My name is Sharon and I'm a home care worker. I've worked for nearly seven years now. I go out into the community into people's homes to help them independently live in their own homes. So I help them with several tasks, washing, making lunches, laundry and give medication. My job that I did before, I worked for Yve Sellerong Cosmetics, a completely different field. I had my daughter and obviously I wanted a job that fitted around my daughter and also I was able to go into care work so it fits around our family. My first lady is Alice. Morning Alice! Oh you're awake, did you have a good night's sleep? There we go. My friend works already within the industry. She said why don't you try care? This to me was very daunting but when your new person goes out they will always shadow anyway so you'll always have an experienced carer that will show them how to do it and they're always there to support you to do your job properly. So I'm going in to see Lynn. Hi Lynn! Thank you. How did you sleep last night? Oh good, too long. Did you? Christmas day I went out. The difference that you make by just saying happy Christmas to someone that hasn't got anyone, hasn't got any family, it's those key things that make you do what you do and I just love my job. So today I'm going to prepare Lynn's breakfast and her lunch. I couldn't cope without Sharon at all. I just couldn't. It just means that I can still stay in my own home. All right, have a nice day. Thank you for a nice shower. That's all right, take care. I'm all right, how are you? I'm fine. Mum's flying, she's awake. It's a lot of support for me.  They're very, very good. I never ever thought I would do care, like coming from cosmetics, being a manager and with a team full of people and then till that day that I actually done it and now I wouldn't change it. It's about job satisfaction for me. I'd love making a difference to people, giving them the ability to live in their own home but it gives you fulfilment in your job and I'm still ten years down the line in care. I'm going to get the giggles now.


السلام عليكم ورحمة الله وبركاته هناك بعض الأشياء التي يوجد في بكسة دعاء ويبادات ومتعلق بشكل كبير في نهاية الثلاثة الثلاثة الثلاثة الثلاثة من هذه الأشياء التي تكون كبير في هذه النهاية هؤلاء الأشياء من ثلاثة القرآن هؤلاء الثلاثة الثلاثة are Surat al-Rum, the Romans which is chapter number 30 reciting Surat al-Dukhan, the smoke chapter 44 and reciting Surat al-Ankabut which is chapter 29 and very briefly why these three chapters why these three Surah from the Holy Qur'an because for example Surat al-Rum explains why الله سبحانه وتعالى created this creation to prove of Allah سبحانه وتعالى His presence and His creations and His presence in the human beings in the souls and the lives of us mankind الله سبحانه وتعالى speaks of His signs present in the creation of the world and in human beings the wisdom behind the running of the universe and the power and the mercy of Allah سبحانه وتعالى so once one recites these verses of the Holy Qur'an الله سبحانه وتعالى will be able to notify the mankind of His powers and His creations and His presence in the lives of mankind Insha'Allah and why one may ask why was it called the Romans is because there was a prophecy that the Roman Empire at the time was going to defeat the Persian Empire so the Muslims who were the worshippers of Allah سبحانه وتعالى were afraid that this empire who were idol worshippers who were the Persian Empire they were going to overpower and defeat those religions who were worshipping Allah سبحانه وتعالى so it is well advised for one to recite Surat Al-Rum Surat Al-Dukhan again speaks about the smoke that will envelop the earth before the day of judgment again another sign another remembrance from the path of Allah سبحانه وتعالى towards the those who are away from Allah سبحانه وتعالى some refer to this as being the smoke that will there are those who are going to transgress and those who are going to be far away from the path of Allah سبحانه وتعالى and also in this Surat Al-Dukhan there is a mention of Laylat Al-Qadr there is a mention of Laylat Al-Qadr in two occasions in the Holy Quran one of them in Surat Al-Qadr and the other in this Surat Al-Dukhan where Allah سبحانه وتعالى in a indirect manner in a direct way speaks about Laylat Al-Qadr and we said that Laylat Al-Qadr is the night that Allah سبحانه وتعالى brought down the Holy Quran in one manner in one go rather than bringing down verses from the Holy Quran during the 20 or so years upon the Holy Prophet of Islam so this is one of the chapters recommended to be recited and the next chapter and the third chapter is Surat Al-Ankabu chapter 21 again Allah سبحانه وتعالى talks about the fragility of the false gods there are those individuals who worship false gods Allah سبحانه وتعالى speaks about how those religions and those ways of lives are far away from the kindness kindness of Allah سبحانه وتعالى on this earth and again some of the verses from this chapter is speaking about the trials of the believer and distinguishing factors of the hypocrites that openly worship Allah سبحانه وتعالى or they disguise themselves with the clothing of worshippers but inside them they are the furthest away from worshipping Allah سبحانه وتعالى and the second remembrance in this ayah in this chapter is that speaks about the trials and tribulations faced by the prophets previous prophets Allah سبحانه وتعالى gives us examples of how the previous prophets were facing problems in their lives from their people and how Allah سبحانه وتعالى advises mankind and wants us as human beings to be ready to face any trials and tribulations and test and difficulties for the sake of Allah in the path of Allah سبحانه وتعالى and some of the other other to be recited on these nights as I said دعاء جوشين الكبير دعاء بيحمز الثمالي دعاء البحاء repeating the Surah سورة القدر if you are able to repeat recitation of the Surah سورة النانزة ناقف ويليلة القدر 100 times or 1000 times there is Turuk عي صلا as I mentioned in the previous episodes it's similar to Salat Al-Subah you pray specific to this night after reciting Surat Al-Hamdu Surat Al-Fataha you repeat Surat Al-Tawheed 7 times you finish the prayer and you do تسبيحة الزهراء and you engage in repeating 70 times and don't forget to conclude all of these supplications these nights with the supplication and the prayer for Imam Al-Mahdi عجر الله تعالى فرجو الشريف as he is the one that going to have the ultimate say and the ultimate signing on our books of عمل and what will be destined for us in the next coming year I pray for you and no doubt you will not forget us in your dua والسلام عليكم ورحمة الله وبركاته


Raj Bhavan, the graciousness of governor Vijay Sagar Bravji, and probably this is the most spectacular view in Mumbai. Here we're leaving the coast, the west coast of India, and from now on it's all inland. We're going to miss the ocean for sure. So, leaving Mumbai for Gujarat, and further to Madhya Pradesh, Uttar Pradesh, Rajasthan, Punjab, Haryana, Himachal Pradesh, Uttarakhand, and to Delhi. That's the route for us. So, this is our last moment here on this trip with the ocean. Raj Bhavan is located at literally the land's end in Mumbai. And a spectacular view of the Arabian Sea as it is called here. This has a long maritime history, because the sailors of the old, they found it easy to navigate along the Arabian coast, all the way to northern Africa. Rather than trying to navigate the open seas, they hugged the land along the Arabian coast and reached Damascus, reached Jerusalem, and also into the northern African coast. This has been a significant part of India's trade in the past and still continues to be. So, we're going to miss the ocean for sure.


Welcome to Toffy TV, it's the Everton News Daily. Everton midfielder Tom Davies could be set to leave the club when his contract expires later this month. Davies, who's been at Everton since the age of 11, is 25 on the 30th of June, the day his contract expires. He's been at Everton since the age of 11, like he said, and has played 179 times for the blue score and seven goals. He is apparently interested in Glasgow Rangers and Norwich City, as well as Southampton. There's been no official statement from the football club that is indicating one way or the other whether or not Davies will leave the club. But he did say in an interview towards the end of the season that you might need to look at playing regularly and if it isn't that evident then it obviously will be somewhere else. So, we're in turn in 25 later this month. You do think maybe he'll think the time is right now for him to move on and go and kickstart his career where he's going to play regular games, so we'll have to wait and see what happens with that one. Liverpool Football Club have requested that the first game of next season for them should be away from home. Anfield is getting some reconstruction, certainly, to the Anfield road and they're getting a new stand and they've asked that they can have their first game away. And what that means is that the blues are certainly, almost certain, rather to play the opening game of what will be the last full season of Goodison Park at home. So, the fixes do come out a week on Thursday and we'll know then who Evan's opponents are for the beginning of the next season. Because, though, Evan's opening game of next season will be at home. Everton are apparently interested in Manchester United winger Amet Diallo. The right winger spent last season on loan at Sunderland. He's 20 years of age. He's scored 13 times and had three assists in 37 games. He's quick. He's got a really good shot on him. Manchester United signed him a couple of years ago for Atlanta for around €38 million, something like that. He is highly rated. Eric Tenhag is thought to want him to go and get experience now at a higher level than the Championship. And obviously, with Evan's budget probably being quite tight this summer, the desperate need for a right winger. The next player may well fit the bill there, so want to keep an eye on. Good age as well, so we'll see what happens with that one. And staying with Sunderland, Evan have also been linked today with Sunderland winger Jack Clark. The 22-year-old, he's scored nine goals and had 11 assists for Sunderland for Tony Marbury's men in 45 games. Again, another very, very highly rated player. Obviously this time Sunderland do own the player. They maintain an interest in Everton striker Ellis Sims. That's out there again today. I think Tony Marbury wanted them to stay at the club in January when Everton recalled them. There is some suggestion in the north-east that if a deal was to be done for Jack Clark, that Sims may well be requested as part of that deal in the make-up of that deal. They apparently rate Clark at around £14-15 million. Depends how much Evan won for Ellis Sims. So there could be something in that. There could be nothing in it, we'll wait and see. That is it for the Evan newsletter. Give the video a thumbs up, subscribe. If you haven't and if you want to become a Trophy TV premium, let me click the link in the description or the QR code that will be on the screen in about 10 seconds. See you later.


