Vadim Bauer
Cloud Native builder in the Clouds with Kubernetes. CNCF Project Harbor maintainer.
Zürich, Switzerland
Actions
Vadim Bauer is a Container Silverback with over a decade of experience in running containers in production. As a maintainer of the CNCF project Harbor, he focuses on extending the boundaries of OCI artifact management, adoption, and developer experience. At 8gears, Vadim helps cloud providers, ISVs and enterprises adopt Harbor and use OCI capabilities.
Area of Expertise
Topics
You Don't Own the Image, But You Own the Risk: Securing Third-Party Containers
The common use of third-party container images has created a systemic security challenge for the cloud-native ecosystem. Common practice is to detect problems and delegate remediation, creating persistent exposure. This session examines the security lifecycle through static (registry-stored) and dynamic (runtime) perspectives. The speaker covers various real-world scenarios on third party images consumption. All approaches introduce trade-offs: rebuilds increase complexity and break signatures, waiting creates exposure windows, minimal bases limit compatibility, runtime protection adds overhead without removing vulnerabilities. Harbor's native Copacetic integration provides an alternative automated package patching. We demonstrate vulnerability detection to patch application flows, covering manual workflows for critical CVEs and automated pipelines. Attendees evaluate this against existing strategies with examples of complexity reduction, MTTR improvements, and integration patterns.
Vibe Code Suvival Guide for Open-Source
Vibe code is flooding open-source projects with an ever-growing volume of pull requests and ideas.
Banning AI contributions isn't the answer, yet it is difficult to resist.
How can open source projects survive and keep progressing despite the pressure?
This talk covers the project playbook we're building in CNCF Harbor and Harbor Satellite: defining a clear project direction so contributors, human or AI-assisted, know what's in scope before they contribute. Setting explicit acceptance criteria and guardrails. Using AI on the maintainer side to triage, review, and filter the growing volume of contributions. Deciding as a project where your boundaries are, what's core, what's an extension, and what's out of scope, so you stop drowning in well-intentioned feature PRs that slowly erode coherence.
We share what works, what fails, and how we are rethinking open-source, contributions, community, and project positioning as a whole.
From Maintaining Open-Source to Operating an Open-Source Business, a Harbor Project Showcase
Navigating the delicate balance between business imperatives and open-source ethos is a challenge, yet within this tension lies a unique opportunity for open-source sustainability and growth. This talk explores the journey of building a bootstrapped business around the CNCF Project Harbor. We look at the symbiotic relationship between the CNCF open-source community and business and show how this resulted in a win-win situation. Our experience shows that making the cake bigger creates a surplus for everyone.
In this session, we aim to inspire and inform, offering a roadmap for leveraging CNCF projects to not only navigate but thrive in the intersection between open source and a business that is outside the typical VC or enterprise culture.
Join us for insights into the strategies, challenges, and rewards of striking the right balance in the cloud-native landscape.
Unleashing the Storm: Security Exposure Testing for CNCF Projects with the Kubernetes Storm Center
Integrating new apps into diverse K8s ecosystems introduces a complex web of potential attack surfaces. Assessing the security impact of these deployments requires significant time and resources. To shift-left the security exposure impact analysis, we envision the K8s Storm Center to standardize continuous security exposure testing inside a specific cluster configuration for a given project. We discuss the usefulness for a CNCF project maintainer and demo on Harbor how to leverage existing K8s security tools like e.g. icekube, kdigger, tracee and tetragon to:
-Automate attack path validation: by translating Kubehound's theoretical paths into concrete chains of attack steps to evaluate which paths are realistically vulnerable in a specific configuration.
-Visualize attack paths: by translating eBPF logs into STIX we have a sharable data standard to see how vulnerabilities interconnect within a specific environment, revealing weaknesses arising from seemingly harmless configurations.
Solving Edge Computing Challenges with Harbor Satellite for Software Distribution
Deploying containerized software at the edge introduces challenges like unreliable connectivity, resource constraints, and massive scale. As the cloud-native ecosystem expands to edge environments, these challenges impact core tools like registries and artifacts. This session introduces Harbor Satellite, an extension to CNCF Harbor for managing and distributing OCI-compliant artifacts to edge locations. Attendees will learn how Harbor Satellite ensures consistent, secure, and integrity-checked artifact delivery at scale, even in constrained environments. Use cases, such as isolated sites, IoT, and telco deployments, will show how Harbor Satellite bridges cloud-native to the edge and meets Software Supply Chain Security standards while optimizing resource utilization.
