Hello everybody and welcome to another hobby cheating video and today we're going to talk about something pretty important. Why it's okay not to be happy with your work. Recently as you know I've been working my way through my rat cast trying to get my army ready and this is an army I'm taking to a display standard. I put a lot of time into every figure. It came time to do my night Vexelor and that's basically a banner bearer guy and his standard banner comes with some engraved detail. I don't like engraved detail in banners so I cut it off and shaped a piece of plastic card to be my new banner. It was blank and I thought fantastic. I'll do my own symbols, my own iconography. I'll make an awesome banner. I was inspired by this piece of art what you see up on the screen right now. I just think this is the coolest thing. I think the Celestin Prime looks amazing but it would be very hard for me to translate this into something the size of basically an inch by two inches at most. So I decided to just draw on the color palette and make my own banner with my own icons and images and things on there employing different freehand and that but that general color tone to a cool effect. In the end I wasn't happy with what I came to but that's all right because I learned a lot and I'm going to take you on this journey with me give you some tips on freehand and how to work your own banners and importantly how to know when it's just time to be satisfied and move on. So let's see what this journey looked like. Let's get into it. The strict technomancer that is Vinci V. Let us get into the technique and learn it Vinci V style. All right we're going to begin today by just doing some some quick color down on this banner. What I'm trying to do here is set an atmosphere a tone. I don't actually care about how smooth it looks and in fact I want it to be rough for reasons you'll see later. I'm not using an airbrush just some mix of yellow and white because I'm trying to set an overall ambiance. That's the part I'm drawing of inspiration from the original art piece and part of my goal in laying this down is just to create some interesting transitions throughout the banner. Now you'll notice it's very streaky that's okay don't worry that's going to have value later. What I effectively want to do is have this light from below thing reaching up just like in that original image and then spreading out to sort of darkness on the sides and fading in the light from above. I think oftentimes we try to get very smooth colors out of our you know out of our paint and most of the time that's usually the right answer but just as though sometimes we want to be rough to create textures with things like fabric we can use brush strokes and things like that to communicate visual information. So here what I'm doing is I'm laying down the airbrush color over the top but a little bit of that of those streaks are still going to show through and what it will effectively do is it will make the banner itself feel as though the light has rays to it as though it's traveling in a direction. It will create movement within the image and that's much more visually interesting than just the flat perfectly smooth colors. So sometimes roughly sketching with your brush first and then going to the airbrush can be a great tool. Now I decided this was way too annoying to do on the pole still so I took the snap the banner off the pole and now I'm just going to do it here because I have much more control for the freehand and here's where you see me making my first mistake. I'm doing the same custom icon, link is up in the corner if you want to see how I do these but I'm making it way too small. Now I end up adjusting a little bit you'll see in between this image and the next but right away I should know that the golden rule is that freehand images within negative space need to be at about 50% of the size but I'm just laying it down. What I want to talk about here with freehand is when you're doing complicated freehand the key is start from the simplest shapes as I did just a little cross and then I connected that to the circle and then I'm making the arrow at the bottom but break freehand down into its simplest constituent shapes and then fill everything else in. So as I filled in that shape can make my icon for my rack cast I then wanted to do just a little outlining. Now I think a lot of people find doing this kind of edge highlighting on nothing that's kind of tracing a thin line to be very difficult and honestly sometimes it can be even I have challenges with it but there's a simple trick. If you are trying to do a thin line push towards the inside so you mess it up a little bit into the darker area there into the area you're trying to outline and then go back with your original color i.e that dark sea blue black that I'm using here and fill in and push towards the edge. I actually have a video about this linked up in the top. Now the storm cast the new storm cast the thunder strike storm cast have this like gem iconography about them and somewhere on all of the new storm cast is a little blue gem and it's always a diamond gem like a diamond shape and I thought okay cool let's translate that over into the banner so I'm going to put a little diamond in the normal of my or in the middle of my normal symbol and one of the ways to creating the freehand of a three-dimensional object like a diamond like this where it's meant to be reflecting light is you need to create the planes of light that separate it from what's underneath a little four part four facet gem like this is very easy one of your planes is capturing the most light the opposite side should also be quite bright and then the two opposing sides need to be varying levels of darkness with one being quite dark usually toward the top and one being just moderately dark down at the bottom now we come to the part of this I actually really like and I'm really proud of and that's the lightning and I thought this would be a great thing to share with people so lightning I see a lot of people freehand lightning often it doesn't look great uh but the key to lightning is to be one extremely thin so I'm using some uh white and blue paint mixed with flow improver to keep it moving and moving nice and thin off the tip of a very sharp brush the next thing you want to think about with your lightning is it needs to be directional it always travels in one direction it's striking to somewhere but it does not take the shortest path to get there it is circuitous it has squiggles and wiggles and double backs and so you want to be shaking your brush almost as you're doing this the next thing you want to think about is that lightning branches so it doesn't have just one bolt it often has little tiny streaks that'll come off of it little extra things that'll be attracted uh to other you know things it's wanting to strike against and so you need to squiggle the brush and then make little branches think like a tree of it coming off of there and just squiggling and wiggling and doubling back in other directions the final and most important part about lightning is you want to make sure that you vary the pressure of your brush slightly as you're doing the squiggle wiggle that is to say some parts of the bolt will be thicker than others and so we do that in multiple ways the first thing we do is we push down on the brush more and then lift up and push down and lift up as we're squiggling and wiggling to create different thicknesses of the brush stroke but also then we're going to go back at the end you'll see here in just a moment and we're going to start filling in the areas and what I tend to focus is wherever there is a branch so wherever the bolt is breaking off into other smaller bolts that's where we're going to then go in and fill it in you can also put secondary bolt lines that are very thin next to the actual one it sort of has this feeling of breaking out everywhere now here I'm using a light blue green and I'm just giving this nice glaze I am not glazing over the bolt directly sometimes I go under it sometimes I go over it sometimes I go above it in any case though I'm just trying to add a very slight I mean this is a filter this is almost having no effect and that's because I just want to add the concept of the blue here not to turn the thing blue it's about capturing the ionization in the air now it's time to start making up for mistakes because I have all this open space on the sides I thought cool let's do some banners now doing a little banner and making it look three-dimensional is actually very easy it's effectively just copying what's modeled onto a lot of things in 40k and stuff like that but you roughly make a shape have it fold back on itself and then go the opposite direction and you can see the shape here notice the first time I painted it it was almost invisible to the underlying colors that's because I was using a very thin very neutral watered down paint to just block in the rough shape then if I need to make adjustments I can do so and covering that paint up is easy to make it three-dimensional we're going to need to create shadow underneath it an occlusion shadow effectively so here on the lower sides I'm taking some dark sea blue but you can use any dark color and just tracing a shadow underneath to oppose the shadow we have to have a light so on the top sides I'm taking basically a pure white and I'm edge highlighting the top edges of all of the banners this makes it feel as though it's three-dimensional your brain resolves this as a three-dimensional shape because there's light hitting the top and a shadow underneath for bonus points you can actually take some very thin to down color of whatever your shadow is and glaze them underneath underneath the the lower area I'm then just adding a little bit of contrast and tonal variation over the piece where in the upper areas have a little more brightness never going up to pure white but being a little brighter and the lower areas having a little darkness never going down to the same black that's underneath it but just being a deeper tone that then creates the variation of both hue and value that we would expect across this surface now the next thing I'm doing is just making sure that the top has some very thin line that shows it separate and I'm using a light warm brown color just extremely razor thin on the top side because there's no shadow there it's just a little bit of a difference we almost want to communicate the concept that it's lifted off of the thing but we want to be very thin seeing there was still too much negative space I decided to make some gems and at this point I'm really stretching because what I should have thought is oh this is wrong and started doing a border or something but I didn't these gems are done in the exact same method as the original gem in the center of the thing but again it was just about filling the space and trying to make more visual elements that were interesting to the viewer right here I'm going to jump in to say I'm breaking several of my own cardinal rules on freehand I've talked about in previous videos which is use the negative space but because I had these different color tones a couple of which I don't need I ended up shrinking things down smaller than they should have been this is a mistake but I don't really catch it until the end when I take in the whole piece and realize it's not quite living up to where it should be and I should have made some different choices but again that's okay because sometimes you've got a sticky finger in the light socket to learn so what should I have done differently well I should have had a border around it that was my start most historical banners have some kind of border because again it frames it against the negative space of the rest of the world and against the banner itself I also should have expanded the size of the central icon from there honestly I should have planned a little better I kind of went into this with a different idea ended up scrapping it and then I was going on the fly and what I should have done was stop slow down and make a new plan so let's talk about the most important element of this when do you decide to stop and accept and when do you keep pushing in this case I'm making an army for a tournament and I'm really up against it on time so I have to accept this and move on and that's the reality a lot of us have many things we're trying to paint for various reasons we have to move on we have to accept it and that's okay if you have as the other problem is sometimes you just get frustrated you're done with a piece and you want to move on there's nothing wrong with that either put it to the side and work on something new but take in those learnings if you do want to keep pushing though then keep pushing the point of this is to say neither of these is a hundred percent correct there's no one answer the point is to do what's right for you at that moment is it right for you to keep working to keep pushing to bang your head against the wall if it's a competition piece that's probably the right answer if however you want to get the rest of your army painted if you've got a tournament if you want to just keep learning and painting new stuff then put it to the side it's fine the goal is to be satisfied but never happy to look at the mistakes you made take them in understand what you could have done differently and not make those mistakes again in the future so as I finish up this banner let's go back to the table and see what kind of summary thoughts we have for everything so what did I do right well I think the lightning looks good I think the change on the icon actually works and it really there are elements of it that I enjoy and then I think are cool what don't I like well it doesn't fill up enough of the space and it has too many colors it really doesn't need the yellow in the end I should have brought that all to red that also would have made the lightning more visible so oftentimes our projects that we're not happy with don't be beaten down by that it's okay we're all going to have them I've been hobbying for years and years 20 years I've painted thousands of figures and still this happens to me so when it happens to you don't get down don't let yourself get beaten up think what did I do wrong or what don't I like and what can I do in the future so I'm going to show you some pictures of it of the final model it's still fun and I'm still proud to have it in my army and most importantly I'm happy that I learned the lessons that I can carry forward to the next time so thank you very much for watching this final shots like I said are coming up give this a like if you liked it subscribe for additional hobby cheating in the future if you've got questions drop those down below I always answer every question and comment all right thank you for watching this one and we'll see you next time


Shura is a private public intubator that runs autonomously. So the institution arrangement between the intubator and McKay University and Naro was a key challenge at the beginning. How do you have an autonomous institution promoted by public institutions? So there is always a task to say we want to control it, we want to be part of the university or we want it to run autonomously because it can raise its own financing and build and grow as an organization. That was the first challenge you had to work through and thank God McKay and Naro agreed to start Shura as an independent organization only promoted by the public sector but running as a private institution capable of raising its finance, capable of growing as an organization and not be a project driven entity. So that was the major challenge. Besides that having started with a grant as a seed transitioning from grant into an organization is also very challenging. First of all when there is no direct government support support the institutional setup becomes extremely difficult. Thank God the university provided Shura with the buildings to work and start with so there is no rent overhead. With that in place Shura had managed to attract new partners to grow the organization from the first initial project into a successful intubator. Shura had managed to attract new partners, new funding and it has expanded and actually set up its own head office way beyond the university confines and it's now a national organization. So those are the key challenges and that's how Shura tried to work through them to establish itself.


