Viktor Petersson logo

Podcast

Follow Me

Join Viktor, a proud nerd and seasoned entrepreneur, whose academic journey at Santa Clara University in Silicon Valley sparked a career marked by innovation and foresight. From his college days, Viktor embarked on an entrepreneurial path, beginning with YippieMove, a groundbreaking email migration service, and continuing with a series of bootstrapped ventures.

Unpacking Docker's Journey: Justin Cormack, on DevOps, Containerization, and the Future of Wasm

Play On Listen to podcast on YouTube Listen to podcast on Spotify Listen to podcast on Apple Listen to podcast on Amazon music
08 SEP • 2024 1 hour 27 mins
Share:

In this captivating conversation, Viktor sits down with Justin to explore the evolution of Docker, the challenges and triumphs of containerization, and the exciting potential of Wasm. As a key figure in Docker’s history, Justin shares his unique perspective on the company’s journey, its impact on the DevOps community, and how Docker continues to innovate in an ever-changing tech landscape.

The conversation begins with Justin’s first encounter with Docker, which sets the stage for his long and ongoing relationship with the company. Viktor and Justin then delve into the often-debated topic of containers vs. virtual machines (VMs), where Justin explains why this framing is misleading and how Docker’s real success lies in simplifying application packaging, deployment, and management.

As they navigate through the early days of Docker, Justin recounts the challenges the company faced in a small market with significant competition. Despite these hurdles, Docker emerged as a disruptive force, particularly among early cloud adopters who recognized the potential benefits of containers. Viktor and Justin also discuss Docker’s decision to start charging for Docker Desktop, which sparked controversy within the tech community.

The conversation then shifts to Docker Hub, its infrastructure, and the challenges of managing a global service at scale. Justin offers an inside look at how Docker has adapted to meet growing demands, from the early days when outages made headlines to the present where Docker Hub has become an indispensable resource for millions of developers.

Justin also takes Viktor on a journey through the evolution of Docker image security, explaining how early images had cryptographic signatures but no real content hashes, making them vulnerable. He discusses how Docker transitioned to the V2 format, introducing proper content hashing and significantly improving image security.

One of Docker’s latest innovations, Docker Scout, is another topic of discussion. Justin explains how this tool generates Software Bill of Materials (SBOMs) and tracks vulnerabilities in real-time, allowing developers to stay on top of security issues without needing constant re-scanning. Viktor and Justin explore the potential of WebAssembly (Wasm), discussing its possibilities in both server-side and browser-based applications.

As they conclude their conversation, Justin shares his thoughts on the future of Docker and cloud-native development. He emphasizes Docker’s focus on empowering developers and providing seamless tooling for containerized environments, which remains at the core of its mission.

Why listen to this episode? If you’re a developer, DevOps enthusiast, or tech leader interested in the evolution of containerization and Wasm, this conversation is packed with valuable insights. From Docker’s early days of rapid growth and market challenges to its present role as a leader in cloud-native development, Justin Cormack’s unique perspective offers listeners a front-row seat to the pivotal moments that shaped Docker and its impact on the tech world.

What will you learn? By tuning into this episode, you’ll gain a deeper understanding of Docker’s journey, the lessons learned along the way, and where it’s headed next in the world of cloud-native and containerized development. You’ll also discover how Docker continues to address security challenges in modern software development and explore the exciting potential of Wasm.

Don’t miss out on this enlightening conversation! Join Viktor Petersson and Justin Cormack on Nerding Out with Viktor as they delve into the fascinating world of containerization and WebAssembly (Wasm).

