 Just testing if my sound works Yep, you sound good We are waiting for a few more folks to be able to come on in so good morning And I heard an Amy so hello Amy Hey, welcome. This is your opportunity for a mic check before we get rolling if anybody has exactly exactly My check You sound great rock and roll Thank you. Welcome back everybody. Hi everybody So we have a full screw day We do we do so kick us off. Go ahead. We've got enough people here rock and roll. Yes. Thank you. I mean so Happy new year to everyone. I don't think I wished all of you yet So and it's only the 70th of January. So I'm wishing you hopefully I won't have to repeat this again So today we have two items on the agenda. Can we go to the next slide, please? Yeah so the first one is You know, we've had a couple of turns at this one a one a private to see discussion last year and More recently in the CNCF to see repository. So hi Phil So I would like us to you know Talk a little bit about it. I want to see what What folks on the call think about this including the to see folks as well Let's start with free flowing. If it doesn't work, then we'll switch around to You know raising your hands up. So Let's who wants to get started Justin. Would you like we have to Justin? So the capo mr. Capo, so would you like to get started as since you Raised both the email and the issue in the CNCF to see repository. Sure. Yes I Think this is a pretty simple Issue and I am glad to see that that some folks from the notary v2 project did show up Because there hadn't been any responses to the thread and there had been you know prodding on their slack on their You know slack channel and stuff like this to interact in some way But but basically the project is entirely different There has none of the same people the design has You know, it's completely different. It's fundamentally flawed in a bunch of different obvious ways that were pointed out the Way this was done was completely in a way that had The project or the CNCF enforced code of conduct in a way that they do now never Would have been allowed to to fly And and frankly it's I Think a really bad look and a bad precedent for it to to be inside the Inside the CNCF especially the way it is because you know, I mean I could start a crypto minor project to call it notary b3 And I would have more provenance Claimed a provenance than notary b2 does with with what they've done Justin I want to divide the Divide the discussion into like two parts one was before the last time the TOC interjected and you know requested some changes and after Talking about before or after or both I Would say both Really what happened is the TFC stepped in asked for some changes We were told things like the project would have a new name It wasn't gonna try to ride on the coattails of notary the notary name and cause confusion We were you know told a lot of things were gonna happen They were gonna change so that we could participate others could participate freely in the project They were gonna make changes to code of conduct and all of this and basically instead the project really went dormant for a very long period of time with no Visible progress of anything and I think most of us thought that the project was basically dead And then it's kind of had you know, they've I don't know what has happened to cause us to occur But they brought a new people who have no background with the project and don't really know what has happened in the past with it To try to move it to a state where they can declare some form of Victory or something with it. I I'm presuming they'll be able to speak and talk about it But once again, it's now it's like a whole new cast of characters in addition to the other Cast of characters that went in and through all the original people out of the project So I I think that all of the complaints and criticisms are equally valid both pre and post and none of them Were really addressed in a way that I think any of the original signatories of the letter Felt with satisfactory and also I would say that I don't believe that by us sending the letter privately to the TOC We Believed we were trying to do something private We were trying to give people a heads up as I did with the message that I sent to the TOC ahead of making this public Which was to just say hey Here's a heads up of what we want to say publicly and we were encouraged to keep that message private while the TOC discussed it and did things with it and then all we heard months later was a response that was you know Effectively almost entirely the opposite of what we had all wanted and thought was fair and equitable and reasonable Yeah, got it Justin. Thank you. I'll I'll take I'm not I Let others speak people speak as well, especially folks who have been on the no either on the notation new project or on the notary-Vee-Too or You know that are Signatories does anybody else wants to want to go next go ahead Lucky Dems hello lucky even send from Microsoft. I am associated with the notary-Vee-Too project Namely my contributions have been I worked on the governance documentation The governance docs that were suggested through this change that Justin Kapo has just said So just I wanted to probably respond to a few things that I saw on the thread that we're dangling And and you know action items for this project specifically one was specifically about governance and we've Spent some time thinking about how we can improve the the governance docs and we presented Preliminary proposal to some changes to the governance mainly if I was to summarize what they are is making them more discoverable Making the maintainers more consistent so that it was easy to find who was the maintainers of what? projects Underneath the notary project organization and github So that's something you know the notary Maintainers have been interested in seeing if we can do that. I'm happy to share that document Because I know that there was enough Dems that governance changes would have been made by August I think that was August of last year And there were some governance changes