Welcome everyone, I'm Jared and you are listening to The Change Log, where each week we interview the hackers, the leaders, and the innovators of the software world. In May 2025, Docker launched Hardend Images, a secure, minimal production-ready set of images, and in December they made DHI freely available and open source to everyone who built software. On this episode, we are joined by 2-Sharjan, EVP of Engineering at Docker to learn all about it. But first a big thank you to our partners at Fly.io, the platform for devs who just want to ship, build fast, run any code fearlessly at fly.io.
Okay, Docker, Hardend Images for all. On the Change Log, let's do it. This is the year we almost break the database. Let me explain. Where do agents actually store their stuff?
They've got vectors, relational data, conversational history, embeddings, and they're hammering the database at speeds that humans just never have done before. And most teams are duct-taping together a Postgres instance, a vector database, maybe Elasticsearch research, it's a mess. Our friends at Tagger Data looked at this and said, what if the database just understood agents? That's agent at Postgres. It's Postgres built specifically for AI agents, and it combines three things that usually require three separate systems, native, model-context-perical servers, MCP, hybrid search, and zero-copy forks.
The MCP integration is the clever bit your agents can actually talk directly to the database, they can query data, introspect schemas, execute SQL without you writing fragile blue code, the database essentially becomes a tool your agent can wield safely. Then there's hybrid search. We're going to merge this vector-similarity search with good old keyword search into a SQL query. No separate vector database, no elastic search cluster, semantic and keyword search in one transaction. One engine.
Okay, my favorite feature, the forks. Agents can spawn sub-second zero-copy database clones for isolated testing. This is not a database they can destroy, it's a fork. It's a copy off of your main production database if you so choose. We're talking a one-terabyte database, fort, and under one second.
Your agent can run destructive experiments in a sandbox without touching production, and you only pay for the data that actually changes. That's how a copy on write works. All your agent data, vectors, relational tables, time series metrics, conversational history, lives in one queryable engine. It's the elegant simplification that makes you wonder why we've been doing it the hard way for so long. So if you're building with AI agents and you're tired of managing a zoo of data systems, check out our friends at TigerData at TigerData.com.
They've got a free trial and a CLI with an MCP server. You can download the story experiment thing right now. Again, TigerData.com. So first we have supply chain attacks caused $60 billion in damages in 2025. Triple what they caused in 2021.
Every language, every ecosystem, every build stuff, their target because who does not use Docker. And Docker's response was to make hardened container images free for everyone. We have head of engineering to Shire here today to dive deep into that and all the things that come from it. So welcome to the show. Thank you.
It's set to be here. Let me start to talk about all that. Where we begin in such a deep topic. I mean, you got vendors out there that had products around this. You got the desire to secure the supply chain.
You have a brand to protect, you got developers to protect, you got bills to protect, you got a lot of responsibility. I mean, it's a big job you have. But where do we begin to unpack the reasoning and decision making behind this choice? Yeah. Maybe I can let me talk about how we think of supply chain, so I just carry out our current role in it and then how that evolved to Docker images and then eventually why we made it free and how we see that.
What exactly is Docker harden images? We can just explain that too. Perfect. So let's start at the beginning. Before you and that, I'm going to see everyone knows Docker and Docker Hub.
Everyone builds containers, you use images. Docker Hub is effectively upstream for open source container images. We get billions of billions of bowls per month. Everyone pulls from us. And these other repositories are images of like usable open source software and not just like upstream based images.
I want MySQL on WN. You get that from us. That works great. We've been doing this for a decade. But we basically keep up with upstream.
As a result, images do have CDs. They've lost the CDs caused by multiple reasons. One, bloated stuff, bloated packages that are built for usability first as a result of many packages in them or just not patching fast enough. Harden images and this is a concept that has started in industry before we launch a product, which is let's first minimize this problem. What people started doing was less scanners in production.
They'll see when there's a CD, we'll go alert some teams, they'll have to go update and patch and this is the world they lived in. Instead, why do we need all these images? Can we first minimize them? Let's get minimal packages that are only what we need. Second, can we have someone patch these faster and then we drive that.
So we release the border on engineering teams. This is not the movement that started. It's very natural for doctors to do this. And so we launched Docker images as a paid product early last year. So hardware and images, base images, app images that are minimal, low to no CDs, back when it's late by us.
When we launched, we had a limited catalog and we've been aggressively growing that. Our vision was always like Docker is like broad adoption, get tooling and content out to everyone. So vision was always, we need to make this accessible to everyone. And then for enterprises, we provide things that are scared about compliance and we can cover what is in their package. But for every note that they should get a great starting point and a secure starting point.
So that was the vision always, we should build up to that. So that's what we got to last year and launch that out there. This is a pay product for a bit there. And this is a big deal because you're letting revenue go by making this choice. Yes enough.
So it was a paid product where we did a basically launch a large catalog of made entire content and catalog available for free, nearly most of it. What's paid is stuff that enterprises would care about still. So what's free is like any developer, any project that opens those projects at the top of this scale. And then it's probably the largest of those projects that's moved to this, right? Which is what we want.
Everyone to have a secure starting point. But now if you want an SLA, like any place where there's a C cell, they want things. I want an SLA commitment behind the patching. I want flip images and stick images. I want support and patching on images that are all like outside LTS images.
That kind of stuff is an update product. I want to deport most scalable customizations. Those are not paid products. We still have a paid tier and that's basically the actor is a C cell who gets a bunch of stuff. That stuff's in the paid tier.
Feature is for every developer, every company up there. Yeah, yeah. Table stakes, it seems as S bombs, SLS, I didn't know there's an SLS out there, but there is. SLS a SLS a build level provenance. Yeah.
And cryptographic sign. You're making those three things. Those things will freeze. Everyone gets S bomb or build by themselves as. So I'll say it's also salsa.
So I say salsa. It's fun. There you go. I'm not going to trip over my acronym ability then and just do salsa. And so that is how we build it.
So we have a salsa level three build pipeline. We actually have an open source or builder for this. What's been interesting is to do this, we had to change how we build images. I still using like Docker build can only take over, but we go away from Docker file store and semantic layer, don't knew which build is well and explain that. And then our build system is very interesting as we've done this, you know, supply chain security is a broad topic and secure content is one part of that.
Securing a build system is another part of that. That's key. So the interesting thing is that lots of companies interested in our build pipeline. So that's the next thing we're looking at is exposing that technology to everyone for everyone can have secure build pipelines. And we'll keep going down this sort of like how to make a series of supply chain is just critical.
Not just for traditional containers stuff, but you know, we'll also see this with AI. We talk about that. You said you moved away from Docker file? Is that right? I mean, it's still using the same technology on either covers, but just we have it.
We built our own, we built our own Yammer syntax here just to make builds more repeatable. Like in Docker files, you can shell out, you can do stuff, remove that. So in the syntax, it's very repeatable, it's reproducible. So you can actually do this in a way where you meet salsa requirements. It's still built in the covers.
Can you unpack briefly as bomb? What that means? Why is it important? And salsa, which is obviously how you say it. I don't know.