Transcript

Transcript

Show/Hide Transcript
[00:01] Viktor Petersson
Welcome back to another episode of nerding out with Victor.
[00:04] Viktor Petersson
Today I'm joined by Justin Cormack.
[00:07] Viktor Petersson
Hey, Justin.
[00:07] Justin Cormack
Hi.
[00:08] Justin Cormack
Nice to nerd out with you.
[00:10] Viktor Petersson
Amazing.
[00:11] Viktor Petersson
So I know Justin from, I guess, the old school London DevOps scene.
[00:15] Viktor Petersson
Our paths ran across from many years ago, I guess.
[00:19] Viktor Petersson
And we've been bumping into each other at various conferences.
[00:22] Viktor Petersson
I think last conference was state of open con, I believe.
[00:26] Viktor Petersson
And that's when I realized that I should have you on the show.
[00:29] Viktor Petersson
So thank you for hopping on.
[00:31] Justin Cormack
Yes.
[00:33] Justin Cormack
The London scenes.
[00:34] Justin Cormack
Yeah, there's a lot of people who I kind of met through those things, even from way back when, like a lot of days before, even before I joined Docker.
[00:46] Justin Cormack
There's people I met back then in the years.
[00:51] Justin Cormack
It's been a great place to meet people.
[00:53] Viktor Petersson
I mean, the London Kubernetes scene in particular.
[00:55] Viktor Petersson
And obviously that spilled into the.
[00:57] Viktor Petersson
Well that started with the docker scene.
[00:58] Viktor Petersson
The Kubernetes scene was way ahead, London pushed well, by its weight, or punched way above its weight, I would say, from that perspective.
[01:08] Viktor Petersson
So there was a lot of strong DevOps people in London that really kicked things off.
[01:14] Viktor Petersson
So it was a really good scene to be in those days, I think.
[01:16] Justin Cormack
Yeah.
[01:18] Viktor Petersson
And.
[01:19] Viktor Petersson
All right, so let's talk a bit more about Docker, because you are the CTO of Docker.
[01:24] Viktor Petersson
So let's talk about Docker.
[01:25] Viktor Petersson
I have some other topics, but we're largely themed around Docker.
[01:28] Viktor Petersson
So with that, let's start with a very simple question.
[01:32] Viktor Petersson
What was your first docker experience?
[01:34] Justin Cormack
So my first docker experience was.
[01:39] Justin Cormack
I mean, it was.
[01:44] Justin Cormack
It was.
[01:51] Justin Cormack
I can't remember exactly what the first experience was.
[01:56] Justin Cormack
I remember roughly when it was.
[01:58] Justin Cormack
It was.
[02:00] Justin Cormack
It was.
[02:03] Justin Cormack
It must have been about ten years ago.
[02:10] Justin Cormack
I've been a doctor for nine years.
[02:11] Justin Cormack
So it was.
[02:12] Justin Cormack
I think it was around a year before that, maybe a little bit somewhere in that area, you know, as you say, there was a kind of.
[02:22] Justin Cormack
There was that strong London scene where, you know, things were.
[02:27] Justin Cormack
Things were happening.
[02:28] Justin Cormack
My.
[02:28] Justin Cormack
I was.
[02:29] Justin Cormack
I had a.
[02:31] Justin Cormack
My first kind of experience in the kind of DevOps space really was puppethe I was doing.
[02:37] Justin Cormack
I did a bunch of what we called sysadmin work back then, before it was DevOps.
[02:43] Justin Cormack
And I came across this automation stuff, and I thought, hold on, this puppet thing that's actually different from the other stuff and this terrible manual configuration work that were doing before that.
[02:56] Justin Cormack
So that kind of got me interested overall in what was changing.
[03:01] Justin Cormack
And I was always interested in kind of this sort of system manageability area.
[03:07] Justin Cormack
I actually ran the London Coreos meetup for a while.
[03:12] Viktor Petersson
Oh yeah, thats a blast of the past.
[03:15] Justin Cormack
I think the next thing after puppet I got cited by was actually the kind of the really early coreos when it was ETCD.
[03:23] Justin Cormack
And that was a thing to manage your distributed etsy which was like before it was, you know before it was actually really about containerization.
[03:35] Justin Cormack
And somewhere in that period I ran into Docker.
[03:43] Justin Cormack
I mean I think the first kind of formal thing I don't.
[03:48] Justin Cormack
We worked on a joint ebook on using Docker with a bunch of us back in somewhere in that period I wrote a Docker security chapter for that book.
[04:02] Justin Cormack
So.
[04:04] Justin Cormack
But yeah, somewhere around.
[04:05] Justin Cormack
So container security was something that, because I was always something I was interested in really early on and yeah so it was around that period.
[04:19] Justin Cormack
But I don't actually remember the, I actually remember the first Docker run experience.
[04:25] Justin Cormack
It must have, which is kind of disappointing.
[04:28] Justin Cormack
I should be happy to be able to say oh yeah, the first time I did Docker run I thought this is the future and I'm going to end up working at Docker.
[04:34] Justin Cormack
But it didn't actually work out like that at all.
[04:36] Viktor Petersson
Yeah, I mean I remember my first Docker experience and it was such a mind boggling experience from a, I guess principal perspective in the sense of like you came from vms and now you came with this concept.
[04:51] Viktor Petersson
I mean I've been using like freebiece to JRS and whatnot in the past, which is kind of similar, but it was just this mind shift of like is a single process and that took a bit of time to get your head around, I guess.
[05:02] Viktor Petersson
And you still see a lot of people trying to get their head around that, even to this day.
[05:06] Viktor Petersson
Right.
[05:08] Viktor Petersson
So let's talk a bit about, well obviously you have a lot of exposure to the community, I presume, with Docker.
[05:15] Viktor Petersson
So what do you see as the most common like misconceptions about Docker?
[05:20] Justin Cormack
Well, I don't know.
[05:22] Justin Cormack
I think that there's a number of things.
[05:25] Justin Cormack
I mean it's not so much misconceptions.
[05:28] Justin Cormack
I think it's a matter of people having different ideas about what the, you know, what the important changes that happened in the world are because of Docker or with Docker by using Docker and what the way to frame it is for so many years at the beginning, you know, beginning and it's a little bit less so now, but it still comes up, you know there's the VMS versus containers.
[05:56] Justin Cormack
Like, that's a thing.
[05:57] Justin Cormack
And that, like.
[05:58] Justin Cormack
And the idea that this is an important distinction, I think, is really misleading.
[06:05] Justin Cormack
I think, you know, obviously, like, people frame things in terms of what came, what they were doing before, but it wasn't ever really a VMS versus containers in the sense it.
[06:20] Justin Cormack
And sometimes you got the impression that it might go down that route.
[06:23] Justin Cormack
But I think it became a sort of, this is the way we talk about Docker thing, not a really useful thing, because I think that a lot of the VMS versus containers discussion was actually about efficiency of isolation.
[06:39] Justin Cormack
Like, were containers sufficiently isolated?
[06:43] Justin Cormack
And as a security boundary or not?
[06:46] Justin Cormack
But there were two things about that.
[06:48] Justin Cormack
One is the answer for, you know, for multi tenancy purposes was no.
[06:53] Justin Cormack
Yeah.
[06:55] Justin Cormack
And that was fairly clear for quite a long time that the answer for multi tenancy was no.
[07:01] Justin Cormack
For single tenancy.
[07:03] Justin Cormack
Well, yes.
[07:04] Justin Cormack
Like, actually, single tendency.
[07:06] Justin Cormack
Isolation wasn't that important.
[07:08] Viktor Petersson
It's better than nothing.
[07:09] Justin Cormack
Yeah, it's better than nothing.
[07:11] Justin Cormack
Absolutely better than nothing.
[07:12] Justin Cormack
Better than running processes on the same VM without any isolation.
[07:17] Justin Cormack
But the security boundary wasn't what made Docker successful.
[07:23] Justin Cormack
And the framing of containers versus VMS really was trying to frame it in terms of that.
[07:28] Justin Cormack
And it was a very confused conversation over the.
[07:32] Justin Cormack
The eight years or so.
[07:34] Justin Cormack
It was that often the main conversation about containers was containers versus vms.
[07:38] Justin Cormack
Like, it wasn't very helpful to anyone trying to, like trying to adopt, because it didn't tell you what the benefits of using containers were, which wouldn't, and what the reasons that containers around were.
[07:52] Justin Cormack
They weren't there to repair.
[07:55] Justin Cormack
Almost everyone who uses containers in a vm.
[07:59] Justin Cormack
Like.
[07:59] Viktor Petersson
Right.
[08:00] Justin Cormack
Like many things in the.
[08:02] Justin Cormack
In, you know, in our ecosystem, they were largely additive, not replacing.
[08:07] Justin Cormack
And so there wasn't really, for most people, averse at all.
[08:12] Justin Cormack
They were going to use both.
[08:15] Justin Cormack
And it.
[08:16] Justin Cormack
But the implicit story was about security isolation.
[08:19] Justin Cormack
And was the security isolation good enough?
[08:22] Justin Cormack
But that, like, literally for most people, that really wasn't the issue.
[08:26] Justin Cormack
It wasn't why they were using containers.
[08:27] Justin Cormack
It wasn't important.
[08:30] Justin Cormack
Like, I think the.
[08:32] Justin Cormack
I mean, there were, you know, there were conversations about security and security.
[08:37] Justin Cormack
I'm not saying security is not important, but it wasn't the principal part of the threat model.
[08:43] Justin Cormack
And it wasn't, you know, the adoption of containers was entirely tied to, you know, organizational changes, the rise of microservices, the explosion in the number of developers, repeatability, you know, understandability of your environment, you know, configuration as code, and all those things that were happening at the same time.
[09:10] Justin Cormack
And that was the important thing.
[09:12] Justin Cormack
And none of that was captured in the containers versus vms.
[09:16] Justin Cormack
I think there's a sort of.
[09:18] Justin Cormack
I think there was a sort of alternate universe in which, you know, vms could have tried to be more competitive with containers and tried to adopt some of those processes.
[09:32] Justin Cormack
And you saw, I mean, and I kind of.
[09:34] Justin Cormack
I was.
[09:35] Justin Cormack
I was actually kind of interested in that.
[09:37] Justin Cormack
You know, over the years, we saw the little bits of that.
[09:41] Justin Cormack
You know, we had.
[09:45] Justin Cormack
God, well, I've even forgotten where it's got the hashicorp tool for Packer.
[09:50] Justin Cormack
It was probably the earliest thing for creating VM environments.
[09:53] Justin Cormack
Repeatably.
[09:56] Justin Cormack
There were other tools since then, but that was very early on, like, okay, we want to do repeatability with vms.
[10:04] Justin Cormack
How do we do it?
[10:07] Justin Cormack
I worked on Linux kit, which was shipped into Docker desktop, but that was also a way of repeatedly creating vms for running containers.
[10:16] Justin Cormack
But.
[10:18] Justin Cormack
And then there was, you know, far cracker became like suddenly, oh, okay, lightweight.
[10:24] Justin Cormack
You can run really lightweight vms.
[10:27] Justin Cormack
I mean, again, there'd be more work.
[10:28] Justin Cormack
Before that, there was the whole CAta containers piece, like vms and kubernetes and things like that.
[10:34] Justin Cormack
So there was actually this whole kind of timeline where a whole bunch of people were trying to make vms more like containers.
[10:39] Justin Cormack
And arguably, you know, when you look at the services and the cloud providers run fargate and things, they are vms as containers, but they have a container API, not a VM API.
[10:54] Justin Cormack
So they're actually, they just went around the route of, well, containers are what people want, but they want the VM isolation.
[11:05] Justin Cormack
We'll make this hybrid, but it looks like from anyone's point of view, it is a container.
[11:10] Justin Cormack
And then, like, it has all the important properties of container.
[11:13] Justin Cormack
It's compatible with the container ecosystem, not the VM ecosystem.
[11:17] Viktor Petersson
Yeah, I mean, to me, I think the reason why Docker won in a way over that was around more packaging for me was more like, you can pull a pre configured image.
[11:29] Viktor Petersson
It became more like an application packaging more than.
[11:32] Justin Cormack
