Chaos Computer Club - archive feed

Uyuni, an opinionated fork of the Spacewalk project, provides open source lifecycle management for today's datacenter. With the help of Salt for configuration management it keeps your workloads up to date and secure. Uyuni manages all your Linux workloads. It bootstraps physical servers, creates VMs for virtualization and cloud, builds container images, and tracks what runs on your Kubernetes clus...

Titus is a multitenant scheduler that runs a variety of workloads that vary from online workloads which serve customer traffic to big data workloads which perform machine learning. Getting all of these workloads to cooperate on a shared pool of resources together. Just to add a bit of complexity to the mix, these workloads all run on the cloud, and a shared storage and network fabric. Come to this...

At some stage in your programming life you may well have used a debugger, but did you wonder how it was able to step into and control your executable? In this talk we'll see how debuggers work by building one from scratch in a few lines of Go. In this talk Liz will explore how a debugger gains control of a process with the all-powerful ptrace system call. You'll see how we can find the machine cod...

Portable Services bring certain aspects of containers to classic system service management. Let's discuss them in technical detail! Portable Services bring certain aspects of containers to classic system service management. With systemd v239 Portable Services are for the first time complete and ready for users to take advantage of. In this talk we'll have a look on the underlying technical concept...

In a distributed world, monitoring system calls with kauditd can present challenges. In this talk we will address some of those challenges and give a use case of how we build an event pipeline for monitoring file system events. With the rise of containers and generic container based operating systems we find ourselves with a large quantity of nodes that do general compute tasks. These nodes produc...

Logging could be considered simple when dealing with a few applications, but in environments with distributed systems where log data comes from multiple sources and likely in different formats it becomes complex and data analysis harder. In this session I will dig into the challenges of logging for distributed systems and the experience of building a tool called Fluent Bit to solve the problems as...

In Instagram, we have been experimenting with casync as an alternative package format for deployment of the site. This talks describe our findings Last year when Lennart presented in ASG about casync, we were excited to check it out. So we checked what was necessary to deploy parts of our sites with it. and we spend some times experimenting... This talk show our results, so far... about this event...

Computer systems are complex. Most software applications are distributed and expected to scale. That does not make them any simpler. Further, there is the real world all of that is expected to work in. To analyze performance of such a system isn't less complex. Luckily, there is help. The Open Source universe is full of excellent tools that can help. The talk introduces a few of them. The talk wal...

Modern container engines such as systemd.nspawn and rkt provide a means of restricting privilege by limiting Linux capabilities. At Facebook, however, the heterogeneity of services and complexity of libraries running inside the container, along with our full init system model, make determining the set of capabilities that a task uses non-trivial. In this talk, we will discuss how we tackled this p...

After years of development and experimentation, we finally have comprehensive OS-level work-conserving resource isolation working and are now in the process of deploying for various applications including workload protection and container stacking. This talk examines the project and the resulting resource control methods. FB has been actively experimenting with cgroup2 resource control for years....

Open Container Initiative (OCI) started in 2015 to make different implementations of container runtimes and images compliant with well-defined specifications. Together with other folks at Kinvolk, I have been involved in various OCI projects since months, and encountered various issues that occur in runtime specs and runtime-tools for verification. Since we live in a real world, not everything wor...

In contrast to most firmware, like UEFI based or the BIOS, Linux is free software, has drivers for everything and is well known to the administrator. So why not use it in the firmware too? Some work has to be done though to fit it into the flash ROM chip and make it fast. Due to increases in flash ROM chip sizes, it’s possible again to put the Linux kernel and an initrd there, and use Linux as a b...

about this event: https://cfp.all-systems-go.io/en/ASG2018/public/events/222

about this event: https://cfp.all-systems-go.io/en/ASG2018/public/events/221

As we isolate functionality into services distributed across networks, we increasingly strain the concept of trust boundaries. Hosts are no longer simply trusted or untrusted, and each host comes with a new foothold for attackers. This risk is called the Confused Deputy Problem, and it’s part of a growing number of attacks, including the one on Equifax. We need to stop assuming trusted services --...

A dive into the world of running systemd as an *in container* process manager at Facebook. At @FB we heavily utilize systemd on our servers. But, there's more! We also heavily utilize systemd inside our containers as well! Combined with our btrfs based image deployment mechanism we leverage all the good parts of systemd within our containers. I'll show how we utilize all the various components of...

dbus-broker is an implementation of the DBus specification, intended to be a drop-in replacement for the reference implementation on Linux. It is now scheduled to be the default system and user bus in the next Fedora release. This talks shows some of the lessons learned during this relatively young project, the challenges faced, what the current status is and the plans for the future. about this e...

Thunderbolt 3 is a high-speed IO technology that can be used to connect docks, graphic cards or other peripherals requiring high speed. However, the mechanism that allows these high speeds also poses a security risk because malicious devices could obtain sensitive information from the computer's memory. As a result kernel provides an interface to authorize thunderbolt devices before they can be us...

Running out of memory on a host is a particularly nasty scenario. In the Linux kernel, if memory is being overcommitted, it results in the kernel out-of-memory (OOM) killer kicking in. In this talk, Daniel Xu will cover why the Linux kernel OOM killer is surprisingly ineffective and how oomd, a newly opensourced userspace OOM killer, does a more effective and reliable job. Not only does the switch...

We’ll look at patterns and anti-patterns for self-contained, immutable runtime environment for applications using Habitat, with a focus on special cases, integrated testing and advanced hacks. about this event: https://cfp.all-systems-go.io/en/ASG2018/public/events/162

Portability is a shining goal for all software -- an objective since the beginning of computing through the present. And yet, it also remains illusive. We once sought to develop software "portable" between whole OSes and kernels; today, we've lost control of our build and distribution pipelines so completely that portability of a binary between two barely-different distributions of linux is consid...

This talk describes our experience developing Wormhole Connector, a distributed proxy component that connects external enterprise systems to a Kyma Kubernetes cluster. The connection between the Wormhole Connector and the Kubernetes cluster is based on HTTP/2, taking advantage of the stream concept to multiplex multiple connections (HTTP/1 or HTTP/2) through one active HTTP/2 connection. It will c...

about this event: https://cfp.all-systems-go.io/en/ASG2018/public/events/230

Die letzten 10 Jahre haben nicht nur den Durchbruch von Smartphones, Cloud-Diensten und Künstlicher Intelligenz gebracht. Zeitgleich ist im Netz eine universelle Infrastruktur zum Sammeln von Bewegungs- und Nutzungsdaten entstanden, der zu entkommen längst auch für versierte User schwierig geworden ist. Mein Vortrag wird sich mit den gesellschaftlichen Folgen und sozialen Dimensionen dieser Datena...

Cyber-Sicherheit stellt eine Vorbedingung für das Gelingen der Digitalisierung dar. Dass die Gewährleistung von Sicherheit im digitalen Raum eine zentrale Herausforderung darstellt, zeigt der Bericht zur Lage der IT-Sicherheit in Deutschland des BSI in jedem Jahr eindrücklich. Das BSI arbeitet mit verschiedenen Akteuren aus Staat, Wirtschaft und Gesellschaft gemeinsam daran, den Risiken wirksame u...