Chaos Computer Club - archive feed

oomd is a userspace out-of-memory killer. This talk covers past, present, and future development along with possible plans for systemd integration. Running out of memory on a host is a particularly nasty scenario. In the Linux kernel, if memory is being overcommitted, it results in the kernel out-of-memory (OOM) killer kicking in. Perhaps surprisingly, the kernel does not often handle this well. oomd builds on top of recent kernel development to effectively implement OOM killing in userspace. This results in a faster, more predictable, and more accurate handling of OOM scenarios. oomd has gained a number of new features and interesting deployments in the last year. The most notable feature is a complete redesign of the control plane which enables arbitrary but "gotcha"-free configurations. In this talk, Daniel Xu will cover past, present, future, and path-not-taken development plans along with experiences gained from overseeing large deployments of oomd. Anita Zhang will close the talk with a discussion of why oomd would be a great addition to systemd. about this event: https://cfp.all-systems-go.io/ASG2019/talk/DQX3DH/

Traditionally processes are identified globally via process identifiers (PIDs). Due to how pid allocation works the kernel is free to recycle PIDs once a process has been reaped. As such, PIDs do not allow another process to maintain a private, stable reference on a process. On systems under pressure it is thus possible that a PID is recycled without other (non-parent) processes being aware of it. This becomes rather problematic when (non-parent) processes are in charge of managing other processes as is the case for system managers or userspace implementations of OOM killers. Over the last months we have been working on solving these and other problems by introducing pidfds – process file descriptors. Among other nice properties, the allow callers to maintain a private, stable reference on a process. In this talk we will look at challenges we faced and the different approaches people pushed for. We will see what already has been implement and pushed upstream, look into various implementation details and outline what we have planned for the future. about this event: https://cfp.all-systems-go.io/ASG2019/talk/TPS8TS/

Closing of All Systems Go! 2019 about this event: https://cfp.all-systems-go.io/ASG2019/talk/WB9TFT/

Baden-Württemberg’s Ministry of Transport aims at developing regional mobility data towards an open and interoperable framework for new mobility solutions - as part of a sustainable traffic system, realising efficiency, climate protection and living quality. On the way there, fair chances for innovation are key: Not only for better results but also for a the involvement of most different societal actors. Cross-thinking and open innovation are corner stones in such a process. Baden-Württemberg’s Ministry of Transport aims at developing regional mobility data towards an open and interoperable framework for new mobility solutions - as part of a sustainable traffic system, realising efficiency, climate protection and living quality. On the way there, fair chances for innovation are key: Not only for better results but also for a the involvement of most different societal actors. Cross-thinking and open innovation are corner stones in such a process. The keynote speech develops the need for open innovation against the background of the concept of sustainable mobility. It also gives insight into participation in innovation projects and the use of Open Street Map as a sustainable and non-discriminatory digital basis for new mobility. about this event: https://pretalx.com/sotm2019/talk/TWARHC/

Wer sich gegen Überwachung von Kommunikation wehren will, kann sich entweder kryptographischer oder steganographischer Methoden bedienen. Der Vortrag diskutiert die Möglichkeiten und Grenzen der Enttarnung steganographischer Kommunikation im Medium natürlicher Sprachen. Steganographische Kommunikation ist die Kunst des Versendens von Nachrichten über einen offenen Kanal, so dass niemand außer den intendierten Empfänger/innen überhaupt von der Existenz der Nachricht weiß, geschweige denn ihren Inhalt dekodieren kann. Dies unterscheidet sie von der Kryptographie, bei der die Existenz der verborgenen Botschaft prinzipiell wahrnehmbar ist. Häufig werden Bilder als Trägermedien steganographischer Botschaften gewählt. Doch ebenso häufig ist das Verbergen von Nachrichten in unscheinbaren natürlichsprachlichen Nachrichten, etwa wenn Jihadisten Anleitungen zum Bombenbau als Kochrezepte tarnen. Nach einem Überblick über unterschiedliche Spielarten der klandestinen Kommunikation diskutiert der Vortrag die folgenden Fragen: - Was sind typische Merkmale steganographischer Kommunikation im Medium natürlicher Sprachen? - Welche Ansätze zu ihrer Enttarnung gibt es? - Lassen sich überhaupt zuverlässige maschinelle Methoden für die Enttarnung entwickeln? - Mit welchen Maßnahmen kann man eine Enttarnung schwieriger machen? about this event: https://datenspuren.de/2019/fahrplan/events/10373.html

