Hi guys, welcome back to my YouTube channel here. This is Daniel Rose. I'm going to do a video today about testing your hard drive, something extremely important. Backup and data protection and all that good stuff are very, very important topics to me. Just to quickly say, I'm using Ubuntu 2010. That's why I have my terminal up here. It's not the, I think it's one of the long-term supports LTS releases Which is why it's not the latest Ubuntu. I think they're on something like 22 now I decided a while back that I want to stick with LTS releases But I don't think any of this stuff has has really significantly changed in in in the meantime um Now regarding smart testing smart stands for if I can find us here on my screen somewhere smart monitoring analysis and reporting testing This is basically a Now i'm not a hardware or a firmware guy But i'm just going to give my basic understanding of this It needs to be supported on the actual storage media the disks themselves And then the operating system can read their self-reported data now for instance When I go into my laptop which has an nvme type ssd storage This is my desktop computer and actually it's a bummer because I'm much more interested in knowing the health of my laptop which only has one drive than my desktop because if You know this if a drive blows out on my desktop I can recover pretty easily By buying a new drive and I take regular backup season clone zilla, which everyone should be doing But if I'm on business travel and my laptop goes kapoot I'm in a world of pain and that can really compromise my ability to work. So This is what smart testing is about. It's not about saying. Oh, I see that my hard drive or my ssd Is starting to break because i'm booting into a bunch and i'm getting all these errors It's about periodically pro actively running these checks and at the first sign of failure Then that's when you want to move in and what would moving in be if it were me I would first first my first move if it was getting any indication of a failing drive back up the system clone zilla Is your friend in this regard amazing amazing program? Then I would go out and buy a new replacement drive I might even use a chance to upgrade the capacity and I would Move the data from the failing drive onto the new drive And there you are put that in the computer and swap out and you're back in action. You've got you've just bought yourself Uh more time because that's the thing with flash drives Storage like ssd and hdd. They're all going to eventually fail. So you're just trying to buy yourself time Against data loss as an insurance policy And it's a lot cheaper to buy a new hard drive than it is to lose all your data when your hard drive fails And or you have to either lose the data or try to bring it to something like a data recovery specialist Lot cheaper to just buy a new disc disc discs have come down in price a lot. So anyway Uh using this utility disc there is a way to um You know check out your smart data by just clicking here a lot of people don't know this I've been using discs for i've been using a bunch to for 14 years I never saw there was a little smart data thing until uh about a year ago But it is right there just pop up here It's not under volumes because when you think about it You're not interested in the health of a of a partition. You you're caring about the health of the actual disc So click them click onto the things here smart data and self tests And this is really the key thing overall assessment disc is okay But it's quite amazing how granular the data that you're going to be getting out of this stuff is like look at this Pericycle kind 4717 the computer actually logs. How many times you've turned on this disc along with the computer, right? Now you can re manually rerun Self-test and you can see I've got three options here short extended and conveyance a conveyance I believe is designed to to look for errors that occurred as the thing was uh in transit Extended is more extended testing someone asks someone asked on one of those a bunch of forms is it safe Does running tests actually ironically it would be degrade the disc the answer was technically yes because all usage of the computer degrades the disc Or ages the disc but not beyond regular usage basically so if your disc is healthy This is when you're supposed to be running these things and you don't need to go crazy I don't think there'd be any point running these smart tests every single day But you know once a month and they're running anyway so You just you really need to check them periodically or as I said if you're going on a business trip That's when I would really recommend quickly a week before your trip Test the disc see that it's okay, and you might avoid yourself a major headache Um down the road So the second way you can do all this business is going is a pro as another GUI It's called g smart control. What I like about g smart control Is that uh, they ask you for pseudo permission. You didn't see it because it was in my other screen They asked for pseudo permission at the start. So um, you don't need to give it each time because think to When you're asking the operating system to communicate on such a low level with the hardware you're going to need elevated permission. So that's uh That's part for the course now what you can do here And I you get myself confused because I got four drives in this thing. I've got a backup drive I've got a media volume for storing on my video clips I have a A bunch to drive and I have a window bare metal drive for the rare and horrific times that I need to actually use windows Now, uh, you can do reread data. I'm going to use this one or you can perform your tests Now what I like about g smart control Unlike disks is that it tells you what you're doing, right? It tells you you can give we can run a short and extended test. It doesn't do conveyance Uh, and it gives you an estimated duration as well, which I also appreciate So you can kind of know how long you might need to sit with your thing for the extended one takes 10 minutes The short one takes two minutes. Let's just do a short one so that I can uh, You can only you only have two more minutes of my company to to tolerate But it says note that this test is no way comprehensive. Its main purpose is to detect totally damaged drives So, you know, if this for me again, I come back to that scenario of going on a business trip I'd probably be running for the for the sake of running of you know, 10 more minutes I'd go for the extended test. We can see we're already 20% Through the testing process. So I'll just sing songs for the next two minutes or something like that um So, yeah, as I said for certain storage media NVME It seems as if this is a problem Um, I spent about five minutes looking for solutions It said to install an NVME CLI and that would sort it out on one of these ask a bunch of threads It didn't that didn't work for me. Um, it couldn't find it in the repositories So I'm going to be spending a bit more time tonight Trying to uh sort this out and if I figure out a solution to I'll be able to run these tests on my NVME SSD Then I will go ahead and uh and do that. Um, there's a few more stuff. There's a few more things and smart mon tools Um, this these aren't the only ones for a bunch of Linux. I'm sure I'm only, you know, scratching the surface in terms of the tools that are available By the way, what I would recommend I've talked on this channel about dumping stuff onto HDD enclosures for cold archival storage now to the best of my knowledge There is no tool in Synology DSM for doing smart data checks on external drives, which is a big pity Um, I'm not sure if you can hook up a enclosure to an Ubuntu machine and uh run it like this I don't know but again, I will be checking and reporting back on my findings because Uh, that's basically again if you're using it for archival, uh, that's the kind of thing that you want to know about Not when the failure is happening, but before any Disgross data rot bit rot Starts threatening the integrity of your data. Uh, you can see here my test has completed without errors But it was a short two minute test and I'm going to do the extended one out. Just drill a little bit deeper But I can do that after hitting the stop button. So those are the two I would say key GUIs I find on Ubuntu for testing the healthier hard drive Definitely recommend running them periodically and again, as I said or try to emphasize the purpose of these things is really Preventative maintenance. It's not remedial maintenance. You want to do this before You find any errors and I also recommend it especially before as I said, you're traveling or any time Where murphy's rule might apply, you know, when things go wrong, they go wrong at the worst possible time Thanks for watching this video. If you want to get more videos from me, feel free to subscribe to this youtube channel. Have a great day


Let me take a few questions. Jabalpur, over to you. Good morning. My first question is, what is the reference of 0 degree Kelvin? My first question is, what is the reference point of 0 Kelvin? And my second question is, if I am the student of first year or second year, how will you define entropy? Over to you sir. Your first question was about 0 Kelvin. Get used to it. Forgot the reflexes over the weekend. About 0 Kelvin, 0 Kelvin is not defined. The, our thermodynamic temperature scales, remember thermodynamic temperature you could have many scales, including Kelvin scale just one for a single reference point. And for Kelvin scale, we know it is triple point of water. So, we do not have to define 0 K and it is not defined. However, there is already a discussion on Moodle also on this line. Do participate in that, where approachability of 0 K etcetera has been discussed. The second question was, how do you define S to a student in the first and second year? We define it precisely the way we have defined it during this course. First, emphasize before we come to second law, emphasize that energy also is defined as a difference. So, in a similar way we define entropy also as a difference. And we say that the show them this analogy delta E is defined as say minus integral 1 to 2. This change in energy between two states, the work done by an adiabatic process. And here we select any adiabatic process. First law says that for any adiabatic process, this work done will be independent of the path. So, we do not have to define the path. We select any suitable path. Only requirement is that it should be an adiabatic process. In a similar fashion, note this similarity delta S 1 2 is defined as 1 to 2 integral of d cube by t. Just the way we had adiabatic as the constraint here, reversible as a constraint here. And here any reversible process. So, we can say the first law which defines energy is our understanding of the behavior of adiabatic processes. The second law which defines changes in entropy is our understanding of the way reversible processes behave. And the second law tells you the derivations from the second law tell you that this integral will be independent of the path for any reversible process. This is the way a student who has done 12th standard calculus plus a bit more math in first year engineering can understand. We have had the teaching of thermodynamics in the four year B. Tech program right from the, we have had it at various stages from second year, second semester, second year, first semester, even in first year, second