Crucible: Towards a Safer and Consistent BOSH Job Interface
summary
Project replaces ad hoc BOSH job scripts with a declarative BPM/Crucible config that runs jobs inside RunC containers while mounting the stemcell filesystem, managing PID files, logs and directories, and converting a large majority of open-source releases so far. It enforces isolation via namespaces, read-only mounts and no default capabilities (only CAP_NET_BIND_SERVICE allowed), reduces hundreds of lines of bash to short configs, and equips operators with helpers like bpm logs, bpm trace and an interactive bpm shell.
AI-written summary · about
chapters (7)
- 0:00Introduction and motivation
- 1:45Origins of BPM project
- 3:30Implementation details and design
- 8:05Security and isolation benefits
- 12:36Simplicity and consistency gains
- 14:45Future directions and possibilities
- 17:55Q&A session
related talks
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
28mConfiguring a More Secure BOSH [I]
26mThe State of Supply Chain Security in the Cloud Foundry Ecosystem
35mOne Pipeline, Three Regulator - SBOM Compliance for the Developer
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
34mSBOMs: zero to hero in 25 mins!
42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..
34mTransforming SBOMs from Compliance Burden to Security Asset