How to run clusters for GPU computing based blockchain hashing diskless on cost effective commodity hardware. Running the nodes of a cluster diskless is quite common in HPC environments. The challenges to run diskless in the context of blockchain hashing for cryptocurrencies are different. There are constraints like to run sufficiently on hundreds of machines with commodity 1 Gbit/s network hardware or the modest RAM size of 4 Gigabyte. This talk will provide insights in the technical approaches that made it possible to run GPU-clusters for blockchain hashing diskless and provide an outlook to other potential GPU-based use cases beyond blockchain hashing. I will discuss like how some early userspace trickery and state of the art RAM compression is used. How to handle the modest given RAM size and how a neat toolset based on container-runtimes helps to easily build boot images and plug-in packages. And how to use plug-in packages as an elegant way for adding further software like proprietary GPU drivers to the computing nodes of the clusters. about this event: https://cfp.all-systems-go.io/ASG2019/talk/XNU7NE/

Ever experienced a broken system by simply upgrading packages? No more! This talk introduces the purely functional package manager Nix and the advancements all software distributions can benefit from - with some of those already implemented in mainstream package managers like snap. about this event: https://cfp.all-systems-go.io/ASG2019/talk/AD8VYE/

Have you wondered if a certain dataset can be used for OSM? What does it mean for a license to be “compatible” with OSM and ODbL? This talk will give pointers on where to look for information, common compatibility issues, and best practices for presenting a license to LWG for help review. The talk would go over tips for mappers to help them think through potential license issues for imports. The tips would cover all the major steps for determining compatibility: identifying the data's license, check OSM-related history, identifying/resolving compatibility issues, and achieving community consensus. This talk will be useful for any mapper with compatibility questions or who is interested in importing open data into OSM. Outline: - Sources of information about the license - Website (page from which data is downloaded, about page, FAQ, TOS) - Accompanying file (e.g., README, LICENSE) - Terms, credits, etc. - Metadata - Information about licenses/dataset previously evaluated for use with OSM - Imports wiki page - License compatibility page - forums/lists - Common compatibility issues - Attribution - Use restrictions (e.g., noncommercial/personal/research) - Privacy - Sharealike - Revocability - Indemnity - Local laws - Things that are usually not a problem (disclaimer of warranty/accuracy, trademarks, governing law, ) - Making it easy for others to read a license - A note about translation - Link everything! - Include all information about the source - Where to obtain - Description of where/who the data is from - Include all information about the license - What the license is - Any info about permitted uses - Any prior OSM discussion - Flag common compatibility issues and why you think they are or are not issues - Quote the relevant sections of the license (include the section number!) - Explain your reasoning - If the license references other laws/regulations/terms, look them up and link to and quote from them. about this event: https://pretalx.com/sotm2019/talk/UN33XK/

Come and learn about packit: tooling which enables you to integrate your upstream project into Fedora linux. Imagine a world where Linux distributions provide feedback about using your upstream project back to the project. So that when you are working on a change, you'll know right away: * if it builds or a project Z changed API again * if it works or that your change doesn't work with older systemd which this distro has * or if your change breaks components which depend on your project That's not all! If we have a service which can do all of this, why not propose a new upstream release automatically as a change to the linux distro once the release is done? Wouldn't it be awesome if upstream developers could control and track in which version their software is in Fedora 30? Sounds interesting? Please join us in this session and learn more about the packit tool and the packit service: tooling which makes your dream come true. about this event: https://cfp.all-systems-go.io/ASG2019/talk/US8XA9/

Lessons learned operating thousands of stateful production clusters on top of Fedora and systemd-nspawn. Aiven is a cloud data platform operating thousands of production clusters on top of different cloud infrastructure providers (e.g. AWS, GCP). We offer the latest open source database & streaming engines to our users around the world, and implement most of our platform using the latest open source software including Fedora and systemd-nspawn. We wanted to base our platform on a fast moving Linux distribution like Fedora to gain quick access to new technology and avoid having to backport a lot of things. Fast moving distributions are typically not supported for a long time, but implementing an immutable infrastructure where deployed machines are not touched afterwards makes it possible to use them in production. In this talk we’ll share the details of our architecture and the lessons we’ve learned as well as problems we’ve faced over the years operating hundreds of thousands of virtual machines and containers with it on top of six different public clouds. about this event: https://cfp.all-systems-go.io/ASG2019/talk/RLCDFS/

