided to leave the South and head west and they did, they picked up roots with their eight children and moved to California, settled in the Los Angeles area. And I was very, very young at that age and I think I was like two years old. And just a few weeks after my parents arrived in Southern California, my father was drafted into the Army Air Corps, leaving my wife, leaving his wife and eight children, the oldest was 10 years old at the time, leaving a wife with no money, no savings, no car, no telephone, but lots of friends and relatives. And so my father went out to war and my mother existed with her family. But on his return, he and my mother had additional children. I previously had 12 children, one of which passed away shortly after birth, but they raised 11 children together. And- Well, not to interrupt, but I'm so fascinated about your father's story. Can you share a little bit about your dad? Yeah, my dad was a very honorable man and he was my role model. As a matter of fact, he was the impetus for me joining the military post. When he returned from the military, the only time I ever saw him in a military uniform was the day he returned home. And I was very young, but I recall him coming into the house in uniform. And what struck me was that he removed the hat from his head and placed it on my small head. And I just kind of marched around the room like I was a soldier. And from that point on, I believe that's when I knew that I wanted to be a soldier like my father. And eventually I became a soldier as you can see now. And I think my brothers also saw that too, because eventually eight of my nine brothers served in the army. How many? Eight of my nine brothers served in the army. My goodness. And, but my two sisters got into the act also because one married a soldier and one married a Marine. We had a Marine in the family. And tell me about your father's role in the military. Well, my father was drafted, as I said, in the Army Air Corps. He was assigned to the 332nd fighter group, which later carried the title of Tuskegee Airmen. My father was an enlisted soldier and a ground crewman. And his role was to support the pilots in preparation for their missions. And then when they returned from missions, his role was to receive them back and make sure that they have all the logistic that they needed for their next mission. That's incredible. It's an honor to talk to someone who has so many military experiences and backgrounds. So let's talk about your book from East Garrison to the Ranch House. First, I wanna ask you, why that name? Okay, let me explain the title. And on the front cover of the book is a photograph of the California State Capitol. And in the foreground are colored people in the South picking cotton. I merged those two together to talk about where I came from as a sharecropper son and where I achieved some success as a member of the governor's cabinet in California. And the title of East Garrison to the Ranch House was coined because in California on the central coast, there's a military base there called Camp Roberts. At Camp Roberts in World War II, the colored soldiers were based upon the east side of the post called East Garrison and the white soldiers run west side of the post called West Garrison. And on West Garrison, there was an old Hacienda that became the quarters of a commanding general.  And up until the time that I eventually took up residence in the Hacienda as a commanding general of no other black or African-American officer had ever resided in the Ranch House. So my journey was from East Garrison across the highway to West Garrison to the Ranch House. Amazing, amazing. So what inspired you to write that book? My sister, one of my sisters. I had served in the police department for over 20 years. I served in the Army National Guard for over 20 years simultaneously. And then later, after I retired from the police department and returned to full-time military duty for another 20 years. So I served a total of 44 years in the military, active and reserve combined. In that time, in both careers, I had done a lot of things that my family didn't know about because I was working in law enforcement, doing things that police officers do. And then in military, I had traveled several places in the US and around the world. And my family didn't really know all that I had done. So my sister encouraged me to put pen to paper and start striking keys on a computer to write my story for them, if nothing else. And so I really started writing the book for my family. It was only toward after I'd been into the book for over a year or so on and so forth. My sister suggested that I let others read my book. She had read the manuscript and some of the drafts. She said, other people need to know what you've done. And I said, well, I'm not writing it for that, writing it for the family. She says, well, the world is your family. And so when I finished the book, that's when the decision was made to have it published. And that's the genesis of the book. Well, let's hear a little bit about from, if you don't mind reading it from your book. And I know it kind of goes back and forth between law enforcement and military since you were basically having two jobs at once there. Could