Good morning and thank you to everyone for joining us today. Before we begin, I'd like to remind media on the phone, you may press star one at any time in order to ask a question. That's star one at any time to enter the queue. The question and answer portion will take place after today's remarks. I will now invite minister George Heyman to speak. Please go ahead. Good morning everyone and welcome. It's great to be joining you today from the traditional territories of the Musqueam, the Squamish and the Slewa Tooth Peoples and we're here to announce another step in our joint efforts to address the climate crisis and build a better future, a future everyone wants. Today's announcement is going to show what we can accomplish by working with all levels of government to support people and communities right across British Columbia. This is an important part of our Clean BC Roadmap to 2030 Action Plan to meet our targets, to reduce emissions and deal with the climate crisis. And with that, I'd like to invite the federal minister of natural resources, Jonathan Wilkinson, to provide some remarks. Good morning and thank you to minister Heyman for the introduction. Je vous jouais aujourd'hui de notre Vancouver située sur la territoire ancestral des nations Musqueam, Squamish and Slewa Tooth. It is a pleasure to be among you today on behalf of the Honorable Dominique Leblanc, minister of intergovernmental affairs infrastructure in communities and certainly pleased to join minister Heyman and Kamloops councillor Singh for the announcement of the third intake of the Clean BC Communities Fund. Climate change, as I think everybody knows, represents an existential threat to our way of life here in Canada and the people around the globe. It is no longer something that is far away. Climate change is causing significant impacts today and these impacts will increase significantly going forward in the absence of aggressive near-term action to reduce carbon emissions. British Columbians, British Columbians know more than most that there is no time to waste. It is just this past year that we have witnessed extreme heat and catastrophic fires, atmospheric rivers, floods and slides and with these came human and economic devastation. Climate change, though, often also represents an enormous economic opportunity for those countries that act thoughtfully and aggressively to seize those opportunities that will be enabled by the transition to a low carbon future. Canada and British Columbia have taken bold action to address the climate crisis over the past several years. For Canada's part, the actions we plan to take were outlined in some significant detail in Canada's strength and climate plan, a healthy environment and a healthy economy and certainly we have been very pleased to partner with the government of British Columbia who has a similarly ambitious climate plan. Our bold and thoughtful actions were acknowledged just last week by the International Energy Agency which stated that our climate change policies have been exemplary in nature. However, we are all aware that more must be done and that climate action will need to remain a priority for governments at every level over the course of coming decades. Certainly an important part of climate action must involve our governments working together and working with municipalities, Indigenous communities, non-profit organizations and businesses to build resilient energy efficient communities. So today I am very pleased to announce a combined federal provincial investment of up to $134 million for local green projects that manage renewable energy, increase access to clean energy and improve energy efficiency in buildings, transportation and other infrastructure. This will be the third intake of the Clean BC Clean Communities Fund. To date, the federal government and the province of BC have funded over $240 million for local green infrastructure projects through the Clean BC Communities Fund. The success of the first two intakes underlined the value of this program in addressing climate change through adaptation and innovation. Some example projects would include the biomass energy center in the district of Sycamus which reduces its carbon footprint through new bio-heat technology and sets a precedent for eco-conscious rural infrastructure. And the new passive house certified hub of tourism and economic development building in Castlegar which is a leading standard for low energy efficient buildings through its use of passive influences like sunshine, shading, ventilation and airtight design. These types of projects help us to reduce emissions and enhance resilience all the while creating jobs and economic opportunities here in British Columbia. Beginning a week from Wednesday, the third intake of Clean BC's Communities Fund will open representing another step on our path towards a healthy and a prosperous low carbon economy. Thank you very much for joining us today. Let me turn this back now to Minister Haman. Thank you so much Jonathan. It's exciting to join both you and Councillor Singh in support of stronger climate action at the local level. We've seen and I know you agree with me on this local and indigenous government showing incredible leadership fighting the climate crisis and they're looking for strong partners at every level of government. So we recognize the importance of supporting these efforts. Today we're increasing our commitment with record amounts of funding through the Clean BC Communities Fund up to 134 million dollars jointly with the federal government. The science is absolutely clear that we need to rapidly move to cleaner energy in absolutely everything we do. This last year showed us just how urgent climate change is, the crisis that we're in now and we need to step up our actions. It's the reason we released the Clean BC road pretty late last year to expand and accelerate our transition to a cleaner economy for everyone with lower emissions steadily moving forward as we reduce along with Canada and the globe to keep global warming at some manageable level. Our community infrastructure is a key part of this. We've seen fantastic projects funded from the first round of the Clean BC Communities Fund and I know Councillor Singh can attest to this. The City of Kamloops funded a Canada Aquatic Centre energy efficiency upgrades that significantly improve an important community asset and help reduce climate pollution through the first intake of this program. The funds also helped finance waste heat recovery projects in places like Vancouver's False Creek and Richmond's Oval Village. A clean hydropower installation was put in place for the New Hawk Nation to get them off diesel. We've seen significant expansions of electric vehicle charging networks in Surrey, Vancouver Island, Northern BC and Coastal and Central BC. And there are others. This new funding round will open January 26 and it will help build on the incredible work of local and Indigenous governments to address the climate crisis head-on. Thank you very much and I'd now like to call on Councillor Arjun Singh from Kamloops and a member of BC's Climate Solutions Council to speak. Thank you, Minister Heyman and thank you, Minister Wilkinson. I come to you again from the City of Kamloops on the traditional ancestral and city territory of the Squepmick people. Thank you so much for this great announcement today. It's really fantastic and I would say also that I have a great opportunity through the work I do with the little governments across the province to see my colleagues and little government all across the province innovate and work really hard on exciting projects that will help reduce emissions and keep our economy and social fabric strong. And so local leaders are really excited to be partners in training climate crises and climate opportunities. And I come from a part of the province where we've had massive extreme weather impacts whether it be wildfires and floods and obviously all these things have befallen us in many ways over the last little while and we're all trying to make sure that we're leaning into the crisis and the opportunity to reduce emissions and this funding will undoubtedly help us do so. And so you know I think from the perspective of the tables that I sit at, I listen to my colleagues and the work that they want to do in their communities whether they be rural or urban in every part of the province they're ready. They're ready to work with our other orders of government partners and Minister Wilkinson and Minister Heyman and just thank you very much for this announcement. Obviously we have to work as fast as we can. We can't negotiate with the with the planet. It's starting to get mad at us. We're seeing that day in and day out in every part of the world and especially in British Columbia last little while. And so this this funding will help I think us enormously and we need more. We always need more of that and we need more partnerships to make sure we have capacity. So especially in smaller rural communities across the province the capacity issue is quite evident and this money will help and whatever we can do also to help communities. We're a willing partner I think and I know that my colleagues on the UBCM board are will be excited by this as well. I'm not along on the board but I'm a past president so it's a very exciting day for all of us and thank you again. And as Minister Heyman said in CalMOOP specifically we've benefited from this funding with a pool project. Our pool is almost 30 years old and to be able to actually retrofit it with the energy efficiency was a fantastic win for our community. And I raise my hands to our staff in CalMOOP for making that happen as well. So from a staff side, from an elected side, local government, we're ready to work with you. Thank you very much. Thank you to all our speakers today. As a reminder for reporters on the phone, please press star one to enter the queue. That's star one to ask a question. You will be limited to one question and one follow-up. Please also remember to take your phone off mute. You will not be audible until your name is called. We're now checking the phone lines for questions and it looks like we may have answered all of today's questions because we don't have any questions. So that is all we need for today so thank you to everybody for joining us and this will conclude today's event. Thank you.


