Hey, everyone. Just a quick announcement. If you are not here for the root to root list, you can bail now. I think the .NET track is next door. There seem to be some room confusion, probably my fault. Track says container. So this is the container track and the root to root list. Are we good to go? Or should we wait a little longer? All right. Then let's go. So I've got to give this FireExit announcement first. You read this. I actually saw a note here. It says, you only have to give this announcement if there are 49 people or more. And I thought, that's great. That's a win, win. Either I do have to give the announcement or I'm in the big leagues. So I feel like looking around, I'm going to leave this up for a second. My name is William Martin. I work for Pivotal London. If you looked at the schedule, you might get kind of confused because you might look at this and say, wow, that William Martin guy, he's giving four sessions. And it turns out that I'm not the only William Martin at Pivotal, and I'm not the only William Martin at Pivotal giving talks here, which is totally outrageous because I joined Pivotal first. But there's another William Martin here. He's giving a few talks on .NET. And you should definitely go to those. I work on The Garden Project, which provides containers to the Cloud Foundry platform to concourse CI and to Bosch Lite. You can get me on Twitter at WLA Martin or GitHub William Martin. Or if you want to chat after come find me, we can talk containers to Cloud Foundry. Oh, sounds good. So this is The Root to Root List. And I just want to lay down one grand rule. I heard some murmuring outside. And I know that American and English, slightly different dialect from English to English. But every good talk starts with a good title. And this one is going to be The Root to Root List. I don't want to hear anything else. While I was preparing this talk, I realized that my co-engineer, Ed King, out there, he's been on the team for a long time with me. And sometimes he goes by Ted. And I go by Will. And it's taken me two years to realize this. But I thought I could pitch this alternate talk title, Bill and Ted's Root List Adventure. But I didn't think this would inspire a lot of confidence in Garden and me as the speaker. So we're doing The Root to Root List. What does this talk about? Well, containers are great. And they're a really good way to secure applications and to isolate them. But there has historically been some concerns about the piece of software that orchestrates the container lifecycle, so creation, running processes, deletion, et cetera. So the Docker daemon, or in our case, the Garden server. And the reason for that is that typically they've had to run with privileged super user Root in Linux. And that's really a bad practice. That is against Linux best practices. Because if we have a vulnerability and we get exploited, well, immediately the attacker has root to the system. So that's pretty bad. So what I'd like you to take away from this talk is really three things. One, what are the pieces that make up a container in Linux? How are those being facilitated now in an unprivileged or rootless manner? And how Garden is utilizing some of that to make the platform more secure? So let's start with a high-level problem statement. What security problem is Garden solving for Cloud Foundry right now? Well, the problem for Cloud Foundry, security-wise, is it's public. So you don't really know anything about your users who are running software on the platform. It's multi-tenant. So you could have malicious actors running alongside everyone else. And it can run Docker workloads if you've enabled the Docker feature flag. And that's painful because you could put almost anything in a Docker container in a Docker image. And all that together leaves me with a profound sense of distrust for running things. In fact, when I was putting the slide together, I was like, oh my god, what are we even doing here? But how do we solve that right now? How are we dealing with this security issue? Well, containers. So what is a container? Or more specifically, let's say, what isn't a container? This is my Kaiser Soze quote. The greatest trick containers ever pulled was convincing the world they exist. Containers in Linux are not really a thing.  And so I like to think of a container more as a contract, which I've laid out here. And a container runtime should satisfy this contract. So we're talking confinement. So containers should have their own view of system resources. They should also fairly share those resources with other processes. And they should be unable to modify those first two constraints. And then from a dependency management point of view, in the container, it should be able to have whatever dependencies it needs, regardless of the host that it's running on. But then on the host, and this is kind of slightly controversial, but if you've been to Dr. Jules's talk earlier, he mentions the difference between Linux containers and containers as they're well-known. Because a few years ago, a little company called Docker came along, and they figured out how to transfer, to how to ship and store dependencies in a performant and efficient manner. And so we'll get on to that as well. So let's do it with a first bit confinement. How do we achieve that? Well, we've got this thing called Linux namespaces. So there are a set of global resources in Linux, things like network devices, mount points, that kind of stuff. And namespaces allow you to rep these resources, such that processes appear, or believe that they have their own isolated set of those resources. And this is just some of the, not just some, these are the seven namespaces that are available in Linux right now. And I'm just going to call out the username space specifically here, because it's going to become really important later when we talk about doing stuff unprivileged. Username spaces allow you to act as an unprivileged user in one namespace, and then child username space act as a privileged user. And we'll get on to what that really means later. We talked about fair sharing. And this is really satisfied in two ways. A garden, we've got control groups or C groups. And they deal with things like, if Linux namespaces deal with what a process can sort of see, C groups deal with what a process can really use. So things like memory limits, or a disk throughput. Also things like CPU scheduling. So with those, and then with disk quotas, so ensuring that processes can't write so much to a disk that other processes are unable to, we start to deal with this sort of fair sharing. And disk quotas I'm going to get on to quite a lot later, because it's been a bit of a pain point for us. So if those two Linux namespaces and control groups were dealing with the first two bullet points, so isolated set of resources and fair share, we can now start to talk about how we make it so that processes are unable to modify those constraints. Now, the namespaces and the C groups sort of overlap here with these next three slides. Because, as I said, containers aren't really a thing in Linux. They've just got all these edges that overlap. But here's an important one, dropping capabilities. So historically, processes could run as privileged user or not. And now, over time, the kernel has started to split these up into capabilities, which can be independently toggled. And to give you a flavor or taste of what these are kind of like, if you ever see cap underscore, you know what I'm talking about, Linux capabilities, we've got things like cap set UID to change UID, or cap sys admin, which unfortunately is sort of in Linux world becoming pseudo root. But it's certainly a better world than one distinct toggle. We've got set comp, secure computing mode. This is a kernel technology that allows you to limit system calls available to processes or flags on those system calls. So for example, in garden containers, although they can do the clone syscall, which they need to create new processes, they cannot create new namespaces because we limit the flags that are available on that system call. We've got app armor, which is mandatory access control.  And this is sort of defined as a text file with rules like deny under the process file system, read write or execute to sysrq trigger. And so app armor provides a way to once again limit privileges.  And that's true. We do defend things in multiple ways. And that's because we sort of have this aspiration, which is to be the most secure container provider out of the box. Now, I'm not saying this is the truth. I would never claim that. But this is an aspiration. This is a goal for garden.  And we like to believe that operators should have to explicitly take action to reduce their security rather than toggling levers to ensure they get the right security. And in fact, in practice, this has been demonstrated in a few ways. I just pulled out some CVs in the container world from the last year and a half or so. And for example, the one in the middle, we've got username spaces and app armor that prevented the SCSI mic drop vulnerability, which is great because some people who were running Docker containers who didn't have username spaces by default didn't have app armor turned on, found that, well, with this vulnerability, you could just disconnect the hard disk. So what we find is, in practice, most of the CVs that come out, we've got multiple layers of the onion protecting. That's really important. So moving on, we did confinement. Let's talk dependency management. So in the container, we manage this via the system call called pivot root. And on the host, you could talk about layered file systems. So how does pivot root work? This is a system call that allows you to change what a process sees in slash, at its root directory. And it works very simply, something like this. We've got a process called run shoe. And it says, oh, what's in slash? And the files that come back are boring, boring host Ubuntu files. And then it can run pivot root, just passing in this new directory, basically. And that's all it needs to be, is really a directory and top of a file system tree. And with that in mind, when it asks what is in slash, it's going to get this cool container busybox file system. And so that's how we enable, in container land, if you think about maybe Docker images, which often start with a directive like from Ubuntu or from Alpine, you can run these on any host. But at the end of the day, you get that distributions, dependencies in your root file system. Finally, we've got layered file systems. So quick segue here into how they came about. Got your process run shoe, that's what we name things. And it's got some operating system specific dependencies. Well, one way we can deal with this sort of packaging of dependencies is to wrap it all up as a virtual machine image. So an AMI or a VMDK, something like that. And that's cool that works. But it's got some drawbacks. For example, virtual machine startup historically has been a little slow. But a bigger problem really is there's a kind of duplication that can happen here. So if you've got a web server that relies on Ubuntu and a database that relies on Ubuntu, and you package them as images, well, you end up having that entire Ubuntu distribution twice. And these end up being sort of multi-gigabyte files or can be anyway. So we can be smarter than that. And this is a thing that really Docker popularized with layered file systems.  