DockerCon Internals Summit

LinuxKit Summit BoF: Session 1

Incoming changes:

Moby tool will move out of LinuxKit
init will get replaced and probably re-written in Rust
package and kernel builds will leverage multi-stage builds

Discussion:

How to combine kernel flavors? ex: Wireguard + Landlock
- proposal: Automated kernel patch merging for build recipes?
- proposal: "Security" kernel channel with combination of projects
Can we have a LinuxKit mailing list or use Slack?
- prefer mailing list
- community #linuxkit channel currently exists
Issue tracking: make the development process more transparent
- need to keep community up to date with timelines for big changes such as Moby tool movement, can use mailing list
- discussed creating an issue tracker/milestone with a monthly horizon for tracking progress
Modules: current kernel won’t change much
Lessons learned from RancherOS: need robust testing across all platforms and use-cases
- with LinuxKit: instead, have to build custom OS yourself
Roadmap: replace system daemons with type-safe languages, potentially in unikernels
- Collaborate with formal-verification groups at Microsoft
Moby yml: should outputs be in the cmd-line vs. yml?
Diagnostics: currently closed source but will become a public package
Error logging: we've added yml validation, would love more input from the community with how we can improve this
Outputs: currently support bzImage+initrd, iso-bios, iso-uefi, qemu, gcp tarball+upload, vmdk, vhd, pxe
- Coming soon: ami, azure
- Should Moby tool be able to upload outputs to clouds?
  - yes: we might call that moby push or something
- TBD: can we collaborate here with packer?
Who are the users?
- Docker: we want to build a lean and secure Linux layer for Docker to run on
- Custom kernel and appliance builders: using bleeding edge security features, minimal OSes for embedded use-cases, etc.
- Testers: can easily build and spin up custom Linux OS for reproducible and minimal test environments
- Tinkerers: folks who want to play, implement weekend projects
Security: prove value of incubation projects and kernel patches - ultimately want to see our projects make it upstream