Welcome, everybody, to the planning of a cherry tree which symbolizes the relationship between Portland and Shinagawa, Japan. This is a 30-year sister-city relationship, and thanks to the vision of our mayor, and we are grateful to Portland Parks for this wonderful cherry tree which is planted here in Tommy's post office plaza, and hopefully as this cherry tree continues to grow, the relationship with Portland and Shinagawa will mirror that and continue to grow as well. And we are very honored to be part of this tree-planting ceremony. To make this cycle come to fruition, we'll start by having our original mayor, when I say original mayor back in 1984, David Brenerman was mayor of Portland, and he signed the original sister-city relationship into being, and as a result, the fruits of his vision and the vision of Shinagawa mayor, Aitur Otaga, have come full circle. And so, without further ado, I'd like to welcome David Brenerman, the mayor who signed the sister-city relationship into being 30 years ago. Thanks, Jeff. When we signed the sister-city relationship 30 years ago, as Jeff said, I had the great honor and fortune to be mayor of Portland, and we commenced the relationship because in some small way, we wanted to contribute to world peace and understanding. And as many of us have been to Japan, and a number of Japanese citizens have been to Portland of all different walks of life, I think that we've had greater understanding of each other. And Mayor Brennan was able to lead a delegation to celebrate the 30th anniversary. A number of former mayors have been to Shinagawa, and of course, mayors of Shinagawa have been here as well as other citizens, children, people of different professions. And so, it is a great thing that we are dedicating this planting of a tree today, and I want to introduce Mayor Michael Brennan to continue this tradition and say a few words. Mayor Brennan. Thank you, former Mayor Brenerman. And what I'd like to do is invite up the former city manager, Joe Gray, and former Mayor Ann Pringle, and we're going to do a toast. So, and to Mayor Havana, who hopefully will get to see this, and Jeff. Okay, so this is, thank you for the 30-year Sister City relationship that we've had with Shinagawa and Portland, and this is a toast and recognition of that 30-year anniversary and continued of many years of goodwill, peace, and friendship between our two cities. We should mention that this is cherry juice in keeping with the cherry tree behind us. And Joe, would you hold this for a second? We would like to, on behalf of friends of Shinagawa, Mayor Brennan with a Portland Shinagawa t-shirt, and this is our thanks for the Mayor's vision and the Mayor's actions to continue this relationship that has benefited the citizens of both Portland and Shinagawa all these years. So, on behalf of friends of Shinagawa, Mayor Brennan, enjoy. Well thank you very much. I appreciate it, Jeff. And I accept it on behalf of all everybody that went on the trip to Shinagawa, the delegation. It was a terrific group of people and we all got along well for extended periods of time that we spent with each other. And what I'd like to say just very quickly, when I was in Shinagawa and I spoke, I talked about the importance of planning this cherry tree, symbolizing our friendship and continued relationship with the city of Shinagawa. And I noted the fact that it was my hope that my granddaughter would be able to come and see the cherry tree and to understand that even though she hadn't been to Japan yet, that we had all gone to visit. Yes, Ariza. And recognize that she had friends throughout the world as a result of the first relationship that David established back in 1984. And I just recently came across the saying, and I thought this was great and very apropos for today, but they said the sign of a civilized society is when older people plant trees knowing they will never sit in the shade of those trees. So I hope every one of us has the opportunity to sit in the shade of this tree. But I also hope that many generations and many people of all ages will come and benefit from the shade of this tree. Daniela, thank you for bringing Ariza today. We appreciate it. Daniela's a biologist, so she really understands the importance of trees. But very quickly, Jeff, I'd like you to come up and explain a little bit more about the history of the tree as well as what you just mentioned about the Four River and Yeah, sure. Thank you. I'm Jeff Tarling, the City Arborist in Portland. And Post Office Park has a long history of a lot of effort from the community to become a park. In 1992, a committee was formed. We talked about design attributes and really thought about the sister city program. And that this brickway that you're walking on or standing on represents the Four River flowing down to the islands of Casco Bay. The Japanese male boxes, the antique male boxes, have been a real focal point of this park. I know former mayor Esther Klennett always reminded me of how important it was to have the right color. So we wanted to make sure that the male boxes look good. But the cherry trees we're planting today is a Sargent Cherry. It's a cultivar called Acolyde. And cherry trees in Portland, in the early 90s, we only had a few down on Commercial Street. And we saw how well they did. And what it did for people's spirit in the spring when they bloom. And so we've prospered that idea and continued to plant trees throughout the eastern prom, western prom, and throughout the city. There's four cherry trees in front of City Hall. And I think that spring spirit that it brings and the happiness is a real tribute to the type of tree that we picked out today. So next spring, we're going to have shade, but we'll have cherry blossoms to come and enjoy. So thank you for coming today. That's great for having me involved. Jeff, thank you very much. And Jeff put this together very quickly, so we really appreciate it. And Anne Pringle wanted me to just make note very quickly that we obviously are looking for any students or young people that would want to participate in the exchange next summer. So if you know of anybody, recruitment is on. And it's a terrific event and opportunity for young people to go to Japan. So does anybody else want to say anything? Well, if not, thank you very much and thanks for being here. Good morning, Mayor Hamano. This is Mayor Brennan from Portland, Maine. And we're standing here with Jeff Sandler from Friends of Shinigawa. And we just planted a Japanese cherry blossom tree in Post Office Park in honor of our 30-year anniversary sister-city relationship with your great city. And this is my granddaughter who helped plant the tree. So we just wanted to say hello to you. Thank you for the wonderful visit in April that we had to Japan. And this fulfills the promise we made to plant a cherry tree in honor of the relationship that we have, again, with your wonderful city. And so I'm going to turn it over to Jeff Sandler. Thank you, Mayor Hamano, once again for your vision and support of this relationship that has continued and benefited the citizens of both Portland and Shinigawa all these years. And whenever we look at this cherry tree here in our Post Office Park, we will think of the warmth and the gracious hosting that you have always extended to all Portland citizens whenever we have had the privilege to come to your wonderful city. So from all of us here in Portland, Maine, thank you very much.


What is stimming and what are some examples of it? Stimming is self-stimulatory behavior and it usually has the focus of regulating through repetitive action. It used to be thought that stimming had no purpose, that it was purposeless repetitive action. Thankfully they figured out that it serves a purpose that it is very regulatory for many folks not only autistic people stem, non-autistic people stem, neurodivergent and neuro-typical people stem. Autistic individuals just tend to stem more often. Although stimming is not a mandatory criteria to receive an autism diagnosis. I also just want to add to the definition of stimming, I think a lot of the time folks think of stimming as something that autistic individuals do only to regulate negative emotions like frustration, overwhelm, anger, maybe like a routine change, different things like that. When in fact autistic stimming often is an expression of regulating joy, happiness and other positive feelings. So we might see individuals stem in a variety of ways using and tapping into sensory input from seven out of the eight senses. So we have eight senses. Most people think we have five. Sorry mind blown. There's eight and I can briefly describe each one. The first five are the easiest. So we have sight which is when we take in sensory input from what we see. We have hearing where we take in sensory input of sound, smell which is the whole factory sense, taste which is the gustatory sense and touch which is when we take in sensory stimuli from our skin primarily and it is what clocks and things like texture but also sometimes clocks and things like pressure which is directly related to the sixth sense which is not to be related to the movie the sixth sense. We can see the ghosts, you know, we can sense that. I mean some autistic individuals do have a lot of strengths in that due to our ability to tap into the senses and it's not what this podcast is about. Maybe another one. Yeah. So the sixth sense that I'm referring to is proprioception or the proprioceptive sense and I like to think of this as our sense of body-ness. It helps us know where our body is in relation to space and how close to get to something, how far away. It also really helps us with hand-eye coordination as well as how much pressure to apply in the push-pull experience like if you're going to push a ball or push a chair in or put a glass down. Then we also have the vestibular sense which is my favorite. That's right. I really love the vestibular sense too. We'll get to that. Well, I mean it's good in a sense that I really enjoy stems that are related to it but that in a sense because I keep falling into stuff all the time. Yeah, so the vestibular sense is located in the inner ear which is interesting because we often think of the vestibular sense as the sense of balance and most people when we think of balancing we think of our legs or we think of our core but if you were to spin your head around really fast several times you get dizzy and that's because the vestibular sense is located there. So this helps us to know where our body is in relation to gravity and the vestibular sense and the proprioceptive sense combine into what I like to call the senses of movement and they help us move our body in all the day to day. So we also have an eighth sense which is not a stimmy but it's the interoception sense, interoceptive sense which I like to call the internal sense. It helps us clock our heart rate cues. It helps us to clock our hunger and thirst cues and whether or not we need to go to the bathroom. So that's a very important sense especially in relation to self-regulation but like I said it's I'm sure there's a way to stim with it. I'm sure someone stimming with the interoception sense like I'm sure it's happening but there's not really a list. I don't know like. Maybe like plug your ears and like count your heartbeat things like that I could see being a fun stimmy thing for some but examples so if we're stimming with our sense of sight we might love to look at flashing lights like your light there in the background or my microphone here. We might like to look at music visualizers that go round and round and round and those sorts of things can be very stimmy or the 8D kind of or I know I know that you have things like ASMR streams and stuff like. Oh would they show? Would they show? I usually think of this out. Yeah I think even gaming we were talking about gaming before there in some like RPGs there's such fascinating and gorgeous and beautiful graphics that I've just paused and stared at like a waterfall and an ocean and an RPG and just stared at it for like 10 minutes like now I'm living my character and I've actually started crying because it's so like joyful for me as a stim. Yeah I think a lot of people don't really recognize or consider visual or sight based stimming because it's not really something that we see an autistic person doing unless we notice they're staring at visualizer for a really long time or staring at a flashing light for a really long time but it generally doesn't affect other people and since most folks when they think about autism they think about how it affects them as an outsider there's not a lot of discussion around sight based stimming. There's also stimming through our sense of hearing