Don't get me wrong. But Docker really popularized this. And how this works is that you can have a single directory containing your Ubuntu distribution treated as read-only. And then use some copy on write file systems to layer other directories on top. So for example, you can have your single directory which contains Ubuntu, and then a directory which contains your dependencies for your database, and one that contains for your web server. And then all you do is, through some special mounting, just apply deltas on top of Ubuntu. And so you only need to transfer that around once and to store it once. So quick segue here again. Enter Run C. So I just wanted to talk about this for a bit. We don't do a lot of this work in garden. This really comes from Run C, which is a CLI tool, came out of the open container initiative. And it really does a lot of the heavy container lifting. Really the only thing I'd say it doesn't do from that list is that the layered file system stuff, which we manage in a tool called GridFS. It's used by Docker and Kubernetes, and we wrap it up and just make use of that. And that's really important because we build on the work of a lot of really good work from a lot of really good people. So everything is secure inside a Cloud Foundry container, right? Well, yes, or hopefully. Seems to be playing out that way right now. But if you weren't Dr. Jules's talk earlier, you might have seen this analogy. I think it's great. If you've got this door, which looks pretty secure to me, and you kind of treat it as if it's the container, you're trying to exploit the system, and you run, you barge against it, and you don't get anywhere. You start thinking, well, what else can I do to get through this door? And you look at the wall, and you know if this glass jug of Kool-Aid could smash through that wall, well, you need to work on your security. So again, we have this aspiration, which is to be the most secure container provider out of the box, right? And we've done a lot of work on securing the containers themselves, but now we need to start thinking about the piece that orchestrates it, the garden server. So that brings me onto the real purposes of this talk, which is the route to rootless. So when I was putting these slides together last night, I was looking at this image, and I was thinking, wow, it's got some twists and turns, but it looks pretty straightforward, and really the route to rootless has felt a little bit more like this at times. You know, it's had its stops and starts, it's had its troubles, but hopefully I'm gonna explain how we got over some of those things in the next sort of 15 minutes. Before we get into that, some really important shout-outs. These are people in the container community that have really spearheaded the rootless work, moving to unprivileged. We've got Jessie Vazel. I think she works at Microsoft now. Alexis Sarai, he really, really did a lot of work at allowing Run-C to run unprivileged. That's been super important, and hopefully I say his name right, Ake Hirosuda. He's been doing a lot of this work in Container-D. I just wanted to call that out because we're likely, if you went to the garden update talk, you see we're making some moves to use Container-D in garden. And there are many more people, of course, who are kernel maintainers, et cetera. But I think it's really important to call them out. You can look up their work, but also because if we didn't have them, our journey would have ended pretty quickly. It would feel a lot more like this. So let's look back at our contract. What is a container? Well, we've got confinement and dependency management. So let's deal with the first bit. Unprivileged username spaces. I said I'd come back to username spaces earlier, and these are really key to a lot of this work. So since Linux 3.8, you've been able to create new username spaces as an unprivileged user. And the key thing to know about this is that every other name space, so the isolation mechanism for processes, has an owning username space. So in all the initial username spaces, or sorry, in all the initial name spaces, they are owned by the initial username space. But as an unprivileged user, you can create a new username space where you have privilege. And once you have that privilege, you can create the rest of the namespaces. And then if you were to do a privilege operation on one of those namespaces, so for example, maybe a mount call, the kernel will check against that mount namespace, find the owning username space, and see whether you have privilege. And so once you've got privilege in your username space, you can do all the other namespaces, you can do set comp, and you can do app armor. So how do username spaces really work? Well, users are living a sort of double life. So in the host, you are boring lame Edward Norton from Fight Club, but in the container, you can be cool sexy Brad Pitt from Fight Club. And how this works is that you specify some UID mappings from the outer username space to the inner child username space. And these files exist per process, proc self UID map and GID map. And there are triples of UIDs, inner ID and outer ID, and then a range how many user IDs you want to map in that username space. So I pulled one of these mappings off a rootless deployment of garden. And to read this, you can see we got a zero, which is in the container ID zero, is actually the initial username space, Maximus. So the max UID possible. So as this unprivileged Maximus user inside the username space, you are privileged. And we only map that one ID. But in garden, it is important that we have the ability to have many user IDs in the namespace. So we also map everything from above 65,000 to Maximus minus 65,000. Why do we not do those bottom 65,000?  So we try not to map those users in at all. So that was username spaces. But what about unprivileged username spaces? By default, you can only map yourself, your own ID into a username space as an unprivileged user. And this sort of makes sense because you shouldn't be able to become any other user anyway. But there are these two binaries, new ID map and new GID map, they exist in the shadow package, and they are set UID. So what is set UID mean? Set UID means if you execute this binary, or execute this thing, you will change user to whoever owns this file. So if these binaries are owned by root and you execute it as an unprivileged user, you will change your user to root and you will gain all the privileges that come with that. But importantly, this is really the key bit, mappings are validated by these tools against an Etsy sub UID file, which is only writable by root. And so that allows root to decide what unprivileged users should be able to map. We PR support or the initial version of support to run C for this. And that's now in there, we're using it fine. So more confinement stuff, but thinking about fair sharing. So there's no way to do C groups entirely unprivileged yet. And that's because they're really just a file system. And whenever you have that file system, you mount the file system and all the files are owned by root. But we need to be able to change these files as unprivileged users. So during a setup phase in the garden server, we can show them these because we will be privileged at that point before spawning our demon as an unprivileged user. I'll get onto why that's not great, but okay later. And again, we PR support for unprivileged C groups to run C. Dependency management in the container, real simple. Username space gives us this capability, capsis admin, and that allows us to do the mand operations required by pivot root. And then the dependency management piece, this has been a little harder. So by, you know, historically garden had its root file system management built in in a library called garden shed. And the overlay mounting was done using AUFS, but it's not possible unprivileged. Can't even, you know, there's no chance. It doesn't work. So what we did was we thought that was a good seam and separated plug-in interface. And that ended up being this thing called GRUDFS. And GRUDFS, initial version, use better FS snapshots to do these layer file systems. We could do an initial setup as privileged and then at runtime, everything could be done unprivileged. Snapshots are finding better FS unprivileged. But unfortunately what we found was that the disk quota is didn't scale very well and everything eventually blew up. So we went back to the drawing board and we found out overlay FS. So there's a key thing here, it's an unfortunate restriction. Ubuntu in conversation with the overlay FS maintainer decided that it was acceptable to do overlay FS operations as an unprivileged user, that it was not a security risk. And so on the Ubuntu distribution compiled into the kernel is a flag which says this is fine, you can do operations on overlay FS as an unprivileged user. So that kind of unfortunately right now ties us to Ubuntu if you want to work rootless. But seems to be working, so that's good. Now how do we do that then? How do we take advantage of this unprivileged mounting? Well I pulled out a snippet here from a configuration file. So RunC expects a JSON file that conforms to the OCI runtime specification. And in there there is a section called mounts, which RunC will perform once it's moved into the right namespaces. So we can request instead of us doing all the overlay mounting in our initial user and mount namespace and then telling RunC here use this path, use this directory, we can ask RunC to do it all. And we can see here we've got a whole bunch of, we've got a source and type of overlay, a whole bunch of options which tell the overlay which directory is to mount and where. And then we've got a destination, which