Red Hat has expanded its partnership with Google Cloud in a bid to supercharge legacy infrastructure modernization and cloud migration.

As part of the deal, Red Hat OpenShift will now be integrated with the Google Cloud console, making life easier during onboarding and when managing workloads alongside Google's own native compute.

Similarly, Red Hat said OpenShift Virtualization is now available on Red Hat OpenShift Dedicated on Google Cloud, letting customers use traditional virtual machines (VMs) and modern containers in the same place.

“Red Hat’s hybrid cloud vision is built on consistency – the ability to run any workload, anywhere, with the same operational model," said Mike Barrett, vice president and general manager of Hybrid Cloud Platforms at Red Hat.

Red Hat OpenShift on Google Cloud Console

The integration of Red Hat OpenShift with Google Cloud console will help streamline workload optimization on the platform, the company said, and simplify onboarding processes.

"Red Hat OpenShift Dedicated users can natively validate Google Cloud prerequisites before transitioning to a guided cluster provisioning flow within the Red Hat Hybrid Cloud Console," the company noted.

The integration will also simplify billing and procurement, with pay-as-you-go billing through Google Cloud Marketplace that applies their Red Hat subscription against Google Cloud spend.

Beyond that, the deeper collaboration allows for native service integrations, with support for services including Google Cloud Secret Manager, Certificate Authority Service, and Workload Identity Federation.

“Our customers are constantly looking for ways to simplify their infrastructure and accelerate innovation without sacrificing performance," said Nirav Mehta, vice president of Product Management for Google Cloud Compute Platform at Google Cloud.

"Customers now have a smoother path, enabling them to run both virtualised and containerized workloads consistently on Google Cloud's global, secure, and performant infrastructure."

Red Hat OpenShift Virtualization

Red Hat OpenShift Virtualization is designed to help enterprises modernize legacy infrastructure at their own pace, using modern containers in a way that lets old and new work together.

The tool allows traditional VMs to work seamlessly with more modern containers and serverless workloads on a consistent Kubernetes platform, the company said, letting users have a single interface, toolset and operational practices across workloads.

Additional tools, such as a migration toolkit and Red Hat Ansible Automation Platform, also aim to make shifting to modern systems easier.

Beyond upgrades and migration, RedHat OpenShift Dedicated on Google Cloud offers easy scaling and more predictable performance, Red Hat said.

"This extended collaboration with Google Cloud further empowers organisations with comprehensive cloud native capabilities of Red Hat OpenShift, whether they need to accelerate application development or streamline migration to the cloud," said Barrett.

"Together, Red Hat and Google provide a clear, unified path for organizations to modernize their entire application portfolio, helping them manage both their traditional VMs and containerized applications on a single platform."

FOLLOW US ON SOCIAL MEDIA

The UK risks fumbling its lead on cloud native deployments due to skills issues, according to Nutanix’s Enterprise Cloud Index (ECI) survey.

As it stands, firms in the UK lead the way in containerization, a foundational element of cloud native application development.

UK-specific figures from the report revealed that more than 90% of firms are at least in the process of containerizing applications. Nearly one-third (32%) are ensuring that all new applications are containerized, outpacing the global average of 27%.

“By embracing containers at pace, UK organizations are positioning themselves for greater agility, portability, and automation,” the report said.

A looming skills gap threatens the UK’s lead, however, with less than half (42%) of IT leaders confident in the ability of their teams when it comes to supporting cloud native adoption.

UK firms are focusing on skills investment to address this issue, the report said, with 59% now actively hiring for roles in containerization and staff with cloud native expertise. This attention to talent development will be crucial in sustaining momentum, the report added.

“The UK is at a pivotal moment in its GenAI adoption journey. While organizations are eager to leverage AI-driven productivity and automation, security, integration with existing infrastructure, and skills shortages continue to slow progress,” James Sturrock, director of systems engineering at Nutanix, said.

“The findings from this year’s ECI highlight the need for a strategic approach that ensures secure, scalable, and well-governed AI implementations. A hybrid multicloud foundation and strong data security and governance frameworks will be critical in moving from early experimentation to real-world impact,” he added.

Cloud native adoption gathers pace

Additional findings from the report suggest cloud native deployments are becoming increasingly popular, with 54% of global firms reporting that all of their applications are now containerized.

This is partly driven by cloud-only organizations that are running their entire portfolio of applications in one or more public loud. 66% of these firms report that all of their applications are containerized.

Almost all (98%) of surveyed firms said they are at least in the process of containerizing applications, including both legacy and newly developed applications.

A shift to containerization is also being driven by the development of new AI applications that are often built on containers. The trend towards containerization is therefore expected to continue, the report said.

MORE FROM ITPRO

• What is cloud native and how can it generate business value?
• Five ways to reduce Kubernetes costs
• Orange eyes cloud native gains with Red Hat deal

An unnamed Fortune 500 company with a “multi-billion dollar” revenue stream could have been exposed to cyber attacks due to misconfigured Kubernetes clusters, according to new research. 

Analysis of Kubernetes flaws by Aqua Nautilus found that more than 350 organizations and open source projects worldwide were left vulnerable for several months due to a series of common misconfigurations. 

One misconfiguration uncovered by researchers would have allowed threat actors anonymous access to Kubernetes clusters with privileges. 

The second - and “less well-known” - issue highlighted in the study was a misconfiguration of the ‘kubectl’ proxy that “unknowingly exposed” Kubernetes clusters to the internet, leaving organizations at risk. 

Researchers said that at least 60% of clusters affected by these misconfigurations were breached and had an “active campaign with deployed malware and backdoors”. 

“The exposures were due to two misconfigurations, emphasizing how known and unknown misconfigurations are actively exploited in the wild and can be catastrophic,” researchers said. 

Among the vulnerable organizations identified by Aqua, one was a “small analytics” firm that, had it been breached, likely wouldn’t have made headlines. 

However, the firm in question had close ties to a “top-tier” Fortune 500 company, researchers revealed. 

Given that this company was an analytics services provider, the exposed Kubernetes cluster was found to contain a high volume of highly sensitive information hosted on various databases within the cluster. 

“Since the cluster was exposed, this data was exposed, and the exposure of this data could significantly impact the business operations of this large enterprise,” researchers said. 

This example underlines the potential knock-on effects that common Kubernetes misconfigurations could have for businesses spanning a range of industries.

A high volume of open source projects was found to be at risk during the investigation, which could have inadvertently triggered a supply chain incident that would affect millions of users. 

“In the wrong hands, access to a company’s Kubernetes cluster could be business ending,” said Assaf Morag, lead threat intelligence analyst at Aqua Nautilus. 

“Proprietary code, intellectual property, customer data, financial records, access credentials, and encryption keys are among the many sensitive assets at risk,” said Assaf Morag, lead threat intelligence analyst at Aqua Nautilus.

Morag said the growing popularity of Kubernetes in recent years has offered businesses “undeniable prowess” in managing containerized applications, but this study shows many are entrusting highly sensitive information in their clusters without a detailed understanding of potential risks and management techniques. 

“Misconfigurations continue to persist across organizations of all sizes and industries,” he said. 

“There is clearly a gap in security knowledge and management of Kubernetes. These findings underscore the extensive damage that can result if vulnerabilities are not properly addressed.”

The adoption of containers was also highlighted as one of the key risk factors affecting the security of cloud environments by Google Cloud last week.

Its August Threat Horizons report found that telecoms companies are facing a marked increase in attacks on their cloud environments, though much of these were DDoS in nature.

Additionally, Google Cloud also noted that user-driven errors were blamed for most of the successful compromises of cloud environments in the first quarter of the year.

Misconfigurations accounted for 19% of all incidents in the company’s telemetry. As well as opening access to Kubernetes clusters, misconfigurations elsewhere in the cloud were also often linked to the exposure of APIs and UI sensitivity too.

Despite Kubernetes adoption soaring in recent years, users are concerned security strategies haven’t kept pace. 

A significant minority (38%) feel security isn’t taken seriously enough, according to Red Hat’s latest State of Kubernetes report, or that investment in containerized operations is inadequate. This is a rise of 7% against the previous year. 

These concerns are affecting the implementation of cloud native technologies, with 67% reporting delaying deployments due to security issues. 

Kubernetes security pain points

Security pain points include tooling around signing and verification according to Jeffrey Sica, principal developer experience engineer at the Cloud Native Computing Foundation (CNCF). “If the solution to a problem is difficult to implement, developers will go out of their way to shift – or not even address – the problem,” he tells ITPro.

Policy is also an issue, not only in terms of enforcement but also definition. “Businesses need some examples or sane defaults to build off of, and it seems there’s somewhere of a gap there,” Sica says. 

More than half of Red Hat’s respondents worry about misconfiguration and vulnerabilities due to Kubernetes’ level of customization, while the focus on upgradeability also poses security risks in some people’s eyes. 

One of Kubernete’s guiding principles is backward compatibility and so a default configuration release will never break an existing deployment. This means teams must pay special attention to new security features that may be disabled by default, notes Sandy Carielli, a principal analyst at Forrester. 

She also points to the fact more organizations need to realize Kubernetes security goes far beyond the API itself. “Because Kubernetes security also extends into application security, container security, identity management, and zero trust, security professionals must have basic familiarity with all of them and be able to collaborate across the team,” she adds. 

“Kubernetes is a Venn diagram over security disciplines and organizations can’t confine their discussion of Kubernetes security to just the Kubernetes settings.”

“At its core, Kubernetes is simply an API that allows the scheduling of containers. In that sense, the attack surface is the API server, or the containers being scheduled by Kubernetes,” continues Sica, who says that as container run times and Kubernetes, itself and defaults, have become more hardened, the focus has moved to the supply chain.

Is there a Kubernetes security deficit?

To some, these issues point to a security deficit, but Sica disagrees, instead pointing out if you compare the Kubernetes security space from 2018 to now, it’s night and day. His view is that there’s never been more effort and focus on security within Kubernetes and the cloud native ecosystem, which is down to adoption and maturity. 

“Five years ago there was a proverbial gold rush to adopt Kubernetes because it was the pattern to follow in application development. People and organizations alike had to go through the growing pains of adopting what was at the time radically new technology.

“Now that there’s less of a scramble to learn about Kubernetes, there’s a greater focus on the stability of the codebase and creating secure defaults,” he explains. 

There are many examples of how the cloud native community is addressing security concerns. For example, the CNCF instigated a Kubernetes security audit. This raised concerns about network permissions and intra-component communications, which have been – or are in the process of being – resolved by the community. 

In terms of supply chain security, Sica mentions Chainguard has been working closely with the Open Source Security Foundation (Open SSF) in creating extensive tooling for the signing and verification of software artifacts. 

Another large focus in terms of security is extended Berkeley Packet Filter (eBPF). “Notably Sysdig's Falco project, which can use either a kernel module or eBPF probe to monitor/log any kernel-level calls that a container can make,” says Sica. “This is the next logical step in observing or preventing any privilege escalation or container escapes.” 

Strategies to boost Kubernetes security 

The majority of organizations with security concerns are taking steps to address them, and are seeking the services of a handful of vendors, which are focusing on some or all aspects of the security challenge.

“I don’t find that security is putting companies off going down this path, or from doing more in this area. They’re carrying on – but with a focus on having secure containers,” says Charlie Winckless, a senior director analyst at Gartner. 

Winckless recommends adopting a tool that validates the security not just of your containers, but your Kubernetes environment – and preferably a single tool that does both. 

He notes a growing number of vendors are moving into this area, with some companies including Sidero Labs and Tigera focusing specifically on container security, while ‘big picture’ cloud security posture management (CSPM) vendors such as Wiz, Aqua, Orca and Palo Alto Networks are adding container security features to their platforms.

“Some are very much focused on that bigger picture, while others are addressing those micro markets,” he says.

Beyond tapping into the market, organizations can take a number of steps internally to shore up their container security. Winckless’ top tip is to “automate, then automate, and automate some more”. “If you don’t,” he continues, “then trying to keep up with the dynamism of these environments is very difficult.”

He also recommends validating (and automating that validation) your setup in the same way you’d treat other cloud providers, and in some cases using a managed Kubernetes environment. 

“A lot of people are adopting EKS in Amazon, GKE in Google, AKS in Azure to have something where at least in my underlying Kubernetes environment, some of that security responsibility is delegated to a cloud provider.

“For the most part – exceptions include choices Microsoft made that led to the Azurescape vulnerability for example – we still see the large cloud providers able to a do a better job of it than you can.”

VMware has revealed an addition to its network detection and visibility solutions in the form of Carbon Black XDR, seeking to address the very significant threat posed by lateral attacks and empower companies to combat threat actors that have already breached their networks.

Whereas endpoint detection and response (EDR) reacts to endpoint data, extended detection and response attempts to provide environment-wide, comprehensive visibility on threats. In this way, VMware Carbon Black XDR adds to and extends the capabilities of VMware Carbon Black Enterprise, the threat hunting and response solution already available for VMware customers.

VMware identifies this as crucial in drawing attention to the danger of threat actors performing lateral attacks once gaining access to a system, with historical focus having been placed almost exclusively on endpoint tools to prevent malicious access altogether.

The service leverages data within VMware Contexa, the firm’s threat intelligence solution that provides observability across VMware’s network, as well as endpoint and user technologies. The company claims it processes over 1.5 trillion endpoint events daily, using machine learning (ML) to contextualise this information in parallel with the input of more than 500 VMware Threat Analysis Unit partners and researchers. VMware Carbon Black XDR can then use this data to prompt action by security teams, and inform policy changes.

In August, VMware research suggested cyber attacks were on the rise following Russia's invasion of Ukraine, with 25% of attacks seeing lateral movement by attackers once systems had been compromised.

"Lateral security is the new battleground," said Tom Gillis, SVP and general manager, networking and advanced security business group at VMware.

“By bringing VMware Carbon Black XDR to market, we’re improving threat detection and prevention across endpoints and networks to address the need from our customers to limit the lateral movement of attackers inside their environment.

"Our XDR solution is not replacing SIEM, rather it’s helping to paint a broader picture of the threat landscape for customers. We are correlating high-fidelity, process-level data from the endpoint with packet-level data on the network to create super high-fidelity and actionable alerts that can also be fed into a larger SIEM. That data is pulled from VMware Contexa, our threat intelligence cloud that combines the telemetry of Carbon Black and NSX."

VMware has been quick to note the uptake in demand for XDR solutions within the current threat environment, citing a Forrester study it commissioned which indicated that although 75% of responding organisations have not implemented XDR, 27% are planning to in the next 12 months. Data from the same study suggested that ROI increased following early adoption of the technology, bringing the boons of automation and adding another feather to the cap of existing security stacks.

Carbon Black was acquired by VMware in 2019, in the interest of boosting security oversight across VMware’s cloud offerings. Since then, its offerings have been expanded and are now part of VMware’s array of network and endpoint security options. These include Contexa and the upcoming Project Northstar, a SaaS-based tool for network security for applying multi-cloud security policies through a central cloud console, which is currently in tech preview.

Joe Baguely, VP & CTO EMEA at VMware, spoke to IT Pro about how VMware Carbon Black XDR expands upon past efforts by VMware:

"We've actually been talking about these threats for over 10 years. When we first acquired Nicira, which became NSX, we talked about east to west security and what we're talking about now with natural security is pretty much the same thing. But what we're doing in that space is when we talk about it back in the past, we were literally introducing the concept of having micro firewalls per workload. But it was pretty basic, pretty manual.

"What we're doing with Carbon Black and the XDR technologies and EDR, is we're making that much more intelligent. We're bringing artificial intelligence (AI) and ML to that. And we're bringing all the intelligence we've got around threat analysis to what's going on in the data centre, to make it much more responsive."

VMware’s NSX security solutions aim to provide consistent, zero trust, multi-cloud security policies alongside granular protection such as network segmentation. The firm also states that NSX is uniquely able to combat lateral attacks, as it sits alongside a hypervisor to protect individual virtual machines within a VMware vSphere environment, and alongside Kubernetes to protect native clouds.

VMware Carbon Black XDR is available for certain customers in early access, with the security specialist team handling sign up requests.

Carbon Black in action

"Carbon black is an absolute godsend for us," said Ed Higgs, group director of IT Shared Services at Rentokil Initial, speaking to IT Pro.

"We're very acquisitive. We acquire just over one company a week and we've just done one for $6.1 billion - we just acquired Terminix in the US. It’s massive for us, and obviously all those acquisitions bring relative complexities, but whenever we've got an acquisition, the first thing they do is install Carbon Black, because that gives us visibility from day one."