Thank you for the invitation to speak. It's always nice to be back at Cambridge. I was realising as I sat here, I first sat in these rooms nearly 25 years ago. Which is terrifying. I'm a patent litigation partner at Freshfields. But I also do some competition law. Saying that to people tends to make a lot of IP lawyers look at you like, you say you live in a Brexit area and speak a foreign language. I've got a similar warning from the organisers saying, Remember most the audiences are IP lawyers, they won't understand much competition law. That seems a bit like the warning Stephen Hawking got when he wrote his book of Every time you put in an equation you'll have the sales of your book. We've already had chemistry upon board but that's okay for our IP lawyers. So, this is all I'm doing in competition law. Hwnna, beth mae gydag wedi ei beth o'ch ffwrdd. A dyna rwy'n meddyl i'r mwyaf arall. Ond yna, y dyna'r topicau, oherwydd mae'n dweud ar gyfer bod ydydd y cysylltu yng Nghymru, mae'r ddau cymryd yn gyffrifedig, a'r ddefnyddio'r ddau'r ddau, felly mae'r ddau'r ddau'r cyffredig. Dydag, mae'n ddau'r ddau'r ddau'r ddau'r ddau. Y c Honestly is how this market works… We often think about the market in very simple terms that there's the patent owner, they've got their drug, they've got a monopoly and then the patent goes and everyone flows into the market and the price crashes and it becomes a commodity product. That's kind of our simplified view of it and that's what we often talk about in the patent scope when we look at preliminary enjunction cases. It's not always quite like that, if you auch a generic company… Yes, you can make a bit of money like that, but you can make a hell of a lot more money if you are the only generic company to come into the market rather than one of many, many ones. Teva, and I always forget it, Teva used the term first and alone. They want to be first and alone, the first and alone generic company. I'm afraid I always think of Chesney Hawks with that. Those are the right vintage and maybe Professor Bentley can tell me why I think of Chesney Hawks with first and alone. I was checking your paying attention. The one song, his one famous song being one and only. So if the competition stuff too much, just remember Chesney Hawks, one and only, that's what actually most generic companies want. They want to be the one and only generic company in the market because then they can make some real money. But what are the competition topics we're looking at? Well, I bucketed them to three real types. The patented drugs where there's settlements, pay for delay. There's other patented drugs issues which are discounts and then some other related issues. And then there's the off-patented drugs where we see price rises or the price gouging cases. And they're really quite different, but they often get merged again, particularly if you're an IP lawyer and don't like competition law. It's all kind of competition-y stuff, but I'm trying to split them into these three buckets. Starting off with the settlements, that's what gets people very excited, that gets the headlines. It's got pretty boring now, to be honest, although all the cases are coming through. I'm not sure we're getting very many surprises. The pharma sector inquiry was in 2008, 2009. And that was with a great fanfare and all the outrageous things that pharmaceutical companies were doing like having a toolkit and life cycle management. All these things that everyone had talked about at conferences very openly for dozens of years, but were suddenly secret things that had been found out by the commission. That came down in the final report in the pharma sector inquiry and one of the big issues that was still seen as outstanding was pay for delay settlements. And the way that you described that is a generic company threatens to launch and then settles with the innovator paying them a very large sum of money. And if that wasn't part of a pharmaceutical patented market, I don't think anyone would see a surprise that that was anti-competitive. I would like to launch a new market. Here's a large packet of money to not launch in my market. Okay, that'll do. You kind of understand why that might be seen as anti-competitive. These cases really then dried up pretty quickly. The commission put in monitoring so they had to be notified every year and we rapidly saw those kind of cases falling away. And if we look at the three judgments that are coming up, we've got Surveyor generics and Generics UK, which is just, we've had the judgment and Lundbeck. All of those were conduct in the early to mid 2000s. It's all pretty old conduct. Yes, we're 2020. That's just a reflection of how fast competition law tends to work. We have had the judgment of the court just before Brexit from the CJAEU on the 30th of January. And that was a pretty clear statement that that kind of reverse payment is typically going to be anti-competitive. There were some wonderful blogs with those involved in the casing. No, no, it doesn't really say that. But if you read it, it's pretty clear that's what it says. If it's a very large payment, if there's no explanation beyond payment to keep off the market, then it's going to be regarded as anti-competitive. And it's a long judgment because it goes through all the very clever arguments the lawyers have come up with to say, well, it's scope of the patent or it's this or that. Most of those have been rejected pretty clearly and that was following the Advocate General's opinion. We do have this week another Advocate General's opinion coming out in the Lundbeck case. It's the same Advocate General. So I don't want to bet on what the outcome will be, but I can't imagine it's going to be a complete reverse turn. And then at some point we'll get the survey judgment. None of those cases really tell us, I think, very much new. And the question was, should this conduct be regarded as anti-competitive? The US Supreme Court a few years ago told us, well, it's a rule of reason. We need to look at the facts. We are looking at the facts, but these aren't particularly good facts in most of these cases. So it's hot because it's coming out new, but I don't think we're learning very much new about these ones. The more interesting ones, I think, are those in the US at the moment. I've mentioned one and I've got another one to talk about. Baltimore and Abbey is quite interesting because that's a challenge to Abbey's conduct in trying to restrict entry of competitors for Humira. Humira was the world's biggest, most profitable drug for a number of years, and so big money involved. Lots of the stuff is what you would expect in the normal case. What is, I think, interesting is there have been a number of settlements with Humira where entry was allowed in Europe now, effectively, but not for a number of years in the US. And these competition cases, among other things, are challenging that and saying doing a settlement where you allow differential entries in different jurisdictions is anti-competitive. That's interesting because that's what most people are doing. In the light of the, you cannot pay people to not enter, then a lot of people have been crafting jurisdiction by jurisdiction entries. I think most people think those are not anti-competitive, but we've got a real challenge in the US saying, well, we are anti-competitive if you do this. So I think that's a case to watch because that maybe means that a lot of the settlements that we're doing now might be at risk if that succeeds. I don't think it will, I don't think it should, but if that succeeds, then some of the current approaches we think are okay, may not be okay. The other one I think is interesting is Staley and Gilead. I read a dismissal judgment this week. And in that case, particularly if, again, there's lots of parts of it, the interesting piece I think is in relation to a settlement agreement between Gilead and Teva, which had most favourite entry and most favourite entry plus clauses. And most favourite entry said, we will give you as good a date for entries as anyone else. So we're not going to let anyone else come in the market before you can. So if we settle with other generic companies, they can come in the same date. Most favourite entry plus said, you know what, we will let you enter first. We won't let any others enter until at least six weeks after you in one case, or six months after you in another case. Gilead sought to get that struck out saying whether this does miss, there's no competition problem here. The court said, well, there might be a competition problem. The most favourite entry may be not a problem because we're just ensuring parity with others. Most favourite entry plus where you give Teva the first chance to get into the market, the first and the only one they want, that might be competition. So we don't, again, we don't know quite where that goes. But that's another area where we're prodding the edges of, right, we know pay for delay, straightforward, big payment, that's going to be problematic. But even on allowing early entry, if it's jurisdiction by jurisdiction, that's being challenged if it is allowing one to enter before others, or possibly even promising we will give you as the most favourite nation type that may be problematic. So as a settlement case, that's why I say I don't think they are really so exciting, but there is more interesting developments in the U.S. And the U.S. also led the way with pay for delay. We saw that happen in the U.S. significantly before we saw it happen in Europe. Right, what about other cases? As you can probably tell by the fact I'm speaking too quickly, I grew up in Scotland. And as many of you will know in Scots criminal law, there's three potential pleas you can give if you're accused of a crime. Which are obviously guilty, not guilty, and a big boy did it and ran away. And those lead to the formal legal conclusions of not guilty, guilty or not proven. The first two of these cases I put in the not proven category. So in both of them, the competition markets authority in the UK investigated discount schemes. So where discount schemes are being put in place by a pharmaceutical company, with the goal of restricting competition, so it would say the CMA. In both those cases, the CMA checked and I haven't said, well actually we're not going to make a finding. In both those cases it's enter nasty letters saying, but don't do it again. Renwickade, we get a bit more because we've got a very detailed no grounds for action decision. We know a lot less about the first case. But there is a nervousness about how discounts work. But particularly the Renwickade case is quite interesting because the CMA's decision says, well they tried to use discounts to block entry, but it didn't work. So we're not finding it to, we're not taking action because although they tried to do something we didn't like, in fact it didn't work very well. And I think that rebates and discounts are