Hey everyone, thank you for joining. My name is Peter Hunt. I'm also a software engineer at Red Hat, working primarily on Cryo, but sometimes on KubeLid and Signode, and sometimes on C, Podman, container-related technologies. Appreciate everyone coming out right before the party. Hope to get you all pumped up, ready to go for this evening. And we're gonna be talking about Cryo's senior year. So I'm gonna start off, quick introduction. What is Cryo? And Cryo is an implementation of the Kubernetes Container Runtime Interface, compliant with your open container initiative. It's a lot of jargon, a lot of acronyms. What you can take away from that is it takes the spot in the stack that Docker used to occupy. So it pulls the OCI container images and starts the containers and pods. It's responsible for all of the operation underneath the KubeLid, but before the OCI Container Runtime. Some design philosophies that Cryo takes on is it's a balance of stability and features with a focus of security and performance, and specifically, it's purpose-built for Kubernetes. And we'll describe some of the consequences of that later. So here's a quick architectural diagram of what Cryo is. So you see on the left here, a KubeLid talks via GRPC to Cryo. You know, KubeLid asks Cryo to pull an image or create a container or start a pod. Cryo's image and runtime services then are responsible for doing that. So for the image service, Cryo has a library containers image, which actually does the pulling, and then Cryo has for the runtime service, it uses OCI runtime generation to actually generate the container spec, and then uses an OCI runtime to actually start the container for a pod it uses CNI to provision the networking resources. And underneath on the disk, you know, it uses container storage to allocate the disk resources like the copy on write file system. Cryo also has an entity called Konmon, which we'll be talking about a little bit later, but it's a container monitor that actually pays attention to the lifecycle of the container. Why would anyone use Cryo and why do we implore that you do? So Cryo is, we aim to make Cryo secure by default. So, you know, we try to have a minimal attack surface by reducing the set of operations that Cryo is responsible for. So with other generic container runtimes, it's responsible for a lot of, a lot more operations than Cryo, which is only looking to satisfy the Kubernetes CRI and the things that the Kubelet wants it to do. So Cryo doesn't need to build images or push images, for instance, because all it cares about are the things that Kubelet wants to be able to do. Cryo also prioritizes security features and tries to get them consumable in a way that the Kubernetes API can, you know, satisfy. We had experimental support for user namespaces for years before we just recently added it to the actual CRI and that allowed folks to test it out and, you know, work out some issues with it beforehand. And also, you know, it was specified through annotation so it was actually consumable by, you know, in Kubernetes. We also ship with a smaller capability set because we don't expect, you know, we want the containers that are run in production, which is Cryo's main priority to be as secure as possible. Cryo also aims to be as performant as possible, specifically for Kubernetes. Because Cryo's behavior is customized for Kubernetes, common operations are optimized for. So, you know, currently with the generic plague, the pod lifecycle event generator, the way that the Kubelet maintains the state of what the status of the pods and containers are is by frequently relisting and asking Cryo, hey, what's my containers? What are my containers? What are my pods? What are my containers? And it does that over and over again fairly frequently to maintain its state machine. While we're improving that asynchronously throughout this time, Cryo has optimized for that use case because we know Kubelet is gonna be doing that a lot. I'll also be talking about another optimization that Cryo, another set of optimizations that Cryo has made in a little bit. Ultimately, what we want for Cryo is for it to be boring. So, you know, even though we have plenty of these exciting features that, you know, optimize for Kubernetes, what we want really is that an admin chooses Cryo as their container runtime after deliberating over the options and then promptly forgets about it because it's doing the job that it needs to and really nothing more. And we're excited to announce that we are in our senior year, hopefully. We have just recently applied for graduation and, you know, we're excited. We've been in the, as the C&S, we, Cryo was born in the Kubernetes Sandbox, what, Kubernetes Incubator in 2016 and then it was, it moved up to a Sandbox project, which it is now in 2019. We're excited, you know, we have a lot of production users that are using Cryo, OpenShift, you know, Susan was for a while left and so we're happy with those relationships and we think that Cryo is very ready for production now. It has been for a long time, but I think we've really proven it at this point. We got a security audit in the spring and they had mostly pretty good things to say and, you know, a couple of bad things we fixed already. So now it's all good things. And so we're excited for graduation and hope to have that go through soon. So next up, we are gonna talk a little bit about the container monitor that I mentioned earlier, Konmon. And I'm gonna talk about a rewrite of Konmon.  Konmon's a little helper agent that manages the life cycle of the container. Specifically, it actually starts the OCI runtime process and it watches for the exit of the container. It manages the logs of the container, takes the logs from standard out and writes them to disk. There's one instance of Konmon per container and also one per exec sync request. So if you have an exec probe, there's actually a Konmon running underneath there. We'll describe why that's important later. Konmon is called by Cryo over the CLI so it has this pretty large CLI set now. And it's currently written in C. So we have a couple of reasons that we want to go through the process of rewriting Konmon. Specifically, some of the points that I mentioned earlier and why the consequences of those, one container per Konmon per container and per exec session means that there's a lot more process overhead than we'd ideally like. Everyone here knows now that the standard unit of container is pod. It's 2022, Kubernetes is largely one. So we're really thinking about, we're really thinking about containers in groups. It's also Konmon is CLI based and we're really looking for a more modern API mechanism than just passing through the CLI. For instance, we have an API version flag that actually we used to specify different behavior for change that we made years ago but because of API compatibility over the CLI that's a little bit more difficult than it is with the more versioned and smart IPC mechanism. And it's a bit of a clunky program. It's a little tough to work with sometimes. It was written in C and it started a long time ago and it's really served us well and it's very stable but we're looking forward and looking up and trying to do new things. What we want out of our container monitor is really we want one Konmon per pod because the unit of containers in 2022 is now pods. We want an IPC API based mechanism to speak with Konmon. CLI is good and it works but it's clunky and it can be better. And we want a more modern language. C has served us well but everyone knows the common pitfalls of C and a lot of the difficulties that can arise from using it. And so we want to kind of work around those by having a language that works