in there But I think we've taken a look and we can make some better effort around what Justin Kapos has called out around making it more clear discoverable who who owns what I Was part of a lot of the changes when notary was moved the notary v1 project was moved out from under the tough organization and I was acting on what I thought was Agreed upon which was what that we'd move it out for its own organization and that we'd rename notary Because notary v2 was there was a project called notary v2 under there and it was changed to notation as a way to Stop confusion, which is one area and kind of the idea behind pulling it out and into its own org was That we could create an ecosystem of projects under there that people could implement the specifications And I believe that we created a couple of different repos with different maintainers for that specific purpose as for You know, what's in that that issue 981? I think you know as being part of that community I'm not a maintainer of notary v2 specifically, but I've participated in in meetings. I think That there's been a lot of changes to the way that that community has been run and I would invite those members to come back and take a look Because I think we've a lot of those allegations in the in the issue are no longer valid And there are other members of that community that are participating in there, so I'm really trying to see what are the what are the areas we can improve And make that community better and see what we can put into shape and what we've got now is Some governance changes to transparency and discoverability And then I also think what was called out in there making sure that our agendas are always clearly documented That meeting minutes are always clearly documented and we could probably work with the cncf to make sure that Videos are posted. I think the videos are there. We could go and post the recordings and do that But I suggested that we go talk to Amy because I believe there's a tool to do that in an automated fashion So I think You know all the things we have a plan for for the dangling pieces that need an action item. I'd be happy to discuss them but yeah interested to work to make it a better community and Help address any issues that have been raised That's where I'll stop at this point. Thanks Tim Thanks Yeah, I just wanted to add that um, I mean just to mention it going quiet I think you know a bunch of the work that was being done for a while would ended up Landing in places like OCI with things like reference types that um What kind of general pieces of work that were needed as generic infrastructure in the ecosystem around with signing and other use cases and and so You know there's a bunch of work that ended up landing there rather than naturey I think that also You know to be clear that um, you know, there's there's lots of potential components needed and that You know notation is not a kind of feel and all project that replaces naturey v1 in any sort of sense and you know, I think there's um ongoing ongoing work looking at um, you know still you know You know, we've been doing internal draft work Which I shared with Justin recently on like ways we can incorporate tough into the seeker system. There's um a bunch of Think about things like in Toto and I think that you know, these things are not, you know these projects are design and naturey project is designed to be modular and components and not like you know Complete kind of replacements or other things as there's a lot of work to do to actually put these things together into ways that people can use them effectively um, and you know, I think that it's still um, you know kind of designed to be um A project that's a set of related projects Uh, thanks Justin. Um, Matt, please go for it Yeah, so I've been doing a little bit of investigation on notary and notation and what's going on here trying to figure out what happened And I've learned a handful of things that I don't know how many people know some of the context so, you know, like um Notary v1 is still in use, right? I know there's been talk of it's archived. It's not in use anymore. It's gone Yet I have found multiple instances where it's still used in production and I think Docker hub is still one example of that Uh, so it hasn't gone away code has been merged into it and it is still in use So I don't think that needs to be forgotten I also noticed that with notary v2 and notation Having a new thing that comes up and takes life and then there was the old one We already have examples of this in the cncf, right? Where a project comes in with one way of doing things and one architecture And then as things change get re-architected the ecosystem does things differently Competitors comes along things change something comes along and changes and a recent example of this would be flux v2 Which just became a graduated project, right? Flux came in as a project with flux v1 while they were incubating they created version two Version two went live and the whole thing met all of the criteria for you know graduation from governance to everything else and let's be honest governance again with incubating projects is often kind of shaky And in fact, that's one of the things that isn't a hard requirement until something hits graduation Because along the way people can be kind of shaky with that and it's one of those areas of improvement But that's where it falls and a project will come through and then this new thing will come along and go And we have examples of this so to say v1 versus v2 requires a new project Is one of those things we'd really have to dig in deep on I think because we already have these examples of transformation while in the cncf I also noticed that along the way Notary in its new form is A collection of specs in many ways with a reference Implementation in notation right and those specs many of which were worked out with the oci The open container initiative to make some of this stuff work together Now if I even understand it right this involves some of the sig store project Which now can use some of