Referring to the threat posed by lateral security, Higgs praised Carbon Black for the security insight it provides:

"We've been pretty good over years in managing the perimeter," added Higgs. "We pay companies, like everyone else, to hack us and see where they get and, of course, they're still finding things. When they first started doing it, there were massive gaping holes, and over the years we’ve matured and matured.

"Carbon Black and NSX have significantly reduced [a threat actor's] capability to do anything - because as soon as anyone elevates a role, on any of our systems, we immediately get a notification and they can go on and delete the account, segregate the environment, whatever they need to do. The last time we paid someone to hack into our systems, we had to tell the [Carbon Black team] to ignore the test, because we don't want them to stop the testers straight away, otherwise they wouldn't get to anything else that they might find."

VMware has announced a number of new data sovereignty solutions as part of a new initiative to make cloud compliance easier to manage and monitor.

The VMware Sovereign Cloud Initiative encompasses a number of changes to existing VMware services, such as VMware Tanzu and VMware Aria Operations, as well as a new framework for ecosystem wide compliance solutions.

These sovereign software as a service (SaaS) products are intended to help companies deliver services like those found in the public cloud, remaining compliant with data regulations. The Sovereign Cloud has been drawn up in alignment with European data sovereignty project Gaia-X, and other such international regulations.

VMware promises that in addition to the changes announced, sovereign cloud services will continue to see expansion through its cloud partners, to ease the process of maintaining data compliance and data protection across cloud services.

The cloud giant also revealed that it now has 25 Sovereign Cloud providers across the globe, more than double the number at the time the group was formed, including OVHcloud, UKCloud, Telefonica, Hitachi, and Tata Communications. In order to address customer concerns directly, VMware has additionally assembled a “consortium” of industry policymakers and cloud providers, working to define requirements across sovereign clouds.

As VMware seeks to address what it calls ‘cloud chaos’, in which businesses utilising multi-cloud are wasting resources to redundancies across multiple silos, and lack the oversight or central control to fix these issues, sovereignty has arisen as another pain point amongst its partners.

“VMware engineers made the Sovereign Cloud Initiative to address this issue, said Raghu Raghuram, chief executive officer at VMware.

“The VMware Sovereign Cloud Initiative is a set of software controls, overlaid on top of the standard VMware, infrastructure and platform to deliver sovereign security, compliance, control, autonomy and allows you to innovate on such a platform.”

As part of the update, VMware Tanzu Kubernetes Grid will offer users the enterprise-ready runtime they have come to expect from Tanzu, bolstered by open source server components such as Fluent Bit, Grafana, and Prometheus. In addition, Tanzu Application Platform will allow developers to perform air-gapped installation, dynamic API registration to ensure automation is secure, and a vulnerability dashboard through which teams can perform better pre-deployment security checks.

VMware’s multi-cloud management platform Aria, meanwhile, is being given its own Operations Compliance pack, in an effort to provide continuous compliance monitoring, reporting and remediation, with a backbone of automation that remains. It can be fully integrated with VMWare Cloud Director, and comes with a central dashboard from which users can monitor cloud-wide compliance, for compliant DevSecOps.

Research undertaken by Vanson Bourne, commissioned by VMware, has shown that 96% of of surveyed companies believe that over the next two years, data will be a source of revenue, but an almost equal figure (95%) identified data sovereignty as a point of concern.

“There is no data sovereignty without cloud sovereignty. And sovereignty does not have to come at the expense of cloud innovation,” said Rajeev Bhardwaj, vice president, cloud provider platform solutions, VMware.

Speaking to the importance of cloud sovereignty at a press event, Bhardwaj emphasised how the company’s increased efforts around sovereignty are in response to the worries of its customers:

“Sovereignty is more than just data privacy and security. What customers are concerned about is this changing geopolitical landscape, and making sure if things change customers still have access to data.

“What's happening in Ukraine and Russia that kind is now bringing sovereignty to the forefront," added Bhardwaj. "The second one we heard was around jurisdiction controls. This is around foreign nations having access to data using the legal framework. So that came up as another key concern from customers.

“Additionally, customers have embraced cloud. A lot of these regulated workloads are now set in public clouds. So, there's a concern here, either foreign nations can access their data, or if the geopolitical landscape changes they may not have access to data.”

A number of tech firms have made moves to give customers greater control over data transfers, with Oracle building more sovereign cloud regions in the EU in 2023, and Google adding more data transfer controls in the EU. The moves come in part due to anticipation of the EU-US data transfer agreement, the successor to Privacy Shield, which seeks to reconcile data protection approaches across the Atlantic.

Companies across Europe are now adopting cloud-native technologies faster than companies in the US, but with specific demands in mind, according to a new study.

Data suggests that Kubernetes and container use is now more common within Europe, as organisations look to firm up cloud-native technologies, with recent findings showing that 75% of back-end developers in Western Europe used containers in 2021, up 13% on the previous year and ahead of the US figure of 60%.

In contrast, demand for serverless architecture has plateaued, as firms seek to address specific market demands, while avoiding potential technical debt or vendor lock-in. Indeed, as cloud-native tools are more widely adopted, container migration services are becoming more widespread across the region, to assist enterprises in strategically scaling cloud-native technologies.

The figures were revealed as part of the 2022 ISG Provider Lens™ Cloud Native Services and Solutions report, published by tech advisory firm Information Services Group (ISG) on Friday.

As the market for cloud-native technologies matures, European businesses are increasingly seeking multi-cloud tools and mixed premises storage to address problems such as data sovereignty, with providers now moving to back up clients in meeting individual regulatory requirements.

Greater observability was identified as both a common goal among European businesses, and one that is increasingly complex. Cloud strategies increasingly extend to include DataOps, FinOps and SecOps, and maintaining full-stack observability is a key concern for decision-makers. A recent Dynatrace study revealed that 71% of CIOs worry their cloud complexity exceeds human ability, with 97% identifying various implementation barriers as preventing full-stack observability from being achieved.

As an extension of this demand for observability, firms are also seeking cloud-native tools with which they can measure their carbon impact. The concept of tracking carbon emissions to achieve software sustainability is growing in popularity among firms, and offers such as Google Cloud’s sustainability expansions offer cloud partners new ways to measure their carbon footprint.

Businesses are also relying more than ever on open source solutions, acknowledging that even commercial platforms such as those offering cloud security will necessarily integrate with open source solutions such as Prometheus. At the same time, firms recognise the need for ‘best of breed’ open source solutions, and programs such as Google’s Assured Open Source Software service to ensure that implementation does not compromise security.

The Cloud Native Computing Foundation (CNCF) states that the most popular certified Kubernetes platforms within Europe were Amazon EKS, Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE).

“As enterprises pursue cloud-native strategies, many are tapping into the strengths of different public clouds, along with on-premises and edge environments,” said Bernie Hoecker, partner, enterprise cloud transformation, with ISG.

“This may make their architectures even more complex, but it helps them avoid technical debt or lock-in.”

The report also assessed the capabilities of 65 providers across five quadrants: managed container services, container platform solutions, hyperscaler cloud-native platforms, cloud-native observability solutions, and cloud-native security platforms. VMWare was named a leader in three of these quadrants, while Azure, AWS, and Google were all named leaders in hyperscaler cloud-native platforms, indicative of the rival firms’ strong competition at the top of the market.

Those organisations that are becoming more data-driven are gaining a competitive advantage and solving business problems at a great pace. But this isn’t happening in the data centre or in the cloud.

Companies that need to deliver applications at scale, and solve challenges fast are doing so with an edge computing solution that enables them to reduce costs, connect existing infrastructure and support continuous innovation.

Download this resource to learn how containers and Kubernetes can help deliver edge computing benefits, as well as what to consider when building a modern edge infrastructure.

Provided by

Organisations are becoming increasingly used to the digital disruptions caused by cyber and IT incidents, and are adopting new methods to enhance their resiliency and ability to bounce back, including machine learning (ML) and Kubernetes-orchestrated containers.

In order to strengthen their position and get head of the competition, edge computing can offer an effective way to enhance these operations.

Download this resource to discover what to consider when planning an edge deployment and how edge computing can accelerate your innovation.

Provided by

Containers are increasingly being used to improve security and speed up application development - with businesses noting better app performance as a result - and are becoming standard practice for implementing SecDevOps workflows.

However, as organisations feel under pressure to launch new products and services at a faster rate, innovation can be limited when resources are focussed on managing infrastructure and security.

Download this whitepaper to learn how to address application development challenges with Red Hat OpenShift on IBM Cloud so you can focus on your business objectives.

Provided by

Container technology has gone from a niche, experimental application and infrastructure tool to a cornerstone of modern IT transformation - but its explosion in popularity has resulted in a corresponding demand for skilled professionals to manage these deployments. Kubernetes certifications are particularly sought after, and holding one is almost a licence to print money for IT professionals.

With the market for Kubernetes skills hotter than ever before, we’re joined this week by OpenUK CEO Amanda Brock to discuss why it’s become so popular, what this says about IT transformation in the UK, and how organisations can make sure they don’t fall into the Kubernetes skills gap.

Highlights

“Everybody is looking at Kubernetes, but they're not looking at it in isolation. What it's done is opened a floodgate in many ways for those who might not understand that they're using open. And the fact that they bring it into organisations, or they're using it via third parties, has opened up the opportunity for more tolerance, acceptance and understanding of open source generally, I think, so I don't think that you can say ‘everybody's using Kubernetes, nobody's using other open source’, I think what you're seeing is people are acknowledging and understanding their use of Kubernetes. And that's allowing their internal processes, their policies, their governance, to improve to facilitate the adoption of other open source.”

“With Kubernetes certification, there's a lot of structuring around it, and it's quite different. And I think there's that difference that's making it so popular alongside the scale of adoption. And what I mean by that is that the certification isn't your usual multiple plot choice test. You can't just tick box A the whole way through and find that you've passed. You actually have to answer.”

“I think that we can all accept that there are skills gaps. I was on a podcast a few months ago with OVH, ATOS; all of them were looking to recruit in the UK, with these skills. Now, I think the skills gap, we just have to accept is there. Obviously it's great to train people. And it would be ideal to bring people in with those skills. But there's a shortage. So you're balancing those two. And I think that we will have to retrain people, or encourage people to train in this space. I suspect that that's where the work that's been done in the last few years will really come into its own with CNCF, the Cloud Native Foundation, which has got this whole ecosystem around Kubernetes. So it doesn't just offer Kubernetes training. It offers training in associated products as well.”

Read the full transcript here.

Footnotes

• What is Kubernetes?
• Rancher Labs unveils new Kubernetes certification programme
• How the tech industry can retain talent
• Getting started with Kubernetes
• Is the UK government's plan for digital upskilling on track?
• Government launches 400 free qualifications to help with economic recovery
• What are your tech skills worth?
• Education is needed to end apprenticeship stigma, says BCS
• The lost year: How 2020 tech graduates and apprentices are coping with the coronavirus pandemic
• Is a degree still necessary to get ahead in IT?
• OpenUK Entrepreneur in Residence and Founders Forum Initial Findings November 2021
• The IT Pro Podcast: The teenager who started a networking firm
• The driving forces behind DevOps today and how to integrate it into your business
• IT Pro Panel: Defining DevOps
• 11 best python courses
• How to become a Python developer
• Python founder Guido van Rossum joins Microsoft
• UK's growing skills gap could stall COVID recovery
• Linux on Mars!
• The IT Pro Podcast: Picking a programming language
• Why SMBs are fishing in the wrong technology talent pools
• The 2021 Open Source Jobs Report
• How apprenticeships are fuelling the future of UK tech
• IT Pro Panel: Do we still need certifications?
• IT training courses and where to find them
• Learn to code online with these six websites
• How to confidently change careers to IT
• How to become a developer: A beginner’s guide
• The best cloud computing jobs and how to land one
• IBM job ad calls for 12-years of experience with six-year-old Kubernetes
• How to become a DevOps engineer
• The IT Pro Podcast: Why the tech skills gap doesn’t exist
• CNCF.io
• Open UK Kid’s Camp
• The IT Pro Podcast: Bringing space tech down to earth

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Everyone needs Kubernetes certs’. To listen to the full episode, click here. We apologise for any errors.

Adam

Hi, I'm Adam Shepherd.

Sabina

And I'm Sabina Weston.

Adam

And you're listening to the IT Pro Podcast, where this week we're digging into the recent demand for Kubernetes skills.

Sabina

According to the Linux Foundation's 2021 Open Source Jobs Report, demand for IT professionals with Kubernetes certifications has shot up by more than 450% since 2019, with almost 90% of hiring managers reporting that they are prioritising the recruitment of certified professionals.

Adam

But what does this explosion say about the state of enterprise open source adoption, and is certification the right route for organisations seeking to plug skills gaps? This week, we're joined by Amanda Brock, CEO of OpenUK, to find out more about why Kubernetes is big business. Amanda, thanks for joining us.

Amanda

Thanks very much for having me along today guys.

Sabina

Okay, so, Amanda, how does the level of interest in Kubernetes certification compare to the demand for other open source technologies?

Amanda

That's a very good question. I don't think we have the data on some of the other open source technologies in the way that we have it for Kubernetes, simply because Kubernetes has been such an explosion. And it's so essential today to business. I see particularly in the UK that we have a lot of leadership and growth around Kubernetes, in particular. So it seems to be that it's pretty much ahead.

Adam

And I, I would argue the fact that we have so much more data on Kubernetes, in particular, kind of demonstrates the overwhelmingly dominant position that it has kind of among other open source technologies.

Amanda

No, no, no, no, I think you're comparing apples with pears there. So what you're comparing Kubernetes against is other cloud technologies and containerisation technologies, really, whereas other open source may be organised in a slightly different way. Kubernetes is super structured, brilliant governance through the Linux Foundation who do a lot of reporting, you might not see that in every other area of open source. So I'm not sure that the comparator should be other open source. I think the real comparator should be other containerisation and cloud technologies.

Adam

So platforms like Docker, for example, which, you know, enjoyed a lot of early success, I think it's fair to say, but was just absolutely eclipsed by Kubernetes over the last several years. But anecdotally, when you're when you're talking to organisations in the field, to, you know, member organisations and partners and people like that - what is the kind of the ratio of organisations that are looking at Kubernetes versus organisations that are looking at other kind of open source infrastructure platforms; not necessarily kind of containerisation platforms, but other open source things?

Amanda

I would say they're at equilibrium. So when we talk to people, they're running Kubernetes, everybody is looking at Kubernetes, but they're not looking at it in isolation. What it's done is opened a floodgate in many ways for those who might not understand that they're using open. And the fact that they bring it into organisations, or they're using it via third parties, has opened up the opportunity for more tolerance, acceptance and understanding of open source generally, I think, so I don't think that you can see, you know, everybody's using Kubernetes, nobody's using other open source, I think what you're seeing is people are acknowledging and understanding their use of Kubernetes. And that's allowing their internal processes, their policies, their governance, to improve to facilitate the adoption of other open source.

Adam

Cause of course, historically, open source has had a bit of a mixed relationship with, I think enterprises in particular, where there's a huge appetite for it in the in the IT team, because, you know, there are just so many useful tools and utilities and kind of back end things, bits and pieces that kind of rely on open source. But on a high level, there's quite often a bit of trepidation. I think it's fair to say, about deploying open source at a kind of policy level, if you like.

Amanda

Yeah. And you obviously know my background. I don't know if people listening will, I was a lawyer for 25 years, I stopped being one a couple of years ago, I spent five years from the beginning of 2008 in a company called Canonical, one of the biggest open source companies. Definitely biggest in the UK, at least when I was working there, and I set up and ran the legal team. So for me, my conversations day on day on day, particularly as I was the escalation point in all the commercial contracts, was explaining risk; getting people to understand open source, getting them to understand governance. Now, I left there at the end of 2012, almost 10 years ago. And what's happened in that 10 year period has been that there is a massive, massive shift. And I don't know how much even you two will understand what's caused that. Some of it is definitely Kubernetes in the cloud. Some of it is around Git and the the massive growth of these distributed repos where the DevOps community, the internal engineers, can now go and get the software they want, they don't have to go through procurement, they don't have to go through legal, if your organisation is doing it right, you will have policies and processes that govern how your open source is brought in. And you'll know what's going on in your organisation. But your developers are going to be doing this and using it, whether you like it or not, and then don't have to come back to legal and procurement until you get to the stage of money changing hands. And that tends to be for a subscription or a support contract or some sort of implementation that you might need. So actually, the power shift, and the risk shift has really come from the internal engineering CIO, CTO community.

Sabina

Interesting.