Yeah, no, absolutely.
[11:33] Justin Cormack
And I think that's the thing.
[11:34] Justin Cormack
That's what I mean, like that there is maybe a.
[11:37] Justin Cormack
There's maybe a path where vms went down that packaging route.
[11:39] Justin Cormack
Right.
[11:40] Viktor Petersson
Nami kind of tried to do that.
[11:42] Viktor Petersson
Right.
[11:42] Justin Cormack
And they had, I think if, you know, I think, as I said, like, there's a few of these routes towards that, but they didn't really.
[11:50] Justin Cormack
It never took off.
[11:51] Justin Cormack
And containers did, you know, very much to do a kind of reduction in complexity that made those things easier to understand because Vmsheen, you know, were just.
[12:06] Viktor Petersson
Big, so much more surface area.
[12:07] Viktor Petersson
Right.
[12:07] Justin Cormack
Yeah.
[12:08] Justin Cormack
And had, yeah.
[12:09] Justin Cormack
If you could take out a lot of the stuff just, and just simplify it down to the application piece, not the whole system piece.
[12:18] Justin Cormack
Now, I mean, again, there's kind of, we've had discussions about minimal containers and.
[12:24] Viktor Petersson
Yeah.
[12:28] Justin Cormack
But like, fundamentally, yeah, the idea was just, yeah, take the applications because that's simpler and that's also separation of concerns, whereas the VM, if you ship a whole VM image, it's not got separation of concern as well.
[12:41] Viktor Petersson
Absolutely.
[12:42] Viktor Petersson
Absolutely.
[12:43] Viktor Petersson
Interesting.
[12:44] Viktor Petersson
So let's take a step back.
[12:46] Viktor Petersson
So back in 2019, some big changes had happened at Docker.
[12:51] Viktor Petersson
Right.
[12:51] Viktor Petersson
So the company was spun out into two.
[12:54] Viktor Petersson
One pot was sold and that was capped.
[12:57] Viktor Petersson
Do you want to shed some light?
[12:58] Viktor Petersson
Because I think that's a bit of confusing story for people at large, what actually happened.
[13:01] Viktor Petersson
Do you want to shed some light on what actually around that?
[13:05] Justin Cormack
Yeah.
[13:05] Justin Cormack
So, I mean, it's a complicated story in a way.
[13:10] Justin Cormack
Like, it goes back to, you know, goes back to a number of things, I think, first of all, you know, Docker Washington, explosively successful very quickly, and that in a way that very few open source projects or products ever are.
[13:43] Justin Cormack
And that was difficult in many ways.
[13:48] Justin Cormack
It was such a success so fast, and it created this giant ecosystem around the cloud native ecosystem around it.
[14:02] Justin Cormack
And there was a huge amount of interest and money and investment in that area.
[14:09] Justin Cormack
And I think that it was so unprecedented that having that huge ecosystem that it was very unclear for Docker, the company what the business that Docker should be in should be.
[14:33] Justin Cormack
And because everything was still really early and there was such a lot going on.
[14:42] Justin Cormack
The whole cloud native space was created from scratch pretty much over those years.
[14:50] Justin Cormack
And so the business that Docker chose was, you know, I think I can see the reasons at the time, but it was like, it was kind of the, it seemed like the right thing at the time.
[15:09] Justin Cormack
So it was basically our product was Docker Enterprise, which was, you know, a production side largely on prem, you know, run, you know, runtime production side product for Ops people.
[15:27] Viktor Petersson
Docker Swarm, right.
[15:28] Justin Cormack
It was originally based on Docker Swarm.
[15:30] Justin Cormack
We migrated it to support Kubernetes and swarm, you know, so it was actually, it supported both.
[15:39] Justin Cormack
I think there was a, that was another something we can talk about, like, internally later.
[15:49] Justin Cormack
I think that.
[15:52] Justin Cormack
But, yeah, because it was a production orchestrator solution, but that market at the time was still quite small back in 2018 2019, because a lot of people were still trialing these things and not really running applications at scale back then.
[16:20] Justin Cormack
So a lot of customers, we talked to customers and they'd have a few applications that they would try on, even, as you say, or swarm, whatever, they own containers.
[16:31] Justin Cormack
They agreed it was a future, but they had a lot of work to do to get there.
[16:34] Justin Cormack
So the market size, relatively small, it was extremely competitive.
[16:39] Viktor Petersson
Oh, yeah.
[16:40] Viktor Petersson
Back in those days, you had a lot of people playing that game.
[16:43] Justin Cormack
I mean, you know, red hat.
[16:46] Justin Cormack
Red hat was obviously a big player on the.
[16:49] Justin Cormack
On Prem, but they.
[16:52] Justin Cormack
I mean, they bought Coreos just really.
[16:56] Justin Cormack
Just to shut them down and stop them competing.
[16:58] Viktor Petersson
Yeah, that's really disappointing, right.
[16:59] Viktor Petersson
Because I was.
[17:00] Viktor Petersson
I was really bullish at Core Os.
[17:01] Viktor Petersson
I really liked Coreos back in those days, but then they just went to die at red hat.
[17:06] Viktor Petersson
But, yeah, that's a different story.
[17:07] Justin Cormack
But there was a.
[17:08] Justin Cormack
There was.
[17:09] Justin Cormack
I mean, but that's the thing.
[17:10] Justin Cormack
Like, the market was too small to support the number of people there.
[17:13] Justin Cormack
But I think there was another.
[17:14] Justin Cormack
There was another thing that I think, you know, and I didn't really, you know, so that was the kind of obvious competitive thing at the time.
[17:20] Justin Cormack
There was too many people in a too small a market.
[17:23] Justin Cormack
But the other thing I didn't really appreciate until a little later, I think, was that the early adopters who had made Docker a success and JSON Docker were not the people were selling to.
[17:43] Justin Cormack
They were not running on Prem.
[17:47] Justin Cormack
They were the people who'd gone into the cloud early as well, because containers in the cloud were part of the same thing, the whole cloud native thing.
[17:57] Justin Cormack
All our early adopters were early cloud adopters.
[18:01] Justin Cormack
And so the people were selling to who wanted on prem often actually weren't even using Docker at the time.
[18:07] Justin Cormack
We were trying to sell it.
[18:07] Justin Cormack
And I remember having a meeting with one bank, and there was a lot of these meetings back then, and they'd taken a year to sign an evaluation agreement.
[18:24] Justin Cormack
They were going to try it out.
[18:25] Justin Cormack
This was a very slow sales cycle.
[18:27] Justin Cormack
A lot of the time they were also coming and saying, we've heard about this Docker thing, it's amazing.
[18:32] Justin Cormack
And this was great.
[18:33] Justin Cormack
We were a small startup that could sell to have these sales conversations with big companies, but they didn't use Docker, but they believed it was a magic thing that they could sprinkle on their terrible systems to make things better, but they weren't using it, whereas there were all these people who were using Docker.
[18:57] Justin Cormack
And were being very successful with Docker, but weren't.
[19:00] Justin Cormack
We weren't actually.
[19:01] Justin Cormack
We didn't have a product to sell to them.
[19:03] Viktor Petersson
Right.
[19:04] Viktor Petersson
But, yeah, the thing with, the thing does this was like, Docker was used by everybody, but nobody paying Docker.
[19:10] Viktor Petersson
Right.
[19:11] Viktor Petersson
That was like, very successful in that sense, but not.
[19:14] Viktor Petersson
Yeah, like you're saying, like, not the people actually pay for it.
[19:17] Viktor Petersson
Right.
[19:17] Justin Cormack
But I think so, you know, when.
[19:19] Justin Cormack
So we sold the.
[19:21] Justin Cormack
So we sold that Docker enterprise business to Marantis because, and I think, you know, Marantis was originally big on OpenStack.
[19:31] Justin Cormack
They had a big Openstack customer base, but they could see the writing on the wall with kubernetes.
[19:36] Justin Cormack
They'd been trying to build their own kubernetes solution, I think, gradually, but acquiring ours accelerated them.
[19:46] Justin Cormack
I think they, you know, they did quite well out of their business in the air.
[19:52] Justin Cormack
It took them a while, but that's still.
[20:00] Justin Cormack
They grew the business.
[20:01] Justin Cormack
It took time and patience, but they had the customer base, particularly telcos was their core market, where they knew the customers well.
[20:17] Justin Cormack
They already were in with them on OpenStack, and they could introduce kubernetes on top of OpenStack to them.
[20:24] Justin Cormack
And so it kind of made sense from that point of view.
[20:28] Justin Cormack
And we, you know, we kind of, were kind of left with this, with the other bits of the business in a way that, but with a strong desire to focus on those original customers who had made Docker successful.
[20:51] Viktor Petersson
So Docker Hub stayed inside of this new entity, right?
[20:55] Justin Cormack
Yeah, so we had basically had Docker hub, Docker desktop, the open source Docker engine composer.
[21:08] Justin Cormack
And that was kind of, you know, that's basically what we kind of started with.
[21:14] Justin Cormack
And so, but we, yeah, so we had a clear desire to go back to the original customers who'd made Docker successful and who were using Docker in the cloud and also to go back, you know, to work with developers rather than just the ops side of things.
[21:36] Justin Cormack
Because, again, the ops side of things was by, you know, by then being dominated by the cloud providers.
[21:44] Justin Cormack
We didn't want to do the on prem thing because we recognized that the cloud was, you know, very tied to the success of containerization and those things.
[21:55] Justin Cormack
So we, so that's why we refocused on the developer market and on the, on people using, primarily using the cloud.
[22:06] Justin Cormack
Not all the customers using the cloud, but most of them.
[22:09] Justin Cormack
When you talk to them, a lot of people have a very strong tie between containerization and the cloud.
[22:16] Justin Cormack
These journeys go together for them sometimes they're incentivizing people.
[22:26] Justin Cormack
You have to move to the cloud, but you also have to use Docker containerized to do that.
[22:30] Justin Cormack
And because we don't want to just lift and shift to the cloud, because that's not going to give us the value.
[22:35] Justin Cormack
We want to do the whole cloud native route.
[22:38] Justin Cormack
And so we very much didn't want to be in this kind of world where we're tied to this kind of on prem only and just separated from the cloud.
[22:54] Justin Cormack
And I think that, you know, when I look like, again, when it's coming, kind of coming back to the conversation about containers versus vms, again, like, that wasn't the question.
[23:06] Justin Cormack
The things that all grew up together were the cloud, the organizational changes, the kind of, you know, the stuff that the team topologies work and the kind of like, how should we work together?
[23:20] Justin Cormack
How should we, you know, how should we build applications now we have hundreds of developers, nothing.
[23:25] Justin Cormack
Three.
[23:28] Justin Cormack
How do we have understandable things that people can work with that are repeatable and they can understand, you know, they can under, you know, we reduce the kind of complexity burden that people have to understand the whole kind of piece around.
[23:44] Justin Cormack
I mean, I kind of, looking back, I kind of think that, you know, when you, when we, when you introduce something radical, like darker, you've got to, you have a sort of change budget where you can change some things about how people work, but not too much containers, unlike, say, serverless, you didn't have to rewrite your applications.
[24:08] Justin Cormack
You could just take your applications exactly as they were.
[24:12] Justin Cormack
But we insisted on two things roughly, neither of which were really forced by the technology they would, but they kind of, we managed to bring people along, I think one of which, as you mentioned before, is one thing perk and one process per container.
[24:30] Viktor Petersson
Yeah.
[24:31] Justin Cormack
Again, people, some people know that you can run a process supervisor and run multiple things in a container, but when.
[24:39] Viktor Petersson
You introduce Ssh into a container, that's where, you know, you can't miss the boat.
[24:42] Justin Cormack