a really complex area of competition law more generally. These aren't particularly to do with patents or the IP side, although with Renwickade it was about that period of products coming off patent. But there are real complexities if you're thinking about these schemes, basic work, think about getting some advice and make sure you think about getting advice from an external legal counsel not from your economist because otherwise you may end up, your documents go in front of the court which you might not want. The other two cases I think are the quirkier cases. We had the AstraZeneca case some time ago. The two types of conduct being challenged there were AstraZeneca filing for supplementary protection certificates, which Trevor's talked about a bit. But rather than providing the dates on which marketing authorisations were granted in some countries providing the dates on which the product was price approved or reimbursement approved. And the criticism seems to be that AstraZeneca, when they did that, didn't say that's what they were doing. They just provided the date in the form and didn't say we think we're entitled to use the date of pricing and the price of date of reimbursement rather than the date of authorisation. That went through the courts and the courts later decided you couldn't use the date of authorisation but it was fine not to be anti competitive to try to do it. That always seemed to be quite an extreme case because even if you think that was trying to push the limits of the law it seems a bit difficult to see why that is actually anti competitive. And there was a lot of concern among the IP world about what's it's going to lead to. What it's going to lead to was the Pfizer case. The Pfizer case, Pfizer had screwed up and had failed to file some SPCs and certain jurisdictions. In those jurisdictions they use a divisional patent then to file the SPCs and the divisional patent. Any IP lawyer looks at that and thinks fine what's wrong with that. Don't see what the problem is. The Italian competition authority investigating said that was anti competitive because you're trying to block competitors. Yes that's what patents and SPCs do. There's nothing very weird about that. Went up an appeal, the appeal court said rubbish, nonsense, this is not anti competitive. Hallelujah we've got some sense. Went up to the supreme administrative court who then said no no no the authority got it right. That's anti competitive. Really really hard I think for any IP lawyer to understand where the problem is there. Even trying to say I'm not an IP lawyer I think competition law. But that's challenging and I think we still have some challenges there particularly with national competition authorities who can take a very strong view of a case, think the conduct is wrong and therefore go after it. And then we turn to our third bucket where we've got completely off patent drugs. I think these are some of the most damaging cases for the pharmaceutical industry and they're not being done by innovators in large part. Although you'll notice Pfizer up at the top on this. They're generally not being done by the innovators but the innovators get tarnished by these cases coming through. We talk a little bit about the Pfizer case. The Pfizer-Finn case was about a very old epilepsy drug called phenatoin which Pfizer so does eponaten. Price had gone to next to nothing in the UK market. Pfizer weren't particularly interested in it. Flynn came along and said to Pfizer you know what we'll buy that drug off you. And we can put the price up. Because actually there's not much of a competitive market for that. We can put the price up on that. You might not want to put the price up because it's part of your basket of goods and you might not want the sort of response from the authorities if you put the price up. But no one knows who we are. We'll whack the price up. The documents and the decision are fascinating on that. And that's what happened. Flynn bought the drug off Pfizer in the UK. Whacked the price up massively. NHS got very upset. CMA investigated. CMA found a competitive conduct both by Pfizer and Flynn. Pfizer were still producing the same drug from the same factory. It still had the name eponaten on the individual drugs because it really was the same factory. But Pfizer were charging Flynn far, far, far more than they'd been charging the public. And then Flynn were putting their own mark on it. So there was two stages. There was clearly an agreement there. So article 101 going back to our basics of competition law. But the CMA went after it as an article 102 problem saying this was a dominant position. And that there had been abuse of that dominant position. And they went after it very strongly. They said this is clearly terrible conduct. But they really tried to push some points about market definition and also about how much of a high price becomes an abusive price. And they said for a generic product abusive price is really not very much over cost price. If it's very much more than cost price then that itself is going to tell you it's abusive. That's not consistent with most case law on abusive pricing. That would really push things forward. But it wasn't a great facts case. I think anyone looking at that and looking at the documents that came out in particular about why it was being done. Not a good facts case. CMA was challenged before the competition appeal tribunal. Competition appeal tribunal said all very well it's a bad case. We should be applying the law and the law doesn't say that that is an excessive pricing. That's not the test for excessive pricing. Please CMA look at it again. CMA didn't say fair enough we'll look at it again and try and find a more normal way of dealing with it. It has appealed before the Court of Appeal and super-helpfully the judgement comes out on Monday. So I can't tell you what the judgement was going to be. I've not seen it and if I see that I wouldn't be able to tell you. But it feels like it'll go one of two ways. Does the Court of Appeal think this is really bad conduct? We should be allowing this bad conduct to be taken out. So the bad facts piece in which case the Court of Appeal may reinstate what the CMA did or something along those lines. Or does the Court of Appeal take the view that this is important that we have the framework right? Therefore we follow the competition appeal tribunal and say this needs to go back to be done properly. You can't short-circ it just because it's a bad facts case. You can't short-circ it the law. I would think and hope the Court of Appeal will do the latter. But we'll find out on Monday because I'm not going to put it more than that. Then there's a whole slew of other CMA investigations in this. And this is not a surprise. If you do any googling on this you will find the NHS published long lists of these long-off patent products where there have been price spikes. So this has been known for years. The prices go up. Why are the prices going up? Because it's generic and anyone can compete. Well the problem with lots of generic competition is the price spirals down and down and down and down until it hits cost level more or less. And then people say well I can produce this drug and make next nothing on it or I could produce some other drug and maybe make a bit more on it. So people start dropping out and dropping out. And then eventually one generic company looks around and says no one else is making this drug. Let's put the price up. Like you would expect to happen in a competitive market. What is a competitive market then? Other people say they're making money from that. That's a bit interesting. I'll start entering the market. And that's exactly what we do see but that takes time. And in that time the price goes up and up and up. And we've seen that there was a decision in the North Tryptoline case today. This is the third one from the bottom. That came out this week. That was a product that was first marketed in 1963. Patents, IP, nothing to do with any of it. Last year, in 2018, the most recent figures we've got the NHS prescription data for, the sales to the NHS were £3.5 million. On roughly the same volume in 2014 and 2015 it was £27 million and £32 million. For a very long off patent drug where the price had shot up to that level. How did it shot up to that level? What the CMA tells us is that it shot up to that level because there had been a cartel, there had been a conspiracy between the first player in the market who was pushing the price up and someone else who was coming on the market saying, okay guys, you can supply some of that, we'll supply some of this. So there had been a price agreement that way. And then as more came onto the market there had been information sharing about what was happening and where. So removing uncertainty, removing competition from the market in that way. And those are the kind of two lines of attack to that kind of conduct. So one could say, a very kind of Chicago school competition lawyer would say, there's no problem here, this is precisely how the market should work. The price shoots up, that's a competitive signal for someone else to come in, they come in and sort it out. And these are just little bumps in the way. The NHS doesn't take the same view saying suddenly why the hell am I paying $30 million for something that should be costing me $3 million? There's something wrong here. What might be wrong here? Well there may be a dominant position being abused but that gets to difficult questions about what is excess pricing and that's why the Pfizer-Flin case matters so much to find out what the test is for abusive pricing. Or on the easier line of attack for the competition authorities is to say, well that might be the case but if you start entering into agreements with the people who are trying to come in, then you're playing with a competitive framework. And that is not dissimilar to the pay for delay because there's only one or two competitors at any one time to see if we can pay them off. That's the legal theory, that is an easier legal theory to do if the facts support it. But that doesn't give you an answer in all circumstances which I think is why we're seeing a push to try to get a 102 remedy in and an excessive pricing remedy in for these cases. But I think it's really important particularly from an innovator side of the industries these are nothing to do with innovators by and large. These are all drugs but they very much get bundled together. I heard a very good competition lawyer talking about these cases earlier this week and he described all these as pay for delay cases. And to some extent they are but they're nothing to do with patterns. They're nothing to do with IP so the problem that's arising in these price gouging cases is a market structural and regulatory problem. It is not an IP problem. And in that attempt at a positive note I will wrap up and leave time for questions if there are. Hello to the audience.


