Hi, I'm Erin Chapple, CVP
of Azure Core Product and Design.
Welcome to the third episode of Inside
Azure for IT where
we're focusing on two
of my favorite subjects:
open source and Linux.
Open source plays
a critical role in enterprise
digital transformation.
For more than a decade,
Microsoft has adopted
an open source approach
as part of both our own evolution
and bringing customers, partners
and communities together to innovate.
Before we get started,
remember, this is part
two of a three part episode.
In part one, I spoke with Red
Hat about our joint product offering
and what we are doing together
to help customers
with their cloud modernization
and migration journey.
And in part three, I chatted with Sarah Novotny
about running open source
technologies in the cloud,
the relationship
between IT and developers
to enable open source innovation,
and Microsoft's leadership
and contributions to help secure
open source software.
In this segment, we'll discuss
Mariner, Azure's Linux distro
that engineers use to build services on.
We'll share with you
the decision behind
creating our own Linux distro
and how it's benefiting
engineers and customers.
As we kick off this segment,
let me welcome two people
who are no strangers
to Linux and open source community.
Welcome Krishna Ganugapati,
VP of Software Engineering,
Edge OS,
and Brendon Burns, CVP,
Azure Cloud Native.
Thank you, Erin,
it's so wonderful to be here in person.
Thanks, Erin. It's great to be here.
So this is such an exciting
and growing space.
I feel like I've been
on a journey of my own,
mirroring the company's
evolution of how
we think about, contribute to
and really consume Linux and open source.
You know, I've gone from being 100%
focused on Windows and Windows Server
to learning how to contribute upstream
to make Linux run great on Hyper-V
to now open source and Linux
being core to the development of Azure.
Now this journey has been driven
by a combination of both the customer
and what they need,
as well as internal development teams
and what they need.
Now, some of those tuning in
may not know that a number of Azure
services are managed
open source SaaS offerings,
for example, Azure Kubernetes Service
being one of the largest.
And in fact, we run
and build on a Linux
infrastructure in Microsoft.
So Krishna, could you share
how we approached the space
and what it means to internal
engineering teams?
Thanks Erin, as you just said,
a lot of people are unaware
of how many customer workloads
are powered by internal Linux services.
And safeguarding customer
workloads means that we need to secure
these internal Linux services.
And our internal engineering teams
were pretty vocal to us
and telling us that we need
a single standard,
secure Linux distribution
that serves as an ingredient OS for them.
And that's why we created Mariner.
It's our internal Linux distribution
for our first party services.
And you mentioned standardization
as a driving factor.
Let's elaborate more on that decision
to build our own internal distro.
You know, it's a question
I hear from customers interested in
in really understanding our approach.
You know,
would you share why
we decided to do this
instead of using something off the shelf?
Sure, it's worth mentioning
that many of our services are
using off the shelf distributions,
and that will continue.
But as a hyperscale cloud,
we have a very diverse set
of requirements and scenarios,
and some of these scenarios require
that we can't always meet them
with an off the shelf distribution.
And before we decide to build our own
internal Linux distribution,
we did a pretty comprehensive study
of what Azure services would need.
The central thesis that emerged was that
it's all about how we improve
the quality of our Azure services
and how we increase
and improve the velocity of delivery
of our Azure Linux services.
And there are many factors out here,
but I want to focus on two reasons why
an internal distribution made sense.
The first is what I call
Just-Enough OS or the Small Footprint.
You know, I've been an OS engineer
for quite some time
and I really love operating systems.
But the one thing I've learned
is that the best operating system
is the one that's invisible.
That means you need
just enough operating system
to power your service.
You know, the more OS
you have, the harder
it gets to manage it.
But the smaller the OS footprint,
the better your manageability.
And by extension, that means the better
your security assurance.
When we built Mariner,
this was one
one of our central tenants,
the ability to start
with the smallest OS footprint
and add just what you need to power
your applications.
The next big one is security.
And there are so many
aspects of security,
but I want to talk about two of them.
Ease of patching and compliance.
You know, it's critical
for us to ensure
that our customer workloads
are always protected.
And to do this,
we need to make sure that the moment
a security vulnerabilities
known upstream, we can patch it
as soon as possible.
The Mariner build system
is continually checking
for secure vulnerabilities
from upstream projects,
and we're patching
the distribution in real time.
Compliance is another really big
and important area for us.
We want to make sure that
all of our Linux services
run on a platform
that continually meets mandatory
security certifications.
These are just two of the considerations
that made sense for us to say,
OK, I think we really should look
into building our own Linux distribution
for our internal services.
You know, and ultimately,
that means faster feature
velocity and fewer
surprises for developers
and support teams.
So let's shift from the team
managing our own Linux distro
to the teams building on it.
So Brandon, as a Mariner
customer and partner,
what's the team's experience
been like building on top of Mariner?
You know, it's been really fantastic
to be able to have a team
that's focused on
a Linux operating system for Azure
and to be really be a partner with us
in delivering services on top of Linux.
