by VMware China, maintained by whole community Integrated into enterprise products: VIC and PKS GitHub Repo: https://github.com/go harbor/harbor/ Apache 2.0 license An open source trusted cloud Docker Compose • BOSH/Pivotal Tile • Helm Chart Label • Label in project and system scopes • Mark labels to image and chart Harbor Architecture API Routing API Routing Core Service (API/Auth/GUI) Image Registry Trusted Content Vulnerability Scanning Job Service Admin Service Harbor components 3rd party components SQL Database Key/Value Storage Persistence components Local or Remote

need… • a Container Management Platform, but to network it I need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and and monitoring service, and to monitor it more I need… • a Log Aggregation and Search service, but to install it I need… • root access on a bunch of servers, but I need more servers so I need… • an Infrastructure Infrastructure as a Service platform, but for high availability I need… • another rack of servers, but to pay for it I need…Always ask yourself • Am I solving my customer’s essential problem? • Or am I

Cloud Native and Open Source Liangyu Zhou Senior Software Engineer at Tencent Rich experience in Container and Kubernetes field, promote lots of K8S production practice in Tencent Motivation https:// isolation, but we will focus on pod-to-pod isolation in this talk, AKA Sandbox Isolation. • Container Escape docker.vh.neargle.com:8888/?command_exec=python3 -c "import docker;client = docker.Doc /proc/self/fd/ 4. Linux Kernel Patch Are those enough? NO https://landscape.cncf.io/category=container-runtime&format=card-mode&grouping=category Runtime Landscape cri- containerd runsc+gVisor kubelet

Support44  Defined in  New adaptors on top of basic sequence containers  Associative container interface (similar to std::map)  unique keys (flat_map)  fast retrieval of values based on a // "", "c", "d", "e", ""70 Changes to Ranges Library  ranges::to(): Converts a range to a container  E.g.: auto ints = std::views::iota(1, 5) | std::views::transform([](const auto& nts) }; std::print("{}", vec); // [2, 4, 6, 8]71 Changes to Ranges Library  Converts container to container  E.g.: // Convert vector to set with same element type. std::vector vec{ 33, 11, 22 };

Pointer Synchronous Reclamation Beyond Concurrency TS2 – Maged Michael template class Container { struct Obj : hazard_pointer_obj { Key k; /* etc */ }; hazard_pointer_domain dom_; // completion of destruction of Container. • Problem: High setup overhead of constructing/destroying per custom domain hazard pointers. • Even worse if many instances of Container are used by thousands of Pointer Synchronous Reclamation Beyond Concurrency TS2 – Maged Michael template class Container { struct Obj : hazard_pointer_cohort_obj { Key k; /* etc */ }; hazard_pointer_cohort cohort_;

extension)) { continue; } // ... } }15 Erasing Elements16 Container Erasure Strategies • Erasing unwanted elements before C++20: • vector-like: erase-remove idiom 🐞 • Invalidating iterators while looping 🐞 • Skipping elements while looping 🐞17 Uniform Container Erasure • GH-236 and GH-566 implemented by SuperWig #include #include #include value_type • Associative containers have member .erase(key) • Inspects only the key, using the container's predicate • Ordered: "Logarithmic" time, O(K + log N) • Unordered: "Constant" time, average

Practicing Sparrow  https://rust-cloud-native.github.io/  Our new talk "Rust-based Container Runtimes" is coming soon. 2.3 Unified runtime for eBPF and Wasm Summary II. Practicing Sparrow

macOS, and Linux C++ IntelliSense, debug & code browsing CMake, vcpkg and git integrations SSH/container/WSL remote experiences and much much more… https://aka.ms/cpp/code Thu 10/28 – 2pm An Editor Can

Zookeeper-2 Zookeeper-1 Replica Service Load Balancer Service Shard 1 Replica 2 Shard 2 Replica 1 Shard 2 Replica 2 Replica Service Replica Service Replica Service User Config Map Common Config Running NAME TYPE CLUSTER-IP service/chi-demo-01-demo-0-0 ClusterIP None service/clickhouse-demo-01 LoadBalancer 10.98.143.187 NAME TYPE CLUSTER-IP service/chi-demo-01-demo-0-0 ClusterIP None service/chi-demo-01-demo-1-0 ClusterIP None service/clickhouse-demo-01 LoadBalancer 10.98.143

Based on following major components:  Range: A concept defining iteration requirements  Any container supporting begin()/end() is a valid range  Range-based algorithms: all Standard Library algorithms