Yeah, yeah, totally.
[24:44] Justin Cormack
I mean, but, you know, it's possible, but I.
[24:47] Justin Cormack
That separation really helps modulize things, and it also fits the microservices thing.
[24:54] Justin Cormack
And the other one was, you have to redeploy a container, you can't update it in place.
[25:00] Justin Cormack
That was really the radical one because that suddenly allowed you to understand that the thing that you built was exactly the same thing in production.
[25:10] Justin Cormack
Being able to track that content hash all the way through the life cycle and be able to know, like, you know, Thursday last week, it was this version that was in production, and it had this issue, and we rolled out this version to fix that issue, like, and being able to see that rather than the kind of the old, you know, before Dogra, I still, you know, I remember the FTP into production.
[25:35] Viktor Petersson
Right.
[25:36] Justin Cormack
Change your, change your PHP code.
[25:39] Justin Cormack
Yeah.
[25:40] Viktor Petersson
But this goes back to the whole like, pet versus cattle debate, right, with the febrile vms that kind of Amazon kind of pioneered, right, with easy to.
[25:47] Justin Cormack
Netflix pioneered.
[25:49] Viktor Petersson
All right, fair enough.
[25:50] Viktor Petersson
Okay.
[25:50] Justin Cormack
Well, actually, although the pets versus cattle was actually a CERN presentation.
[25:55] Justin Cormack
Was it?
[25:56] Justin Cormack
Yes, it's actually.
[25:57] Justin Cormack
Yeah, it was actually CERN.
[25:58] Justin Cormack
So CERN's a.
[26:00] Justin Cormack
CERN has actually been on the housing edge of a lot of this stuff too, because they're a really interesting organization.
[26:06] Justin Cormack
We went to CERN for a CNCF meeting earlier this year, and it was some time and it was there.
[26:15] Justin Cormack
They're really rolling out kubernetes at scale now.
[26:18] Justin Cormack
And it's a technologically, it's a fascinating organization and they've really met a lot of issues that people have in advance.
[26:31] Justin Cormack
And I have been quite pioneering in all of this work.
[26:34] Justin Cormack
But they're also so weirdly different from other organizations in the kind of things they do that they also, the kind of things they do also seem very different.
[26:42] Justin Cormack
So it's a really fascinating place to visit and understand what I can imagine.
[26:50] Viktor Petersson
But, yeah, like that.
[26:50] Viktor Petersson
The whole concept of ephemeral vms, I remember back in mid two thousands, early 2010, whatever, when this console, ephemeral vms became normalized, I guess it was still, if you came from like the sysadmin world, it was still a mind boggling concept that these are throwaway vms and the whole IIC, it really took a while to get behind it mentally, I think.
[27:18] Viktor Petersson
Yeah, because I worked for cloud vendor at the time and it was just hard to just get your head around.
[27:26] Justin Cormack
It was, it was fascinating because Amazon, especially in the early days, really pushed the idea, like the cloud was cloud vms were different because they are potentially ephemeral.
[27:40] Justin Cormack
They might go away outside your control.
[27:44] Justin Cormack
But it was interesting when Google Cloud launched, they spent a lot of time actually making that never happen.
[27:50] Justin Cormack
And they had vm migration behind the scenes so that your vmsheen weren't like that.
[27:57] Justin Cormack
And then Azure did a lot more lift and shift than the other clouds as in the early days.
[28:07] Justin Cormack
And I mean, I remember they would come to our customers and say, would you like to sell your data center that you have all your machines in to us to turn into an azure data center.
[28:19] Justin Cormack
We'll produce exactly the same thing for you.
[28:21] Justin Cormack
Running an azure, you'll never notice the difference, but it'll become an Azure data center.
[28:24] Justin Cormack
That was how they, that was how they grew at the early point, which is really fascinating to the customers like got these offers and it's like, it makes sense, right.
[28:33] Viktor Petersson
Because Windows never ephemeral in that sense, right?
[28:36] Justin Cormack
Yeah, but I think that, but Amazon kind of just stopped pushing that message later because the more traditional clients came along and it didn't resonate so well with them that things could be thrown away.
[28:53] Justin Cormack
But I think those of us like me and you who grew up in the era of pets versus cattle and female vms still treat them like that and think that's a good thing and also scale them and kubernetes also forces you to treat them like that and like, you know, I think that we internalized that stuff was kind of, yeah, it was a big shift but we did internalize it.
[29:15] Viktor Petersson
Yeah.
[29:15] Justin Cormack
In that period, containers obviously were even more so.
[29:20] Viktor Petersson
I was about to say that's, and it kind of created natural segue into containers which is just that in the next instance, I guess, or lower down.
[29:30] Justin Cormack
Right.
[29:30] Viktor Petersson
So yeah.
[29:31] Viktor Petersson
Like I, I can't see a way going back to the whole nurturing and patching servers.
[29:36] Viktor Petersson
That sounds like a dreadful life.
[29:39] Justin Cormack
Well I'm not getting it, but a lot of it was just, it was forced by the scale of the things were trying to do, you know.
[29:47] Justin Cormack
Yeah.
[29:47] Justin Cormack
We just got more applications and that's never going away and you just have to automate when you get bigger.
[29:55] Viktor Petersson
Oh yeah.
[29:56] Viktor Petersson
Imagine running a service where you can't just say, oh, give me five replica sets of this and then where does it run?
[30:01] Viktor Petersson
You don't care because it is by definition.
[30:05] Viktor Petersson
But it's also philosophical difference between, I guess, how the Linux worldviews an application which the way how the Windows world I guess views an application.
[30:18] Viktor Petersson
Right.
[30:19] Viktor Petersson
So I think that is also why our cohort easily, I don't know if it's true.
[30:25] Justin Cormack
I don't, I wouldn't, well I think, I don't know.
[30:29] Justin Cormack
I think that Linux wasn't always like that.
[30:33] Justin Cormack
I think we took a bunch, I think we took a bunch of ideas and experience.
[30:40] Justin Cormack
I think that, you know, I think that, you know, there was a, there was that period around just trying to think exactly when it, there was a period, I think it started in the late nineties where the cutting edge of hard applications and things at scale, moved to Linux.
[31:03] Justin Cormack
I remember I worked with for a while a long time ago with people at MySpace.
[31:09] Justin Cormack
MySpace was a windows shop originally.
[31:12] Viktor Petersson
Were they?
[31:12] Viktor Petersson
I didn't know that.
[31:14] Justin Cormack
Yeah, they were kind of weird.
[31:15] Justin Cormack
They were based in LA, they were windows shop.
[31:18] Justin Cormack
But I met the Linux team at MySpace who were subversively taking over a bunch of the staff and kind of rolling out more of the Linux way of thinking and that kind of disposability and like, and the performance engineering stuff was hitting Linux more and the distributed system stuff and the, you know, the kind of things like, I mean there were a bunch of language communities.
[31:46] Justin Cormack
Erlang was very early in their kind of disposability and process ephemerality, but in the language, not in the runtime, because.
[31:57] Viktor Petersson
They had their VM, right, they're allowing VM to run everything so you can't just.
[32:00] Justin Cormack
But it had the whole kind of, you know, it was built for 100% uptime telco platforms where you had to.
[32:10] Justin Cormack
And it was crash.
[32:12] Justin Cormack
All the things about crash, you know, expect your processes to crash and another process is there to restart it.
[32:20] Justin Cormack
All that stuff was, you know, it's been there for a long time.
[32:25] Justin Cormack
And I think it actually like, I think Erlang did.
[32:29] Justin Cormack
I mean I knew a bunch of people who were, became container people who had been Erlang people and programmed Erlang.
[32:37] Justin Cormack
And I think some of those, you know, some of those ideas definitely filtered in from there even to people who didn't, who weren't really far fetched.
[32:49] Viktor Petersson
It's not that far fetched if you view the container as that boundary instead of the relying VM.
[32:53] Viktor Petersson
I guess there is some overlap in terms of philosophy, I guess, you know, strange.
[33:00] Justin Cormack
Yeah, I think, yeah, I think that, yeah, it's different, but yeah, definitely some philosophical overlap about, you know, what you, what's, what has to be reliable, what has, what's ephemeral, what's disposable or, you know, how you manage.
[33:22] Justin Cormack
I mean I think that, you know, being careful about how you manage data to make sure that your data has persisted when the processes crash and all those types of things and being able to just restart things and expecting to get better uptown out of unreliable system, fundamentally unreliable system.
[33:45] Justin Cormack
You don't expect the system to be reliable bit versus the, you know, probably the, whatever it was the seventies, eighties kind of tandem hp, tandem build, reliable hardware that never fails kind of solutions that were.
[34:03] Viktor Petersson
Yeah, yeah.
[34:04] Viktor Petersson
These boxes are still running though.
[34:08] Viktor Petersson
The old mainframes still running reliably to this day.
[34:12] Viktor Petersson
Right?
[34:12] Justin Cormack
Yeah, totally.
[34:13] Justin Cormack
Totally.
[34:13] Justin Cormack
Yeah.
[34:15] Viktor Petersson
Cool.
[34:16] Viktor Petersson
Before we switch into more nerdery around Docker, the one thing I feel like I need to cover is, I guess the debacle around the price changes around Docker desktop because that was obviously something that blew up massively in the tech community.
[34:33] Viktor Petersson
Do you want to give the vantage point from Docker?
[34:35] Viktor Petersson
Because that was obviously a big debate around that.
[34:40] Justin Cormack
I mean, I think that, you know, I think the, I mean, I think that overall, I think there was a smaller number of people making noise as often the case, rather than a good reflection of the world.
[34:59] Justin Cormack
I mean, I think that, you know, you know, somehow at the end, you know, companies have to charge for something to survive 100%.
[35:19] Viktor Petersson
I mean, absolutely.
[35:20] Viktor Petersson
Of course.
[35:21] Justin Cormack
Docker desktop, you know, I think like people are, people don't like, you know, it's definitely the case that going from something that you give away for free to something that's charged for.
[35:34] Justin Cormack
People do get a bit, do get upset.
[35:38] Justin Cormack
Although we did, you know, have a lot of exclusions as to who didn't have to pay for that.
[35:44] Viktor Petersson
Yeah.
[35:44] Viktor Petersson
Maybe share some light on like what the parameters were for the price increases.
[35:49] Viktor Petersson
So for those not who do not remember the debate or the.
[35:52] Justin Cormack
Yeah, yeah.
[35:53] Justin Cormack
I mean, you know, we, you know, we excluded a lot of people, anyone working in a small company basically with less than 250 employees or 10 million revenue, which was to basically exclude startups.
[36:18] Justin Cormack
And a lot of the people who were part of our community, although to be honest, a lot of them do pay anyway because they get value out of the bits that you pay.
[36:30] Justin Cormack
But I think that our primary aim was to charge larger, which was really charge the larger companies that were getting a lot of value out of.
[36:43] Justin Cormack
Docker desktop had fleets often thousands of people using it.
[36:48] Justin Cormack
It was a core part of their development environment.
[36:52] Justin Cormack
And you know, to be honest, like we didn't charge, you know, the price was quite cheap.
[36:59] Justin Cormack
Right.
[37:00] Justin Cormack
And so the kind of noise was mostly amongst people who to a large extent weren't trying to judge anywhere.
[37:08] Justin Cormack
And I think that, I think we, I think in general a lot of people understood the kind of, the kind of charging people who had the ability and willingness to pay made sense.
[37:25] Justin Cormack
And I think that.
[37:27] Justin Cormack
But yeah, overall, you know, as a strategy I would, you know, if people are asking about it, I generally say do try and avoid charging for things that were once free.