a little bit better. So I am happy to introduce to you a program that actually satisfies all of these constraints and more. We have Konmon RS. I originally, it would have been cool if we could have named it Podmon because it's a pod monitor after all but for some reason people said that that would be confusing, I wonder why. So instead we settled on Konmon RS, a Rust implementation of Konmon. It currently covers the scope of the existing Konmon but with a couple of differences. Some highlights of Konmon RS is that we have a native Golang client API which wraps Captain Proto as a protocol. Captain Proto is an API framework that's used by Cloudflare and a couple of other folks. It basically advertises zero serialization between the different, even different languages. So we can speak between Go and Rust and it basically passes a block of memory over and those are each M mapped into the different languages. So it's very fast and also has less complexity than something like GRPC or TDRPC or something. It, Konmon RS runs on the pod level not for each container which is exactly what we want now. And it also supports having the exact sessions within the container which is beneficial. It aims to keep a low memory usage so Konmon used something around two megs per container and we're aiming something between four and six. It would be better if it was lower obviously and we're working on that but we really want there to be no memory penalty for using, theoretically there should not be a memory penalty for using Rust and if you had a pod with two Konmons for one for each container and then maybe a couple of Konmons for the execs we aim for Konmon RS to be much less memory than all of that would ultimately end up using. So Konmon RS to be able to support pod level as you know, to support all the containers in the pod it's gonna be multi-threaded where Konmon used to be single-threaded or still single-threaded. And we have some exciting features that we're able to enhance Konmon RS with because it's written in Rust so it's a little bit easier for us to add new features to it. To be able to use Konmon RS in cryo all you have to do is add a drop in file to cryo's config directory and specify the runtime type as pod and then point it to the location of Konmon RS and then restart cryo and cryo will come up and use Konmon RS and hopefully you can also promptly forget about that choice. Right now we have passing CRI tests and integration tests, Kubernetes and node tests basically all of the tests that cryo expects for fully functioning to be fully compliant with Kubernetes, Konmon RS is passing now. We're planning for integration into Podman. There's a couple more pieces that we need for Podman which we've not quite gotten to yet so we'll talk about that a little bit. We have RPM packages available and we also have static binaries available for each commit so if you wanna download and use it you can currently and we're looking for adding more distributions in future as we stabilize. In the future, I'd like to describe to you a world in which we have all of the pieces that Konmon used to have so there's currently some gaps. We have all the functioning pieces we need for cryo but Podman needs a little bit more it needs an attached exec session because Podman the process goes away there needs to be something holding open that exec currently cryo's doing that. We need checkpointing for Podman and also actually soon for cryo because we're having checkpoint and restore functionality. We need support for seccomp notify to be able to be notified when a container uses ASIS call that it wasn't supposed to or wasn't expected to and the journal D log driver which just adds compatibility to what Podman currently uses. We also looking forward have some features that we're pretty excited about PID namespace holding is one that I personally am really excited about. So currently if you have a pod level PID namespace you need the infric container to hold open that namespace because you need to have the PID one in the namespace to stay alive for the duration of all of the processes within the PID namespace. Currently the infric container, I mean it works, it's worked for a long time but it adds a little bit of process complexity and overhead and it would be nice if we just had some process. Imagine what a process that survived for the duration of the pod and was able to hold the PID namespace for it and ConmonRS satisfies those requirements so I think it'd be cool to be able to have the PID namespace held by ConmonRS and then we'd be able to drop the infric container in all cases. Also looking for IPv6 port forward support which is required or desired by Podman there needs to be a running process to keep port forward requests going in IPv6. We want logging rate limiting so in just additional log drivers in general we have right now there's like the Kubernetes log format and we're looking towards journal D but also we have the opportunity for a JSON logging driver which Podman has wanted for years ever and has never actually gotten and so being written in a more modern language it'll be easier to integrate some of these new features and open telemetry tracing which I'm actually excited to say we have experimental support for we're still kind of working through the details of it and I didn't have time to put together a demo of it and I wanted to but open telemetry tracing is coming and so you can actually track the especially with the Cubelets support for open telemetry tracing and cryos you can track the life cycle of a container from being created in the API server, being registered in FCD, being created by the Cubelet, being created by Cryo and then all the way down to Conman RS now which we think is exciting and opens up some opportunities for being able to track the life cycle of your containers and pods. So that's Conman RS, we're pretty excited for it and now I'm going now for something completely different we're gonna talk a little bit about some load optimizations and specifically some better reporting mechanisms that Cryo has added semi-recently. So if you've attended some of these talks before you might have seen me talking about situations of load in Kubernetes and specifically between Cryo and Cubelet but I'll give a refresher for anyone who's new here. So the problem is in situations of load Cryo and Cubelet get into this bickering match where they have trouble syncing up between so basically the Cubelet needs to have a time out on each container and pod creation request because it needs to know that when it sends out that request, that request and it just disappear into the void. The problem about that is that Cryo can take an undetermined amount of time to create a pod or container, especially under load. Usually there's some entity that is the bottleneck it's often the SDN or maybe the disk IO and so Cryo might not be able to create that container in time and because of that Cryo and the Cubelet bicker about trying to create that specified resource Cubets like hey please create this resource and Cryo's like hey I'm working on it name is reserved gets this awkward situation. So this has been largely solved in Cryo as of 119 or something like that and I'll describe so it's quite old now but I'll describe the solution because we've added a little bit to that solution. So the solution to it is to fine tune our behavior to the Cubelet which Cryo is able to do because it's only for the only client that Cryo materially cares about is the Cubelet and running containers in production. So the basic idea is to finish creating the resource and then save it until the Cubelet asks again. So I'll walk us through that example.  