LinuxKit is a toolkit for building secure, portable, and lean container-based operating systems. Over the past six months, it has gained 75 contributors and seen improvements like support for additional platforms, TPM support, immutable images, and newer kernel versions. Looking ahead, the next six months will focus on stable releases when Containerd 1.0 is available, using LinuxKit as the basis for Docker desktop and cloud editions, and expanding Kubernetes integration and production usage. The LinuxKit Security SIG has also deep dived several security projects and aims to contribute further to upstream Linux security.

1. LinuxKit: the first six months

2. What is LinuxKit?
A toolkit for building secure, portable and lean operating systems for
containers.
● uses Moby tooling to build system images
● everything is a container
● runs with Containerd 1.0 branch for over four months
● lightweight, fully customizable

3. Some metrics
● 75 contributors!
● first maintainer appointed from the community
● 50 commits a week since DockerCon

4. Platform support
The community added support for so many platforms...
● LCOW
● Azure
● OpenStack
● VMware and vCenter
● Packet.net
● Vultr

5. Lots of smaller improvements
● TPM support
● containers to run on clean shutdown
● fully immutable images, eg CD-ROM images
● 4.10, 4.11, 4.12 kernels, 4.13 coming soon
● namespace sharing for system containers
● rewrote a lot of shell scripts in Go for better maintainability
● OCI runtime spec 1.0

6. What about the next six months?
● stable releases when we have Containerd 1.0
● Docker desktop and cloud editions based on LinuxKit very soon
● more work on Kubernetes: infrakit integration for production
● production production production
● help wanted improving CI for multiple platforms
● tell us about your production use cases

7. LinuxKit Security SIG

8. Security SIG Deep Dives
● WireGuard - graduated from projects!
● Type Safe System Daemons
● LandLock LSM
● Memorizer
● HPE okernel

9. What’s next?
LinuxKit Security
● Cultivate security community and testbed
● Directly contribute to upstream Linux development
○ XPFO
○ eBPF hardening
○ Namespacing IMA
● Talk with us if you are interested in upstream Linux security!

10. @justincormack @riyazdfThank you!