those same things and they were worked out together So some of the work that you see in in notary v2 and notation has actually been worked out with other organizations Along the way and there are people who are working towards using this You know I've gone around and asked I said all right sig store It's great. I use sig store my company you use sig store You can verify our container images a bunch of them with sig store But I went around and asking and I said is Are there places where it doesn't work and the answer I've been told is yes and that's one of those areas where something like Notary and notation may be able to step in and solve for because it doesn't work in every situation that you're going to run to And you know that's kind of normal We we have that kind of thing in the linux foundation in the cncf look at container d and look at cryo We we're okay with that as long as things are able to work out and have healthy ecosystems and things like that And so I wonder where there's going to be Things that work together using specs and those same specs workplaces Where certain projects are going to carry themselves along further and do really well at it For their own niche use cases and maybe you know a niche can be a 1% niche can be a graduated project Because you can have enough people who are using that and i'm curious to see What projects align in what ways and what users and their reasons for that because You know as we've seen there isn't always one size fits all Argo and flux graduated what a week from each other and they both are in very much the same space But they do things in different ways and they have a healthy number of users on both sides We're happy with them And so what does that look like in this space with notary and notation and sig store and everything else going on I think there's a lot to be seen here as well Thanks matt Justin capos just hold on just in case somebody else Has want to say something. I saw a few people d cloak Vincent Jason Richard any any thoughts here before I hand it off to Go go for it Jason Totally muted. We can't hear you. Yeah I just I will unmute for a second and say I really appreciate the healthy I really appreciate the healthy discussion and I appreciate the attention from the TLC towards making sure the community In all of its variations works well. Thanks. Uh, thanks Richard Jason I already Yeah, go for it Nope, we don't hear you Okay, no, we you know Come back again. Justin capos, please go for it Okay, thank you for giving me so much time here. I appreciate it Um, I I wanted to mention a couple things really quickly and response to a bunch of this So the governance problems that uh, Lockley mentioned were only kind of part of the problem It really wasn't so much the governance It was really the people involved with the governance and the way that that had worked And so I now understand that some of those personalities have moved on to you know, other things like this and and so on Um, fundamentally it it still comes down to you know, this question of Of like who created this there was an existing community of people that did something As there was in the case of other projects like Argo and they came and that community went and created a v2 And that was very successful. That's a great starting point. Okay But this isn't what happened in this case There's zero of the original maintainers zero of the original code zero of the original design This is effectively an entirely new project that's come along And is promoting itself heavily and in fact like a third of the webpage if you go to the notary b2 webpage Is basically we are a cncf project. They've had no security review the you know, it's There there are fundamental problems in the security design and other things that have been repeatedly pointed out In the public meetings that you can see, you know time after time That are unaddressed in the project And yeah, I think we've made the same argument before Justin. So Let me say one last thing and then I'll Okay, is that um, I would very much like By considering the fact that there's not a big contingent from the sigstore community here And there was some discussion made about integrations with this project and everything For this discussion to be put back on the issue tracker in a form where they can participate And they can comment So that that we can do this in a you know In a way that doesn't involve only the people in the room during a very specific period when Certain people have you know other personal problems going on like family illnesses and stuff and can't make it Yeah, absolutely. If you want to go back and create another issue somewhere else Happy to redirect people to that the other issues Um In the end Justin we all have to work together to make each other better And we we we have to keep trying to make things better for us as well as other people So I would like to move to towards a cooperative solution to like what we are trying to do here um, so I want to take The things that you pointed out in a positive fashion and see how like we tried a few things and The toc ended up asking the folks to do something So we we're going to try doing it again and see what happens We are not in the habit of you know shutting down projects just because uh, you know People don't like it right like we There is There are time periods in the project's growth When we mandate the security review or a governance review and things like that So we will catch it. Um, and we like Matt far enough pointed out that we've had the different projects that have had multiple versions of things are doing totally different things possibly with totally different people too. Um, so I'm going to take that input as Uh, the input of all the things that you've said as part of what the toc will consider But you know, we will end up Taking bunch of the things that we heard here Uh, and read on the issue and whatever issue you want to make you want to create We'll take that into consideration and and then come come back to The team to say hey, this is what we think