At some point in that process maybe Cryo gets stuck on SDN because it's taking a real long time there's a lot of pods being created at the same time something, Cryo takes too long and the Cubelet times out. Cubet's not sure whether the timeout is because the request disappeared or because it actually is just taking too long. So just in case Cubet re-requests hey can you create me this pod. The second routine is aware that the first routine is working on creating that pod because it can tell that the name is already reserved. So what it does is it waits and basically tells the first routine hey when you're done creating that let me know because I'm trying to give it to the Cubelet. Eventually the bottleneck either clears up or you know the networking you've finally on gums and Cryo's able to create the resource. So Cryo that the first routine detects that there was a timeout and pings the second routine saying hey I'm done my thing now and returns to the Cubelet. Cubet's not paying attention anymore it assumed that the request disappeared so this dotted line represents Cubet's not really listening anymore. But what it is listening to is the second routine which has said hey I have this resource for you but you need to request again. The reason we do another round of requests even though the resource is already made is because there might be a race between the Cubelet timing out when Cryo sends it so we worry about having this resource disappear. So instead we time out one more time in the Cubelet and then await the inevitable Cubelet re-request that resource from another Cryo routine. That routine sees that it has the resource and it's able to return it no problem. So this was a good optimization because it changed the situation where there used to be a lot of thrashing on the node where container would be created, it would take some time and then it would have to be the creation would time out and at the time we actually removed the container because it aired out and that was bad because that actually made the resources be even more constrained. So now we've improved the situation a lot. Now we're basically returning the resource just about as soon as it's actually done. Another small piece of it is we're actually throttling the request from the Cubelet. So if the Cubelet had its way or the way that it used to work is if Cryo was just like immediately after getting the duplicated request, hey, I'm already working on it, I'm gonna return an error to you, Cubelet, then the Cubelet and Cryo, like Cubelet would propagate through the event API like a whole bunch of like names reserved, name is reserved because Cryo would be returning these errors really quickly and Cubelet's trying to create this pod as fast as it can. What, because we know that the Cubelet is going to re-request this object, as long as the error keeps being time out, what Cryo can do is it can actually throttle the Cubelet and wait on in this routine to saying, hold on, Cubelet, slow down, we're working on it, don't worry, taking as long as it can. So that reduces the number of events in the pod API. So that's very nice and reduces churn and makes the admins not as scared because there's not a bajillion messages saying, oh, name is reserved. A new thing that we've done semi-recently, which I'm also very excited about, is we return where the pod or container creation is stuck. So we used to just say this kind of generic error, like name is reserved, we're working on a Cubelet, chill out. But now we're also keeping track of where in the container and pod creation process that resource is stuck and that way we're able to return. So when resource, when one of the Cryo routines that isn't the original one returns an error saying, hey, we're working on it, but it's not done yet, it also says, and it's actually stuck at something like currently at stage sandbox network created. So it's saying sometime after the sandbox network was created, we're stuck. Or says something like sandbox storage creation. So what that error would indicate to me is that there's an IOPS throttling problem. If it said stuck on sandbox network creation, I would guess that there's a slowdown in the bottleneck in the SDN. So basically this improvement allows an admin to see the state of the container or pod creation process like why it's taking so long and hopefully make read-immediation steps faster. And I'm very excited for it because in the past it took kind of just a lot of intimate knowledge with Cryo and the timing of things to be able to actually tell which was the problem, which I ended up doing a lot of that work for the people that I support. So I'm excited that it'll be doing that for me. And next up we have Rinal talking about some six-store stuff. All right, so folks, everyone must have heard about six-store. Well, I'm happy to say that Cryo has support for six-store style signatures. So the containers image library that Cryo uses for polling images. Merth support for verifying those signatures. Podman fully supports it. So Podman can be used to sign and push those images and the signatures to a registry and then you can use Cryo to verify those signatures when you pull the images. However, we need to improve the UI of what happens when a signature verification fails. So today the CRI doesn't distinguish between the types of image pull errors. So we'll do some upstream work. So like Kubler can distinguish and give the right message to the user when signature verification fails instead of just a generic image pull fallback. Then we also did work so that the Cryo release binaries are now signed using Cosign so you can verify them as well. So next I'll cover some upcoming features that intersect Cryo and the work we're doing in Signode. So first of them is username spaces. So far, this username space is supporting the Linux kernel, but Kubernetes has not been able to take advantage of it. So Peter mentioned that we had annotations-based support in Cryo. But finally in 125, we got phase one alpha for username spaces merged into Kubernetes. So this phase one supports stateless pods. It means any pods that don't use persistent volumes will work with username spaces. So the supported volume types are like MTRs, secrets, config maps and so on. So with username spaces, you get an additional layer of security in your pods. So you can be root inside your pod while being non-root on the host. What it means is if a process is able to break outside of the container, it's not able to attack the host or other containers running on the node. So it's very useful and one more advantage is you are now able to run any random image from any registry that runs as root by default and not have to worry about changing it to be non-root. The kernel takes care of it for us. So here's a simple example of how you utilize this. So you just add that host users equal to false in your pod spec and that will enable Kubelet and Cryo to enable username spaces and you are in this username space pod. So next up in this area, we'll start adding support for other types of volumes, persistent volumes and that's something we need to tackle upstream first and then make available in Cryo. So checkpoint restore. So this is another feature that was merged into the Kubelet. So basically it uses the CRIU to checkpoint container state. It's only a Kubelet API at the moment. So there's no Kubernetes API for it. So if you want to use this feature, you have to hop on a node and directly hit the Kubelet's endpoint to checkpoint the container. So the current use case that has been targeted is forensic analysis. Say you're a bank and there is a bad actor that's able to break out of a pod and is trying to attack or do something bad on your node. So what you can do is you can get on that node and then checkpoint the state of that pod and then you can move that checkpoint state to another node and then you can start that pod back up again so you can analyze what was happening inside that pod. And this can happen without the knowledge of the attacker. Like they can continue being in that pod. So this allows like, this is like a security feature. So other use cases of checkpoint restore like faster startup for pod such as JVM. So we know that Java takes time to start up, right? So potentially we can checkpoint a pod after that startup phase is done and then you can launch hundreds of copies of such pods. So that would be a net improvement in startup time. So this is also early and let me just merge the checkpoint support. So next we'll start tackling the restore support in the Kubernetes API. And finally, event at plague. So today the cubelit uses the generic plague. What is plague? So that's a pod lifecycle event generator. So that's what is being used by the cubelit to materialize the lifecycle of a pod. So once the cubelit starts a pod, it needs to be aware when it dies or it gets killed for some reason.  