BuildStream is used to build Freedesktop SDK for different deployment systems allowing applications based on it to be distributed at once to multiple systems. Flatpak, Snapd and Docker are similar. They are all used for deployment and applications use their own runtime. Each system has its own tools for development. Flatpak uses Flatpak Builder. Snapd uses Snapcraft. Docker development is based on `Dockerfile`s. Freedesktop SDK was developed to be the runtime of Flatpak. It used to be partly built with Flatpak Builder. It has since changed to be built with a deployment system agnostic tool: BuildStream. For this reason we can export the Freedesktop SDK to multiple formats. We will show how it is possible to build an application for the three systems at once. about this event: https://cfp.all-systems-go.io/ASG2019/talk/CF7FSX/

Dieser Vortrag gibt einen Überblick wie Datenschutz in der Praxis umgesetzt werden kann. about this event: https://datenspuren.de/2019/fahrplan/events/10467.html

Karen M. Sandler is the executive director of the Software Freedom Conservancy, which is the nonprofit home of dozens of free and open source software projects including Git, Etherpad, QEMU, Selenium and Inkscape (to name a few. She is known as a cyborg lawyer for her advocacy for free software as a life-or-death issue, particularly in relation to the software on medical devices. Prior to joining Conservancy, she was the executive director of the GNOME Foundation. Before that, she was the general counsel of the Software Freedom Law Center. Karen co-organizes Outreachy, the award-winning outreach program for people who are subject to systemic bias and underrepresented in tech. Karen is an adjunct Lecturer-In-Law at Columbia Law School and a Visiting Scholar at UC Santa Cruz. She is the recipient of the Free Software Foundation's 2017 Award for the Advancement of Free Software as well as an O'Reilly Open Source Award. Karen M. Sandler is the executive director of the Software Freedom Conservancy, which is the nonprofit home of dozens of free and open source software projects including Git, Etherpad, QEMU, Selenium and Inkscape (to name a few. She is known as a cyborg lawyer for her advocacy for free software as a life-or-death issue, particularly in relation to the software on medical devices. Prior to joining Conservancy, she was the executive director of the GNOME Foundation. Before that, she was the general counsel of the Software Freedom Law Center. Karen co-organizes Outreachy, the award-winning outreach program for people who are subject to systemic bias and underrepresented in tech. Karen is an adjunct Lecturer-In-Law at Columbia Law School and a Visiting Scholar at UC Santa Cruz. She is the recipient of the Free Software Foundation's 2017 Award for the Advancement of Free Software as well as an O'Reilly Open Source Award. about this event: https://pretalx.com/sotm2019/talk/VC8ESD/

Opening Session Opening Session about this event: https://pretalx.com/sotm2019/talk/HFET3E/

Over the last few months, we’ve been building an offline first field mapping tool for the OpenStreetMap ecosystem called Observe. Observe makes field surveying, and verification easy for mappers, and works on iOS and Android. My talk will cover how Observe integrates with mapping workflows and helps improve OSM data from the field. I'll also touch upon fundamentals of building Observe and our assumptions on field mapping. Field verification is an important part of keeping OSM data accurate. So far, field mapping exercises are largely manual, cumbersome, or requires internet connectivity. OpenStreetMap has an active mobile editing ecosystem, but they don't offer the same editing experience as iD for beginners. Most often mapping campaigns need an equally good tool that allows edits from the field to verify existing data and improve data quality. Observe is a cross-platform, offline-first field mapping tool for OpenStreetMap, perhaps the first of its kind. Our primary goal was to build an application that makes field observation easy, and provide comparable experience to iD on Android and iOS — with some success. Observe focuses on browsing OSM data, and allows users to add new points, or verify existing information. The edits made offline are stored on the phone, and uploaded when the mapper goes online. Observe is a product of several iterations of user research and a couple of years of conceptualization. The talk will: - introduce motivations behind building Observe - look at some specific use cases in campaign management - share internals of building the application - discuss challenges around offline editing and our approach to conflict resolution - gather feedback and launch a developer edition of the application about this event: https://pretalx.com/sotm2019/talk/39SBT8/

