This is part of my live blogging from QCon 2015. See my QCon table of contents for other posts.

Risks

• Escalation of privileges
• Image integrity
• Unpatched containers
• Any others – see Docker presentation

Need to prevent

• “good” containers calling you accidentally
• “good” containers calling you without your permission
• “bad” containers calling you

production only workflow is an anti-pattern. network security isn’t enought

DevOps is about veleocity. Security and Risk Management can put on the brakes

Pod suurounds separation of concerns. Each actor (security, dev, etc) has own space

Can organize containers into layers

At event, can have ticket in advance or “will call” where show id. The later is like dynamic tokens.

Use host factory when provisioning

Impressions: the original speaker is sick and the subtitute has been at the company five weeks. I wouldn’t have know if he hadn’t mentioned it. I think I don’t know enough about containers though because some of this went over my head.

This is part of my live blogging from QCon 2015. See my QCon table of contents for other posts.

people aren’t logical. need to understand people; not just technology

with kids, you are creating a culture in your family. it’s about what you do, not what you say. modeling behavior. nice to see it played back to you as kids grow.

culture matters because:

• shapes how people work togther
• makes comanies great
• to blame when people not doing right things anymore
• powerful tool for new solutions

people need to be empowered and responsible

nobody should be allowed to treat others badly

culture in tech is creating shared expections for behavior

when something bad happens, does someone say not ok. if not, it becomes ok. culture is the accumulation of lessons like this

No manual on culutre. So learn to recognize, reason about and affect culture around you. In time, you gain the confidence to develop culture.

Conway’s law – structure of the architecture comes to reflect the organization of the company.

rules not written down, but we all know about the culture where we work

culture happens in real time – boundaries between people/groups, unexpected challenges, discovering the rules, rituals that reinforce, fear/anger/surprise/punishment/reward, stories are repeated

leaders set culture whether good or bad. if you set the culture, you became the leader

Once show dialog in team, info starts to flow in different ways.

“need to know” means “you aren’t going to know”

If had an API for culture:

Upper bound (ideal)

What can you do?

• What is your personal culture
• Choose positive culture over other rewards
• Ask about culture on interview
• Develop confidence to speak up when group and personal culture conflict.Thereare other places to go
• Choose people for culturl fit. Model values you want to establish. Avoid ambiguity

Q & A

• How handle public situations? People can only change so fast. “Let’s talk about this later.” Discuss one on one. Explain why a larger issue as group. Values group embodies are in conflict with your action. Choice of bringing closer to those values or looking for something new to do. Can progogate message via someone else on team in a softer/less direct way.
• What do if team culture is in conflict with org culture? Doesn’t matter; have to be prepared to leave as leader to endorse values – those values are that important. Will cause conflict with values/goals of organization.
• Culture takes time to develop. What if planting wrong seeds and waiting 6 months to find out? Takes time for person, but can still get team results faster. If inherit group, can take time. Will probably lose most of those people
• When culture improves, people still have bitterness about past. How deal with that? Harder when not starting from scratch. Bigger organization limits how much one person can change. Even if CEO. Hard to change. Person has to want to change.
• Fluid org structure. How switch teams when different culture on different teams? More about adapting over time. In startup, rate of change is so high, that changes daily/weekly. Don’t want people who will be upset if job/job title changes.
• How balance against getting super talented engineers? So hard to find tech talent that becomes a moot question. Better to get lesser skilled engineer who will be productive and a good fit. Want someone who will pair rather than impeed team work.
• What ask at interview to judge culture? Look at body language – eye contact, body language, flushing skin, talk to team members not just managers. Or ask, what would you do if X or tell me a story about X.
• How “infect” organization to change? Person who cares ,know what is important, talks about it, etc. If people want it, they infect others as well. If in conflict with org values, need top down change