semester. And we have had absolutely no difficulty in making them understand this. Over to you. Thank you sir. Panvel, good morning. Over to you. Area under the TDS diagram, integration of TDS greater than or equal to cube. So, you have given the homework for checking this equality or greater than sign. So, in most of the books I found that it is given is equal to cube. Can you elaborate it sir? Thank you. This was the question I think which was discussed. I think sometime on Saturday. Again, let me sketch that. We have a quasi-static process on a P V diagram. What is that this area under this curve? And we said area under this curve is integral P D V and which is W expansion. No doubt about it. Now, let us take a process and we say that this also is quasi-static. Because it is quasi-static, we can sketch it as a continuous curve. Remember that a continuous curve in state space means only a quasi-static process. It need not be a reversible process. The question that arises is this. This is if this was A under the P V curve. Let this be A under the T S curve. Now, remember that our second law says that delta S or let us take in a differential form. D S is greater than or equal to D cube by T. That is our entropy principle or entropy relation. T is always positive. So, we end up with T D S is greater than or equal to D cube. Now, integrate both sides, left hand side as well as right hand side. The integral of T D S will be higher than or equal to the integral of D cube. And integral of T D S is nothing but area under the T S diagram of a quasi-static curve, quasi-static process which will be greater than or equal to cube. That means, even if you have an adiabatic process, it is possible for the process to have an area higher than that. That means, if you have an adiabatic process, the area can be 0 like this. Area can be positive. It can go like this. Area can be as much positive as it feels like. So, remember this comes out of the basic idea of second law or the entropy relation. Good morning, Dr. Brahmara. Any questions? Over to you. Yes, sir. There is one question regarding entropy, sir. I am handing out the mic to the participant. Good morning, sir. This is Janardhan. And my question is like what is the meaning of the word entropy? It can be dictionary meaning or general meaning. And what does it physically means? It is like if we say heat, we can get a feel of that. When we say entropy, how can we feel that? Physical explanation of that. The question is, what is the meaning of entropy and how do you explain it and how do you feel it? Remember that when it comes to feel, perhaps the only thermodynamic variable which we feel is the temperature because of the three thermodynamic properties which basic thermodynamic properties which we have defined T, E and S. Only the temperature is defined at some sort of a level. You know the label on isotherm and each isotherm can be considered as a level. Whereas, energy is defined as delta E entropy is also defined as a delta S. So, for this there is no direct feel. And that also means you will notice that there is no direct measurement also. And this is true not only of the thermal energy that we are talking about. This is true also of the measurement of other energy components. You know gravitational potential energy is not directly measured as energy. It is measured in terms of the level difference or height difference. At something comes down in a height, you can measure the work required to bring it down or work required to raise it up. Similarly, our electricity energy meter, it keeps continuously track of voltage as well as current and integrates that out to give you the actually what it measures is interaction. It does not measure delta E. Delta E is derived from it. So, one should be always conscious of the fact that of the three basic thermodynamic properties, temperature, energy and entropy. Temperature is the only one which is something like a level and we have a feel for it. Whereas, energy and entropy are first defined as differences and we do not have a feel for it. And that translates into the fact that there is no direct measurement for this. So, that should be emphasized because people think that kinetic energy can be directly measured. Kinetic energy is not directly measured. You measure the velocity of a particle or a body, linear velocity or angular velocity whatever it is and use a formula to determine the kinetic energy. If you try to measure the kinetic energy, actually you are measuring, you are creating a change of state from high kinetic energy to low kinetic energy and that energy change for example, breaking a vehicle that is an interaction and that interaction is being measured. Direct measurement of energy or energy differences is not possible. And as I have said earlier maybe a junior school boy or a junior high school boy may find it difficult to understand what entropy is. Energy for some reason is easily understandable and that is why we introduce it in early high school. I think quite often it is introduced is our ability to do work because reduction in energy as we have seen is the work done by a system provided there is no heat transfer. And because of that perhaps in school we keep the heat transfer separate from work transfer that is why we talk only of heat, we do not talk of thermodynamics. Thermodynamics properly should be learnt only when some calculus is learnt. So, over to you Brahmara. What is the dictionary meaning of entropic? When you say work we can tell that some body is moving from one place to other place some distance. But physically the entropy what is that? See for entropy we should not and I do not try to give a very simple explanation. It is a very useful property which allows us to determine whether a proposed process is a possible process or an impossible process. Students and even school kids understand that there is something called time, there is something called before and after there is only a direction in which many processes take place. You just tell them that entropy tells us the direction whether the proposed direction of a process is a possible or an impossible process. And remember that if you take an adiabatic system and look at its two states then all that we say is that state with the higher entropy will be the later state in time state with a lower entropy will be the before state or the earlier state in time. Tanjavur over to you, over to you Nirma at Amdabad. Sir, my question is can we calculate the entropy of any system entropy produce? I am talking about the entropy of any system absolute entropy over to you. I think I have said so far that entropy is defined only as a difference. So, there is for us there is no such thing as an absolute value of entropy. You may go into textbooks of material science and you know solid state physics and things like that. There they have a so called third law of thermodynamics where they say that the entropy of a perfect crystal at 0 Kelvin is 0, but there are two problems with this. The first problem is thermodynamics should not and basic thermodynamics does not depend on the properties of any material and should not. If a basic law of nature should be independent of any particular material. So, the moment you talk of something called a perfect crystal you are not remaining in the domain of proper thermodynamics. And second thing even if you accept a perfect crystal as something you know God given even then if you really look at it that also is a just a definition that let us define that to be 0. If you define it to be a positive number or a negative number absolutely nothing goes wrong because finally everything comes down to the fact that it is the entropy difference which is important as mechanical engineers we should never ever think up of absolute value of entropy over to you. Thank you sir over and out.


Amen. God is good and all the time. Amen, amen. It is a blessing of God to be here and I thank God for this opportunity and I believe God has something very special prepared for us tonight in Jesus' name. Amen. We already heard a lot of awesome messages and I think if we apply half of what we heard we can flip our world upside down. But because we still have one more night we'll just take a little bit more time and prepare our faith for what's about to happen tonight. As some of you already have heard we're gonna pray for the sick. We're gonna pray specifically for people who have some issues that they cannot resolve with the help of doctors, medicine, counselors, and other things that we would trust the Holy Spirit for His divine intervention in people's lives. Amen. God is not done with miracles. He's still yesterday, today, and forever the same. The idea that Jesus healed people only to prove that He is God is completely weird because I saw a good friend of mine Jacob over here when he plays piano. He doesn't play piano to prove that He has fingers. Though playing piano does prove He has fingers. He plays piano because He loves playing piano and making music. Jesus did not heal people to prove that He was God. Though it proves He is God, but His motive was always compassion and love for the hurting people. God always loved the sinner and hated the sin.  God always loved the cursed people and hated the curse. God always loved the demon possessed people and hated the demons. Our God always loves people and He loves the sick and He loves to help us. I know sometimes we pray for the sick. When we are sick ourselves and we pray for a certain time and after a certain time we just give up. And it's not right to do that.  Don't ask me for this. My grace is sufficient. But if God doesn't give you a word, you have to stand on His promise and you'd only stop when you get the victory, not when you get tired. Can somebody say amen? And then we will see the results and the blessing of God. All the promises of God, the promises of healing, they are like cement. They must be mixed with water. They must be mixed with our faith. And today we are going to just do that. Take a few minutes and just encourage our faith toward what is going to happen tonight in Jesus' name. When it comes to faith, faith is a very complicated subject and sometimes when you come to church it gets a little bit even more complicated in church. But faith is supposed to be very simple. The story that I heard once that really helped me to kind of bottle down what faith is, is a story, I'm not even sure whether this story is true or not. It's a story about one man who was going through, they put a rope over the Niagara Falls and he was walking over the Niagara Falls. He walked once and everybody cheered and after that he got blindfolded and he went over Niagara Falls blindfolded on the rope. After they removed the blindfold everybody was really impressed and really just taken in awe by how he was so brave. And he took the wheelbarrow and took the wheelbarrow over the Niagara Falls and that's when everybody got super, super excited. After this he asked people a question. He said, does anybody believe that I can put a person in a wheelbarrow and carry that person across the Niagara Falls? What do you think people responded? Yeah! And then he asked the question, do I have any volunteers? See that is faith. Now when you believe that God can take a wheelbarrow across Niagara Falls, it's when you believe God can take you in a wheelbarrow across the Niagara Falls. That is faith. Faith is not intellectual agreement with the promises of God. It's a hard trust and