Outgrowing Heroku
Building a Cloud Native Platform-as-a-Service Alternative with Kubernetes providing a similar developer experience as Heroku
Navigating the Legacy Operational Technology in the Cloud Native Era
The convergence of IT and OT poses obstacles that are in contradiction with the cloud-native ecosystem and practices, yet we need and want to make it work. In this session, Benoy and Vadim share their stories about the legacy technologies and obstacles they have seen on the factory floors of this world. What measures and approaches do they take to make cloud native methodologies and tools work at the edge.
Attendees will learn how Advantest uses Harbor Container Registry and legacy SSH and FTP connectivity to distribute software to the edge and bridge the gap between the IT and OT worlds, ensuring seamless and secure data transfer. The talk will highlight practical approaches used in the field for achieving IT/OT convergence, address pitfalls, and showcase real-world use cases.
Meet BOB: the supply chain provided “bill of behaviour” for anomaly-based runtime security
Currently, SBOM (“Software Bill of Materials”) includes only static build-time information. We propose to strengthen supply security by allowing vendors to also supply known benign runtime-behaviour information alongside the OCI artefacts as “Bill of Behaviour” (BoB).
BoB allows users to detect anomalies from the provided baseline at runtime and thus infer malicious behaviour or tampering using well-known cloud native tools.
We demonstrate a PoC reference implementation and discuss early user feedback and known limitations.
Meet BOB: the supply chain provided “bill of behaviour” for anomaly-based runtime security
Currently, SBOM (“Software Bill of Materials”) includes only static build-time information. We propose to strengthen supply security by allowing vendors to also supply known benign runtime-behaviour information alongside the OCI artefacts as “Bill of Behaviour” (BoB).
BoB allows users to detect anomalies from the provided baseline at runtime and thus infer malicious behaviour or tampering using well-known cloud native tools.
We demonstrate a PoC reference implementation and discuss early user feedback. We will also discuss limitations for the vendors and the impact on their software-production.
How to: Containerized Software Distribution
Back in the days, when software distribution happened over floppy disks or email, things were simple. It was only the transport medium that was relevant, not the format, as it is with container images. Code-based collaboration between teams and across teams is predominantly accomplished through Git. However, the majority of software that is distributed and shared is closed source or not meant to be accessible publicly. When it comes to the distribution of ready-to-run software packaged in containers with a specified, target group, there are no well-established out-of-the-box solutions. Today, most organizations are building home-grown solutions. In this lightning talk, I show an elegant solution with Harbor Container Registry, the static site generator Hugo, to share and distribute containerized software privately. All in a way that greatly reduces or even eliminates the amount of custom code needed to build a solution.
From Zero to Hero, the Adventure of Managing Container Images.
Especially when it comes to secure software development, there is often a gap in how things should be and how they are actually are. For example, with container images: We know we should only use images from trusted sources, build our images ourselves, constantly scan for vulnerabilities, have reproducible builds in the CI and on top of it making sure that everyone and every system in the organization is aligned with those standards. The road to hell is paved with good intentions. We know the reality is different, but how can we implement it so that the simple goals will have simple solutions that aren't soaked in the blood of complexity picked up along the way?
In this session, Vadim will take you on an adventure, where he paints a story of a hero character who systematically solves one tiny quest after the other and slowly but steadily progresses from one level to another to meet the final boss.
In the adventure you learn how Linux Foundation OSS tools like Harbor, Kyverno, Sigstore and Kubernetes are used to build Open Container Initiative (OCI) centric workflows for secure image management. While preserving a frictionless developer experience. You learn how to grow your organization’s security posture gradually, from zero to hero. Manage 3rd party images securely. Restrict image pulls to trusted sources. Require up-to-date vulnerability scans. Assure that all images are signed. Enforcing policies across the CI/CD pipeline and at runtime.
From Maintaining Open-Source to Operating an Open-Source Business, a Harbor Project Showcase
Navigating the delicate balance between business imperatives and open-source ethos is a challenge, yet within this tension lies a unique opportunity for open-source sustainability and growth. This talk explores the journey of building a bootstrapped business around the CNCF Project Harbor. We look at the symbiotic relationship between the CNCF open-source community and business and show how this resulted in a win-win situation. Our experience shows that making the cake bigger creates a surplus for everyone.