And how does it know that? It knows it through the plague. The way the generic plague works is the cubelit periodically relays all the pods and containers from the runtime over CRI. Now the overhead of doing this is very high when there are lots of pods. Like imagine you're trying to push the boundaries of how many pods you can run on a node. You are at 600, 700 nodes. And very frequently the cubelit is requesting this list of pods from the runtime. So this adds a lot of overhead to both the cubelit and the container runtime. So we are working on a feature called as evented plague that moves to a list watch model, like a cubelit that is operator's work today. So with that, the cubelit will be able to list the pods less frequently, way less than it does now, and then rely on events being sent from the container runtime to generate the plague events. So this will drastically reduce the overhead of cubelit and runtime, and hopefully we'll be able to run way more pods than we do today. So this work is targeted for 126. There are PRs open and we are hopeful that it will get merged. So this brings us to the end of the talk. Thanks for joining us and we are happy to take questions. You also, so in a tragic event where Kanman dies before the container does, then also we don't catch the containers exit because Kanman is the parent of the container process. So it's the one that can catch the sig child that the kernel sends when the process ends. Cryo is not at all, Kanman actually demonizes. So Kanman is a child of system D, not even of cryo, so cryo can't catch those. So at one point we had a Kanman monitor, but Kanman-mon we called it, but it was racy and kind of difficult to work with. So we've made it, we worked hard to make sure that Kanman isn't gonna seg fault or anything like that or exit before the container does and it actually can't be umkilled either because that would be in a bad state. We hope that we're looking at situations. PID FDs would help with that where we can actually, cryo can keep track of the life cycle of the Kanman or Kanman RS instance. We could also maybe use EPF to catch Kanman exits, but we don't currently have anything. So the ideal is that that doesn't happen. Right, as of now it does not. It would, I agree that that would be even more problematic of a situation. And so we're, you know, it is on our radar trying to figure out the way to actually pay attention. You know, I really look forward to PID FDs in general Kanman could also use them, but you know, before that maybe we'll come up with some EPF thing so that, like that risky situation doesn't come up. Because I wanted to have a good resume. No, because, well because it like was a natural fit for kind of the piece of the stack. It was, you know, we already had Kanman NC, but it would have been kind of clunky to add, you know, asynchronous and you know, all of these things and go would be, the go runtime uses too much memory for the number of Kanmans that we want. So we felt like Russ was a good fit for that. And you know, I kind of feel like in general, the layer of the stack that we're at, I think we're gonna start seeing more projects being written in Russ, because it's a pretty natural fit for like the space. I think Russ has a right mix of low level and high level. So we can do all the low level things we were able to do with C, while also having access to like an RPC API, like Captain Pluto, that we can easily integrate while not paying the huge memory or CPU penalty. That was a motivation to me. We have attracted some interest in it, but not kind of contributors, mostly people. Some people are looking at, you know, some issues and stuff, but it's, you know, a little slow going, but we're hoping that also the integration of Russ into this whole ecosystem will appeal to people. So what was the motivation for using a CNI for setting up Cryo? And what are your thoughts on this CNI conflicting with other NetCon? For say any other CNI that works. And I've seen this issue that the Cryo CNI conflicts a bit. So are you talking about Cryo shipping a default CNI? Yeah. So I think that's just something that we ship. So it's easy for you to get started with Cryo, right? So you can easily start up a local or cluster and you'll be able to see your parts, but that's something we never recommend for production use cases. And we make it easy for you to like, drop in any CNI conf and the binary and it should just work. So that's more like a starter thing to get it right. And also actually now the packages that we ship in all of the upstream distros, they don't actually require the container networking plugins, they only recommend them. So if, you know, if you're on Fedora, you're able to actually install Cryo without installing the container networking plugins. So it's not required, but you know, we suggest it if you don't have another solution that can come out of the box. And I've seen that the plague issues I see with Kubernetes, they're not very descriptive. So how would you go about digging in deep in those issues and actually figuring out what's causing the plague error? So I think like, there are two things, right? Like one thing Peter mentioned is improving what we log in the container and things. And the second part of it, like improving what we log on the Kubelet side of things. Like the whole Kubelet code that manages sync pod and generates all this is hard. And what we are hoping is with event it like, we have some ideas on how to simplify it and like make it better. And also folks in the community, folks on Google are also working on some documentation. So more people can come up to speed, contribute and simplify that whole area. The existence of tracing support in the Kubelet, we also had the idea, we were talking about it today, like instrumenting sync pod or the pod workers that are actually doing the plague generating and managing, if we were instrumenting them with open telemetry, like maybe that could also give some better insight into what's going on there. You'd be able to watch us span and see its behavior. So that might help too. So right now, so cryo currently doesn't have open telemetry support? So it does have some preliminary support. I think we're still working through trying to get, figure out exactly the granularity of spans. We have it on, we have a number of functions that are like emitting them. I think that's, but it's in like the main branch. It's like not yet been released.  