Cloud Native Computing Foundation

Is there some RFC that people follow? Did their local municipality send out rules about how to do this? Or how is it all arranged? How does this happen?

There is, I think, GitHub actually has like a security template or like back in the day when I was working on a CNCF project, there was like a health check that they did for all their projects.

And one of them was you had to have a disclosure statement for vulnerability management.

And they provided a template.

Well, it's the internet, right? So everybody is kind of deciding it for themselves.

So it's emergent is maybe a word that you would use.

Obviously with CNCF, they've got hundreds of projects under their tent.

So they've had time to kind of work out the kinks of what they think good looks like.

Starting those conversations.

I mean, you know, things like the Linux Foundation, the CNCF, which kind of began from the enterprise organizations in, you're kind of beginning with, like, here are these problems that we see and doing more of a grassroots motion from there.

So, yeah, I mean, I don't know if you've talked with folks like Aaron Schnabel at the Common House Foundation, but I know that that's a sort of move that they... do as well, where they were a bunch of developers.

I said, we think that we can do foundation work differently.

I want to be able to participate in its co-evolution.

So the first project we were working on here, we discussed around sandboxing generally, that open shell technology is open and just was recently donated to the Linux Foundation as a part of the CNCF.

So the thing that would be securing your AI agent in its untrusted actions, you can inspect, you can evolve, and you can help us co-maintain together, right? Then if we go up a layer of the stack here with Open Claw Enterprise, one of the things that is appealing to us is it's backed by the Open Claw Foundation itself.

It has a commitment to maintain its open source posture, and its overall neutrality in the ecosystem.

A lot of it is already available online.

If you talk about open source solution, Filecore was released as part of CNCF project in 2016.

It's 10 years from now.

So this technology has existed for a long time.

There was OpenLit, OpenFerence, OpenRelemetry.

And then since OpenTelemetry is a big CNCF project, it's usually a bit slower to catch up with things because they want to build something that is enterprise ready.

They start adopting slowly also their own semantic conventions and then instrumentation

for it.

And today I have the great pleasure to welcome Liz Rice, Chief Open Source Officer of iSurveillance at Cisco.

She's on the governing board of the CNCF and she's a best-selling O'Reilly author and one of the world's experts on eBPF and security, which is what we're going to be talking about today.

Liz is also one of my oldest friends and we co-founded a startup together.

So thank you very much.

So Cilium is a product that's based on eBPF.

Cilium is a project.

It's an open source project part of the CNCF.

So the CNCF is the organization that looks after Kubernetes and Envoy and Cilium and dozens and dozens of other projects that people are using in cloud native deployments.