[37:42] Justin Cormack
I definitely avoid charging things and things that were once open source.
[37:48] Justin Cormack
I'm.
[37:48] Justin Cormack
Docker desktop was never open source.
[37:50] Justin Cormack
It was always a proprietary product.
[37:56] Justin Cormack
And I think some people thought it was open source, and we've done that because some people then never really understood that.
[38:03] Justin Cormack
But it was never open source.
[38:05] Justin Cormack
We never closed sourced anything.
[38:06] Justin Cormack
We've never.
[38:08] Justin Cormack
I don't think those routes.
[38:10] Justin Cormack
I think those routes upset people a lot more than, you know.
[38:14] Viktor Petersson
I think it was probably more philosophical debate than an actual, like, I'm impacted by this.
[38:18] Viktor Petersson
Right?
[38:19] Justin Cormack
Yeah.
[38:19] Justin Cormack
Yeah.
[38:20] Justin Cormack
And I think that.
[38:23] Justin Cormack
But overall, you know, it was.
[38:25] Justin Cormack
I think overall, you know, it's.
[38:30] Justin Cormack
It was the right thing to do.
[38:32] Justin Cormack
It had a good outcome.
[38:34] Justin Cormack
Like, the people, it's allowed us to invest, continue to invest in Docker desktop, and people are happy with it, and we're providing the things that those customers want from it.
[38:51] Viktor Petersson
All right, so obviously you need to pay.
[38:54] Viktor Petersson
I understand that.
[38:54] Viktor Petersson
And that brings me to a natural segue to Docker hub, which, if my understand is correct, which is probably by far biggest expense Docker has.
[39:04] Viktor Petersson
Maybe, except for payroll.
[39:06] Viktor Petersson
Hosting, this is a pretty significant cost that needs to be paid for somewhere.
[39:12] Viktor Petersson
Can you shed some light on the sheer volume and infrastructure cost for your hosting Docker hub, which most people use for free?
[39:21] Justin Cormack
Right.
[39:23] Justin Cormack
I mean, it's not as high a cost as you kind of make it.
[39:29] Justin Cormack
Like, it's not.
[39:34] Justin Cormack
It's well down below payroll.
[39:37] Justin Cormack
Oh, okay.
[39:38] Viktor Petersson
Fair enough.
[39:38] Justin Cormack
Yeah.
[39:38] Justin Cormack
It's not, it's not.
[39:40] Justin Cormack
I mean, certainly when we restructured Dhaka, it was a huge, right thing, but, you know, but now we've grown, it's not so significant.
[39:55] Justin Cormack
So, but I think that, I mean, it's interesting because it, you know, a lot of the, it's interesting how the cost of actually running a service like that has changed over the years.
[40:09] Justin Cormack
So we, it's now, but mostly since Amazon introduced teard storage pricing, the storage costs actually are now kind of quite manageable because a lot of it ends up in cold storage because it doesn't actually get accessed very much.
[40:37] Justin Cormack
But we are kind of, the cloud providers still have these egress charges that are designed to keep traffic inside their own cloud.
[40:57] Justin Cormack
And while the European Union has been kind of pushing them a little bit about, is this uncompetitive and so on?
[41:10] Justin Cormack
Because we run a global service that's accessible to everywhere.
[41:17] Justin Cormack
You know, egress is.
[41:19] Justin Cormack
Egress is difficult when you're doing something like that at scale.
[41:22] Viktor Petersson
Right.
[41:23] Justin Cormack
We, it's a complicated thing, and, but, you know, egress charges are, you know, they're high enough that they kind of affect how people are designing services and things in a significant way.
[41:46] Justin Cormack
And they're clearly, I mean, there's arguments about the why of inbound versus outbound.
[41:54] Justin Cormack
Like there are some economic reasons, like in terms of traffic is not symmetric, inbound and outbound.
[42:05] Justin Cormack
And like they're, you know, the way it's charged it, there's some justification, but it's, you know, there's also a reasonable argument that it is purely anti competitive, competitive thing to stop people running cross data centers.
[42:19] Viktor Petersson
They are roughly the same.
[42:20] Viktor Petersson
You have symmetric lines usually in and.
[42:22] Justin Cormack
Out of symmetric lines, but doesn't mean that the binding point on your 95th percentile, it could be one direction, not the other.
[42:34] Justin Cormack
But I mean, yeah, but yes, your lines are definitely symmetric and the charging model is very different.
[42:42] Justin Cormack
Yeah, it's very interesting.
[42:47] Justin Cormack
I'm curious to see what the competition authorities in various places decide about this because they clearly, it clearly makes building kind of multi cloud infrastructure extremely expensive for a lot of businesses.
[43:05] Viktor Petersson
I mean it's, oh, it's a massive lock in.
[43:07] Viktor Petersson
Absolutely.
[43:07] Justin Cormack
Yeah.
[43:09] Viktor Petersson
So, and just for those not familiar with the kind of orchestration of Docker hub, it's essentially Docker registry, which is essentially a thin layer on top of s three.
[43:21] Viktor Petersson
But it's s three compatible, I guess.
[43:23] Viktor Petersson
So the vast majority of all the hub data sits at s three.
[43:27] Viktor Petersson
Eventually it's tiered using istorage for less frequent.
[43:31] Viktor Petersson
Is that, is that a fair representation of the architecture?
[43:35] Justin Cormack
I mean that's a very simplified version.
[43:37] Justin Cormack
Yeah, I mean I think that, yeah, I think that, you know, I think that, yeah, I mean it runs on kubernetes.
[43:49] Justin Cormack
It's, there's.
[43:54] Justin Cormack
We do.
[43:56] Justin Cormack
Yeah, it is, yeah.
[43:58] Justin Cormack
It's based on the open source distribution code that's in CF now.
[44:02] Justin Cormack
It's, you know, we've forked it at times and gone back and merged our changes at times.
[44:10] Justin Cormack
That's fair.
[44:11] Justin Cormack
You know, the core of it's there but we still, we have a lot of, there's a lot of other stuff around, around it.
[44:23] Justin Cormack
There's the whole UIP.
[44:26] Justin Cormack
So there's a whole layer with scout where we're indexing data inside the images and s bombs and things like that as well now and things like that.
[44:37] Justin Cormack
So there's, on top of that.
[44:39] Justin Cormack
So yeah, it is a big Kubernetes cluster.
[44:42] Justin Cormack
It used to, I mean we've always, yeah, I think it, we've migrated into kubernetes probably at least five years ago now.
[44:57] Justin Cormack
We used to host a lot of stuff on swarm ourselves, but we moved over to Kubernetes but yes, it's an interesting thing because it's just because of the whole scale of it and that adds a lot of complexity.
[45:22] Justin Cormack
I remember years ago being in a meeting, this was back in 2017 or something.
[45:27] Justin Cormack
I remember sitting in a meeting because Hub had gone down and noticing that the meeting I was in was number one on hacker news.
[45:35] Justin Cormack
Soccer hub is down and it's like, look, our meetings on top of hacker news.
[45:40] Justin Cormack
We better fix this.
[45:44] Justin Cormack
But reliability is, you know, reliability is for.
[45:48] Justin Cormack
Yeah.
[45:49] Viktor Petersson
And can you share some like sheer volume of pools per day on hub right now?
[45:56] Viktor Petersson
Do you have any daytime?
[45:57] Justin Cormack
I don't have it at hand.
[45:58] Justin Cormack
It's, I mean it's, you know, it's, you know, traffic is every, usually at Docker Connor's, I think we release them figures on how many pulls there's been.
[46:14] Justin Cormack
You know, and it's, it continues to, you know, continues to grow.
[46:21] Justin Cormack
You know, I think that.
[46:26] Justin Cormack
I think that, you know, I mean, it's another part of the, you know, it's an important part of why darker was successful Washington, you know, and, you know, as we're, you know, talking about the things that were different about doggo from what came before and since, it's like having that catalog of publicly maintained high content was a key part of what, you know, the fact that you can have that magical docker experience of like, I can just docker run Ubuntu and I get Ubuntu.
[46:54] Justin Cormack
Yeah, and this is kind of hundred kind of, you know, magical in.
[47:00] Justin Cormack
And it's part of that experience, but it's also part of the, you know, the whole productivity of all the components I need to build applications there and available and I can trust and rely on them.
[47:16] Justin Cormack
And Docker Hub, so really keep, it's a key part of that.
[47:24] Justin Cormack
And it's very different from, you know, a lot of the other registries, which are largely private registries.
[47:29] Justin Cormack
Tucker hub is still largely a private public registry.
[47:35] Justin Cormack
There are lots of customers using as private registry, but the public part is still way bigger than that.
[47:41] Justin Cormack
I mean, the cloud, you look at ECR there is ECR public, but it's very small private.
[47:47] Viktor Petersson
Yeah, I mean, most cloud vendors do offer some level of caching off the public hub images as well.
[47:53] Viktor Petersson
Right?
[47:53] Justin Cormack
So, yeah, I mean, that's been part of, you know, working with them to, you know, just make sure that, you know, that they are caching things effectively just because it's like, just, you know, that's, they're the source of a lot of traffic.
[48:14] Viktor Petersson
Right.
[48:15] Viktor Petersson
Yeah, that makes it work out how.
[48:17] Justin Cormack
To make it more efficient on both sides.
[48:20] Viktor Petersson
Yeah, that makes a lot of sense.
[48:21] Viktor Petersson
So you mentioned Docker Scout.
[48:24] Viktor Petersson
I want to zoom into that because I don't think a lot of people are familiar with Docker Scout, but it does a lot of things.
[48:30] Viktor Petersson
You mentioned s bombs.
[48:32] Viktor Petersson
I had a lot of content on the podcast about s bombs already.
[48:36] Viktor Petersson
And Docker Scout can generate sBoms, both Cyclone DX and SPDX, from docker image using.
[48:44] Viktor Petersson
I think it is a wraparound anchor.
[48:45] Viktor Petersson
Sif.
[48:46] Justin Cormack
I think.
[48:47] Justin Cormack
No, it's.
[48:48] Justin Cormack
Well, it uses a bunch of stuff and a bunch of its own code.
[48:52] Justin Cormack
So it's kind of,
[48:54] Justin Cormack
We do use a.
[48:55] Justin Cormack
We use a mix of tools internally.
[48:57] Justin Cormack
It's not just based on what thing found.
[49:01] Justin Cormack
We found things that.
[49:03] Justin Cormack
Okay, yeah, it's not.
[49:04] Justin Cormack
It's,
[49:07] Justin Cormack
But the.
[49:08] Justin Cormack
But in a way that.
[49:08] Justin Cormack
I mean, the.
[49:09] Justin Cormack
The creating s bombs bit is not like the core.
[49:15] Justin Cormack
The.
[49:15] Justin Cormack
The way we see the core value of it.
[49:18] Justin Cormack
The way.
[49:18] Viktor Petersson
Right.
[49:18] Justin Cormack
Like we.
[49:19] Justin Cormack
The.
[49:22] Justin Cormack
You know, I think that one of the things that.
[49:27] Justin Cormack
One of the kind of design things about how people were managing, you know, understanding vulnerabilities was, you know, and we.
[49:37] Justin Cormack
You know, we used to do this with the services we had on Docker, things like that.
[49:40] Justin Cormack
It was like you would.
[49:41] Justin Cormack
You would take an image, scan it, look at vulnerabilities, and give the user reports on that.
[49:47] Justin Cormack
But we really wanted to separate out the two stages of creating an SBA on what's in the image versus the bit about, is there a vulnerability?
[49:59] Justin Cormack
Because if you separate those, that lets you actually scout is basically a real time database with live feeds from different sources.
[50:12] Justin Cormack
As soon as a vulnerability happens, you can get an alert about it without having to run the image through a pipeline again, to find that.
[50:20] Justin Cormack
Because we link the vulnerability to the SBom item that we've indexed in the database, and we say, okay, these images now, as of a minute ago, now have a vulnerability, and then we can look and see if they in production.
[50:38] Justin Cormack
Are they things that you're actively using?
[50:40] Justin Cormack
And then we can help you remediate that.
[50:42] Justin Cormack
So it's like separating out what's in it and is there a problem about what's in it?
[50:51] Justin Cormack
Pieces.
[50:52] Justin Cormack
And running them separately allows this real kind of much more responsive tooling.
[51:01] Viktor Petersson
So, to talk to me, you do some interesting stuff with, I guess, at the station and embedding s bombs in kind of metadata.