you all should be doing so Please, uh, you know consider it while you are doing your um, you know the business of uh doing the open source For the work that you are doing here. So that is the overall framework. Uh, we are going to operate in Um, so I'll switch back to jason. Are you ready now? I'm going to assume you can't hear me. Yes, we can go ahead. You can. Oh my god Uh, I put it all in the chat, but I will reiterate the thing I think the the thing that I was, uh, responding to earlier was matt's comment about, uh Notary in sig store and some of that work. Um I don't think that the request as as justin laid out and as I signed on to was that notary not exists or that it like Shouldn't doesn't doesn't have a place in the world. I don't think anybody says that just that As an incubating project, I think the concern was that it Would not meet the bar of an incubating project if it walked in off the street today The other thing that came up was the the in the chat that, um The security review is a requirement for graduation I think notary being a security focused project with security review security concerns being raised sort of Raises the bar, uh, like, you know, notary should have a higher security bar than I think the average incubating project off the street Yes So what we have done previously in in projects with multiple components or multiple repositories, uh, that are different stages of, you know, you know, uh growth or, uh, maturity, uh, what we've ended up doing is We told the project to clearly Uh, delineate which ones are, uh, production ready And which ones are not and have enough language In the repositories or in the sub projects or in the different repositories that it controls To have enough guidance in there so that people are not led astray by, you know Coming through one portal and ending up somewhere else kind of thing So we have done this before and the guidance that you see has given us. Hey, uh Please make sure that you document these things properly. So end users are not surprised. Uh, and there is no bait and switch. Okay So, uh, anybody else, uh, matt, you came back. Do you want to take a turn? Yeah Yeah, so, uh, I want to address one thing, you know, that it would not be an independent incubating project yet uh, because I when that was said I went back and looked at the Incubating stage requirements and what do we normally expect and also how does something shift right and Flux v1 to v2 looking at something like that right v2 obviously didn't meet the requirements Well v1 was around initially it had to pick up certain things like your multiple production instances and things like that And so when I was looking at this and looking over it, um, I couldn't honestly answer all of the questions But it's at a point where it does meet multiple of the criteria Um, and some of the things we would have to do the due diligence on to know whether met more of them But there is a possibility v1 still meets the criteria and we're in that transition phase And that's what normally happens when flux v2 came around people didn't say hey This one doesn't meet the requirements yet Break it off into a separate project and then once it is we bring it in is incubating Even though it's architecture and the very way that it did things were different And I think you know, we try to be consistent and I know not everyone's going to agree with that but one of the things that um I know I work hard on is be consistent There are things that other toc members will know that I sometimes disagree with But if it's an ongoing decision that the toc consistently makes If we're going to revisit that we're going to revisit it So we now do it in a new consistent manner with the justification behind it and until then we will be consistent with the way We're doing things so projects know what to expect and I think in that case Being consistent is okay notary v2 is a different architecture a different way of doing things But we don't just jettison it right away because it doesn't meet the criteria right away as it's ramping up And so that's just consistency in our nature And it's why I would be tentative to go after that because then we're setting a new and different precedent here And does it become now an ongoing existing precedent for everybody? Is it a one-off? Why would we do a one-off? You know, we have to think about things in this this macro level way So we're consistent people know what to expect from us. They know how things operate as best we can And so that's just one of my thinkings on this and I did go look at it and a number of the criteria I can tell you today. They already meet things like the number of production instances I didn't go chase that down because that takes a little bit more legwork than I was going to go put in But that's the kind of criteria where we're now getting to do they meet those criteria yet in it Yeah, thank you I I did want to see if emily wanted to voice something about like The security review and when we do the security review. What kind of security review emily? Did you want to take a turn at? How we do things so people know what what we do and when So There's a couple of things that are going on with this. So the security tag Justin who is a member. He's the technical lead We've gone through and we we've revamped how security reviews are done in the way that the structure is set up such that A self-review by the project is usually ideal for sandbox applications or really early incubating projects And it's a guiding point for them to set up the security of their project From there between incubation and graduation the joint review is intended to be conducted The combination of the self-review and the joint review are usually handed over for security audit for projects That really weren't that extra level of security attention We found in the past that having both the joint review and the self-review as As precursors to the security audit not necessarily a requirement But just having that extra documentation and research done makes the audits go a lot smoother And