So it's pretty young, but there could have been a demo that we did today, but I didn't have time to put it together where like you actually can't see the spans. Actually, you might be able to find an image I have if I have enough time or send it to you or something of like what that looks like for convoin RS. So we're getting there, but we're not quite there yet. Thank you. With the introduction of convoin RS, is there plans to eventually deprecate convoin itself and then replace it? Yeah, yeah. I would say the longterm, assuming that we can make sure that, and I'm pretty sure that this can be the case, but I just want to maintain that. One of the main ideas is to make sure that the ultimate memory usage is not egregiously more than it was with convoin. Assuming that, which I think will be the case, then eventually we'll deprecate and remove convoin, and it'll be convoin RS moving forward. And then obviously this will move upstream into like open-shift threat or downstream. Yeah, yeah. We're working on pulling it down as well. I wanted to say very impressive work with convoin RS, and I appreciate the description of why Rust might be the good tool for the job. Could you show the slide again on how to switch the CRIO runtime and then maybe elaborate on like what future scenarios people might consider switching to convoin RS to be an early adopter? Yeah, so this slide is the one you were looking for. Yeah, so there you go. So why you would want to early adopt it. So one of the things that we kind of triggered our desire to do this is we wanted better C-group accounting of the convoin resources. So like in situations where you wanna keep the convoin on a separate CPU set, then the container is running if you have a real-time pod that's doing some network latency stuff. You could, you know, that was originally what kind of got us started thinking about having a pod-level convoin to be able to isolate that. So that's one use case.  I would say there was another thing that I thought, why else? Yeah, I mean, so one more thing that we wanted to tackle is like right now when we do an exec right, we are spawning a new convoin. And at study state on a node, your execs are the most expensive operation that a container on time is doing. So we wanna reduce that process hop here. So with convoin RS, like there won't be an additional convoin, we'll talk over our PC to convoin and it'll directly do a run C or a C run exec drastically reducing your CPU usage. The other other thing that I just remembered is actually can help with CPU and memory accounting on the node. So because we have multiple convoins now, it's hard for us to use the pod overhead feature, which was originally made for Cata because you have like a VM that has some sort of standard amount of memory in CPU. But, you know, if we have a variable number of convoins, we can't really well guess how much memory in CPU they'll all use because it's not proportional to the number of containers. With convoin RS as one per pod, we can guess like, okay, it's not gonna use more than eight mags, definitely. So, you know, if that's the pod overhead and then you can more tightly fit your containers on the node because, you know, there's not, there's not this like mysterious amount of memory that's used by convoin. Questions? Over time. Well, let's get out of here. Thank you, everyone. Thank you for the answers. Thank you.


I can open now if you want yeah, I'm already pushing this body.  Just keep going Got it just reset just calling me you can go go go go go go go Watch out for the stun I'm spreading stun on me solo fairing me for help me now I stopped the image on like I got says can't stop Getting refit I can say now we can go right now if you want Knock knock comfie comfie I'm running across running across Trinket we got we got trinket we got trinket chill Let's go watch the knock now ten seconds for it. What's this done?    Okay. Okay.   Just spelling, just spelling Yeah Got it, got it, got it, got it I'm, I'm, I'm gonna stand late I'm gonna couch him, okay? Couch him Yeah, don't hang him up Nice, I'm just gonna put a kid in there, okay? Big damn Yeah, yeah, yeah Dancing late, get to the car, okay?


Go-mul-he, go-mul-he That's a catchy song Every time it came on Go-mul-he, go-mul-he No?    Yeah, that's crazy, right? Yeah Wow, I'm intrigued Anyways, I think they did a big long interview together Which is a crazy pairing It's not somebody You never expect those two to get together I would kind of put together No So I thought that was interesting So he's gonna do a little rapid fire with Satguru We've done quite a few videos, obviously, of coffee with Karan And we've seen many videos of Satguru himself He's always very interesting to listen to Yes So, let's just get into this I'm gonna take the liberty, Satguru, to do what I normally do on my television show Which is a rapid fire round Normally, the end of this round When I was young, I watched a lot of, you know, Wild West movies Right When you fire, I also fire already No, I promise you this is not that kind of... You're not in my line of fire At all I will not take the liberty of being that person These are just quick questions Which when I ask for one word, you have to stick to that Because sometimes you have a tendency of not exactly answering the question asked But you give such a profound and prolific retort back Then it makes you very satiated But in this case, my only request is that If it's one word, then it's just one word That's funny, he's got a preface into that You get a hamper But in the absence of a hamper here You already have something right A cow And all this beautiful bouquet Had to drag it next to you But so there's no hamper But you do will get my... Ranked in terms of acting Thank you Ranked in terms of sex appeal What is the one thing that is essential to living a balanced life? Sense A little uncomfortable What is the one thing we must absolutely do away with In order to lead a balanced life? Senselessness Yeah First thing that comes to your mind when I say the following The first thing, organized religion Madness Marriage Cohabitation Competition Stupid Money Useful Love Say a sentence Yes He's being so respectful I will allow that Most beautiful but unfortunately crippling for most people Little elaborate that See if something unpleasant cripples you Something nasty cripples you It's acceptable When something beautiful cripples you It's a true disaster Very poignant If you could ask one person alive or dead one question Who would you ask and what would that be? I really sorted out all my questions because I did not spend time educating myself or doing anything I spent my entire life sorting out every damn question I had I kind of run out of questions And you certainly have not run out of any answers Best advice you have ever received I never sought, not did I receive I made myself in such a way I'm incapable Either of seeking advice or giving advice In an imaginary completely hypothetical situation If you had a day off with no commitments, no responsibilities What would you spend the day doing? A lot of things this can't be one word No it's not one word See I have an indiscriminate sense of passion towards everything Lots and lots of things I did at one time but these days Time is not allowing me to do that So generally if I have little time all I need to do is play golf Because that's safe and within the city And I can get back in time for something else to be done But if an entire day is left to me Which they have not done for a long time They have not left it to me If that happens I will close my eyes and sit Because that is my, the best, the best I am at my best when I truly have nothing to do What is one thing you'd like people to remember about you At the end of your life? They must live so wonderfully that they