confidence that He won't fail you even when it's hard. It's very simple. It's not an emotion. It's a position of the heart that trust and rust arrest and the promises of God. And though He slay me yet I will trust in one of the prophets says, that is faith. In the Bible some people had leaps of faith. Blind Bartimaeus, woman with the issue of blood lepers and we see on and on and on people who took a very big leap of faith. For a moment they had this great faith in Jesus but you saw that Jesus constantly the people who had the least kind of faith were disciples. And you don't see them experiencing miracles in their life but it's something very interesting that Jesus wasn't teaching disciples how to take leaps of faith. He was teaching them how to live a life of faith. And you don't see Bartimaeus, you don't see a woman with the issue of blood and you don't see 10 lepers doing anything for the kingdom of God in the book of Acts. Only people who had the most weirdest weakest faith ever. And maybe you're here today and you're not one of those people who can take a leap of faith. You find yourself as a doubter. You find yourself constantly being afraid more than being actually in faith. I want to tell you something. God is not just interested in developing within you an ounce of faith for which you can snatch a miracle and then you can go and live your main day life. God is interested in developing within you a life of faith that will not just bring a miracle into your life but make your life a channel for His power to touch other people not just your life. And somebody say amen. Faith, you know some 5,590 white days ago my family immigrated to United States. I was 13 years of age and when I came to United States I did not speak any English. I know somewhere like man you have an accent trust me. Some 15 years ago my English was really really bad. I would mix words up. It was just really really terrible. And I understood one thing about this country that if you want to function in this country properly.  Because you cannot be walking around with a translator all the time. You have to learn English. Otherwise you will get lost. Otherwise you won't know what to purchase. Otherwise you will not know how to return certain products. And most of you know that learning English is not that easy. There is no prayer anybody can offer where you can get English downloaded into your mind. I've heard of stories where missionaries learn a language supernaturally but those stories seem not to happen to people who move to United States. Learning a language is not easy. That's exactly what faith is. Faith is a language through which you communicate with God. God doesn't speak Russian. God doesn't speak English. And God does not speak Christianese. He speaks faith. The Bible says he calls those things which are not as though they were. God's language is this. He looks at something that doesn't exist and he says it exists. A humanistic looks at it and says it's insane. It goes against our logic and God says that is how I am. God speaks faith. And many of us we come to church and we don't learn faith. We learn Christianese. Praise the Lord brother. God has been good to me man. But when we walk out of the church the Christianese goes outside of the window. Negativity, pessimism and everything that is not contrary with faith is our language inside of us, outside of us and everywhere else. And God wants us to be a generation who doesn't just take leaps of faith in which we can snatch a miracle or two. But we learn to live a life of faith. Develop a language of God, a language of faith. Somebody say amen. And this language of course is learned step by step as we walk with God. We go through trials. We experience miracles. We experience setbacks. Our faith gets stronger and our faith gets more mature. If you have your Bible let's go together to 1 Samuel chapter 16 verse 13 and 14. And I'm going to read from the New Kings James Version. And this is the following. Then Samuel took the horn of oil and anointed him in the midst of his brothers. And the spirit of the Lord came upon David from that day forward. So Samuel arose and went to Ramah. But the spirit of the Lord departed from soul and a distressing spirit from the Lord troubled him. If you're taking notes you can title this simple message that we are going to have. Anoint my head with oil. Now I know some of you may say how can this relate with faith? Hang in there. We will get to this in just a moment. Let me ask you a question. When did David become a king? When he was a teenager anointed by Prophet Samuel or when he was 37 years old and all the tribes of Israel gathered together and put a crown on his head? When did David become a king? Let's make it easy. A. When he was a teenager. B. When he was 37 years of age. How many of you in favor of A raise your hand? In favor of B raise your hand. Okay. Some of you noticed that there's many less of you the B ones. So you just I must be wrong if there's not many of us who agree with this. Listen very carefully. Here is a young man and some historians or theologians they say that he was about 15 years of age. He's shepherding a sheep and a prophet of God comes to him and says takes the oil and pours oil on his head and anoints him to be a king. But you don't see the next day David occupying a throne. You don't see David in the palace next week. We don't see a crown on David's head right away. We see anointing on his head that makes him a king. Though he's just a teenager and after he became a king he didn't go to the palace. Actually everything on the outside was still the same. It was the same sheep. It was the same brothers who always picked on him. It was the same father who always sent him on this crazy errands. Everything was the same and nothing was the same because a young man became a king. Something happened on inside. A supernatural magnet was placed inside of David. What when a lion would come and normal shepherd would run for his life but a king trapped in the teenager's body runs after the lion and kills a lion. Nobody's seen that. No crown on his head but a king is inside. A bear comes in a typical shepherd no matter how powerful he is he most likely is going to run for hiding but a king inside doesn't run for hiding it goes and kills the bear because inside David is a king. No crown, no palace, no army, no king, salary, no king, servants, nothing on the outside indicates he's a king. On the inside he is anointed to be one. He goes to run errands. Most of us went to do errands for our parents but when a king went to run errands for his parents he didn't just bring cheese to the commander of an army. He brought a stone into the head of the Goliath. Why? A king came to the field trapped in a teenager's body. A king started to attract a palace. He didn't go into the palace as a king first he went to the palace as a musician and see there's many people who could have went to the palace as a musician. Why did he go to the palace as a musician? Because when you're a king and inside it's a magnet that begins to attract the kingdom. There is a guy who's sitting on the throne. There is a guy who has the plans for his son to take the throne but when you have a kingdom inside there will be no devil in hell who can stop that. No king, no empire, no regime, no threats, no army can stop a man who has become something on the inside through the anointing of the Holy Spirit. We see he becomes a commander of the army and eventually he gets kicked out. He gets framed for trying to assassinate the king and take over the throne.   Saul died, his sons died, everybody died because the king on the inside was anointed. David did not become a king because he got a crown. He became a king because he got anointed. That's how God works all the time. Most of us what we want God to do for us is this. We asking God for a crown, a palace, soldiers and an army. For some people it's asking God even to touch a physical body. We ask God to change even our outward circumstances and that's a noble thing to ask and it's important to us but we must understand the way and the manner the Holy Spirit works. Many times the way God will do a miracle in our life is not first coming and putting a crown on our head but coming and putting a king inside in your spirit and sometimes the crown can come the next day, sometimes the crown can come next week, sometimes the crown can come next month and sometimes a crown like for David will come some 15 years later. It's dangerous to have a crown on your head without having one in your spirit. Saul had a crown on his head. Saul was taller than anybody else. Saul had a title, Saul had the army, Saul had the palace.  He still had a crown but when you're no longer a king on inside your crown is not just decoration. It's demonic because the Bible says demons started to torment him. He started to fall under pressure over the things that he had because he was not that on inside.  Faith is when the revelation comes inside and revelation is not inside. Inside is when you're reading the Bible and you you get this cool thing this with this and with that and comes up with a scripture and you get a sermon. That's an inside. That's not a revelation. Revelation is when on the inside a truth of God's Word becomes so real it takes your whole inside and flips it upside down but you cannot make a sermon out of it. You can't. You know something happened and people ask you can you share it? I can't explain it because faith is when the oil goes on your head and you become a king and there is no sermon about it. The only thing is this is after this occurrence after this revelation lions die, bears die, Goliaths die and kings soul dies and a crown ends up on your head. That's what happens. From the beginning God always worked like that. If you look in Genesis chapter one we see that God first made the light and four days later he made the sun. Most of us read it just creeper skip it through but I used to think the first first day when people ask me what was the what did God make on the first day? God made a son. But your Bible makes you to understand that God on the first day did not make the son. He made the light and on the day four made the son. God works completely the other way around because in our mind we say this in order to have light you have to have the son and God says in order to have the son you have to have light completely everything other way. We see same thing with Abraham. Nobody becomes a father who doesn't have kids. Abraham doesn't have kids and God comes to him and says you are a father. Oh and let's add little things to it. Of many nations.  In God's world nobody gets kids until he first becomes a father. Completely everything around. Joshua is facing a Jericho and Jericho is fortified city. The Bible says the walls are very high and the Jericho doesn't want us to render. And God comes to Jericho, God comes to Joshua and says Joshua I have given Jericho into your hands. All of it's mighty man. They're yours. The interesting part is Jericho didn't fall. I think Joshua after this conversation was looking over. That's it. The walls fell. Nothing happened. The city fell in a spiritual world and it fell in Joshua's spirit and only then Joshua took down the walls with the power of God. In our world if you do right things you become righteous. In God's world you become righteous so that you can do good things. God always works the other way around. Faith is God's way but it will conflict with your mind because your mind says put a crown on my head and then I become a king. God says you become a king and the crown will come. And somebody say amen. This applies also in area of health. This applies in the area of ministry and this applies also to every area that we want to work with God. God works just like that.  