Ahoy-Hoy and welcome to the channel.  That truck's not messing around. Today we're gonna go over... I'm gonna leave that in. I'm gonna go over the dank memes from the dank memes from Site 19 subreddit. We are... let's scroll over. This one is by underscore shoulder underscore, another shoulder meme. Hey, can I have some recommendations for SCP articles? So you can read them later? Yes. Actually doesn't read them like a boss. Nothing time. This is a pro... everyone does this. I think at the very least. And it's a bigger problem when something is super long. A long article get me to look at it and be like, I'll read this later and then later comes and I'm playing a video game instead. I don't know how many times I'll open up a tab and then end up closing it later. It's sad, but it's the way things go. Read things on my SCP wiki? Not likely. The author's headcanon. There is no headcanon. I think... Oh, this is by bushguy9. See, there's this... every once in a while people are like, well, what did the author intend? But I mean, that's helpful for under... that's interesting and helpful for understanding an SCP. Don't get me wrong. But if you don't like what the author had in mind, you can just ignore it. It's fine. There is no canon. Gosh, I remember back when I used to make videos and that was like the thing I opened and ended with. There is no... remember, no matter what, there is no canon. Although, again, I think it's more fair to say there are infinite canons. I might actually change my vernacular to point that out, but like every article is its own canon and your interpretation of it is its own canon. So the author's headcanon might explain why they've written certain things into the article. It might explain a lot of things about it, but in the end... you can always just ignore it. It doesn't have any real impact on anything. This meme is by Commander Shortsight. I, for one, welcome our new David Overlord. So here's an interesting thing. I know a lot of people... is it 6140? I've actually... which I was told, hey, you should read 6140 if you haven't already because there's a lot of memes this week that include it, but not a whole lot of the memes that were in my list. At least I don't think we're... although a lot of them talked about the Davites. They weren't specifically about 6140. But I mean, like, the interpretation of the Davites in 6140 is kind of boring. I mean, it's not... it's a nice subversion, I guess, but I wasn't ever... it's been a while since I read it, but I don't recall being blown away by it or anything like that. The Davites... it's a little bit like Pattern Screamers or a variety of other pieces... mysterious things on the SCP Wiki in that they're better when you don't know what they're all about. And 6140 is just something I'm gonna ignore canonically going forward. It's fun. It's a neat idea. Like, they're the idea that there is a universe where the Davites are just, you know, eventually turned into a normal empire. But it's not my... it's not my viewpoint of them. If the Wiki doesn't got my shitty ideas, I know Log of Anomalous Items got me. Can I get a silent acknowledgement? No, because this... because stuff that gets added to the Log of Anomalous Items doesn't... doesn't mean that it's shitty ideas. And if they are shitty, it's gonna get removed from the Log of Anomalous Items. It's not... it's not... there's no... it's not that there's no quality control on it. There are people. There's like a whole team, I believe, devoted not necessarily to just this, but part of their mission statement is to manage the Logs, the collaborative Logs that are all over the SCP Wiki. So like... sorry, Indonesian guy. I hate to tell you that doesn't actually mean... that doesn't mean what you think it means. The SCP Foundation obliterating humanity because of something, a place that taught me the difference between right and wrong. The GOC, terminating anomalies that might cause harm to humanity. The SCP Wiki and the... by the this one is by John Mark Corpus II. I'm gonna start leaving the underscores out because I'm pretty sure those those are just supposed to be spaces for most people. What I mean... what we learn about the SCP fiction is that everybody is just sort of supposed... everybody thinks they're the lesser of two evils. They're the... that every... that evil is necessary in order for the world to survive and that they are the lesser of the two evils or in the story generally, not always, but generally the organization being portrayed as the one that is the lesser of two evils. And the version of the SCP Foundation which... I can't even remember which one it is. It's why, but is it the six... is it 6k or 5k?  That's how little it impacted on me. I should know despite the fact that I don't... I wasn't... like it didn't really hit with me, but I don't. Which is... says more about me than in the article I think. But why is boring? Because it portrays a foundation that steers into the skid that is more evil, not less. They're not a necessary evil. And in that... in the fiction that we're talking about, the GOC is the good guy because they're the ones fighting against, you know, the extermination of the entire human race. Anyway. The context for Mr. Mudda himself, who is the creator of this meme. It's a bummer actually, enjoyable animated SCP creators get lumped in with the rubber. And then there's a... there's my logo beating up a guy who I assume actually not assume is the rubber. I don't think that's fair. First of all, the video I did on this was merely acknowledging... like some of its low quality, yeah, but was merely acknowledging the fact that the reality of SCP content on YouTube has changed. And it has, by the way. As long as people can produce, you know, animated content at the level and at the volume that we're talking about here, let me put this way. And this says something about my content, and perhaps it says something about the other content, which is still doing decently. And if you'll look at my numbers, I'm doing not great. But this says something about my content, right? When there were no other options, I was doing great.  And my traffic has gone down significantly. Yes, competition is a thing. But apparently I'm not competing very well. Just put it that way. I was the rise... I was rising up, rising up, rising up, and then I have... my growth has flattened out to a literal plateau now, which... and it started right around the time the animated channel started to become popular. Truth is, as I said, there's just more competition.  All right, I should be the newly extant channels. That's how it's got to be. I need to do more. I don't know what I need to do exactly, but I'm figuring it out over time, hopefully, before the channel completely dies. But it's not... oh, this is the last one. Well, perfect. I'm going to go out on a down note here. But yeah, I mean, I don't think it's fair to say that I'm like kicking the rubber even necessarily. Like, there are... by the way, some of these animation channels have problems with regards to crediting properly and all these other things. So there are problems. That's the issue. But most of them have corrected them since then after a lot of work and bugging them about it because they had to. But I guess what I'm saying is, is it like, I need to find my niche, right? And do that and keep doing that. Because there's just too many options in the SCP sphere now, you know? These guys are trying to make money just the same as me. Ain't nothing wrong with them. Well, there is something wrong. I keep saying like, I'm not, I'm not down, I'm putting down these other channels. And then before I finish that sentence caveating it with, but some of them and, and some of it is terrible.  Well, that's not true. See, I caveated that there are channels that do that. Maybe I should just consistently do takedowns on everybody else. Get those hate views going on. Anyway, that's it. Thank you very much for watching. If you enjoyed the video, hit the subscribe button and then hit the notification bell next to that so you're notified when I upload new videos. And then head on over to patreon.com forward slash D Sumerian and pledge at any level, like everybody here on the screen already has, including Sinjeriki, who has pledged $100. It is nice to know that I am not alone out here. And I will see you all again, another truck. Thank you for helping me in the video. And I'll see you all again on Thursday.