Building forward from our work presented last year at State of the Map, we have created a system to assist mappers via machine learned models. In addition, we have built an automated ingestion framework for OSM data at scale that allows us to selectively update parts of the map instead of doing a full snapshot change. Building forward from our work on __Mobius Logical Changesets__ (presented last year at SotM US 2018), we have created an __automated ingestion and integrity framework__ for OSM data that allows us to __selectively__ update parts of the map instead of doing a full snapshot change all at once. Decomposing a large set of changes in this way gives us the flexibility to __rapidly ingest__ our own additions to the map, focus on __geographical areas of importance__ to downstream products, and allows us to __quickly apply hotfixes__ whenever egregious problems do arise. With millions of tiny changes happening every week, we have created a system that is built on __per-feature approval and preprocessing__, that allows us to ingest changes at scale, while creating rules to __automatically process logical changesets and enforce integrity constraints (e.g. anti-vandalism, anti-profanity etc.).__ Due to the contextual nature of some of the changes in OpenStreetMap, the system combines Human Approval, necessary for highly visible features such as names of large administrative areas, with __Automated AI/ML-based approval__: for example, using __computer vision techniques__ to reconcile newly created features against __satellite imagery ground truth__, or applying __NLP techniques__ to determine whether other user-visible string changes are sensible and valid. These components are combined to create a __continuous ingest-validate-deploy cycle__ for OSM map data. about this event: https://pretalx.com/sotm2019/talk/3WQKAX/

Exploring the visualization of OSM data outside its digital form and how it can be applied to everyday object from book cover to wallpaper. This talk will discuss on how to elevate OSM data beyond maps, exploring its potential in data-as-decor on both public and private space. The talk will describe the tools and workflow on how to create these product as well as its strengths and weakness. When people describe OSM data, usually it will revolve around its structures, type and geometry. And normally the data will be transform into maps, both in printed and digital format. Yet, we believe that it should not stay that way. Several efforts have been made to transform OSM data into everyday product, from simple things such as book cover, t-shirt design to wallpaper or wall paintings. Its open data license enables vast array of customization into product that some may consider as a work of art without constrained by cost and licensing. We will showcase what have been created by OSM community all around the world from OSM data in everyday objects and several products that we created ourselves for event merchandises (book cover, key chains, sticker, mouse pad, goody bag) and office decoration. For the product that we create we will explain the tools (software and hardware), options for media used and what is the workflow to create such product so that it will inspire the audience to create their own product for their area of interest as well as building geographic identity through design. We want to proliferate OSM data and transform its data beyond maps and explore its potential in non-conventional design. about this event: https://pretalx.com/sotm2019/talk/799WZF/

Currently everyone uses the same seccomp rules for running their containers. This tool allows us to generate seccomp rules based on what the container actually requires and allows us to lock down the container. We had a GSOC student this summer who instrumented podman to allow it to run containers and then genrate the seccomp rules for the container based on the syscalls that the container actually made. Once you have this newly generate seccomp file and are satisfied that you have thoroughly tested the container, you can run the container inproduction using the seccomp.json file. This talk will explain how the tool works and demonstrate it in action. about this event: https://cfp.all-systems-go.io/ASG2019/talk/ACEWHG/

Lightning Talks ## Uses of native language in OSM <i>S M Sawan Shariar</i> <p>Native Language uses in OSM is very important for any country specially in developing country.</p> ## SolidaryCityMap <i>OpenDEM</i> <p>The aim of this project is to visualize places where you can participate in city life without papers and / or money.</p> ## OpenLitterMap - Open Data on Plastic Pollution with Blockchain Rewards (Littercoin) <i>Seán Lynch</i> <p>Open litter mapping is a new and largely unexplored field of Geographic Information Science. During this talk you will learn about OpenLitterMap, how to use it, get some ideas about making relationships between OSM and OLM data, and learn how the OLM data can be used to improve OSM.</p> ## Map2endFGM <i>Janet Chapman</i> <p>Mapping to fight Female Genital Mutilation in Tanzania by training first time rural women to map their communities and report gender based violence as part of WomenConnect</p> about this event: https://pretalx.com/sotm2019/talk/FLPYCN/