those projects are generally set up for a much healthier audit experience and the auditors themselves Find a lot of value in that content given everything that i'm hearing Currently about the initial indications of notary v1 and what has come out of as in as a new change within the project I would like to caution folks and this kind of goes a little bit to what matt farina was mentioning we don't necessarily Evaluate changes in architecture and design Without giving them runway to start doing that development and architecture work on and be like saying harden your Environments, but you don't get any development Machines to try to practice and play around with and figure out what configurations are going to work for your users needs so For this project i'm hesitant to actually go back and put this back on security tag to become involved in for a security review Without a clear direction of what we want to accomplish Between the two projects because that's what it's starting to sound like is these are really two efforts with a very colorful group of passionate contributors And community members that want to see them successful, which is great. And that's what we want to foster Thanks, Emily. Um, let me see if any of the other TOC members have anything to say Richie your decloaked. Uh, do you want to add something? I don't think I have anything of value to it. Okay, thank you any other TOC members I see Dave Going once going twice No, no one else. So, um, are there other folks in from the community on the call who may or may not have been involved in the discussions on the issues or anything But wanted to speak up a little bit If I don't hear I can call on people too. So please decloak and Speak You've got some weird audio issues today try again Can you hear me now? Yeah, go ahead Okay, um, I just put quickly one little thing in the chat though, um that to highlight that Obviously like Emily said this is colorful and somewhat contentious Area that I'm not going to pick sides on that To to Justin Capo's You know put point of completely different folks involved and otherwise To unravel that history. I think is part of why we're even here now and having somewhat of you know different efforts and needing to you know, kind of keep checks and balances But that the fact that there are different people involved is Like almost like a benefit of this conversation rather than a drawback to the fact that What notary tried to evolve in you know with notary v2 or notation or whatever And six store even existing Was all part of that same growth and renewal. So That's not to say that it's against either one Either one of them, but it's actually for both of them and why we need to continue working together Thanks, Vincent So any folks who Who are currently part of the notation stuff other than justin kormack? Are you on here and would you like to talk? Okay, I think We are reaching the end. We have one more talk we could cover So Thanks for all the good conversations here in the discussions Let's try to make each other better for sure. And We will we as in the toc will Try to reach out to more people who haven't been on the call like justin kappos mentioned And we will Come up with a set of guidance for You know the community at large Does it sound okay to everyone? Okay. Thank you. Thanks everyone So let's go to the second part that we wanted to talk about today Which is the flat car project proposal Are any of the folks from the community who Participate who wrote up the proposal here today Hi dims. Yeah, andy randall here with microsoft. I'm actually the author of the Of the of the pr and I think there's other folks on the on the team here though including vincent Uh and andy, why don't you give us uh set this up for us like Why flat car why here and you know, how do how do you fit into the overall picture that we are now That we're working on here at cncf Sure. I mean flat cars Probably a little bit unique in terms of Um proposals that you're going to see for you know quotes new projects coming into cncf Because it's actually got history going back to 2013 Back to the very very earlier days of cloud native before cncf even existed You know core os was one of the foundational companies in the cloud native ecosystem A lot of people here have a soft spot for core os And you know core os container limits was the foundation of that company and a lot of the original innovative cloud native work was done on you know on the basis of of core os container limits Some great work that was done in that project and that kind of obviously when red hat acquired core os the company Core os container limits went on to a new life as part of the fedora project with fedora core os and red hat core os Is the commercial product built on that um It kind of inspired a lot of you know a lot of the things that went on there But black car really was the only project that um Well, we so we forked the original container core os initially in a kind of a friendly fork way of just we built as a downstream But then when the original core os came to an end We took it forward as its own independent project. I've been running it like that for You know getting on for three years now um, so with with quite a track record of putting out Frequent releases keeping up with security updates all of the kind of things you want to see around a mature You know linux project that people are actually putting in production and And if I look at the community of users, uh, we have It's it's quite interesting because it splits. There's probably You know close to half of the user base that is just Folks that had already built on core os that just wanted something That they could take forward and just point their up, you know point to a different update server and continue getting updates with a compatible um distro and You know probably the other half of the user base You know who's who's come to black car for new designs for new builds and choosing it as um, You know without without having had that history, but just because it's a it's a great platform to build