says just mount it all at slash, which will be the root file system for the container. So what are the roadblocks right now to being fully unprivileged? Well, this quotas for one, better if I handled this, but unfortunately blew up. So we had to use XFS, another file system and it requires privilege, there's no way around that right now. So again we pulled out a small focused set UID binary that just focuses on this quotas. A big part of containers that are still requiring a lot of privileges networking. And again this used to be integrated into garden and for reasons, not security related, but for container to container networking, we also pulled out a seam here. And another team created this thing called the Garden External Networker. But actually in the end that's been really useful for us because we can just make that piece set UID or set cap, they might have done set cap, which is just instead of changing UID you can gain a certain number of capabilities when you execute a file. But there is some really good work going into this from Alexa Nakahiro, who I've seen have done, have some proof of concepts of networking running unprivileged. So there's hope here. And then there's the garden setup phase. So I said we had to show in the secret file system and we do, but it's sort of okay because it happens before there's any user input possible and before any workload runs in Cloud Foundry. I did see at least one attempt on the kernel mailing list by Alexa to fix this, but no luck yet from the maintainers. So there are a few things which we'd like to fix. We're not there yet, but don't worry, be happy. And this morning I thought, oh, this would be a good place to have an image. So I Googled, don't worry, be happy. And one of the first hits was this and this is terrifying. This does not make me feel happy at all. But it is, it is pretty cool. So don't worry, be happy because really we're playing the long game here.  We want to reduce privilege where we can and when we can because something's take time, but that's actually okay because proving them out from a functionality and a security point of view is important. And one way we found to do that is by breaking apart sort of monoliths and both of these cases for file system management and for networking, we were, we had libraries embedded into garden. We pull those out into plugins. It's really important that we share these technologies with the community. Like I said, I can not overstate how important RunC has been to achieving this goal. Historically, we didn't use RunC. It wasn't a thing before the open container initiative came about and all our containerization code was written in-house, this thing called Garden Linux. And I cannot imagine doing this piece of work on that code base now. So the community's given a lot to us and it's important that we give back and hopefully when as we move to container D we're going to be able to continue doing that. So take heart because things are getting better. So does it work? I wish I could say, yes, it definitely works. But all I can say right now is hopefully it does pass Cloud Foundry acceptance tests in the default deployment and that's great. And hopefully it's gonna go out on pivotal web services soon so it'll get some real production traffic. How can you try it? Well, Bosch is the way we deploy Cloud Foundry in Garden and there is a flag you can set, experimental rootless mode and that's it. That's the only thing you need to change. We also have a standalone binary just for playing about with that you can get on GitHub. And we've stood that up on, we've grabbed that, stood up on Ubuntu virtual machine and RunGarden as the Ubuntu user and it's worked fine. So I'm optimistic. So that's actually the end. So thank you for listening. Although one more thing, if you found this interesting and you like containers, then you should come to the next talk which is in here or maybe next door, I'm not actually sure now, by Dr. Jules who's sitting over there where he talks about why you absolutely shouldn't care about containers at all. So that'll be a really good talk, I've seen the preview. I do have some time for questions I think and I definitely have my colleagues in the room that I can shunt them to if I don't know the answer. So any questions? Yes, okay, sure. So the question is what's the relationship between Grud FS and Overlay FS? So I'll tell you what, Grud FS is terribly named, horribly named and I'm entirely responsible for that. I think I recommended it on Slack and Jules just ran with it because he loves terrible names. So Grud FS does a lot more than Overlay FS in that it's sort of built on top. So whenever Garden or Diego or Concourse requests a container from Garden, it will pass, it'll request an image, could be a Docker image or it could just be a, it requests the container to be created with a particular root file system which could be a Docker image or it could just be a tar file. And let's say it's a Docker image, Grud FS will go off to whatever registry and pull the manifest for that image and then look at that manifest and download all the file system layers that are referenced within that manifest. Once it's got that, it changes depending on whether you're running rootful or rootless. If you're running with root, then Grud FS will take those layers and do an overlay mount. So it'll take all the layers and do a mount syscall with the operations that you sort of saw, where is it, here. It's like passing this lower directory is an upper year and at the end what you'll have is a directory, moded by overlay, which acts as the root file system. Okay, if you're running rootless, then what Grud FS will do is produce the JSON that you see here and pass that back to Garden and Garden will embed that within Runcs configuration file. So Grud FS really does sort of a whole bunch of image management stuff, overlays just the bit that will take the directories and layer them on top of each other. Does that answer your question? Yeah. Okay. Anything else? All right, that was enough time. So thank you very much.


What's going on everyone? Sam here with latent sports cards, ripping 22 at Canadian Flawless Baseball. Hobby, one box break, number 14. I forgot to change it, that is number 14. Here's a look again at your results. As always, you can find these on the website under the results tab as well as the link in chat. So they're posted just like this to the website as they came out of the randomizer. I personally will be sorting them one through 25 so it makes it easier to find who's got what. So let's get started. She found the note in the first package you open. All right, the funny story with that is Sean, like during one of the, the, when we were starting a break, he's like, I wanted to put happy, like happy fourth birthday, you big baby, but I don't want people in sorting and shipping to be like mad at me for saying that to a four year old. That was bad dude, so funny. 10 box Tuesdays sold out for football. I think both 10 box Tuesdays are not sold out. Good luck here, everybody. No one needs to stay in their collection with it. Do some Flawless. Bunch of children. Oh yeah. Yeah. If you haven't learned that by now, Kyle, do it better. Bunch of children you're dealing with here. Top TikTok as well. Dude, this is, that's a great case, man. What is up? Is that Paul or Pete, right? Yeah, it's up Pete. Yeah, these are all group breaks up until about 12, 12 a.m. Eastern time. These will all be group breaks. All right, starting off with the 15 spot 15 of 15 Gabriel Moreno on the four way patch right there. That is 15 spot is Keith on R. Oh, 100% Jeremy. We're talking about doing like a money in the bank cage match with an actual like sealed case of Flawless at the top. There's Alex Rodriguez, nine of 10 on the three colored patch. Nice one there going to the nine spot that is Mark K. What's up, SG? SG. That game used? Game used. A-Rod. Next up, we've got going to the 21 spot, Ryan Valet or Rookie Otto. 21 spot is going to be Keith on R. A-Rod, yeah, A-Rod, another Hall of Fame snub. So is Ryan Valet, another Hall of Fame snub. We've got going to the 14 spot that is going to be James H. How about a dual Gavin Sheets and Andrew Vaughn patch autos. Nice one there. So that's Rookie Sheets and second year Vaughn. Very nice. Make it a viewer match, make them pay to enter. Yeah, pay a pay-per-view. Pay-per-view money in the late in money in the bank ring. That'd be awesome. This is sick, dude. This is going to the four spot, four of 25 Eric Chavez for the A's. Four spot is going to be Corey B. What's up, Ken? That is Game Worn Chavez. That's sick. What's up, God? We've got going to the 12 spot. 12 of 15 is going to be Jose Reyes. Nice Mets hit right there. I know Kyle liked that one. 12 spot, Keith on R. Yeah, your wife wants to chop this card or second. Are you guys A's fans? Buttermilk? Yeah, right. Honestly, you're Mars. Eat, sleep, break, repeat. You know it, SG. Jeremy, what's it called? Donnie's a Eagles fan as well. Yeah. Got three of 15. Nice one there. Hunter Green on the RPA. Nice one there. That is four color. Two shades of white right there. Nice one there. That is three spot. Is Jeff M. Congrats, Jeff. Yeah, I agree, God. These are so awesome, man. Oh, your Cubs fan. She's an A. Who's her favorite player, then? And really cool one here is going to be going to the 10 spot. 10 of 10. Chad R. We've got Jose of Ryu. Fourth Chicago player to win MVP. I know it's Elgato Reyes, Belchran, honestly. Oh, Barry Zito. Oh, yeah. Barry Zito. Absolute stud for both the Bay Area teams, honestly. He's played for the A's and the Giants, so he's a Bay Area legend for sure. All right. First card with the Diamond Guarantee is going to be Diamond, numbered 10 of 20. Royce Lewis going back to Chad R. Chad R with back-to-back cards. Congrats, buddy. Nice. Noice Royce. Noice Royce. Oh, that's going to start. That's definitely going to start. Noice Royce. Yeah, true. Just wait till tomorrow, man.  Everyone's going to be leaving the stream. Thank you for the lots of encouragement. Oh, yeah, absolutely. Dude, this one is so nasty. Jesus. Flawless moments going to Jeremy Q at the 11 spot. How about a Mariana Rivera? Boom. Enter Sandman. 53 saves in 2004. Let's go, man. That is so sick. Congrats to Jeremy Q at the 11 spot. Nice mo. LaytonSportsCards.com, God. LaytonSportsCards.com. So sick, dude. So, so sick. Yeah, Q the music is right.  Yeah, perfect Mariano Sigg as well. Awesome. So cool, man. That will do it for the break. Thank you guys again for the fill. Next up, I believe we have, I don't want to say, so good luck.