and the first thing that comes to mind with that is listening to the same song on repeat and whenever I tell someone I've been listening to the same song on repeat and they're like oh I do that too and then they look at like my play count back when I used to use like iTunes they would look at my play count and they'd be like wait you've listened to this song 10,000 times. They think that you're putting it in a playlist and you sort of play it around but we're actually literally just like got it on the repeat one just like over and over again. And I would have like maybe a really stressful day at work and come home and just lie down on the floor and listen to the same song on repeat for 30 minutes to an hour as a means of self regulating that stress. There's other ways to stim through the oral sense or through hearing like just by playing sounds I think we often like think of maybe an autistic person who has an app on their phone that makes sounds and they like do you press those sounds again and again. Like a storybook like with the little things that you get. Yes, I totally forgot about this. That's a dream when I was a kid. A water, water or pebbles, sand like I know it's a little bit sort of tactile as well but I think definitely like the sound of water you know you get those sort of indoor waterfalls or fires or you know I think for me that kind of stuff really helps. I hate silence like silence is really really hard for me like I always have to have something playing on in the background or even whilst we're talking I have like a Spotify playlist of it's like chilled music that I play and I do it for pretty much every single thing that I do whether it's like standing up and doing like some public speaking or chatting to people or I don't know it just kind of I think it for me it fills up spaces I think I feel like I always need to be like stimulated by some kind of noise. Yeah it can be really fun and exciting and also really calming in a lot of ways and then we have smell stemming through smell might look like using lots of essential oils on the nose and might look like you know just smelling everything smelling the same thing over and over again we have taste often when I think about stemming through taste I think of that person who really likes intense intense flavors and wants to like have all the spices in their food and they use them often and then when I think of touch I think of you know rubbing plushie blankets and maybe something that's rough yeah some people might even like rough textures or bumpy textures just really tapping into that touch and taste often get confused with different proprioceptive senses or I mean proprioceptive stemming because we might think of someone who choose on things constantly and think taste but or think touch but it really often is proprioception because that has to do with applying pressure to the body it is a little related to muscles contract and so using jewelry or just chewing on pens that is a proprioceptive stem another proprioceptive stem as to use weighted blankets and different things like that you might also have someone who rolls things a lot across the floor or across a table that's tapping into that sense as well we have vestibular so we've got this spinning spinning spinning spinning and swaying and rocking maybe even pacing those stems are actually the ones that we think of the most and we think of autistic stemming and what's funny is that we often don't even know what sense that's tapping into we don't know about the vestibular sense and so that's a really big one I personally love spinning good day viewers and listeners apologies for my very rude introduction to our regularly scheduled broadcast I just want to remind you that if you have enjoyed the podcast thus far please make sure to rate subscribe like comment and share all of these actions are pretty much the lifeblood of a small independent creator like myself and it will help me get most of my work more of my work to people who really need it if you want to stay up to date with my life get behind the scenes content check out my daily blogs head over to the instagram at Thomas Henley UK you'll find a link to that down in the description alongside my range of neurodiversity clothing just like this strong powerful autistic hoodie I love so much and my website of course where you can find a contact email to book me for one-to-one autism coaching interviews workplace training and speaking so thank you very much for listening to this very annoying self out there and I hope you enjoy the rest of the show I love walking on my tip toes to challenge my balance not that I'm thinking about it when I do it but it's getting me that sensory input and I also rock a lot and then we had interception but we also said that maybe maybe fucking your ears and listening to your heartbeat maybe something something was I think you could you could think of a lot of different things but I do think I do think is there any of the ones that you want to touch on or is it I think I covered all the senses I think I actually did that yeah yeah yeah I went when you were talking about sort of like the different sort of senses specifically using like the scientific names for like the senses and stuff I was thinking about you know obviously I obviously but I went to university to study via med and one of one of the modules was around like senses and things like that and we were talking about all like the inner mechanisms and like even even senses as we as we see and view them they're very like multifaceted for example the thing like to do with touch you know different neurons or different nerves are like activated by different kinds of sensations and pressure and you know so like the light light touch can activate different neurons than the ones that are involved in like heavy pressure even going so far as to things like nociception or like to do with like pain you know things like specifically for me I know it's not to do with stimming but I feel sharp pain very very intensely and they're like related to these these group of neurons called alpha delta fibers and they're very like they've got loads of lots of this stuff called myelin around it which allows them to go like really quickly and that's why when you know you get a cut or you get like a prick or something it's like you jump away from it quickly because it's like such a fast sort of electrical signal and then you also have like stuff around blood pain around the C fibers which are like very very slow you know the system doesn't react to them very quickly but it's sort of like a weird sort of dull pain you know like if you have like an achy leg or something you know you bang that or something and I don't feel that a lot so it's it's you know obviously it doesn't lend well to me taking injuries seriously if I you know me me being six six three I tend to I tend to bash my head on a lot of things unintentionally and I did not know you were six foot three I had no idea yeah yeah and it's also one of the reasons I'm actually a little bit annoyed at that fact because like I used to spin so much when I was younger and you know being my height it's it's very hard to no more than find a space to spin unless I'm like doing it on a chair or I'm going on like a round about or what are those cool park contraptions where you're sitting and just spin around all of those and also if if I just trip up or if I mess up I am like plummeting towards the ground at a very very dangerous pace so I tend not to do that a lot anymore and a lot of my stimming tends to be sort of related to like exercise like you know I was saying about the hyposensitive to blunt blunt pain and that also kind of plays into a little bit you know in terms of like going to the gym and stuff because for me I don't feel sort of that that pain from exercising very easily so it means that I can sort of push it a lot further than most people can obviously again it's like a it's it's a double edged sword because I can injure myself and not know about it or you know unless it's like a sharp pain so there's there's a lot of ways that like sensory systems I think can be very sort of complicated you know I think even in terms of like the visual system in terms of like you know we often see it as just visual but there's the aspect of like the hue of the lights like the colour of the light or the the brightness or the contrast or you know there's there's so many aspects to like how we sort of interpret in our environment


Yes, I didn't know that you could do that. Yeah, I'm so excited Who should I protect? Oh dog. Oh dog. Oh dog. I found the perfect skin guys I'm never gonna do anything ever again. It are he's ready.  Yes Yeah, but you know, I Don't know any of you well enough to tell if you're lying You are skilled and we will vote You're very one of the best among us players in the world Crewmate yeah What are you here to help me with? Oh, are you how does that work? Well, I would it be so obvious. Yes, I was hanging around like who know counting down from three But that would why would the witch literally do that? Nice gasser What is going on?  I don't know what the lawyer does Yeah, I think so Confused and then my whole chat was like Ethan.  That was dumb? No, because I was cuz I was like I think That was toast that was toast I did see toast that was toast a hundred percent toast you have anything to say for yourself even though you reported the self-report Warlock mm-hmm to control of me Okay, there's no way to live through evil guesser and not protect myself right are we voting out toast because Because I'm what's standing between you guys and certain death, but I already I want to do my task I'm going to do my tasks. Nobody can stop me guys. We can still get a task win here near Lily I know for a fact she killed in the last round That's true. I'm with you. Where did Lily go and Abe? We can't wait hold on I know what to do Abe is okay still Okay guys we have to vote Charlie because Charlie is not medic because I am medic I May I protected Lily at the very beginning because I felt bad for killing Lily so many times Charlie is Something else Charlie is not medic though. I am medic Charlie you dousing man Nope, but I baited him out baby. Ethan's the evil guesser. No, I'm not I'm not the evil guesser I've been I've been trying to get a task win Three out of the seven of my tasks are done really Ethan you try to get a task win Look at how many tasks are completed. You're trying to you're trying to tell me that you did all those tasks I'm pretty sure I did most of those tasks I mean he's the imposter though. You could just be saying that he's a medic You know like to bait something out or something and I really think it worked I genuinely think Ethan is the evil guesser, but Lily didn't I say at the very beginning at the very beginning We can settle this right now. What so one of us one of us is telling the truth So the evil guesser could roll the dice right now and we'll know for sure sure go evil guesser sir Evil guesser can kill me. I am the medic Yeah, he could be jester.  Oh, no He's not just her. Oh my god. What's going on? Help on help. I think we just come out with our rules Think there's no way evil guessers alive. Maybe leslie's the evil guesser Lily you're not the jackal No, I'm not the jackal. I'm security bar. We've already been in admin panel Leslie. What about you now, Junior? We vote in we won the game Leslie vote Leslie vote Leslie.  Why don't you show us your security guard by putting down a camera? Oh, Ethan Why do you trust Lily? I don't Can we watch Lily put down a camera it could be a marinade I Know let's skip and watch Lily put down a camera on the ground because that's what this Do I do I have a meeting what then that's bad really you're the one that we're suspecting Well, you will you put a camera down will you put a camera down? I can put a camera down But I don't think we should wait that long but I can do it. Okay. Let's do it I'm skipping No, why is it not Lily Lily's acting stuff now guys some don't feel right down a camera. Oh put down a Yeah I Even protected you. Oh my god. Thank god. I got cursed by either Ethan or toast. Hey, but I didn't touch you I don't want to touch you bro Wait, he stood there the longest yeah, Ethan Ethan was there for okay. What do you have to say for yourself, Ethan? I don't I don't know what's going on This excuse before Ethan Tell us your role and maybe you can live yeah, I'm a little swappy, baby I don't know Chat should I tell Lily should I tell Lily that she's my client? Don't do it.  No, it's fine No No, she tried to kiss me. I'm actually not the lawyer. I just want to pay out the evil guest Doesn't feel good I know It's so funny! It's so funny! It's so funny!


