Cloud, Containers & Security • Adrian Mouat, Kief Morris & Sam Newman • GOTO 2025
In this panel discussion, experts Adrian Mouat, Kief Morris, and Sam Newman delve into the current landscape of cloud technology, container security, and infrastructure automation. They cover key topics such as supply chain security with Sigstore and SBOMs, the practical impact of AI on deterministic systems, the ongoing debate about cloud repatriation, and advanced Infrastructure as Code practices like TDD and managing configuration drift.
Introduction
The discussion, featuring Adrian Mouat (Chainguard), Kief Morris (Thoughtworks), and Sam Newman, explores the infrastructural stack from containers to the cloud. They discuss current trends, challenges, and future directions, touching on container security, the role of AI in infrastructure, and cloud strategy.
Container and Supply Chain Security
Adrian Mouat notes that while fundamental security problems haven’t changed much in the last decade, the tooling and focus have evolved.
- Sigstore: A significant advancement allowing for easy, keyless signing of container images. It integrates seamlessly with CI/CD pipelines like GitHub workflows, using ambient tokens to sign and publish images, which users can then verify.
- SBOMs (Software Bill of Materials): While mandated by regulations like a US federal executive order, their practical utility is debated. Creating a truly complete SBOM is extremely difficult due to complex dependency chains. Often, it becomes a “tick-the-box” exercise to satisfy partners rather than a functional security tool.
- Supply Chain Attacks: These are real and have massive consequences, as illustrated by the multi-billion-dollar bailout of Jaguar Land Rover caused by a supply chain attack.
- Language Repositories: Central package repositories (like NPM, PyPI) are critical vulnerabilities. Chainguard is working on a product to mirror these repositories, verifying the source of packages to ensure they are built from the claimed source code. A key recommendation is to use features like GitHub’s “Trusted Publisher” and eliminate long-lived API tokens in favor of short-lived, single-use tokens to mitigate attacks.
AI in Infrastructure Automation
Kief Morris expresses caution about the current rush to integrate AI into infrastructure, highlighting the tension between AI’s non-deterministic nature and the need for reliable, repeatable infrastructure.
- Generative AI for IaC: Using prompts like “make me a database” can lead to inconsistent environments, undoing the progress made with Infrastructure as Code (IaC) in solving configuration drift.
- AI as an Assistant: The more promising use of AI is as a coding assistant. It can generate initial IaC code, which is then reviewed, tested, and managed deterministically. AI can also be used to analyze existing, manually-configured infrastructure to generate a model that can then be codified.
- MCP (Multi-Tool Calling Protocol): This emerging protocol allows AI agents to interact with toolchains like Terraform. However, security is a major afterthought, much like in the early days of Docker. The protocol opens new attack vectors, such as data exfiltration and poisoning the data sources (e.g., API documentation) that AI agents rely on.
The Cloud Repatriation Debate
The panel discusses the trend, popularized by figures like DHH, of moving workloads from the public cloud back to on-premises data centers.
- Cost vs. Effort: While running stable, predictable workloads on your own hardware can be cheaper than renting from the cloud, many analyses neglect the full cost and effort of running a data center well.
- Drivers for On-Prem: Beyond cost, drivers include regulatory requirements for data locality (which is increasing with the current geopolitical climate) and the need for specialized infrastructure. An audience member from Saxo Bank confirmed they are moving some workloads on-prem for cost savings and to gain bargaining power with their cloud vendor.
- The AI/GPU Factor: The rise of GPU-heavy AI workloads complicates the repatriation argument. Building and running specialized, liquid-cooled data centers for GPUs is prohibitively expensive for most. This has led to the emergence of “neo-cloud” providers like Core Weave, which offer competitive pricing on GPUs, creating new competition for the big three cloud providers.
Infrastructure as Code (IaC) Practices
The discussion dived into practical challenges and best practices for IaC.
- TDD for IaC: Kief Morris explains that Test-Driven Development for infrastructure is different from software.
- Focus on higher-level integration tests (e.g., “Can service A connect to service B?”) rather than low-level unit tests for declarative code.
- The slow feedback loop of provisioning infrastructure is a major hurdle. This can be mitigated by breaking infrastructure into smaller, independently deployable components.
- The tooling is immature, and writing tests often requires learning a separate, complex language (like Go for Terratest), which is a high bar for teams without a strong development background.
- Managing Configuration Drift: The modern definition of drift is a mismatch between the state defined in code and the actual running infrastructure.
- GitOps is one solution, using an automated loop to enforce the state defined in Git. However, this requires excellent observability to detect and diagnose issues like “flapping” resources.
- The most effective solution is team discipline and making the automated process the path of least resistance. If developers are making manual changes, it’s a symptom that the IaC pipeline is too slow or rigid.
- Platform Engineering: When asked how to convince a central infrastructure team to provide automation APIs, Kief Morris advised that infrastructure teams should adopt a “product mindset.” Instead of building everything for developers, they should build a platform that enables developer teams to safely provision the infrastructure they need themselves, using code within a framework of centrally managed policies and safeguards.
Niche Architectures
For a question on running workloads on non-standard architectures like RISC-V, the panel acknowledged this is a cutting-edge problem. Beyond AMD64 and ARM64, support is minimal. QEMU is a slow but common solution. For more niche scheduling needs, Sam Newman suggested exploring the Nomad community, as it is often used for unusual workloads that don’t fit neatly into the Kubernetes model.