The Desktop GIS QGIS offers many ways to work with OpenStreetMap data. This presentation will give an overview on how you can use OpenStreetMap data with QGIS. The Desktop GIS QGIS (https://qgis.org) is Open Source software and an OSGeo project (https://osgeo.org). QGIS offers many possibilities to work with different sort of data - vector, raster & services. You can visualize, style, edit and process data and your have a great variety of additional functionality via Python plugins. QGIS offers many ways to work with OpenStreetMap data. Most of the possibilities can be added via plugins. You can download OSM data directly - complete data or only a subset via the Overpass API. You can use a search module for OSM data. Load OSM data as OGC WMS or as background. You can create great 3D maps with your OSM data. You can use a routing plugin and offer a routing on your OSM data. You can create field papers and create great print layouts. You can analyze your data and process it. You can publish your OSM data as an OGC WMS or WFS with QGIS Server. QGIS is a great Desktop QGIS and even more. This presentation will give an overview on how you can use OpenStreetMap data with QGIS and will demonstrate it via use cases. QGIS is written in C++ and uses the Qt library. QGIS is a community project with many people from all over the world involved. about this event: https://pretalx.com/sotm2019/talk/JNXE9Q/

Despite of it's old age, ksh still remains one of the most popular shells. In 2013, David Korn and others who worked on ksh were laid off from AT&T Bell Labs. This lead to speculations of death of ksh. In 2017, Siteshwar Vashisht and Kurtis Rader resumed it's development on GitHub. This talk will be about what makes ksh so challenging to maintain and how new developers are trying to revive it. about this event: https://cfp.all-systems-go.io/ASG2019/talk/CV9R3N/

The boot loader specification defines a generic drop-in based solution for defining boot targets. sd-boot is a boot loader for UEFI systems, and included in the systemd source tree. In this talk we’ll have a closer look on the what, the why and the how of the specification and the boot loader. about this event: https://cfp.all-systems-go.io/ASG2019/talk/HFJMLU/

We will present [Yomi](https://github.com/openSUSE/yomi), a new proposal for installing Linux using [SaltStack](https://github.com/saltstack/salt). This installer is designed to be used in heterogeneous clusters, where you need a bit of intelligence during the installation and be integrated as one more step in the provisioning process. [Yomi](https://github.com/openSUSE/yomi) is a new kind of installer for the [open]SUSE family based on SaltStack and independent of AutoYaST. The goal of this project is to make the installation of Linux (currently openSUSE) when: * You have a cluster of heterogeneous nodes (different profiles of memory, storage, CPU and network configurations) * The installation needs to be unattended * The installer needs to make decisions based on local profiles and external data * The installation process needs to be integrated, as one step more, into a more complicated provisioning workflow. The dependencies of Yomi are minimal, as only Salt and a very few CLI tools are required, which make it ideal to be deployed a booted from PXE Boot. about this event: https://cfp.all-systems-go.io/ASG2019/talk/KDEYJZ/

Can you actually walk through or fly over a 3D scene of live OSM data using a VR headset - and if so, can this be done in a way that easily transforms to a view on a normal computer (or mobile) screen? The answers are "Yes" and "Yes", and this talk will show how this can be done with relatively simple code, and just inside a web browser! Mixed Reality (XR), i.e. Virtual and Augmented Reality, opens up new possibilities for 3D visualizations of OpenStreetMap data. With WebXR and Mozilla's A-Frame library, it's really simple to create cross-device XR experiences running right in the browser with very little code, and scaling well from mobile via laptop/desktop to fully immersive VR headset experiences. VR Map is a demo that brings all that together and allows you to walk or "fly" through a virtual model of the real world courtesy of live OSM data from the Overpass API. The talk will describe WebXR as Mixed Reality APIs for the browser and A-Frame as Mozilla's library to make it really simple to build WebXR scenes. Then, it will dive into how those technologies were used together with live OSM data to create the VR Map demo and show how it enables people to move through virtual models built from that real-world data. This will include a dive into an actual live demo, and into the HTML+JavaScript code used to create this experience. Through all that, it hopefully will show an interesting new perspective on OpenStreetMap - and hopefully inspire developers to build similar experiences. about this event: https://pretalx.com/sotm2019/talk/9TMRYN/