don't even remember me If you found a way to travel through time Where would you go? I am kind of done with all those things Your universe visited already You have visas for every platform If we can do some slow fire Yeah because that's a question with many Slow fires instead of rapid fire This, for example traveling in the world We've jettled around and now we want to travel to the Mars We want to travel to another place And now that's not enough We want to travel into the past and future All this longing is again exploratory in nature Whether you go on vacation to Maldives Or you want to go to Mars It is fundamentally exploratory Maybe you're also thinking of relaxation and pleasure and whatever But essentially it's exploratory Otherwise why can't you do it here? It's something that you want to do You want to touch another place This longing is there in the human being Only as long as the life that you are Remains in a seed form That is it did not sprout and blossom This happened when the yogi was expanding the science of yoga And talking about the nature of the cosmos How it's related to your individual self And what you can do with it Then the seven sages who were with him They asked what is the nature of this cosmos How big is it, where does it begin, where does it end So he laughed and said, your entire cosmos I can pack it into your mustard seed Because your ideas of time and space are essentially Because you're living within the framework of your intellect If you cross that dimension Then there is no such thing as time and space Everything is here and now So travelling through time, space No, it means nothing to me Because it's difficult to express Difficult to articulate If I say I'm little I have a reputation of being very logical But if I sound illogical or silly to you You can blame it on my jet lag I just come from United States after six weeks So you can say maybe he was jet lag That's why Sadhguru is saying something silly But I'm fine I'm saying this because You can't fit the universe into your silly little logic Today's human being is too overly enamored With their own logic that they're missing the entire life The gamut of phenomena that's happening in the existence Is missed because the only way you can accept anything Is it has to fit into the square hole of your logic Anything that doesn't fit into your logic You will reject In this you rejected the entire cosmos In this you have rejected the magic of life You have become a slave of logic And completely missing the magic of life So this time, space, all this stuff Is because intellectually you're trying to dissect the universe And try to understand this, this, this Tell me if you sit here Suppose you're very joyful Do you see you will not know how the day passed off And if you're depressed do you see the day won't pass So time is a consequence of the miserable nature of human existence If you are truly blissed out and ecstatic You wouldn't know what is a day, what is a year, what is a lifetime You wouldn't know There have been times I sat down, I didn't realize I thought it five minutes But people gathered around and started molesting my feet Because in their understanding I sat there for many days or whatever This idea of time and space is a very convoluted idea Simply because people are stuck in the framework of their logic My work, my fundamental work is to take people Beyond the framework of logic into the true magic of existence Our own existence But it takes a lot of time Still my reputation is of being very logically correct Because I'm still trying to woo them Still wooing them, you know For the real thing to happen They will take a long time unfortunately Because they have become such slaves of their logic What is the first thing you notice when you meet a person? Just everything Just everything Everything, yeah Past, present and future Is it more important to do what you love or love what you're doing? The choice is entirely yours See, if you're an intelligent person You will try to do what you love most But if you're a genius They will do just what is needed If you could be invisible for a day What would you do? You wouldn't know? With due respect, what is your biggest weakness? Biggest? What is your biggest weakness? See, what normally people treat as weakness In their lives Okay, let me give a normal answer Why am I going to do all this? Already you said I'm what? What's the word? Sashayga Biggest weakness is I love danger Without danger I cannot live I need to do something Which keeps me on the edge of being mortal Being alive and dead I want to walk that line all the time Every day I'm stepping on it one way or the other Is it a weakness? I don't think so but people think So Guru, you should risk your life like this But if there's no risk I feel I feel I'm not being... Because most of the time in my life For whatever I'm doing I don't feel tested It's only moments of danger That I feel little tested So my weakness is I like to be stretched You know For all the time when I was riding across India Later on I started driving My only wish was That to find a machine Which will test my skills Always found the damn things broke down If I took it to my limits These days recently I'm beginning to Get to do a few machines Testing me Whether I can push it all the way or not Maybe that's because of my age If I had met them much younger I think I would have managed to work it out The one thing the world doesn't know about you They don't know a thing about me And the one thing you wish you could change about yourself These are great questions I looked at that I could speak Hindi The one thing you wish you could change about the world Oh a lot of things One Human beings Yeah Desperately made up So what would you consider to be your greatest achievement? I don't think there's any Because I always fall overly short Of my own expectation of what I could do So I never feel Anything is an achievement Is there a song you love and can listen to all the time? Somehow Probably because This Came to me At a certain time When I was In my early teens maybe So this one song Kind of Comes back to me more often than anything else It's not that I even seek it Somehow one way or the other this song keeps coming back to me Is How many times Wow I didn't expect that I did not expect it either Oh I've seen many good Movies at one time I saw a lot of them I've not seen much of Indian cinema But I saw a lot of English cinema But One movie that I Thoroughly, thoroughly enjoyed at that time Because on that day the way things happened Many life situations fell together and everything Was Roman Holiday Classic movie Well I have to say That's the first film I've ever seen in my life Here we are It is true Roman Holiday is the first film I ever saw It's with my introduction to the big screen Really?  