Hello and welcome everyone. Thanks for joining us today. We're excited to have you on. During today's webcast we will be going over our latest release 11.2 where we have lots of exciting new features. My name is Agnes and I work on the marketing programs team here at Good Lab. I'm joining you from San Jose California today. We'd love to hear where everyone is tuning in from so if you feel so inclined please use the chat function to tell us where you are in the world. Also joining us this morning is James Ramsey from our product team, Antonio Mimo from Field Sales and our presenter Simon Williams our account manager. We're going to give people just a couple more minutes to get locked on. While we're waiting I'm going to launch a poll you can take part in if you'd like. The graphic on the next slide may be useful as you think through your answer for the first poll question. Great thanks to everyone who participated in the poll. Before we get started I'm going to cover a couple of housekeeping items. First feel free to ask questions throughout the presentation. You can use the Q&A function at the bottom of your screen for that. We'll have dedicated time for questions at the end of the presentation and demo but you can go ahead and send in your questions as you think of them and we'll make sure we get to them at the end. If you're experiencing any technical difficulties you can use the chat function to get in touch with the moderator for help. Now I'm going to turn it over to Simon to talk about the results. Thank you Agnes and welcome everyone to our first release radar webcast for the EMEA region. I'm just going to go through the poll results quickly so thank you everyone for taking part. It looks like we've got a really good spread of people using different parts of GitLab. Quite a few of you are using the create part which is the traditional version control piece and we've got a couple of people on the webcast as well who aren't currently using GitLab so hopefully we'll give you some good overview today of what you can achieve with GitLab but if you do want any more information at all please feel free to reach out to us at the end of the webcast and we'll do our best to help you. Before James presents the demo to you I did just want to set the scene for what he will show you and talk a little bit more about what we've done with 11.2. So as you know or as you may not know if you're new to GitLab, GitLab enables concurrent DevOps by providing a single application for the entire DevOps lifecycle accelerating your development and delivery. I'm super excited to share with you some of the new features that will help you get started and iterate faster. Now rapid iteration is key to success in DevOps. It separates the winners from the losers and enterprises that rely on their software innovations get real competitive advantage. Here at GitLab we aim to practice what we preach. We constantly turn out new code to production and on last check we do between 40 and 100 code changes live every day. To do that we use our own product. It empowers our whole organization not just the developers to move quickly and gives us real business agility. Each iteration gives us an opportunity to advance and deliver real advantages to our customers. If we're off track we can learn about it quickly before any significant investment is made that might take us down the wrong path. So let's have a quick look at how 11.2 can help GitLab users do the same. Now again another bit of a plug for GitLab in addition to rapid iteration we practice consistency. 11.2 is our 86th consecutive monthly release. That's just over seven years. I'd had to do the maths to work it out. Just over seven years of releasing every month. We're very very proud of it throughout the whole organization. So let's look at three of the release highlights briefly before we move on to James's demo. Before I go on if you do want to look at the full detail of what's in 11.2 you can look at the release notes as well. I'll just pop those into the chat so that you can browse throughout your leisure as I'm discussing them. Before we launch into discussing them in a bit more detail let's have a quick polling question just to set the context for how we're going to talk about Web IDE. So Agnes if you could bring up the next poll for us. Perfect thank you very much. And for those of you who don't know GitLab's Web IDE I know there are a couple of you who don't use GitLab today. It's something that we introduced in June this year so it's still relatively new and actually very exciting as a feature to bring out. It really is aimed at helping to get you coding quicker with GitLab that you have a full IDE experience in your browser and it doesn't rely on having any local clients installed for example. Here we go the results are in. We have out of everyone it's about 20% of people that are using Web IDE today. Like I said those of you that are using it today that's great but those of you who aren't please do have a look at it. It's available in all of the tiers of GitLab so it's there available for you to turn on whichever version you are using today. So let's have a quick look at my screenshot. So the Web IDE really makes it faster and easier like I've said to contribute changes to your projects provides an advanced code editor with commit staging right within your browser. With 11.2 we've made it even easier to see the effect of your code changes and to debug even before you commit. You can now preview your JavaScript web app in the Web IDE. You can view your changes in real time right next to the code for client side evaluation. In addition with 11.2 you can delete and rename files and switch branches without ever needing to leave the Web IDE. This means you can see the impact of your changes easily and quickly without needing to change apps and context. Now in today's fast-growing development environment moving from an idea to setting up a new project from scratch can still be a tedious task. There's a lot of boilerplate code involved and additional admin overheads preventing your developers from getting started right away. With 11.2 we enable organizations to manage their own project templates. As a GitLab admin you can now define a group within your installation that serves as a source for custom templates. All the direct child projects of this group are available as templates when creating a new project. All the relevant repository and database information of a template get copied over to your new project including the project and wiki repository, the issues, project configuration and more. This lets you get started right away and allows the team to spend more time coding and less time managing the process. Until now importing complex project structures that have multiple substructures was a very tedious and time consuming task. With this release we introduce support for manifest files for project imports. Manifest XML file contains metadata for groups of repositories allowing you to import larger project structures with multiple repositories in one go. When creating a new project there is a new option to choose a manifest file as the source of your project import on the import project tab. In addition you can then select from the list of individual projects in a subsequent step if you don't want to import the complete project structure. That's what you can see on the screen here. This improvement allows you to import the Android OS code from the Android open source project as one exciting use case. You can also import other projects that use of manifest files which meet our format requirements. And as it always is every month there are a lot of other features that we've included as well in the release. So I'll just quickly talk through some of them here, some of the highlights. For me this is a great one. We're very excited to announce that the cloud native GitLab Helm chart is generally available. This chart features a more cloud native architecture with a container for each component of GitLab and no requirement for shared storage. These changes result in increased resilience, scalability and performance of GitLab on Kubernetes. GitLab runner is also deployed, making it easy to get started with GitLab CI and CD. The GitLab chart is the best way to deploy GitLab on Kubernetes. Please give it a try and let us know what you think. This has been a long time coming this project and we would love to get your feedback. In addition there are several more features which are aimed at efficiency, team work and collaboration. Now this is quite a cool one. I quite like this one as well. So within your profile settings in GitLab you can now add a status including an emoji and a custom message. This status will show up on your profile page as well as in your comments and author title bars. So across