I mean, that's the whole time. Yeah. I mean, I mean, do you know the word time Jared? No, I did not. I know.
I also don't know the first time. This is a different version of the SLS. Let's learn on the air here, which I've been doing it for years. So we're not doing it for years. Go ahead.
Let us know what it means now. So as far as simply software materials, all it means is to be in a container package. There's built in many layers. How do you know what's in it? And the second you want to know not just what's in it, but how is it built?
Everything about how everything was built and signed. If you look at that, it can say like, okay, here's not just a top layer back image that knows the packages. Here's everything else that's in it. And we also sign it. We can capture aspects of the build environment where it was built, various aspects of the node, etc.
That's typically important for, or that's important for one problem. And so you know where the thing came from. Two layers of the compromise. You can trace what's all impacted and you can manage that. So S-bombs are critical and then it continues to complicated just because of all the layers that can happen.
And so we manage all the trans-steps that we can see. And then many tools, all the scanners can pull from that and understand what's happening there. There's three things to explain here. So S-bombs, the Salsa, and the Vex, the whole cover of Vex, then S- then is, I'm going to get what it stands for wrong. I'm going to make it up and assume it's correct.
Something that can correct me in the comments from wrong. But it's like vulnerability exceptions, I think, which are a lot of times you have CVs that are reported, but if you look through it, the maintainers will face you like these don't actually apply. And so you can produce Vex statements and that there's also, you know, we stand behind that, a lot of stream maintainer will have it behind it. And then scanners can understand that and they're like, okay, these things don't matter. So it reduces scanner noise.
And what's good to do it this way, a lot of times what other people can do is like, in the S-bomb they might obfuscate or they have a CV, they say, say, say, say, say, say, say, here's everything, go for different anywhere else and then we'll tell you which things we think don't matter and we're standing behind that. It's just much more open and transparent. And then Salsa stands for, it's an open standard, it stands for how you build a thing and you build an environment. And it's very slow, and Salsa 3 just means it's reproducible, it's home, it is not being tampered with the environment itself, it's not accessed, it's a way to secure your build pipeline that we're standing behind. So you know, like, okay, nothing can be tampered with all the build pipeline itself.
And so that's all a bunch of, maybe that's like, you know, to give an example, all the machine that goes into doing this stuff. So stuff is pretty in the free, you know what you said we're giving revenue. I think if it is actually, no, like, look, this is very much, there's both the business model and ethos here. ethos is very much get this out, the commission run over standards and business model is sure we drive, that's top of funnel to pay product. But as we do put a lot of effort and value that we give out a duty free, right, Docker hub is free and we're giving the future for Docker languages.
There's lots of schools into that. Let's just say I'm a working developer with a couple of servers out there in the wild and they're all Docker eyes to me, I got a Postgres server and my base image is like Debbie and our alpine or something basic and then I have to get installed Postgres and I, you know, my Docker file does all the things or whatever. How do I gain by switching to a Docker harden image and what do I potentially lose or what might I hit up against when I try to do that? Yeah. So into the way to gain so that two ways with journey to flavors, hard images, like a development image and production image and production and development, you want stuff like you need a package manager, you need shell, you need debug, you need to do all these things, right?
You need to be able to give that to you still minimal. Really with them, we recommend a multi-stage build. So for your production images, you don't need that stuff necessarily. So minimize that. There are trade offs here, primarily to do with usability and how you manage that.
So first, the images you get from us, maybe you need a few more packages. You've got some ways to build for that. You run that from the pipeline with those in. Those are still hardened packages you're putting in and you still get all of S-bomb, Salsa, Vex, all that kind of stuff. But if you've just built a project doing it, a lot of times a lot of people, migrations are really easy.
Sometimes you've done stuff where like, okay, I have to figure out what's my trade off between usability and security and what am I managing there? And if I've put my system in a way where it comes to the subwell or it really depends on shell access, in production, then those are trade offs I'm making. And those are typically the challenges that a number of projects can run into. But once we have the most part from a lot of our customers, we have the vast majority of their projects are able to migrate easily to this. We are also looking at building an agent here to help do this.
We've got an issue of which we're running it only. We use it internally and then we start to build up the, you know, how much we help people with complex migrations here. Yeah, that'd be super useful. So what did an option look like back in May and then what's it look like since then? Is this something that everyone's just like, it's a no-brainer?
Obviously you might have some headaches, but they're worth it or people more tentative. What's been the reception? Yeah, maybe just as Andrew first. We did have a webinar. I want to say a couple of weeks ago something I forget when does everybody attended?
I think my favorite question from that was, is any reason I shouldn't use Docker images? It really is like, no one, you shouldn't. There's really no reason why you wouldn't want to have a hearted image, you know. There's really no reason. This is why we opened this up.
You should go do this. So early on we had lots of good traction with the customers and working on them price deals. Since we've open sourced this, also if we open sourced it right before the break, I think it's something that's when something is when other, or they've not open sourced at the future, that's when our launch was. But even then we saw immediate interest and pick up and so we're tracking open source packages, adopting this dramatically, like a mission, a challenge, contour. And then with the customers, it's resonated.
So like CISOs like it, head to platform, like in part because we've seen player will be hope, which is, okay, now someone on the team typically someone has a mandate of like, oh, I should go and people care with this problem. The barrier for them to go adopt and try it and see the benefit is low. It's basically zero. They can just do it. And then they're like, okay, now I want all these additional security guarantees.
I think great. Now we can have a conversation about the paid tier. So we've seen an uptake for sure in this emotion playing out where like, open this adoption and double funnel with companies and then we start working through that, working through this. You know, this is the one that's the thing that people have to take time to work through because like, people have adopted, they've scared of security, they drive it, but it's time to see, it's time to see this grow quite a bit. You mentioned releasing this announcement or have it before the break.
I didn't do it. I had to have some feedback on that time. I know this announcement. I think anybody would have feedback on that time. It could be more now.
Yes, the worst time ever. So I'll say something. I'll say something. It's the worst time you've ever. Just go there before the break.
I don't know. I feel like holidays, actually now like when all the airport is at least, it's like the moment we do stuff with things anyway. Right? Everyone's at home tinkering. We're going to get our product out there for people to tinker it with it.
Yeah, I didn't know it was December. That's for sure. I was like, I don't care what month it is. I'm here. I'm happy.
You better follow me or be left behind. I suppose there's no really bad time. It's just that whenever you want to get good fanfare, now you're playing a month long, long launch plan versus a single day with a great precipice and a lot of attraction. No, it's just, I think you just made it harder yourself, basically. Yeah, if it's fair enough, we'll take that.
I don't see bottles just like, let's just do it and get it out, which is come back and just go. Right. There's no good time like secure today. Like security, I would rather use secure today than tomorrow in every case because don't delay security. I think just timing is not the best because we couldn't do the show in December.
We were like, we're checking our breaks. We're talking about it now. But here we are December, January 28th, talking about it. Super important though. I mean, I think the one thing that I'm reading here is obviously that when you make a change, when Docker makes a change, when you change the default, it's a ripple effect about the industry.