I'm going to talk to Bakshan Who would make a biopic first of all? There would be lots of interested people And to say a big B would be mine Maybe we should animate I don't think you would want that Well, that is the end of the rapid fire And you totally deserve the hamper That doesn't exist on this platform But it's a virtual hamper That I've given to you with my love gratitude And deepest amount of respect Thank you That was wonderful Great questions It was such an interesting I think there's an entire interview before this And it's kind of how he ended his I'd love to see that His time with Satguru But it seems like a lot of fun Especially with the pairing of them two Who are I can't think of two more opposite styles of people The one thing they have in common is they're both human beings They've got that in common but everything else And I really I think every question was Like if you had an opportunity to talk to this man And ask him some questions Those would probably be some of the ones I would come up with You know And Suffice it to say It's kind of an understatement He's on a completely different wavelength Yeah He is just I loved All of his answers But it's like if you could change one thing There's a lot of things about the world I'd like to change Like yeah but if you could change one thing So what made you get clums to mind Or what are the things you could change I'd like to get rid of greed I'd like to get rid of nuclear things I'd like climate change I'd like to end poverty He covered all of it but just saying Let's change the human beings The 7 billion parasites Every problem we have Was us So let's change that He's on a completely I'd love to see a full enter Anytime he talks He seems like such a He's poignant His wisdom is unprecedented He's pretty funny guy And my favorite thing about him Which is my favorite thing of most people I admire Is that there's no Filter There's no Presenting something He is just himself He's genuine He says what he's thinking There's no pretense He seems like he's both a guy You'd probably have a lot of fun golfing with But you would also have just a lot of Just soak in I've never heard anyone answer Questions Or say things the way he says them I can't think of anybody that I've ever heard That talks the way he talks That was really interesting 2017 And great job by Karen Johar Those are great questions He has 9 million YouTube subscribers That doesn't surprise me I didn't know you had a YouTube channel Do you think he runs it? No Neither do I I bet he doesn't even think about it He just has his team of people who says it's time to go do this He's like okay And he does it And he's off to the next thing Also it was shocking that he plays golf I did not peg him as somebody who I expected him to say To be sitting in silence That's his He loves doing that But for just leisure time No Now I want to talk to him about What kind of clubs do you like to use Do you prefer playing on par fours How's your short game What's your handicap Don't lie That was great Any other interviews that we can react to From Karen Johar Any golfing videos we've got I'd love to see what this song looks like Absolutely Let us know down below


Alright you guys Even though Jeff and I are away on our third anniversary cruise I didn't want to leave you guys hanging. I wanted to post something still every day for at least 365 Gotta have goals, right? So I'm posting something for you every day on this channel Either a demo or a product review or a new kind of artwork or new technique New color something every day just in case We don't have a very good cell service on the ship and Can't livestream or post Since we are going into a tornado hurricane Thunderwave whatever I Don't know who knows what will happen. So I wanted to be sure so I'm gonna post something every day And you know they may confiscate my art supplies as I'm getting on the cruise ship or in the suitcase Who knows then again? What am I gonna do with a heat gun like knock on the cabin of the captain and say give me The keys and hold them up with a heat gun. I don't think so. So I don't know who knows better safe than sorry, so I'm going to Art for you guys so this particular video is going to go over the differences in stonecoats base tin and Other brands so for the sake of this video. I'm using colored sessions Snow white Paste and It's very good brand. It's I love it just as much as I do Casting craft artists use white just resins white Leresa's white It's all good. It's all Pretty similar in the way that it reacts with other colors while in resin The thing I'm gonna demonstrate today is the difference in stone coat versus The other guys so the difference mainly is that this has an oil property to it And while I still stand behind the fact that you should not put oil paints in resin because it will either a Pit to the end of the earth or it will leak out like the shining all over your floor I know this for a fact happened to me don't want to know so What I'm gonna do for you guys today right now is a Demonstration on how to work with these to make them work best for you for what you're going for So if you're wanting a frothy foamy Cell like for an ocean pour that has like tighter cells Like a wave basically you're gonna want to use a pace right and If you're wanting something that has larger cells made for a larger painting or you want some like webbing or lacing You're gonna want to use the base tint from stone coat and How you use the pace versus the base tint is very different in that with the base tint you want to push color Over the base tint stone coat based it needs to be on the bottom because the oil properties. It's going to Alter the surface tension and like diffuse the cells. I don't know. That's the right word. We're gonna call it an e-science word disperse cell dispersion That's what's going to create the cells is the oil property Think of like an oil slick or something like that You want the color to go over it to create your cells whereas with the tense? Nope the pace You want that to be on top of your other colors? So they each react to surface tension differently, but I'm gonna just Do a demo for you guys so you can get a visual.  Let me get that logo out of the way There we go So I'm going to use the base tint white from stone coat Snow white from Color obsession Which is available on my website or select that come And I'm gonna use equal amounts of those and then I'm gonna use a new color that I haven't used yet But Jeff just discovered that we have it so he's super pumped about trying it It is dark turquoise by color obsession And I'm also gonna use a little bit of the gold that stone coat is releasing Because it's gorgeous. I'm not using too many colors in this because the point of this is To demonstrate the differences not really Create some fantastical Piece of our work, although I do hope it comes out fantastical brand new Anytime you get a paste or a new paint or Well any time paint really make sure you stir it up if you run into a paste that is thickened or looks like kind of Dried out or separated a little bit Put the cap back on and running under some hot water and that should Help everything mix back into where it's supposed to be now for most powders paste tints, whatever The standard measurement is 10 percent paint to resin That's a starting point if you mix too much paint into your resin you're gonna end up with a Chemical imbalance basically and you're gonna have marshmallow fluff instead of nice flowing smooth resin Don't want marshmallow fluff. I've made that happen by accident on some of my videos. Just tune back It'll be there. So I'm gonna go ahead and mark this arm color obsession Where am I? Where are you color obsession? And then this one I'm gonna mark Stone coat Hopefully you can see that The only pin I have is a micron and Jeff would kill me if he knew that I had Resiny fingers on his new pens like he hasn't even used that pen yet He'll be fine so If you haven't used any of the stone coat base tints yet because of its enamel or oil like Um Makeup it does have a slight Odor some people like it some people very sensitive.  