containers on so uh, a lot of benefits to How how flat car manages systems in terms of security. It's an immutable os so there's a whole series of Of attack vectors that by having an immutable os you avoid and that's I think very much kind of the way forward for For a lot of linux distros looking at going that way um has uh Has a very simple atomic update system where you download a new version of the os and In a b partition you're running in an a partition you boot over to that when you're ready to update If the boot doesn't take for some reason it doesn't it doesn't system doesn't start it'll flip back to the a partition And we allow you to have a lot of policies around how that um how those updates work And it it really is minimalistic and designed for containers so Uh, as everyone knows this, you know the thousands of different linux distros and they all have their own niche You know the the the the the raison d'etre for flat car is to run containers. It's to be a container host Um, so it has Just the bits you need to run containers. Um, it integrates with container d. It has xcd Um, it's a great way to run kubernetes. Some people are just running Um, you know containers un orchestrated or with other orchestrated so it's not kubernetes specific um and uh Yeah, and and and it has these kind of security and manage and the manageability of having that kind of Immutable construct is is pretty key when you're starting to run at scale Which is what you want to do in a lot of cloud native environments. Um, so that's kind of A flat car the project in terms of the process and governance and you know community and all of that So, uh, some some of you may may know the origins of flat car came from a small uh small company called kinfolk, which was Really just you know a small team of open-sourced experts actually had done a lot of work For core os a lot of the original contributors to the rocket container engine so one of the early cncf projects came out of the kinfolk team and It was actually chris cool. Who's the it was a ceo at kinfolk who said hey, you know, we should we should do this flat car project So we we ran it independently for for a while until kinfolk was acquired by microsoft um and As you can imagine a lot of the community had questions when you know a small independent open-source company gets acquired by You know one of the large You know one of the large vendors. What does this mean for the project? um, and that was that was nearly two years ago that that acquisition happened And you know, there was it was I would say when we went into the acquisition the discussion was very, you know Was it was we were very clear that supporting the community and doing the right thing where the community Was an absolutely key requirement that we had as a team um, but fortunately that was Microsoft's view as well was they want to support the community and to support the cloud native community in general allow the um, you know the project to flourish and You know and the best way to do that in our view is as part of cncf because um that provides this independent forum for for us to build governance and to enable contributions and to really kind of You know put every every participant on a unequal footing And it also just underlines that Microsoft's intent with this project is not to Dominate it make it a microsoft linux or anything like that, right? It's it's to do the right thing by the community You know, we'll continue investing with the team We've got but we would love to see others come in and join and be part of that some folks already have but I think You know, particularly when you have the you know the microsoft name on it it's it's there's probably maybe There'd be people be more willing To do it as part of cncf than in the current structure. So so that that's really hopefully that That gives like the high-level picture. There's a bit more Detail in the proposal and I'm happy to answer any questions that come up here Thank you So thanks for the setup. I so one of the things that we were trying to look at or talk about earlier When your proposal hit was Do we open this up? What are we going to find when we open this up? And are there other projects in the space and who might be interested like Those kinds of things like are we set up to handle it? Are we set up to you know help you succeed in the things that you want to do? So those set of questions the toc has been talking about And I would like to invite anyone on the toc if They had some questions or they wanted to speak to You know, some of the things that Andrew mentioned Yeah, dimms, maybe if I could just address that point before other questions come in because I think that you know, there is an important question and I address address it a little bit in in the proposal, but I can imagine You know, the concerns. Oh god the flood gates open, right? We've let in one the linux distro now We're a linux distro shock kind of thing, right? It's um, I think there's something very specific about flatcard that it absolutely have a cloud native project in in the sense that As I said, it exists in order to run containers and cloud native Um infrastructure on top there are a lot of other distros out there that You can run kubernetes on but They exist for other reasons as well. So so that that's kind of the the first point um It's not unique in that. I mean, there are other other os's as well out there that would say they're um cloud native focus, but very very few I would I would suspect I mean, I know of talos for example, um and They they may well be interested. I You know personally, I would I wouldn't have Yeah, they did a sign up submission and we asked for more information. Um, yeah, you know, uh, so yeah, please go Talos bucket block bottle rocket, you know, there's a small number of other ones but I think it is fairly constrained and a fairly small number and if they meet the criteria and their teams buying them willing to maintain them and You know why I don't think the cnc have to shy away from having, you know, two or three of the same in a