Due to virtual memory and optimistic caching strategies, true memory consumption of an application, and true utilization of a system's RAM, are mostly unknowns on modern operating systems. This has always made memory provisioning a tough and error-prone trial-and-error task, but it's aggravated with containerization, where the stated goal is thinner margins and higher resource efficiency. Senpai is a userspace tool that harnesses recently developed Linux kernel features to automatically shrink cgroups to their smallest possible memory size without notably affecting the performance of the contained applications. This talk goes over the motivation to develop senpai, how it works, and success stories from the Facebook fleet. about this event: https://cfp.all-systems-go.io/ASG2019/talk/TCBLRG/

During development and testing it is often needed to test different kernels or run various sets of unit tests quickly. With lrun it is possible to do exactly that. It utilizes existing technology including UML, KVM and Namespaces to facility different environments. It has been in active use for testing Bluetooth and Wi-Fi features on Linux and can be easily extended to other technologies in the future. This presentation will introduce lrun and its design. It will also show demos of its current use cases. about this event: https://cfp.all-systems-go.io/ASG2019/talk/N8YRKX/

Get to know the Board and the Working Groups. Together, we run the OSMF. Let's use the SotM to have a real face to face meeting. The public is invited to join the conversation too. SotM is about the community meeting the community. But we don't always seek out everyone we would like to talk to. So let's use this space to make sure as many members of the working groups and the board get to know each other as people and not just online text. All working group and board members are invited on the stage and can discuss anything. The public can also ask questions. Feel free to suggest some agenda items to joost -at- osmfoundation.org about this event: https://pretalx.com/sotm2019/talk/9MR9QK/

Testing the effectiveness of Kubernetes Network Policies can be done in different approaches. In this talk we will show you the benefits and drawbacks of different approaches and what solution we finally chose. Probably everybody who uses Kubernetes in a productive environment with multiple users possibly has looked at policies. Often the operators of the cluster(s) just trust the policies but in some cases it might be useful to control if the policies actually have taken action and often there are just to many Policies in the cluster setup to manually test them all (and obviously you don’t want to do this). Testing the effectiveness of the Network Policies can be done in different approaches. In this talk we will show you the benefits and drawbacks of different approaches and what solution we finally chose. Also we will show you some other tools and how they complement our solution. As a takeaway you will get an overview of different testing strategies for policies, as well as understanding challenges in testing policies in general and the Kubernetes ecosystem. We will get a feeling that it’s not always the best idea to just trust other plugins to implement the policies correctly. Our solution is open-sourced under https://github.com/inovex/illuminatio/ about this event: https://cfp.all-systems-go.io/ASG2019/talk/QXMUUW/

Eine kurze Einführung in Qubes-OS - einem vernünftig sicherem Betriebssystem - und ein Erfahrungsbericht über die private Nutzung des selbigen. Der Vortrag beschreibt die Herausforderungen mit klassischen Betriebssystemen und die Gründe für Qubes OS. Es folgt ein Überblick über die Architektur und ein paar Live-Beispiele. Zum Abschluss gibt es noch ein paar Informationen aus meiner Erfahrung mit Qubes OS. about this event: https://datenspuren.de/2019/fahrplan/events/10456.html

Zstandard (zstd) is a new lossless compression algorithm with a very attractive compression rate and performance. In production environments it comes with some quantifiable benefits but also with some surprising issues. about this event: https://cfp.all-systems-go.io/ASG2019/talk/DG3YDE/

Tilo Jung, Stefan Schulz und Hans Jessen kommen nach Dresden und machen den zweiten A!Live außerhalb Berlins. https://aufwachen-podcast.de/termine/alive-in-dresden/ about this event: https://datenspuren.de/2019/fahrplan/events/10470.html

In this talk, I'll go through my efforts to revamp libcontainer's systemd driver, in particular to support the unified cgroup hierarchy. libcontainer is part of runc (opencontainers/runc in GitHub) and is used by the Docker and containerd ecosystem to spawn containers. This work is trying to bridge the gap between the Docker/containerd/Kubernetes ecosystem and cgroup2 through the unified hierarchy, using systemd as an authoritative container manager. I'll also touch on alternative approaches (such as crun and systemd-nspawn) and briefly talk about the OCI standard and the need for it to evolve to properly support cgroup2 semantics. about this event: https://cfp.all-systems-go.io/ASG2019/talk/YPU3HL/