And I think about one, the effect of that ripple and then two, creating that ripple. My gosh, behind the scenes, what kind of thinking, what kind of specifications, what kind of planning, how do you architect this new vision, this new build pipeline from build kit to all the, all the free artifacts that are given away for free and then re changing how you productize it to create revenue as a company. I mean, it must have been head of engineering undertaking. You know what I mean? It's a whole company effort.
I'll see. My job is easiest in all of this. I mostly say, okay, we should do this. We should do this. Let me know when it's finished guys.
And then, you know, look, Docker's got a great talent and so rally and stuff. In this case, like this is always part of the thing we wanted to go do and try to put in, yes, there's lots of stuff to go figure out. Study first for most with don't put stuff out there. Like it's true for everything, but if you're going to make a big product announcement that we have like the quality, the underpinnings of this technical security have to be stellar. We simply cannot do it.
If you don't do that in part, because, you know, not from a brand damage on call, like that too, but first we are the source of supply chain. Like people will take what we put out there. And yes, we'll get, you know, if you do something best, we'll find out. But like really it's like a responsibility of like, whatever we're doing is going out there. So we have to deeply, deeply care about that.
And so that comes from like, just a team that's on this and experts, we have on this. Like going deep here, right? We've got like decades in these areas. And they've got a bunch of strong people here working on it. And then there is a product and strategy and all that we work through like, okay, how to actually get this out.
Magic community, management through this and we'll throw all of that. So yeah, this is definitely a whole company effort for us to go take on and start what we're doing. This is just start, right? Like the vision is secure entire supply chain. For those job is like, you know, void main down.
Like we want to address everything. Make it to packages, get you build pipeline, secure entire supply chain as we can get policies out because we sit everywhere in your DLC from laptop to CI production to registry is going to dressed. Let's try to get to where we can secure all of it. Well, friends, I don't know about you, but something bothers me about getting back. I love the fact that it's there.
I love the fact that it's so ubiquitous. I love the fact that agents that do my coding for me believe that my CI CD workflow begins with drafting tom will files for get it back. That's great. It's all great until yes, until your builds start moving like molasses. Get it back.
Actions is slow. It's just the way it is. That's how it works. I'm sorry, but I'm not sorry because our friends at namespace, they fix that. Yes, we use namespace.so to do all of our bills so much faster.
namespace is like get up actions but faster and like way faster. It caches everything smartly. It caches your dependencies, your Docker layers, your build artifacts so your CI can run super fast. You get short of feedback loops, happy developers because we love our time and you get fewer. I'll be back after this coffee and my build finishes.
So that's that's not cool. The best part is it's drop in. It works right alongside your existing get up actions with almost zero config. It's a one line change. So you can speak your builds, you can let your team and you can finally stop pretending that build time is focus time.
It's not. You can do namespace.so that's namespace.so just like it sounds like it said. Go there, check them out. We use them. We love them.
And you should too. namespace.so. Can you estimate the time to shipping from the point where the phrase Docker harden images was like a white on a whiteboard somewhere or in a product roadmap like we're going to do this someday to deciding we're going to do it now. And then from that point till either December 16th or May when you actually shift the original. Let's see.
I'll try to jump on me. So when you see a join, I would say Feb of last year, that's when the site is rolling around and before seems like we're going to do this one launch yet. So I think from that point, people will still set from the team at that point. So I don't know. Only Feb, but Feb something like that.
And we got it out into like a limited release like early, limited release. And I want to say three months, we're customers jaded within the next three months. So that got us to like summer. Then we grew, kept growing, growing, growing. And then I think the real, we knew we wanted to make a few people go and show when.
But I think the real thing like, oh, we should work with Feb. December, I want to say it was like, honestly, it was like maybe early November, okay, we're doing this or like right on, yeah, we're supposed to think it was whatever call somewhere on there. And so from then till that was like a, probably a four week sprint. That's all pretty good. That's all pretty impressive.
You said you have a good team there. I mean, that I was expecting longer. So I guess, you know, congrats to you and the team for really a pretty quick turnaround. Yeah, well, since day and age, you don't have time. I don't have time.
Yeah, I'm going to get done yesterday. I'm going to get done yesterday. I'm going to get everything done yesterday. Because also the stuff we talk about continues, but like, you know, this, this, a, this mode of working is critical for us for everything we're doing. And you know, we, we talk about that like it in that space in particular, the time I just said in the air world has to shrink 10x.
So this muscle is in general as an Asian organization critical for us. This part of the conversation talks about the time. Eight months is when I roughly kind of captured there to go from Docker harden images to GA to let's make it free, let's release it and it's released. But the tension behind it has to go back beyond that. Because one thing that was mentioned in the announcement post was, I'm going to quote this, it says, and while some vendors suppress CVEs and their feed to maintain a green, a green scanner, Docker is always transparent.
So there's this, it seems like if I'm reading this correctly, you got Docker, which is, you know, the supply chain essentially of images, Docker hub and the trust factor. And you got vendors out there who have been doing versions of this, seemingly not being fully transparent, making their builds green when they're actually not green. Can you speak to not just the cycle to get here, but the tension that rose to say, we've got to take this on, we've got to make this a the way, this default stands to be made. Can you speak to the tension and what it took to sort of own the responsibility? Yeah, absolutely.
So, you know, these ideas go way back, right? You can go to when the Google just sort of started, right? And so like, what are the ideas go back? And so discussion has been there, like what do we do here? How do you manage this?
I think there's been lots of like in the past discussion of how should we do this? And then there's a bigger business here. Should we go after this? How do we think about this versus what else we're doing across the company, etc. So, there's been, the discussion has definitely been there for some time, and it was the best way to do it.
I think few things came together for us and said, one, we should change clarity of like, we're doing the stuff, we're doing the stuff, we're doing the stuff, you know, do it. Second, I see on the title side, like clear clarity, like how we should do this. Like, no, this happens, like we're going this differently, and here's how you can completely like a next statement, other thing that industries adopting now and we're helping driving that. We're working on the scanners, like this is why should we adopt it? It's being, it's a standard, but it's not universal adoption of yet.
And we're like driving that forward, making that happen. So the tension is definitely there. But before that, I've been here in half. I'd seen before my time, it's been there. It's one of those topics that's been in industry for a while.
And then the real thing was like, no, we should do this. And that was both business clarity and second, I'd say technical clarity on how to do this. And then on the speed, we built a bunch of stuff, but we get to leverage a lot of Docker underpinnings. So we've got to look at here, a Docker engineer. We've got hub here, we get to leverage all of that for how we get to go drive this and we can have it.
Yeah, I think the core part is just realizing this will come from like, we are a core part of supply chain. And so we have to start not just the concept video, but take on the broad responsibility of how to secure a supply chain. That's both a business opportunity, but it's also almost like a responsibility, given our position, where we are. Can you go deeper into this Vax? You've said a couple of times, vulnerability, exploitability, exchange, it seems like, I'm not steep deep in this, I'm learning.