Hello, everyone. Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Annie, and I am a CNCF ambassador, as well as a senior product marketing manager at Samunda, and I will be your host tonight. So every week, we bring a new center of presenters to showcase how to work with Cloud Native technology. They will build things, they will break things, and they will answer all of your questions. So join us every Wednesday to watch live. This week, we have Martin, and the press here to talk with us about comparing different minification techniques and their vulnerability assessments. And another great news from the KubeCon and Cloud Native Consphere. The North America CFP has been pushed to two and third, so everyone still has time to submit their sessions. So go ahead and get that done. So great to hear. So this is an official live stream of the CNCF, and as such it is subject to the CNCF code of conduct. Please do not add anything to the chat or questions that would be in violation of that code of conduct. Basically, please be respectful of all of your fellow participants, as well as presenters. But with that done, I'll hand it over to Martin to kick off today's presentation. Hello. It's great to be back on CNCF Live. I think we were here about five months ago. And today, we have a slightly different topic. So we're going to be talking about container images and looking specifically at managing sort of complexity of container image management versus the size of the container images versus sort of the security of the container images. So we're going to be using a number of terms today, particularly slim, minify and optimize. And those terms are being used interchangeably to describe the act of reducing the size of a container image. And we'll be covering a number of different ways that you can reduce the size of a container image. And what's really important here is we believe that container size is not a vanity metric, but it's an indicator of container quality. So throughout this sort of presentation we'll be showing you sort of hard facts about why that is actually true. So if you can just flip to my shared screen view. Thank you very much. Oh, there we go. Hello. So we have an article that we've posted in our community forum. Whoever has the rights to paste the link to that if you could share that link so anyone can jump off in here. So the first question is why should you slim container images? So very clearly you should only ship into production what your application requires. And I see Gibran says, is there a presentation visual? So yeah, hopefully you'll get the link in chat in just a moment to this article which you can review after the fact. Oh, they only see a blue screen. I do at least see the article itself. So I'm hoping that it is. It looks like people that are watching aren't able to see my screen. Yeah, there's a bit of a delay. So we might do and tell us that it is working. But let's see, if it's not working then obviously we can try a reshare. Yeah, sure. I can reshare. I will stop sharing and resharing that screen. There we go, let's do that. Okay, let me know if that is, if you can now see the screen that I'm sharing. Okay, well, there is some issues from the attendee side but I think we can keep on going a little bit. Okay, let's just see. Oh, there we go, is that better? Anyone asking delay should not be that much? Well, I will keep talking for the moment and we'll see if, oh dear, that's disappointing. Not visible. How odd. Yeah, I see everything fine as well. Sometimes with the streaming it can help the quality if everyone closes the tabs they don't have. At least they have opened a lot of tabs and closing all of the others. But that might not help in this case, but worth the shot. And then we do have our host is letting us know, please try watching in Chrome as well. That might help. But if we can get that sorted and because from our side, we can't see an issue at the moment. So we might have to go into a podcast mode but we can still talk through the topics at the same time. Okay, let me just make certain that everything here looks to be correct settings. So that all looks fine. Like I say, I can see what's being shared in the event. Everyone's saying it's not visible. It will be necessary to see my screen. See my screen later on, unfortunately. But for the moment, I can explain what's going on here. So we believe you should only ship into production what your app requires. The slim container images are faster to deploy because they're lower in size and they're faster to start because they contain fewer files. And slim container images can be less expensive to store and transfer as well. So, and the big benefit that we're gonna touch on here is that slim containers reduce your attack surface. So the link to the container report that we, which is linked in the article. I don't know if the article has been shared in the chat yet but it's called what we discovered when analyzed in the top 100 public container images. And we definitely saw a trend of dev, test, QA and infrastructure tooling being left inside production containers. And the issue here is if you do have an unfortunate vulnerability in your own application and that gets exploited then leaving those shells and interpreters, tools and utilities in your container effectively instruments that container so that the would be attacker can now use your infrastructure against you to disrupt your operations. So I wonder if it's worth me trying. I can't share the screen in a different way. I don't think I could share a window. Let me try that. Let me try changing the way I'm sharing. We have now confirmed though and I pulled up the attendee view as well is that the attendees cannot even see the speaker. So we are fully on a podcast mode essentially no view of you or screen share available. We are in the background checking on this. So essentially hang on tight everyone. And if there's anything that you can cover podcast style to kick us off that would be lovely obviously but at the same time we can hang on tight. Sure. So I'll continue with sort of some of the objectives that we're going to cover today. And that's that we're going to be using science to determine the best approach to containerizing an application. We'll be focusing specifically on developer momentum and developer experience, lowering complexity, optimizing for size and reducing the attack surface. And it's important to understand that reducing the attack surface is more than just the vulnerability count and we'll get into all of that and we'll providing we can share screens we'll give some practical examples of actually how we're doing this. So the tools that we're going to be using today is the slim AI Docker desktop extension because we can use that to introspect the container images and do some deep exploration and analysis of what's in the container images. We'll be using Docker slim to minify or optimize the containers and we'll also be using sift. Well, not so much using it but we'll use data from sift to sort of catalog the number of packages that our containers have and then trivy to do some security analysis and then we'll be doing some manual sort of diving into the containers in order to actually see what happens when we optimize a container what residual vulnerabilities are left behind if any at all. So we'll be going through that whole process. Now, what are we gonna be looking at? We're gonna be looking at container construction in the first instance. And in order to do that we have a very simple Python Flask app that implements an even simpler RESTful API and the application is kind of irrelevant. It's for illustrative purposes only and its function is unimportant and as it happens it's exactly the same application we used when we were here last time when we talked about building analyzing and optimizing containerized images. So it's a Python Flask app, it's super simple but it's good as an illustration. And at this point I could like, if I could share my screen I could show the application. It's literally a few lines of Python. If the link to the, can the link to the article be pinned so people can refer to it? If the link to the article can be shared publicly there is indeed a link to the Python file so you can inspect it. But it's a RESTful API with two endpoints. Root and also a hello for a hello world RESTful interface. So it seems unfortunately that the, that everyone that's watching the live stream is not seeing any visuals but if the link can be shared to the article then I can talk through where we are in the article and explain what's going on. This will get tricky when we get towards like how we do the deeper analysis of the containers because that is a very visual process. I trust this. I trust usually the cloud network is very visual. So the podcast format is very challenging for sure. But let's get the link shared to the chat but there is a base to be an issue on possibly on YouTube side currently but we are still working on it for sure but let's get that link shared and then we can talk through it. Okay, so I see that you're still working on it. So I'm now going to talk about the techniques that we're going to use to containerize our application. So what we've done is we've actually containerized it in several different ways. The first thing we did is as it's a Python application we went to the official Python Docker Hub images and we're using the Python 3.9 slim bullseye image. So if you're not familiar that obviously means it's a Python orientated image from the Python project. It's Python 3.9. It's what they consider to be their minified or slim image and it's built against Debian bullseye which is Debian 11 and that base image is 129 megabytes. Also from the official Python project is a Python 3.9 image that's built against Alpine 3.15. So we're also going to use another container image built against that, that base image is 58 megabytes. So, you know, almost one third of the, or half the size, about half the size. We're then going to use an Ubuntu 2004 base image which is 73 megabytes but by default doesn't ship with Python at all. So that will require some additional steps and because Ubuntu 2204 is available now we're also going to use that. Now the 2004, so two years ago image is 73 megabytes and the 2204 image is 78 megabytes. And on the day of release of Ubuntu 2204 we did do a deep dive into why there was a five megabyte file difference between the two releases of Ubuntu. And we've got a link in the article that's now being shared of a live stream we did where we actually sort of dug into that live. And again, used exactly the same tools we're going to be using today in order to determine exactly why it was five megabytes larger. And then finally, we're going to use Distrolis Python 3 image. And that's going to be a multi-stage build and that image weighs in at 54 megabytes. So we've got a spread of sizes there with and without Python included using a number of different techniques in order to containerize our application. And then what we'll be doing later on is evaluating what the developer experience and the security profile looks like from all of those things. Now, given that I'm not seeing anything in live chat anymore, does it mean the live stream is working correctly? It appears that it is not working correctly at the moment. Okay. There is, we're trying to fix it obviously in the background, but the article has been shared to people. So if there's anything that we can run through there, this audio-only podcast style, I think that would be really great. But yes, we're trying to get the video feed working as well. Okay. Let me just check something here. One moment, just bear with me. I'm just doing my own checking in the background. I'll come back to that. So if you've got the link to... So we have a question here from Rolf. Is this cloud-native foundation live comparing different minification techniques and their vulnerability assessments? Yes, essentially, yes. We're going to be looking at precisely that and also the impact of starting with different base images on the minification process and the outcome of the security profile of the containers. So you're in the right place, Rolf. You're among friends. Okay. And I'm just looking. Yeah. Okay. When I understand now what people are saying about a blue screen, they're not talking about the screen I am sharing. They're talking about the whole screen. So now I understand what people are looking at. But you will see that the host shared in the chat a link to the article. So I would ask for those of you that are following along to drop down to the title that says Dockerfile complexity. And what we're going to do now is we're going to actually look at about half a dozen different Dockerfiles that are containerizing the same