same category and it might even um, kind of add some validation in the sense to the to the category So I you know, that's that's my view on it But I don't think you're open the floodgates to you know, any and every unix distro. It's a it's a very constrained Uh, you know category that I think Yep, thank you. Um, Justin Yeah, I mean just to follow up on that. I mean In the application you call it container optimized operating system I think I think the the name and the description of the category is a little bit unclear in a lot of people's minds because you Ever people say Linux distribution, but in the classic sense, it's not a nice distribution I kind of think in my In my view because you you can't Install it like inside a container to run Linux for example and things like that. It just doesn't And it's underlying packages come from gen 2 and it it's in some sense it's a it's a way of using gen 2 and when red hat acquired core os they Took the technology and applied it to you know different to fedora so but I'm kind of interested in what you How you edge if you've got a better term to describe the category of thing that this is Because because I think it is very unpleasant people what what that's what the category is It's it's a good point in that so there are two very different categories of container os if you like so there's container host and you know and then there's container base image right so Working with were optimized for the container host use case right so That means a minimal set of packages. You've got a container runtime so that you can start containers And We're assuming that all of the runtime Dependences that you have package in the container, you know come package in the container and therefore you don't don't need them on the host so Yeah, maybe like container host optimized os might be more technically correct But if I think people understand You know that a base image is is kind of a different animal Okay, thank you. Vincent you were just ringing about something. Uh, would you like to voice? I think you were talking about a copy on the chat and then you were talking about You were just ringing when we were talking about the I guess gen 2 Sure, I'm like an animated animated muppet giving interpretive dance. I'll people talk um The cappy thing was just you know additionally touching on kind of like uh kind of the community driven side of things um and You know as cloud native has different needs and demands that that people the things that has pulled the most Development and features and otherwise support And ongoing iteration for flat car has been community driven and it's been things like capping. It's been things through other cncf projects Which has been interesting and somewhat of a testament because it's it in that way it is somewhat different because it's not a business Driven development like some of the other ones in the same similar category and yes, they do all smell similar, but So I understand the desire to to distinguish them The hand gesturing was kind of in the the the path of Yeah, flat car is not a container image And it is you know Like core os was a derivative of chromium os which is built from gen 2 way back whenever We've experimented with having it do derivatives of other os's So that's it's not it's not completely preposterous So it is kind of a a derivative product or a derivative process But also even like when red hat went to make what they later called fedora core s or whatever red hat core s um Then they use some of the technologies, but still it was it was completely its own derivative as well. So that was the They're not one for one In the same way that was all Thank you Just see you were you know my two cents. Can you wise that wise it please? Oh, I could I I'm not really a stakeholder here. I just am an os an os guy. So, uh, yeah, I would just I My camera won't turn on Noise why why does it always happen? No, I just had to turn it off. You're doing fine. Keep going Yeah, uh, so yeah, I just I'll read what I said We often refer to general purpose distributions versus purpose built distributions This is squarely a purpose built distribution that's focused on orchestration data plane And I was just asking does it need to be categorized beyond that? There are certainly other examples of that. Um, as someone else said there's tallows. There's bottle rocket Um, Ricardo pointed that out. So that's all I was saying Uh, yeah, I think when we open up to the host Possibly host like you mentioned, I think we might we might Kind of like the slippery slope there is like, okay. We we need to give, um, a similar consideration for the Container base images as well. Um, so I think it's natural for this to lead to that, uh, as well, I think Um, it yeah go for it. Matt. I was looking for you Yeah, you know in in all of this one of the things that sits out in my mind Isn't does this you know join the linux foundation in its family because the cncf is part of the linux foundation It's where does it go? Does this belong in the cncf or does it belong in the greater linux foundation somewhere? And so this is one of the questions That's in the back of my mind that i'm trying to answer with everything else going on because it may be a purpose built linux distro But does a purpose built linux distro belong in the cncf or does it belong in the greater linux foundation? And I I don't actually have an answer to it But this is the big question that i'm trying to formulate an answer to in order to know how to respond to this Yeah, perfect Before I hand off to richie. I do want to uh raise one of the things that we talked before uh in the toc was like Hey, um The folks doing this work are already part of our community and you know, so it makes sense to Have them close to the rest of the things that we are doing So that was one of the thinking one of the lines of thinking that we had when we were talking about it, uh richie go for it So first of all, I have to agree that um core is kicked off what we What we now call cloud native. So there is there is certainly an argument