GitLab people will be able to see your status and the emoji exposing it to everyone that's working with you. The obvious example that springs to mind for me is whenever you're not available, for example you're on holiday and everyone would know that you're not going to be able to get back to them straight away. Next one is pretty cool actually. So instead of restricting search to the project or group that you're in, we can now give you a consistent experience with the ability to search instance wide from the top of every page. This is a really cool one for inner sourcing use cases that you might have where you want to search instance wide. Issue boards, they were originally designed to support workflow tracking with label based lists. In 11.0 earlier this year we introduced a sign-e list so that teams can easily see which members have got issues attached to them and reassign them quickly. Now with 11.2 we've got a third type of list coming, the milestone list. All issues assigned to the given milestone will appear in a milestone list. This allows teams to see the issues in different milestones all at once in one single board with multiple milestone lists. This also means that you can quickly move issues across the different milestones. Add in the next feature and it gets even cooler so you have summed weights. With this in 11.2 it means that you can see the total weight of the issues that are in the milestones and for the sign-e's as well, not just for milestones. You can make sure you're not over-scoping or under-scoping. The final one I'm going to talk about here is that when you're at mentioned in an epic you'll get a to-do for it. This just helps to streamline your personal workflow. You can also create a to-do manually from the sidebar when you're viewing an epic itself. Again similar to the capabilities that we already have within issues and merge requests. It just makes your workflow that much easier to manage. Enough of the bullets, a bit of overkill potentially there. Let's get on with the demo and I'm very happy to pass it over to James. Thank you Simon. I'm excited to give you a quick demo. I'll just share my screen. Thank you. Here we are in a project and I'm going to show you a bit about the Web IDE. If you haven't used the Web IDE before, the easiest way to jump in and give it a try is by clicking the Web IDE button. As Simon said, this is available in every edition of GitLab. This project to give you a bit of background is a little toy project I've been working on trying to learn a bit of Vue.js. It's a simple to-do app.  There were a few improvements that I need to make and I've started on a merge request to make them. If I open this merge request and we can also open the Web IDE right from here. I haven't added a done button yet. Let's take a look. This is the Web IDE. It's opened one of the files that I changed in my merge request. This probably doesn't mean much. We can take a look at the new Live Preview. Clicking the Live Preview button launches a code sandbox side by side in your IDE and we can preview the app live. This is a to-do app, so I can add it to do. Try out GitLab. Switch to GitLab. We can mark some done. I suppose I've learnt Vue. I've got some single component files. I'm pretty much in love with it. I'm marking all these items as done, but the button says X. This feels like a delete action. This is one of the improvements I want to make. If we take a look at the source code, we can make this say something a little bit more useful. I think it's in this file. Yes, it is. Here we can see the X button. I'll verify that that's the right button. There we go. I've made a change and you can see it applied live. This is, I guess, the dream development scenario. You're making changes and seeing your code live. I think we can maybe do better than a done button. What we'll do is add a new component, which has an SVG. We'll see what it looks like to have an icon in the button. In the file tree, we can create a new file in the components folder. We'll call this done button. Just like using your local development environment, we can create files. I need a new template. I'm just going to copy and paste in an SVG, which is from our component library at GitLab, which is public if you want to take a look. This is an SVG for a check mark icon. Still not visible because we haven't yet added this to our view list item. To do this, I need to import from components. I think actually the components is not necessary. Now we need to include the component. I've misnamed that. That's why I've got a compiler error. Cannot find the module. Components. What have I done here? Done button, done button. Let's see if we can use this component. Done button template. Sorry, I've probably made a very trivial typo. Done button, components, done. Let's commit this and reload it.  These are my changes. Done button. Stage and commit those. Let's just reload this. Try the live preview again. Okay. This is better. We still can't see the icon, though. This is what I wanted to show you a live preview. The great thing about live preview is that if you make a mistake, you can fix it before you ask someone to review it and it's broken. What I've done here is I've forgotten to add a height argument to my icon. It wasn't rendering. 12 is a bit small. Let's see what 24 pixels look like. That's a bit weird. Maybe 14. Yes, I think that's a bit better. I'll commit that now that I'm happy with that. Okay. Fix missing button. We'll stage and commit that. I can commit it by double clicking it. This is how you can use the Web IDE to add improvements to your applications, even create a brand new web app from scratch, fix bugs, or address code review feedback. That's my favorite use case for the Web IDE. When someone leaves feedback on one of my merge requests, I can quickly open it straight in the Web IDE and fix the typo or fix the bugs that I've created inadvertently. The next feature I'd like to share with you is about project import and export, which I will go to not project import and export. Project templates, which I'll explain why I had that documentation page open in a second. In 11.2, we've added project template support. I'll show you the group where we've got some project templates. The project templates feature allows you to create custom project templates and add them to a repository. Here, we've created a simple to-do app project template, a spring template, and a minimal Ruby template. What this allows us to do is when we create a new project and we create it from a template, we now see the GitLab built-in templates, but also the custom templates. The really exciting thing about this is you can add templates that are specific to your organizations and teams so that they can get started. Really quickly. An example might be microservices. If you're using microservices, you could have a template and every time just get it right very quickly in a single click. There are quite a lot of things that get created with a project from a project template, the Wiki contents, the project contents, any uploads, webhooks, issues, the things to draw attention to that aren't copied across CI variables, container registry images, and build artifacts. But if we create a new one from the spring template, we use this template. I'll create a new one. This is my called SpringTest. Create new app. I'll make it public. I've already created a test. All right. Oh, dear. I think I cleared my settings when I had the typo. So let's use this template, create a new one. Spring app. Create template. Here we go. So this is importing the project and it's copying over all that data I described before into our new repository. And here we go. I've got all my files that were in the template. It's going to have copied across all the settings. So you'll see that any permissions around project capabilities. So LFS was disabled in that template. The pipelines were enabled. Any issue settings or merge request settings, these are all copied across. So if you've got a specific way of doing things in your organization, you can use project templates to quickly replicate those when you're creating new projects.  