you start with maybe something from the law enforcement perspective? Well, in my law enforcement career, after graduating from the Los Angeles Police Academy, I served in a number of positions along the way, uniform patrol, traffic, I eventually became a detective and served in public affairs and spent a lot of time in traffic enforcement. And traffic enforcement is one that I wanna read about because all police work is not dangerous. Some of it can be funny at times and comical at times. And the police officer has to have a sense of humor to exist in law enforcement. So I'm reading a passage from my book of my law enforcement career. This is just one piece. One summer day while patrolling alone in a beach area, the driver of a four seats, four in red convertible committed a traffic violation. So I made a traffic stop. The driver was a young blonde girl, probably about 16 years old, and there were three other young girls her age in the car and they were all wearing bikinis. I requested the driver to produce her driver's license but she replied that it was in her purse and her purse was at home. As I began taking personal information, she attempted to get out of the car and I requested her to remain inside. She exited anyway as did the other three girls. I politely but firmly ordered all of them to get back in the car, but they just giggled as if it was all a lot of fun. As I was writing the traffic citation with the limited information she provided me, one of the girls came up behind me and grabbed my uniform hat. As I turned to retrieve the hat, she tossed it to another girl and they began playing keyboard with my hat. All of this was being watched from across the street by a group of young beach party-going teenage boys. These boys were friends of the three girls, four girls. The boys were clapping and edging them on. It was not funny to me. In fact, it was downright maddening and embarrassing. I radioed the dispatcher to send a backup unit but cautioned that I did not require any assistance as that would have generated several police cars responding with red lights and siren. I didn't want that. When the dispatcher requested the nature of assistance that I required, I chuckled and there was said that there were young girls playing keyboard wave with my hat. Minutes later, there come several police cars, red lights and sirens blaring. Now I was totally embarrassed. I finally retrieved my hat and wrote the driver a citation for a violation of not having a driver's license and also for the violation she committed while driving. I ordered her to lock the car up and walk and she would not be allowed to drive any further with no license. They all protested as they were barefoot and only wearing their swimsuits. I considered this payback. As they walked away, just as quickly as I could, I left the area. No doubt the other officers would have preferred to have given them a ride but refrained from doing so.  I suspect those young ladies really learned several lessons that day. Always have a license when driving, take shoes from going to the beach and never play keyboard wave with a priestess hat. I too learned a lesson. Never stop a red convertible sports car with young blonde girls wearing bikinis. But if so, leave your hat in the car. So that's just a lighter side of law enforcement. And you know, in law enforcement, there are a lot of lighter sides and we need to always understand that. Oh, that's great. Oh my gosh. Okay, so you were in law enforcement and then you joined the National Guard or was it the other way around? What was the other way around? I went into the National Guard right after high school and went off to the Army for training and served my time in the Army when I returned from the Army. I was a National Guard and then I joined the push department. So from that point on, for the next several years, I was a full-time police officer and a part-time soldier. And somewhere along the way, I, well, I was promoted to an enlisted ranks, E1, E2, E3, and finally, I was a sergeant. And then I made the decision to apply for officer training. And I was accepted and I went off to officer candidate school. And officer candidate school was very rigorous as it should be. And I was on leave from the push department during the time. And my intent upon being commissioned as an officer was to serve in the tank corps, armor, armor, armor branch, which I had served in as enlisted soldier. And so if it's possible, I can read a little passage that occurred, something that occurred after my training was just about over. Yes, please. Okay. And it's called a field artillery, the elusive branch. Just prior to my graduation from officer candidate school, all candidates appeared before a branching board to determine which branch in the army there would be a commission. Generally, these candidate will list up to three choices in priority, but it's up to the needs of the service which branch they would be assigned. In priority, my choices were field artillery, armor, which is a tank corps, and infantry. I specifically did not want to be branched military police as I had served there as enlisted soldier, as enlisted soldier. Each cadet was directed to report to the office where the branching board