DevOps "Office Hours" (2020-12-09)

 for this special edition of Office Hours to discuss how Cloudsmith is helping our customers solve the toughest challenges in package management.

Using GitLab to publish packages to Cloudsmith: 

https://www.youtube.com/watch?v=9WpvfegCgBY

Create a Cloudsmith repository in under 60 seconds: 

https://www.youtube.com/watch?v=yzBEWrgbvQQ

https://help.cloudsmith.io/docs/welcome-to-cloudsmith-docs

Edmund, had been promoted to Chief Executive of Elf, Inc. in February, a mere 10 months ago. It had at the time been a great honor, but had almost instantly become a farce. Not only did toy production stop for a number of months, it was now looking like all the toys would remain in storage until such time, Father Christmas would be allowed to deliver them. And who knew when that might be.

The phone rang. Edmund picked up and stoically spoke, “Hallo.”

It was a crazy plan. The elves were to stop all toy production immediately. That was unheard of. Every available toy-making elf had to re-train overnight in software development and related disciplines. That, at least, was possible, elves are extremely adaptable and pick up new information like sponges, and there was a small, but efficient development team that had been building the software for the many electronic toys over the years.

The plan was to build a digital parcel, a package of goodies, for every child who had the means to consume it. Where appropriate it would include video games, e-books, movies, tv boxsets, music, comics, digital trading cards, software, and various digital assets like avatar upgrades and gift cards.

Edmund was horrified at the sheer amount of work involved, this late in the day. He spent hours on a spreadsheet trying to figure out how to achieve this massive undertaking. No matter how often he did the sums, there was no way to build all the packages and the delivery method. They would have to use a third-party to distribute.

He searched for “package distribution” and a few suitable options showed up. After a quick read of each of the offerings feature sets, one stood out, one with enough global infrastructure and scalability to handle such a large distribution all at once.

“This just might work,” he muttered to himself.

Elf Storage and Distribution

The Cloudsmith family is something you have likely seen across our content and communications for years. While many brands make that, well, part of their “branding”, for us, it’s genuinely how we feel about our staff, customers, partners, investors, and everyone we meet along the way. In all cheesiness and truth, we believe the Cloudsmith family is real.

While we’re not based in America and, at the moment, only have one American on staff, Thanksgiving is just as meaningful to us as it is to you. And even though we can’t sit around the table this year to share exactly what we’re thankful for, I wanted to share a message of gratitude on our behalf.

You’re a crazy bunch but we love every single one of you. We love being able to help you succeed with DevOps and pipeline building. And it kills us when we fall short with a missing feature or have to type in those fateful words “It’s on the roadmap.” It is. Thank you for choosing us and believing.

We could not be more excited about building upon our partnerships with CircleCI, HashiCorp, Buildkite, and Cloudposse to name a few. Together we’ve built out some super exciting insights and events for the end of 2020 and early 2021 and for that we thank you. If 2020 is anything to go by, 2021 will be a whole other level of awesome. And for that, we’re grateful for these new relationships we built this year. Watch this space.

And last, but not least, our incredible team…

This holiday season, my thoughts turn gratefully to our employees, advisors, and investors who have made our success possible. Working at Cloudsmith isn’t always easy but I am impressed each and every day with your resilience, resolve, and resourcefulness. Thank you. The donuts are in the mail.

It goes without saying that 2020 has been a wild ride for us all but (a vaccinated) 2021 is going to be EPIC!

Alan

PS: Whether you’re celebrating Thanksgiving or not, here’s a little song to add to your playlist during this very special (yet bizarre) holiday season:

Giving Thanks on Thanksgiving

Universal Package Tags

A walkthrough of universal Package Tags - tag any package or container within Cloudsmith. Use them to search/filter and organize your software assets.

Entitlement Tokens

A walkthrough of Entitlement Tokens; how to create, restrict, and permission with the use of tokens using a Maven example.

We’re a little late to the party. Fashionably late.

By now the world knows that DockerHub has removed the free, untraceable goodness of anonymous pulls. How dare they? How dare they build a revolutionary technology, open-source it and give it away for free at a substantial cost to themselves. It’s worth calculating what a couple of petabytes of CloudFront bandwidth would cost, even with a substantial discount. It’s mind-blowing. And frankly unsustainable for any company that doesn’t have a multitude of revenue streams.

Why have public when you can have private?

 at the request of a customer about two years ago. At the time, we thought it was unlikely that we’d be picked over AWS ECR (other Cloud provider container registries are available) but we were pleasantly surprised to find that a single pane of glass for all assets is a huge draw for our customers.

We’ve built Cloudsmith to normalize, where possible, the diverse list of formats as much as possible; so that Docker images can sit beside the very dependencies they contain.

The truth is, untraceable, anonymous access is bad for software delivery. It really should be a thing of the past. Organizations must build security into their processes and workflows at the far left, with tools like Snyk, and at the point of deployment or distribution with tools like Cloudsmith.

We believe that building up a provenance trail is vital to monitor and control your risk.

The move from DockerHub, while it might cost you money, is actually a step in the right direction for everyone. Control over public upstreams is vital, and this move shines a light on the problem, and will, for many, force action toward a better, more secure, way of doing things.

DockerHub vs Cloudsmith Private Docker Registry

Our distinguished competition took a puzzling position of “Imagine there’s no versions”.

At Cloudsmith we think that’s crazy. Software versions are what makes software development possible. They make deployment possible. They make distribution possible. How else can you understand and navigate complex dependency trees or be sure your code will interact with a third party’s? Hint - you can’t!

You must care about versions. And updates. It’s the only way to know you are on the latest build; the one with the security fixes and new features. But it’s not about the end-user. It’s about you. How else can you label or tag the push of a new build that’s been verified?

Not a single one of our customers has ever asked us how to architect, build, and deploy versionless software.

The revolution against versions hasn’t begun - and never will. Versions are here to stay. There is an explosion in the amount of open-source software that all software relies upon, and the only way to manage the chaos is with versioning.

 containers are filled with versioned software. You need to know what’s in each and every layer.

Now more than ever, engineers, like you, and like us, need better tools to track, manage, and understand all software pulled into your stack. Cloudsmith was built to tackle this problem, providing a single source of truth across every format you use; providing isolation from public upstreams, and allowing you to interrogate the provenance of any package with insight into security and licensing. These are vital for everyone going forward.

But more than that, there are three key reasons why versions are so important:

More bluntly - “Knowing what is where”. The dependency tree for any piece of modern software can be vast. You need proper visibility on what packages, libraries and components make up this tree because without it you really are running blind, in more ways than one. Without versions, you don’t have this visibility, and you’re missing the details of the “what”.

Once you know “What is where” you need to explore “When did something change?”. You should be able to trace back when a particular package or library was updated, modified or even rolled back. Without versions, you can’t do any of this - it’s like a financial audit without figures: it’s lacking the very detail that it requires to be effective.

And finally, you need to know “Will this actually work?” You can see what you have, you know when things changed, and now you can determine if the sum of these will, in effect, “make” or “break”. Without versions, you can’t tell. You can’t plan, implement or react effectively. You’re adrift in a sea of unknowns. Breaking changes are real, we have all seen them. This is one of the most important reasons why versions matter.

While we admire the sentiment of imagining a world with no software versions; it’s just not realistic. We fundamentally believe in the opposite; and will continue to build a platform that gives you a more profound understanding of versions; not one that muddies the very clarity you need to develop better, faster, more maintainable products.