And I'm pulling back the Google results and the stuff. Yes, that's the Google here and there, because it's just easier sometimes. It seems like this is a way to be transparent. You software suppliers to be transparent about particular areas where you're still vulnerable, but you're able to do so, it seems like, in a community mindset where, hey, we've got this thing, we're delivering it, it's not fully green. And these are the areas where it's not green.
Can you speak to the behind the scenes and what the exchange actually is? Yeah, so the way actually that is, can have packages, so typically, if you're just strobe, you have packages and then you have your own CV fee, like, hey, we will tell you what is CV easier. And that's one way to control it. You have this root issue of like, well, there are CVs, but the CV is in the national database, but they're not actually an exploitable CV. We don't think it's actually exploitable in our code base of the way this works.
So if you publish your own CV fee, you can just not publish it and that's what we do it. We take a different approach, where we publish a fully transparent response, scanners can take that and they pull the central CV fee and the CV series, then we publish the VEX fee, that says, okay, here are the ones that we don't think matter. And the other approach, you're missing that transparency and that logic of like, oh, here's everything, here's what we think is matter and here's why. And which is a better approach, because then we can talk about it, right? And we can see whether you agree or agree with us.
If you feel like, also for CISOs on the right, anyone else, it's very clear what's happening. So that's the sort of thing we're doing, the approach we're taking here. Now, this is being a standard for some time, it was just like never, so I can tell like broadly adopted yet, because like with scanners we're working through, somehow it's something that I didn't have been working until getting it in there. And what it seems like is it's a focus on what is exploitable versus the things they're not. So you still have, let's just say security concerns, but these are the ones that we should pay attention to.
These are the ones that are actually worth paying attention to and actually cause real harm or damage. It's both, you put everything that is, which I don't do it stuff, so we put everything that I care the ones that we think are coming, but then all six, which ones I'm not exploited will put that in there too. So we cover all of that in there. What about this tension? Can you go maybe one layer deeper in terms of, who has been the supplier?
So you got Docker, then you got third parties, not so much by name necessarily, but like what are their roles in the supply chain? And why has this moved to a free tier with these kind of table stakes requirements? Been a great move compared to the prior way. Sure, so maybe we think, maybe the way I'll talk about this is, I think like Docker Hub has been, I'd say the easiest, the biggest, main registry for purposes, continuous images. There have been other companies that have come up that are selling harder continuous images, right?
So that's been a model that other business models that companies have come up with started doing. So then the question for us was like, well, when is it like very natural for us to do that? So we should look at doing that and it's a thing we've discussed and not done specifically. So that's a very natural thing for us to go do. I think the tension in Docker module is like Docker Hub could have remained just the open source usability first place or really is like no, Docker should take on supply chain security all up.
And I think that was sort of changing like our product and business thinking. It's like, if you look at our like, prox, strategy pillars, supply chain security should be a core part of it because we are core parts of our supply chain, not just for images, but also Docker engine is right. It's once everywhere. And so we should take those two things and drive supply chain security everywhere. And so that was the thing that sort of mental framing change that was needed here first to go drive with this and go do this.
And now the other thing for us from making these phases two parts. One, it's a general approach of welcome to adoption and then drive use that as a funnel. But maybe second is like, you know, we have a holistic platform and supply chain security and secure content is one part of that. So that's why for us, maybe there's somewhat of revenue impacted by I don't actually think so because for anyone who needs compliance guarantees there's a big tier for everyone's supported option. But this is a, this is one third of our business, not the entire business, right?
So that lets us go do things where we can draw adoption for the community. So it's very much a long-term play. Like this is not a short game play. This is a long game play. And you know, Jerry, we just, we're about to release this episode.
I think it might be out, I don't know if it's out or not. I don't know. About securing MPM, this reminds me a lot like that. I'm wondering to show if while you were in this tension period with the ecosystem and realize the responsibility and then in this announcement back in February internally, hey, let's do Docker hard images. Let's actually put the effort here.
Let's do all the research. Let's figure out what we have to tie together. And let's make a concerted plan to execute. How did you look at the rest of the world in developer land to say, where are the supply chain attacks happening? And what are their issues?
Cause there seems to be a responsibility you've taken on and just put it bluntly, GitHub is not with MPM at least based on our current examination of the situation. You've taken the responsibility and made a concerted effort and launched in the ones. And you've done it regardless of maybe here in this conversation, regardless of potential revenue loss, I think it's a long-term play and you're adding trust to the layer and security to the layer, which is good for your brand long-term and good for Docker. And me, like I got a home lab, launching Docker, it was no daily. I want that to be trust and secured.
How did you look at the rest of the world when it comes to supply chain attacks or supply chain security? Was MPM one of the examination targets for you? Yeah. So numbers are turned back to absolutely. One thing we before do that, just a revenue topic first, actually think of this as very excellent for us to be great, right?
Like actually think of this as a level of like, we're having this conversation because we launched Docker is for free. I'll listen to it. Hopefully, maybe people could use it. And within companies, they'll want to start the CISO's want. And that should really to like them calling us.
So like the reach, basically our reach would expand here, right? So if you're this is like a level of like selling for us and we're starting to see the play out, just never in front. On the other part, you're absolutely right. Look, I can't tell if supply chain security attacks have actually gone up or we just like talk about them more, but there is definitely a marked increase here, right? Like in PM Stop, like the Shai Hoos attack, it just happened.
So I know that I love that name. I just watched the show and then I was like, ah, now I know why I showed it. So we absolutely saw that and see this happening broadly. And when you look at that, this is what I was saying, like this is the start. We have right now with our managers.
We've started securing a critical part of your supply chain. There's a lot more to do. There's a lot more to more than this supply chain. There's packages. It's one time.
And then the ambition is to get through all of it and start looking at it all. Mostly because it's just the tax increase, and supply chain attacks are the ones that have massive impact, right? They just ripple out. And so what you see is a critical aid business need and a need for like software across the world. And then it's also just critical foundation needed.
I think if you're going to live in a world where AI agents are writing more software, like if you don't have secure foundations, that's life system, get way way worse. And so as we look at our AI play, we take secure contents and supply security, critical pull up for that too. So that was absolutely all of these things. And to be clear, we're not address all of them, but this is why this is a, this is not a one and done, you've got documents, that's good. Not this is a, this is a.
Start somewhere. It's still there. Now we're going to walk in the. So one thing we didn't cover was the breadth of the announcement of what was happening here. So if I understand quickly and correct me wrong, is over 1000 hardened images and helm charts are not available.
That's a lot. You're building on Alpine and Debian. These are familiar. These are trusted foundations we're building on. And it's obviously being announced as open source under the Apache to license.
So DHI is now free under Apache to that's the current state of affairs. Where do we go from here? Like what is in that 1000 hardened images in those helm charts? What is not there currently? What needs to be there?
If now is the flag moment, you know, where else are you going to go from? I'm not. Yeah. So a number of things. One, we're going to roll out hardened system packages.
Also today, a lot of system packages that you want come from upstream repos, we're going to start offering our own hardened system packages, but from source we'll patch ahead if we're in when needed. So we started doing that and that's going to come out. We're also going to click like a language packages, attack that language by language, go into that and get those out. On the enterprise side, we'll look at long term support typically packages have like LTS, they're off like two years. So you're getting patches from upstream with three years.