There's a certain
consistency and reliability
that you get out of
knowing that
everything that they're doing
is focused around your services
and the things that you are trying
to provide to your customers.
And ultimately, that optimization
for Azure in the distribution
really helps us do a better job.
You both mentioned reliability.
Not having system reliability
can greatly impact business
continuity for engineers
and end customers
and lead to service outages.
However, there are things we do
to ensure platform
reliability for Mariner.
Krishna, can you go into some of that?
Definitely.
Platform reliability
is central to the Mariner build system.
I’d like talk about three things here.
First, the build pipeline
has been constructed
to easily integrate a variety of tests.
We're continually looking
to shift left where we can.
How can we identify and fix issues
well before they land in production?
Second, we've invested
heavily in our update
mechanisms, building reliable
roll back and roll forward mechanisms.
Third, Mariner’s build gates are automated
to prevent defective
builds from advancing.
That allows us to respond quickly,
but with the confidence
that production deployments
are not impacted.
Our intention is that
if we do this right, customer
workloads are heavily insulated
from any potential impact.
And Brandon, even though
Mariner is intended for internal use,
ultimately it benefits customers
providing them with stable services
and delivering optimal experiences.
You know you're absolutely right, Erin.
We can collaborate with Krishna
and his team to find patches
that need to be included in Mariner.
But also, we can use this
sort of upstream first approach
where we treat them
as an open source project,
just like many of the other open
source projects that we consume.
And customers should notice the platform
we use, like you said earlier Krishna,
you know, it's just the smallest OS.
It's invisible.
They just want to know
that we're providing them
with a better, more reliable service
with faster improvements.
So Brendan with Mariner
out on GitHub today,
even though it's a platform built
for Microsoft's internal use,
can you tell us what the thinking
is behind publishing?
Sure, I mean, the first part is GitHub,
of course, is an amazing place
to build software, right?
So I think we're going
to build it on GitHub no matter what.
And then I guess it's
just the private or public flag
that becomes the thing.
And I don't think we really view
it being private as an important part
of what it means to be Mariner.
We really want that transparency.
Mariner exists in a broader
Linux community
that is rich with a
lot of different distros,
and I think also increasingly,
our customers are looking
to have us help them
understand what it means
to open source stuff.
And so as they look at
the way we approach it,
not sort of saying,
well, what are the things we can
open source, but rather
what are the, you know,
why not open source things?
I think they're looking to us
to provide them with help
solving the same kind of problems.
And over the years,
we've really invested a lot
in improving how we collaborate
with the open source community,
not just to say we understand
open source, but to show
we have the underpinnings right
and our philosophy that, you know,
everything should be open sourced.
To learn the role, Microsoft
has been playing
an open source initiatives,
be sure to watch segment
three of this episode
where I meet up with Sarah Novotny,
the director of open source
strategy for Azure.
Back with you, Krishna.
Where do we see Mariner going?
Well, Erin, this is a journey for us,
and in the crawl, walk, run, metaphor,
I think we're beginning to walk
now confidently, I hope,
but we're beginning to walk.
Right now, we have a lot of work to do
to get our internal
customers up and running,
and that keeps us busy.
We do get queries about Mariner
as a more general purpose distro,
but frankly,
as your customers
are well-served by the amazing
distro partners that we have
and what we'll continue to do
is we'll make sure
that partner distros
will always run best of class on Azure.
And with respect to the future,
everything we want to do
has to be guided by
what do our customers need
and how best can Microsoft
serve that need?
And to better figure this out,
Brendan's already spoken about this.
We've made the Mariner source
repositories available to the public.
All development happens in the open
and the Mariner ISOs are also available.
This does two important things.
first, customers
can kick the tires with Mariner.
They can build it,
they can run it,
and they can be better informed
and they can see
if there's something
that Mariner can or should do.
You know,
our customers are always
our best teachers.
Second, and most important
and Brendan's already spoken
to this, it's all about transparency.
There have been lots of questions
interest, excitement and speculation.
Making everything
publicly available
allows everyone,
our customers, our partners,
our stakeholders to see for themselves
what Mariner’s about
and to hear directly from us
and we get to hear directly from them.
Krishna, Brendan,
it was wonderful to have you on the show.
I hear you're both speaking
at Azure Open Source Day on February 15th.
I look forward to seeing you there.
Thank you so much, Erin.
Thanks, Erin. It's great to be here.
It was great to see you in person.
Absolutely.
And if you're wondering why we call it
Mariner, Brendan and Krishna,
will be sharing that story
in their session
at Azure Open Source Day.
Be sure to register at the link below.
Now, don't forget to check out
the other segments
of this episode of Inside Azure for IT.
We have Mike Evans
and Xavier Lecauchois from Red Hat,
as well as an open source discussion
with Sarah Novotny.
And for all our videos, deep dives
and skilling content,
head to
Azure.com/InsideAzureforIT.
I'll see you next time.