What's going on? How are you guys today? Styrofoam delivery just came in Monday morning around 10 a.m. It was supposed to come last Wednesday because you know when things coming out of Monday when we're trying to get orders out It's just not that convenient. It gets in the way. I had to get more medium coolers in and we got about 10 pallets But this is nice and easy. These are lights. So you don't actually need a pallet jack or anything to move them I'll just have the guys, you know organize these against the wall later And I think I'll have to order more more styrofoam this week just to be safe I mean you guys have been seeing that I've been kind of over everything, you know the past few weeks, maybe even few months You know, I think it was Monday of last week We were working in the dark and then just the rest of that week, you know a couple things went wrong that like never happened So we had to pay that electrician about 1500 on Monday on Tuesday UPS didn't show up, which was horrible because then Wednesday I had to buy 500 more dollars with the VICE. We had to repack everything into new cardboard boxes, add more ice to it, and then on Thursday extra ice did not come to get more orders out So it was like two really weird scenarios where UPS didn't show up and then the ice company didn't show up Which is I can't remember it ever happening in general let alone, you know two occurrences in the same week So it definitely threw me off a little bit.  A couple exciting things are supposed to happen this week But maybe I'll save them as a surprise for next week if they actually happen So I've only been here for about 20 minutes and I'm already sweating my guts out Not only did the lights go out last week the AC also stopped working and the age-vac guy that I usually use has Hasn't been coming. I've called him like four times to come. He hasn't showed up once so I might have to find a different age-vac guy, but Really never ends. So I'm gonna try to do the foods orders without becoming a pool of sweat I also have the organ supplements and naturals orders to do which aren't as much We got the best bars, whey protein available on the foods website We also have the salt, all the cooking fats, the beef towel, the pork lard, the lamb tallow, everything freshly made Within the past week and I'm hoping by the end of this week early next week I can start selling you guys the glass bottled water keeper So definitely keep an eye out on FrankieSuriAgeFoods.com for that I did want to apologize if you guys buy the cod liver oil. I Ordered the wrong material label. So what happens is I take it out of the freezer and It kind of like condensates and the label gets all wet But I'm gonna reorder a thousand labels redo all the jars. So Just letting you guys know also if you ordered water key for grains in the past two weeks I haven't sent them out yet. I'm trying to just build up the culture so I can start Just getting the actual water key for out to you guys. So thank you for being patient I'll try to get those out by the end of this week I just got out of the freezer finishing up the 30 orders that were placed Yesterday on Sunday and the freezer is looking a little empty. I'm kind of worried about sourcing some products that are very very popular But let's hop in and show you guys So the rest of my face freezes off And I'll break my arm opening this God forsaken door So these are the rest of the orders that we're gonna try to send out today. If not, we'll finish them up on Tuesday I'm looking a little barren over here.  The bigger issue is I'm completely out of beef heart and beef liver There was a comment on yesterday's video, which was probably from a paid show But they were like, oh, well, you need a storefront to your business I was like, well, first of all, that's completely ridiculous second of all I can't even keep my basic products in stock. So The bigger element of the slaughterhouse isn't isn't just expanding. It's Making sure that I can keep the basics in stock and retain a decent customer base So we're still doing the two pound ground beef from all this week So if you place any order, you'll get two pounds of free 85 15 organic ground beef Next week, I think I'm gonna try to do a best bar promotion. If not, we'll do it the following week We'll give away one of each flavor best bar which are available on Frankie's free range foods calm. I Can't really think of anything else today. If you guys didn't see yesterday's video, definitely check it out You know again, I really haven't doing all this for you guys. I Don't really enjoy that much of it But if I can make people happier and healthier, then I'm willing to do it So I think that'll wrap it up for today. I want to go get on my computer and send some emails out mainly ask my purveyors if double check if they can get me some stuff and What I do sometimes I say hey if I order like three or four thousand pounds of it Can you get me it and sometimes that'll give me a yes instead of a no But then the issue is I have $10,000 worth of a product That's not moving that quickly in my freezer and I can't really afford to do that So it's kind of like a double-edged sword on that end. I still didn't set up the computer downstairs I still have to organize some stuff downstairs You know the Wi-Fi shielding silver fabric supposed to come in the dehydrator supposed to come in my new secret product supposed to come in I'm supposed to get the rest of the enzyme stuff for you guys. So a lot of stuff supposed to happen But you know running all these businesses by myself having money tied up It's just getting more and more difficult than too much of a headache With too many uncontrollable factors. We mentioned earlier. You know UPS not showing up The ice not showing up You know the more I can put in my control the easier it'll be But you guys know where to find everything frank desk on comm Again, thank you guys for reporting me through all of this and I'll see you tomorrow one important thing I forgot to mention in yesterday's video and almost forgot again today Thankfully one of my viewers emailed me saying hey Frank. Can we see the slaughterhouse? and I'm like yeah, I mean I was almost uncomfortable making that video yesterday because You know, I didn't exactly show you guys what I was purchasing now. The problem is I don't have a contract I don't have a purchase agreement You know imagine going to a real estate open house and asking the owners of the house if you can film it and show It to your friends to see if they want to pay for it. You know, it's I Just was not comfortable even asking the guy if I can drive over there and film it but I Really, I really did want to ask him and do that to show you guys what I was getting involved with You know, I think it would help a lot, but I don't want to jeopardize the purchase of it by Asking him that and making him uncomfortable because again, you know, he was going to sell it to someone else just last week I don't know there's downsides to everything but either way We'll see how things go over the next few weeks


Thank you, and then we're gonna we're gonna talk about OS virtualization So this is a topic that I haven't election on before so and I'm not an expert on I'm not really an expert on any of this stuff, but this is new to me But this is important because it's something that's going on in the world And I think it's it's a fun way to sort of complete our discussion of virtualization So we've talked about Harbor virtualization on Monday We talked about ways to make Harbor virtualization a little bit easier on Wednesday by making some modifications To the operating system to make it more cooperative and and created a new piece of software below it And today we're gonna talk about something that's actually quite different. So OS virtualization is quite distinct from these other two techniques Okay, so my usual reminder about assignment three do week from today So we have an increasing number of people that have actually finished assignment three So this is pretty cool because like eight or nine groups that have perfect scores at this point They're not all up here, but Congratulations to those people if you're not on this list if you want to be on this list So if you are on this list and you know, you have some love in your heart for your fellow classmates You know come to also keep coming to office hours and help people out Oh, yeah, they're gonna be trapped on this somehow Let me go the next one. Okay, so Before I talk about OS virtualization, let's thank you guys to go away Let's review hardware virtualization. So What do we have to do to create a virtual machine? So what were the what were the things that were required for us to? virtualize a piece of hardware Remember we talked Monday about VMs. What were some of the things that we had to do? To create a virtual machine. Nobody remembers Just Monday Anyone want to venture any guesses? Well, that's so that's so that's a little bit so I start with a physical machine. I Need hardware And then I'm gonna write Sorry, this is driving me a little berserk. I don't know why I can't get you to go wait wait wait So I start with the first physical machine. That's required And then I'm gonna write some software. I'm gonna write this thing called a hypervisor hypervisor is responsible for taking some of the resources from the actual underlying physical machine and Using them to create this virtual machine. So I'm using the underlying resources To create one or potentially more virtual machines and then I need to isolate the software that runs Inside the virtual machine and the most difficult piece of software to isolate inside the virtual machine was The guest operating system because the guest operating system is used to managing these hardware resources in ways that could potentially allow it to sort of Get out. This was the challenge And then the VM resources that I'm using are provided by the physical machine But the visibility outside of that physical machine of those virtual resources is limited This is by design This makes sense. This is sort of what we talked about on Monday and Wednesday. Okay Now what were some of the implications of these design choices on the virtual machine itself? So someone was just saying we want to virtualize the instruction set. Is that actually true? Can we virtualize the instruction set? What's true about the virtual machine? You know, what's what's the what I'm getting at here is what's the relationship between the virtual machine and the physical machine? That that you know are that that's part of It's a consequence of how we've chosen to virtualize machine. Who remembers a couple of well In order to get good performance I want to give the guest operating system as much access to hardware memories possible But what like what else is true? You know, what can I what can I not change about the virtual machine? Yeah Yeah, I can't I can't modify the architecture. I'm stuck with whatever our underlying architecture I started with because remember I built the virtual machine by taking resources from the underlying physical machine So, you know, I'm stuck with the architecture and then any any Features of that physical machine the discs that are attached the amount of memory I have the performance of various parts of the system those all are part of the virtual machines that I'm creating, right? So the VM and the physical machine have to share the same instruction set So the hosting guest operating system must also be configured to share the same instructions Now the guest OS that runs inside The virtual machine can provide a different Remember this term from that we first saw in Zen a different application binary interface So I can take my virtual machine I can boot windows inside of it if it's running on a bun to host OS And then I can run Windows programs in there that were compiled to expect to communicate with the Windows kernel And of course the challenges in getting this to work were largely related to the fact We're largely related to running the guest operating system Because the guest operating system is used to having privileged access to the machine and things like that once I can get the guest operating system to run Running applications inside the virtual machine is not so hard But you know what we've talked about primarily is the process of getting the guest operating system to work. Okay, so Let's try to apply this type of thinking to virtualizing an operating system So the terminology that seems to have caught on for a virtual operating system is something called a container What So how do we create a virtual operating system so again in the virtual machine I Started with a physical machine to create a virtual operating system. What do I need to start a real operating system an actual operating system kernel So I'm starting with the real operating system So this is something this is different So before we had this piece of