Tech Lounge
00:08:18 · Will Stewart, Chris Chinchilla
[00:08:18] S1: So I 100% agree. 99% of our competition is DIY. That's even what we tell the investors. It's the truth, There is no breakaway product yet, but that's also a good thing for us. That's an opportunity. People are doing DIY because that's credibly the only option for them. You can't buy a product that doesn't it has to do everything. If you buy a product and it doesn't do 15 of your 100 tasks you need it to do, that's not good enough. And that's the methodology when we think about product development at Northflank is to work with customers very closely to understand what do you actually need. Do we actually meet your objectives? If not, let's rapidly build those features. [00:09:01] S0: Okay. Alright, let's dig into a bit more technical detail because I think there's some interesting things. You already mentioned... I'm gonna get the list, but you already mentioned one of them. Yeah. You mentioned that you use catted containers by default. Yep. Now, I don't know if other companies do and just don't mention it, but you explicitly mentioned it. And I thought that was an interesting place to start with some of your platform toolkit options because you've got some interesting ones here. Why did you decide to go with Keta containers over? I don't know, what to call the alternative, but... You guys have normal containers. Yeah.
00:09:33 · Will Stewart, Chris Chinchilla
[00:09:33] S1: One of the core principles of building a multi tenant platform is security. Essentially, platform like Northflank, a platform as a service, whatever you want to call it, is running untrusted user code. Yep. You can't have untrusted user code just masquerading on top of Kubernetes clusters. That's a recipe for disaster. You know, customer a, attack customer b, or noisy neighbor, whatever, it's a recipe for disaster. So with Northflank, from the get go, as soon as we released production, we had a secure runtime. At the time we were using gVisor, a tool maintained and built by Google. It's a fantastic it's wonderful. And then at one point, you know, we were seeing performance impact, we were seeing sort of load on customer websites where they weren't happy with performance, and we sort of evaluated what was on offer. And Carta containers is a sort of abstraction of KVM on top of Kubernetes. It's a fantastic platform. And we've been live in production with Carter, deploying millions of pods now for a couple of years, and it's very performant. And then for some of our customers who need to run on AWS, AWS doesn't let you run nested KVM nested virtualization, so we have to support gVisor for sort of on demand AWS. Was wondering if [00:10:44] S0: there were any I haven't had any massive experience with it, I wonder if there were any compatibility issues. But I'm guessing if there are, it's probably showing it's a bad sign in some cases.
00:10:44 · Chris Chinchilla, Will Stewart
[00:10:44] S0: there were any I haven't had any massive experience with it, I wonder if there were any compatibility issues. But I'm guessing if there are, it's probably showing it's a bad sign in some cases. [00:10:55] S1: So you can only get virtualization on AWS with the metal nodes, so they're very expensive. So for example, if you wanted to add you would then have to spend $21 just having three nodes. Not many people are going to want to do that for that. So gVisor is very credible for that. And then on GCP, GCP only supports nested virtualization on Intel. And they've also got some fantastic AMD nodes, you have to run gVisor on AMD for that reason. So Azure supports nested virtualization on all CPU types. This is like the matrix, the feature matrix of secure run time, performance, price, availability. That's something that we do for our customers. We sort of provide them the best secure performance. Again, exactly a high level of abstraction. And then people who deploy on their own cloud account get the choice if they want that. [00:11:45] S0: And some of the other opinions you kind of make, I see things like Istio Linkerd for service meshes. Is that kind of your preferences? Or is it a force dependency? Or can people bring their own as well?
00:11:45 · Chris Chinchilla, Will Stewart
[00:11:45] S0: And some of the other opinions you kind of make, I see things like Istio Linkerd for service meshes. Is that kind of your preferences? Or is it a force dependency? Or can people bring their own as well? [00:11:59] S1: So we have a golden path at Northflank. The old golden path production is same defaults. Northflank has made same default decisions at every single level of the stack. And we have this pick and mix approach. Use Northflank for everything post commit, or just use us for build, or just use us for deploy, and that goes the service mesh. By default, we expose Istio service mesh. We try and expose as many features as possible in a high level of abstraction. Again, it's consistency and workflow abstraction across all these features. But some of our customers say, well, we don't like the performance of Istio. We don't like Envoy. We happen to love Envoy. It's very memory intensive and very CPU intensive, and we do experience Istio attacks. 30% of our cluster resources are dedicated to mesh, but so be it. You have to live with it until Waypoint and some of the ambient mesh. These technologies that have sidecar less when they go to production, I think they have recently gone to production, it becomes a serious option. But we have to offer Linkerd for some customers because they need Linkerd. [00:13:01] S0: Okay. Because then the interesting one, you get to the bottom of the stack, it's kind of at the top of the stack, you have the BYO logs and DNS and secrets and things [00:13:14] S1: like that.
00:13:14 · Will Stewart, Chris Chinchilla
[00:13:14] S1: like that. [00:13:15] S0: So is there no golden path on those? Or is it just assumed that, you know, 95% of people probably use the same So options anyway in this [00:13:24] S1: if you just use Northflank by default, you add a card, you get started. You don't need to worry about all those features. And Northflank can scale and be a very successful startup if we do that, get to hundreds of thousands of users just using that model. But then you see at Heroku, there's that sort of capped outcome. So the reason why we're building bring your own logs, bring your own XYZ, think we even put on the marketing site BYOX or something like that as a joke. [00:13:48] S0: It's above a code field, so it's not quite so marketing. [00:13:51] S1: It's like bring... When you need to sort of have more control, you can do that. For example, if you need to have the logging back end on your infrastructure because you don't want personal information going to the Northflank logging back end, we have that feature available to you. If you want to drive the DNS and secrets in your ECR or your AWS Vault, have at it because we appreciate that people are trying to build serious platforms, and they need a serious platform to deliver that to. So it's this pick and mix approach again. But it's not the default. That's for sort of our enterprise customers.
00:13:51 · Will Stewart, Chris Chinchilla
[00:13:51] S1: It's like bring... When you need to sort of have more control, you can do that. For example, if you need to have the logging back end on your infrastructure because you don't want personal information going to the Northflank logging back end, we have that feature available to you. If you want to drive the DNS and secrets in your ECR or your AWS Vault, have at it because we appreciate that people are trying to build serious platforms, and they need a serious platform to deliver that to. So it's this pick and mix approach again. But it's not the default. That's for sort of our enterprise customers. [00:14:27] S0: I appreciate this is probably some of the kind of the magic source that a company like Northflank adds. But how hard is it to make all these different services and different opinions of the implementers of these services from AWS to GCP to open source products to etc, etc, to actually communicate and work together in a seemingly seamless way for your customers? Is it really like that all the time?