was in panel to receive their branch assignment. The board consisted of, as I recall, a lieutenant colonel, a major and a captain. Just as I was about to enter the room and within hearing distance, though not eavesdropping, I overheard a casual remark by a board member a known bridge suggesting that I not be branched field artillery. And as I recall, his exact words were, field artillery requires a lot of mathematics and computations and blacks lack that ability. The other board members mean were colonel. My minor in college was criminalistics, requiring several courses of advanced mathematics and I was very familiar with the tactical and operational employment of artillery in support of infantry and armor units. I had a bachelor's degree, which with a major in criminalistics and a minor in mathematics. Additionally, if that person had studied military history, past and current, it would have known that black soldiers had served in field artillery for almost 200 years. So that was just one episode in my army career, a negative episode, if you will, but overall my military career was very, very favorable. And I was able to get commission, served in the armor branch as an officer. I commanded the armor platoon, armor company, armor battalion and finally a brigade. And this is over a period of years. I never did serve in the field artillery, but I found a home in armor. And later on, I was able to serve as chief of staff of a division and then upon sending confirmation as a major general, I was appointed as a division commander of a mechanized infantry division. And all along the way, I had met a lot of great soldiers, a lot of friends and enjoyed my military career. However, I enjoyed my law enforcement career also and that's why eventually when I retired from law enforcement, I returned to military duty full-time and was able to serve in several places.  So, okay, so there's military, law enforcement, what are the other two? So military, law enforcement and then also federal and state government. So, upon my retirement from the military, I was appointed as the California State Chairman of ESGR. The ESGR is Employer Support for the Guard and Reserve. I was appointed by the Assistant Secretary of Defense. And what that agency is, they serve as a conduit between military reservists and their civilian employers to ensure that the employer understands the role of their employees do in the reserve military. And, you know, oftentimes reserve military personnel are mobilized and deployed moving away from their civilian employer. And there are certain rules and regulations and federal rules that employers must follow in terms of rehiring or replacing the military with a return from active duty. So my role was to interact with employers, major employers statewide. And every state has this, by the way, and every state has a state chairperson and I was a state chairperson for the state of California. So that was my extent of my federal government in employment. And then a state, when I was serving as the ESGR State Chairman, I was contacted by a California Governor's Office about a position in state government. I had not applied for position in state government and was kind of shocked that I would even receive a phone call. But I was asked to meet with the governor, which I did, and I was interviewed and then resulted in me being appointed as Secretary of the California Department of Veteran Affairs, an agency which works side-by-side with the federal VA. Again, now the federal VA Veteran Affairs provides all the benefits to veterans but they are administered by the state and the state provides its own benefits to veterans. So as Secretary of Veterans Affairs, I had an agency of about 5,000 employees scattered statewide, but this included eight veteran homes that we house veterans in need and then we have service centers throughout the state. They're work side-by-side with the federal government. And in that role, I was able to work with veterans, ensure that they had their benefits, connect them to the federal benefits, ensure that the eight veteran homes were operated efficiently. One home, which is the largest in the nation, is in Yeltonville, which is in the Wayne County of California, north of San Francisco. And that particular home at a time housed 1,200 veterans and with about 1,500 staff members total. And the facility was as large as a college campus and it wasn't just a building, it was a campus. And so I enjoyed my skin there as the California Department of Veteran Affairs and California Department of Veteran Affairs Secretary. Boy, I mean, these are major, major careers. So my question is, how do you balance multiple careers at the same time? How did you do that? We're a little helping God. And also my wife, you know, when I serve this as CalVet Secretary, I'm going to give a shout out to my wife, Lance. She's a retired Army colonel and she assisted me the entire time I was a secretary as the most gracious volunteer you could ever find. And she traveled with me. She spent time with women veterans. She talked to them. She was a Joan of Arc and she did a great job in assisting me. But it was a challenging position. California is a large state and from tip to tip, it's almost a thousand miles long. And so if you go to Lake California and the East Coast, it goes from Maine to South Carolina, for example. And so California then and now has the largest population of veterans in the nation. At that time, when I served as a secretary, we had two million veterans in California of the 20 million in the nation. 