The primary focus is to gather feedback from systemd community regarding ongoing and future work to introduce custom cgroup-bpf programs to systemd. The motivation is to give a user a capability to attach their own cgroup-bpf programs to systemd containers. This is a continuation of <a href="https://github.com/systemd/systemd/issues/10227" title="discussion"> started at ASG2018 and followed by <a href="https://github.com/systemd/systemd/pull/12151" title="PR12151"> and <a href="https://github.com/systemd/systemd/pull/12419" title="PR12419">. Currently systemd utilizes BPF macro-assembly which is poorly extendable and maintainable, so the 1st iteration would be introducing `libbpf` library to systemd. The first attempt was made and it raised valid questions about `libbpf` testability and dependencies it introduces. We’d like to address that. Another topic of focus may be implementation details, such as how to store libbpf programs: either as bytecode or as restricted C which compiles with the rest of systemd. For attendees with no context a brief intro to eBPF will be made including new initiatives which may be of use to systemd, e.g. “Compile once, run everywhere”. Since this is ongoing work the agenda may vary depending on activity in PRs. about this event: https://cfp.all-systems-go.io/ASG2019/talk/M8DVWG/

Atomic Updates and user modified configuration files in /etc often lead to hard to resolve conflicts. In this talk, I want to show the most common and biggest problems and possible solutions. More and more Linux Distributors have a Distribution using atomic updates to update the system. They all have the problem of updating the files in /etc, as an admin could do changes after the update but before the reboot to activate the updates. But everybody come up with another solution which solves their usecase, but is not generic useable. Additional there is the "Factory Reset" of systemd, which no big distribution has really fully implemented today. A unique handling of /etc for atomic updates could also help to convince upstream developers to add support to their applications, while currently they hesitate to add distribution specific patches and support. During this talk, I will describe the different areas of problems and possible solutions. The goal is to provide a concept working for all Linux Distributors (like the FHS). My dream is, that no package installs anything in /etc, it should only contain changes made by the system administrator or configuration files managed by the system administrator. For some problems, it would be already enough today if Linux distributors would adjust the configuration of applications or use all features of them. Other requires minimal to intrusive changes to packages, and for the last kind complete new concepts are necessary. about this event: https://cfp.all-systems-go.io/ASG2019/talk/KYTCJV/

The difficult task to checkpoint and restore a process is used in many container runtimes to implement container live migration. This talk will give details how CRIU is able to checkpoint and restore processes, how it is integrated in different container runtimes and which optimizations CRIU offers to decrease the downtime during container migration. In this talk I want to provide details how CRIU checkpoints and restores a process. Starting from ptrace() to pause the process, how parasite code is injected into the process to checkpoint the process from its own address space. How CRIU transforms itself to the restored process during restore. How SELinux and seccomp is restored. I also want to give an overview how CRIU uses userfaultfd for lazy migration and dirty page tracking for pre-copy migration. I want to end this talk with an overview about how CRIU is integrated in different container runtimes to implement container live migration. about this event: https://cfp.all-systems-go.io/ASG2019/talk/E88Z7V/

Presenting [traceloop](https://github.com/kinvolk/traceloop), a “time travel” tracing tool to trace system calls in cgroups using BPF and overwritable ring buffers. Many people use the “strace” tool to synchronously trace system calls using ptrace. [Traceloop](https://github.com/kinvolk/traceloop) similarly traces system calls but asynchronously in the background, using BPF and tracing per cgroup. I’ll show how it can be integrated with systemd and with Kubernetes via [Inspektor Gadget](https://github.com/kinvolk/inspektor-gadget). Traceloop's traces are recorded in a fast, in-memory, overwritable ring buffer like a flight recorder. As opposed to “strace”, the tracing could be permanently enabled on systemd services or Kubernetes pods and inspected in case of a crash. This is like a always-on “strace in the past”. Traceloop uses BPF through the gobpf library. Several new features have been added in gobpf for the needs of traceloop: support for overwritable ring buffers and swapping buffers when the userspace utility dumps the buffer. https://github.com/kinvolk/traceloop https://github.com/kinvolk/inspektor-gadget https://github.com/iovisor/gobpf Slides: https://docs.google.com/presentation/d/1zIZUrTrD7FkS9pHnWz87ZmoLTrO1g9-J_lDMD7E5kdo/edit about this event: https://cfp.all-systems-go.io/ASG2019/talk/98A9LW/