I was extremely shy. I was so shy of people. I was so shy to be talking to people. I avoided people. I was scared of people and anytime I would get a chance to be around people I was so awkward that people would just walk away. I was very awkward. And people were awkward back to me and I always blamed people for that. I said if people would have been nicer if they would have had nine fruit of the spirit and if everybody would have been as kind as Jesus I wouldn't have these problems. So I was thinking if God can change people and then I won't have to worry about walking around feeling constantly ashamed, ugly, worthless and no good. And I always prayed for people. For God to change people around me and then I realized probably that's not gonna happen. I started to pray for God to change my physical appearance and for God to change my outside life. I asked God for gifts because when I tried to speak my Russian wasn't good, my Ukrainian wasn't good and my English barely was developing. So I thought if I could speak good maybe people will like me and that wasn't going really well. It was really really slow. I tried to sing. Somebody says that the elephant stepped on my ear and so my singing, the ability to sing and write songs completely flashed out of the window and saying verses in church was no longer cool so that I lost the window opportunity there. I guess now the spoken word is becoming cool so but in that time spoken word wasn't cool either. And I remember my prayer was this is God if you change my outward circumstances I will change the kind of man I have become on the inside for 13 years.  Socially awkward, afraid of people and just afraid of myself. And these prayers went on and on and on and on until the Holy Spirit wasn't answering them and I started to begin to just kind of spending more time with God and God kept always going for my head. I was like God I got this. You go to kid of other problems that you left kind of in my life or you allowed to happen in my life and that's why I have this kind of a mind and this kind of a person on the inside. They are the problem and you fix them this person I promise you I will take care of myself but that's not how it works God knows if he puts a crown on the head of a man who's not a king that crown kills him. He always works the other way around and when God started to work on the inside of my spirit and it didn't happen over one night I wish it would have happened like with David but it's so simple that they're anointing the revelation of God's Word who I am in Christ and the fact that I'm a creation of God and the fact that what you see today is not real me the real me is somebody inside. What you see today is a skin stretched over a skeleton and after you bury me in some five years you won't even see the skin. The real me the real value of a person is hidden by how much Jesus paid on a cross for me and when all of these things begin to slowly penetrate and I stopped worrying about my circumstances it was incredible. My greats went up through the roof in school. I started being liked by other people it was weird. I could hold a conversation with another people and my speaking started to get better and I started to get I started to see influence the crown started to become something I was chasing was running away from me but when a king came inside the crown came with him. God wants to change you on the inside. If you are sick today you may say this is nothing to do with me this is all jumbo jumbo stuff I'm sick and this cannot help me.  A healthy mind will retain healing. I heard a testimony of a young girl she was now she was in her 30s now so she was not a young girl but when she was two years of age and she was sitting on a horse and the photographer who was taking a baby of the pictures of her somehow the flash from the camera spoke the horse and the horse jumped and this two-year-old girl falls from a horse on the rocks and receives a severe brain damage because of that she started to develop seizures and epilepsy and as she grew up and these things would happen some every other day and they would be severe and so she would be in school and she would be shaken on the floor and shivering and became very embarrassing unbearable and so she left the public school and start being educated at home. At the age of 16 they decided to do a special surgery on her thinking that they will undo the damage caused by the injury falling from a horse and that she will be better during the surgery she suffered a stroke. Her forebody became paralyzed and things became worse and now instead of having seizures every other day she was having them every single day and from 16 on this person accepted this as her destiny and as her life and one day she was sitting on the couch and the person was praying on the TV and this lady that was praying for TV was praying for the sick people and she had a word of knowledge and she said there is a lady who's sitting on the couch and she said that I see an injury something had to do with the horse and that you suffered something with your head and God is healing you from that injury she didn't mention epilepsy anything of that but just said that God is healing you of that injury and this young lady something happened inside not the healing that happened first what happened is the word of God went into her mind and started to flush out the idea that living 30 years in epilepsy was the perfect will of God for her and for the first time in her life she accepted the idea that maybe perhaps it is the will of God that by the stripes of Jesus I might be whole when she received that thing she immediately felt just this light this electricity that went through her body this revelation came inside that I'm a healthy person and God is healing me 30 days passed after that and there was not one seizure well if you would know the rest of story it wouldn't clap now but after 30 days when she was in the kitchen seizures came back except this time it's as though all the 30 days of seizures were condensed to 30 minutes and they came on her she almost died and when she came out of those seizures she told her mom she said when I went into the seizures I couldn't control my body but I still could control my thoughts and she said and every demon in hell grows up against me and said God didn't heal you and she said in that moment I had 30 days to prepare my mind and to get my mind prepared and she says in that moment in the corridors of my mind this is with the help of the Holy Spirit I started to repeat this verse by his stripes I was healed she said he went against everything I'm known because here's my body shaking and baking on the floor and my mind is saying I was healed she said when all of that ended she stood up and she's a mom I was healed when this testimony was recorded it was seven years and this young woman has not had one seizure since I want to tell you something that you have to get healed in your mind what I mean by that is that God's word has to take precedence over your reality many of us have been bullied by our reality too long many of us have been subdued by our reality too long and this is a time where God wants to change the reality on inside we have a young woman here with us today who given her life to Jesus from our church about a month ago and when she gave her life to Jesus right away she also surrendered her her drugs and other things that she had going on in her life and I don't remember when I was talking with my wife on the same day on Sunday with her and she was mentioning that she was in a car accident four years prior and when she was in a car accident she was eight months pregnant and the car accident has brought such a trauma to her life that while she was talking about car accident she was shivering and shaking and she said ever since then it's been four years that I do not drive a vehicle not only I do not drive a vehicle but I am extremely terrified of being in one and I told her I say you know God is gonna set you free but I don't ask you please do not get inside of the vehicle until first God does something inside of you I asked her to take a verse where the Bible says God has not given a spirit of fear but power love and sound mind and I asked you to get a notebook and I said I want you to write this verse 1,000 times so that the software in your mind can be changed and so don't try to get behind the wheel first you have to inside of your heart there has to be a revelation that you are not a person that you grew up for four years to be and this doesn't happen always through prayer doesn't always happen through somebody laying hands on you sometimes it happens with you step by step putting God's word inside of you and pushing every other thing out you may not change your reality but you can change the reality inside by filling yourself with the promise of God and sometimes it's so hard especially when the revelation contradicts the situation but if you hold on to the revelation long enough it will change your situation but if you have a situation that changes but inside of you there is no promise of God you're lacking soul holding on to a crown for which you have no right for and this young woman last Wednesday actually she was getting baptized and I was upstairs and I saw a person pull in in the car and I thought it was someone else and I see her walking out of the car so I went downstairs and I said what are you doing I said why are you driving you didn't finish riding a thousand times of this verse yet she said I know I'm on a hundred nine hundred time but she said it's been already a few weeks and I've been driving I said but I ask you not to drive until we first you know pray for you she says something happened inside it took away the fear on the outside God's promise must become the reality on inside and then your outside reality will have to line up to it that's why David says in Psalms anoint my head with oil you know why because he was with the sheep and he saw the sheep's biggest danger is not always lions and bears sometimes it flies oh there's such a small creatures but they can do more damage to the sheep's life than even a lion or a bear because they would put these eggs that would hatch and the things from the eggs would go through the through their nose and and begin to damage their mind and their head and David would protect the sheep by putting oil on their head so anytime the flies would come that they cannot stick and they will have to fly out and the sheep's mind will be protected I want to tell you something today the Holy Spirit wants to anoint your head when you were born you came into this world out of another world most of you head first not your body your head comes first and then the rest of the body that's how you come out of every situation head first financially in health in our relationship with God most of us what we want God is one God to drag the body and we say God then the head will come out and God says that's not how it works in Romans chapter 12 verse 2 it says do not be conformed to this world by be transformed it doesn't say renew your mind when your life is transformed it says renew your mind so that your life