[51:09] Viktor Petersson
And I believe that's stored in the OCI as part of the image.
[51:12] Viktor Petersson
Right.
[51:12] Viktor Petersson
Is that correct assumption or.
[51:14] Viktor Petersson
I haven't actually done a deep dive on this.
[51:16] Justin Cormack
Yeah, I mean, I think that, I mean we actually, scale supports a lot of different formats as well, but yeah, we've been working on doing that because, you know, because we actually, you know, we maintain build kit, which is what the majority of people are using for doing builds.
[51:43] Justin Cormack
That means that we can, if we can add these s bombs at build time and then carry them, you know, all the way through, then we can, you know, then we can use that to index.
[51:56] Justin Cormack
So rather than, you know, if you add the s bomb at build time with buildkit, then we don't need to scan the image at all.
[52:04] Justin Cormack
We can just read the s bomb.
[52:07] Justin Cormack
And we feel that having it attached to the image is helpful because it, I mean, I think that there's been discussion, you know, there's different models because, you know, six door effectively lets you attach it externally in the transparency log.
[52:28] Justin Cormack
But that's kind of, there's a lot of use cases where it's actually more effective, easier for people to deal with if it's on the index.
[52:36] Justin Cormack
Like if you're in a air gapped environment where you don't want to reach out to an external thing.
[52:42] Justin Cormack
And to be honest, and like the transparency log is not a high performance database either.
[52:47] Justin Cormack
And so, but we don't actually, like, we actually index that in the scout database for fast access again.
[52:57] Justin Cormack
So that, because again we actually want to be able to alert you when there's a vulnerability change on something.
[53:03] Justin Cormack
So we still want to maintain a copy of that in the database, but it's a copy and the source of truth is what you add to the image, what you put in the image.
[53:13] Justin Cormack
So you can manage the s bom if you want.
[53:19] Justin Cormack
You can use whatever tooling you want to construct the s bom that you attach to the image.
[53:25] Justin Cormack
So you can be sure that, because I think part of the reason for doing s bombs at build time rather than by scanning is actually quite hard to retroactively work out what was used to build something after the tooling there has gone better in many cases, but it's still like, you know that at build time you've got the complete information about what went into it because it's all there to build it with.
[53:50] Justin Cormack
And you can often you have even more information like what were the build tools, what were the internal build stages and the tools that even if they don't appear in the output they could potentially affect the output.
[54:08] Justin Cormack
Like if you have a compiler bug, you need to know which version the compiler is even though the compiler is not necessarily linked into the final image.
[54:14] Justin Cormack
Although often like tools I go will put metadata about what the compiler version actually was in there.
[54:22] Justin Cormack
Not every language tooling will do that.
[54:24] Justin Cormack
And traditional C tooling doesn't put any metadata about the compiler version in there.
[54:30] Viktor Petersson
Sboms and clay is a whole different kind of word in general.
[54:34] Justin Cormack
Yeah.
[54:35] Justin Cormack
I mean, but I think that like, you know, so having, creating sboms at build time gives you that complete control where you can just take the image, you can take the data from the actual build tooling and the, and feed it straight into the SBom directly rather than trying to reverse engineer out of what came out of the container image.
[54:55] Justin Cormack
So and then if you attach it then, you know, the information is there.
[55:02] Justin Cormack
So then you can feed it through any tooling.
[55:04] Justin Cormack
And there's a broader kind of, you know, there's a broader, you know, this is broader attestation projects around, particularly around in toto which is a CNCF project which is really around, you know, it's a project around attaching build process attestations in the broadest sense, not just s bombs.
[55:25] Justin Cormack
How was this built?
[55:27] Justin Cormack
Who built it, where did they build it?
[55:30] Justin Cormack
And so there's a lot of you can add that metadata like this was built in Docker's AWS account.
[55:39] Justin Cormack
So, you know, we can take the assession from that, from the metadata that Amazon provides.
[55:48] Justin Cormack
You can get it, you can get a sign, you can get assigned signature from Amazon saying that this payload was built, this boot time payload was in AWS at this point and things like that.
[56:01] Justin Cormack
So there's a lot more data that you can really get.
[56:04] Justin Cormack
A reproducible thing that gives you more information that gives you certainty about, you know, how the build process happened, where it happened, what happened and so on and that type of information, I think.
[56:21] Justin Cormack
And again, the GitHub assertion from GitHub actions.
[56:26] Viktor Petersson
Yeah, I was going to say, yeah.
[56:27] Justin Cormack
So all those kinds of things together give you this whole question of things that give you more certainty.
[56:34] Justin Cormack
And I think that our view is generally that bundling all that together in the OCI format is useful so that it's all self contained technically from the kind of the statements are about hashes and don't have to be bundled, but the bundling convenient to keep things together.
[56:57] Justin Cormack
And that's what the sort of extensibility of the ACI format was kind of designed for.
[57:05] Viktor Petersson
And if you look at any of the official builds in Hub today, do they all have this included as metadata to all those images or is this just you can use as your toolchain?
[57:18] Justin Cormack
We're rolling it out.
[57:20] Justin Cormack
It's not, I think, on all of them yet, but it's on a lot of them now.
[57:23] Justin Cormack
So it's kind of in, you know, we're kind of going through this process and being our first customer, zero for ourselves.
[57:33] Justin Cormack
I mean, I was very insistent when we're doing this that like, if it doesn't work for us, then yeah, it's not good enough for other people.
[57:41] Justin Cormack
I mean, our use cases is kind of complicated, but I mean, I think that, you know, if there are, if you can't validate the attestations on Docker official images, and use them, then that's not working for people, I think because I did a talk about this many years ago in Kubecon about how, you know, with the earlier work we did like no one in practice was validating the success signatures we put on Docker official images.
[58:10] Justin Cormack
So because it was very hard to, and it's difficult, and you kind of see this with the adoption of HTTPs, it's hard to incrementally go from an ecosystem that doesn't have signing and security checks to one that does in a way that doesn't leave holes where, because lots of stuff is unvalidatable.
[58:35] Justin Cormack
And so you kind of tend to be in this position where you tend to fall back to, oh, if it doesn't, you know, you can fall back to oh, we don't have to validate it because it must be part of the unvalidatable set.
[58:47] Justin Cormack
And trying to get to a point where you carve out things, sets of things that are known to be validatable and therefore you should validate them.
[58:56] Justin Cormack
You know, it's a kind of slow process movingly because it's a to that.
[59:02] Justin Cormack
And so I think we're still kind of on that journey to where everything is validatable in the cloud native ecosystem.
[59:14] Justin Cormack
But it's just, it is just a hard path going from there.
[59:22] Justin Cormack
It's kind of weird when you look at it like there was a whole like Docker images in the earliest release all had signatures on them, but the signatures were kind of useless unless they're still there in the v one format.
[59:37] Justin Cormack
But they were kind of, they kind of, they were used to signatures or just hashes.
[59:42] Justin Cormack
They were, they were cryptographic signatures on the earliest.
[59:45] Justin Cormack
Weirdly, the earliest versions didn't have real content hashes, but they just have signatures.
[59:51] Justin Cormack
But the signatures were for keys that were just randomly generated for the user.
[59:54] Justin Cormack
You couldn't validate keys.
[59:55] Justin Cormack
So for most users.
[01:00:00] Justin Cormack
So it was kind of, they weren't actually much use right then, but then they weren't actually content.
[01:00:07] Justin Cormack
Cryptographic hashes of content for a while.
[01:00:09] Justin Cormack
That was the first big, that was the migration to the v two format.
[01:00:17] Justin Cormack
That was real content hashes because there was a big potential security vulnerability without the content hashes of.
[01:00:24] Justin Cormack
Right back in, when I joined Docker, this was just being, was in the process of being rolled out as big change in 2015.
[01:00:32] Viktor Petersson
And each layer is SHA 256 sign or something like that.
[01:00:36] Justin Cormack
Right?
[01:00:37] Justin Cormack
Yeah.
[01:00:37] Viktor Petersson
Hash 39s.
[01:00:38] Justin Cormack
Yeah.
[01:00:39] Justin Cormack
But they were originally, they were actually random things that looked like hashes, but they weren't in the earliest versions.
[01:00:47] Justin Cormack
You could basically poison the cache.
[01:00:49] Justin Cormack
Bye.
[01:00:51] Justin Cormack
Gracing something with the same hash as some bit of well known content.
[01:00:55] Justin Cormack
If you could get someone to pull it before the well known content, it would then replace your layer, which was like.
[01:01:01] Justin Cormack
It was, it was, yeah, it was a, you know, anyway, so that was where, that was what v two was about, I think, you know, we noticed that internally and that was the whole v one, v two.
[01:01:13] Viktor Petersson
Right.
[01:01:14] Justin Cormack
Docker format, which is.
[01:01:15] Justin Cormack
Yeah, as I said, 2015 lost in the midst of time now.
[01:01:18] Justin Cormack
But, you know, it's kind of.
[01:01:23] Justin Cormack
But again, I think that the content hash, again, is like one of these key things enables this ecosystem, like, enables these pieces around s bombs and signing and things because you've suddenly got that.
[01:01:38] Justin Cormack
You've got this thing that has gotten an immutable content hash.
[01:01:42] Justin Cormack
You don't update it in production.
[01:01:43] Justin Cormack
You know, what's.
[01:01:44] Viktor Petersson
And you have a root of trust.
[01:01:45] Justin Cormack
And you have a route.
[01:01:46] Justin Cormack
Yeah, exactly.
[01:01:47] Justin Cormack
And so, you know, that it's those kind of pieces that are really important to building out.
[01:01:53] Justin Cormack
Building out this ecosystem.
[01:01:56] Viktor Petersson
And will there be tooling for like, exporting to like a Cyclone Dx s bomb?
[01:02:01] Viktor Petersson
And I guess, is it in one of these formats or is it agnostic to the two formats?
[01:02:07] Viktor Petersson
Because, I mean, that battleground is still being played out.
[01:02:09] Viktor Petersson
Right.
[01:02:09] Viktor Petersson
Between sports.
[01:02:10] Justin Cormack
Yeah, I mean, I think that stuff is all kind of.
[01:02:13] Justin Cormack
Yeah, so, you know, I think that everyone's making their stuff interoperable at the moment, and I think that.
[01:02:24] Justin Cormack
And converting these things, I mean, I think that, you know, that's actually not the difficult bit.
[01:02:34] Justin Cormack
Like, the difficult bits are actually, like, around standardization of all sorts of other smaller pieces about like, what you.
[01:02:46] Justin Cormack
How do we name packages and things like that, like, turn out to be.
[01:02:50] Viktor Petersson
Yeah, I'm part of a working group with CISA for, for a bunch of this stuff.
[01:02:55] Viktor Petersson
And that's obviously something that comes up a lot.
[01:02:57] Viktor Petersson
It's just.
[01:02:57] Viktor Petersson
How do you actually name things?
[01:02:59] Viktor Petersson
Like is it.
[01:03:00] Viktor Petersson
Is it Microsoft or is it Microsoft Inc.
[01:03:02] Viktor Petersson
Or whatever?
[01:03:04] Viktor Petersson
How you capitalize things and like.
[01:03:06] Viktor Petersson
And those things do have real consequences, right?
[01:03:08] Viktor Petersson
At scale.
[01:03:09] Justin Cormack
Yeah, yeah, totally.
[01:03:10] Justin Cormack
