Video: Containers Should Contain... Right?

Here's a presentation video from the very recent OpenStack Summit Vancouver 2018. The topic repeats what Dan Walsh was saying a couple of years ago. Again, this is talking about application containers using traditional kernel features like namespaces and cgroups... because as we all know, in the Linux kernel, containers are NOT a REAL thing. Just to be clear, OpenVZ... which is a mature out-of-tree patch for system containers that has been around and maintained for well over 13 years... does contain... but the hype is all around application containers like Docker and its work-alikes.

Updates in container isolation

At KubeCon + CloudNativeCon Europe 2018, several talks explored the topic of container isolation and security. The last year saw the release of Kata Containers which, combined with the CRI-O project, provided strong isolation guarantees for containers using a hypervisor. During the conference, Google released its own hypervisor called gVisor, adding yet another possible solution for this problem. Those new developments prompted the community to work on integrating the concept of "secure containers" (or "sandboxed containers") deeper into Kubernetes. This work is now coming to fruition; it prompts us to look again at how Kubernetes tries to keep the bad guys from wreaking havoc once they break into a container.

Autoscaling for Kubernetes workloads

Technologies like containers, clusters, and Kubernetes offer the prospect of rapidly scaling the available computing resources to match variable demands placed on the system. Actually implementing that scaling can be a challenge, though. During KubeCon + CloudNativeCon Europe 2018, Frederic Branczyk from CoreOS (now part of Red Hat) held a packed session to introduce a standard and officially recommended way to scale workloads automatically in Kubernetes clusters. Kubernetes has had an autoscaler since the early days, but only recently did the community implement a more flexible and extensible mechanism to make decisions on when to add more resources to fulfill workload requirements. The new API integrates not only the Prometheus project, which is popular in Kubernetes deployments, but also any arbitrary monitoring system that implements the standardized APIs.

An introduction to MQTT

A few years ago, I was asked to put temperature monitoring in a customer's server room and to integrate it with their existing monitoring and notification software. We ended up buying a rack-mountable temperature monitor, for nearly £200, that ran its own web server for propagating temperature data. Although the device ostensibly published data in XML, that turned out to be so painful to parse that we ended up screen-scraping the human-readable web pages to get the data. Temperature sensors are fairly cheap, but by the time you've wrapped them in a case with a power supply, an Ethernet port, a web server, enough of an OS to drive the above, and volatile and non-volatile storage for the same, they get expensive. I was sure that somewhere there must be physically-lightweight sensors with simple power, simple networking, and a lightweight protocol that allowed them to squirt their data down the network with a minimum of overhead. So my interest was piqued when Jan-Piet Mens spoke at FLOSS UK's Spring Conference on "Small Things for Monitoring". Once he started passing working demonstration systems around the room without interrupting the demonstration, it was clear that this was what I'd been looking for.

Ubuntu Unleashed 2019 and other books presale discount

Call for nominations for the Technical Board

The current 2-year term of the Technical Board is over, and it’s time for electing a new one. For the next two weeks (until 6 June 2018) we are collecting nominations, then our SABDFL will shortlist the candidates and confirm their candidacy with them, and finally the shortlist will be put to a vote by ~ubuntu-dev. Anyone from the Ubuntu community can nominate someone.

Decreasing the complexity of IoT adoption with Edge as a Service model

Last week, much of the IoT industry descended on Santa Clara, California, for the annual IoT World trade show. One of the exhibitors present were Rigado who Canonical partnered with earlier this year to deploy Ubuntu Core on their IoT gateways primarily targeted at commercial applications such as smart lighting and asset tracking. Rigado used IoT World as an opportunity to discuss the launch of Cascade, their new ‘Edge as a Service’ proposition, for commercial IoT. Cascade, which is offered as a simple monthly subscription, enables companies to focus on their business and what generates revenue rather than expending effort and resource dedicated to managing the infrastructure behind it. With many organisations looking at ways they can benefit from adopting IoT while removing perceived barriers, Cascade offers a low-risk, low-cost entry which in turn enables project teams to benefit from reduced development, support and no upfront hardware costs. The end result is a quicker path to IoT deployment and resulting ROI.

Xubuntu: New Wiki pages for Testers

During the last few weeks of the 18.04 (Bionic Beaver) cycle, we had 2 people drop by in our development channel trying to respond to the call for testers from the Development and QA Teams. It quickly became apparent to me that I was having to repeat myself in order to make it “basic” enough for someone who had never tested for us, to understand what I was trying to put across. After pointing to the various resources we have, and other flavours use – it transpired that they both would have preferred something a bit easier to start with. So I asked them to write it for us all.