software that was required to provide this interface and a lot of the features were actually provided by the hardware in This case the functionality that I want to get access to that I want to virtualize is actually provided by the under some operating system. That's already running on the machine Okay So now I have some software that's responsible for isolating what? So before we were isolating the guest operating system in all the software that ran inside a virtual machine What do I isolate in this case and again? There's no name for this is kind of weird I mean hypervisor has become this term that we use to refer to the piece of software that provides this virtual machine abstraction But there doesn't seem to be a name for this particular piece of software yet. Although it is required What am I isolating inside the container if the container and the rest of some Share a common operating system What gets isolated inside the container? Yeah Okay, well Yeah, so there is so I want to be able to allocate a certain amount of resources to it But what runs in the container in the virtual machine? I could run an entire operating system and all the software That run not ran on top of it here. I already have a kernel running that I'm going to use. Yeah Yeah programs some sort of guest software these are software applications that now run inside the container Are using the same operating system as the rest of the machine So before the virtual machine was using the same hardware as the rest of the machine here The virtual operating system or container is actually in the same operating system as the rest of the machine So container resources and and these are and this is where this could seem so these are the operating system resources Before we were talking about machine resources physical cores the memory on the machine Access to devices and part-dispartitions. Now we're talking about operating system resources. So we wanna think about the type of resources that operate systems exposed to applications. Some of these have some abstractions as part of them, some of them are illusions. But these are the types of things that we now need to virtualize. So processes, files, network sockets, et cetera. And again, these are gonna be provided by the real operating system, but what I wanna be able to do is somehow isolate them inside the container so that when I run a VM on top of real hardware, I'm isolating the VM from any other operating systems that are running below it and potential operating systems that are running next to it in other virtual machines. Here, when I run things inside containers, I'm potentially isolating the container software from the rest of the machine but certainly from other containers that are running on this machine. Does this make sense? Is this analogy sort of holding up so far? Okay. So what are the implications of this on the container itself? So before we said the virtual, the guest operating system, the virtual machine and the physical machine shared an instruction set and that had consequences on the software I could run inside of it. So for example, I have to run a guest operating system that's been configured or compiled to use the same instruction set as the host operating system or the hypervisor. Here, what are the implications on the container and the software that runs inside it? So I sort of gone up a level. And virtualization always happens across some interface. So before I was virtualizing the hardware interface, now I'm virtualizing the operating system interface but that has implications on what's below it. So what has to be true of all the software I'm gonna run inside my container? It doesn't have to be the same binaries. Actually, this is one of the things that's interesting about it. I can run different versions of software inside the container and outside of the container and different containers. But what has to be true about the software that runs inside the container? All the containers that run on the machine and the machine itself outside the container. What has to be true about those? Yeah. Well, okay, so that's a good point. The physical machine is still the same. So they don't have to be compiled for the same hardware interface but there's an additional requirement now. I've moved the virtualization interface up one level. Yeah, yeah, potentially. Yeah, and containers usually need to include everything that needs to run inside them. But again, this is another term that goes back to Zen. So software that runs in multiple containers. It's using the same kernel, right? So what does that mean? No, no, that's not about isolation. So before the software had to use the same binary interface because the virtual machine was provided by the physical machine. Here the virtual kernel that I get to use inside the container is provided by the same kernel that runs the rest of the machine. So what has to be true of the software that runs inside the container compared to the software that runs inside other containers and outside the... Yeah, what do we call this? Zen had a term for this. I used a few slides. The application binary interface. So compiled applications have to get attention from the kernel in the same way. This is the only difference, by the way, between Linux and Windows and other systems. I mean, Windows, most of what we talked about all semester applies to Windows just the same way as applies to Linux and other kernels. What's different is the language that we speak across the kernel user boundary. So the way, you know, running on Linux implies a set of agreements about how processes are gonna make requests to the kernel. If I go to Windows and try to, you know, communicate with Windows in the same way, until very recently, Windows would be like, I have no idea what you're talking about, you know. And so you can think of it as like different languages. And the support that they've added recently in Windows 10 for running on modified Linux binaries is really just figuring out a way to provide the same, you know, speak that dialect of kernel, you know. So respond to Linux system calls in the same way that a Linux machine would without having to rebuild the entire kernel. Okay, so the container re-opens attempt to share the same kernel. So they have to use the same application binary interface. What's hard about getting this to work? What's not hard about it? What's one of the big challenges that we get to avoid? That we talked about on Monday and about on Wednesday, sort of the primary challenge of providing a virtual machine was what, yeah, there was this challenge of how do I figure out a way to run this piece of software inside the virtualized environment, in that case, the virtual machine, that's used to having control over the entire machine and used to gaining control over the machine using these privileged instructions and things like this. So do I have to do that anymore? No, because the same kernel is providing the containers and the rest of the system environment. So that problem goes away, so that's kind of nice. What do I have to be able to do? Yeah, yeah, so I need to figure out a way to isolate the resources and the names that are being used inside the container from the rest of the system. And we'll come back and talk about this, but for example, one of the big challenges in building containers is I wanna use, let's say I wanna deploy 10 copies of the same container and they all wanna run a service inside that container that runs on like port 8080, for example. Those containers all need to run next to each other on top of the same machine. And yet inside, they're all using the same quote unquote port. Normally that would be a problem. If I tried to do that on top of the operating system without a container, that would create a problem and one of those services wouldn't be able to start. But I need to be able to support this. So obviously there's some naming issues here. Okay, so let's try to get at the differences here or containers versus virtual machines. So true or false, you can run a Windows software inside a container provided by Linux. False, right? It's using the same kernel as the host. What about running like suce linux utilities inside and a container that's running on top of Ubuntu? This works, this kernel is the same. Linux distributions vary for reasons that don't make any sense to me in terms of like where they put things and one of them uses one package management tool and another uses another because what the world really needs is more package management tools, right? So yeah, but I mean the differences between these variants of Linux are really confined to these, you know, again differences in file system layout, differences in tooling, you know, blah, blah, blah. The kernel that you're using is the same. Linux, these are all built on top of a Linux kernel. So as long as the kernel is the same, I'm good. What about if I run a tool like PS inside the container? Should I see all the processes that are running in the entire system? No, and this is important. So I wanna isolate things inside the container so they don't have a view of the entire world. Now outside the container, it turns out that frequently PS will show you everything. So this is kind of a difference between VMs and containers. Why, what makes this possible? Like it's kind of nice. So for example, my students have recently decided to take advantage of the fact that I have this huge beefy machine under my desk that I barely do anything with other than, you know, edit the slides for this class and send email. So they've decided to turn this into part of their processing cluster. So they put a Docker image on that that's running. And when I run PS, I can actually see what's going on inside that Docker container. I can see the things that are running in there. So that seems kind of like a nice thing. It sort of breaks isolation in a certain way because I can see into the container. But why is that even possible? There's no way to do this if you're running a VM. So for example, if they had used Vagrant to create a virtual box, virtual machine, and then solve the software that way, I might see that the virtual machine monitor was consuming a lot of, or the hypervisor was consuming a lot of cycles, but I would have no idea what's going on inside of it. So why is this possible? Yeah. Well, I mean, put another way, the tools like PS use information provided by the kernel. The problem was peering into the kernel running on another virtual machine is that that kernel is isolated. There are now two operating system kernels running on my machine. When you do container virtualization, there are not. There is only one kernel running. And so if I ask the kernel outside the container, show me all the processes that run on the machine, they can do that. Because even the processes that run inside the container are communicating with the kernel to get process IDs and gain access to system resources. Okay, so here's sort of a comparison of the difference here. Between hypervisor virtualization, and this is a case where the hypervisor is running on top of a host operating system. So this is type two virtualization, I think. Is that right? Good, okay. My expert on type one and type two. I don't know, he introduced me to these terms. They're real things. Yeah, she uses visibility provided by the kernel. Yeah, okay, yeah. So the way that namespace, we'll come back to this, but the way that namespaces work on Linux, as far as I understand it, is they're hierarchical. So when I'm outside of the container, I'm in a root namespace. And that namespace has visibility into all the other namespaces on the machine. When I'm inside one of the namespaces, I don't, by default, have visibility up the tree. And this creates some interesting features. So for example, processes that run inside a container can have a different process ID inside the container than they do outside the container, right? And this is one of the challenges to providing these namespaces. Yeah. Okay. So on, you know, type two hypervisor virtualization, I've got a hypervisor running the top of the hostOS that's controlling the hardware. And inside each one of my virtual machines, I have a guest operating system, all the binaries and libraries that are required to run things and applications that use the rest of this. In contrast, in container virtualization, I have one operating system. So here I have four operating systems, potentially if I have three VMs. I have one copy of the operating system. And what, and this, to be honest, looks a lot like running multiple processes next to each other. And the real difference here is that I can group processes into a single container so that they can only communicate inside the container and so I can distribute them all together. And so this is, I went back for this slide to some of the reasons why we did hardware virtualization. So one of the reasons why container virtualization has become so popular is that we preserve a lot of the things that we liked about hardware virtualization. We give up a few things, we'll point those out along the way, but we get a lot of the same features that we like at a lower overhead, because there's only one operating system. We'll come back to talk about the overhead too. So I can't run multiple operating systems in different containers. Boohoo, sorry about that. But who cares? Why are you trying to run multiple operating systems anyway? Just run Linux, problem solved. So yeah, I can't do this. I can, if I wanna run Windows containers, I think Docker has support for Windows so I can use Docker to bring up Windows containers inside Windows, but I lose out on this. On the other hand, I can still transfer software setups around as long as those software setups use the same kernel or something close enough to the same kernel, that the kernel interfaces the same. So before when I packaged up a virtual machine, I got the machine, I got the operating system, I got all that stuff.  