We will you can buy long term support from us. So we keep catching patching and different prices, you know, for various reasons, they move slower. And so that's important there. So we expand the way to think about this is like expand the breadth and coverage of all the things, all the content you would care about. Let's get that out.
The next thing I've left for us, I think, is a secure build pipeline. This is not another thing we're trying to look at. Do you see all the interest here? And so we figure out how exactly we do that. We want to get this out.
So anyone who's building is operates to run on us and get the benefits of starts to be built pipeline. And we're getting that out from there. And then I'd say last thing. And this is like a much positive we started is I really wanted to get some agents out here that help you with either migration or help you with understanding your state of affairs and get you hard to get them secure. Like basically everything we can do to have the foundation to make it secure and then help you move towards that and manage that.
So I'm cruising your hardened images directory catalog as you do. And I've been looking at a few of these and it's very cool. I have some questions around like the security summary, some of the PHP image based on the 1392 packages. That's pretty slim. Seven tools included if you're in on the PHP image.
And it has one medium severity vulnerability, 10 low severity vulnerabilities, six unspecified severity vulnerabilities. I assume those are upstream vulnerabilities that you know about because you're not doing hard in packages, like those things are just like you're patched up as far as you can go, but there's just known vulnerabilities. Is that what those mean? Good question. So the lowest unknowns, since my step at the media one, I'm going to look at it afterwards.
Typically those will, if there's any high we go ahead and do it. Medium should fall that category too. I think for us, like it should be something we go after soon. So I'll go get that one afterwards. Generally, I could of course, any mediums we try to get ahead of and drive quickly.
So when you have like say, there's this medium here and we don't know what it is, I can't seem to find if it lists what that is somewhere. I think that'd be pretty cool. Addition. It should be if it isn't yet. It'd be good addition.
Yeah, that'd be a sweet addition. I do see a full security details and it still shows the vulnerabilities list, but I can't seem to find it at the moment. Anyways, is that then is that a known CV against the package? Well, against one of these 92 things that have been installed. Yes.
But that doesn't necessarily mean that there is a patch or is there a patch that just hasn't been applied. If there's a patch we applied really fast. Like ours, like in the other patch, or in the likely case, like not a patch. But even then we typically try to go work at it and get a patch in place. That's what we do for high.
So the medium, it depends a lot where we are on that. Yeah. I mean, lots of packages. Yeah. Lots of images.
It's probably a never, a never any task is just to continuously be yeah. So this behind this machine running, right? Of software and people. So then the other question I have about is the scout health score, which maybe it's not as new to me as that new in general or just new to me. Start to be something we've had for some time.
Sculpt is our own scanner that we've had. And it's own scanner. That's kind of everything. And now we should just put it in here. So you can see the health score that's there.
We've given it, you know, in hub package owners can see the health score for their package that they're publishing. And now here we've done it. So any of you can see that score of package we're publishing here with the DHI. Yeah, that's super cool. So this one has an A score and it has all the reasons like no high profile vulnerabilities, no fixable critical or high vulnerability sign supply chain, edit stations, no one but it's secret.
It's no, but it malware like on and on and on. And I assume it's a score for every image you'll have on here. There should be score for every image and there should not be any score slower than an A. And if there is a full of them. Well, if we have a, I think through my scout score and just say, show me the ones that are these are lower and then, you know, get the word.
You mentioned, actually, I just mentioned one thing there, which was like knowing that was secret, et cetera. So that's another thing where it's not just going to use the package playing CDs. We go to actually like, you know, a list of stuff like what makes it secure and it's shown us that like there's no credentials and that's not the stuff. And keep on getting lots of patches from all the time. And we scan every single one of them.
So there's a mixture of the I running here and people to make sure what's happening here is secure. It's cool stuff. I think like a good step forward for everybody. It's honestly, for me, it's been, I'm inside the house. So it's, you know, by some state, but like seeing the team here, just running this and defines and have very strong opinions of how to approach this one.
Do it. It's been, it's been really fascinating for us to do that. Right. It's coming here and see everyone who walks into the space and do it because a lot of depth in here as we've done this. So I'm excited now and patient to like do all the stuff that's part of the vision in this space and build this out.
And I'm hoping with everyone listening, we should go try DHI. It's too easy to not to or too easy to I guess. Too easy to and there is enough to do it. Yeah, too easy to and there is enough to I like that. So better way to say it.
There you go. This makes me feel like containers are the way even more so now they've already been the way for so long. And this has been the Docker story arc since, you know, Solomon to now, essentially, is that it took the world by storm. We now have the containerized way to do things, deploying applications, become used to never. And, you know, if there was any scrutiny on how that plays out, well, now that you've made this security mindset, a first class citizen in the way you deliver, which seems like the obvious way to do things like to not do it this way seems like that's just not right.
Yep. Is a containers other way? Would you agree with that? I think containers are the way. I mean, like in general, I don't think containers are going anywhere, even as application paradigms are changing and the day containers are a great way to bundle up software package as well, understand it to port across systems.
1000%. Can you speak to the ecosystem and the partners? So external Google, Mongo, the CNCF, Snake, JFrog, a lot of the players in the space circle, CI, socket, even when you're friends at socket. Can you speak to partner level involvement in orchestrating all the things, I guess? Yeah, there's a ton of partner involvement, right?
And I got various kinds of scanners. So like Wizz is, for example, we work with them to do this stuff here, like all the various scanners, a bunch of scanners have to integrate with us to drive that. There are CSVs where they put images from us and understand that's working with them. It's also interesting things we can do with them over time and figure out various, you know, they have trust centers to have them integrate with us to, right? So all of their effects will be their own scanners and their own registry caches have them integrated with this.
So we do that. Then there are other players in the sort of, I would say, supply chain or security space, right? So sneak or socket is interesting. We actually have a partnership with socket that I think we announced where you can get images from us and build into a socket. And so you can get a socket firewall and get their benefit over, please, by pie or I forget which one they're on now.
I think I'm PM. And so the number of, like the ecosystem, like Docker is in general, that, you know, the DevTools badge interface has lots of plays in it and the Docker is just like such a core part of the next. So we have lots of plays we take place. So we do this. We have a key on that goes around drives very smart.
There's a lot of strong relationships with many people here with Microsoft. Actually, I was built, when we said LA, the name is really, I was at the last year when you were there too. That's where you announced it. And we had early integration with Microsoft for this, where they would take Docker images, but before deploy them and keep up with updates and get us deployed to their pipeline. So there's a number of these kinds of different ways to be doing everywhere.
I mean, the way maybe to think about this is if you want to go drive broad, change and impact us, long, change critical, but we have to go through it through all the various, the key sort of, you know, systems and players in the space, like you got into broad impact without working with partners. What does that like? Do you have to, if I'm one of these partners, do I get early access to documentation? Do I get early access to maybe an embedded engineer that's, you know, works for Docker, but actually works for me because they're inside my organization, helping me better understand, organize the way we work around securing Docker or working out orchestrations, orchestrations of partner. How does that, how does it play out when it's actually boots on the ground, people getting coming in gold?