can be transformed out of every problem that you are in God will remove you out of the problem head first because somebody say head first turn to your neighbors say God's gonna get you out turn to your other neighbors say head first somebody say amen sometimes we think that real humility is when we humble ourselves in our situation the Bible never commands humility to a situation God always says humble yourself under a mighty hand of God it never says humble yourself under mighty hand of your sickness it doesn't say humble yourself under poverty and the humble yourself on the rejection humble yourself under curse humble yourself under oppression God always says humility and sometimes it takes a lot humility to recognize what God is saying to be true even if it contradicts your reality because somebody say amen in the conclusion I'm gonna read to you one verse from Exodus chapter 7 verse 1 it says the following so the Lord said to Moses see I have made you as God to Pharaoh and Aaron your brother shall be your prophet you should speak all that I commend you and Aaron your brother shall tell Pharaoh to send the children out of his land verse 3 and I will harden Pharaoh's heart and multiply my signs and my wonders in the land of Egypt and then it continues on what happens with it's a similar thing that God does with Moses Moses come to the land of Egypt and God sends him to deliver Israelites out of Egypt and he has few simple miracles there's three miracles at his disposal that he really perfected one of them was kind of cool you put your hand inside of the bosom you remove it and it becomes white he did that Pharaoh was like awesome I'm not moved another one was what he did with water and another one is what he did with stick he threw the stick and it turns into a snake and Moses comes and does that and so in the court is impressed but nobody is moved the only thing the Pharaoh does after this is he says since Israelites have the guts and the audacity to come and dare to ask me to move out of my nation I am gonna go ahead and make their hardship harder and that's when Moses gets discouraged Israelite says Moses you gave a sword to Pharaoh to kill us get away from here and Pharaoh gets more stronger and Moses comes to God and does the thing that most of us do says God I didn't sign up for this I told you this is not gonna work this is not a good idea Pharaoh doesn't like me people don't like me you seem to not do anything you know what God I quit and you would think God would say I'm sorry Moses let me help you let me just encourage you you know what God it seems to ignore completely all of his complaints all of the things that are happening God comes in the chapter 7 after all of that wine and he says Moses I'll make you a God to God did you just hear what I just said the Pharaoh doesn't like me people don't like me and you your miracles they're not seem to work in this in this particular situation this is not gonna work but God says Moses the reason it doesn't work is because with my miracles with my message you're still in your mind a slave when you walk into a court of Pharaoh I know you were trained there but you're walking in as a slave and Pharaoh smells a slave and he won't listen to a slave he says in the spiritual world I change your location I'm making you a God to him and I don't want you to walk in as a slave I want you to walk in I know this may sound kind of weird but it's in the Bible I want you to walk into his court not as a slave begging for freedom as a God commending and another lesser God let my people go you know what the interesting part it was after that revelation that God gave him ten plagues and if you study the Bible carefully you will see that in the history every single plague God did through Moses was directed toward a God in Egypt and after this revelation Pharaoh no longer was just bullying Moses he was being bullied and he was asking Moses ask your God please implore your God Pharaoh became a slave because Moses became the bully you've been bullied by the enemy too long anytime you're a slave on inside demons don't respond the slaves they respond only to authority you can be an ex-slave but if once that penetrates inside of you and you don't have to go on a high spiritual experience to get the revelation you can be at the lowest point of your life like Moses nothing is working out and at that moment God comes and says Moses let me in a spiritual world lift you up I am a God nobody messes with me and pigs produce pigs chicken produce chickens I made you and I made you in my image nobody walks over me and nobody bosses me and there has been nobody who rose up and lasted I know Karl Marx said there is no God and signed his name on it well good news is God said there is no Karl Marx and put his name on it I know Lenin rose up and says I'll put the last Christian on the TV and the last Bible will be in the museum last time I checked he is in the museum and it's about him they do the commentary and Christians are not the last and communism fell in a very rush that he sought to build it why because God is God he's a boss you may be a young person in experience but when you are on his side God won't change a Pharaoh until he changes you until he changes you you may say well all of this this is just a good time but the reality is well see until you remove reality out of being your God and put God as higher reality you won't see a change in your life that will last every change that will happen it will happen like this God touches it and then in a matter of few months you're going back to the same life until the Holy Spirit anoints your head when Moses became a God to Pharaoh you know what happened Pharaoh started to negotiate Pharaoh started to say Moses I will let you guys go but let the man only go I see when the man knows his authority he also knows never to make deals with the enemy and he doesn't stop Moses doesn't stop halfway I say oh yes praise God at least you let the man go praise God Jesus oh thank you father at least the men are going at least I know the women are gonna go to hell and the kids are going to hell and finances are going to hell our health is going to hell our pools are going to hell but the fact is just a man see when a man knows his authority he will push the pedal to the metal and he will get everything and not get one ounce to the devil left you won't stop with seeing one person safe he's gonna push it and push it and push it and the devil will negotiate but the person will not surrender and give up why because he knows if the enemy is negotiating that means the enemy is already been weakened and God will give us everything that he has promised if we don't give up we stand on his promise I understand some of you may be listening and you may say you don't understand my reality you don't understand my situation I'm sorry some situations I might not understand but I also know a revelation of God's promise and I want to tell you something that reality which you call so powerful thousands of years ago that reality didn't even exist that reality even came to the reality of the fact that there is a God over a planet who spoke the world into existence let's make him God over a reality faith is when God puts a crown puts anointing on your head and there is no crown I'm not in any way indicating that you receive the promise of God for healing and you go away you throw away the medicine and you pretend that you're healed when you're not but at the same time when you're inside is penetrated saturated with sickness and disease and defeat and unbelief and doubt and fear and you think by just coming and getting touched by a minister whoever that be even if Jesus Christ himself touches you he first wants to change your inner substance you will come out of this situation head first


Good morning, good evening, good afternoon depending on where you are. Let's give it a couple of minutes. All right, so I think we can get started. We've got nine people on the call, so welcome everyone. So we've got two items on the agenda. Today we have Brandon, he's going to talk for I think five minutes about the security white paper. And then we have Akahiro, and he's going to talk about the current state of rootless containers. So I'll pass it on to Brandon. Awesome, thanks Ricardo. Yeah, so I was just speaking to Ricardo and I mentioned it about a couple months ago, or several months ago now in the last couple of weeks, we announced the six security white paper. This was kind of a collaborative effort. We had this really nice document. Actually, let me share my screen on the button. So a while back, we kind of released a white paper. This was like something very conceptual on a high level covering different aspects of cognitive security. And part of that, we would get a lot of good information from the various different groups. But really what this white paper was about is kind of touching on concepts, very high level here, very generic recommendations, nothing to do with anything specific. Kubernetes isn't even mentioned within this white paper, because it's supposed to be non-biased, really looking at concepts. So for example, if we go into the runtime section, which there's in the link, so I'm going to use the Markdown one, which is a certificate, which we also have this in transit and Chinese now. So you've got the runtime environment, we talk about the different phases, how to compute, what needs to be scale, the orchestration level, protecting resource, audit and things like that. But we don't have specific tooling involved with this. So what we've been recently working on to kind of augment the information here is something we call the security, cognitive security map. So the idea here is that the idea here is that it would be kind of additions to the cognitive security white paper. So you have information about the general concepts, and then you can click in and you could see the different projects that are related to the different ideas or security requirements, and then there will be examples. So kind of just to give a quick overview, we are currently curating content for this. So one example here is for security checks and development, we will have a list of projects, so this is kind of similar to landscape. And also we will have examples to kind of help illustrate for someone to go in and say, what would a security control within this area look like? And so the examples of what you would do, and these would be very specific to, okay, if you were using a specific technology, what would this look like? They are meant to kind of just give a more graphical idea on what a control may be. And what's going to happen is all this, we are currently working on kind of a UI to put all this in. So the idea is all this information would be navigable. So if you're interested in, you know, development, you could go in and click on this, go in, and then there would be lists of projects, there would be lists of examples. And, you know, one thing that we want to do in the future is also, for example, if you're talking about in the distribution phase, right, for artifacts and images, let's say you have signed trust and integrity. The idea is like, whenever you have signed trust and integrity on the, on the, the DevOps slash the distribution stage, you still want to also be able to enforce that integrity at the runtime as well. So our plan is to have linked content points. So, for example, if you look at, you know, this artifact integrity, that would