10% were in California. And so our work was done to serve those veterans. And I think we did a very good job. But that's only because the federal government, the federal VA and the state provided sufficient funds to serve our veterans. Well, switching gears a little bit. I know you are writing or have written a second book not published yet, but can you tell us a little bit about that book? Yes, I'd love to. The working title is, it's just a working title. It's a general patents after American battalions fighting in World War II. And the book talks about the chronicles for battalions in the U.S. Army in Europe and World War II. You know, the Army was segregated then and were quite units in what they call color units at the time. And so I selected four units that were different, totally different, that I thought someone would enjoy reading. One of them is a barrage balloon battalion. People don't realize and hope to educate them by reading the book of the role of barrage platoons, especially in D-Day June 6th, 1944. You've probably seen pictures of large blimps floating over the beach. And those beaches, those balloons were tethered through a cable stretching down. And it was designed to throw any aircraft from attacking the soldiers on the beach. And those balloons were manned by African-American soldiers. The only barrage balloon battalion in Europe in World War II. Another battalion I selected was an armored battalion, a tank battalion. And this battalion had been formed in 1942. And by 1944, there still had not been deployed. They've been training for two years. White battalions were formed and 90 days later, they were deployed. And this battalion, two years later, they were still in training because there was never any intent to deploy them into combat because there were no colored combat troops at that time in France fighting. They had some down in Italy at the time, but nothing in France. And so the Battle of Bulge was the largest defeat. It was not a defeat. It was intelligence there that we suffered in World War II. Oh my goodness. I need to interrupt because we're running out of time, but I can't wait for that book to come out. You've got to let me know when that is published. I know you've got a publisher, so congratulations. And I just want to end with a quote, a couple of quotes that you've said to me before. It's not where you start. It's where you finish. Success depends on fortitude, drive, ambition, and opportunity. Wonderful things to live by. And that's all the time we have, and I want to thank you, Peter, for being my special guest and thank our broadcast engineer, our floor manager, and Jay Fadal, our executive producer, and a special mahalo to our underwriters, and thank you all for joining us, audience. And my book can be found on peterbradwick.com. Thank you. Thank you, Peter. Books, books, books. We'll be back next month, and Peter, you were a wonderful guest. Thank you for having me. Appreciate it. Thank you. Good book. Goodbye. Goodbye. Thank you so much for watching Think Tech Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram, and LinkedIn, and donate to us at peterbradwick.com. Mahalo.


And now, an ignoble prize-favorite moment with Kees Mullerker. Let me do the duck talk. My favorite ignoble moment was when my then-10-year-old daughter Cezanne explained to an adult audience here at the Natural History Museum in Rotterdam why I had won the ignoble prize in the field of biology.  And it was unforgettable for me, too. The ignoble prizes honor achievements that make people laugh, then think. This historic ignoble-favorite moment video stars Kees Mullerker, ignoble biology prize winner for documenting homosexual necrophilia in the mallarduck. With a special guest appearance by Cezanne Mullerker, the 30th first annual ignoble prize ceremony will be webcast September 17, 2020. Details about the ignoble prizes can be found at www.improbable.com.


The most challenging part of building a product portfolio is really prioritizing what to include in the product portfolio. Like knowing what's important to include in a product portfolio, because there's just so much to learn as a PM. There are so many skills. There are so many key core competencies. How do you showcase your skills within constraint? Like within, let's say, like a short in a very concise form to potential hiring manager, because they have short attention span. They don't have time to to learn the entire life story of your career, right? What I found really helpful was, so I joined product manager accelerator by Dr. Naisli, which is, you know, your program. And one of the most useful module for me was when the product portfolio module, because it kind of refreshed my knowledge as a PM on some of the PM foundational thinking and PM foundational skills. And two is like, how do you structure your response for the product stands question, which is the product case question.