And I think those are the things that if we can standardize like write down all that detail, then a lot of the other stuff about the format stuff will kind of become much easier to.
[01:03:23] Justin Cormack
Because you just be a conversion process.
[01:03:27] Viktor Petersson
Right.
[01:03:28] Justin Cormack
I think.
[01:03:28] Viktor Petersson
Yeah, go ahead.
[01:03:29] Viktor Petersson
Sorry.
[01:03:29] Justin Cormack
I think there's like, I mean, I think there's a lot of.
[01:03:32] Justin Cormack
A lot of.
[01:03:32] Justin Cormack
It's just about trying to reflect the right amount of domain complexity.
[01:03:39] Justin Cormack
Like what, you know, what is an S bomb?
[01:03:42] Justin Cormack
What do we include?
[01:03:44] Justin Cormack
What does it mean?
[01:03:45] Justin Cormack
Like what do we.
[01:03:46] Justin Cormack
Like, you know, the example I was talking about things that are used in the build but do not appear in the artifact.
[01:03:52] Justin Cormack
Are those part of an S bomb or not?
[01:03:55] Justin Cormack
What, you know, another thing we have with containers is like layers that there's stuff that's overwritten in layers.
[01:04:03] Justin Cormack
And we've had a lot of tooling issues around like some tools just index all the layers and look at what's in all the layers.
[01:04:11] Justin Cormack
And so they'll show you something that is in a hidden piece because it's been overridden by another layer.
[01:04:19] Justin Cormack
And like is that, you know, technically that's not a vulnerability, but I.
[01:04:27] Justin Cormack
It's potentially a vulnerability in a different image.
[01:04:31] Justin Cormack
And a lot of the stuff we did with scout was about, we do have a full layer model because we want to be able to tell you how to remediate issues.
[01:04:41] Justin Cormack
And to remediate an issue, you need to know which layer the things in.
[01:04:44] Justin Cormack
So if you don't have a layered model, you can't realize which bit of it you need to remediate and how the things been built up.
[01:04:53] Justin Cormack
So we have a full layering model and so we can give you breakdown by layout, but we use that to say you should update the base image.
[01:05:04] Justin Cormack
You should update this image in order to fix it.
[01:05:06] Justin Cormack
Because sometimes it's a different team that's responsible for updating the different images because like developers might build the application, but there's a team that builds base images and you need to know which of them to talk to.
[01:05:18] Justin Cormack
And so again, like some of the thing is about reflecting the domain complexity in the model of the data that you're extracting from.
[01:05:27] Justin Cormack
These things and.
[01:05:28] Justin Cormack
Yeah, and things like container.
[01:05:30] Justin Cormack
I mean, layers are an interesting thing with container images because they're kind of an implementation detail, but they kind of leak into a lot of things.
[01:05:37] Viktor Petersson
Yeah, absolutely.
[01:05:39] Viktor Petersson
Yeah.
[01:05:39] Viktor Petersson
Particularly from the voldemorty standpoint, that's obviously a very difficult one because they may or may not be relevant.
[01:05:45] Justin Cormack
Yeah, exactly.
[01:05:46] Justin Cormack
And they're relevant to some questions and not others.
[01:05:49] Justin Cormack
Yeah.
[01:05:49] Justin Cormack
And so they're kind of.
[01:05:51] Justin Cormack
And.
[01:05:52] Justin Cormack
Yeah, and they.
[01:05:53] Justin Cormack
But they, you know, the classic s bomb doesn't understand them.
[01:05:57] Viktor Petersson
Yeah, exactly.
[01:05:58] Viktor Petersson
I mean, the classic s bomb is still to be, I would say still to be defined because we don't really.
[01:06:03] Viktor Petersson
It's still really much a moving target.
[01:06:05] Justin Cormack
I mean, I think that.
[01:06:06] Justin Cormack
Yeah, I think that there's been a lot of.
[01:06:11] Justin Cormack
Yeah, there's a lot of improvement and alignment in the ecosystem around.
[01:06:14] Viktor Petersson
Yeah.
[01:06:15] Justin Cormack
The problem space and what the solutions look like.
[01:06:18] Justin Cormack
But it's.
[01:06:18] Justin Cormack
Yeah, it's, you know, a lot of it is about like the domain complexity versus.
[01:06:25] Viktor Petersson
Yeah, and the tooling, from my experience is very theoretical and like, when you actually started using it for real use cases, that's when it start to break down and that's.
[01:06:33] Viktor Petersson
Yeah, but it's.
[01:06:34] Viktor Petersson
Yeah, there are a lot of great theoretical documents about how to use this, but then when you actually try to use it, you realize that, oh, the tooling actually falls short rather than.
[01:06:44] Justin Cormack
Yeah, no, totally.
[01:06:45] Justin Cormack
I mean, again, that's something that we've, you know, we spend a lot of time on with scout.
[01:06:49] Justin Cormack
Our aim is to make it work for developers.
[01:06:53] Justin Cormack
That's our, you know, because developers are the people who are usually being called on to actually fix the issues.
[01:07:00] Justin Cormack
Yeah, and.
[01:07:05] Justin Cormack
But it's, you know, I think a lot of the time.
[01:07:08] Justin Cormack
Yeah.
[01:07:09] Justin Cormack
As you, as you say, the kind of theory doesn't work particularly with the scale.
[01:07:15] Justin Cormack
Organizations are big and they have a lot of stuff going on and a lot of the tools don't really scale to a large organization, a large, complex organization.
[01:07:27] Viktor Petersson
They're great for greenfields, but when you actually start doing a legacy, that's when it gets really complicated.
[01:07:31] Justin Cormack
Yeah, I mean, yeah, it's like, you know, I think this is the case with a lot of that sort of tool that the steady state.
[01:07:40] Justin Cormack
In a steady state situation in theory, when you've got to a good state, is very different from the.
[01:07:47] Justin Cormack
I've turned this tool on.
[01:07:48] Justin Cormack
It tells me I've got a million problems.
[01:07:51] Justin Cormack
What should I do?
[01:07:52] Viktor Petersson
Right, right, absolutely.
[01:07:55] Viktor Petersson
Well, there's a billion things to more talk about that, but interest of time.
[01:08:00] Viktor Petersson
The last thing I wanted to talk a bit about, which is something I think you guys are doing some interesting moves on, is wasmouse.
[01:08:06] Viktor Petersson
And I know you've been toying with that for a bit.
[01:08:10] Viktor Petersson
Tell me about dockers wasm story.
[01:08:12] Viktor Petersson
And what does that mean in terms of your market?
[01:08:17] Viktor Petersson
Go to market?
[01:08:19] Justin Cormack
Yeah, I think wasm is already an interesting area.
[01:08:24] Justin Cormack
You know, I think that for, you know, for a while there was a whole kind of, like, were talking about VMS versus container.
[01:08:33] Justin Cormack
Like there was a whole kind of wasm versus container, wasm versus docker kind of thing.
[01:08:39] Justin Cormack
Because again, like, superficially it looks like a container.
[01:08:44] Justin Cormack
It's, you know, it's a thing and it's got an isolation layer and it's a sort of package of stuff.
[01:08:51] Viktor Petersson
Right.
[01:08:51] Justin Cormack
But again, a lot of that's kind of a bit superficial.
[01:08:56] Justin Cormack
And like, you know, the interesting, I think there's a lot of.
[01:09:01] Justin Cormack
There's a lot of interesting things about wasm and what it could can be used for and what it will be used for and how and why.
[01:09:12] Justin Cormack
I think that there's, you know, I think that, and I think there's actually one of the things that's really nice about the wasm community is that there is such a diversity of use cases and very different things you can do.
[01:09:32] Justin Cormack
And they're, you know, so we've seen a lot of success for things like Wasm as a plugin, you know, plug in extension language for things like envoy, for example.
[01:09:44] Justin Cormack
Lots of, lots of other projects have it.
[01:09:46] Justin Cormack
And I used to do a bunch of work on Lua back in the day.
[01:09:52] Justin Cormack
And as an extension of language, I kind of interested in extension languages for things.
[01:09:55] Justin Cormack
They're really, they're really powerful way of building.
[01:09:59] Justin Cormack
Building stuff that you can extend.
[01:10:02] Justin Cormack
And, you know, I think that's.
[01:10:03] Justin Cormack
There's a whole piece with people like fastly using it for that open rusty.
[01:10:08] Viktor Petersson
And all that stuff.
[01:10:08] Justin Cormack
Yeah, well, yeah, open rusty.
[01:10:10] Justin Cormack
Well, yeah, open rusty was.
[01:10:13] Justin Cormack
Yeah, and the day with Lua, but anyway, but it's like that kind of area is one area, I think, that WaSM for the web is an amazing enabling technology that helps people build web applications that are just much more powerful.
[01:10:36] Justin Cormack
Again, there's been a very long story from Gmail was one of the first of these complex web applications that was largely built from, largely built in one of the JVM languages, and they can cross compile it to JavaScript to run in the browser.
[01:10:57] Justin Cormack
And there's been this whole long technology tread of that.
[01:11:00] Justin Cormack
And WASM is a much more effective and sane way of doing that.
[01:11:07] Justin Cormack
And then there's this server side wasm, which is the bit that's most often compared to containers.
[01:11:15] Justin Cormack
And that's the bit where to a large extent, we've been working on shipping that shipping tooling to support that.
[01:11:25] Justin Cormack
I mean, it's something that we've been looking at for a really long time.
[01:11:32] Justin Cormack
I think back in, I think it was 2016 or 2017 time were experimenting with it.
[01:11:39] Justin Cormack
And that's when Solomon tweeted around with him.
[01:11:41] Justin Cormack
And it was in his phase when he used to post a lot of stuff on Twitter and hacker news and really kind of get a lot of attention.
[01:11:53] Justin Cormack
And he tweets the thing about like, oh, if Wasm had existed, we never would have had to build Docker or something like that, which has been then since quoted in every single wasm presentation ever since.
[01:12:06] Justin Cormack
And it's kind of like sort of put docker on the map as like, in that kind of space, but it kind of isn't.
[01:12:14] Justin Cormack
I don't think it's a very, it doesn't, it's not a very useful way of looking at it.
[01:12:21] Justin Cormack
Again, like the containers versus vms, like, so what's the, you know, what is the outcome you're trying to achieve for, you know, for the developer by shipping things and wear them?
[01:12:32] Justin Cormack
And generally, you know, I think the areas that are interesting for wasm are, one, is a lot of people are building quite lightweight, serverlessly type stuff with wasm.
[01:12:52] Justin Cormack
I think that, I think some of the sort of wasm is smaller kind of commentary is misleading because people look at people's containers and ask and discover that people have very large containers, and then they build kind of toy applications in rust and wasm and discover they're very small and kind of say, this is much more.
[01:13:19] Justin Cormack
I think a lot of the time, people don't understand why people's applications are so large in containers and people don't talk about it a lot.
[01:13:28] Justin Cormack
But, you know, there are often good reasons why people have multi gigabyte containers, despite the fact it seems a weird thing to do.
[01:13:40] Viktor Petersson
Often very good.
[01:13:41] Viktor Petersson
Bad reasons, too.
[01:13:42] Justin Cormack
But yes, there are bad reasons too, but those reasons are not necessarily, those reasons are not actually necessarily.
[01:13:53] Justin Cormack
They're not really about the runtime, they're about the application.
[01:13:58] Justin Cormack
And it comes back to, like, the whole conversation we have about, like, how do you build your applications?
[01:14:04] Justin Cormack
Can you use the same application?
[01:14:06] Justin Cormack
Do you have to build applications again?
[01:14:07] Justin Cormack
Do you have to build them in a particular way?
[01:14:12] Justin Cormack
But I think that like WAsm does have, you know, that I think there are some interesting things about the Wasm runtimes that are quite lightweight and look more like a, more like what people, what we thought the JVM might be going to look like back in the day, but it never quite ended up like that for reasons.
[01:14:32] Justin Cormack
The security model is much better understood now.
[01:14:38] Justin Cormack
The interface model, which is where the, you know, the security issues and the JVM were back in the day.
[01:14:47] Viktor Petersson
Yeah.