Amanda

It's massively different from a decade ago. And what that's done is cause you know, we did some survey outputs last year or earlier this year. And what you see is 89% of companies in the UK actually running open source and knowing they're running it. And I think the trajectory, we're on now is just so rapid, and so high, that there's no way of avoiding it. So you're right, Adam, Kubernetes has been a big opener up of that. But what we're seeing is Kubernetes taking over from proprietary cloud tools and container orchestration tools, and facilitating greater adoption of open source generally.

Adam

Yeah, cause, of course, Kubernetes is very big in the kind of infrastructure and kind of DevOps side of business. But there's also in recent years been increasing adoption of things like Python, for data science and data modelling, which has also kind of exploded in the last couple of years.

Amanda

Absolutely. And I think if you look at our kids course, which is part of the OpenUK Kids Camp, I think it's lesson five, where we talk about the Python Foundation and Guido van Rossum who created it. We have a lovely fact. And the fact is that there are more children in the UK learning Python than French. Now that might be a post-Brexit thing. But there we go. I knew you'd like that! And I was at something. I was at an event this week at the House of Lords where Chris Philp, the new minister for digital spoke, and he was really emphasising the need for AI and data scientists. And I think that's going to be massive on the government's agenda next year. And of course, as we know, most of the languages that are sitting behind that are open. So we're only going to see more push into that education and skills for data scientists.

Sabina

Why have demand for Kubernetes certification in particular exploded so dramatically?

Amanda

I think it's a couple of reasons. So when you look at Kubernetes, you see something that is infrastructure that's really important, digital transformation has gone at the scale it's gone. Kubernetes allows you to have interoperability. In theory, it removes vendor lock in because it's used universally, it's a sort of de facto standard in the cloud. So and then containerisation, of course, generally, not just in cloud. So what you then see is a need for those skills. Now those skills are in demand and in short supply. So there's a mixture of hiring people from the marketplace, and also where those can't be found, training your existing staff. And it's one of the things that we've identified as a straight benefit of open source is the skills development on the job. With Kubernetes certification, there's a lot of structuring around it, and it's quite different. And I think there's that difference that's making it so popular alongside the scale of adoption. And what I mean by that is that the certification isn't your usual multiple plot choice test, right? You can't just tick box A the whole way through and find that you've passed. You actually have to answer; do you know, you're laughing, but the American Bar, American lawyers qualify in that way. That the bar exam has multiple choice as well. But what you've seen here is a shift and you actually have to be able to write the answers. So you either know it, you either understand it or you don't. And I think that's been a big part of the certification. I also happen to know that they did something called the massively open online course for Kubernetes. And that had 165,000 enrollments in 2020. It's massive.

Adam

So Kubernetes certification is obviously something that's very attractive to learners and developers who want to broaden their skill set. But what I think is really interesting is that there has been a corresponding demand from employers and from businesses who want these certifications; more so, in fact. The Open Source Jobs Report stat of 450% growth is crazy, crazy high. And that's really interesting, because certifications are often something particularly in you know, emerging technologies like Kubernetes - you know, depending on whether or not you think Kubernetes is still emerging - it's, it's often something that's looked on as a nice to have, rather than something that is being proactively sought out and fought over by organisations.

Amanda

It's interesting, I think it's way beyond a nice to have. We have at OpenUK an entrepreneur in residence, chap called Matt Barker, who I worked with at Canonical. And he set up one of the early stage Kubernetes companies, one of the first in the world. And as I'm talking to you, I'm quickly flicking through his profile on LinkedIn. So he set it up in 2015. So you know, that's what, seven years ago, he's created, it sold it, now running it as part of another enterprise. And, Matt, I'm going to give you a sneak preview, this will probably have been released before this podcast comes out. But Matt's about to share his entrepreneur in residence report. And he steals a line, I can't remember who originally gave this quote, I know Tony Blair used it but he's not the originator. And Matt talks about education, education, education. And he talks about educating our young people, he talks about reeducating our business people, and educating our government in that report. And you know, after all the work he and the Founders Forum have done, they come back to that. Now, Matt's also been involved at Bristol University in helping them create a Kubernetes course for students. We'll be running a founders course from 21st of January, helping UK founders broaden out their skills around things like product development, revenue models, that kind of practical open source stuff. But we're also talking to universities at scale, and we're talking to a number of organisations about building an apprenticeship module. And it will be inevitable that Kubernetes will be part of that. There is no way around it at this stage.

Sabina

That's amazing, that's really good. Can I ask what like, how do you see an apprenticeship programme with Kubernetes involved? Are there any sort of like specifics?

Amanda

Yeah, we've been very good at teaching people. So we've been very good at sort of teaching go and code Python, but not teaching them why they do things in a certain way, or how the, the openness of that's originated and the governance and the practicalities. So what we're trying to do is merge both the functional practical training with the understanding, and I think that understanding really empowers people and lifts them up to a higher level.

Sabina

Definitely, yeah.

Amanda

We're very keen on that.

Adam

So is this massive demand for Kubernetes from the business community, is that being driven by a skills gap, do you think?

Amanda

I think there is a skills gap and I think it's a universal skills gap caused by the scale of digitalisation that has really been put under a magnifying lens through the pandemic. You know, if you go to McKinsey or Deloitte, they'll show you the massive pace of adoption and digitalisation in the last two years, I used to refer to them as reluctant technologist because there are all these companies, you know, I mean, basically, they're either producing their products, distributing it, or having it consumed via digital. And that's been a shift over the last decade. For those of us who worked in it, it was very confusing that it wasn't already happening. But you can understand how industries had to shift to that. And really, I think there's a bigger picture here, which is that we're also going to see the public sector and governments moving to it. You know, we're going to see UK utility shifting over to that. I think Laura Sandys who's running the digitalisation task force for the energy sector, calls it the plumbing. Our infrastructure, our roads and bridges; the future of that is digital in the UK and beyond. And we're going to see, I think, real leadership in the UK around that transformation. One of the things that we've always done well as infrastructure, whether it's digital or not, and we have amazing engineering communities, which I think is why the UK has a leadership role already around CNCF, around cloud native. You see people I've mentioned, Matt Barker, we've got Alexis Richardson. People like Liz Rice who's the CTO at CNCF, Cheryl Hung, Katie Gamanji, there's a whole crowd of those folk, based in the UK. And I suspect that that will really help us in building those skills now that people are understanding the gap.

Sabina

And what is the potential impact of this skills gap?

Amanda

There's obviously an immediate problem with the lack of those skills and the need to get people trained quickly and effectively. I think that governments across the globe are recognising that. I don't know, I don't really want to get into the politics of it all. But I actually think that the UK also is really beginning to come to terms with the fact that we need to equip people digitally and quickly. We've got to implement it. But I think there's an understanding in the public and private sector now, about that.

Adam

Do organisations risk kind of falling behind competitors if they don't have Kubernetes skills, specifically?

Amanda

I think it's a no brainer, you're going to have to have it because it has become such a de facto standard to avoid lock-in. And, you know, the theory is it's entirely interoperable. I know, sometimes that isn't quite the case with cloud companies. But I think you will see that. And then we've got these conversations going on across Europe, across the UK, in fact, across the globe, again, about sovereignty. And everybody is looking at managing their own cloud, about managing their infrastructure, building out that infrastructure locally, which means that there's a, an increased desire locally to have it, as well as just companies in their day to day digitalised transformation. So yeah, I think we have to have it and we have to have it as soon as possible.

Sabina

Should organisations, according to you, consider retraining existing technical staff to fill the supposes skills gaps?

Amanda

So I think that we can all accept that there are skills gaps, I was on a podcast a few months ago with OVH, ATOS; all of them were looking to recruit in the UK, with these skills. Now, I think the skills gap, we just have to accept is there. Obviously it's great to train people. And it would be ideal to bring people in with those skills. But there's a shortage. So you're balancing those two. And I think that we will have to retrain people, or encourage people to train in this space. I suspect that that's where the work that's been done in the last few years will really come into its own with CNCF, the Cloud Native Foundation, which has got this whole ecosystem around Kubernetes. So it doesn't just offer Kubernetes training. It offers training in associated products as well.

Adam

What are some of these associated products? Because obviously, one of the the advantages of Kubernetes is that it's part of a wider ecosystem that is kind of very complementary. So stuff like serverless, serverless computing, dovetails very naturally with it. Microservices architectures, of course, is a big part of Kubernetes. What are some of the kind of inroads, if you like, that can lead people into Kubernetes?

Amanda

So rather than trying to list things out, I would send anybody to the CNCF.io site. There's a chap sadly, he died last year and not as a consequence of the pandemic, who did the most amazing work in creating our cloud native landscape. And there is actually a card that you can see on there, which sets out the whole landscape and breaks it up into categories. And then within those categories, shows you products and what's open and what open interfaces with. And I think that's been used in by Linux Foundation since Dan Kohn created it, across other areas of their work, but it was a first and I remember seeing it maybe 2017,18 at one of the KubeCon conferences, and I would send anybody to that to get themselves a picture of the landscape. The other thing that they have that you may not have seen is Phippy. Do you know who Phippy is?

Adam

I do not.

Amanda

Ahhh, Phippy's a giraffe. Phippy is a little giraffe. And again, we've shared Phippy and friends across our kids camp. Cloud Native have these amazing books for very young children explaining containerisation orchestration, microservices, the whole infrastructure, for I would say late primary school, early high school kids. And there's a whole series of characters around it steering the Kubernetes ship.

Adam

Absolutely. We'll put a link to that in the show notes.

Sabina

Yeah, it'll be amazing. So it's a giraffe, yeah?

Amanda

It's a giraffe.

Sabina

That's so cute.

Adam

That is adorable.

Amanda

She is. Yeah, well, she's a bunch of friends, there's little zebras and all sorts in there. It is really wonderful the way it's been done. And I think it was a community initiative. But what what they've done, which in some ways I tried to emulate is they've created really accessible user interfaces. So it makes it something when you come to that learning, and that skills development, it's less intimidating than some areas.

Sabina

Yeah. Yeah.

Adam

So speaking of that side of things, you've mentioned the kids camps, and the fact that you're teaching Python in them. Firstly, are we teaching kids enough about these kinds of platforms, about Kubernetes, and containerisation, and all of the kind of related ecosystem stuff? And also, how long do you think it is going to be before we start seeing Kubernetes and containerisation as a foundational, you know, everyday part of hobbyist citizen development?

Amanda

Really interesting. So I'm hoping that you will see some of that via us next year. We talk in our kids course. So I'll take a moment. Yeah, it's not a, an advert as such, but I'll take a moment to talk about what we did. So we did a first course last year, we didn't intend to do it, we intended to run a competition, we pivoted because of the pandemic, we created a course to give to kids who were stuck at home during lockdown. We realised it was probably something that other children would enjoy, other young people would enjoy. So we did a glove kit giveaway of the Mini.Mu glove. And we did over 3,000 of those and kids joined a summer camp. And the Mini.Mu glove is inspired by MiMU; Imogen Heap, the singer worked with a lady called Helen Leigh to create this glove. And it was retailing for sort of £30-£50. So we gave away about 3,000 of those last year. This year, well this year was even better. So this year, I got the bit between my teeth. And we started understanding that we're building a course. And what we did was we took the Open Source definition, which has got 10 elements to it, we broke that down. We added coding skills where we have I think, five make code which is a block code lesson that goes with the glove and the Micro:bit. Then we did four Python lessons and one JavaScript. And around those we explained the Open Source Definition and sustainability. And we start to teach the sustainable development goals and interface the two, we were super lucky, our friends at NASA created a column across those for us, the ODI creating something on data; I know NASA, gets me every time as well.

Sabina

It's very, very good to have friends in NASA always.

Adam

Yeah. Friends in high places, you might say.

Amanda

Yeah, well, lots of open source on Mars. So it's one of those things that allowed us to really engage with kids. And unfortunately, the MiMU, Mini.Mu glove was withdrawn, and I'd raised the money for them. So we went out and built our own glove with MiMU's help. And we've just distributed 5,000 of those to allow kids to do this course. So you can go to openuk.uk/openkidscamp, we're on lesson seven on Monday, that course teaches data centres, a little bit about cloud, containerisation, it starts to contextualise some of this stuff, and for us, it's key stage three. So age 11 to 15. By next year, we will have an apprenticeship knowledge module; as with everything we do, it'll be Creative Commons, people will be able to take it and use it wherever they want to. But I'm hoping that that will also lead into either a GCSE or a T-level or a Scottish higher, something like that, that we can put out and just share with people and let them start to learn and be educated and educate themselves around it.

Adam

That's really interesting.

Amanda

If we wait, I mean, the current curriculum, I'm told and I, you know, I'm not an educational specialist, but the current curriculum is from a few years ago and changing that in a formal way takes lots of parties to agree. And it will take time, and I don't think on digital skills that we have that time. So we've just gone ahead and done what we can.

Adam

Absolutely, it's the problem that you see so often with kind of government tech policy. Policy takes so long to agree and finalise that by the time you finalised it, the technology that it's dealing with has moved on.

Sabina

So we've spoken about how this can be used with, with younger people, especially specifically children. But let's talk about people who are on the job market right now and are applying for jobs; do you think that that organisations should be looking for certifications in particular, when trying to fill these gaps or does that risk excluding potential talent?

Amanda

I hope it doesn't risk excluding potential talent. I don't believe that it does. Because the ability to go and get the certification is not massively expensive. It's something that's freely and widely available. What I've experienced is the and this influences everything I do around education in coding. A number of people I know, good friends of mine have not gone through the university system, they've not gone through that traditional tertiary education system. And they've, if you measure success in money, which I don't, they've made a lot more money than me.

Sabina

So did they, did they go through like apprenticeship programmes, or...

Amanda

Sadly not, because most of them didn't have the facility and I think apprenticeships programmes, the right apprenticeship programmes, I think really would help. For many of them, they didn't fit within the university structures, they just didn't appeal to them, or they dropped out, right, and they've gone off, and they're largely self taught. And I think for a lot of engineers, that's the way they've come through. And the more guidance we can give, and the more that that's simple, practical, accessible, the better. So having something like a certification rather than requiring somebody to go off and commit to years of college, creating something that they can do while they're on the job, I think is really important. And it makes it much more accessible.

Adam

Yeah, absolutely.

Amanda

What we also have to be doing is encouraging a more diverse community into that. And that still comes back to schools. And if it's not the computer science teachers, it's the careers advisors, encouraging, you know, an ethnically and gender diverse group into this space.

Adam

Yeah, absolutely. And that whole self taught programmer thing, I think, is becoming a lot more, as you say, a lot more accessible and a lot more common. I would encourage listeners to check out the podcast episode that we did with friend of the podcast, Jessica Cregg, who did that exact thing of, of retraining; not even retraining, but kind of teaching herself programming, and she is now firmly entrenched in a tech role at LaunchDarkly. So then, you've mentioned that these certifications are kind of fairly, fairly widely available, and the courses and the course materials are very open and accessible. Would you encourage developers to have a go and to get stuck into learning Kubernetes if they're interested?

Amanda

I think many of the community that I work with already has, to be quite honest. And they certainly are advocating it across the board. I definitely recommend it. I think if you look, as I've said many times in this interview, if you look to the UK, our engineering community is really really good at infrastructure. We've got an incredibly strong Kubernetes community, incredibly strong cloud native community. They're very welcoming Cheryl Hung, who you probably know runs meetups in London. There's other meetups. Lewis [Denham-Parry] is running them in Wales, you know, there's folk doing this all across the UK, where you can go and dip a toe in the water if you want to sort of chat to people about it. If you can't find them, come back through me. You'll find OpenUK or me on Twitter, DM us and we can put you in the right direction.

Adam

Well, unfortunately, I'm afraid that's all we have time for this week. But thank you once again to OpenUK's Amanda Brock for joining us.

Amanda

Thanks very much, Adam.

Sabina

You can find links to all of the topics we spoken about today in the show notes, and even more on our website, itpro.co.uk.

Adam

You can also follow us on social media and if you like leave us a rating and a review. We'll be back next week with more analysis from the world of IT but until then, goodbye.

Sabina

Bye.

Recent events have put the security of software supply chains squarely in the sights of corporate boardrooms while developers remain under constant pressure to deliver new software to market ever faster.

To accelerate innovation, developers often leverage open-source software (OSS) components. But the unfortunate reality is that threat actors no longer respect the unwritten code of honour in the open-source community and are now actively targeting OSS software components and public repositories. Clearly, development teams must now take proactive steps to ensure container network security.

Access this guide to learn how to:

• Recognize attack vectors in dev environments
• Create policies with the NetworkPolicy API
• Leverage CNI providers
• Run end-to-end validation tests
• Secure Kubernetes resources
• Control ingress traffic
• Secure east-west communications

Provided by

Provided by

Modernise and accelerate application delivery by migrating your traditional virtualised workloads directly into container-based workflows within Red Hat OpenShift.