be a link here that says, okay, you may also want to check out the runtime section on this. So then you cover how do I assign the images, but at the same time, you also cover within my orchestration system, how do I verify these images when they're running? Oops. So what we are looking for right now is content contributions. We have under the runtime section, we do have a couple that are still kind of semi-filled or not yet filled. So this is kind of like a plug to see if anyone in this group is interested in contributing to any parts of this. That would be super helpful. Especially, I know, like, the group here is a lot more familiar with the runtime projects. So this could be a good way to also introduce that ecosystem. Yeah, that's kind of all that I had to share. If there's any questions, if not, this is pretty much all I have. What are some of the runtime sections that are missing some part? Initially, we had our resource request limits, contrapping authentication, secrets encryption. I think this was a tree of the main ones. I think these and bootstrapping and the bootstrapping. So these are a few that I'm missing. I would say the main focus areas that we are lacking expertise is resource request and limits and the contrapping authentication and secrets encryption part of it. But I would say, you know, whatever, I think a lot of projects on the runtime side, we don't have great visibility on. So, you know, if anyone can also just go through the different projects in those sections and say, okay, maybe this additional project may be helpful here, that would also be, that will also be very good for the document. Got it. Thank you. So one more question. So do you have a sample of one of those sections? Yeah. So let's pick one here. Let's pick runtime. I haven't reviewed the one that yet. So let's see. So this is like service mesh.  We also are kind of keeping track of a few commercial projects as well. So there's actually another motivation of this is that we also want to look for gaps within the CNC and ecosystem. So part of this exercise is kind of seeing, okay, if there are certain areas where there are open source projects, sorry, there are commercial projects, but there are no open source projects, then we would try and make a recommendation to the talk about, you know, maybe we should try and get some of these products in or, you know, try and see whether we can create new products around these areas. So I think runtime is actually at the, if you scroll down, yeah, there. Is it this one? Yeah. Yeah. So this one is, like there's only one project, right? So maybe there are some that we may not be aware here. Maybe the EBPS stuff, stuff in the area. Yeah. So it's not something that's like content heavy is pretty much, you know, yeah, there's a project here, some examples, and just to help help folks get a better idea on how to secure the aspect of the ecosystem. Got it. Thank you. Any other questions? Oh, was the link to the doc published anywhere? Oh, yeah. I'm going to put the link to the issue and to the doc in the chat. Thank you. Once I can find the chat. All right. And thanks, thanks, Ricardo, for the thing we come by and share about this. Yeah, you're welcome. Thank you for coming by. Okay, so now we have a key hero and thank you for joining. I was excited to have you talk about the state of ruthless answers. So I share my screen. Sure. Can you see my screen? So let me introduce myself. I'm a software engineer at entity, telecom company in Japan. And I'm a manager of several projects, including RunC, Continuity, and Moby, and also several subs under dw.com slash continuous. And today, I'll talk about continuous, which means running continuous runtimes and also continuous, of course, as a non-root user on the host just includes running all serial runtimes, such as RunC, and serial runtimes, such as continuity and cryo, and CNI problems, such as front now, and also keyword and keyword proxy. So this is useful for protecting the host from potential vulnerabilities and misconfigurations. So even in the rustic case, the attacker can gain the normal user on the host, but the attacker cannot gain root privileges. And the rootless containers are implemented using a kind of feature called user name spaces, which allows mapping a non-root user to something like root users, but with a limited set of privileges. And in the Kubernetes signal, there's a similar enhancement proposal about user name space, but rootless containers is not related to this user name space enhancement proposal. And do not conflict either. There, a user name space proposal is about just running continuous as a non-root user, but they run runtimes as the root user. On the other hand, rootless containers run everything as a non-root user. So the rootless containers is quite different from the user name space proposal. And of course, rootless containers is not a panacea, and there are some drawbacks. For example, the network throughput is slightly slow, just like 50 GWPS to 10 GWPS. So this is really slow, but we are seeing huge improvements in these years. And rootless containers cannot support NFS and block storages, but this is not a huge deal for Kubernetes, because when you can use managed databases and object storages such as Amazon S3, you don't need NFS and you don't need block storages. So I don't think this is a serious problem. And let me show the history of rootless containers. It started about 10 years ago by LXE folks, but this wasn't popular until a few years ago. So in 2018, Bill Teet started to support rootless nodes, and we also had Jocular Continuity, Portrayon, and Cryo, all of them supported rootless containers this year. And we also made a purchase for Kubernetes to support rootless nodes, but the purchase are not merged into the Kubernetes upstream at this moment. But T3S already supported rootless nodes in 2019. And this year, we added rootless support for kind Kubernetes in Docker. So now you can run Kubernetes in rootless Docker and also rootless Portman. And with regard to root layers, there is a lot of news. So last year, there was a new feature called SETCOMP activity. And in this year, we are seeing a kernel mode overlay with rootless containers. And what should I runtime spec is being modified to support SETCOMP activity? I will talk about this topic later. And let me show some examples of rootless containers, such as UserNetist. UserNetist is our reference distribution of Kubernetes for supporting rootless nodes. And we have a demo using Jocaconpose for showing a module of the demo of Kubernetes cluster. I don't show demo today, but I have some screenshots in this screen.  And these components are running as a non-root user. And we support the both continuity and cryo as the CRY runtimes. And T3S is also supporting rootless mode using the patches of UserNetist. The patches are not matched into the Kubernetes app scene, but T3S uses a whole version of Kubernetes, so it already supports rootless mode. And T3S uses continuity as the CRY runtime. And just a rustic, kind, Kubernetes in Docker started to support rootless mode. And this way we included in kind version 0.11. And kind supports Kubernetes without patching. But for supporting Kubernetes without patching, we have several complicated hacks, such as bind-mounting dev-nur into slash-proxy, sorry, slash-proxy, slash kernel to emulate some cys-controller values. And we also need some complicated configuration for Kube proxy to avoid setting several privileged CCC values. But we have several complex hacks about how we can run Kubernetes without patching at all. And this way we included in kind version 0.11. So within a few weeks, you can try this easily. And the topic of this year is SecComp. So just two years ago, kind of version 5.0 added a new feature called SecComp user notification. This is a new way to emulate system calls in user space. This is very similar to P2S, but it's more lightweight so it doesn't need context switches compared to P2S. And this feature wasn't supported by the also runtime spec. But just two days ago, there was a progress that was merged into also runtime spec. So also runtime spec now supports this SecComp user notification. Yeah. And with this continuous, we'll be able to use this SecComp user notification for emulating sub-URGs without a file called slash-etc-sub-urg. So previously, you had to have this file. This file is something similar to slash-etc-password and slash-etc-group. And you had to configure this file for the previous users. So this is very difficult on other environments because you have a really bunch of users and you had to configure itc-sub-urg. But with SecComp user notification, you no longer need to prepare this slash-etc-sub-urg file. And also with this SecComp user notification, we can completely remove set-urg binary files such as user-slash-bin-slash-new-urg-map. So this is better in the security. And kind of 5.9 added support for SecComp IOCTL notif at fd. This is a new feature that allows injecting file descriptors from a host process into container processes. So we can replace the file descriptor of the socket on the connect-c-score. So we can remove the overhead of user-mode networking called slurp. So this is very faster compared to previous users' containers. And we have some proof-of-concept code but not ready for production at this moment. So there are several tasks that need help from the community. So we need to have more experiments in the SecComp. We also want to port-over rootless kind to MiniCube with Docker driver and Portman driver. And we have a proposal for key-minted signals but this proposal is not merged yet. So we need some help to facilitate acceptance of this proposal. And we have some questions about rootless containers on SQL workflow and Reddit and also on a similar community site. But I don't have enough bandwidth to answer all these questions. So it should be great if we can get help from the community to answer these questions. And rootless containers components such as rootless git and counter-run times such as runc and controller g and mobi, all of these components have several bugs and I don't have enough bandwidth to work on these bugs by myself. So I'd like to have some help from the community to resolve these bugs. And for further information please visit hdps.com, rootlesscontain.rs and last year in cubicle we have some presentation about rootless containers and we also have a proposal to change signals. That's all. Do you have questions? I have a question about the block storage support. Is it a go or is it something that the project owners are looking into and is it just because the mount is not available or why you cannot use that? So counter maintenance do not want to support username spaces for x4 file system and xf file system and so several file system drivers are likely to have bugs and they don't want to expose these potential bugs to non-root user. So the counter maintenance do not want to have rootless support for x4 and xdface and other personal ready file systems. So we cannot support a block storage. But we could have huge file system in user space for implementing x4 and xf in the user space. So potentially we can support hub block storage. But we are likely to have significant performance overhead because file system in user space is slow. But we can support block storage if we want to do. Okay, thank you. I have a question. I have a few actually. But one is, is there any update on a kernel supportive overlay fs from user namespaces? I know that they've talked about that for a long time, but I know there's fused overlay fs, but is there, so there you go, the kernel mode overlay fs. Oh yeah. So there's two implementations of overlay fs in the kernel mode and in the user space fused overlay fs. But kernel mode overlay fs didn't support rootless until kernel 5.11. So it is already in 5.11? Yeah, 5.11. It's released last month, I think. Ah, okay. I hadn't heard that. So that could be a good improvement in performance hopefully over fused overlay fs. Yeah. Another one is I run into lots of problems with getting the PID namespaces. Backer and Kubernetes block them by default. They put in, they mask them by mounting other masking, by mounting other file, other things on top of slash proc so that you can't mount a new slash proc in an unprivileged user namespace. Do you have any insight into that? I presume the rootless ones don't block those things like Docker and Kubernetes do. Oh, sorry. You said slash proc slash what? Slash proc for unprivileged slash proc. So if you have a new PID namespace and an unprivileged user namespace, right? So you can't, so in order to make a new PID namespace, which, you know, any Docker container has its own PID namespace and you need that for any time.  