[01:14:48] Justin Cormack
And this, I mean I think that there's a lot of interesting things.
[01:14:53] Justin Cormack
I mean I think the whole, I mean it's hard, but the whole we can write code in multiple languages and interface them together and have libraries that are security isolated from each other is a really interesting area.
[01:15:14] Justin Cormack
It's kind of, it's at the moment it's very niche.
[01:15:17] Justin Cormack
I mean there was an attempt to do security isolated libraries in JavaScript, for example, and like, because, and there was a bunch of really good work on that, which actually shit.
[01:15:32] Justin Cormack
But like, because like libraries have high privilege levels right now.
[01:15:37] Justin Cormack
Like a library that's supposed to do some calculations can also access the network and exfiltrate your data.
[01:15:45] Justin Cormack
And you can't really stop this because we don't, because everything ends up in a global namespace and doesn't have least privilege.
[01:15:53] Justin Cormack
And WASM is a potential way of actually addressing that kind of issue potentially.
[01:16:03] Justin Cormack
So there's a lot of interesting stuff we've really been focusing on at the moment.
[01:16:09] Justin Cormack
Enablement of kind of build and run of WASM applications in the kind of roughly similar sort of space to where we are because that's where we've seen most interest.
[01:16:23] Justin Cormack
But it's such a diverse ecosystem that I think there's a lot of interesting paths about where adoption will happen.
[01:16:32] Justin Cormack
And it's not just going to be one thing, you know, it's not going to be one thing.
[01:16:36] Justin Cormack
And you know, I think there's like, you know, these different use cases of whereas, and we talked about it at the moment, you know, kind of, you know, extension stuff is very different from in browser stuff.
[01:16:50] Justin Cormack
And it was actually interesting, like when I worked on, when I did stuff with lure, I run the London lure meetup back in the day.
[01:16:59] Justin Cormack
And it was really interesting because again, like there were you, it was hard to have a uniform conversation around a language that was used for so many different things.
[01:17:07] Justin Cormack
And I think that wasm has the same thing, that there's a lot of different use cases and they're, and they're kind of pushing in slightly different directions, but they are, they're using a set of common tooling and they, you know, they're building this stuff out together for different use cases.
[01:17:30] Viktor Petersson
Are you more bullish on the server side of wasm to kind of eat up node js style workloads or are you mobile on the browser side of things?
[01:17:42] Justin Cormack
I actually don't like.
[01:17:43] Justin Cormack
I think it's in a way, I think the, I don't know, I think that there's a kind of thing you could get.
[01:17:53] Justin Cormack
I mean node, Washington node was kind of exciting because it was like one language for the front end and back end, and wasm potentially I think is interesting, we could do that from the other direction because it was like node was, well the one language has to be JavaScript because that's what the browser has.
[01:18:14] Justin Cormack
So the backend language now has to be JavaScript.
[01:18:18] Justin Cormack
And that was great for the JavaScript people and I got people who then adopted for everybody else, kind of bad for everyone else.
[01:18:24] Justin Cormack
And like, I mean I try, I tried to become a JavaScript person as a back end person at that time and I like, I kind of, I tried quite hard for quite a while and I decided it wasn't for me.
[01:18:40] Justin Cormack
But I think that, I think there's an interesting thing of like how much can we go the other way of like take someone who's a, a go programmer and help them ship go via Wasm into the browser so they can build, you know, more of the application.
[01:18:55] Justin Cormack
I think you can't exclusively build applications in WASM alert in the browser, although there have been some people trying to do that like I think.
[01:19:04] Viktor Petersson
So I ported like Libreoffice to Wasm and had it up and running like fully.
[01:19:08] Justin Cormack
So I mean, yeah, but there's still a bit of JavaScript.
[01:19:12] Justin Cormack
There was actually a, like a really radical proposal have an index wasm, kind of like why can't the entry point into a website p wasm rather than JavaScript?
[01:19:24] Justin Cormack
But I think there's still issues there.
[01:19:26] Justin Cormack
But you still need some, like you.
[01:19:29] Viktor Petersson
Need to invoke it somehow.
[01:19:30] Justin Cormack
Yeah, but also invoking the UI from WASM story is a bit messy in terms of it's a bunch of, but in principle I think, yeah, you could, and I think the rust community are kind of pushing that direction most because they're quite, most of the WASM communities here are rust people and they don't like JavaScript.
[01:19:53] Justin Cormack
Rust people.
[01:19:56] Viktor Petersson
I don't think you could find bigger, I mean bigger difference between programmers than rust programmers and JavaScript programmers that's probably as far apart they can get.
[01:20:06] Justin Cormack
Yeah.
[01:20:06] Justin Cormack
So I think that a lot of them are kind of pushing in some place direction.
[01:20:11] Justin Cormack
And I think I know, I mean, rice is a good language for.
[01:20:16] Justin Cormack
I mean, I think it's changed now that garbage collection in WaSm is a real thing now.
[01:20:20] Justin Cormack
But it was the case that it was a good language from the, because WaSm didn't have a GC, but now with WASM GC, I think there's like, there's a.
[01:20:34] Justin Cormack
I think the, because I think I joked a few years ago that you can write wasm in any language you like as long as it's rast.
[01:20:41] Justin Cormack
But it kind of felt like that for a while that there were actually really strong reasons why actually it was the best language to write wasm in for almost all use cases.
[01:20:54] Justin Cormack
I think that's, you know, and it was kind of accidental because it wasn't what Russ was targeting either, which is kind of interesting, but it kind of was like that.
[01:21:03] Justin Cormack
But I think that's, yeah, with Wasm GC and the maturity of the other language ecosystem tool chains to wasm and things, that's actually changed a lot in the last couple of years.
[01:21:14] Justin Cormack
Yeah, it's now much broader, but there are still, I still think that there's, I mean, I think that, you know, if you look at go, for example, like tiny go has been the go to way of getting into wasm for a long time.
[01:21:27] Justin Cormack
Just because the go runtime compiler wasm is big.
[01:21:31] Justin Cormack
They don't, they like their GC implementation, they don't want to use the upstream one.
[01:21:36] Justin Cormack
And it's become a bit, you know, I remember when, with, when cloudflare workers launched their wasm thing, like you couldn't, like Cloudflare had a very small memory allocation for workers at the, when they launched it.
[01:21:58] Justin Cormack
I think it's increased now, but like, it was like you couldn't fit the go run time into a worker because it was right.
[01:22:05] Justin Cormack
Who compiled it to wasm is too big.
[01:22:07] Justin Cormack
And they were like, well, we're gonna have a shared library kind of layer for the go runtime or whatever.
[01:22:11] Justin Cormack
We're gonna work around this kind of thing.
[01:22:13] Justin Cormack
And it was like a lot of work.
[01:22:16] Justin Cormack
So, you know, it really worked.
[01:22:17] Justin Cormack
There were these kind of barriers of like, hard to make a small wasm application in go.
[01:22:23] Justin Cormack
Tiny go filled that niche actually really well.
[01:22:26] Justin Cormack
And tiny go is a kind of fun language anyway, and quite a lot of people are using it, but it was, you know, it's kind of, you know, again, that's kind of the tool chain and kind of language ecosystem is just taking, you know, taking a long time to mature.
[01:22:44] Justin Cormack
But it's really, I mean, as I said, it's really changed over the last year or year, two years, and that's really much more mature now and it's becoming more realistic for people to experiment with.
[01:22:55] Viktor Petersson
So what's that?
[01:22:56] Viktor Petersson
Is there a docker angle here?
[01:22:57] Viktor Petersson
Like, is there going to be like a docker hub as a CDN for browser based wasm?
[01:23:08] Justin Cormack
I think, I don't know about browser based wasm.
[01:23:11] Justin Cormack
You know, for, I mean, we, because I think that the, I think that, I think we're starting with the server side because that's where the audience for Docker Hub are.
[01:23:28] Justin Cormack
The browser based wasn't people kind of come through other tooling routes at the moment but not saying never.
[01:23:37] Justin Cormack
I think that, I mean, I kind of think that one of the interesting things about wasm, although, is just that universality.
[01:23:46] Justin Cormack
It runs in the browser and on the server and that's like, I think that's a really interesting thing that's different from what came before.
[01:23:56] Justin Cormack
I mean, we kind of had that very briefly with Java applets like two decades ago.
[01:24:04] Viktor Petersson
Is over.
[01:24:05] Justin Cormack
Yeah, but I mean I think that like that, but there's, but it's actually very, like, it's actually the ecosystems are quite diverged and there are, I mean, although there are, you know, there is a community of people trying to do things that support, or rather support, you know, there's people who are supporting the web APIs on server side or on which, like for example, actually cloudflare workers is a great example of that where their core APIs are the browser APIs.
[01:24:42] Justin Cormack
And so you can mostly write browser code that works there.
[01:24:45] Justin Cormack
But again, even like there's still things that they have that are, you know, because the environment is different from the browser.
[01:24:54] Justin Cormack
The biggest one has always been like inbound socket.
[01:24:57] Justin Cormack
You can't listen to a socket in the browser and that's a core activity you do on a server.
[01:25:03] Justin Cormack
And arguably that one thing has been the thing that's kind of diverged those ecosystems in terms of APIs the most.
[01:25:12] Justin Cormack
And so I think that, and I think that the value of WASM on the web has mostly been being able to use libraries and code that was written for other, you don't want to go and rewrite some complicated rendering library or something that you've already got in c, again in JavaScript or on the web.
[01:25:38] Justin Cormack
If you can just compile it to wasm and just run it, that's great, performs well.
[01:25:45] Justin Cormack
So it's still not a kind of uniform, I just write things that run everywhere kind of world.
[01:25:53] Justin Cormack
Yeah.
[01:25:53] Justin Cormack
But we're starting to see that's the kind of, there's these bits of promise and ambition that WaSm has that are quite exciting.
[01:26:05] Viktor Petersson
Yeah, I'm super excited about WASM.
[01:26:07] Viktor Petersson
I think that could be a nice solution for a better web really.
[01:26:13] Viktor Petersson
Right.
[01:26:14] Viktor Petersson
Where we can write when a website currently is absolutely okay.
[01:26:19] Viktor Petersson
Apparently to have a website that's like 300 megs to download and then like if that's the ballpark of data we're talking about, then writing it that in WaSM, then obviously 300 megs for a rust binary compiled is a lot more than 300 megs of JavaScript, right.
[01:26:40] Justin Cormack
So.
[01:26:41] Viktor Petersson
Well, hopefully it's more optimized.
[01:26:43] Viktor Petersson
So I'm super excited about that.
[01:26:44] Viktor Petersson
Prospects from particular on that I'm less excited about the server side, more excited about the browser side, us, honest.
[01:26:50] Viktor Petersson
But yeah, Justin has been super interesting.
[01:26:54] Viktor Petersson
We found a lot of ground.
[01:26:55] Viktor Petersson
There are plenty of more things I would like to cover, but I do realize that we are kind of running up on time here, so maybe we'll do a follow up in a future episode.
[01:27:02] Viktor Petersson
There have been more content because there are plenty more on my list here I would like to cover.
[01:27:06] Justin Cormack
Cool.
[01:27:07] Justin Cormack
Christ, great to talk.
[01:27:08] Viktor Petersson
Thanks so much.
[01:27:10] Justin Cormack
Thank you.
[01:27:11] Viktor Petersson
Have a good one.
[01:27:12] Viktor Petersson
Cheers, bye.

Found an error or typo? File PR against this file or the transcript.