How to install Ubuntu Server 18.04

How To Install Firefox Beta in Ubuntu & Linux Mint

XFS online filesystem scrubbing and repair

In a filesystem track session at the 2018 Linux Storage, Filesystem, and Memory-Management Summit (LSFMM), Darrick Wong talked about the online scrubbing and repair features he has been working on. His target has mostly been XFS, but he has concurrently been working on scrubbing for ext4. Part of what he wanted to discuss was the possibility of standardizing some of these interfaces across different filesystem types. Filesystem scrubbing is typically an ongoing activity to try to find corrupted data by periodically reading the data on the disk. Online repair attempts to fix the problems found by using redundant information (or metadata that can be calculated from other information) stored elsewhere in the filesystem. As described in Wong's patch series, both scrubbing and repair are largely concerned with filesystem metadata, though scrubbing data extents (and repairing them if possible) is also supported. Wong said that XFS now has online scrubbing support, but does not quite have the online repair piece yet.

Supporting multi-actuator drives

In a combined filesystem and storage session at the 2018 Linux Storage, Filesystem, and Memory-Management Summit (LSFMM), Tim Walker asked for help in designing the interface to some new storage hardware. He wanted some feedback on how a multi-actuator drive should present itself to the system. These drives have two (or, eventually, more) sets of read/write heads and other hardware that can all operate in parallel. He noted that his employer, Seagate, had invested in a few different technologies, including host-aware shingled magnetic recording (SMR) devices, that did not pan out. Instead of repeating those missteps, Seagate wants to get early feedback before the interfaces are set in stone. He was not necessarily looking for immediate feedback in the session (though he got plenty), but wanted to introduce the topic before discussing it on the mailing lists. Basically, Seagate would like to ensure that what it does with these devices works well for its customers, who mostly use Linux.

Using user-space tracepoints with BPF

Much has been written on LWN about dynamically instrumenting kernel code. These features are also available to user-space code with a special kind of probe known as a User Statically-Defined Tracing (USDT) probe. These probes provide a low-overhead way of instrumenting user-space code and provide a convenient way to debug applications running in production. In this final article of the BPF and BCC series we'll look at where USDT probes come from and how you can use them to understand the behavior of your own applications. The origins of USDT probes can be found in Sun's DTrace utility. While DTrace can't claim to have invented static tracepoints (various implementations are described in the "related work" section of the original DTrace paper), it certainly made them much more popular. With the emergence of DTrace, many applications began adding USDT probes to important functions to aid with tracing and diagnosing run-time behavior. Given that, it's perhaps not surprising that these probes are usually enabled (as part of configuring the build) with the --enable-dtrace switch.

Wine's VKD3D 1.0 Released For Running Direct3D 12 Over Vulkan

The Wine project has announced the release of VKD3D 1.0, the first official release of this Direct3D 12 over Vulkan layer primarily developed at CodeWeavers. VKD3D is the approach Wine is pursuing for getting Direct3D 12 games from Windows working on Wine under Linux or also under macOS when paired with MoltenVK. For the VKD3D 1.0 release there are D3D12 demos now working but features are known to be missing and bugs are expected. Geometry and tessellation shaders are among the big ticket items still left to be implemented in future releases.

DXVK 0.52 Brings More improvements For Direct3D 11 Over Vulkan

While VKD3D 1.0 is out today for Direct3D 12 mapped over Vulkan, the DXVK project for running Direct3D 11 over Vulkan is also out with a new release today. Most prominent to the new DXVK 0.52 release is initial support for DXGI 1.2, the updated Microsoft DirectX Graphics Infrastructure that brings various updates for drivers. The initial DXGI 1.2 support in the process fixes at least Bioshock 2 Remastered as well as Frostpunk.

Vkd3d 1.0 Released

This is the first release of vkd3d. A lot of Direct3D 12 features are still missing and bugs are expected. The current version was tested mainly with demo applications. A number of features that are being worked on have been deferred to the next development cycle. This includes in particular geometry and tessellation shaders support, various shader translation improvements, as well as various improvements for core Direct3D 12 methods.

vkd3d for Direct3D 12 to Vulkan in Wine has released the first stable version

Today, the Wine developers officially announced that vkd3d for translating Direct3D 12 to Vulkan in Wine has reached 1.0.