Welcome to Tickmill Weekly Market Outlook for week commencing the 27th of July with me Patrick Munley. Mountain tensions between the US and China have contributed to a halting in the risk-on rally but have equally failed to trigger any substantial correction as equities continue to treat geopolitics with a good dose of complacency. Coming week will likely test such approach as tensions may escalate to a point where the US trade the US-China trade deal appears jeopardized and bulls will know to be pinned some hopes and positive developments on the US fiscal stimulus front and on the ability of the Fed to once again prove market supportive. The dollar will remain tied to risk sentiment swings although more bad data will get us second quarter GDP figures this week along with the key jobless gains may put a lid on the ability to for risk to rally further. Also we have bipartisan talks around the next US fiscal stimulus bill and they're set to enter a pivotal phase. Republicans have delayed the announcement of their stimulus package till this week at the end of which the $600 payouts are set to expire. Some reports suggest the intention to bridge the existing payments so that they get reduced but not entirely cancelled. Although this could hold investors' nerves for a little longer the size and content of the timing of the stimulus package will be the key driver for market sentiment in the coming weeks. Turning to the Fed meeting, look for the Fed to remain a little interest in terms of the FMC to display any hawkish tilt in their message especially given fresh lockdown measures and concerning jobs data.  From a technical perspective the dollar index whilst we hold below 9496 resistance I'm looking for a move down to trust to test projected descending trend line support down to the 9250 area. The historic agreement on the EU recovery fund has helped the euro strengthen significantly. Moving ahead the notion of fresh solidarity within the union creates a positive environment for the euro to cash in on one more on the more dollar weakness with the latter likely to remain the driver of future upside for the pair. In this week's European calendar the second quarter growth numbers will take centre stage where a bad reach should still be mitigated by the price of recovery prospects after thanks to the European recovery fund. Along with the German EFO indicator which is expected to confirm the improvement and sentiment shown in the market PMI surveys which are released today inflation numbers will also be watched although the implications in monetary policy terms are still to be very limited. From the technical perspective as the euro holds above this 116 now I'm looking for a move to test the policy objective at the 118 area from there I've looked for a pullback profit taking pullback to retest 115 ascending trend line support. In terms of sterling no progress on the UK-EU trade negotiations is expected and with the news headlines suggesting an increased perceived probability of a no deal there's little to be optimistic about at this stage. It's very quiet week on the UK data front although sterling reaction to positive economic data has been fairly muted in the overriding importance of the UK-EU trade negotiations. Sterling price action in response to solid June retail sales and July PMIs have really proved that case really. From a technical perspective now looking for sterling as we hold above 127.50 I'm looking for a move to test the equality objective at 128.93 once we get into this area I'll be looking for a profit taking pullback to retest 127 as support. The yen appears to be gaining momentum as geopolitical tensions emerge and there are rally and risk assets seems to be stalling. In particular there looks to be some room for the yen to emerge as the most attractive safe haven option in the G10 in the current environment. Indeed the dollar has to deal with the combination of an unsupported data flow and set to get worse according to most economists in a dramatic virus situation which appear to have the potential to partly curb the benefits of risk off. The other safe haven in the swissie still be facing the negatives of improving sentiment in the eurozone. Should US China tensions continue to evolve in a worrying direction and in particular if trade concerns creep back into investors radars expect the yen to be the main beneficiary in short term. From a technical perspective whilst we hold resistance now at the 106.30 area I'm looking for a move down to test the major equality objective down towards the 104 handle. From there we could see a more significant profit taking move which would bring us back into retest the 106 from below. Finally in Australia the boost from the risk on rally and are still very relaxed Reserve Bank of Australia comments around the strength of the Aussie have now worn off. If market sentiment fails to show you another proof of extraordinary resilience this week the Aussie appears to be the most vulnerable to a downside corrections due to its highest correlation to the G10 effects to the Chinese one. Lingering virus emergency situations in Australia and a worse thing when covering outlook. Data wise inflation numbers for the second quarter will stand out. The risk of a negative year on year read appears quite material although the implications of the RBA monetary policy stance are not at this stage going to be impacted. From a technical perspective whilst we trade above the 70 70 level I'm now looking for a move to test the 72 85 from there I look for a profit taking pullback to test the 69 88 as support and that concludes the weekly market outlook for week commencing the 27th of July.


