Amsterdam JUG Meetup at Atlassian
Details
Join in with the latest Amsterdam JUG Meetup at Atlassian, Singel 236, 1016 AB Amsterdam, Netherlands.
Would you like to be a speaker at this event? Send a mail with your proposal to amsterdamjug@googlegroups.com.
Talks will include:
- "Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images" (Pasha Finkelshteyn, BellSoft)
- "DuckDB: From Academic Research to AWS" (Nantia Makrynioti, DuckLabs)
- "Valuable Lessons from OSGi" (Michael Kemp, Atlassian)
Abstracts:
"Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images" (Pasha Finkelshteyn, BellSoft)
Your mission is to turn a bloated CVE-infested container image into a low-noise image with low vulnerability exposure and clear operational posture. You have 45 minutes before the explosive attack hits. Mission possible!
This session provides a straight path towards building more secure and maintainable Java container images. We will identify the key culprits such as stale dependencies, outdated base, lack of provenance, and excessive privileges. Then, we will draft a step-by-step plan to:
- Pick a minimal and well-maintained base image,
- Shrink privileges,
- Prove provenance with version pinning, signatures and SBOMs,
- Scan and classify with CVSS rules to cut noise and fix what’s exploitable,
- Automatically monitor for updates with Dependabot/Renovate.
Expect a before/after scan comparison, copy-and-paste Dockerfile instructions, verification checklist, and a clear and reproducible path towards hardened Java container images that provide an impenetrable lock-box for your applications.
"DuckDB: From Academic Research to AWS" (Nantia Makrynioti, DuckLabs)
DuckDB is an open source analytical database system with a vibrant community of contributors and over a million downloads per day. The project started by Hannes Mühleisen and Mark Raasveldt at CWI, the Dutch national research institute for mathematics and computer science in Amsterdam. It then continued its course through DuckLabs, a spin-off company founded by the two creators, which was recently acquired by AWS.
In this talk, we’ll walk through DuckDB’s journey from an academic research project to a beloved tool that attracted the interest of major players in the area of data management. We’ll share lessons learned, anecdotes, as well as personal perspectives on why it’s a great example of research built around real user needs.
"Valuable Lessons from OSGi" (Michael Kemp, Atlassian)
OSGi is niche now, but it pioneered some concepts that are still valuable today. It started with some simple concepts and grew into a much larger spec, but even the simple cases have a lot of hidden complexity.
Why would anyone still use it today? Is there an alternative for runtime behaviour changes? There are better ways to use modularisation to enforce domain driven design, but which one to pick?