With Red Hat OpenShift, teams can achieve greater resilience and high performance for virtual machine-based workloads. Supporting this virtualisation will require persistent storage solutions, however, which provide data resilience, live migration, and more.

Download this resource to see how Red Hat OpenShift Container Storage compares to a competitive storage alternative.

Provided by

With a Kubernetes platform offering like Red Hat OpenShift, your organisation can gain a foundation for developing and running important business applications with increased efficiency and automation.

This whitepaper reports the findings of an IDC survey of 14 organisations using OpenShift, revealing how their development teams have been empowered to pursue business goals with better digital products and services.

Download this report now to see how Red Hat OpenShift can:

• Improve DevOps productivity and effectiveness
• Increase revenue
• Reduce costs

Cisco has acquired application monitoring firm Epsagon in a multi-million dollar deal that will see the firm’s technology integrated into Cisco’s products and services.

Joining the company’s Strategy, Incubation and Applications division, the Epsagon acquisition will expand Cisco’s advanced full-stack observability strategy with its expertise and technology.

The startup, which has offices in New York and Tel Aviv, distributes tracing systems for modern applications and services, including containers and server-free environments.

The value of the acquisition hasn’t been publicly disclosed, although Globes reports the figure stands at $500 million. Epsagon itself has raised $30 million to date, according to Pitchbook, with Globes estimating its value at between $100 to $200 million.

As the app market’s competitive landscape expands, Cisco’s senior VP and chief strategy office Liz Centoni said, businesses must fast-track their innovation timelines or they’ll be overtaken by their rivals.

Businesses are doing this by adopting cloud-native technologies, microservices and containerised components on a massive scale. This has led to a rise in the complexity of IT environments, with firms like Epsagon stepping in to track the performance of the components that make up a firm’s digital infrastructure.

“Cisco’s approach to full-stack observability gives our customers the ability to move beyond just monitoring to a paradigm that delivers shared context across teams and enables our customers to deliver exceptional digital experiences, optimise for cost, security and performance and maximise digital business revenue,” Centoni said.

“Epsagon’s technology and talent align well with Cisco’s vision to enable enterprises to deliver unmatched application experiences through industry-leading solutions with deep business context. By contextualizing and correlating visibility and insights across the full stack, teams can improve collaboration to better understand their systems, solve issues quickly, optimise and secure application experiences and delight their customers.”

Cisco’s core software as a service (SaaS) platforms includes AppDynamics, ThousandEyes and Intersight which all feed into the full-stack observability strategy. This provides observability across the entire stack of apps, network infrastructure and security with real-time insights correlated across domains, and integrated with business context powered by AI and machine learning.

Expenditure on Kubernetes is rising dramatically, and most businesses are struggling to accurately project how much they’re expecting to spend on their container orchestration systems in future.

Over the last year, Kubernetes-related costs surged for 68% of businesses, according to research by the Cloud Native Computing Foundation (CNCF), which manages the ecosystem. Just 12% of businesses lowered their Kubernetes expenses, while among organisations to have sustained an increase, half saw it jump by more than 20%.

Kubernetes is an open source container orchestration system for automating app deployment, scaling and management. While it was originally designed by Google, Kubernetes is now maintained by the CNCF.

The trend does not come as a surprise, according to the report, because as most organisations adopt cloud-native architectures and scale up Kubernetes environments, the associated cloud costs will rise.

Despite costs projected to spiral, however, there’s a disconnect between these rising expenses and how well most businesses are able to accurately forecast Kubernetes costs, project these, and instigate processes that can manage overspend.

CNCF and the FinOps Foundation surveyed senior IT staff from their extended communities of 195 organisations, which is a small sample size but serves as a representative sample of a cross-section of businesses.

The vast majority of respondents either don’t monitor Kubernetes spending at all, 24%, or rely on monthly estimates only, 44%. Only 13% used accurate show-backs while 14% had a chargeback programme in place.

“As more organisations adopt cloud-native architectures and scale up Kubernetes environments, the associated cloud costs will rise,” the report said. “However, the FinOps for Kubernetes survey uncovered a disconnect between these rising expenses and how well most respondents have been able to accurately and effectively monitor Kubernetes costs, predict those costs, and instill processes that can curtail unnecessary overspend.

“Whether spending $10,000 per month or 100x that, the lack of real-time cost visibility and the insights and actions that organisations can take from that suggests that the majority of organizations leveraging Kubernetes can become significantly more cost-efficient – and do so without impacting performance.”

As cloud costs continue to rise for the majority of businesses, the report urges organisations to adopt processes and systems to track how much they spend. Firms should look beyond basic cost estimations and should instead seek to allocate costs back to granular environments and projects for show-back and chargeback.

Research must be closely aligned with the direction of the open source community or it risks becoming irrelevant, a senior Red Hat exec has claimed in light of the University of Minnesota controversy.

Researchers at the University of Minnesota were excoriated by senior Linux moderators last week after being caught attempting to embed the Linux kernel with inconsequential patches and vulnerabilities. They were stress-testing the submission process, and how the open source community would react to these flaws.

Although the university itself said it would take the matter "extremely seriously" and fully investigate the approach, the controversy led to the institution being banned from contributing to the Linux project again.

Red Hat’s senior vice president and CTO, Chris Wright, has branded this event as significant and unfortunate, adding that he fully backs Greg Kroah-Hartman and the broader community in their response to the “unusual” activity.

He added the only way to succeed in open source research is with the trust and consent of the community, while also adhering to the open source fundamentals.

His comments come as Red Hat announced an expansion of its own research endeavours with the University of Boston (UB), comprising a $551.9 million donation of software licenses and an additional $20 million in direct grants.

“First of all, it’s a significant event, and we’re paying attention closely, and I really support Greg Kroah-Hartman and the broader kernel community and their response to the unusual approach that University of Minnesota researchers took,” Wright said at a panel event at Red Hat Summit 2021.

“Having said that, it sort of highlights a possible disconnect, or even the traditional notion of the academic ivory tower, that we’ve been looking at, actually, from a very different perspective with Boston University.

“At this point, open source is such an innovation engine across the industry, that it’s possible for academic researchers to produce research that in the end isn’t that interesting or novel because it’s not aligned with open source community directions. So, rapidly, that research doesn’t have the same level of impact.”

He added his focus with UB is working directly with researchers and engineers to make relevant changes for open source communities, and to make code modifications actually improve the quality of software. This is as opposed to research conducted simply for the sake of research, hinting that the University of Minnesota project was more preoccupied with research outcomes than contributing to the open source vision.

“Our focus, with Boston University, is working directly with researchers, with our engineers, on making changes that are relevant for open source communities,” he continued.

“And in order to do that we have to establish trust and credibility, and follow the openness and transparency models you expect in any open source communities - and that’s exactly the kind of work that our Red Hat engineers do with Boston University researchers in pursuit of academic research in the context of open source communities.

Researchers across several institutions can benefit from the $551.9 million worth of software licenses to access a suite of Red Hat platforms including Red Hat Enterprise Linux (RHEL), OpenShift, OpenStack Platform, Virtualization and Red Hat Ceph Storage.

The breadth of free software will grant Boston University and its partners, including Harvard University, resources to pursue cloud research projects. Red Hat claims its contribution will allow these institutions to develop technologies more quickly, and make existing services more efficient and accessible.

The subscriptions, set to be distributed over three years, will also boost a series of interrelated projects that form the open research cloud initiative, with the growth of these projects helping to advance research in cloud computing and AI operations.

Red Hat first announced its collaboration agreement with Boston University in 2017 as one that advanced research and education in open source and emerging technologies. Now known as the Red Hat Collaboratory, the project will also receive an additional $20 million funding boost over the next five years.

This expansion of funding will be committed to creating a joint operations research centre for the study of automated hybrid cloud operations at a larger scale, as well as the continued support of open source development.

Red Hat has launched an advanced tier of its OpenShift container application platform, with added tools designed to offer a complete Kubernetes stack out-of-the-box. This is in addition to launching three new managed cloud services.

Red Hat’s OpenShift Kubernetes Engine is the foundational layer of OpenShift, allowing customers to run containers across hybrid cloud deployments on the Red Hat Enterprise Linux (RHEL) OS. The OpenShift Container Platform adds developer and operations services, as well as advanced features for app development and modernisation.

The tertiary tier, OpenShift Platform Plus, builds on the OpenShift Container Platform to provide advanced security features, ‘day two’ management capabilities and a global container registry. It brings together all the aspects needed to build, deploy and run any application where OpenShift software runs, Red Hat claims.

Its launch has come alongside a set of managed cloud services tightly integrated with the Red Hat OpenShift platform to help organisations build, deploy and manage cloud-native apps across hybrid configurations.

Red Hat OpenShift Streams for Apache Kafka, Red Hat OpenShift Data Science and OpenShift API Management are being launched to ease the complexities of modern IT environments, while not compromising on productivity.

OpenShift Streams for Apache Kafka is designed to make it easier for customers to create, discover and connect to real-time data streams regardless of where they’re based.

OpenShift Data Science also offers organisations a way to develop, train and test machine learning models and export in a container-ready format.

OpenShift API management, meanwhile, reduces the operational cost of delivering API-first, microservices-based apps.

“To take full advantage of the open hybrid cloud, IT leaders need to be able to use the technologies that they need in whatever IT footprint makes sense for them,” said Red Hat’s executive vice president for products and technologies, Matt Hicks, at Red Hat Summit 2021.

“Red Hat managed cloud services effectively drops many barriers that have kept organisations from harnessing the full potential of the hybrid cloud. We believe eliminating the traditional overhead of managing cloud-scale infrastructure will spark a genesis moment for customers and open up a future of possibility where those barriers once stood.”

Red Hat OpenShift Platform Plus adds Advanced Cluster Security for Kubernetes, a standalone product developed from the firm’s recent acquisition of StackRox. This offers built-in Kubernetes-native security tools to safeguard infrastructure and management workloads through an app’s development cycle. This is in addition to Advanced Cluster Management for Kubernetes and Red Hat Quay. The former brings end-to-end visibility and control of clusters, while the latter provides a secure registry for a consistent build pipeline.

“We believe this version addresses the need for a hybrid cloud solution that we hear from our customers, and we’ll be working lead with customer-managed OpenShift across data centre, public and private cloud,” said senior vice president for cloud platforms at Red Hat, Ashesh Badani.

“This version also becomes a landing point for additional capabilities, and we have worked hard to reduce costs compared to purchasing any of these capabilities a la carte, and we will continue to offer all three versions so customers can best decide what’s appropriate for their use case, and subscribe to the best available version.”

One of the key appeals is it grants businesses system-level data collection and analysis, as well as more than 60 security policies out-of-the-box that can be enforced from the time apps are built to when they’re deployed.

RedHat OpenShift Platform Plus also lets organisations take a DevSecOps approach to security by integrating declarative security into developer tooling and workflows.

The three managed services, being launched in the coming months, build on Red Hat’s existing suite of OpenShift apps, allowing customers and partners to build an open Kubernetes-based hybrid cloud strategy.

Based on the open source Apache Kafka project, OpenShift Streams for Apache Kafka allows dev teams to more easily incorporate streaming data into their apps. Real-time data is critical to these apps, and provide more immediate digital experiences wherever a service is delivered.

OpenShift Data Science builds on Red Hat’s Open Data Hub project and provides faster development, training and testing of machine learning models without the expected infrastructure demands.

Finally, the OpenShift API Management managed cloud service offers full API management to Red Hat Oepnshift Dedicated, as well as OpenShift on AWS. This combines managed operations with native OpenShift integration to let organisations focus on the innovation side of things as opposed to the infrastructure.

Red Hat OpenShift API Management also enables customers to build their own API management program, with the capabilities to control access, monitor usage, share common APIs and evolve their overall application landscape through a single DevOps pipeline.

Red Hat has added a host of features to its flagship Red Hat Enterprise Linux (RHEL) platform to refine the product as a lightweight, production-grade operating system for edge computing.

With RHEL 8.4, which will launch in the next few weeks, the company is adding Linux container deployment and management capabilities scaled for the intensive demands of edge computing. The latest version of the flagship operating system adds container images, enhanced management of edge deployments at scale, and automatic container updates.

Together, these improvements comprise the foundational layer for the ‘Red Hat Edge’ initiative, which aims to extend the capabilities of the firm’s hybrid cloud portfolio to edge computing across various industries. The segments being targeted initially include telecoms, transport, as well as smart vehicles.

“The vision of open hybrid cloud - that sort of build once and deploy anywhere - that gets extended to the edge as we have seen this incredible thirst for the capabilities that edge can bring,” said senior vice president and general manager for Red Hat Enterprise Linux, Stefanie Chiras, speaking on a panel at Red Hat Summit 2021.

“As we look at what we have done with open hybrid cloud, edge becomes that next extension for us to broaden out that hybrid cloud, bringing that choice that our platform delivers out into edge use cases.”

“To me when we look at our value in edge, it fundamentally comes to our capabilities in Linux. What we’ve done in RHEL, how we’ve built that out to be the heart of an ecosystem, and a stable, secure platform, how we’ve brought that into the OpenShift platform to deliver Kubernetes and management around containerisation - all of that consistency is critically important when we get out to the edge.”

With updates to Podman, RHEL’s open standards-based container engine, the platform will help to maintain standardisation and control across several Linux containers, which is critical to edge deployments.

There’s also new functionality to Image Builder, a tool that creates customised deployable operating system images for a variety of users. This tool supports the creation of installation media tailored for bare metal, which helps IT teams maintain a common foundation across disconnected edge environments.

Finally, the Red Hat Universal Base Image (UBI), which allows containers to retain RHEL’s traits such as security at the application level, is now available in a lightweight micro image. This makes it ideal for building redistributable, cloud-native app standardisation on an enterprise-grade Linux foundation, minus the overhead of an entire operating system deployment.

The latest version of RHEL also adds a few non-edge-oriented features, including greater flexibility for cloud-based applications, more simplified and automated system configuration and management, as well as greater security.

AWS and Red Hat have jointly launched a managed service that allows customers of both companies to manage containerised applications through the cloud.

With Red Hat OpenShift Service for AWS (ROSA), Red Hat customers can create cloud-based Kubernetes clusters, as well as build and scale their containerised applications, without needing to manage any underlying infrastructure.

ROSA allows businesses to more smoothly move on-prem Red Hat OpenShift workloads to AWS, with this managed service available alongside tighter integrations with a suite of AWS services.

Existing AWS customers can also take advantage of the partnership by deploying container clusters without needing to go through Red Hat. Billing, as well as technical support, is handled directly through AWS, with no up-front investments, and customers charged only for the container clusters and nodes they use.

“Increasingly, customers are turning to containers to improve application velocity and portability, and they’re growing to rely on technologies like Red Hat OpenShift and AWS that make it easier to deploy containerised applications,” said AWS’ GM Kubernetes, Bob Wise.

“ROSA gives these customers the ability to seamlessly run containers on AWS using familiar Red Hat OpenShift APIs and tooling, and integrates the full breadth and depth of AWS services to build, scale, and manage their workloads.”

Red Hat’s OpenShift platform is a family of containerised software products. The flagship Container Platform serves as an on-premises platform as a service (PaaS) system built around Docker containers and managed by Kubernetes.

Many OpenShift customers have in the past been required to manage OpenShift clusters on top of AWS deployments by themselves, with much more work required to make it happen, including maintaining two vendor relationships. Using ROSA will allow them to create Kubernetes clusters using OpenShift APIs and tools while being able to access a variety of AWS services from within the AWS console.

With ROSA, AWS claims Red Hat customers can access the breadth of its compute, database, analytics, machine learning, networking, and mobile services in order to build secure and scalable applications much faster.

Each ROSA cluster comes with a fully-managed control plane and application nodes. Installation, management, maintenance, and upgrades are monitored by Red Hat’s site reliability engineering (SRE) division with joint Red Hat and Amazon support. Cluster services, such as logging, metrics, monitoring, are also available.

Customers can acquire the service directly from the AWS console on their own. As with other AWS services, such as elastic compute cloud (EC2), organisations spin up OpenShift clusters and will be charged based on consumption. Customers can also contact their Red Hat or AWS representative to purchase ROSA clusters.

“Red Hat OpenShift provides a common, open and enterprise-grade Kubernetes platform to span hybrid infrastructure, from a customer’s physical datacenter to their operations in AWS,” said Red Hat’s VP for Hosted Platforms, Sathish Balakrishnan.