Oh, yeah. So basically, you need to bind the mount slash proc file system. And rootless port amount already supports dash slash PID with such bind amount. Which does it just say? You mean bind mounted from outside the slash proc? Yeah, yeah, bind mount slash proc to continue. Yeah, but that you can do, but if you want to have its own PID namespace inside of a container, then you need a new slash proc. You need to have an unprivileged PID namespace. So I'm talking about a separate, to be able to isolate two different containers. So in just case, if you have a mount namespace along with a PID namespace, you can just mount proc. And all of the rootless containers, including Docker and Potomac, supports PID namespace in that way. So if you have some problem, maybe you can post the coffee JSON of OCR runtime to the GTAW issues of RunCityPo, or maybe somewhere else. So maybe I can look into that to help us with the problem. So I mean, Docker is relatively easy because they have this option security system pass equals unconfined. For that, if you're just running inside Docker, you can run this and it will allow you to mount a slash proc. Kubernetes, we have a regular K8S, we haven't actually figured out how to enable the corresponding option. It's supposed to be a way to do it with proc mount unmasked, but we haven't got it to work. And I presume the K3S and stuff don't block these, don't have this by default, blocking the mount of a new slash proc. So okay, so you're not, you probably haven't run into this and you don't use Kubernetes anymore.  I guess we need to have work in the kernel to facilitate the amount of proc for a result such as security opt. Yeah. So I think we need to have some work in the kernel. Yeah. This is a beyond kernel problem because the kernel allows it, but the problem is that these container systems are blocking other things inside the container from using it. So because they're doing, they're putting, they're deliberately putting in other things on top of slash proc so you can't, so to prevent it. So by default, Docker will make those confined of slash proc and so does Kubernetes and Kubernetes makes it even harder to do that. Now, loud proc types is the option inside the pod security policy and we haven't got it to work. So Dave, if I may ask, what are you trying to do at a high level? What is the overall goal that you're trying to accomplish within the container? Like, I'd like to be able to run a completely unprivileged container within a Kubernetes pod. Sure. And in particular, we use singularity unprivileged and with the dash dash PID option so that you can create a separate PID namespace. So I put a link there to a runtime that may help you. I'm the lead developer at runtime called Sysbox that allows you to create a rootless boss inside of which you can run things like Docker and system.dn, microservices and stuff like that. And it will probably solve the problem that I think you're trying to get at. If you run Kubernetes inside of this? No. Or you can deploy the pod with Kubernetes and that. I say, so you run Docker? It's like a new run C. Okay. So that's a replacement for run C? Yes. I'll take a look. Hey, I can hear you. If I may ask, my name is Cesar and I am, as I mentioned, the developer in the runtime called Sysbox and you run C. And number one, I wanted to do this myself and thank you so much for all the work that you've done on bootless containers all the many years. It's a lot of perseverance from your part to work on very challenging technical feeds in the kernel. So we really appreciate that. The other thing is, just at a high level, when you talk about rootless containers, I almost feel like the term rootless containers is not entirely accurate to what you are actually doing. I think what you're trying to do is a rootless runtime because the rootless container itself is sort of a subset of that. A rootless runtime generates a rootless container, but the reason I mentioned it is because, for example, in the Kubernetes KEP that you mentioned right there, there's going to be the notion of a rootless pod, but Kubernetes itself is running rootful in order to do whatever it needs to do. And so I can sense already a bit of confusion there where people say rootless containers doesn't mean that Kubernetes is running rootless or doesn't mean the pods are running rootless. And they're two different things. It seems to me in your case, you're really targeting a very challenging problem, which this is a rootless runtime, which has a lot of merit, but it is not quite the same as the rootless container because the runtime can be rootful, but the container can be rootless. So what do you think about that? Yeah, it makes sense. Actually, rootless containers, it's not something I invented, so there was already rootless containers when I became interested in it. So actually, it's difficult to re-name rootless containers, but I have ways that rootless runtimes. Even the name rootless is already kind of weird because you are root inside of the container or inside the pod, but you're not root at the host, so there's also that. There's a whole thing, you know, but yeah, just so that I would mention it. In our case, for example, with the runtime that we developed, all the containers we generate are rootless, meaning they are in the Linux username space, right?  But it is just rootless containers. Our runtime itself needs root because it needs to do very advanced things like Cisco Trapping and things like that that are really hard to do. Rootless, you know. So we're, I think our results are rootless containers, but we're not a rootless runtime, you know. And I think a lot of what you're mentioning here is a rootless runtime, which is an even more challenging thing than what we're up to, if I may answer. Sounds like the backing of scope creep, yeah, salary rootless containers and not a rootless one. Did you say that again? Sorry, I didn't catch that. No, it's a bad job. I was saying it's probably maybe scope creep, you know, they want to do rootless containers and then they're like, why don't we make it the runtime as well? Yeah. I had a question out here actually about the sitcom stuff we talked about. The user notifications, you said that it has better performance in pictures, you know. Do you have any details about, you know, if we were looking at this last time, if not right, we looked at S-Trace. Is this supposed to be better than S-Trace as well? Do you have any experiments or any numbers that you could kind of share? Yeah. So for pictures, you have to inject hooks for every C-scores, even for C-scores, you are not interested in, but with second visualization, you can only inject hooks into the interesting system course. So the number of content switches is proportional to the number of C-scores you want to emulate in the user space. Okay, but do you still get like the overhead of having to go back between kernel space and user space, right? But I guess that's not as big as, that's not as bad. I don't have benchmark data. Sorry, I just wanted to ask you. You said you wanted to get more experiments on sitcom. Yeah. What kind of experiments are you looking for? Yeah, it would be great if we can get some experiments overhead of this C-score visualization. Yeah. Okay, so you're looking for performance data. Okay. Thanks. If I may add, are we, in the simple runtime, we use this mechanism quite a bit to intercept certain system calls. It is very useful. And because we can select the specific system calls that we want to intercept. For example, intercept the amount system call, because it's very important that whenever PROCFS or C-SFS are mounted inside of one of these wireless containers, it is our emulated PROCFS and C-SFS that get mounted, not the kernel's PROCFS, otherwise you create a security hole.  And it also has the advantage that you can just decide when to process a particular system call. And if the arguments are not the ones that you need to process, you can send it back to the kernel so that the kernel can do the regular processing of the system call. So it doesn't, like the amount, for example, system call is a very complex system call to emulate, right? So we only emulate it in certain scenarios. In the case that we don't care about it, we send it back to the kernel and then the kernel continues with the processing, right? I do think that it does add a bit of overhead, so we only use it in control path operations. We shy away from using a measure of data path operations. And how much overhead, it depends how much, what are you doing there with that particular system call in user space, you know? It's a very powerful mechanism. Yes. Yeah. For emulating sub-urges, we have to emulate a lot of system calls such as C.J. Orwell and C.G.U.I.D. and C.B.U.I.S.C.S calls. Yeah. So these are very, yeah, complicated. What are you thinking of doing as far as a set comp, like a hero for ETC for emulating sub-U.I.D.s without the ETC sub-U.I.D. file? What exactly does that mean? What sort of system calls would you be intercepting, for example, in your user second? So, without a sub-U.I.D. file, we can't emulate multiple users for root-less contracts. But with second-user notification, we can emulate system calls such as C.J.U.I.D. to adjust no operation, but modify the system calls such as C.J.U.I.D. to return fake value. And we can also inject hooks into C.H.O.I.D. to fix ownership of the file permissions. Got it. Thanks. I had one here. Actually, this was also the initial trigger list, but in your help wanted slides after here. It's kind of amazing the amount of work you've done tracking this in all these different projects. It's insane. But my question would be, what's the best way to help you out? Because I don't know if you need some help from the end-users to try this out. But it's not very clear to me how to report this. Would it help to have some place where we can coordinate all these things you're doing in different components and maybe report user experience? What do you think? Yeah. I think it'd be great if the community can have more tweets and blog articles and answering questions on Stack Overflow and Reddit and other community sites. That would be very