How does that work? Very based on the state of the partner state with you. So for example, we said early Microsoft on we was just getting started. So in that case, with PMs and engineers connected, generally, when we're not going to join Slack channel or something, and then we're deeply connected. And that gives me like doing some cool build as very early.
So they're getting early access from us and working together. When you're later stage, then you have connection between partnerships and product people generally and then you drive that forward. Right. So depending where we are, we do this. But the maybe the approach and the philosophy here very much is succeeding partnership is not the job of like a partnership department.
It's a job of like our company with everyone. Right. So we figure out what's needed and drives that. That's a general approach to everything. Right.
It's not like, yes, I have departments to focus on stuff, but like we have to operate as like one. And so depending on what's needed, we'll have engineers, but then we'll have essays, but then whatever's needed to like, manage this and do this as we work with everyone around it. And so there is a lot where we are and we'll see it as it works. But like it's absolutely like a, it's a becoming a cross-function team effort, but default. Is there a framework or a specification or a substrate that can be borrowed or extracted from all the work you've done?
Your team has done for the last eight or nine months accomplishing this mission. I'm just thinking like if if we want MPM or any other registry out there to have similar characteristics or similar concerns around security, is there a substrate here that can be extracted that says this is the way we secure registries across the board because we look down the line, you've got the idea that you've mentioned hardened MCP servers, for example, this is a very thing around the answer. No, AI, that's how can we secure AI? Then you got things like maybe hardened libraries or system package, something like after any time you install anything, like, is there an extractable thing here from this effort that you can lead or provide a spec to? That's a good question.
So I can first start with my mind is actually the first thing is like at least extracting like the principles and the like and goals, right? Being very clear about that, like we have some core principles that they've applied. And I said it was like the house might defer depending on the domain of what's needed right for sure. And so then it's like, what can you extract like a technical level to there? I am not sure.
I'm sure the stuff here, but especially if you think about stuff outside container images land, then it's interesting and like a little different. But the principles definitely do and the approach does in terms of common things that you can pull out there. I think there are things here, for example, like the way we're building, yes, we made it for images and containers, but I suspect that like if you sit down and look at it, core parts of that stuff, we can pull out and make it work for like non-continent stuff to maybe, right? And I'm bringing it a bit here and say that. But there's a core parts like how do you do build a secure build pipeline that should apply, I think, a little more generally to you as an example, there are parts of like some of the agents we're running that can apply more broadly than just for because they run at the code level to verify security or thousands of upstream back up yours, but you'll be getting right.
So maybe stuff like that, but first up, I can think like, okay, how do you secure non-continent registries, et cetera? First up comes one very much is like, let's extract the core principles. And then we can see what components are, for example, yeah. Do you have that in like a manifesto? And if not, can you, can you give it to me?
Yeah, I was saying this. I'm like, I think I teed up the next question. I really want that. I mean, I really do. I think, well, because I even think about like, I want, I want your, your what and your why.
And I kind of want a little bit of your how, but not all of your how, because my house is going to be a little bit different based on my context, right? I want to know your what and your why and how you think about the problem, because I want that's the, that's the intellect. That's the intelligence. My house is going to be different if I run, you know, a different kind of registry that is not at all images or container images or around the things you care about. It's going to be a way different thing.
So don't tell me the how, give me the what and why. Yeah, yeah, yeah. Yeah, absolutely. That's actually great. And also, you know, riffing a bit here, even though how to freak in my video that you should produce maybe like this, maybe another opportunity.
That's good to you. It's my dear. See, maybe another opportunity. What we see and see if someone is producing spec of like, once you've done it, like, you know, what's an s bomb and it's a signed artifact saying, Hey, here's what I've done. Here's what's there that someone can take and understand and then be like, OK, cool.
This passes the bar. So, you know, if you can agree with what's in house and cool, someone has to do that and produce a result and artifact that captures all of that. And then depending on what you're doing, you can still like have a central, a central like, you know, review or grader or something across stuff. So it's unlimited to just get to this, but like expand broadly. That's something interesting.
You can also do this for like runtime security, for example, I think. Cool. All right. I think you gave me an action item here. Go right down.
What's a podcast? I mean, I want it seriously. So the moment you release it, email me personally, if you don't mind, because I'm going to read it right away. Done. So here's the thing about network security for enterprise.
It's usually a six month project involving hardware consultants and at least one person whose entire job is managing the VPN. No, literally that solution said what if we could do that in 10 minutes? What is no letter? It's a toggle ready network security platform built for businesses, VPN, access control, threat protection, all this stuff all in one place, no hardware requirements. It's built on zero trust principles, which means only the right people, access the right resources verified every time and is powered by Nord links, their VPN protocol that's built on wire guard.
So it's actually fast for IT admins. This is a good stuff granly control over who access is what, from where, on which device built in threat detection, skin provisioning for automated onboarding on boarding, deploy minutes and scale in clicks. They've also got a crap, right to bring Falcon in point, protection to small in mid-sized businesses so you get enterprise grade, multi-layered security without needing enterprise-sized IT team to run it. Here's a exclusive offer for your friends up to 22% off Nordlayer yearly plans plus 10% on top of the coupon code, changelog-10-Nordlayer, trap risk free for a 14-day money-back guarantee at Nordlayer.com slash the changelog, once again Nordlayer.com slash the changelog and use the coupon code, changelog-10-Nordlayer for the 22% off Nordlayer yearly plans plus 10% on top if you use that code.
Enjoy. Talk about forward-looking things. We're here in January, just until in January, going to February. You've done all this work. It's released.
It's out there. We've got table stakes, hard and security out there for Docker images. What is next? You've got great partners in place. You talked about how you integrate with them, how you work with them, how you involve them, and you have hopes for new trust to be built on in the community.
What is in your mind instead of engineering, both leading your team but also just all of the trust they're thinking about Docker and its trust level, what do you want to come from all this work? There's a lot here. So in terms of what's next and how to think about the impact that will be quick to get here. So first on the custom stuff, I guess I should do a lot more. We've got to keep that package, expand the ecosystem of stuff.
We cover a lot more. Can you just do packages, get into language packages, build stuff with enterprise layer. We need to get our secure policy, the ability to find policy and force it across your entire tool chain. So working on that, getting us to get builds to the deeper map here for us to go work on and drive. But maybe what's the very impact we want to hear?
One, I'd love to see this beat default starting point. What is needed to get into the paper? I'm building something new. Why not start with Docker? What all is needed to achieve that?
I expected to make sure of technical and non-technical things needed there. One, it's like, for somebody that's starting, where did they learn how to start? How do you make this beat default easy path? For a lot of people, I'll copy someone else did. Or I'll just do whatever I would actually tell me to do.
So how do we go and influence all these places and how to speed starting point for everyone? Because that should be a key thing if I jump forward. And here's the future. Great. The next popular open source package starts with the H.I.
Because why wouldn't it does the thing you do? Let's have to go achieve that. And the reason that matters to us, from the trusty goal, the real goal of like, makes off of security, like on the business side, that then really leads to friend prices. They get to buy and buy that security from us. Yeah, just worry a little less.