“ROSA provides a streamlined process for organizations that want to extend the power of Red Hat OpenShift in AWS without having to manage separate technology streams, enabling IT teams to focus on delivering value and not managing underlying infrastructure.”

Google Cloud is offering free training for data analytics, AI, machine learning and multi-cloud services, which include routes to foundational certificates, the company has announced.

Budding learners can access all of these through a set of 'skills challenges' which give participants greater knowledge of each subject and a chance to earn a Google skill badge to prove their competency.

While not as expansive as last year's pledge by AWS to offer free cloud training to 29 million people around the world, it does provide significant access and insight into some of the most popular cloud services in use today.

Participants will have 30 days of free access to Google Cloud Labs to work their way through four skill challenges: 'Getting Started', 'Data Analytics', Hybrid and Multi-cloud' and finally 'Machine learning and Artificial Intelligence'.

Each skill badge is a foundational certificate, which requires participants to complete a series of hands-on labs and a final assessment. The Getting Started course also requires the learner to demonstrate core infrastructure skills, including how to write cloud shell commands, deploy a virtual machine, and run applications on Kubernetes.

The Data Analytics course is for more experienced participants to expand their skills into AI and machine learning with a chance to demonstrate an understanding of BigQuery. They can learn how to do everything from writing and troubleshooting SQL queries and using Apps Script, to building classification and forecasting models.

The Hybrid and Multi-cloud course is for more advanced learners ready to showcase their skills in managing containers with Google Kubernetes Engine and Anthos. Here they can also test their skills in security by deploying and managing production environments with Google Kubernetes Engine.

The final course, Machine Learning and Artificial Intelligence, is for data scientists and machine learning engineers ready to prove their skills with BigQuery, Cloud Speech API, AI Platform, and Cloud Vision API.

All learners can register for an introductory webinar to Google Cloud, which will include a walk-through of the skill tracks and a tour of the labs.

Red Hat has announced the general availability of its common Kubernetes foundation for Windows and Linux container workloads: Red Hat OpenShift Support for Windows Containers.

Containers allow organizations to package and run Windows and Linux applications on-premises and in the cloud. With Red Hat’s new service, enterprises can simultaneously manage Linux and Windows-based containerized workloads, eliminating the need for parallel software processing across hybrid cloud environments.

“Red Hat OpenShift already provides enterprises with a powerful foundation to connect workloads across the hybrid cloud and with each new feature or capability we aim further that mission,” said Ashesh Badani, senior vice president of cloud platforms at Red Hat.

“With Red Hat OpenShift Support for Windows Containers, organizations no longer need to manage separate IT stacks for their Linux and Windows containers — helping to break down silos and make it easier for enterprises to pursue their cloud-native agenda.”

Red Hat said OpenShift Support for Windows Containers uses the certified OpenShift operator Windows Machine Config Operator (WMCO) to manage Windows containers within the OpenShift console.

With WMCO as the linchpin, the platform orchestrates Red Hat Enterprise Linux and Windows to run as building blocks of applications. Organizations can choose to run Windows containers on Red Hat OpenShift across the open hybrid cloud, including bare-metal servers, AWS, Google Cloud, IBM Cloud, Microsoft Azure, and, in the future, VMware vSphere.

Furthermore, Red Hat OpenShift Support for Windows Containers provides organizations with the ability to move Windows containers to Red Hat OpenShift without entirely rewriting the code.

The platform can help lower deployment costs for containerized workloads in heterogeneous IT environments and improve productivity and DevOps agility by providing cloud-native management.

Finally, Red Hat says the platform can increase applications’ survivability across hybrid cloud environments, including public cloud deployments and edge installations.

Over two million container images hosted on the Docker Hub repository harbor at least one critical vulnerability, according to new research.

In an analysis carried out by cyber security firm Prevasio on four million image containers, over half (51%) contained at least one critical vulnerability.

The research also found incidents of container images carrying embedded malware. It found 6,432 malicious or potentially harmful containers, representing 0.16% of all publicly available images at Docker Hub.

“Our analysis of malicious containers also shows that quite a few images contain a dynamic payload. That is, an image in its original form does not have a malicious binary. However, at runtime, it might be scripted to download a source of a coin miner, to then compile and execute it,” said Sergei Shevchenko, CTO at Prevasio.

In its report, Prevasio said if a developer takes a shortcut by fetching a pre-built image instead of composing a new image from scratch, there’s a viable risk that such pre-built images might come with a Trojan installed. If such an image ends up in production, the attackers may potentially access such containerized applications remotely via a backdoor.

Mark Bower, senior vice president at Comforte AG, told IT Pro that platforms like Kubernetes enable immense application delivery power. However, the built-in security controls reflect classical data-at-rest and transport encryption, perimeter, and access control-based security.

“While these controls are important, the last decade has seen leading enterprises and data processors shift towards data-centric over perimeter controls to combat advanced malware, ransomware and insider risk to sensitive data,” Bower said.

“Fundamentally, to thwart the variations of malware and attacks from misconfiguration or API exploitation, a data-centric approach is vital even with advanced container and app orchestration ecosystems to avoid data compromise or attacks that can create havoc for data-hungry enterprises depending on them.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told IT Pro that when selecting an image from Docker Hub, a development team is implicitly stating that they trust the security practices of the author of that container image.

“Such implicit trust is risky from a security perspective, which is why many organizations are now creating hardened container images where the image hardening process is managed by a dedicated team skilled in operating system hardening which is separate from the core development team.

"These hardened images are then pushed to an internal registry and policies are defined that only allow images originating from hardened images in that internal registry to execute in a production cluster,” Mackey said.

We’re now getting used to the idea of virtual conferences, but while they work very well at getting the information across, what’s often lacking is the shock when any organisation or vendor establishes a new path or announces a new direction.

The recent Cloud Foundry Summit is a case in point. The open source software organisation has coalesced its offerings around Kubernetes and announced several new projects to support the container technology, but according to Cloud Foundry Foundation executive director Chip Childers, this decision wasn’t straight forward.

“There was a split opinion around the community,” Childers told attendees, “just how much should we accept and embrace Kubernetes.” It was a difficult decision, as Kubernetes was emerging as a de facto standard for containerisation but, on the other hand, there was a definite feeling that it was not really a part of the Cloud Foundry ecosystem.

That’s all now changed. The organisation has thoroughly embraced the technology. “Kubernetes is the new infrastructure, it’s going to be ubiquitous,” he said.

It’s a view that’s been whole-heartedly supported by the vendors in the Cloud Foundry ecosystem. Ian Andrews, VP of marketing for VMware Tanzu says that “the concentration on Kubernetes was a view very much shared by the team at VMware”.

What helped the decision making process is a number of mergers and acquisitions in the ecosystem – notably VMware’s purchase of Pivotal – and that set the path for a new direction.

Mainstream clout

Andrews says the deal combined the best of both worlds; Pivotal had created a name for itself in the Cloud Foundry community, “but had a relatively small number of users. VMware with its user base in the tens of thousands added that Cloud Foundry expertise to its range of products.” This integration has seen the emergence of the Tanzu brand, a means of adding Kubernetes to the VMware portfolio.

The concentration on Kubernetes and the enhanced participation of VMware has definitely provided a boost to Cloud Foundry, which perhaps has never quite had the clout it should, even though it’s a well-established platform and, most importantly of all, has a thriving, almost fanatically devoted user base.

This has meant that it could never be ignored but, at the same time, it’s never permeated public consciousness. “Cloud Foundry has one major problem,” says Bryan Betts, principal analyst for Freeform Dynamics, “within the open source community it’s seen as rather like your dad’s open source: It’s been around for some time and it’s seen as rather dull.”

In most areas of IT, longevity would be seen as a bit of an asset. There are too many flavours of the month that attract a heap of interest, generate plenty of hype and vanish as quickly as they appear. In such a world, Cloud Foundry’s robustness and stability should be cherished but, as Betts points out, that's not always been a positive sign within the open source world.

“What Cloud Foundry has been doing has been very exciting. Some of the things that they were doing two or three years ago were ahead of their time and were precursors of the whole microservices movement – that’s now been forgotten. Cloud Foundry is finding that perception is all – and this is an industry built on perception.”

It’s something that the Foundation dearly wants to change. It hopes that its new found wholesale adoption of Kubernetes will provide Cloud Foundry with the kick-start it needs.

Applying a devops model

The first of the projects revealed to the wider world at the summit is CFfor-K8s, software aimed at making the transition to Cloud Foundry easier. CF-for-K8s enables users to run Cloud Foundry instances on top of a Kubernetes platform – offering what the Foundation claims is an easy integration between the two technologies. Childers claims that the new project would enable users to spin up Cloud Foundry within just ten minutes – a big claim, considering that Cloud Foundry hasn’t always been the most intuitive pieces of software.

The flipside of CF-for-K8s is KubeCF, which offers a way for Cloud Foundry users to run Kubernetes. This is more established software, however, and it was version 4.5 that was released at Cloud Foundry Summit.

Freeform Dynamics’ Betts says that one way of thinking about the relationship between CF-for-K8s and KubeCF would be to consider the devops model. “Think of CF-for-K8s as being the dev side will KubeCF is the ops part – and that part is just as important,” he says.

The third new release is a new version of Stratos, the management console for Cloud Foundry clusters. The new version, 4.2, adds support for native Kubernetes clusters and Helm chart repositories.

All of these show how Kubernetes is beginning to be more integrated into the ecosystem and there’s a hope in the Foundation that this will herald a new boost to adoption. Childers sees plenty of opportunity for growth. “There’s a perception that Cloud Foundry is only for large corporations; if that were true, it’s because that’s where the skillset was,” he said.

He sees plenty of opportunity for small companies to use Cloud Foundry – the closer integration with Kubernetes will provide a pathway for these users.

This is still a growing area for a lot of smaller organisations and there’s plenty of new opportunity now for growth. The Cloud Foundry project may have been slow to recognise the significance of Kubernetes but it’s catching up now and is using it as a springboard for new areas. Current systems are immensely complicated, says Andrews, but this is changing, the embrace of Kubernetes will help. “We’re getting to that moment of peak complexity, we’ve climbed the mountain and on the downwards slope,” he adds.

Betts sees the potential for Cloud Foundry if they can crack this perception issue. “There are people who have started new projects and found it’s something that Cloud Foundry already does.” He says that the Foundation has all the right elements in place but users have to be informed. “They have to know it’s there and have to know what to do with it,” he says. It seems that the Foundation is on the right path to do that.

IBM has said it has reached an agreement to acquire cloud application management startup Instana for an undisclosed sum.

The Chicago-based company's main product is a service that can monitor the performance of complex cloud applications over both public and private environments, on-premise and mobile devices. It has an 'observability platform' that can analyse cloud applications to both prevent and fix IT issues, such as slow response times or even services that are fully down.

IBM says it plans to integrate Instana's system into services such as Watson AIOps, where AI would be used to trigger alerts and speed up IT remedies. Such a service would eliminate the need for employees to manually monitor and manage the applications, freeing them up to focus on more innovative or "higher-value" work, according to IBM.

The deal represents IBM's first major cloud move since its decision to fully separate its cloud and infrastructure units by the end of 2021, spinning the latter off as a public company. It's thought that the acquisition of Instana will be used to offer customers new ways to manage complex hybrid and multi-cloud environments, particularly as the service can be used for monitoring containerised environments running Kubernetes.

"Our clients today are faced with managing a complex technology landscape filled with mission-critical applications and data that are running across a variety of hybrid cloud environments - from public clouds, private clouds and on-premises," said Rob Thomas, senior vice president, cloud and data platform at IBM.

"IBM's acquisition of Instana is yet another important step that we are taking to provide companies with the most complete portfolio of AI-automated solutions to tackle this enormous challenge and help prevent unforeseen IT incidents that can cost a business in lost revenue and reputation."

Cisco has announced plans to acquire Hungarian container security startup Banzai Cloud, as the networking giant looks to further expand its portfolio of cloud-native technologies.

The deal is expected to close at the end of this quarter for an undisclosed sum and follows hot on the heels of Cisco’s takeover of cloud-native security company Portshift back in October.

Founded in 2017, Budapest-based Banzai Cloud offers a Kubernetes-based platform that is designed to help businesses develop and deploy cloud-native applications.

The firm's assets and employees will now become part of Cisco’s Emerging Technologies and Incubation group, which focuses on incubating new projects for cloud-native networking, security and edge computing environments for modern distributed applications.

In a blog post, Liz Centoni, SVP of Cisco's Emerging Technologies and Incubation group, explained that the move would help the company address the challenges presented by modern cloud-native applications and their environments.

"This team has demonstrated experience with complete end-to-end cloud-native application development, deployment, runtime and security workflows," Centoni said.

"They have built and deployed software tools that solve critical real-world pain points and are active participants in the open-source community as sponsors, contributors and maintainers of several open-source projects.”

The acquisition is the latest move in Cisco's push to grow its cloud security portfolio, following its acquisition of Israeli startup Portshift last month for a reported $100 million.

The Tel-Aviv-based business provides a Kubernetes-based platform to secure containers and serverless applications and will also fall under Cisco’s Emerging Technologies and Incubation umbrella.

"These two cross-border acquisitions are a testament to the globalisation of the cloud-native ecosystem and underscore our commitment to hybrid, multi-cloud application-first infrastructure as the de facto mode of operating IT," Centoni added.

"The Emerging Technologies and Incubation team’s mission is to incubate impactful technologies and to attract, foster and grow the global talent needed to drive innovation and support our customers' digital transformation initiatives.”

There’s little doubt containerisation has changed the way applications are designed, built, deployed and maintained, by providing the velocity and improved time-to-market essential to help companies differentiate from the competition.

Unfortunately, containers also introduce complexity. Kubernetes does make it easier to deploy and operate applications in a microservices architecture; however it’s also difficult to manage at scale as it doesn’t address some very basic—and very important— issues.

Learn how to leverage modern application architectures and deployment methodologies to deliver a better customer experience in this whitepaper, without inadvertently compromising that customer experience with downtime, bugs, or latency.

Malware that has remained undetected for six months is exploiting misconfigured Docker API ports to launch malicious payloads, while abusing the Dogecoin cryptocurrency blockchain in the process.

The malware, known as ‘Doki’, is targeting misconfigured containerised environments hosted on Azure, AWS, and a number of other major cloud platforms, according to Intezer researchers, with attackers able to find publicly accessible Docker API ports and exploit them to establish their own containers.

Doki is then able to instal malware on targeted infrastructure based on code received from its operators, spawning and deleting containers during the process.

Doki serves as an undetectable Linux backdoor, and represents an evolution of the two-year-old Ngrok Botnet campaign. Alarmingly, it has also managed to evade every one of the 60 malware platforms listed on VirusTotal since it was first analysed in January 2020.

This particular strain is unusual in the sense that it abuses the Dogecoin cryptocurrency blockchain in order to attack these containerised environments. The attackers use a fairly ingenious method to prevent the botnet infrastructure from being taken down, which involves dynamically changing the command and control (C2) server's domain based on the transactions recorded on a Dogecoin wallet.

The C2 domain address, from which the payload is sent, changes based on the amount of Dogecoin in the wallet at any given time. When a cryptocurrency is added or removed from the wallet, the system encodes the transaction and creates a new unique address from which they can control the Doki malware.

Because of the secure and decentralised nature of Blockchain, this infrastructure can't be taken down by law enforcement, and new addresses can't be pre-empted by others as only the attackers can make transactions on their Dogecoin wallet.

“Linux threats are becoming more common. A contributing factor to this is the increasing shift and reliance on cloud environments, which are mostly based on Linux infrastructure,” said researchers Nicole Fishbein and Michael Kajiloti. “Hence, attackers have been adapting accordingly with new tools and techniques designed specifically for this infrastructure.”

Historically, the Ngrok Botnet has been one of the most prevalent threats abusing misconfigured Docker API ports in such a way to execute malware, they added. As part of the attack, the hackers would abuse Docker configuration features to elude container restrictions and execute various payloads from the host.

Such threats also deploy network scanners to identify the cloud providers’ IP ranges for additional potentially vulnerable targets. What makes it so dangerous is that it only takes a few hours from when a misconfigured Docker server is online to become infected.

Meanwhile, because the cryptocurrency blockchain the hackers abuse is immutable and decentralised, Fishbein and Kajiloti added, the method is resistant to infrastructure takedowns as well as domain filtering attempts.

Hackers can create any container as part of the attack, and execute code from the host machine by exploiting a container escape method. This is based on creating a new container, which is achieved by posting a ‘create’ API request.

Each container is based on an alpine image with curl installed, which isn’t malicious in and of itself, rather it’s abused to execute the attack with curl commands, activated as soon as the container’s up and running.