This is a no VOC Um resin So unless you put way too much heat on it, you're not gonna smell it So this is the color that we're using where am I? Where are you dark turquoise? Of course, it's not gonna focus Because my life There we go. It's dark turquoise by color obsession. I do have some of this in stock currently however Things change as videos post so if you Go to the website can't find it have questions shoot me an email Thornton at artistilldebt.com to tease to elves and I'll be happy to help you out Answer your questions and Reorder paint that's out if If you can't find it Okay I don't know if this color is going to show true on the camera because the Lighting is set for p.m. And it is currently very am But it is a gorgeous deep rich teal turquoise color And the last color we're using is the new gold from stone coat. It's very glittery very extra And I love it everybody that's seen it has loved it. It's like a metal flake. That's what it looks like It's very glittery and it goes very airborne. So If you don't want it to look like a pixie farted in your house Um, maybe not use it because it's very extra In fact, that's my bid for what they should name it. Let's just call it extra When you mix the powder or glitter into your where am I? Into your resin. I just basically just gently fold it until it's a little bit more incorporated That way less chance of things flying out And getting all over your studio house kitchen Just liquid gold y'all Oh Luckily, I don't know how they did it, but it's beautiful. All right So i'm not going to put the clear down like I usually do because this is just a test I'm going to here's okay. Let me just Tell you what my plan is Look at me here. What my plan is is that i'm going to do The stone coat white on this side The color right here and the color obsession here because I want to swipe The color obsession white over the color and then the color over the stone coat because that's kind of the order it needs to be in Color obsession the paste needs to go over the color Unless you're using stone coat then that needs to be on the bottom So this is stone coat and since these cells expand further than The paste i'm going to do almost half Just filling in all the voided areas Having some resin down first helps Your design flow over your substrate more easily So then i'm going to do the color And I really hope this color shows on camera because it's Kind of amazing. Also, I may need more color That's okay because I have some resin left over That I can make some more So we're just going to do that real quick A lot of times i'll keep um Some clean resin set aside just in case There's a color I feel like I need more of or If I need to fix something or if I decide to do the edges a different kind of way better sakes and sorry People ask a lot of times how we figure out how much resin we're going to use and ultimately There's so many factors that go into how much resin you should make. It's really hard to say I know that Art resin has a calculator. It's Not really accurate for our use But it does help a lot of people so that may be a good place for you guys to start I'm going to talk to stone coat about putting a Usage chart up on their website This is very opaque and i'm just pushing it just to where the Base coat is I'm not pushing it into it because i'm going to do a swipe and I don't want to contaminate my gloves With the other colors Now this is the color obsession White i'm going to just Finish off this side And I have a little bit left up both whites. So that's cool Just in case I get a stain On the other areas So so far there's not a real noticeable difference. They're both really opaque See that's what i'm talking about. I'm going to have to fix that But since it's going to be a swipe And it's just a test It'd be fine Now i'm putting some gold into this because it is amazing And I just want to use it All right So i'm going to put a little heat on it You don't want to do that much when you're trying to get cells use as little heat as possible because You use too much heat Then your resin will be too liquid and even if you get cells that you really really like They won't Hold up while it's setting You just want to put just enough To pop the bubbles out of your surface Do quick passes until you don't see any more little bubbles popping. It shouldn't take that long And it all depends on how much um how quickly or how briskly you mixed your Your resin up. So i'm using a bent spatula. Nope. That's not what it's called. But you know what I mean And i'm going to just swipe Hmm Yeah, I think i'm just going to swipe into The color I think this is wide enough that it won't make this white travel into this way and if it does it won't go that far So it'd be fine And I might bring this back into this way because something that's great about the pace that Isn't really a property of the stone coat is This will sell whether this pace goes over this one or this one goes over this one whereas The the base tent really needs to be on the bottom to work. So I could swipe this over this But it won't work the same if I do this over this. That makes sense. I hope it does moving up So when you swipe you don't want to go all the way down to the Surface your canvas. You just want to angle it slightly and lightly just Push the resin over the other colors Also after each pass you want to wipe your spatula off Now I think i'm going to do this over this You can see cells popping up over here not so much yet over here But if I bring this back this way Maybe it'll yield better results This is going to sell whether I hit heat on it or not whereas this kind of needs Heat and motion to more work So Let's do that Now usually with this heat gun, I will push the resin around but for the sake of this demo I'm not going to do that just yet. I just want you to see the differences in the cell structure Of this Side versus this side So you can see the cells starting to pop up over here and in here And you can really see where Stonecoats cells are making magic Also that gold is losing its mind So let's take our experiment a little bit further And let's push it around with Well, hold on this is a little bit too organized right here So i'm going to kind of break that up. I think and swipe this way Looks the same amount of organized, but I like it So let's push These colors a bit And see if we can make something more magical happen Give it a second. They're starting to pop up. They're kind of smaller, but They're still present And what I was saying earlier is it kind of all comes down to What kind of cells you're looking for what kind of Y'all this top corner is doing some banana stuff. I'm gonna have to show you I wonder if I can I may be about to ruin this piece, but I want to try something if I can get my life together real quick Okay, so I don't know if you guys can see this but Like there's peek-a-boo cells right here and it's like glittering only in the cells It's kind of sandwiched The gold under the color of session white But on top of the stone coat white I hope that's focusing like I would like it to but who knows So I'm gonna see if I can Exploit that just a little bit And maybe work it into this part I don't know if it's working I don't know if it has to go all the way over The stone coat part, but It's starting to pop up a little bit over here. Maybe if I use a little bit more of the color of session White and push it over I'll use all my teal again Now wipe off your spatula There's some glittery cells popping up right here So as you can see the difference in cell structure And size is very different Let me switch you guys over to just lucy cam So there's that piece. I hope you guys like this quick tutorial I will be back tomorrow with another one Don't forget to check out our website if you're interested in any of our colors or if you haven't Any questions anything at all that I can help you out with Hit me up. Send me a text or an email or Whatever thornartistallette.com Um If you're interested in any stone coat products use the code ATD all capitals to Get 30 off your $50 order. It looks great on us and we appreciate it so much Y'all are bananas and I'll see y'all manana. Bye I said bye