One less worry for a C so or one less worry for a head of engineering to think, gosh, our supply chain needs to be secured. Somebody should do something about that. Let's just trash the engineers, right? Let's shift left more, okay? Just put more on developers.
Right. Even more. That's one way to go. Yeah. Yeah.
Well, that's very much, you know, just start green, start green, stay green. Well, I like that. Start green, stay green. You should take like that. But then the website, if you haven't done yet, t-shirt that, okay?
That's how you create a false, right? You create a movement. You see that kind of a tangent. I don't know if a little bit. Do you see that?
I think it was the show Billions or something like that. Honestly, I don't even know. I didn't watch the show. That's all the clip or he was talking about Lemons. Do you see this clip ever?
I don't know. I see the show. I don't know what it's clip. Well, there's a known term out there, you know, when life gives you lemons, you make lemonade. He's like, no, no, no, that's not what you do.
I'm gonna just paraphrase you. I forget. It's just like deep dive. Now you don't make lemonade. You make lemon scares.
And he went to this whole story of how you make lemons the defaults and you make the tagline. That's not cool. That's Lamont. You kind of give it this cache of sorts. I think if you do something like that, you create a movement.
You create a change. That's how you start green, you stay green and you make that the maneuver and it's essentially you make it not cool. Yes. That's the ultimate's nerd-snipe. It's the inevitable.
Like, this is the way and the longer you take to get there, the further behind you are. Yeah, I'm 1,000%. And so if you could do that, and then also, I don't know, I do a video for you on a speed of speed that is the default thing that every agent recommends and starts, because that's just how you're going to go down anyway. So Yeah, I do recommend this. Still black box, I guess, away, right?
Yes. That's just from the side. It's not from the bottom. It's from the bottom up. Freaking it out.
What's left? I know we covered a lot. And you have a big role there. I know that there's a lot happening around Docker in general. I mean, this is a big announcement.
There's AI things happening. What is your stance on things in that area, around the Docker world? That's, you know, so we don't know this. But like, they actually have a clearly big focus for us. And ex-solve comes together in my mind.
We will talk a little bit about how we think about it, thinking how I think about this a bit. So Docker, you know, every user that is a core part of the SLC, we help go from lateral production. And we can solve for like the big growth of apps that happened over the last decade, like Cloud Data Apps. It removes the cloud. Everyone builds services.
It continues to do that and drive that. We solve all that with our packaging, with the hardware content distribution, with the engine, for the running. Well, there's two big shifts happening now, right? Everyone is the SLC is changing. You're developing code in ages, but literally the entire SLC for you build, test, publish, run code is going to change and become AI first.
And second, the kinds of application you're writing are going to be agents now. Thanks, go to apps agents. So I kind of see a very natural thing for us is like, you know, I think of Docker as our job is to help engine and engine team securely build into software. And so we've done that with the last decade for the way things have worked. And now we're adapting that for AI.
A core thing for us that we've had with Docker and Docker and Docker and security trust we talked about, but even more important with AI agents, I think is trust. If you're not trust across this layer here for agents, that'll help people trust into agents more. We see today everyone's writing text code, then what's shipping to next code? In large part, because there's not code trust yet. Even when we're using agent, how to let it run unfettered, do I trust all this output?
How to test all of this? How to get this out? How to know what it's building with? So that's the framework we have. And we're starting with a day of runtime environment.
So we've got Docker, Docker engine. This is how you build and package and run isolated environments to containers. Well, now we've got a slightly different thing with agents. So with coding agents, we think, I frankly think it's crazy everyone's coding agents started the machines and then just like, and PX installs M C B, so it's, and runs the machine. Like, talk with supply chain risks.
And so great. But to be clear, the product we've been fits here crazy, right? What I want to do is I want to use an agent and let it run. I don't want to run a Yolo by default. Go do everything.
But just give me some security. So we're going to adapt our engine, build a new engine. The way I think it was a really new runtime engine for untrusted workloads. It should be placed where you can go put in, like a coding agent. It needs a computer.
It should be able to go run to everything it can do, with security guardrails. So it'll be default, we'll have micro VMs here. So if you go look, we have our initial start of this. They'll just come out to see the Docker Sandboxes. You can do Docker Sandbox Run Cloud.
It spins up Cloud in a micro VM. Around that, we have network proxies that are outside the VM. So when it tries to go outside of the network, we run through proxy layer. We have a credential layer here, where you don't have to give it your credentials. But if it does not get hub, we inject the potential outside.
So the agent doesn't need to know if you secure content data. You control files that has access to, control where it goes. But let it run. Then for MCP, the server adding or MCP security. We have a trusted registry MCP service.
These are MCP service that we vetted. We run through security hardening here. We're also building the HR version of these. And a gateway that's about the end. And the gateway where we can start injecting a lot more security rules too.
And so the vision is build towards a secure runtime for untrusted workloads, you know, folks including agents. And we'll make this work with locally and remotely. And give you the same things. You can be working locally, who have a cloud, that will be coming out soon. And they actually have some only partners who are working in something already.
But as a developer, I should just start in a Docker Sandbox. I get all the proxy benefits. I run my agent unfethered. I get all the security benefits. I'll get cloud enterprise.
They can manage governance and all of this stuff. And then we try to supply security in here. And the way we're doing this is create by default, build on the secure content we've talked about, get that in here, et cetera, et cetera. Let me pause. This is like a big, big push for us.
And I think like sort of, you know, what should the next? Well, I want to say what should the next five? Is it a look like? But I'm talking AI. So let's just sit there next year for a minute.
And we'll see what happened after that. Right. It does make sense because I'm kind of a dash dash, dangerously, skip permissions kind of guy. You know? So when I run cloud, that's where I go.
I'm just starting like saying yes. You know what I'm saying? So I just, in a way, yolo. I'm not yelling on production stuff, but I got the word in the fly for a reason. And so what you're saying is, in this future world where we may be going to, in this next year around AI, I can do that in a way that is less dangerous because it's containerized.
It's compartmentalized. It's in its own micro VM or a sandbox. And so the danger is really just micro VM danger, not Adam's, macro pro danger, where I can, I've seen this, where there's a hacker news article on this, I believe something like deleted there, the agent deleted their entire machine. You know, that's a possibility when you live there. Yeah, it's done here.
So just to, you know, paint the picture of it. So there's the VM isolation. And we can do that and then protect your home directory, your directory is a bit, but it's more than that, right? So we can talk about just file for a minute, what you want to protect stuff. But now, well, what if you actually need to read some folder?
How do you manage that? So this is, it's different from like containers because containers you think of like, backage and static and then scale them out here, like a runtime that actually needs to be dynamic. That's a nature of the thing. But I still want security. I want security to be true about it.
So by default, limited access, once we go out, we can decide what we approve what we don't let it run. And when it does, like control rights to sensitive areas, when it's right out to the network, it's not just to put a gate there to anything that wants to do outside this box, but a gate with a network proxy. That can control not just where it goes, but over time with that in deeper rules here, that is it doing something dangerous? And we can work in various levels of the stack as we do that. Gredentials, don't give this thing credentials.