Welcome back to theCUBE's coverage here on location, AWS re-invent 2023. I'm John Furrier, your host. This is our 11th year covering AWS on the ground, on the floor. Start out as a small set, pulling people in from the hallways. Now it's packed house, 50 plus thousand, I think 60,000 people. Again, continuing to just thunder along, a lot of great announcements. This year, more than ever, has been the, I think the inflection point of generative AI and has bring that next gen cloud, next level legit, has been the conversation here. We've got a great guest here, Doug Bellin, worldwide head of smart manufacturing. AI's coming to theCUBE, theCUBEAI.com. Check it out. We've got the smart cube, we've got smart manufacturing. Doug, welcome to theCUBE. Thank you, thanks for the time and for inviting me over here. I did put a little plug in for theCUBEAI.com, which is our own little language model. We got 13 years of transcripts. We put vectors in and it gets us answers. But I mean, we're a small little use case, but the points to some of the things we were talking about before we came on camera, which is the big takeaway from this re-invent is the accumulation of all those years we've been talking about cloud and then you guys always had an industry focus, but this vertical industry focus around like say, manufacturing, healthcare, health sciences, fintech, they're the real winners in this generative AI boom because the gift of generative AI is the role of data becomes really more valuable and the more specialized the data, the better it can work across other data sets to actually produce better results. It's kind of nuanced, but it's the big theme here at re-invent, what's your takeaway right now? As we get down to things like smart manufacturing, is that inflection point here? Did we have it already? Is it coming? Where do you see this? It's coming. I don't think it's here yet. We haven't had it yet, especially manufacturing. I think manufacturing's an incredibly interesting market in here and I think a couple of reasons. One, manufacturing is the largest producer of data and most people don't think about that. They think, no, it's financial service, it's media and other things from that standpoint but it's an incredibly large amount of data but it's locked down, it's disparate, it doesn't talk to each other, it spews off numbers that a human being has no clue what it means from that standpoint and while we're the largest consumer or the producer of that data, we're the smallest consumer of that data. So there's a huge opportunity for us to actually start using that data, creating value in this market. And I've been on the company for six years, six and a half years and it has been that evolution of starting with first cloud and manufacturing being miles away from each other and every manufacturer going, I'm never going to do that. To now they're going, why am I not doing that? Help me accelerate and get into here faster as we go forward. It's interesting, and I was at a CUBE event when we were talking about regulation, regulated industries. Actually, Generative AI is perfectly set up for regulatory industry because the data's been so managed well. It's kind of labeled, it's got compliance. So a lot of low hanging fruit opportunities are in these industries that have had compliance and operating technology of the old school and IT kind of came together. We saw that collision, that kind of help happen. Now you've got cloud and data bringing together on manufacturing. How is that going to actually change the developer experience? Because, okay, now you have new ways to do things. What is, I guess I'll back up and say, what do you see as the key low hanging fruit for manufacturing to kind of go that next level? It's got a lot of data laying around. You got developer apps being built. What's the low hanging fruit? I think there's a couple things. One, we're seeing the evolution of the citizen developer. In the past, it was always a data scientist or something from that standpoint that first had to do data wrangling. How do I get to data? How do I make sense of that data? How do I understand what's going on? Second was, okay, now that I have that, how does it affect the business? Because a data scientist might understand the data, but the business is where the value starts to go. So how do you blend together that data scientist with the business person or make it easier for the end user to become a data scientist light like type of person from that standpoint? And if you look at some of the partner offerings out there, we've got a great partnership with a Siemens division called Mendix, which is low code, no code. And what they're able to do is allow a person on the shop floor to make an application. Now in the past, guys on the shop floor would be like going, I just need to use the application, but now they're not waiting for the person to bring it to them. So they're looking and going, let me just build this right now because I know where the data is. I know what I need to do from that standpoint. Yeah, and I think that's a great example of kind of this next generation that I call the genu. You're in charge. It's almost like this whole enablement of, democratization, I love that word, it's been overused, but it truly is democratizing in the sense of if someone could build their own app. But now, if you're back and say, okay, how do you get there? Like, if you look at manufacturing FinTech and just any kind of incumbent legacy environment, it's got a lot of components. And you're moving from that components and engineering. I got to send a request in. I got to get a developer to a more that an environment is driving productivity, okay, with simplicity and composability. Yep. Okay, that is an architectural shift. So okay, so assume the end state is low code, no code, build an app. I want to be more productive. It's got to be simple and composable. Yep. Okay, that's the here. What's behind that? What has to happen? Because it's not easy when you think, okay, where's the data coming from? Can I get accounting data? Where is the data? And that's the hard part a lot of times is understanding where the data is, understanding, like I said earlier, what the data means. You know, if you think about a manufacturing facility, there's 10, 15 vendors in there. You've got your Siemens, your Rockwells, your Honeywells, your Emersons. All of them have different languages. But on a single line, you may have a machine by vendor A, B, C, D, E, and F.  