Rodrigo Campos Catelin
Rodrigo is a software engineer at Amutable and has been a free software developer for 20+ years. With a background in Computer Science from the University of Buenos Aires (Argentina), his career spans both software engineering and system administration.
He is currently a maintainer of runc and has been contributing to Kubernetes since 2016. Over the years, Rodrigo has maintained cloud-native projects like MetalLB and Lokomotive, and contributed to open-source projects including containerd, moby, php and Linux.
Session
System extensions (sysexts) become part of the host's /usr, making them available to all users. But what if we want to run tightly coupled services without exposing their binaries to everyone else on the system?
This lightning talk will show how to ship a real-world stack (kubelet, containerd, and runc) without making them accessible to the rest of the host. We will demonstrate how to use portable services and systemd capsules to allow these components to invoke each other and share some namespaces, all while keeping the host OS clean.