The next really exciting feature I'd like to share with you is around importing Android manifest files. So the Android project is actually open source project consists of multiple repositories. So I can jump back here. So all of these are different repositories that need to be created in a specific structure to work together. And it's a bit of a pain to create this many projects. And so what the Android project has is a manifest file. And you can now use a manifest file in GitLab to quickly import a subset or all of these repositories into your GitLab instance. So I'll show you how to do that by creating a new project. And I'm going to import a project. And I cannot see the option. No, I am sorry. I can't demo this to you right now because the button is not available. So I may have done something wrong here. All the staging environment might be running a different version than I'm expecting. I apologize for that. But basically, you would click on there's a new manifest file button that allows you to upload a manifest file. And it will give you a list of every single repository here. So each one of these is a repository. And you can then select individually which ones you want to import or click an import all button. So finally, I'd like to show you the milestone board. So this is this is GitLab.com here. And this these are the issue milestones for the GitLab.org group. So you'll see these are milestones for some previous releases. We also have milestones for all our upcoming releases. Sorry, scroll past them too quickly. Down here we've got 11.5, which is coming up soon in October November. And we use these in the issue boards. And so this is the new milestone list. So this is the milestone board for my team. You can see these are the direction items that we're working on for 11.4. We can see how many issues and what weight they are. And looking at the distance, we can add issue columns for upcoming releases, upcoming milestones, 11.5, next three to four releases. We can add a new list. So I'll add another milestone because 11.6 is coming up very soon. And I've already added a milestone, already added an issue to that. I probably need to add some more great features to 11.6. But yeah, this is how you can use and how we use the new milestones lists in the issue boards. So Simon, I'll hand back to you to wrap things up and take questions. Thank you, James. That's I mean, I personally just love the web idea. I think it's such an exciting capability to have within the product. I'd love to see what's going to evolve from where we are today. But it's not time to talk too much about us. And what we're doing is time for you to ask us questions. So I'm throwing it open to the floor. Now for Q&A, anyone that has questions, please just let us know. There should be functionality for you to just chat it to us. I'm going to just add, I've already done it, the release blog post about 11.2 if you want to see more details. But in terms of questions, I'm just going to bring it up. Agnes, have you had any come through yet? Yeah, we don't have any come through yet, but maybe we can start with some questions that, you know, we have seen come up a lot. So one, when are we going to do the server side evaluation? Seems like James did a sneak peek right there in the demo earlier. So James, maybe you want to pick this one? Sure. We're actively working on server side evaluation at the moment. And we're very excited about it. The first iteration is coming in 11.4. And it is a web terminal powered by server side evaluation. So the really exciting thing about that will be that side by side with your code, you'll be able to run unit tests and pull up a REPL interface to your preferred language and will support any language that you can run in GitLab CI. So server side evaluation will be powered by GitLab CI. And the actual live preview of web applications will come in, I think 11.5 or 11.6. But we're working on that at the moment and that will be an ultimate feature. Thank you, James. All right, maybe another one that a lot of people are curious, what is Helm? So maybe Simon or James, you want to take that? James would probably give a better answer than me, but Helm is a way to get started with installing with Kubernetes. And the important thing about it for us is that we've now got all of the GitLab application can be installed using a Helm chart. It was previously in beta. I think it was in beta for quite a while, maybe six months or more, but it's now generally available. So you can take that Helm chart that's available, install all of your GitLab application so that it's cloud native and get all of the benefits from using a cloud native architecture in terms of scalability, resilience and performance, right for all of your GitLab users. Awesome. Thanks, Simon. I guess if there are no questions, we will close up with one that, you know, again, comes up a lot. So what format is required for the manifest files? The manifest file format is an XML file format. It's documented in the GitLab documentation. I can paste a link quickly in the chat. And so it's the same format that Google uses for the Android project. And there's more detailed documentation available on the Google page, Google website as well. So here's the link to take a look at the manifest file. All right. Thank you, James. And here is us actually commented and says it still has Postgres that may not scale like other cloud native DBs. So I think it's a comment. Thank you, Iza. And Marco sent over a link to all the panelists on Helm. So thank you, Marco. All right. If we don't have any other questions, maybe let's kind of move on and close up with like a little bit of tease on what's coming up with 11.3. Go ahead, Simon. Yeah. So 11.3 is right around the corner. It's 10 days away because we release on the 22nd of every month. It's always the case that something shiny and new will be available very shortly with GitLab. 11.3 is no exception. So I will just post into the chat. There we go. The link to all of the releases and you can see exactly what's in 11.3 there. But 11.3, some of the highlights that I've picked out protected environments, I think is really an interesting one and is really good for the GitLab admin teams to look at in terms of just controlling who gets to deploy changes, for example, to production or to staging if you want to protect your environments that GitLab's deploying to.  For SAS, we're including Groovy to the languages that we support. And there are a host of other features that I won't go into now, but please do check out the link in the chat so that you can see more details on them. As always, it includes links to the specific issues themselves so you can comment and give your feedback directly in those issues straight to the product teams. And on that note, that's it. That's my time. I'm going to hand over back to Agnes just to say for me, thank you very much for your time today, everyone. Thanks, Simon. All right, so just a few last housekeeping items. We'd love to hear your thoughts on today's webinar. So please fill out our webinar survey, which I'll drop in the chat today. Here you go. And then finally, if you have any other questions, please don't hesitate to reach us via our sales contact page about.gitlamp.com slash sales. That's all for today. Thank you so much for joining us.


Grews. I didn't know it was this big. Thanks for letting me know. My pleasure, Grews. Like, just look into... like, I did ASMR readings of WikiLeaks Vault 7. I did ASMR readings of the Guantanamo Bay Files. I did ASMR reading of the OPCW WikiLeaks. Like, huge, humongous. Oh my god. What the unbelievable, the information released through WikiLeaks. The information released through WikiLeaks in the last 10 years, if there was any journalistic integrity in the Main Street Corporate Propaganda, they would still be talking about what WikiLeaks has been revealing in the last 10 years. From war crimes, to wars of aggression, to torture, to surveillance, to spy, to crucifying people, to murdering people, to assassinating people. Unbelievable, right? The eddy G, sadly I think his fate has sealed. I hope not. During an interview years ago, one of the main corporate propagandists asked Julian Assange that if he wanted to be a martyr, or he was becoming a martyr, and Julian Assange said, I don't want to be a martyr. I want to live my life as a free human being. I'm paraphrasing, right? But his take was, look, I don't want to be crucified by central power. I just want humanity to wake up. Because these people are killing millions of people, displacing tens of millions of people on a yearly basis, like on a consistent basis. They're enslaving humanity, right? And Julian Assange was, I'm just someone that has the power, that has the tools, and the will to see this all the way through. And his take was, he doesn't want to be a martyr. Who wants to be a martyr? The only people that want to be martyrs, if they have nothing, nothing to live for, right? Julian Assange had a lot to live for, right? So he's becoming a martyr, right? And his seal might be, his fate might be sealed, but it is not his doing. It is our doing. We are perpetrating this, this act, okay? We as a society, right? There are some of us that are speaking out and whatnot, but majority of people are oblivious to what's really taking place. Just like the majority of people were totally oblivious when Christ was being crucified, or when Tesla was being demonized, or when Iraq was being invaded, right?