Hopefully it's no longer running DOS, but some of them are, which is also pretty scary. But now you've got, each one also probably has its own database. And what manufacturing has been good at is looking at each individual cell and fine tuning it to beyond Mth degree. Now, how do you look across the line? How do you look across the facility and then extend that to your supply chain? And you've got these disparate data sets. Great, okay, how do I get the data off of there? So with- You have to unify them. You have to unify them. You have to make sure that the same languages are there. You have to make sure it's human readable. The context is there. So in April, we launched a program called the Industrial Data Fabric, which is both AWS and partners. And it does, how do I collect the data? How do I contextualize the data? Normalize the data? And then even start to build a data model. Now, that is going to allow you then to have that citizen developer or gen-U, I love that comment, the gen-U of you make it now from that sample. You are in charge. As long as they have the security to get to that data. We're copyrighting that, by the way. Gen-U is the cube word. That's not what you can do for your cloud. But what it can do for you is what it will be what it is. And it is going to be down that level where they can get to that data. Again, security is going to be paramount. Do you have rights to get to the data? Rights to see what's going on with it? And then start to ask the different questions. And it's always been the problem many times is you get to a certain point in a question. You can't ask the next question. Now you have, not going to say you have access to everything, but you're getting better access. But no, but you're going to have, you're bringing up a good point. We brought this up in the cube again earlier on Monday. The words are changing with Gen-U AI. And it's almost interesting. It's almost words that we used to know and love. Words like memory, latency, actually have meaning on the data side. Latency to getting the right answer faster or that next progression, whether it's a words being spit out from a language model or a creative action on the move the next step on a solution that's being generated. Memory, retrieval, augmentation generation. Did I get the right response? Does it have hallucinations? Not physical memory, but that's good for storage too. There's even latency in the process. So think about a person standing there and if you've in your auto ever get an error message up and it is like a 12 digit number that means nothing to the human being. Is that like a hex message? What is this, a core dump? Right now.  I just saw these three things happen. That means in the near future this is going to be an issue. Wait a minute. One, the machine's talking to me. That's pretty cool. Two, it's not giving me a hexadecimal message. That means a zero to me. And historically what you did was you basically went off to the air conditioned room. You found the right file, which was 500 pages long. You had to go through that for about an hour and a half and find the one paragraph that you were looking for. Now that's right like that. So if that's a quality issue, or if that's the machine that's going to break in an hour or six hours, you just stop that. Yeah, and I think that you're pointing to exactly why generous, so powerful why it's going to change the expectation of what happens at that end point of the user experience is going to be changed. For example, that outcome is saving time, reducing the step takes to do something, and it's easy. These are major simple concepts that are winning for most for success. Okay, so let's take unpack that. The data's got to be there, right? So okay, we're seeing you guys do things like Health Lake, Security Lake. Are you going to have a manufacturing lake? So I'm a big fan of Data Lake. Never really liked the word Data Lake. I like the word Data Ocean because a lot of things are moving around, and currents and things are more different, but Data Lakes can be good if they're done properly. So what does the Data Lake concept look like, whether it's centralized to enable the intelligent fabric or whatever it would just, industrial data fabric. The industrial data fabric. What does that concept look like? What should be the principles of a good hygiene oriented Data Lake? The end point or the target for industrial data fabric is a Data Lake. Now, do we need to build a custom Data Lake for manufacturing potentially with you, but it's more use case driven? It's customer driven. It's customer driven. So instead of saying, okay, now how am I going to format this Data Lake for use particular because every business, so am I first, am I discreet manufacturing, process manufacturing? Am I regulated or unregulated? And all of the different permutations. And, or can I actually make it to a point where because we're doing with industrial data fabric, we're building that contextualization. We're building the data models into it. We're building the capability now that I could say, what application are you looking for? Oh, you're looking for a quality application to understand what is happening on the product. Guess what? That now attaches right to that data fabric, sitting on a Data Lake, and we can make it happen very quickly.  