But I can move those around, I can duplicate them, et cetera. This is one of the reasons it's so much, has anyone brought up a Docker container before? Okay, has anyone brought up a virtual machine before? Okay, if you raised your hand both times, you probably know Docker containers are way faster to start. Because they don't have to create, they don't have to grab lots of memory and create all these other resources. They're very lightweight, yeah. Good question, I don't think there has to be. There certainly isn't this, we'll come back to this in a minute, there isn't this multiple level of traps that I have to re-vector around. Because the operating system is handling all the requests. It's just using these new namespace features to isolate them so they can't see outside the container. And there's also some features to control the resources of the container. Yeah, we'll come back to that, but that's a great question. I don't see a reason why. Unless the container is throttled in some way. So if I take the container and very similar to what I can do with virtual machines, I can say, okay, I only want you to use this many cores or this much CPU time or this much memory or whatever. And in that case, it would run slower. But it's running on a more limited machine, yeah. I can potentially adjust container resources over time to, as things change, so I can give a container more memory, I can give it less memory. I can potentially do this even online at runtime, rather than having to reboot the system. Because again, the operating system is not used to memory suddenly appearing on the machine. There are operating systems out that do have support for hot swap memory, but for a long time that no one really built that in because they were like, this isn't gonna happen. Applications, on the other hand, are used to memory coming and going. It's like the kernel took a bunch of my memory away and now I'm running slow, and then it gave me some more and now I'm running fast. But that's just something that they're used to. So isolation, containers can be configured to make sure they don't leak information outside. So I can isolate certain things inside the container, and particularly not to other containers. Maybe the operating system outside the container has visibility into everything that's going on, but if I had two software setups provided by different companies that were accessing sensitive data, I can put those in different containers to make sure that there's no crosstalk between them, so they can't see each other's resources. And like I said before, I can package up everything I need to run an entire application or system and put it inside a container and allow someone to deploy it easily. People that have used Docker, I mean, what have you done with it? I mean, you're using it for AutoLab, right? Yeah. So for example, one use case of containers is the auto grading software that they're trying to deploy here. Well, you guys are deployed, right? Have deployed, it works flawlessly. It uses containers to isolate tests from each other and isolate the tests from the rest of the system. So if I run potentially malicious buggy student code inside a container, I can make sure it doesn't destroy the entire root file system or something like that or do something bad. We get away without doing this in test 161 because we have sys161 there. So that's what allows us to not have to worry as much about this, but if I'm running an arbitrary piece of code provided by someone I don't trust, like don't run it on your main machine, who knows what it's gonna try to do? Yeah, rerun me as Pseudo right away. That's what it's gonna say. You know, like the, so for example, the discourse forum that we use for this class is in a Docker container. That's how you deploy it and it's very easy. The reason for that is that it requires a bunch of different things. It requires certain versions of Ruby. Sorry, I didn't write it. You know, it requires things like Redis and Postgres databases that run inside the container and all that stuff is packaged up together, isolated from the rest of the system and can be deployed very easily. Okay, so back to the overhead question. So what had to happen in a virtualized environment for an application running inside the virtual machine to make a system call? What's the first thing that happened? This is a good review. Forget Zen.  A guest application makes a system call. Where does that go first? Yeah, Steven. Yeah, so I have to try it on the host operating system. The host operating system has to see every, you know, interrupt and exception on the system to maintain control. It then has to re-vector it back to the hypervisor, which then has to hand it back to the guest operating system.  What happens when a process running inside a container and operates as a virtualization makes a system call? What happens? Yeah, yeah. It just goes to the operating system. You know, there are no other operating systems running on this machine. There's only one operating system that can handle this. That's it. Yeah, so the overhead here is dramatically reduced, which is nice. And again, going back to this, the hypervisor has to do all this work. And potentially some of this is slow, like handling x86 page tables. One of the reasons why Zen worked on that is because that is actually pretty slow. Now, some of the, you know, as I mentioned in my discourse post, some of the new hardware features that Intel is introducing, I think, are designed to help address some of these things. So that's good. But there is still some sort of unavoidable overhead to being able to provide full hardware virtualization. And I don't have to do that anymore. I guess there's one operating system. What I do need to do is sort out naming issues. So this is kind of the core of container virtualization, names, getting names to work properly. So what sort of names does the container have to virtualize? If I want things that run inside the container to not be able to peer outside or to look at other things on the system, what are some of the names that the operating system has to start to virtualize or attach identifiers to? Give me one example. Yeah. File system. File system, that's a huge one. If I can look at other files on the system, I'm already outside of the container. So the container has to have its own view of the file system, not necessarily its own file system. We'll come back and talk about this in a minute. The way that Docker does this, for example, is very clever. I can let the container use parts of the file system provided by the outside machine or none of it and force it to establish its own paths. What else? What are the examples of names? Some of these are numbers because it's a computer program. Yeah, so memory is interesting. Yeah, memory isn't so much a name I have to worry about. I do worry about controlling memory, remember? Because the operating system sort of naturally already provides memory isolation between different processes. Is it already subject to the Docker pool? So as far as I understand, processes that run inside the container have their own address spaces. Now in order to share memory with each other, processes have to communicate with each other to set up those shared memory maps. What's required to communicate with another process? Is that it? Yeah, so there's an example of another name that I have to make sure that I isolate inside the container. If I can't name a process, I can't communicate with it to set up a shared memory mapping and so there's no problem. Does that make sense? If I want to do shared memory inside the container, I can do that, but I can only do it with other processes that run inside the container. That's what I want to happen. So yeah, it shouldn't. Yeah, so I'm, if I can prevent the container from seeing upwards, so that can prevent it potentially from seeing down as well. Yeah, I mean, I don't know if it's better in every way, right? That's a great question. I didn't even think about that. I mean, there's clearly an enormous amount of interest in container virtualization. I mean, there are, so for, okay. So let me, well, great question. What can I not do? There were a few things that were on that side that I got rid of or didn't strike through. What are some of the things I can't do with container virtualization? Because I'm sharing the same kernel. Yeah, we're right. So I can't support different operating systems. So that's one thing. But I also can't do any operating system customization that's heavily designed for one machine, right? So for example, if I have one piece of software and I want to modify the operating system to tailor its performance to that one piece of software, and this is something people do. When you set up databases, for example, like Postgres makes all this noise because it wants these huge memory, the ability to map huge amounts of memory and that's a thing you have to actually have to reconfigure the kernel to get it to do. So the degree that I want to configure kernels to tightly match the software that's running inside them, I can't do that here. The kernel configuration is shared across all containers. So any changes I make that are gonna improve performance for one container or the software set if in one container may not for another. But I mean, you make a great point. I mean, one of the reasons why people are so excited about this technology is because it does solve a lot of the problems that we wanted to solve in a much more lightweight way. Yeah. Oh yeah, I mean, there's no magic here, right? We haven't created more physical resources. One way to think about it is every container is like running more software on your computer. It just all came together very tightly packaged and it has limited visibility outside the container. So it's really just like running a bunch more applications. So yeah, absolutely. I mean, container software will slow down.  Yeah, yeah, Steven. I mean, like we just said, the overhead of getting in and out of the operating system is lower potentially. And so how fast things go ends up, remember those Zen graphs we looked at, it had to do with how much am I using the operating system? So anything that has to do heavy OS utilization on a system that is providing full hardware virtualization slows down because of all those traps I have to do, right? But remember, I mean, a hypervisor is scheduling. Yeah, that's one thing that hypervisors have to do. They have to schedule between multiple virtual machines. That's a good question, I'm not sure I know the answer. I mean, does OS virtualization benefit because Linux knows more about what's going on inside those containers? Because again, the container just holds processes that Linux has full visibility over. So does that improve scheduling and resource allocation at might? I'm not sure. I could see cases where it would help and I can't necessarily see cases where it would hurt. Yeah, Dave? You also don't have...  