Recent content on Samuel Karp
containerd 2.3 is coming right around the corner, and with it we’ve made some changes to how we produce our releases. I won’t bury the lede here, starting with containerd 2.3, we now have: Annual LTS releases with a two-year support window (starting with 2.3) New releases every four months, aligned with Kubernetes Regular releases now get eight months of support Improved upgrade safety…
I’ve been interested in ambient data displays for a while. They’re pretty common in modern life: arrival/departure boards for transit or flights, traffic condition signs (“X minutes to Y” on a highway), the current floor display for an elevator, open/closed signs for businesses. Clocks are probably the oldest kind, going back to early timekeeping with sundials. My house is…
runj is an OCI runtime for FreeBSD jails. Until recently, it relied on the jail(8) command to actually set up and manage the jail in the FreeBSD kernel. It had been a to-do item on my list for a long time to migrate to directly-invoking the jail(2) family of syscalls . This is now done, but I learned some new things along the way.
runj 0.2.0 now supports the new OCI Runtime Spec 1.3.0 , which includes official FreeBSD support!
This post is part of the Lobste.rs blog carnival . A while ago I read this blog post “ An app can be a home-cooked meal ”. It really resonated with me. Later, I realized it’s because I’ve been doing this for a while, just without a name. While I don’t have a ton of home-cooked apps, I have written a few over the years for some different specific reasons.
containerd 2.1 is here! Delivering new features and improvements, this release also launches our new six-month cadence – just half a year after containerd 2.0 .
I’ll be speaking at KubeCon EU 2025 in London tomorrow! As I like to do, here’s what I’m thinking of attending at the conference this week.
Welcome to day 4 of our series on containerd internals ! Container images are the mechanism that we use to capture a container’s filesystem, distribute it to nodes that will eventually run containers, and ensure that containers start from a known-identical configuration. In many ways, images are the defining characteristic of a containerized system; they are the interaction point for users…
Welcome to day 3 of our series on containerd internals ! This post will cover ctr , a command-line tool for containerd.
Derek already announced this on his blog , but I figured I can post here too. This month, a few of the containerd maintainers plan to write a series of blog posts about containerd internals that we think are interesting and not well-known. Our hope through this series is that you’ll find some useful takeaways in operating containerd (and understanding how to debug), integrating with…
The containerd maintainers (including me) are happy to announce the release of containerd 2.0! This is the first major release of containerd since 1.0 was released in 2017, and represents a commitment both to the evolution of the containerd project and continued investment in stability, reliability, and efficiency.
containerd 2.0 will be the first new major release of containerd since the initial stable release of 1.0 in December, 2017. After six years of iteration, development, and refinement, 2.0 will encapsulate the learning we’ve had building and supporting containerd at large scale (and as the default container runtime for a number of managed container offerings). With that, 2.0 brings some major…
I’ll be speaking at KubeCon+CloudNativeCon EU 2023 in Amsterdam next week. I’d love it if you came to see me! I tried this before with SCALE 18x and shared my expected schedule, and I want to try sharing it again! If you feel like you want to join me or meet up during the conference, please reach out and let me know.
It’s been a bit since I’ve written on this blog about anything other than containers, but I’ve been reading a lot of new (to me) Go code lately and wanted to discuss unit testing. I’m pretty firmly in the camp that testing is critical for building reliable, maintainable systems, and unit testing is an important component of that (though I do not believe it is sufficient on…
One of the really nice things about Docker containers is that the defaults mostly just work. One of those defaults is networking; docker run gives you a perfectly serviceable network experience with containers able to access the Internet, access each other, and expose services. runj is a much lower-level tool than Docker, so that sort of out-of-the-box network experience wouldn’t be…
One of the core use-cases for modern container systems is to run networked workloads, often across a group of machines deployed in a cluster. A variety of different networking models exist, but until now no networking at all was possible with runj . Now, after this change , runj has its first networking capability! The functionality that pull request enable jails to share the IPv4 network stack…
In March, I open-sourced runj, an experimental OCI-compatible runtime for FreeBSD jails . I started runj in order to teach myself more about FreeBSD in general and jails in particular, and the initial contribution policy I set was designed to give me the space to learn at my own pace. However, as I wrote in that first blog post, the amount of attention runj received on its first day really…
This past September, I joined the containerd project as a security advisor . In March, I increased my involvement as a reviewer . And this week, I joined the Moby project as a maintainer . My colleague Kazuyoshi Kato wrote about joining containerd on his blog and I’ve been wanting to do that too.
containerd 1.5.0 was released today and now works on a new operating system: FreeBSD! This new release includes a series of patches ( 1 , 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 10 ) which allow containerd to build, enable the native and zfs snapshotters, and use a compatible runtime like runj . I’m really excited about this! It’s awesome that only a small amount of work was needed to make…
Today, I open-sourced runj , a new experimental, proof-of-concept OCI-compatible runtime for FreeBSD jails. For the past 6.5 years I’ve been working on Linux containers, but never really had much experience with FreeBSD jails. runj (pronounced “run jay”) is a vehicle for me to learn more about FreeBSD in general and jails in particular. With my position on the Technical Oversight…