Using RPMs can be very advantageous during development of systemd on Fedora. In order to make that viable, we need to build them from a git checkout and have the ability to use incremental builds. I will explore tooling I've been using and building to use RPMs during systemd development. I'll quickly cover the motivation and advantages while I manage to build one during a lightning demo. about this event: https://cfp.all-systems-go.io/ASG2019/talk/JM7GDN/

How can we build hostile and untrusted code in containers? There are many options available, but not all of them are as safe as they claim to be... Rootless container image builds (as distinct from rootless container runtimes) have crept ever closer with orca-build, BuildKit, and img proving the concept. They are desperately needed: a build pipeline with an exposed Docker socket can be used by a malicious actor to escalate privilege - and is probably a backdoor into most Kubernetes-based CI build farms. With a slew of new rootless tooling emerging including Red Hat’s buildah, Google’s Kaniko, and Uber’s Makisu, we will see build systems that support building untrusted Dockerfiles? How are traditional build and packaging requirements like reproducibility and hermetic isolation being approached? In this talk we: - Detail attacks on container image builds - Compare the strengths and weaknesses of modern container build tooling - Chart the history and future of container build projects - Explore the safety of untrusted builds about this event: https://cfp.all-systems-go.io/ASG2019/talk/PVYETJ/

Whether to support users, ensure their security, or meet compliance goals, organizations need to deploy monitoring of their desktop machines. Yet, many approaches overreach by effectively being rootkits. In this presentation, we'll examine: * What data a monitoring system needs to collect * Where the data we need lives on a modern Linux desktop * Which data sources expose sandbox-friendly API access * Sandboxing the monitoring daemon itself about this event: https://cfp.all-systems-go.io/ASG2019/talk/3ZKVWF/

Learn how a Service Mesh can secure your bare-metal (non-virtualized) workloads quickly without any code modifications to improve your security posture. Zero Trust is an information security mantra to not implicitly trust any the underlying infrastructure (hardware, network, software, etc). For many organizations, this extends into the cloud where this philosophy is applied to workloads running in public, virtualized clouds. We'll be taking this philosophy to protect an insecure application, the Fortune Cookie Micro Service, running atop a bare metal cloud with a Service Mesh to provide authentication and encryption of data in motion without the complexities of virtualization or containerization. This walkthrough uses all open source software (Terraform for the deployment atop the Packet bare metal cloud and Consul for the service mesh) atop Ubuntu physical nodes. about this event: https://cfp.all-systems-go.io/ASG2019/talk/H3YZZM/

GNU poke is a new interactive editor for binary data. Not limited to editing basic entities such as bits and bytes, it provides a full-fledged procedural, interactive programming language designed to describe data structures and to operate on them. GNU poke is a new interactive editor for binary data. Not limited to editing basic entities such as bits and bytes, it provides a full-fledged procedural, interactive programming language designed to describe data structures and to operate on them. Once a user has defined a structure for binary data (usually matching some file format) she can search, inspect, create, shuffle and modify abstract entities such as ELF relocations, MP3 tags, DWARF expressions, partition table entries, and so on, with primitives resembling simple editing of bits and bytes. The program comes with a library of already written descriptions (or "pickles" in poke parlance) for many binary formats. GNU poke is useful in many domains. It is very well suited to aid in the development of programs that operate on binary files, such as assemblers and linkers. This was in fact the primary inspiration that brought me to write it: easily injecting flaws into ELF files in order to reproduce toolchain bugs. Also, due to its flexibility, poke is also very useful for reverse engineering, where the real structure of the data being edited is discovered by experiment, interactively. It is also good for the fast development of prototypes for programs like linkers, compressors or filters, and it provides a convenient foundation to write other utilities such as diff and patch tools for binary files. This talk (unlike Gaul) is divided into four parts. First I will introduce the program and show what it does: from simple bits/bytes editing to user-defined structures. Then I will show some of the internals, and how poke is implemented. The third block will cover the way of using Poke to describe user data, which is to say the art of writing "pickles". The presentation ends with a status of the project, a call for hackers, and a hint at future works. about this event: https://cfp.all-systems-go.io/ASG2019/talk/BKXVJQ/

How Endless are implementing time-limited scopes in systemd, using that to implement time-limited login sessions, and then using that to implement parental controls on the desktop. about this event: https://cfp.all-systems-go.io/ASG2019/talk/8RB73U/