application using those different base images. So we're going to start with the Python. These will be tags in the images that we create later. So I'm opening this on my screen. I know that you can't see it, but maybe you can follow along as well. So in this Dockerfile, what we're looking at here is a very simple container image. We just have to use the Python 3.9 slim bullseye image. All of this adheres to best practice. We establish our working directory. We copy our requirements file in. We run PIP without caching any data to install the PIP requirements for our app. We then copy in our application itself. We tell the app what user it should run under, what port it should run under, and we define a well-defined entry point. So this adheres to best practices, very simple Dockerfile. So in terms of the complexity, it's simple and it adheres to best practice. So now what we'll do is we'll take a look at the Alpine-based image. And again, this is using a Python-based image published by the Python project. It's 3.9 and it's Alpine 3.15. And it's almost identical. If you're able to, you know, flip between those, then you'll see that really the only difference here is that there is no user defined in the Alpine image. So we don't define a non-privileged user. That's because by default in Alpine images, there are no users created or system accounts. Now it is entirely possible to add those. I've elected not to do that for simplicity and sort of show some of the differences in these different techniques. So consequently, you could say that this container image does not adhere to best practices as it's currently defined because it doesn't run the application in an unprivileged user or system account. And like I say, if we added some extra steps to this dockerfile, we could do that. I've just chosen not to for the purposes of simplicity and highlighting the differences in the techniques. So next we have two images which are one byte different from one another. So these are the images built on Ubuntu 20.04 and 20.20.04. Now, as somebody that's familiar with Ubuntu, so I used to work at Canonical. In fact, I was the engineering director for Ubuntu while I worked there. So I'm very familiar with Ubuntu. So, but this does introduce some additional complexity in that we have this run statement which does our app to get updates. Then app installs, some, that basically the Python requirements, the minimal Python interpreter and PIP, and we also need the certificates bundle. But then we run all of this in one concatenated line that also includes some cleanup of the app cache. So that's sort of standard fare for Ubuntu. And then the rest of this looks a lot like the Python project Debian based image. We define our app, we use an unprivileged user, it's all the same stuff. And again, this adheres to best practice some additional complexity. We then have a version that runs against 20.20.04, Ubuntu 20.20.04, and the only thing that changes is the version of Ubuntu and we'll get into looking at that a bit later. Now, for completeness what I've done is I've also created a couple of versions. Again, they're based on Ubuntu 20.04 and 20.20.04 and they add one additional parameter to the app to get line. And that's to say, don't install recommended packages. So the complexity of this Dockerfile is slightly elevated because we're using some additional knowledge about how apt works. For anyone familiar with Debian or Ubuntu, this should be familiar. Now, the benefit of using this we will see later on. So these images we will tag with no rec in order to distinguish between a full Ubuntu image and also one where we've tried to create a slim image but all of these Ubuntu images adhere to best practices. And then lastly, we have a distro less image. And this is where we need a bit more knowledge and this is a more complex Dockerfile for several reasons. First of all, it's a multi-part Dockerfile. And also we need to know something about how distro less works with Python. So I'm going to sort of talk about what that is. Now, there's some things that are common with alpine here in that there are no user accounts defined or no system accounts either. So we don't have, and again, we could have created those with additional steps but I've elected not to for the purposes of simplicity. But what we do is we create a build stage where we install our app and all of its requirements via PIP and then we create the production container. And that's where we then use the distro less Python 3 image and then we copy from our build image, the app itself and then those Python packages that were installed via PIP. So the benefit here is we can create a container that is smaller and we'll look at that in a moment when compared to other Debian based images. But the trade-off here is I really need to understand how those distro less containers are constructed. And for that, I'm going to switch over to Docker desktop using the, in fact, I'm gonna have to reshare. For the purposes of those few people that can see my screen, I'm gonna reshare my screen so that you can see what I'm looking at here. So if you're not familiar, Docker desktop recently added support for extensions and Slim AI were among the first to use that program. So what I'm gonna look at is the distro less container and I'm gonna analyze that because I had a hunch that this was based on Debian but it was like, well, what version of Debian is it based on? So here I'm in the file explorer and I can go to Etsy and I can have a look at issue.net And then I can look at the final content. I think the screen isn't sharing. I think I'm the only one who can see it as well, but it is now I see. Now we can see. And if anyone joined in late, we are doing due to technical difficulties for essentially having a podcast style for now, trying to figure out the issues in the background but a recording of this will be available after the session and I, for example, can see the screen. So the recording will have all of the screen share and all of the graphics and our lovely faces in it as well. So if anything is missing, yeah. I will add to that that we stream traditionally every Thursday with Slim AI. So for those of you that are watching, we will rerun this whole tutorial tomorrow on twitch.tv slash Slim DevOps. So for those of you that can follow along, reading the article to my voice, that's great. But for those of you that want to come back and see the full sort of video presentation, we'll do that on twitch.tv slash Slim DevOps tomorrow. And if you follow that channel, then you'll see the notifications and the schedule for when we're doing those things. So if I go back here, what we can learn from the distro list container is it's based on WN11, which has the code name Bullseye. So that was useful to know. And then what I can also see is if I look in the bin, in fact, not the bin directory, but the user bin directory, I can see that it's using Python 3.9. So these were important clues that I needed in order to understand how to create my build container with a container from the Python project that was compatible with the distro list container that I was using for my production container. But this all adds a degree of complexity. Hang on a moment, let's go here. Because I now need to know a bunch of different things. So I need to have some deeper insight into how Python works. I need to set my Python path to the correct version of Python. I need to know how to copy the Python site packages into the appropriate location for the distro list container. So the complexity of maintaining that container image goes up. So that's sort of a review of those container, those Docker files and how they differ from one another. Now I've pre-built all of these Docker images, except for one. So what I'm gonna do is I'm going to build each, one of just one of those container images. I'm gonna illustrate how we do this. So we're going to build the version of the container image that is based on the official Python project image that's Debian based. And if we then go back to the presentation here, we can now take a look at the sizes of these respective containers when they've been built with our application inside them. So what do we find here? First of all, we have a clear winner when we are looking at image size alone. And that's Alpine. Alpine as a base image with our app and all of its dependencies inside is 62 megabytes and distro list follows up 71 megabytes, which is excellent. And then when we look at the version based against Debian, it's 139 megabytes. So we're looking at twice the size. And if we look at an unoptimized Ubuntu image, we're looking at nearly 500 megabytes, well, just over 400 actually. But when we use those techniques to reduce the number of recommended packages that get installed, then those sizes come down to 120 and 136 megabytes. But if we're looking at image size alone, Alpine looks like a clear winner and it's certainly great for go and rust. But our application here is Python. And this is where an additional piece of complexity gets introduced when dealing with Alpine images and Python and also some other languages as well. And that's the Python can result in significantly slower builds and also introduce runtime bugs when you're using Python and Alpine. I'm not going to explain all of that now. We have a link to an article published by PythonSpeed, which is titled using Alpine can make Python Docker builds 50 times slower. So I encourage you to read that and learn more on that topic. But what we learn here is when we elect to use Alpine, we have to do it knowingly. We have to choose to use Alpine when we know we're not going to introduce build time issues, build time performance issues or runtime compatibility issues. And as I said, we were able to use the Slim AI Docker desktop extension to discover that the distro-less container is based on Debian 11 and Python 3.9. We've already illustrated why those two bits of information are important in order to create a container that works. For example, I was using a different version of distro-less to start with and it was incompatible and my container didn't work. But we're going to touch on some other reasons why this is important later on as well. And it also highlights why good use and understanding of apt can significantly reduce the Ubuntu image sizes even when compared to the official Python Slim images that are built with Debian. So the next thing to do is look at some package analysis and this is very, very quick. So what we're going to do is we're going to be using SIFT for that. So I'm just going to run this command here. SIFT is a tool that builds a software bill of materials. It can work on just file systems but we're using a container image here. And so that just took a few seconds to run. I know you can't see my screen right now unless you're watching the recording after the fact. But if we return back to the article, we learn a couple of things. So what we're looking at here is, well, there must be a correlation between number of packages and size of container images and certainly that's borne out. What we see here is that distro-less has the fewest number of distro packages that are installed. But what's common among all of these is they all have precisely 11 Python packages installed. And this is expected because PIP should be deterministic. So those Python packages should be the same versions installed in the same way across all of these platforms. So this in itself is interesting and certainly you can inspect those reports in order to understand exactly which packages are in your container image. But this gets more interesting when we move on to vulnerability analysis which is the next thing that we're going to look at. And we're going to be using Trivi in order to do our vulnerability analysis. Other security scanners are available. This is the one that we're using primarily for today's example. So I've just switched over. We're going to run this again. And this is scanning my container and it produces a very nice report indeed. So you can see that on my screen. But what we'll do is we'll look at like summary information of the vulnerability analysis when run against each of those containers in turn. Now, what we learn here is there is no denying that the Alpine results are excellent here. It has zero vulnerabilities. So this is a container with our app and everything the app needs to install. Everything the app requires in order to operate being installed, zero vulnerabilities. But then we see some sort of interesting information here. So Distrolis, which is a small image, actually that has three critical vulnerabilities and seven high vulnerabilities. And the official Python image which is built on Debian has two critical vulnerabilities and 15 high vulnerabilities. So that's quite