Hackers then abuse the Ngrok service, which provides secure tunnels connecting between local servers and the public internet, to craft unique URLs with a short lifetime, using them to download payloads during the attack by passing them to the curl-based image.

“The Ngrok Botnet campaign has been ongoing for over two years and is rather effective, infecting any misconfigured Docker API server in a matter of hours,” added Nicole Fishbein and Michael Kajiloti. “The incorporation of the unique and undetected Doki malware indicates the operation is continuing to evolve.

“This attack is very dangerous due to the fact the attacker uses container escape techniques to gain full control of the victim’s infrastructure. Our evidence shows that it takes only a few hours from when a new misconfigured Docker server is up online to become infected by this campaign.”

The researchers have recommended that both companies and individuals who own cloud-based container servers must immediately fix their configuration settings to prevent exposure to the threat. This process includes checking for any exposed ports, verifying there are no foreign or unknown containers among existing containers, and monitoring excessive use of computing resources.

Docker is expanding its collaboration with AWS to make its Compose and Desktop tools easier to use in container ecosystems.

The compose and desktop developer tools will be integrated with AWS Elastic Container Service (ECS) and ECS on AWS Fargate.

The container ecosystem has become complex, according to Docker. What used to be a simple case of A talking to B and B talking to a database, has expanded due to new managed container services. The complexity of it is helpful to operational teams that might want more control, but it makes it tougher for developers.

"With a large number of containers being built using Docker, we're very excited to work with Docker to simplify the developer's experience of building and deploying containerised applications to AWS," said Deepak Singh, the VP for compute services at AWS.

"Now customers can easily deploy their containerised applications from their local Docker environment straight to Amazon ECS. This accelerated path to modern application development and deployment allows customers to focus more effort on the unique value of their applications, and less time on figuring out how to deploy to the cloud."

A similar integration was announced in May for Microsoft Azure, shortening the developer commute for Azure Container Instances, highlighting Docker's more developer-focused strategy. The company surprised many when it sold its enterprise business to Mirantis in 2019, but its reasoning was to solely focus on cloud-native development.

"Going forward, in partnership with the community and ecosystem, we will expand Docker Desktop and Docker Hub's roles in the developer workflow for modern apps," said CEO Scott Johnston.

"Specifically, we are investing in expanding our cloud services to enable developers to quickly discover technologies for use when building applications, to easily share these apps with teammates and the community, and to run apps frictionlessly on any Kubernetes endpoint, whether locally or in the cloud."

If you’re at all involved in the world of IT, it’s almost inevitable that you’ll run into containers at some point. In many ways, they’re the engine that powers the modern web, and the technology is gaining popularity among organisations of all sizes as a tool for developing robust, highly-scalable applications.

However, while you’re almost certainly aware of containers, you might not necessarily be familiar with how they came to be so beloved by software developers. The history of containers is rooted in the concept of process separation - sandboxing services running on the same hardware, for reasons of security, resource monitoring and other concerns. While the concept is similar to (and in some aspects an evolution of) virtualisation, the two are slightly different.

The first real forerunner of the technology was FreeBSD’s ‘jails’ feature. Released in 2000, this allowed admins to split FreeBSD systems into smaller independent environments. Jails were followed in 2006 by Google’s Process Containers, which isolated and controlled the resources for a small collection of processes, which in turn evolved into LXC, and eventually Docker. Docker offered the first fully-fledged container management ecosystem, and when it hit the scene in 2013, it immediately started making waves.

The next several years saw rapid advancements, as innovative startups and tech providers pushed the bleeding edge of container development forward, while slow and careful enterprise adoption ensured that it continued to grow in maturity. Over time, the Google-created Kubernetes container orchestration system came to be seen as an implementation of the technology that was stable and enterprise-friendly enough to merit mainstream adoption, and containers have now become an accepted element of infrastructures around the world.

Contain your excitement

Part of the reason that these services - and containerisation in general - were so popular, was that they gave administrators much more control over how and where they ran their apps. While virtualisation had been around since the 90s, every virtual machine runs its own separate clone of an operating system whereas containers run on top of a single OS, sharing the elements that they need to while keeping their own binaries and dependencies safely isolated.

In addition to the actual application or process it’s housing, a container also includes an individual copy of the exact binaries and configuration files required to run that specific application in the exact way its creators intended. This ensures that it will run predictably in any environment, without the prospect of different software versions introducing compatibility issues.

For this reason, containers are incredibly portable; they are pre-packaged with only the software they need in order to run, which means they can be dropped onto any OS without requiring extra configuration or software installation. They’re also much more lightweight than VMs, because multiple containers can share the same OS, rather than each application requiring its own instance. They take up less space, require fewer resources and boot much faster than VMs, which is a big bonus for efficiency-seeking businesses.

A further advantage of containers is that they allow for a modular approach to application development. Rather than constructing an application inside a single giant VM, organisations can break an application up into its constituent elements and run them in individual containers. This means that if one element experiences an issue, it doesn’t bring the whole application down with it; furthermore, it enables developers to swap components out as and when they need to without having to rebuild the whole application.

Containerised applications are more portable, more resilient, cheaper and faster to run than many bare-metal or VM-based applications, but because they can be quickly and easily duplicated, they’re also more scalable. This makes them perfect for web-based applications, which may need to be hosted across cloud, on-prem or hybrid environments, and thus benefit hugely from the predictability and low resource consumption that containers offer. The vast majority of web-scale SaaS applications are delivered via containers, and they’re ideal for services that need to be fast, stable and responsive.

Architecting for success

There are many benefits to containerisation, but while all this may sound disarmingly easy, an effective container delivery strategy requires more than just knowing how to use Docker or Kubernetes. A number of complementary and supporting functions are necessary to properly utilise containers. Most of these functions revolve around principles of agile and DevOps; part of the appeal of containers is the ability they provide to rapidly iterate on software, but they also require rapid iteration in order to maximise their impact.

Continuous integration and continuous delivery (CI/CD) are often key to this. Using these processes allows containers to be built, improved, tested and fed into an organisation’s infrastructure at rapid pace with minimal downtime. Proper use of continuous testing also means that these containers will be more stable, and ongoing monitoring as part of a good DevOps programme will enable organisations to quickly detect and remedy any faults.

So are containers set to dominate the enterprise landscape, pushing out VMs and establish a position as the only real way to run applications? Well, not quite. VMs still have their uses; they’re better suited to instances where a diverse set of operating systems need to be run on the same server, and as VMware CEO Pat Gelsinger is fond of pointing out, most hyperscale public cloud providers actually run their containers inside virtual machines.

The reality for most businesses will instead likely be a mixed estate, with containers and VMs utilised in parallel for different workloads. What we are going to see, however, is a continual increase in container adoption within the enterprise, as tooling gets more sophisticated and easier to integrate with existing technologies and workflows. This mixed approach will also extend to the infrastructure that containers run on; while the scalable nature of containers makes them a natural fit for public cloud services, these benefits can also be achieved in hybrid or on-premise systems by utilising the flexible consumption models and easy on-premise scaling offered by HPE’s Greenlake IT as a service portfolio.

We may also hit a talent crunch; container management is already one of the most highly sought-after skills in the IT industry, and as it grows in importance, the demand for competent container architects could spark bidding wars and talent shortages. Businesses who want to implement containerised applications without engaging in these bidding wars, however, can also make use of HPE’s Pointnext Services, which apply the industry giant’s expert talents and specialisations to the construction, architecture and operation of its customers’ IT estates, with deep knowledge of cutting edge container technologies like Kubernetes, Mesosphere and Docker. The combination of Pointnext and Greenlake allows customers, with HPE’s assistance, to construct a flexible, performant and robust container architecture, which can be run on Greenlake infrastructure and scaled up, down and out as their capacity needs evolve.

The key for businesses who want to put themselves at the head of the curve is to look at their roadmaps, and figure out how they want to integrate containers into their ecosystems in years to come. That way, they can gradually build their competency over time, without having to suddenly pivot years down the road. Put simply - containers are here to stay.

Discover more about HPE GreenLake

It’s no secret that containers have been taking the software development world by storm in recent years, with companies including VMware, Red Hat and more talking up their benefits for developing cloud applications quickly and at scale. But why exactly is there so much buzz around them? What are they good for? And how difficult is it for companies to establish a container competency?

In this week’s episode, we talk to Canonical’s vice-president of worldwide field engineering Nicholas Dimotakis to find out why software developers around the world have been jumping on board the container train, and what benefits it can bring for enterprises who want to scale their applications.

Elsewhere, we talk about why beleaguered videoconferencing service Zoom has hired Facebook’s former CSO, Nvidia’s role in fighting coronavirus, and how social media has led to some people setting 5G masts on fire.

Footnotes

News

• Zoom hires ex-Facebook CSO Alex Stamos to boost platform security
• Who has banned Zoom and why?
• Nvidia joins the digital coronavirus fight
• What is the 5G health scare?

In-depth

• What is Kubernetes?
• Mirantis snaps up Docker's enterprise platform
• Move over VMs, the future of app deployment is in containers
• VMware launches vSphere 7 and Tanzu container management tools
• Why container tech is the backbone of DevOps
• The IT Pro Podcast: DevOps for fun and profit
• Getting started with Docker
• Getting started with Kubernetes

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Container systems like Docker are a popular way to build 'cloud native' applications designed for cloud environments from the beginning. You can have thousands of containers in a typical enterprise deployment, and they're often even more ephemeral than virtual machines, appearing and disappearing in seconds. The problem with containers is that they're difficult to manage at scale, load balancing and updating them in turn via the command line. It's like trying to herd a bunch of sheep by dealing with each animal individually.

Enter Kubernetes. If containers are sheep, then Kubernetes is your sheepdog. You can use it to handle tasks across lots of containers and keep them in line. Google created Kubernetes in 2014 and then launched the Cloud Native Computing Foundation (CNCF) in partnership with the Linux Computing Foundation to offer it as an open project for the community. Kubernetes can work with different container systems, but the most common is Docker.

One problem that Kubernetes solves is IP address management. Docker manages its own IP addresses when creating containers, independently of the host virtual server's IP in a cloud environment. Containers on different nodes may even have the same IP address as each other. This makes it difficult for containers on different nodes to communicate with each other, and because containers on the same host share the same host IP address space, they can't use the same ports. Two computers on the same node can't each expose a service over port 80, for example.

Understanding Kubernetes pods and clusters

Kubernetes solves problems like this by grouping containers into pods. Each container in a pod has the same IP address, and they can communicate with each other on localhost. It exposes these pods as services (an example might be a database or a web app). Collections of pods and the nodes they run on are known as clusters, and each container in a clustered pod can talk to containers in other pods using Kubernetes' built-in name resolution.

You can have multiple pods running on a node (a physical or virtual server). Each node runs its own Kubelet, which ensures that a cluster is in the correct state, along with a kube-proxy, which handles network communication for the pods. Nodes work together to form a cluster.

Kubernetes manages all this using several components. The first is the network overlay, which handles networking between different pods. You can install a variety with a range of capabilities, including advanced ones like the Istio service mesh.

The second component is etcd, which is a database for all the objects in the cluster, storing their details as a series of key:value pairs. etcd runs on a master node, which is a machine used to administer all the worker nodes in the cluster. The master node contains an API server that acts as an interface for all components in the cluster.

A node controller running on the master node handles when nodes go down, while a service controller manages accounts and access tokens so that pods can authenticate and access each other's services. A replication controller creates running copies of pods across different nodes that run the same services, sharing workloads and acting as backups.

Installing and running Kubernetes

Installing Kubernetes will be different on each machine. It runs not just on Linux, but also on Windows and macOS. In summary, you'll install your container system (usually Docker) on your master and worker nodes. You'll also install Kubernetes on each of these nodes, which means installing these tools: kubeadm for cluster setup, kubectl for cluster control, and kubelet, which registers each node with the Kubernetes API controller.

You'll enable your kubelet service on each of these nodes so that it's ready to talk to the API. Then initialise your cluster using the kubeadm command kubeadmin init for your master node. This will give you a custom kubeadm join command that you can copy and use to join each worker node to the cluster.

After this, you can create a pod. You define the pod's characteristic using a configuration file known as a PodSpec. This is often written in YAML ("YAML ain't markup language"), which is a human- and machine-readable configuration format. Your YAML file will define the name space that your pod exists in (you can name Kubernetes clusters differently so that you can run multiple clusters on the same physical machine).

The PodSpec also defines the details for each container inside the pod, including the Docker images on which they're based. This file can define a pod-based volume for them in the same pod so that they can store data on disk and share it. You can create a pod using a single command - kubectl create - passing it the name of your YAML file.

Running copies of a pod for resilience and workload sharing is known as replication, and a collection of replicated pods is called a replica set. While you can handle replica sets directly, you'll often control them using another kind of Kubernetes object known as a deployment. These are objects in the Kubernetes cluster that you use to create and update replica sets, and clear them away when you're done with them. Replica sets can contain many pods, and a deployment gives you a strategy to update them all (adding a new version, say).

A YAML-based deployment file also contains a PodSpec. After creating a deployment (and therefore its replica pods) using a simple kubectl create command, you can then update the whole deployment by changing the version of the container image it's using. Do this using kubectl set image, passing it a new version number for the image. The deployment now updates all the pods with the new specification behind the scenes, taking care to keep a percentage of pods running at all times so that the service keeps working.

This is all great, but how do we actually talk to and reference these pods? If we have, say, ten web server pods in a replica set, we don't want to work out which one's IP to visit. That's where Kubernetes' services come in. We define a service that exposes that replica set using a single IP address and a service name like 'marketing-server'. You can connect to the service's IP address or the service name (using Kubernetes' DNS service) and the service interacts with the pods behind the scenes to deliver what you need.

That's a short introduction to Kubernetes. As you can imagine, there's plenty more to learn. If you're hoping to manage native cloud services in any significant way, you're going to bump up against it frequently, so it pays to invest the time in grokking this innovative open source technology as much as you can. With Kubernetes now running on both Amazon Web Services and Azure alongside Google's cloud service, it's already behind many of the cloud services that people use today.

Amazon Web Services has unveiled a free open source operating system called Bottlerocket, designed specifically to run containers on bare metal or virtual machines.

Bottlerocket is being pitched as a purpose-built operating system designed with a single-step process to make it far easier to automate updates, while also cutting out much of the unnecessary elements found in general-purpose software.

Its biggest selling aspect is its dual partition setup, running as active and inactive. When an update is issued, the inactive side is changed first, with the system then switching the positions of the partitions in order to complete the update.

The OS also uses image-based updates, which means the update can be rolled back in its entirety if necessary, helping to reduce downtime and minimise process failure. This is in contrast to most general-purpose operating systems which use a package-by-package approach.

As part of the slimmed-down design, Bottlerock takes a different approach to authentication and secure login normally found on general-purpose systems. There's no SSH server to support secure logins, although users can use a separate container to access admin controls.

The new OS also supports all the container tools you might expect, including Docker images and anything conforming with the Open Container Initiative standard. The system is also built with some third-party components, including the Linux kernel, the container's runtime, and Kubernetes.

The OS is currently in a preview state, and is hosted on GitHub alongside a host of tools and documentation to support its use. Among these is a Bottlerocket Charter, which claims that the OS is open and "not a Kubernetes distro, nor an Amazon distro", adding that such a platform can only be built with the support of a wider community.

Despite its open nature, the OS is optimised to work best with AWS tools out of the box, specifically Amazon's Elastic Kubernetes Service (EKS).

The OS is currently available in a free public preview as an Amazon Machine Image (AMI) for Elastic Cloud Compute. Once released to general availability, Bottlerocket will come with three years of support, incorporated into AWS support plans at no extra cost.

VMware has announced the launch of a number of new Kubernetes-focused products, including the latest version of its vSphere platform.

Most of the new products fall under the company’s Tanzu portfolio, unveiled at last year’s VMworld.

Tanzu represents VMware’s efforts to integrate Kubernetes container management - which the company is betting big on as the next significant step in enterprise applications - with its existing VM management tools.

Three new Tanzu products are being introduced; first up, Tanzu Mission Control, a tool previewed as part of last year’s announcement which is designed to help enterprises manage multiple Kubernetes clusters across a range of environments, while centralising key functions like security, configuration management and data protection. It also allows businesses to hook VMware’s other management and monitoring tools (such as its Wavefront and CloudHealth products) into its Kubernetes workloads.

Following on from this is VMware’s new Tanzu Application Catalogue, which represents a way for customers to integrate open source components and tools from Bitnami's catalogue into their applications in a safe and secure way, by providing a curated repository of open source products that have been verified as stable and vulnerability-free.