What's up everybody once again it's Brandon Shawn and we got to talk about some of these IG lives that have been popping not just IG lives but lives in general and the videos that I'm about to talk about will be included in the description so y'all can go check them out trust me we got some lit stuff to talk about but one of the primary things that I want to touch on not just because some of these lives are dope but look artist how can y'all make your lives popping because I see too many people doing lazy lives and I hate when my creatives aren't creative when my artists aren't artistic you know what I mean so let's make this thing pop let's go ahead and talk about the first video let me find this thing pull it up here we go oh yeah she in her bag already let me uh let her hit that note I y'all know nothing about that what's so dope about this live right here Erica by dude she didn't do her live on IG live she did her live on I don't even know what platform I think people donated a dollar which isn't a lot indeed talk about no overhead for a concert this is kind of the way to go I don't see why more artists don't do it been telling people to do it but check out how she has a whole environment going on right a whole vibe for people to vicariously live through versus just hopping on live and I'm doing some basic stuff and I'm performing sitting at my couch and on the guitar or whatever that's something y'all can take from this because like I said this is a whole experience check her live out it's a vibe give me you angles but let's move on we're gonna keep this fast pace my god my guy sway lee bruh this junk is hard dude is lit if y'all haven't watched this man he's pretending like he had a concert for real for real let me let me show you how dedicated he is this guy wins number one over anybody I've seen in terms of dedication and shout out to Cory for putting me onto this one let me let me pull up a moment in this live I'm not gonna even hold you I'm not gonna even hold you hold up let me pull up a moment let me see where where's where's a moment in this live that y'all got to check out ah alright 1056 time stamps this dude right here he's so dedicated he's bringing fans on stage right he had the whole setup like yo put up a red phone if you put up a red phone I'm gonna invite you into the chat you got to act like you're a fan on stage and rock out with me but that's not it right check this out how dedicated he is with this dude is wildin the kid is wildin alright hold up at 1812 another time stamp check this out bruh throwing the bras and panties on stage this isn't something he just like hopped on live and said I'm gonna get at a mic right he has the mic he's rocking out walking around acting like he's at a concert for real but if you hear the crowd noise right they had to set this whole thing up they thought this through I love this live this is probably like this is my top four easy top four probably top top three of the lives I've seen because of how dedicated buddy is you gotta watch this live I'm not gonna even pull it up do crowd surfed tell me how you crowd surfed that's how that's how dedicated buddy is man but where's another another moment let me see check this out right here how look how lit he is by himself jumping around stage come on man like this is one of my favorite lives easily one of my favorite lives easily but let's let's keep this thing pushing we got to switch it up completely because what I love about this guy right here we can get this off the screen my bad my bad folks got all right so much ass obviously on this live it's not the point of this live what makes this live so hard check it out for a second so if you don't see what's going on you really got to check out the entire video but he's really acting like he's a radio hose bringing people on to the radio calling all that kind of stuff of course they added a torque element there's a lot of twerking in this video you know ain't nothing wrong little twerk on IG but check this out right all right my bad look here's a here's another moment for you this is one of my favorite moments off of the live let me see where's young thug he brings my guy young thug on here right that's the young thug answer that shit is classic but the fact that he's really playing and dedicated to this radio hose mode I'm not gonna kid you he killed his job he's he brought a lot of people on the live there are a lot of good moments to watch the whole point of this live and I think what people can get out of it is again you don't have to just be a music you can be a personality in other ways show personality in other ways it can be entertaining that's all that really matters there's a reason that entertainers are more popular than musicians right there's people who are dope at just really getting their pin game up play an instrument all that type of stuff but like people who can entertain us music is in the entertainment industry it's a reason for that entertainment comes first bro and he entertains there's way more ways to music way more ways to entertain the music let me pull up this one we don't go even further away from that this is wild but look if you have some kids you probably understand stuff like this John legend Chrissy Tegan think that's how you say her name they did a wedding for their kids I don't know her name one of their kids baby dolls and they really played this thing out like they they they're dedicated like so dedicated check this out of course John is gonna sing but we don't got no time for that John like they did everything whatever the whole ritual the whole ceremony they did flower girl all that kind of stuff but a point is again for your fans you can entertain in multiple ways you do not have to just play music there's so many different experiences that you could bring people in to and you can't get all picky about how people connect with you and I think that's the issue a lot of artists have like they want them connect to them in a specific way but if they like you this way and some people like you for your music and then eventually sometimes the people like you for your music finally discover your music and start to love you right they finally find that one song that hits them right same thing for people who like your music right eventually they get that hit from your personality where like you know what I actually liked them as a person the whole point as an artist is for them to like the entire brain and vibes anyway who cares how they come into it so if you show personality and things like that these are the things that stand out because if you want to be remembered through this time I've been telling people for years at this point that y'all need to do lives do experiences and get in depth live concerts private things like that I've been saying this for years but now because of this whole corona stuff everybody's doing right and if everybody's doing it now you got to figure out how to stand out because just doing it and dedicated is not gonna do the thing is not gonna do it for you even Drake right talking to his dad on live it's interesting just because of course they've already publicized the relationship it's already a thing people already know who his dad is he's a character kind of a level figure in the culture but then them just talking live that's just a conversation that's a little less expected right and having that combo live and people peering into a genuine relationship like that and then another example of course and this is even further away because this is LeBron Richard Jefferson some people like we don't know basketball you don't know basketball but what's important is like this is just a combo that they have that they're having in the same way people watch ESPN for conversations or everyday struggle and all these talk shows and morning shows just having a conversation with you and other collaborators that's just an interesting regular person conversation that allows another way for people to connect with you and it can't be slept on so if you have genuine people that you genuinely rock with that y'all could actually just have a conversation that other people have that other people are interested in had that conversation and it's no pressure that's the best part about it because if you like people like that the person like that that you're kept collaborating with is probably gonna be an interesting conversation some work listening to so you can do that I don't care if you're an artist actor or whatever and this probably makes it even doper to start to do something like this with people who aren't even necessarily in your field or just people that people don't even know that you rock with so there's so many ways to make these lives go lives are not just a moment right there's gonna be more people who do this ongoing and we talk about the overhead man it doesn't cost money like that why not do this right so make it an experience dedicate like really commit to it and bring a whole vibe and an energy whenever you try to do this make sure you capture it because some people are not capturing their lives in a way where it can be reused for future content you gotta do that because there's not gonna be everybody who catches it make sure you capture that jump so people can use it in the future man entertain and stop being overly worried about how people perceive you man like and how people come into your brain it doesn't really matter as long as they rock with you but these are just some of the dopest lives that I've seen thus far man the lives are the way to go it is the future and eventually eventually you probably can you know make some good money off of it too you know depending on what level artists you are and it's not just for artists by the way influencers in general whatever you do any public figure man there's so much you can do with lives lives are not the way lives are the future let's get it and if you like this video don't forget you want to watch in these videos they're in the description below they are definitely worth it bro like Tori Lane's lit Sway Lee is super lit Erica by do is a vibe convo with LeBron is dope and last but not least it's just a wow they went so deep into that John legend like Chrissy Teigen wedding for their kids they really dedicated it and wherever they are like the weather is nice probably California anyway as always hopefully that was helpful for you giving you some ideas inspiration and all that good stuff if you like this video hit the like button but also the notification bell so you can get the future videos on this channel and also of course if you like you might well share it if you're not subscribed you know what to do hit that subscribe