the jump from a clean bill of health with Alpine. But then when you look at the Ubuntu-based images, even those that have not been optimized in any way by sensible use of apt, they all have zero critical vulnerabilities. And only one of them, the large fact image based on 2004 has a single high vulnerability. Now as it happens, when I looked into it, that high vulnerability is a false positive. You can see on the Ubuntu-USN notices that that vulnerability has in fact been mitigated. And Trivi has picked that up as a false positive. And this is actually something that GRIP and SNCC, which are two other security scanning tools, both confirm. So in actual fact, irrespective of the number of packages or the size of the image when using Ubuntu, there is zero critical and zero high vulnerabilities in all of those container images, which then begs the question, how is that possible? Why is this? Ubuntu is derived from Debian. So why is it so very different? And again, I used to work for Canonical. I have some insight here and I'm gonna squash this down very quickly, which is Ubuntu is a commercially backed Linux distro with a full-time security team that has SLAs to mitigate vulnerabilities for their customers. And there's a link to the documentation that describes exactly what the commitment to security within Ubuntu is. And that commitment also includes mitigating all critical and high vulnerabilities for the supported lifetime of the distribution. And so when you compare that with Debian, which is a community project, and while many contributors to Debian, including myself do fix security issues in Debian, it simply cannot provide the same level of commitment to security as the commercially backed Linux distribution vendors, such as Canonical, Red Hat and Sousa do. So this is a very important point when you're choosing your base image. It's not just about choosing something that is smaller, it's about choosing something that has a better security stance by default. And I think these numbers sort of illustrate that point, which may be not many people are aware of in terms of what the security benefits might be. So this then presents a couple of what-ifs. It's what if I could have the low complexity of maintaining Ubuntu-based containers with the security profile of Alpine? We've just seen no vulnerabilities as a result of using Alpine. What if I can make container images that are smaller than Alpine? So let's try that. And what we're going to do here is we're gonna use Docker Slim to minify the container images, but we could equally use the Slim AI developer platform to do the same thing. But for the purposes of this demonstration, I'm just going to copy this one line here. I'm gonna go back to my terminal and I'm now going to minify this container image. Now we're not gonna talk about the internals of how this works because that was the topic that we talked about when we were last here with the CNCF. So we'll just push forward and we have a minified container image. So I'm now going to switch back to the presentation, which has a table of the results. So what we see here is that it doesn't matter which of the fact containers we started with, whether it was Alpine or Distrolis or a Debian base or an Ubuntu base, all of them see significant size reductions. I know some of you watching live can't see my screen, so I'll quickly run down here. But in terms of the size, all of the images are between 20 and 26 megabytes. Once they've been minimized using Docker Slim. And at the lower end, that means on Distrolis, we're looking at about a 3x reduction in size, the same for Alpine. For the Ubuntu images, we're looking between a five and 17 times reduction in size. And for that Debian image, we're looking for a six times reduction in size. But now we've really leveled the playing fields in terms of the size of the images. And we've also gone beyond what we get by using just Alpine alone. We've significantly reduced the size of our container. So the next question is, well, if we now have far fewer files inside our container image, has that removed vulnerabilities? So we'll start by, we're gonna pick a particular container image at this point. So we're going to look at the container image that was built with Ubuntu 2204, that also didn't install the container image up there. Didn't install the recommended packages that we have now minified with Docker Slim. And we already know that that container image is free of critical and high vulnerabilities. So what we're going to do is we're gonna look at just the medium vulnerabilities that are still present in that container image. And we have like just that report from Trivi in the article here. And we can see there are seven, I think, from memory. Most of those seven vulnerabilities relate to a package called E2FS progs. And if you're familiar with Linux file system, you'll know that that's all of the utilities that manipulate the extended file system on Linux. So what we're able to do is actually use the Docker desktop extension from Slim AI to go and look inside that container to see, is there any residual files left behind from those vulnerable packages that we should be concerned about? So what we're going to do is we're gonna use the Docker desktop extension to open that container image. And that will just take a moment, here it is. And we're looking at the all layers view here. And what we're going to do is we're gonna use the search criteria to actually go and peek inside the container to see if any of the vulnerable bits are left behind. So for example, I know that all of the extended to file system utilities start with E2F. So we're going to go and search for that. And then we'll flatten the results to make it easy to see. Oops, bother, just bear with me a moment. I've just clicked a button I shouldn't have. Let's go back to, there we go. Let's go back here. So we'll flatten the results and we'll put our search criteria in and it comes back with no information. So the extended to utilities are absent from the container and we can do the same thing by looking at this library, which is related to the same vulnerability. So we will do the same here and hit return and it comes back with nothing. Now I'm not going to do this for everything, but you do have links to all of the assets in order to reproduce this for yourself. So you can actually demonstrate, but I did the same searches for the other utilities as well. And then most of the vulnerabilities were attributed to SQLite. And again, we looked at the SQLite libraries, they're entirely absent because our application doesn't require them. And in fact, as a result of the SQLite libraries being removed, that also removed two of the low risk vulnerabilities that were highlighted. So we go down this list and we can easily determine that actually none of these components are left inside our container image. So now we have a container image that is free of critical high and medium vulnerabilities. So we have low vulnerabilities left. So we move on and what's interesting here is that my app requires Python. So we actually look to see, well, are there any vulnerabilities associated with Python itself? And there are in fact. So there are several. So what we can do is when we look at this vulnerability analysis, we can see that all actually the same CVE relating to the same issue. So it's to do with mail caps. So what we'll do is we'll craft this search term. And before we go and look at the minified container, what we're going to do is verify that this search term is actually the way that we should identify that this vulnerability exists in the fact containers. So I'm going back to my fact version of this container and I am searching for mail cap and I'm just gonna flatten the results for simplicity. And we can see it's a pure Python module and we can also see the, what's called the compiled byte code. So this mail cap does exist in the fact container and therefore the fact container does indeed carry this particular vulnerability. But if we now switch back to the slim container and do the same search and get the flattened results, we'll see that that comes back with nothing. So even though this is a pure Python module that's part of the Python distribution, because our application doesn't use this Python module, it's completely removed from our slim container image. So in fact, I was able to do this for all of the remaining low risk vulnerabilities and I've linked the CVEs in the document here. And all of the remaining low risk vulnerabilities were also removed by optimizing the container with Docker Slim or Slim AI. And it was trivial to verify this using the Slim AI Docker desktop extension in just a couple of minutes. So yes, we can have our cake and eat it too. And what's important to point out here is that there was a high risk vulnerability, which is CVE-2021-3399, which exists in G-Lib C. So that's the fundamental library that just about all applications are linked against. And that remains in both the Python-based image, the Debian-based official image from the Python project and also the distro less containers. Unlike Ubuntu, where that CVE has already been mitigated and unlike Alpine, where that vulnerability never existed by virtue of the fact that Alpine uses muscle. So this highlights, again, the importance of choosing the right base image in order to generate the most appropriate security stance for your container images. So we'll move on to some conclusions here. Firstly, I'm not gonna suggest that you should never use Alpine or distro less, particularly if you're working with Go or Rust, then they are good choices, particularly if you use the distro less static Debian base image with Go and Rust. But to recap, slimming container images is a vital process in the software supply chain. It can reduce the attack surface, it can increase deployment momentum, start increase startup performance, and it requires no changes to your existing container build processes, unlike having to learn multi-part builds with distro less or switching to Alpine, which may well be unfamiliar. And vulnerability scanners can produce false positives. So there's an argument to be made for using multiple vulnerability scanners and actually cross-checking the results. And it's also trivial to inspect your container images to verify if vulnerable components are present or not. So don't rely just on the results of the scanners, do actually go and check. And while Alpine is small and secure and has a low complexity Docker file, it introduces high complexity with considerations with regards to language ecosystems and performance compatibility impact. And Debian is not equal to Ubuntu with regards to security profile. So what's the outcome of all of this? I would choose to use the Jami no rec Docker file. This is based on Ubuntu 22.04, which came out just last month. It by default has a better security posture than 20.04. And we did a live stream talking about being a tech debt warrior and moving to newer releases as fast as possible. And here's why Ubuntu makes sense for the purposes of the evaluation here. I work in a team familiar with Ubuntu. Therefore, we can trade the slight increase in Docker file complexity, which is good use of apt in order to install Python in a minimal way. And what we gain from that is a Docker file that adheres to best practice, developer experience of using a familiar and well documented platform, which is Ubuntu, no runtime or build performance or compatibility considerations that can create friction and a container image that is free of critical and high risk vulnerabilities. And then by introducing either Slim AI or Docker Slim into the CI CD pipeline, we also gain a container image that is entirely free of known vulnerabilities and a container image that's three times smaller than an Alpine generated image or just six megabytes larger than a slim Alpine image. We get faster deployment velocity, faster container startup performance and perhaps this is a topic for another CNCF live in the future. We also get automatically generated app armor and set comp profiles for these containers as well. So in conclusion, caring about image size demonstrates that you care about the quality of the containers you deploy into production. Introducing slimming into your container production workflow can considerably reduce image complexity and reduce the attack surface while maintaining development velocity and adhering to best practices. I'm sorry, many of you have not been able to see this visual as we've been doing this, but as Annie described, the video will be made available and we will stream this presentation tomorrow on twitch.tv slash slimdevops. I don't know what questions might be outstanding. No worries, the perfect that was exactly put. So everyone who wanna see a new