For organisations at the start of their container projects, Tanzu Kubernetes Grid is being introduced as a ubiquitous container runtime, combining open source Kubernetes tooling, container images and registry and lifecycle management. Described by VMware as an evolution of its strategy with Enterprise PKS (which will remain as a separate offering), the aim is to make it easier to quickly start using Kubernetes in a consistent way across multiple environments, alongside existing VMware deployments.

Speaking of which, a new version of VMware’s flagship vSphere suite is also being introduced, and it includes a range of Kubernetes-friendly features. Previously teased as Project Pacific, vSphere 7 has been ‘fundamentally modernised’, according to VMware, and re-architected to put Kubernetes management at its heart.

VMs are not being forgotten about, of course - the goal is to enable VMware admins to easily run containers and VMs concurrently. vSphere 7 has also been optimised for simplified lifecycle management, allowing enterprises to manage hundreds or thousands of instances in less time, with fewer tools, including introducing REST and JSON-based APIs for automating lifecycle management tasks.

vSphere 7 also introduces greater security through remote attestation, where a trusted host is used to verify the integrity of other hosts within the network. Elsewhere, vMotion has been improved to allow for easier migration of large VMs with minimal disruption and the Distributed Resource Scheduler now runs every minute as opposed to every five minutes.

GPU virtualisation is now on offer too, thanks to the company’s recent acquisition Bitfusion, which is being touted as a particular benefit for those looking to run workloads using machine learning.

The aforementioned tools are also being rolled into VMware Cloud Foundation 4 with Tanzu, which includes vSAN 7 for managing virtualised storage.

“Kubernetes is still hard,” VMware CEO Pat Gelsinger said. “We're democratising Kubernetes into the industry, with the most powerful platform, the most powerful infrastructure community across multiple clouds; This for us is an important day, not just for us, but for our customers, and for the industry.”

VMware Tanzu Application Catalog, Tanzu Mission Control and Tanzu Kubernetes Grid are available now, while VMware Cloud Foundation 4 and VMware vSphere 7 are scheduled to be available by the start of May.

VMware vSphere and Promox have dominated the virtualization space for many years. The two companies are often the first choice for businesses that want to start digital journeys with open-source technology. 

Virtualization is the process of making the physical, digital; taking your desktop and making it virtual, for example. It is a key strategy within digital transformation, where hardware is often usurped for a digital version.

There are other providers – a larger selection of, in fact – which offer products and services for virtualization and also containerization. This can make choosing the right product a little difficult, particularly as you'll need to pit services against one another to see which is best suited to your operational needs.

There are other providers – a larger selection of, in fact – which offer products and services for virtualization and also containerization. This can make choosing the right product a little difficult, particularly as you'll need to pit services against one another to see which is best suited to your operational needs.

What is VMware vSphere?

VMware's vSphere is the cloud giant's most popular virtualisation service and it comes in two versions - Standard and Enterprise Plus. Enterprise Plus has more features, such as resource management and intrinsic security, whereas Standard is more of an entry-level option.

vSphere is a good choice for companies that have high-performance computing (HPC) workloads, such as artificial intelligence models or big data applications. It's also good for managing remote offices with little IT resources.

vSphere is a type of hypervisor software and management platform and it is now in its seventh generation. The Type 1 hypervisor is a bare-metal version that is known as 'ESXi'. This includes the OS kernel and a vCentre server management system.

The hypervisor works in a similar fashion to the average operating system as it is directly installed into a device. This allows users to create multiple virtual machines (VMs) for systems such as Windows, Linux, macOS, Solaris and more, all on a single machine, with the virtualisation handling a layer of storage.

Another bonus of ESXi is it can run on Intel processors (Xeon and up) and AMD Opteron and Epyc processors – this crosses both 32-bit and 64-bit guest operating systems, although 32-bit processors aren’t supported. ESXi uses a 64-bit VMkernel.

The hypervisor, which can be installed on a hard disk, USB device, or SD card, can support the following resources per host: 4,096 virtual processors, 512 VMs, 4TB of RAM and 320 logical CPUs.

VMware’s ESXi is available as a free download or as part of a paid package. Naturally, the free version provides only limited functionality and can’t be managed by Center (see below). vSphere is currently on its 7th iteration, first announced in March 2020, and is the first version to feature vSphere with Kubernetes, formerly known as Project Pacific.

VMware vCenter is a software suite that manages the whole of the VMware virtualisation infrastructure, acting as a single window. From here, the assignment of VMs to hosts is managed, as well as the assignment of resources to tasks, based on policies set by the administrator. A single instance of vCenter can manage up to 1,000 hosts at a time, across up to 10,000 active VMs or 15,000 registered VMs

It also enables the use of features such as vSphere Distributed Resource Scheduler (DRS), vSphere High Availability (HA), vSphere vMotion, and vSphere Storage vMotion. It also provides the API for vSphere and manages ESXi.

It can be installed on a supported version of Windows or used as a preconfigured Linux version known as vCenter Server Appliance. vCenter Server also permits Host Profiles, allowing users to define rules for specific ESXi hosts.

With the latest version of its virtualisation software - vSphere 7 - VMware has added full integration with Kubernetes, which it's touting as the "biggest vSphere innovation since the launch of the ESXi hypervisor". This means administrators can provision, run, and manage Kubernetes clusters on top of vSphere via the Kubernetes interface. Supporting both containers and VMs on a single platform allows vSphere 7 to run Kubernetes pods on VMs using the vSphere POD Service. VMware vSphere PODs can be managed like existing VMs.

What is Proxmox?

Proxmox is a complete open source server management platform for enterprise virtualisation. It was developed by Proxmox Server Solutions in Austria under the Internet Foundation of Austria and is released under the GNU General Public License.

It's a Debian-based Linux distribution with a modified Ubuntu LTS kernel. It enables the deployment and management of VMs and containers, such as KVM (Kernel-based VM) for VMs and Linux Containers (LXC) for containers, an OS-level virtualisation tool that has been included in Proxmox VE since version 4.0.

The software also includes a bare-metal installer, web-based management interface and many command-line tools. There is also a REST API to support third-party tools.

Admins can carry out all management tasks with the integrated graphical user interface (GUI). This interface is based on the ExtJS JavaScript framework and works with any modern browser.

Proxmox can be clustered across multiple server nodes for high availability. When deployed, the resource manager called Proxmox VE HA Manager monitors all VMs and containers on the whole cluster and automatically gets into action if one of them fails.

There is also an integrated live/online migration feature, this enables the movement of VMs from one Proxmox VE cluster node to another without any downtime. The process can be initiated by administrators with either scripts or the web interface.

The Proxmox Virtual Environment supports a maximum of 12TB of RAM and 768 logical CPUs per host. It also supports Intel EMT64 or AMD64 with Intel VT/AMD-V CPU flag.

It also features a built-in firewall that is customisable allowing configurations via GUI or CLI. Firewall rules can be set up for all hosts inside a cluster or define rules for VMs and containers only.

vSphere vs Proxmox

So, which one of these would be the optimal virtualisation tool for your company? It mostly depends on what features you are looking for and how much you are willing to spend.

For instance, business users might find ESXi to be quite limited when it comes to the variety of tools it offers in its free version, and is known to use proprietary technology to support virtualisation (VT-x for Intel processors and AMD-V for AMD processors). The closed off, proprietary product might not be the best match for organisations that are looking for more advanced offerings.

This is why larger companies might want to consider VMware vSphere Enterprise Plus, which is the new version of the programme following VMware’s decision to sunset the original vSphere Enterprise in 2019, with support for Enterprise licensing having ended in 2020. VMware vSphere is also more often used for business-critical applications and infrastructure as a service (IaaS). However, it does come at a higher price than other virtualisation tools, with costs depending on quantity as well as the level and duration of support, with customers being able to choose between one and three years.

For those looking for a more affordable tool, Proxmox might be a better option to consider. As a free, open source product based on other free, open source products (KVM, LXC, etc), it has all of its features enabled. As opposed to the other two tools, which are most often used in cloud computing and server consolidation, Proxmox is more suited to virtualised server isolation and software development.

Although it might not have the same scope of available tools as VMware vSphere, users tend to find the features it does have more useful. The tool can also be automatically configured to allow nodes to use the same shared storage when added to a cluster, which many will find more helpful than ESXi’s insistence that users do this manually.

FAQs

Containerized applications - and Docker - represent a way of packaging applications that contain all the required components in isolated images - or containers. Docker is one of the most popular platforms that enables containerized applications to be shipped, but beginners may find it difficult to get started.

Programmers of a certain vintage have fond memories of applications that included all of their dependencies at compile time. That approach was eventually dropped in favor of shared libraries, which made for smaller applications. 

However, what is appropriate for one application may not be suitable for another, meaning developers might be forced to adopt server virtualization or run applications on different devices in order to deal with dependency issues.

The solution to this is a move to containerized applications which are effectively microservices that include all the necessary dependencies.

Getting started with this technology and adopting containerization techniques can be daunting for experienced developers and beginners alike, particularly in light of container orchestration platforms such as Kubernetes.

While Kubernetes has gained in popularity over the years, it’s important to understand that it’s a container-orchestration technology - an API to control how and where containers should run. Creating those containers remains very much the domain of technologies such as Docker.

It is therefore vital to understand container technology and how this approach differs from traditional practices.

Docker tutorial for beginners: What is Docker?

Docker is a software platform that separates your applications from each other by running them in dedicated compartments called containers. A Docker container is like a virtual machine (VM) because it keeps its contents separate from other software running on a machine.

However, unlike a VM, which usually includes the operating system of the host machine, Docker containers share the services of a single operating system kernel. As such, containers tend to be less resource-hungry than VMs, and a single server or VM can run multiple containers simultaneously.

Docker tutorial for beginners: How does Docker work?

Because your new Docker installation doesn't have this image locally installed, it downloads it before running it. Open another command line window and type docker ps -a to show running and stopped containers.

The Docker Engine comprises dockerd - a daemon to take care of actions related to containers. It includes APIs to allow other applications to communicate with the daemon and a command line interface (CLI).

Docker tutorial for beginners: What is Docker used for?

Container technologies such as Docker solve issues faced by developers and users alike.

Back in your other terminal window, the Python interactive shell disappears and you're back at your system prompt. Close your second terminal window and go back to the original one.

Type docker ps -a again. Your container is still there; you've just stopped running it. If you want to run it again, you just repeat the same run command we used earlier, and this time Docker will run your local image.

Running many different software programs alongside each other can also take time and effort. What if different versions of the same program are required, for example? 

Docker helps solve these problems.

Docker tutorial for beginners: What is a Docker image?

An image is the basic building block of Docker and is usually a read-only template with instructions for creating a Docker container. Images tend to be based on another image. For example, an image might be based on an Ubuntu image customized for your specific application needs.

Think of it as a shopping list that tells a computer everything it needs for that container. 

If the requirement is simply to run an application in a Docker container, an appropriate image will likely be found in a Docker container registry. Registries contain images created and shared by other users.

While organizations can create their own registries for internal work, the most popular is the Docker Hub, which a Docker installation will automatically check.

The image is, however, read-only. To make things runnable, one needs to create a container from the image.

Docker tutorial for beginners: What is a Docker container, and how does it work?

A Docker container is effectively a runnable instance of an image. It can be created, started, stopped, moved, and deleted using the Docker API or CLI. It can be connected to networks or storage. New images can be created based on it.

However, while it is isolated from other containers, it is quite different from a VM. 

Whereas a VM hosts a whole operating system, a container doesn't. Neither do containers run on a type 1 hypervisor that replaces the computer's primary operating system, as many server-based VMs do.

Instead, Docker containers hold only the things needed to run a single software service, like a database or a web server. That includes the service itself, along with any dependencies it needs to run, like software libraries. 

This makes Docker containers lightweight because less storage and memory is required. It also makes them portable because developers or administrators can quickly move them between different machines while being sure they'll still run. 

Docker tutorial for beginners: How to build a Docker container with Docker images

The first requirement is the Docker Engine to organize and run containers, which it stores in a format called libcontainer. 

Docker Engine is installed differently depending on the target operating system. Windows needs Docker Desktop, and Mac needs Docker for Mac - both are installable as application downloads. A properly-prepared Linux distro needs a simple sudo apt-get install docker -y from the command line.

From there, you can create and run Docker containers.

More than likely, an appropriate image can be found in a Docker container registry, where users can share their creations - although, as with any resource, you must exercise care concerning the potential for malware.

While organizations can create their own registries for internal work, the most popular is the Docker Hub, which your Docker installation will automatically check.

Step 1: Getting an image and starting a container

The simplest way to run a Docker image is to get it from the Hub using Docker's run command. In this example - using Linux - we’ll create a local Docker container with a Python 3 software development environment:

sudo docker run -it python:3

The -it operators give an interactive shell for the container. Without them, it would just run and then stop without allowing interaction. The final command, python:3, is the container's name with a tag showing the required version.

Because the new Docker installation doesn't have this image locally installed, it downloads it before running it. 

Step 2: Listing containers

To see a list of running and stopped containers, open another command line window and type:

sudo docker ps -a

Step 3: Seeing resource usage

Open up another terminal window and display the resources your container is taking up by typing:

sudo docker stats

Step 4: Stopping and starting a container

The container can be manipulated using its name or ID, which each machine generates randomly. Taking a few letters from the front of the ID is simpler. For example, a container with the ID ff0996778a5a and the name hopeful_golick can be stopped by typing sudo docker stop hopeful_golick or sudo docker stop ff09.

Enter the command to stop the container created earlier.

Back in the other terminal window, the Python interactive shell disappears, and the console returns to the system prompt. Close the other terminal windows and go back to the original one.

Type sudo docker ps -a again. The container is still there; it has just stopped running. To run it again, repeat the same command used earlier, and this time Docker will run the local image.

Step 5: Listing Docker images

Now type:

sudo docker images

This lists the images that the containers come from, which should show just the Python image. More containers can be created using that image.

Step 6: Removing images and containers

The image is deleted using Docker's rmi command, but the containers created with it must be deleted first. So type the following, replacing the first few letters of the container ID and the image ID:

sudo docker rm ff09sudo docker rmi d6a7

Now, sudo docker ps -a and sudo docker images should show nothing. Everything has gone.

Containers deployed for microservices within cloud-native architectures are enabling organisations to deliver new customer experiences and improved business outcomes. Yet using numerous cloud service providers causes complexity that threatens to negate initial benefits.

This short paper introduces how to address the three key priorities for leveraging disparate public and private clouds, serving them up as one single multicloud to deliver a cohesive set of resources that best serves the needs of applications.

Download it now to discover how to overcome the complexities of deploying and operating applications in a multicloud environment.

Mirantis has acquired Docker's Enterprise Business Platform to accelerate its Kubernetes as a service deployment.

The terms of the deal are confidential but Mirantis will absorb all Docker enterprise customers and contracts, along with its strategic technology alliance and partner programs.

Docker was once the leader in containers but lost some ground after Google open-sourced Kubernetes. Its enterprise business was still healthy, however, with a fifth of global 500 companies on its roster, according to TechCrunch.

But with this section of its business now gone, Docker said it will continue to focus on tools for developers.

Mirantis said joining its Kubernetes technology with the Docker Enterprise Container Platform brings simplicity and choice to enterprises migrations. CEO Adrian Ionel said it's the easiest and fastest path to the cloud for new and existing applications.

"The Docker Enterprise employees are among the most talented cloud-native experts in the world and can be immensely proud of what they achieved," he said. "We're very grateful for the opportunity to create an exciting future together and welcome the Docker Enterprise team, customers, partners and community."

Mirantis will acquire the Docker Enterprise Technology Platform and all associated IP addresses. These include the Docker Enterprise Engine, Docker Trusted Registry, Docker Unified Control Plane and Docker Command Line.

Neither firm has disclosed the fee for the deal, but it signals a new direction for Docker. Shortly after the announcement, the company revealed it had secured a $35 million investment from Benchmark and Insight. There has also been a change at the top, with former CPO Scott Johnston assuming the role of CEO from Rob Bearden, who replaced Steve Singh in May.

"Going forward, in partnership with the community and ecosystem, we will expand Docker Desktop and Docker Hub's roles in the developer workflow for modern apps," said Johnston.

"Specifically, we are investing in expanding our cloud services to enable developers to quickly discover technologies for use when building applications, to easily share these apps with teammates and the community, and to run apps frictionlessly on any Kubernetes endpoint, whether locally or in the cloud."

Microservices architecture is a type of application infrastructure that separates the functions of an application into smaller, self-contained parts, which can then be reused for other purposes.

To explain, picture an application that is made to enter an active state when it receives an SMS message. Within traditional application development, every aspect of its function is coded as part of one central codebase.