to be made for this to be part of cloud native Um, I think it wouldn't be a slippery slope uh to to also accept other base images It would be the absolute necessary logical step Um, and that's the thing which which makes me a little bit apprehensive Of course, we would be increasing the overall exposure surface of The amount of software which we have within cncf Substantially, um, you're you're worried that will be scale will the toc scale will the tag scale will you know that kind of thing right Not only this but also just like security processes and and everything because like we are talking full distributions at this point And we will not be talking one. We will be talking half a dozen Except for kubernetes. We don't have any code base, which is nearly as large as a complete distribution. I think um It's just going to be New and larger in in a lot of ways At the same time. Yes From the category it makes sense course Core as everything like I I absolutely see this argument. Yeah, and As matt is talking. Hey, it's not just Just the things that we talked about it's also security conferences marketing, etc. So that that's very true matt Vincent Yeah, sure. Um to the To the question LF versus cncf or otherwise was was a huge part of the Mulling on this aspect as well And even um As andy mentioned earlier like the kind of contributors and Users customers whatever you want to say a flat car not paying customers, but still um are You know have have have wanted to see it in a neutral Playing ground so that they can be more involved as well. So that's you know as we've worked on opening up the governance Um, that's been like to get it into an open playing area an open governance area has been a huge focus so that we could Meet them where they're at and Just like was said It it's only focus is cloud native um, so that makes a huge difference and a lot of the All the customers and of a flat car already present and involved in cncf So they're like great our company already has processes for how to get involved and have maintainers and have contributions in that space That would make it easiest And if you did end up in some other place like lf or wherever Then we could try and meet you where you're at but like this is mainline the purpose and what you know processes that we've already put involved for We're literally trying to meet the community where it's at um and to find that that slippery slope or whatever of This space even from conversations had during the week Among all the different os folks involved from like fedora coro s bottle rocket tallow so otherwise at the past cube con was really like there was a feeling and a sentiment that In all the cloud natives and you know, the os doesn't matter that like the os does matter and it's kind of a gap right now like that people are either not talking about it or It seems to be kind of a gap in the landscape of like it's it's implicit and Could could we not just make that part of the conversation? So I think there is there is kind of like we're touching on like a surface tension with with with this topic But to truly express the sentiment from our side is it it's it's purely community driven In this entire effort. So that's all right Just just to give you all some what we're looking at is first you see us to make a decision and It should document it and we need some public comment period Or something similar to let the community know that we are trying to do this So that will kind of like proceed the actual flat car proposal Because we are doing this for the first time and we don't know what we'll end up, you know, how We are going to make that decision Some of the things that we'll have to end up talking about would also include. Hey, um, you know around licenses and copyright and those kinds of things we Yes, uh, the toc has to bless it Agree that we need to open it up first, but then immediately after we'll face Those kinds of questions that we can't answer by ourselves We'll have to rely on cnc of staff and then we need to go back to the cnc of gb There are some things in the charter that we might have to do something about there is a legal committee in gb So, you know have this in the back of your mind. So it's not just the toc, but there is other things that we need to push and lead and like fraud and Move people towards to make it happen Okay, we have two more minutes Jesse, did you want to say something quickly or? Uh, I put it in chat. I just I was being too abstract before and I wanted to tie it back to exactly the point So I think I think oversight and governance is best attached to use case And and so that's I guess to put a fine point on it yet. It is an os distribution. It could go any lf The main use case here is data plan for orchestration and let's not beat around the bush orchestration typically means kubernetes So I just kind of wanted to say that I think that as you consider this Where are the people that are going to be use it using it and needing for it to be a healthy project? Where are they Co-located and I think that that's sort of what vbats was saying as well Also, if there are more of the same category, then there'll be more hopefully more Cross-pollination between the teams. So that is something that I look forward to as well Andrew, do you have any last minute to say? Um, I I just want to Really just on the school vincent's point that the you know the community around flat car just overlaps one-on-one with The community or or it's a subset of you know, the broader cloud native community I mean the people we talk to it's always we'll see you at kubecon, you know that I mean that That is the pond that we play in those are the people we talk to You know and and that was really the driving Consideration when it came down to thinking about well should we pursue lf or should we pursue the mcf? Um, thank you. Uh, please have patience with us as we work through this And you know, we'll definitely involve you in the discussions as they go forward. Okay. Thanks everyone Bye. See you next time. Thank you so much everyone. See you online