Now we are going to be talking about checkout settings and shipping zones. When you combine this lesson with the previous lesson your customers and your viewers will have a very smooth checkout process when trying to buy from your store which is exactly what we want. So on your Shopify dashboard go ahead and click on settings and then click on checkout. The first option that you want to look at is customer accounts. You can go ahead and leave it as disabled or you can go ahead and choose accounts are optional. I do not recommend to go with accounts are required because you don't want to tell your viewers hey you have to create an account on my website before you check out. Many do not want to create accounts they just want a simple and fast checkout process. Next you can choose if you want the customer to check out using either a phone number or email or by only using an email address. In my opinion the email address is more than enough but if they add phone numbers they will get order updates by SMS's and not just through emails. So go ahead and choose whatever is most comfortable for you here. I would go only with the email option because once again it's more than enough and it gets the job done. Next on the receive shipping updates go ahead and choose the first option the customer can choose to add a phone number or email to receive shipping updates after they complete their order instead of having them download an app to see what's going on and you have to be a US resident to use that so it's not comfortable for everyone so the first option is good. Next on the form options you should require a first and last name since you don't want any problems with the delivery process with the shipping company. On the company name you can leave it as hidden or as optional but definitely do not make it mandatory so either hidden or optional. Address line two should also be optional. Shipping address phone number is definitely not a must so you can go ahead and leave it as hidden and now you can go ahead and leave the rest of the options as default because they are good enough for what we need. So once we're done with that go ahead and click on save and that's it concerning the checkout settings. Now let's move on to the shipping zones. Back to the Shopify dashboard click on settings and then click on shipping and delivery. The reason that we need to create a shipping zone is to tell Shopify which countries we want to sell to and so that our viewers will be able to get free shipping or a shipping cost of whatever we want. So a shipping zone is a must so once you are here click on manage rates. Now here you'll notice on a default setting you are shipping from your local address which you have registered to Shopify with on your Shopify profile and you're also shipping to the same country that you're from and obviously this is not what we're here to do and this is exactly why we need to set these shipping zones so what you need to do now is open your settings in a new tab and here instead of using the default location we're going to go ahead and click on add location and this is going to be the name of the location where your products are shipping out from. So we're just going to go ahead and call it US warehouse. Now in the address field you're going to have to have an address a valid and real address from the US. Now to help you with this in the resources PDF that you have for this course there is a file over there with a whole bunch of US addresses in New York to help you out with these addresses so go ahead and copy any address for example this one 13 Washington square south pasted over here in the address and as you can see there's a drop down menu so go ahead and choose any address this way we'll know that it's valid and this way it also simplified the process it shows the correct city in the state of Massachusetts with the zip code and that's good enough let's go ahead and click on save and now we have a location which we can set our shipping zone from and have any resident in the US buy from our store so now let's head back to the shipping menu that we were on before now on the shipping from click on show details manage the one that's not relevant remove it and click on done now we have the address that we do want to use the US warehouse that we just created on the settings slash locations on the shipping zone we're going to click on the three dots and delete it the shipping to now we're going to create our own shipping zone so the zone name is going to be called ship to USA for example and in the country go ahead and add the United States click on done and now Shopify will allow anyone that's coming from the United States to our site they will have the add to cart and buy now options because we told Shopify that we want to ship to all of the 62 countries in the United States now we're going to click on add rate we're going to call it free shipping and the price is going to stay on zero dollars because we want to offer free shipping just as we are getting them from our suppliers go ahead and click on done so once again now everyone from the United States can buy products from your store because they will see the add to cart and buy now options anyone outside the United States can still go to your site they can still view your products and their prices but they will not have the add to cart and buy now options if you want to add those countries just add them in your shipping zone so once you save them that's all there is to it you have created your shipping zones so that's it when it comes to your checkout settings and your shipping zones this is exactly how you guys can get those two features done and now our viewers will have a very smooth checkout process without any problems or interruptions guys i'm really glad that you made it this far i know that the past couple of lessons were not the most interesting ones but you see how important they are to run your business smoothly and efficiently but don't worry you're going to love the next lesson your assignment for this lesson is to configure your checkout settings and your shipping zones and i'll see you in the next lesson where you will finally go live with your store you worked really hard up until now i'm proud of you and i'll see you in the next lesson where we are finally going to go live


SCP-1417 Object Class Safe Special Containment Procedures SCP-1417-1 and SCP-1417-2 are to be contained in a standard safe-class holding locker when not in use. Any personnel wishing to make use of the objects for testing purposes must submit a summarized testing outline formed to Dr. Chapman for approval. Under no circumstances are SCP-1417-1 or SCP-1417-2 to be taken off-site or used without permission. Any personnel found in violation of this protocol will be reprimanded. Description SCP-1417 is a collective designation for two related objects possessing anomalous properties. SCP-1417-1 appears to be an ordinary banana, Musa Akumonata, of the Cavendish variety which is partially peeled at one end. Biological analysis reveals that SCP-1417-1 does not differ from an ordinary banana in any way, with its skin and exposed flesh consistent with biological norms. SCP-1417-1's anomalous properties include the inability to continue peeling it, when an effort is made to peel it, the peel is unable to be moved, with testers reporting an intense resistance on the part of the skin. Robotic attempts at peeling have also met with similar results, with pressure increasing equal to the resistance applied in peeling. SCP-1417-1 also does not suffer from standard biological decomposition. Since its acquisition by the Foundation in 2012, the object has not undergone any form of degradation, regardless of location. SCP-1417-2 consists of two pieces of laminated printer paper, 8.5 cm x 11 cm in size, accompanied by a single plastic chip. The second page contains a chart of several options with accompanying blank boxes. These properties manifest when the chip is placed on one of the boxes. The test of the page is as follows. Swiss Army Banana, Registered Owner, Flare Gun, Single Shot, Tire Iron, Corkscrew, Pocket Knife, Compass, Only Points North, Rest When the plastic chip is placed on any of the blank boxes, SCP-1417-1 will take on the properties of the object selected. The banana itself will not change or displace any new visual qualities, but will instead function as the selected object. For example, placing the chip onto the pocket knife box causes SCP-1417-1's peeled visible end to become as sharp as a standard stainless steel quality knife, just as selecting the compass box will cause SCP-1417-1 to point its peeled end north regardless of the direction the object and or owner is facing. When the chip is placed into the rest box, SCP-1417-1 will return to an inert state and appear as normal. If SCP-1417-1 is not placed into the rest position approximately once every 12 hours, SCP-1417-1 will develop a limp appearance and begin to turn green, becoming non-functional until the rest option is selected. It is also important to note that the plastic chip when placed upon SCP-1417-2 cannot be removed by any means other than the owner physically removing it with his or her hand. The paper is apparently indestructible with ripping, burning, and compacting attempts proven to have little to no effect. Alternatively, if an individual signs his or her name in the registered owner text box, SCP-1417-1 will respond to voice commands from the individual so far as they match the commands found in SCP-1417-2. For example, saying or yelling rest while in the presence of SCP-1417-1 will cause the item to enter in the rest mode, further testing is in progress. SCP-1417-1 was discovered on ██-2012 after police responded to a hostage taking incident in the town of ██████, Pennsylvania. First responders found a suspect, a man with a known history of mental illness, holding a neighbor hostage with what appeared to be a banana. After negotiation with the suspect failed, police attempted a raid on the home only the witness of suspect fatally slashed his victim with the banana, causing death due to a severed jugular vein. Some personnel embedded within the coroner's office noted the unusual circumstances of the incident and retrieved SCP-1417-1 and SCP-1417-2 from the home of the suspect, with amnesiacs administered to witnesses as necessary. Suspect ██████ retrieved from incarceration and recruited in the Foundation program as ██-23952.


Well, this is perhaps the weirdest video I've ever posted. You will see why in a moment So a few months ago, I had a DM from a complete stranger in America asking me would I be interested in auditioning for an acting law? Yes, you heard it right. That was my response. What? Went back saying this is perhaps a mistake the DM came by accident. I'm not an actor. I'm a public speaker I'm a mentor and so on and so on this guy said no, I found you on YouTube and all to everything that you had done there and on Instagram and I would love you to audition turns out for the lead role in a brand new American TV show I'm like what? Anyway, when I'd settled down got over my shock and fear I said, okay, nothing to lose. So they sent me a script. I memorized part of the script I went to London to a studio. I did an audition video sent it to America I had nothing for two months Then eventually I got another Message saying would you audition again this time on a zoom audition with other actors in America and with the director of the show? Just got weirder and weirder. So I did all the time realizing this is a good experience It's a great experience. It'll come to nothing because I'm not an actor But did anyway Then a few weeks later. I got a message saying I got the part So I am now here In a secret location in America where I've just finished filming The first pilot episode of the new TV drama That hopefully will be coming on a global network soon where you will see the show I can't say much about the show I've signed an NDA non-disclosure agreement about the title of the show, which is fantastic and the concept is fantastic We are we're reaching into the mental health space with this show, which is huge issue as you all know in the world And I play a psychologist. That's all I can say to you Can't say the name of the show or the name of my character But I sit here absolutely in a state of shock about what I've just done I spent two weeks on set filming the first pilot episode of this new TV drama Which we hope will be coming to the world soon And I think I'm recording this to say to you all I teach you all the time Don't I step out of your comfort zone? We don't grow in comfort try something new and different always be open to new adventures Take curious take risks. There you go. It's 65. I have just stepped so far out my comfort zone I need to be locus. I need to be inoculus to see where I'd come from It was that far out imposter syndrome fear anxiety all of that. I've battled now for months knowing this was gonna be happening I've just finished Filming the show You're never too old to try something new. It's never too You never too old a dog to learn a new trick is one of the things I want to pass on to you Watch this space. I'll tell you more when I'm free to tell you more. Love you guys. I know who am I? Let me guys talk to you soon