However, under microservices architecture, the three main functions of the app are instead split into three: one that's designed to receive SMS messages and process them, one created to interpret the content of messages, and one more built to take this interpretation and initiate a command of 'on' or 'off'.

Because each component of the overall application is working independently of the rest, they can be deployed, updated, or replaced without having to rebuild the entire product. In the above example, it would allow you to change what happens when an SMS is received without having to rewrite the function that detects them, or change the application to activate when an email is received instead.

The same is not true for 'monolithic' applications, which have to be rewritten as an entire unit in order to add or remove features, or apply updates.

How do microservices work?

Many firms that deploy microservices architecture use containers to house the individual functions as described above. Each container is its own self-contained unit of software, within which lies the necessary libraries and functions to ensure it can carry out its designated task regardless of its surrounding environment.

Containers are a very helpful way for a development team to make microservices architecture a reality, due to their versatility and small size compared to virtual machines (VMs).

It is typical for administrators to maintain oversight of these containers through Kubernetes, a popular tool for orchestrating multiple containers wherever they are deployed, and this can also be used to group containers and allocate resources depending on demand.

Although microservices can be established and run independently of the wider software application, it is still necessary for communication to be maintained across the application so that it works correctly. Application programming interfaces (APIs) are the chief route through which this form of communication can be established, as these allow microservices to pass commands between each other as and when required. HTTP and REST (representational state transfer) is normally used for this.

Benefits of microservices architecture

The main benefit of microservices architecture is stability, with components being easy to exchange when they need to be modified or replaced. One microservice failing does not necessarily affect the performance of the wider ecosystem, with one function instead ceasing to work properly in a manner that can be identified and fixed with little overall impact.

Adopting this kind of architecture can also have benefits for the speed of development, too. Because functions within a microservices architecture are not interdependent, different teams within an IT organisation can be working on different microservices in the same application simultaneously. This means bug fixes and new features can be added faster, which is one of the reasons why DevOps and microservices often go hand in hand.

If a business chooses to use containers to deploy microservices, these can also be reused. This can free up resources that might otherwise be lost to application redundancy. Another benefit is the fact that, because they're self-contained, microservices can be coded in any programming language.

This article was first published on 23/09/19 and has since been updated

Kubernetes is an open source platform that has become the cornerstone of modern application deployment. Originally developed by Google and now maintained by the Cloud Native Computing Foundation (CNCF), it helps organizations automate the deployment, scaling, and management of containerized workloads, a critical function in today’s cloud-driven IT environments.

As businesses increasingly adopt microservices, hybrid cloud, and DevOps practices, Kubernetes has emerged as the de facto solution for orchestrating containerized applications at scale. Its flexibility, extensibility, and vendor-neutral design have helped it maintain a stronghold across both startups and enterprise IT.

But while Kubernetes remains central to modern infrastructure, it’s not without complexity.

Understanding what it is, how it works, and how it’s used in practice is essential for any IT professional looking to work in a cloud-native environment, or simply make sense of how their organization’s applications are deployed.

How does Kubernetes work?

At its most basic level, Kubernetes – often abbreviated to K8s – is an open source container orchestration platform designed to manage the deployment, scaling, and operation of containerized applications.

Containers help software run reliably across different computing environments – whether on-premise, in the cloud, or somewhere in between – by packaging applications with everything they need to run.

Originally developed by Google, Kubernetes was open-sourced in 2014 and is now managed by the CNCF. It builds on years of internal experience at Google with a system called Borg and has since become the industry standard for managing containers in production.

At the heart of Kubernetes is the cluster – a group of machines that work together to run containerized workloads. Each cluster includes a control plane, which handles scheduling, scaling, and orchestration, and a set of worker nodes that run application containers.

Kubernetes uses several key components to maintain application availability and performance, including pods, which group one or more containers as a unit of deployment; services, which enable network access to a set of pods; controllers, which ensure the desired state of the system is maintained over time; and schedulers, which decide where workloads should run based on available resources

Kubernetes can monitor the health of workloads, restart failed containers, and scale applications up or down as needed, and supports rolling updates, load balancing, and automatic failover – all with minimal human intervention.

Crucially, Kubernetes is vendor-agnostic and supports any platform that conforms to the Open Container Initiative (OCI) standards, allowing applications to run consistently and reliably across on-premises, public cloud, or hybrid environments.

Given all of this, it’s easy to see why Kubernetes has been such a smash hit.

How in-demand are Kubernetes skills?

Kubernetes remains one of the most sought-after skills in today’s IT job market. As more organizations embrace cloud-native development, infrastructure as code, and containerization, demand for professionals with the relevant skills to handle Kubernetes environments continues to rise.

Kubernetes-related roles offer an average global salary ranging from $124,000 to $185,000, with the highest salaries seen in North America, according to Kube Careers’ 2024 Q4 report,

Job titles most commonly requiring Kubernetes skills include DevOps engineer, site reliability engineer (SRE), and platform engineer, all of which are pivotal to modern IT.

Certifications remain an important differentiator for candidates. The Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD), and Certified Kubernetes Security Specialist (CKS) are widely recognized and often requested in job listings, and completing one or more of these can significantly enhance job prospects.

Hybrid and remote working models are also contributing to this demand. The New Stack reported that, by late 2024, nearly 30% of Kubernetes job listings explicitly offered hybrid working arrangements, a notable increase from the previous year.

While more professionals are entering the space, Kubernetes remains complex enough that skilled engineers are still in short supply. Teams with strong Kubernetes knowledge are better equipped to manage resilient infrastructure, scale services efficiently, and support fast-moving development teams.

How much does it cost to deploy Kubernetes?

Kubernetes itself is free and open source. However, deploying and running it at scale comes with real-world costs that largely depend on whether your organization opts to manage Kubernetes in-house or use a managed service from a public cloud vendor.

Managed Kubernetes platforms – such as Amazon EKS, Google Kubernetes Engine (GKE), and Microsoft Azure AKS – simplify setup and maintenance, but charge for control plane management, compute, storage, and networking.

At the time of writing, Amazon EKS costs $0.10 per hour per cluster for the control plane alone – around $72 per month – with additional costs based on node usage and data transfer. Azure AKS and Google GKE offer similar pricing, although Azure still provides a free control plane tier with limited service guarantees.

If you run Kubernetes on your own infrastructure – either on-premise or in virtual machines – you’ll avoid managed service fees but face increased operational overhead. You’ll need to maintain the control plane, secure the environment, and manage updates and scaling, which often requires dedicated platform engineering resources.

What are the best Kubernetes alternatives?

Although Kubernetes has become the dominant choice for container orchestration, it isn’t the only option. Several alternative platforms exist that may be better suited to specific workloads, team sizes, or operational preferences.

First up, Docker Swarm, once a popular lightweight alternative, provides native orchestration as part of the Docker platform, and is easier to set up and understand than Kubernetes, making it appealing for smaller teams or simpler projects. However, it lacks many of the advanced features, flexibility, and community support that Kubernetes offers, and has largely fallen out of favor for production use.

Another notable option is HashiCorp Nomad, a general-purpose orchestrator that can manage both containerized and non-containerized workloads. It’s known for being lightweight, scalable, and operationally straightforward, making it a good fit for organizations looking for simplicity without sacrificing performance.

Red Hat OpenShift, by contrast, is built on Kubernetes but provides additional tooling, enhanced security features, and enterprise support, making it a popular choice for organizations operating in regulated industries or those that prefer a more integrated development platform.

Where next?

Kubernetes has reshaped the way organizations build, deploy, and manage modern applications. Its ability to automate operations, scale seamlessly, and run consistently across on-premise, cloud, and hybrid environments has made it a cornerstone of today’s IT infrastructure.

While it’s not without its complexities, Kubernetes continues to evolve, with a growing ecosystem of tools designed to make it more accessible and efficient. Alternatives do exist, but for most large-scale or cloud-native workloads, Kubernetes remains the most capable and widely supported solution.

For teams embracing DevOps, platform engineering, or microservices at scale, Kubernetes is here to stay and will likely only grow more influential in the months and years ahead.

Containerisation is one of the most exciting tech trends to emerge over the last few years. Designed to work at operating system level, it's a popular virtualisation method that allows IT professionals to deploy and distribute applications easily.

This form of application management, which is named after shipping containers, allows almost any application to be stored and transported quickly. Containers, which are simply encapsulated systems, are given their own environments and hosts to run on. This process strips the need for potential dependencies.

Containerisation is being used in a range of areas in technology, particularly DevOps, a software practice that results in the unification of software development and software operations. There's a growing demand for new ways of managing application systems and containers represent a big change in the industry, enabling easy migration from legacy platforms to more modern ones, including the cloud.

Reliable storage option

Based in London, StorageOS is one of the companies at the cutting edge of this technology. The firm has developed a software-based, decentralised storage platform that provides container storage. It's been designed specifically for developers and professionals working in the field of DevOps. Chris Brandon, CEO of the company, says there's an increasing need for reliable storage options for teams working on large numbers of applications on a weekly basis.

"In order to meet the requirements of existing applications, and specifically with the increase of cloud native apps, we are seeing a rapid increase in the adoption of persistent storage for containers in the enterprise. This is being led by DevOps teams who, as they create and develop hundreds of new applications weekly, are reliant on the right environments to give them the agility to spin up projects with their databases quickly. Containers are ideal for these scenarios," he tells Cloud Pro.

While container technology has certainly created a lot of buzz in the industry, it's not perfect, Brandon says. He calls on companies to keep their options open and explore cloud native storage options in particular. "Even though container technology has passed the early adopter phase, organisations are still struggling to find the right storage solutions for the evolving container world," he adds.

"Organisations need to look for cloud native storage that offers persistent enterprise storage designed specifically for the container ecosystem. Containers are the engine running the DevOps industry and as the container market continues to explode, getting the storage right will allow everyone to take advantage of the technology."

Easing processes

Deploying multiple applications can be a time-consuming process, but containers are capable of making this easier for companies. Derek Weeks, of software automation specialist Sonatype, says this technology is transforming the DevOps industry in a number of ways.

"The simple fact is that adopting containers eases successful deployment of applications on premises or in the cloud. Fast development and deployment is the backbone of a DevOps culture, so it stands to reason that something that enables this, such as containers, is the backbone of the backbone. This is backed up by Docker's predictions that container pulls from DockerHub alone would double from 6 billion in 2016 to 12 billion in 2017," he says.

But there are caveats, he says, explaining that containers aren't universal and can differ in terms of quality, especially when it comes to security. Companies need to be aware of this. "Not all containers are created equal. With every organisation that adopts containers relying on a software supply chain which can include hundreds of suppliers and thousands of container versions, quality and security are paramount. But there is still some way to go; in our DevSecOps Community Survey, 88% of companies revealed that they were concerned about security, yet only 53% were using technologies to help them regularly assess their containers' security," he continues.

"To drive maximum value from containers and improve security practices, companies must continuously assess their container images for vulnerabilities and vulnerable dependencies. After all, if you can't see them all, you can't fix the ones at risk. As no container can be perfectly secure, the best organisations will use software supply chain automation to locate those vulnerable containers, recall, and update the image, and then redeploy safer versions within minutes.

"The first rule of DevOps is to never pass a known defect downstream. The second rule is to enable rapid correction when failures occur. Managing containers in an automated software supply chain is the true DevOps approach."

Boosting productivity

Jitendra Thethi, assistant vice president of technology and enterprise at software company Aricent, has worked with container technology in the past. Much of his role involves scaling cloud services and developing new software by leveraging emerging technologies. He says containers can improve efficiency and performance in DevOps.

"Containers enable applications to be scaled and can run on different environments across clouds. The developers will be responsible for packaging container images that get published on a repository.

"The operations team can then pull these container images and run them without the need for change. This makes DevOps practices much more effective and efficient, as it eliminates the need for manual input where errors can happen. It's worth bearing in mind that automation tools enable the construction of container images as part of their build cycle. Continuous Integration (CI) tools can take a source code, construct the build, run unit tests, coverage and [create] an image that becomes environment agnostic.

"Filesystems from software containerisation platforms can make the incremental additions to images much more efficient by enabling the layering of applications. New versions will affect only the application layers and the other layers, like dependencies, can be reused."

Security focus

Tim Mackey, a technical evangelist for Black Duck Software, also specialises in container solutions. His company's software helps firms locate, manage and secure open source code and he recently gave a talk at DevSecCon, where he spoke about what happens when good containers go bad. Mackey says companies need to ensure they have the right security in place if container technology is to be effective.

"For all its virtues, containerisation doesn't overcome the need for application security. And since a substantial element of most application software is open source code, organisations need to have processes in place to ensure any vulnerabilities in open source, including in containers, are patched as soon as fixes are published," he says.

"When you're using commercial software, the vendor is responsible for deployment guidance, security vulnerability notification, and solutions for disclosed vulnerabilities. If you're using open source software, those responsibilities shift. When Black Duck analysed audits of over 1,000 commercial applications we found the average application included 147 unique open source components. Tracking down the fork, version, and project stability for each component is a monumental task for development teams.

"We know that containerisation has increased the pace of deployment, creating questions of trust for many administrators. The key to protecting your applications in production is by maintaining visibility into your open source components and proactively patching vulnerabilities as they are disclosed. And if you assume from the outset your containers will be compromised, you can prepare by making changes that make it much harder to mount an attack from a compromised container."

Many businesses are still relying on ageing infrastructure to handle their application needs, and while container technology is relatively new, it offers so much potential. DevOps specialists deal with great workloads, but by making use of containers, they're able to ease processes and boost productivity. It's also clear that they speed up operations. We'll no doubt see more firms adopt this innovation as it continues to evolve.

The OpenStack Foundation has announced a new project, Kata Containers, which is backed by 22 tech businesses including Intel, Hyper, Canonical, CoreOS, Dell/EMC, Google, Huawei, NetApp and Red Hat.

Kata Containers has been developed to bridge the gap between the security of VMs and containers, OpenStack said. It's hardware agnostic and compatible with the Open Container Initiative (OCI) specification, making it a felxible option for businesses looking for a simpler way to manage their containers.

The purpose is to allow businesses to run container management tools on bare metal without having to isolate workloads. Not only does this reduce the cost of running containers and increase the performance and speed up boot time, it's also a much simpler way of using containers that doesn't involve running them on virtualised infrastructure.

Intel will play an instrumental role in the development of Kata, contributing its Clear Containers technology, while Hyper will put forward its runV technology to help launch the project.

Kata Containers will comprise six parts: the Agent, Runtime, Proxy, Shim, Kernel and packaging of QEMU 2.9. However, it's been designed to work with any hardware, running on hypervisors and working with Kubernetes and Docker.

"It is great to see open source communities combine efforts and work together as with Kata Containers, and aligning with standards like OCI and key container projects like Kubernetes are important starting points for Kata," Chris Wright, vice president and CTO of Red Hat, said.

"Container technologies are having a significant impact on the industry and adding hardware isolation as an option when using containers has the potential to bring a new class of workloads to container platforms including Red Hat OpenShift, furthering that industry impact."

IBM has teamed up with Docker to help businesses move their applications to the cloud using the latter's containers.

The partnership comprises the introduction of Docker Enterprise Edition (EE) for IBM Cloud to help businesses create their Docker environment. Certified IBM apps will also now be available from the Docker Store, which will make it easier for companies to use IBM's middleware with containers.

IBM also explained its involvement in Docker's Modernize Traditional Applications (MTA) programme, which involves working with organisations' innovative container technology projects to help them modernise their infrastrucuture.

"For the past several years, we have collaborated with Docker to help customers realise the benefits of containers," said Jason McGee vice president and CTO of IBM's Cloud Platform.

"Since then, we have expanded our work together to deliver the value of Docker and its container platform to customers in new, secure and powerful ways, whether they are running in the cloud or on IBM Systems, or a mixture of both."

Docker Enterprise Edition has been built for hybrid cloud environments, combining Docker containers with IBM's enterprise servers. This enables businesses to scale their infrastructure quickly, integrating containers with IBM's public cloud platform and using Watson tech to make their apps smarter.

"Our existing partnership with Docker has a lot of history behind it, and through our relationship, we have become one of their trusted support partners," McGee added.

"Our deep collaboration has now allowed us to create a unified experience through single vendor support, a comprehensive cloud platform, and a managed services portfolio that can handle even the most complex customer needs."

McGee said that Docker and IBM will continue to work together on enterprise services helping the customer on their journey to the public cloud.

The news follows on from another recent announcement from Big Blue that it's helping businesses move and deploy their apps and services on the cloud with IBM Cloud Migration Services and IBM Cloud Deployment Services.