Yeah. No, not really. I mean, look, again, you have the same number of physical resources. I've still only got four cores, you know? Whether I have a hypervisor scheduling operating systems that are then scheduling processes or having a Linux kernel that is scheduling containers, processes inside containers doesn't really matter, right? I mean, there is differences in overhead, but yeah, I mean, if I have a really CPU bound virtual machine, it's stealing CPU from every other virtual machine that's running alongside, right? And this is something you notice. Like you can, you know, even if you, once you get, so let's say I have a machine with eight CPUs and I'm running 32 virtual machines on top of it, when one of them starts to really hog resources, you notice or the other ones slow down, right? Because they have less CPU time. Yeah. All right, let me keep going and try to get through this. A file name somebody already brought up, you know, processes inside the container, I wanna be able to control their visibility into the rest of the file system. So their names might resolve differently and some of the outside file system might be hidden from them entirely. And they might have files inside the file system that are not shared outside the container. User names. So this is, again, like this is, so this stuff is actually surprisingly important. So, you know, let's say I have a container that has an entire web server set up in it. That set up includes, you know, the web server runs at a particular user and it has permissions on these files. If I wanna duplicate that a hundred times on one machine, that user had better be different outside the container, right? If I try to use the same username, then that's not gonna work. So the user names inside the container have to be unique. Outside the container, those user names may be different, but they certainly have to have different IDs and things like that. And then there's all sorts of networking stuff that you have to get right as well. And we didn't really talk a lot about networking in this class, I'm not gonna get into this in detail, but you know, obviously the IP address for a container potentially if you want that to be different so that you can run an actual full fledged server environment inside it. And then you can do all this sort of fun stuff where you can set up virtual networks between containers. So multiple containers running on the same machine, could talk to each other as if they're separate machines, despite the fact they're not. They're just all running on top of the same hardware. Okay, so naming. So naming is sort of how we keep things separate. And that's a new problem that we have when we do OS virtualization that we did not have before in the same way. Control is an old problem, right? So control is something that the virtual machine need to be able to do as well. And things I might wanna control are the container's usage of resources. So I might wanna place limits on the amount of CPU time it has, the amount of memory it can use, the amount of bandwidth it gets access to. Again, this is stuff that the hypervisor also thought about and thinks about. And these are things that you can configure when you set up virtual machine environments. They're very similar. Okay, so the thing that's cool about OS virtualization, at least I think it's cool, is that it is built on all of these old tools and techniques. So for example, there's a tool that dates from the 1980s that's called charoot. Has anyone ever used this? Am I saying it right by the way? Okay, I've never used it. I don't know why you would use charoot. It seems very scary, right? So essentially charoot allows me to change the root file system of a process. So a name that would normally resolve starting from the root, now resolves starting from somewhere else. Does that make sense? So slash temp is no longer slash temp. It's like slash home slash bar slash temp, whatever. I can essentially re-root the file system for a program at an arbitrary point in the file system tree. And of course, you know how this is done. We talked about path resolution. What did I do when I resolved paths normally? I started with the root inode and I worked forward. All I have to do to get charoot to work is started at different point. And I just do the same thing. So rather than starting with inode two, which is actually root, I just start with a different item number and I try to perform the same process. Yeah. Yeah, I think so. Ooh. Yeah, I think both you need sudo because you don't want to let the charooted thing true out, right? Because sometimes you're charooting because you want to limit the programs. So I think the design pattern you're supposed to use is get root privilege, charoot, and then drop it, right? Yeah. But you can charoot back. Okay.  So here's some of them. So the past 15 years, Linux has been working on this idea of kernel namespaces. And this applies to a lot of the things that we just talked about. Mountpoints. So namespaces allow me to provide certain processes with a different view of the file system. I can mount different things, different places, process IDs, networking tables. This is all the stuff we just talked about, devices. I can create a namespace so that things that run inside that namespace can't see certain devices or see devices that other things don't see. Okay, C groups. So this is the control portion. Linux namespaces is all the naming stuff. That's where all that came from. C groups is this control aspect. So the idea with C groups is to limit and isolate different processes from each other. So you can think of it as I can put a bunch of processes into this group. And then once they're in the group, I can do things like limit the amount of memory that the group uses. Limit the amount of CPU time that the group uses. You know, assign the group to a namespace so it only has certain visibility into the rest of the system. So you can kind of see where things like Docker are coming from, right? I mean, they're using these capabilities that are part of the underlying offerings. Processes children also remain in the same C group, which is important from a resource manager perspective. I didn't realize this. I never understood the double forking design pattern until yesterday. And I wouldn't encourage you to understand it either, but it is sort of weird. But in certain cases, with old process management tools, services could sort of get away by forking a few times because then when they would lose connection. So remember, if I fork and then I fork again and then the parent, the middle process dies, that new process is now parented in it. It's an orphan. And so it's detached itself from the process tree. And in certain cases that would allow things to get away from processes that we're trying to control. In C groups, if you fork and fork and fork and fork again, you're still inside the same C group. And so the resource limits that I'm trying to apply to you still apply. This can also be useful for things like web servers. So we talked in the past about can a process get more access to the system by just forking a bunch of copies of itself, assuming they can work together, C groups allows me to control an entire group of processes. So if engine X decides it wants to start 82 workers for some reason, all of those can still be controlled inside the same sort of group. So these are things that are useful outside of container virtualization. This is pretty cool. So how do I provide file system access? There's a number of different technologies in this space, but I think one that Docker uses or used to use is something called UnionFS. So this is a stackable union file system. A union file system is a file system that's trying to provide a union of the files available in different files. So for example, I configure things into layers and the way I do path name resolution is I try to resolve a particular path in the top layer of the file system. And if that doesn't work, if that works, that's the file I get. If it doesn't work, what do I do? I go down to the next level of the stack. I just keep looking for this file until I either find it or there are no other layers to look at. I can also do cool things like hide parts of the lower file systems. So I can have occlusions in my union file system where I say if foo.bar doesn't exist in a particular layer, then even if it exists in some lower layer, I have a configuration in the middle that says stop path name resolution here for an entire part of the tree. So for example, I have a configuration that says I can't access anything that's rooted in foo in any lower level. And so even if that file exists, like for example in another container or somewhere else, I can't get at it. One of the things that Docker did to improve performance apparently was apply this copy-on-write technique that did we talk about copy-on-write when we did memory management stuff? Was that one of the lectures I missed? No, yes. So the previous Linux containers implementations did this thing where when you created a new container, it copied a large part of the file system that the container could have access to. Because even files that are shared between the rest of the system in the container, I may not wanna see the container's modifications. I may wanna hide the modifications inside the container. So what Docker does is it does copy-on-write. So it tracks which file system which files the container is allowed to modify and when those modifications happen, it makes copies of them. So it doesn't copy things first. Again, this is one of the reasons why it's so fast to bring up containers is because there's very little upfront resource provisioning that has to be done. Okay, almost done. So, yeah, it can, yeah, but it doesn't have to, right? I mean, put it this way, any resources that really have to be portable from machine to machine, I need to put inside the container, right? And this is something that Docker does, right? So Docker containers come with their own file systems, right? And therefore, yeah, if you want things to work perfectly everywhere, you know? Everything that's used inside the container has to be moved around with it, right? So just to bring this together and sort of talk about one of the more popular, sort of hot containerization technologies out there. So Docker is built on a bunch of these old Linux containerization technologies and isolation technologies. This is an active area. So Docker has gone through several iterations where they've used different versions of things that were available. Early versions were based on Linux containers and then I think now they own their own containerization library that they develop that's part of Linux. So, you know, again, I think lib container is what they're using now, but you can also configure it to use these other containerization libraries and approaches below it. And then within Linux, you know, we talked about C groups and namespaces. There's also a variety of other Linux kernel primitives and support that things like Docker need to work. That makes sense. So this is kind of a neat story of sort of evolution of the Linux kernel itself. And then also the addition of these nice libraries and tools for doing the things that Docker does. Docker also has these nice ways of layering file systems. So if you've updated Docker container, sometimes you'll see what happens is essentially what it's doing is it's bringing in a new layer to the file system that runs inside the container. That's a nice way to update things. If I have changes I wanna make to a container that's already deployed. I deploy essentially a diff that contains those changes. The container is stopped, that diff is applied and the container gets restarted. And then the files inside the container are changed. I mean, this is an example of a container. This is a Docker file. I don't understand this syntax entirely because I've never written one of these before. My students have though. So what this says is, let's see here. When the container is run, so app get, for example, is a tool that it is using from outside the container, as far as I understand. Maybe, is that true? Okay. Okay, yeah. And then here's a volume that's shared outside the container, I think. And here's a command that's run when the container is started. So this is a container that runs MongoDB. This is designed to containerize Mongo. This installs the latest Mongo version, or sorry, this installs the Mongo version that's configured right here, which is 266, when the container is booted, this runs Mongo. Docket container file systems are not permanent unless you configure them to be. So in a case like this, this volume right here specifies that this data should be located outside of the container. If it's not, it's not persistent. So if you didn't do this, every time you stopped and restarted this container, you'd have a fresh Mongo database with no data in it, which is probably not what you want. It's interesting to notice that the Docker file does not configure, so this is gonna be located outside of the container, but the Docker file should doesn't configure where it's located. That's configured when you run the Docker container, and the reason for that is if I wanted to run 10 copies of MongoDB on the same machine, I need to find 10 different directories to put their data in outside the container. Inside the container, the data looks the same. That's the nice thing about it. Every copy of MongoDB running inside this container thinks that it's using data that's located in DataDB, despite the fact that you, as a system administrator, have to find different places to put that when you run it. Okay, any questions? So we're done with the week on virtualization. On Monday, Carl will be here, and he's gonna talk about performance benchmark. So I will see you guys on Wednesday.