helpful for end-users of risk containers. Okay. Yeah. Thanks. Yeah. I was wondering, I don't know, maybe Ricardo can say, I don't know where it would fit. And if there's one place where you could have a working group dedicated to this, where we can track all the points, all the work, all the components that have support, what's missing. Because I guess it's in your head. But I'm wondering if it's worth creating something somewhere for this, just dedicated to rootless support. So we have hgps.com, rootlesscontain.rs to answer your question. I will check it out. Yeah, maybe. So I think I'm interjecting here. But I think what Ricardo is talking about is, you know, maybe from the CNC of how the community can organize around it, right? So and into one way, the SIGs and the TOC have of organizing the communities by creating work groups under some of the SIGs. So I mean, there will be somebody who drives that, like when it could be you, if you're interested right here, it could be the chair or the lead of that community, and basically gather the people around so that you get more contributors, right? And then also you get the support from the CNCF. Sounds interesting. Yeah, so yeah, if you think that's a good way to go, you know, the CNCF will be happy to be there to help you out. And Ricardo is also in the TOC. Yeah, I think if you're interested, I think we can come up with something to give more visibility to this effort. Oh, thanks. Yeah. So it just continues. We have several people, such as Alex Cercera from Susie and Giuseppe Scribano from RETAT. So maybe I will ask these guys about the SIG group. Yeah, that sounds great. Yeah. Thanks. One more thing I wanted to point out is I'm submitting a change to your singularity page on rootless containers because there you're talking about the set UID mode and fake root mode of singularity. But there's actually that's not the main either of those. Well, let's say there's another, there's a third mode, which is more the default when you're running unprivileged. You can run unprivileged singularity without fake root. The default mode is to just use what's called unprivileged user namespace mode. It has no root at all inside the container. That's actually more rootless than what you guys are talking about. There's no root user at all inside the container. It's only the original user, same one inside and outside. So it can be completely unprivileged and it doesn't need any help or new UID map tool or anything like that because it just has no root. So that's not useful in some cases, but it's useful in a lot of cases too. If we're trying to isolate, we have an unprivileged user that runs other users payloads. So this one's very useful for that because we don't care if they don't have any access to root, we just want them to. So it's not nearly as complete a container system, but it's still very useful. Something interesting. Yeah, yeah. So I think I need to modify this one just especially about singularity. Yeah, I'll send you a poll request. Oh, thanks. That's great. So Kihiro, if I may ask, what is your vision sort of where rootless containers? I mean, the project that you're working on, what is your vision for it? When would you say, okay, I'm happy that we've reached the state where I accomplished everything that I wanted to accomplish for this project, right? Where do you see this like say five years from now if you've had your way? Sorry, you said, what is your vision for the project? Where do you see it going, let's say in five years, right? Yeah, in five years, I think most drug users and Potomac users will use rootless containers by default. I think it's highly likely for local containers on laptop, but for promoting rootless containers to production clusters, especially difference clusters, we will need some help from cloud providers such as GKE or AKS or AKS. Yeah, so if we can get help from these human service providers, we will be able to promote rootless containers into the production clusters within five years. And by that, you mean the whole Kubernetes run time itself running rootless, right? The user-native approach, that's what I'm talking about. So in the ideal world, so GKE and AKS and AKS will have a checkbox on their web user interface and click here to run a QBRED and the continuity as a non-router user. So that's my dream, I was in five years, yeah. But I don't work for Google, I don't work for Amazon or Microsoft. So obviously, as a team, help from the industry. And the goal there being to protect the host from vulnerabilities in the Kubelet, for example, itself, right? Or in the underlying run time, is that correct? Yeah, yeah, that's the main motivation, yeah. But aside from that HPC users, hyperbolic computing users, we want to use rootless for some kind of multi-services in a shared cluster. And just a general question for anyone that wants to answer is, I mean, in your experience, do people care more about securing the run time itself or do they care more about securing the container itself, right? Because as I was mentioning, the Kubernetes KDP that would use our namespaces would secure the pot itself, but not the Kubelet, right? The Kubelet will continue to run root, but the pot itself is now rootless, right? I'm wondering, you know, obviously, if people could have both, they'll probably have both, but I'm wondering at this stage of things, where is more of that demand? Is it more on protecting the run times or just protecting the container, the container isolation boundary itself? Yeah, so I think both points are really important. And so, and it's a rootless mode, and the user namespace, it has been proposed that do not conflict either. So we can just send them together by nesting user namespace inside rootless containers. Yeah, so actually, we run times as non-routes such as UID 10000, and also run ports with different UIDs such as 2000 and 20001, and such as, so yeah. I see, I see. So you feel that it would be first rootless pots, initially just the pots, right? The Kubelet will continue to run rootful, but then eventually, as you continue to work in enabling user NADs and running the Kubelet, let's say rootless, at some point, they could interact together, right? In the sense that you have the Kubelet rootless, and then inside of that you could even nest a username space inside for the pots themselves, is that what you're saying? Yeah. Yeah. Thank you. Yeah, I think if I may add, the production environments would like to have something less privileged at the lowest level. So I think the rootless run times hasn't been necessarily available in all places or hasn't been available at all, right? So what some people have been doing is just trying to secure the pot or secure the container, right? So more at the nested level. So yeah, if you are able to break out of the container and if you are running something that's rude, the Kubelet or the runtime, then an attacker could actually gain access to the host. So I mean, I think the largest or the biggest concern is that somebody could gain access to that host and cause some damage, right? So and that's what people have been talking about with multi-tenancy and also, you know, some of the other run times like Cata containers that run the container in the VM. So it's actually preventing that access to the host. So sorry. So what was your question? No, it wasn't necessarily a question. It was more of a comment. Yeah, yeah. So it's more like an opinion, right? Yeah. So actually, Cata containers provides more stronger isolation. Yeah, but Cata containers require CPU support for virtualization, such as Intel BGX. And this virtualization is not available on typical cloud instances. So it's available on Azure and also Google computing engine, but nested virtualization on these clouds are really slow. And AWS doesn't support nested virtualization at all. So, but AWS provides bare metal instances. So you can run Cata containers inside bare metal instances of EC2, but bare metal instances are really expensive. Yeah. So running Cata containers on on-premise is really productive, but running Cata containers on cloud is somewhat difficult. Yeah. Yeah. And I think that's one of the things that when we were developing Cisco, we wanted to create a rootless container capable of running same workloads as VMs, because we wanted to avoid the VM, basically, right? And so, but to your point, Ricardo, I mean, we're using things like second notification, what you do, that's just called trapping and advanced techniques like that. And I just don't know how I don't see us going, making the runtime rootless, because we do have to be root in order to be doing things like Cisco trapping from other processes, right? So for us, at least short term, we don't have rootless running the runtime that we created rootless in the short term, because we're just doing things that require really true root sort of permission like Cisco trapping, just one example. Having said that, if we could run rootless, that would be great, also, right? Because then we could secure ourselves too, right? But our focus has been more on the container itself, yes. But I think it's very challenging. I think at the work that Hacker Hero has been doing all of these last years is securing the runtime shows how challenging it is to secure the run. And it's getting more challenging because things like EVPF and and second of the fact that a lot of the kernel power is going to move into user space, but that requires some sort of high privilege in order to use that, right? Yeah, it's kind of like a chicken and egg type of problem, right? So yeah, you want to allow, you know, or you want to have less privilege, but then to have that less privilege, maybe you need to have some sort of privilege. That's right. Yeah, it's an interesting topic. I think it's because people have talked about over the years on how to be more secure and allow less and less and within containers. But then in the end, it's a matter of what's the most important for particular users, right? So like, there's got to be some compromises, right?  I think part of it is also like just granularity, a lot of the capabilities have kind of scaled down from a big umbrella over a couple of years, so that helps. And I think just like, you know, having parts of the code that you're using, which are privileged, be measured and attestable, I think that that's kind of like both soft, half of the problem as well. So before we run out of time like a hero, if you need any help, I mean, we're not, the work that we're doing is not exactly the same, what you're doing, right? Because you're figuring the runtime, so we're just securing the container. But there is an overlap, right? There's an overlap, certainly. So we'll be happy to help you in that area of overlap right there, right? And the overlap revolves around the rootless container itself, right? And the things that can run in the rootless container itself, right? That's the area of overlap. And so, you know, we'll be happy to help in that area, for sure. Oh, thanks. All right. So I think it's nine o'clock. Well, thank you everyone for attending. Thank you, Akihiro, for the presentation. Thank you, Brandon, for the presentation. Yeah. And if you want to keep the conversation going, I mean, we have a Slack channel so we can also have any conversation there and follow-ups and any questions or anything related to the work that Akihiro is doing or Sysbox is doing. And yeah, and also Syssecurity. Great. Thank you. Thank you.