And one of the things I like about general AI and the models, large language models and the concept of a context window. Very token oriented, very in the weeds, but like the point is, what's the window that you can ingest in to the AI? Now that's increasing from a token perspective. I think Anthropics is bigger than OpenAI at this point. But that's the constraint there. Okay, so, okay, now from the customer standpoint, that means what data is being fed into the fabric? Into the system. That's context. The behavior is the manufacturing. So we're kind of back down to the contextual, behavioral paradigm of a search, I guess. I mean, like, this is a data search retrieval problem or is that the architecture? Part of it is a little bit with that. I mean, but also part of it just has to do with making sure that the languages are the same. Like I said, every vendor has their own language. And, you know, we all use Babelfish or something like that to do translations when we're on a phone call trying to talk to somebody. We need that type of thing. GenAI is going to allow us to very quickly build that. There's, you know, do we need an LLM for industrial? Not sure yet, but I think there's going to be some segments of that. Take PLC ladder logic. Who codes ladder logic nowadays? But wouldn't it be awesome to be able to say, make that robot do these three things, and you kind of walk away and you come back and you look, well, wait, that'll work. Let's test it. I mean, we have an opinion on this. We think, and we published this research on theCUBE research. We have published the power law of AI, which is just a simple power law.  If the customer sees data that's valuable, they're going to want to build some sort of model around that and leverage it as either as context input or into the process. So again, back full circle to why you're here is, people are really trying to figure out, Doug, how do I start re-architecting my system, whether it's rewriting code or throwing stuff away or rebuilding to enable, like the security business enabled, developers to be in line shifting left and doing it properly with governance built in and security built in. There's one thing that I would probably say, which is different in my mind and different in how I talk to customers is a lot of these statements or records, these source systems that are out there, that machine that is sitting there with his proprietary database, I don't want to rip that out because if I touch that, it's going to break everything. But, and it's so expensive, I mean, you look at a facility, it's how many billions of dollars to build a factory. They're not going to just go, hey, Doug, you know, that's a pretty cool idea, give me another billion and a half to redo it. So how do we take those 10 and 20 year old data sources, which are statements of record, but then you're building a layer on top and within it from there. But we're also looking at it in the long term where it's not just what I would call northbound. How do I get the data into the data lake, but is there a prescriptive way that the data lake can actually start to write back as well. So now you've got, you know, this is the mega version of that autonomous factory. You know, the autonomous factory is self-healing, self-generating, self-normalizing as you start to move forward. And to be able to get to that standpoint, you have to have those insights, you have to understand what's going, you have to bring that back, and then the machine starts to. That's the data unification piece. You're essentially not going to throw away the old leverage it and have mechanisms to figure out how to get that into the model to compose new stuff. That's the new, that's the first phase. That's the models. How do I first get the data? Again, that's where industrial data fabric is helping with us with that standpoint. Getting it so a human being can understand it, right? Part of it is that. I go back to that all the time from there. But part of it as well is, you know, right now there's the great surveys from a lot of our analysts talking about pilot purgatory. I go out there and I can do predictive maintenance on one machine really well. End of sentence, right? I stop there on purpose, right? But a factory has hundreds of machines. Well, the theme of this show has been end to end, right? So that's the ultimate end to end is factory, right? So I guess the final question is, what is a smart factory in your mind today? And how does that evolve? Okay, assuming that the architecture people start rethinking, reimagining, reinventing, the data piece of it, which you just laid out, what is smart manufacturing today and how does that evolve? It's more towards the self-healing, self-normalizing from that standpoint.  It is the machine doing it from that standpoint. It's the human being, though, giving that input of the, because the cognizant standpoint of a human being is completely different and AI can't do a lot of that and probably won't be able to, at least in my lifetime. So I don't like the personless facility, but the autonomous is much better because the person is still in the loop. The person is still in the capability to be able to have that capable offering as we go forward. Human capital, Swami said that on his keynote, is a huge part of the scaling, the data in our heads, by the way, we have data there, too. Gotta get that in the fabric. Yep, thanks for coming on, great conversation. All righty, thank you. Great, smart manufacturing is just another example of how Generative AI is going to move closer to the edge and the customer, where the data is different and important, but super valuable for that use case and application while leveraging the cloud scale. This is kind of the paradigm. We've been talking about in theCUBE for years, horizontally scalable, vertically specialized, kind of all working together. This is what Generative is going to enable. And we'll be back with more CUBE as we get content coming to you later today from that location. We'll be right back, back to the studio.