version of this, you can tune in tomorrow to the Slim AI Twitch. Also the recording of this with the video intact and the share screen and all of the example visuals will be shared, will be available immediately in the CNCS for Cloud Native Computing Foundation YouTube channel immediately after the stream ends. So do not worry, the visuals will be available then. And there was one audience question as well. They apologized to see the share screen, they might have misunderstood something, but then they said it sounds like your solution takes this input a container image and produces a new container image. That's exactly correct. So you'll have to watch the video recording after the fact to see what I'm about to share on my screen. But I'm going to compare two container images. The traditional fact container and the one that was slimmed using Docker Slim. But the first thing to explain is that the slim image that Docker Slim or Slim AI creates is a single layer container image that only includes inside it precisely what that application requires in order to function. So, yes, a whole new container image is generated and it's as if it's a from scratch image only using those assets from the original image that are actually required for the app to run. And what I'll do is if I go here, so I've got this, I'm using the Docker desktop extension and we have this compare feature. So I'm going to compare this, not this one, sorry, the one that we've been referring to. So the Jammino rec image with the Slim, oh, I did it wrong. That's not what I meant to do. Let's try that again. We're going to use this image there and we're going to compare with this one. So this is comparing the fat container with the Slim container. So first of all, it's very visible, everything that got jettisoned from the container image. So that's, you can trawl through that to actually see precisely what happened in the minification process. It's a very useful feature in that regards. But we can also see sort of a quick overview. So we can see the size differentials. We can also see here, look all of the shells have been removed from the minified container. We also have all of these binaries that are set GID or set UID, they're entirely absent from the Slim container. And then we can see that, the binary count is down from 10 fold from about 2,400 down to 240. So you can see sort of the impact that this is going to have on not just the security profile, but the performance impact of this container. And last week when we were at KubeCon, we were speaking to a number of organizations who saw using this minification technique as a way to make the mess go away. They were working with customers who were supplying container images to them and they were operating the infrastructure for them. And whilst those container image may well have been functional, they absolutely did not adhere to best practice and would have dozens and dozens of layers, for example, MB multi-gigabyte in size. So they're looking at, and we have customers like this using this technology in order to actually clean up the containers to make them production ready, regardless of how those containers were created in the first instance. Great, perfect. And then Gary continued, and it seems pretty clear that you do not do any application flow path minification, you just do static minification. No, we do static and dynamic minification. It doesn't do any source code analysis. It actually traces the application whilst it's executing. So Docker Slim will run the container and the app in the container. It can automatically introspect, but there are mechanisms to, you know, make that observation step more accurate, for example, instruct the container to run your integration tests to get the deepest sort of execution path across your application. And there's also syscall interception as well. And that, those working consort, because when all of that deep application knowledge has been created, that's also what enables us to create the app armor and set comp profiles to go along with those container images. Perfect. Then I think it's about to trying to wrap up. If there's any questions you can, well, maybe it's time to wrap up. We don't have time for any more questions. Back again, always, oh, there's immediately when I say that. What input slash configuration does it use for dynamic analysis that affects the flow path? So dynamic analysis is sort of part of the default operation, but what you can use to guide how the observation happens is if you've got a microservice, for example, you could export like a JSON object of your API endpoints and what methods they use and what the success and error conditions look like. And you can pass that into the observation piece and so it can hit all of those endpoints to fully exercise your microservice. And similarly, if you've got a web application, you can provide a list of all of the URL endpoints that your application has in order to exercise it completely. And even then you may bump into situations where not all of your static assets get loaded through your integration tests. We saw an example recently with a static website with an image carousel and not all of the images in the carousel got loaded. So you can even stipulate paths within the container image that should always be absolutely included or excluded for that matter. But there's a whole gamut of options in order to sort of tune the behavior of the observation. Great, but yeah, apologies again for the technical difficulties, but now it is time to wrap up. But at the same time, now that we wrap up, the recording will be available on the CNTF YouTube. So you can actually see with the visuals there or you can tune in tomorrow, for example, to Slim AI's Twitch to see a new version of today's session and ask more questions there. Also, obviously there's probably a lot of info in the article that was linked within the stream where you can find a host of things to follow up on the materials. But as always, thank you everyone for joining the latest episode of Cloud Cative Light. It was really great to have Martin here talking about comparing different minification techniques and their vulnerability assessment. Next week, we will have a really great session on enabling automatic setups in your on-prem cloud. Thank you everyone for joining in today and see you next week.


We all know that the defense budget was put on the table on Monday. Roughly $553 billion is the top-line level from the request. Much of the comparison of that number has been to different baselines. And one of the real questions you have in looking at defense is, is it up? Is it down? Is it flat? What exactly is going on here? The first baseline, of course, to compare to is the current spending baseline, and that is the FY10 enacted number. We're still spending FY10, obviously, because we're under a continuing resolution today. That number was about $528 billion. That's the spend rate at which DOD is theoretically running today. The continuing resolution, which is being debated in the House of Representatives now, has a slightly different number for DOD, a number that's subject to amendment. There are a lot of amendments being introduced. If you've had the pleasure of watching the House of Representatives going through its incredible maneuvering on this bill lately, it's quite an amazing opportunity. There was virtually unlimited debate yesterday on an $18 million cut. This is $18 million out of $526 billion for boards and commissions. And if they're going to pick this apart at the $18 million each level, they're going to be at it for quite some time. It's enormously intriguing. I think right about the time we finish our discussion today, the section is coming up of the bill that will deal with the second engine for the Joint Strike Fighter, which is an amendment that's of considerably more importance both in terms of dollars and in terms of philosophical indications. But by and large, that's the second benchmark against which the defense budget is being compared. The third benchmark is actually the President's budget request from last year, which I would remind you, pull my number out here, was actually about $549 billion, only $4 billion less than the budget request for FY12. So if you look at last year's request, not enacted, not authorized, not appropriated, but requested, the current budget is up only a very small amount over last year's budget, in fact, in many ways less than the level of inflation. My fundamental concern about the FY12 budget is that in my estimation it didn't really take on a lot of the tough issues facing the department, and that suggests that the harder choices are really in the coming years. I don't want to minimize the problem set that the department faces, as Dr. Hamery has pointed out, they don't have a lot of the levers available to them that were there in the early 90s. You can't pull out major forces from Europe. We don't have a lot left, although we may see a little bit of that. There was some possibility we might have in this budget and we didn't. Can't consolidate the prime contractors much anymore. Hard to do another BRAC at this point or anytime in the near future. Hard to take a holiday, procurement holiday from a holiday we're already on. And significant end-strength reductions or four-structure reductions are also not feasible in the current environment of a couple of ongoing conflicts. What I think is significant is how much Gates was rolled since August of this year. Go back to what his red lines were when he first announced the defense initiatives, the efficiency initiatives. The first one he's going to sustain top-line growth at 1% a year and then use the savings to generate the additional 1% to 2% that was necessary to maintain essentially the program we have now into the future. Well, he got lost on that, $78 billion is being taken of the out years. He was going to produce $100 billion in savings initiatives and the services were going to be able, the department was going to be able to reinvest that in four-structure modernization. Well, they did save $100 but $28 billion of that has to go to higher expected costs for O&M, for personnel and so they're only getting to reinvest $70 billion rather than the $100 billion of services have been promised only last August. And the third thing is that four-structure was off the table last August. But the only way he could square it was to start cutting four-structure, $27,000 in the Army, $15,000 to $20,000 in the Marines. And so this is Secretary Gates who I would argue has by far the most political clout within the Beltway of a cabinet officer. That's a pretty rapid change in his bottom lines.


What is going on guys welcome back to the channel and I appreciate you being here today. I bring this top five Lockies loot drops in a week basically clips of me since the curse of Osiris has been released So expect a quite a few new exhaustive awards within this video But guys if you want to get your hands on some epic loot of your own In the form of exclusive ember and spiral calls gift cards and much more Simply hit that like button on this video leave a comment down below and join my discourse There are links within the video description. Also people if you have any amazing clip to send in whether it's a lucky loot drop an amazing PvP play a WTF moment whatever send it into the email just linked within the top of the video description Well, let's get straight into this top five and then number five. We have a clip sent in by feline raider I honestly wish the crypto was this nice to me Well Titan, let's see what we have here. You know number four. We have a clip sent in by the pain effect When Kate gives you the most OP weapon ever pulse rifle thingy or no the trace rifle Is that a quest item? Dude, if it's not and I get it.  What's it gonna give me? Oh?  I got the Prometheus lens. I got the Prometheus lens look look I Got it from Kate.  We have a clip sent in by rookie are seeing people get new exotics from vendors Just reminds me of how much this game hates me Have a clip sent in by a crazy bum when the blue bastard himself rewards you one of the rarest Exotics in the game within the first day of this DLCs release in that number one We have a clip sent in by JJ the most OP weapon in the game being rewarded from a legendary I got the Prometheus lens I got the Prometheus lens I just got it from a legendary from a legendary from a fucking legendary Oh my god Oh my But guys as and it's top five luckiest loot drops of the week if you enjoyed the video leaving a like Really does help me out remember if you have any amazing clip to send in send it into the email I've just linked within the top of the video description But thanks as always for stopping by people and hopefully I will see you on that next one