You want to put them GitHub, they're not put on the agent, put that outside. And as you can just try to talk to GitHub and we can check the credentials. So turn this stuff up too. And I don't know if you followed the plot board stuff. I feel like I started, does that sound Saturday or something?
And then it's been like, I'm using it and then I just like to say and follow the speed. And then I think yesterday, there was, I forget the name of the person who wrote the deep security article of how he used Skill Hub to get him to install the Skill and it gets so very, very short, is why he had showed how he could. It just goes to show like, what's happening here is like the potential is tremendous. We all want to use it, but the security is a very, very real. This is not the core of what I think like our job is like enabled devs to be deeply productive and add security.
And just this is not a space where like this all has been true, but it's even more true. It's more clear now because the productive benefits and security are just like 100x what it used to be. Right. Everything's faster, more pervasive. Yes.
We're just flying by the seat of our pants and the stakes are high. And I think it's like a perfect moon for Docker because like when you think about isolating, isolated secure workloads, I feel like, you know, it's Docker, it's not Docker who else. It's Docker, you're staigering, just trying to say it, you know, a couple more times here. Yeah. And so this is what we do local and cloud health.
And I think cloud's critical for us because as you said, doing this stuff, I don't know, I was doing what you go recently. I've got the point now where like, I don't know, cloud can run for like a couple hours for me and produce good quality code with tests and everything. I want to run off somewhere else. So I can like close my laptop and go do something else and I want like 60s at a time. And so, but I also want easy, I want security to talk about and I want easy dX between local and cloud because I come to the into it.
And so that's the other point, the engine grid like building now where the engine will run locally and remotely and we can get security and seamless, you know, local remote experience for you. We're going to have to get the ID back and apply, but I'm not talking about the actual ID. I'm talking about the AI development environment. That's what we need. Yes.
I mean, you have that for the cloud development environment. CD right? Yes. Let me take your machine away from you. Let me put in the cloud and let me attach your ID and or van or whatever you want to rock because it works.
Yep. You know, we need an AI DE out there where you can just develop in the AI and close your laptop and move along and let it just get churning. And then build back what you need to know your security layer there when you need it. And so yeah, this is like, yeah, this is like adapting Docker to be the engine across the entire STLC for AI for glutes. And so that's on development side.
And then we'll start doing stuff across the rest of the STLC too. We've got about security agents. We've got a lot of talk of links. She's just using CI left. We're working all these problems here.
The goal is really help you securely actually help you out securely, connect to the right of the user agents and then help realize that and actually get that shipped out. I know that's safe to secure as you do that. I definitely think there's maneuver you've made with hardened images. I wouldn't say it's a mensit necessarily. It certainly puts the cement down in this hardening to just go back to the play on words here because I mean, I can't imagine deploying software to production in a cloud that isn't in a container.
I can't imagine it just doesn't compute for me that way. Now, I am a system D kind of guy. So I do yellow here in my home lab. So I don't really do a lot of Docker stuff in my home lab sometimes, especially when somebody else's application and because they've already done the work, they've containerized for me. If I'm doing my own thing here, I'm usually system being it and I'm usually just running it bare metal because it's a VM.
It's in products box. It's my home lab. It's not high stakes. I'm already in the best way to get into this solution. I'm already an industry expert.
I'm kind of an industry expert at this point. I'm not introducing it. I'm actually learning this from now. I'm not looking for a component that we have from all of our stakeholders. We're looking for a component that we have.
I'm not discovering it. I'm guess I'm going to take off the issue of something that we're looking for. We're looking at that as a system. I'm going to be a little bit more than a quarter of a week. I'm not going to talk about a short time, I'm going to be doing something.
I'm like, when have you been off the stage just how to be in a lot of the problem of things? I'm going to be the first one to be on the average. I'm going to talk about that. or something like that, trust across the board. And that's true for you.
And then you write the DHI, the same ethos coming through of trust security is critical. It's critical across your entire software life cycle. Well, to show you where the head of engineering over there, anything left to say about what you do, what you're doing, what you're gonna do before we close things out? No, maybe I'll just wrap up, which is the thing where we had it, what we'd be doing, if it's successful, and if I'm comfortable with it, then everyone who's, one, I think, the entire engineering world, they're interested in moving to using coding issues. It's just gonna happen.
I think all that's running on you, secure runtime for agents, using the secure supply chain base that we have. So you use the runtime, the basic adapting our engine and our content for the AI world. And I think that is the thing whatever it needs, and I think we have a position to do that. And what is that? So I think that's the core focus for us, is believing like, you know, solve for the world of people using coding agents.
But as we do that, I think also within the platform that people need for running any agent. So that'll be the next phase once you get through this, that any agents running, any kind should run on this layer here. That's what we focused on doing, honestly, is a really fun, if you're lucky to have this gig, it's fun to get to be in the middle of all the change in software world and to be able to place a Docker that's doing this, right? It's still critical and so cool. It's really fun time to be a developer because there's so much change.
It's also quite scary, this change. You know, there's a lot of, there is some uncertainty. While there's so much potential, there's also so much uncertainty and so much pause, but also so much not pause. Yeah. I mean, it's such a conundrum, really, to think about the state of things, but like everything is literally changing.
We didn't expect this to be where it's at a year ago, like a year ago, the conversation was this direction, but not where it's at currently. And it's clear that everything from the bottom up is changing about how we develop software, how we deploy software, how we have to secure it, et cetera. It's a fun time because we get to rebuild it all. So if you're an old hat, you're like, okay, that sucks. I don't want to have to learn new stuff.
But if you're a new hat, you're like, sweet, let's build some cool stuff. But it is a wild ride run right now. I mean, everything is changing. It is a wild ride. Also, at least for me, like, you know, look, I should have to answer that.
Like, hey, where will engineering be and like, where software will be in two years? I don't know. What's really fun is that fundamentally, I think you become engineers to build stuff, like solve problems and innovate. And like, coding has been a key way to do that. We just get to like, do that at like, 10x 100x throughput now.
It's just fun. I can like, have an idea and go. And that's just, that's just fun. Good to see you guys. Good to see you guys.
Thank you so much for sharing time with us. Doing this hard work, leading the charge and being cool. Thank you. Thank you all. It's a lot of fun.
We're talking to you. All right. That is your change vlog interview for this week. We hope you enjoyed it. And we have a members only bonus segment for our change vlog plus plus people.
You get an extra 10 minutes of us talking Ralph, talking open cloth and talking roll changes. It's sort of the skills of like, deck leads and deck room managers and PMs. It's great to be the creators. Absolutely. We are the PMs now.
We are the PMs now. We've always been the PMs. Join today at changelog.com slash plus plus. It's better. Thanks again to our partners at fly.io to our beef freaking residents, breakmaster cylinder and to you for listening.
We appreciate you hanging out with us each week. That's all for now. But we'll be back on Friday with a Mel Hussein talking career renaissance, aerospace, my return to the blogosphere and more. Looking forward to it and talk to you then.