In this session, we aim to inspire and inform, offering a roadmap for leveraging CNCF projects to not only navigate but thrive in the intersection between open source and a business that is outside the typical VC or enterprise culture.
Join us for insights into the strategies, challenges, and rewards of striking the right balance in the cloud-native landscape.
From Newbie to Core Contributor of Harbor: How Mentorship at CNCF Transformed My Journey
Mentorship is not just about completing tasks or solving problems. It’s about shaping the next generation of open-source leaders. This talk shares perspectives from both mentees and mentors, showing how newcomers can evolve into core contributors to CNCF-graduated projects and how to effectively select, welcome, and retain mentees.
Through the CNCF LFX Mentorship Program, Prasanth grew from a student to a core contributor, significantly shaping the Harbor CLI codebase alongside fellow mentees.
This session explores how mentorship benefits mentees, mentors, and projects. It covers how to be a better mentee, manage challenges, and become a better mentor. Attendees will learn what aspects to prioritize, what pitfalls to avoid, and how to create better and supportive learning environment that attracts, retains, and helps mentees grow into maintainers.
BoB rulez: get your “bill of behaviour” through the supply chain to automate runtime detection
We believe end users should not be responsible for writing security rules for third-party software, rather, we show how vendors can distribute benign runtime-behavior rules along their supply chain using a “Bill of Behavior” (BoB) inside OCI artifacts.
A BoB is a profile of known syscalls, fileaccess, network and capabilities generated using eBPF, and allows anomaly detection. Thus, users can infer both malicious behavior and tampering without writing/maintaining custom runtime rules.
We detail which parts of the BoB specification translate across ecosystems, languages, stacks, and tools and why the process must be transparent for users. We will also discuss the current scope and ongoing evolution of BoB, laying out a strategic roadmap as it progresses towards a de-facto standard, thus complementing our security ecosystem of seccomp profiles, SBOMs and policy engines.
A public on-demand lab of the reference implementation using well-known cloud native tools will be supplied.
A Look Inside the Control Room, of Operating a CNCF-Based SaaS When You’re Not Google
Join Vadim in this immersive session as he navigates their real world, tech stack that operates a CNCF-based Software as a Service (SaaS) offering. Discover the components of their SaaS technology stack, including insights into cloud provisioning, application runtime, orchestration, deployment strategies, and observability through monitoring and logging across multiple Cloud providers.
Vadim, a seasoned practitioner, will share the decision-making philosophy in guiding technology selection within their current stack, offering a unique perspective and approach, how to make technology decisions if you are not FAANG.
This presentation is an invaluable resource for those seeking practical insights into SaaS operations outside large teams and organizations.
The talk isn't just about showcasing accomplishments; it's a real-life look at the journey, with lessons learned that go beyond the usual tales of success.
What’s New in Harbor, and how can you make Harbor even better?
Regardless if you are a user of Harbor or want to be a contributor, that session will lay down the basic understanding of how the Harbor project works, what are the new features and how you can utilize them in your environment.
Join Vadim and Orlin in this session to learn what was added to Harbor in the 2.9 and 2.10 releases. We will talk and show “SecurityHub” introduced in v2.9, which provides a way to present a vulnerability in a holistic view, the alignment with OCI distribution spec v1.1 is also an important update that can extend more clients such as notary v2, key features such as the parallel GarabageCollector and concurrent push.
Get insider information on the Linux Foundation Mentorship program in Harbor and how you can join our next round. What are we doing to make the harbor-operator and harbor-terraform-provider better? And what kind of help do we need to make the project go further?
Project Harbor, all the year around, and what comes next
In 2023, we released Harbor v2.8, which integrated CloudEvents, improved the JobService dashboard, and supported OCI distribution spec 1.1. In our v2.9 release, we introduced the Security Hub and significantly improved the GC for parallel deletion. The platform was further strengthened by integrating Nydus and Notation.
The winter release of Harbor - v2.10, introduced improved customization of access to robot accounts through the user interface and paved the way for the integration of SBOM. Our roadmap for the next year includes finalizing the SBOM implementation, integrating multi-scanners, and designing policies for organizing various auto-generated SBOMs. Our goal is to increase the adoption of distribution OCI spec 1.1 and expand our client base.
We are also exploring an AI-assistant registry - trends in AI. We welcome software engineers and DevOps professionals to join our community and explore the possibilities of Harbor together. Let's work together to make Harbor even better!
Harbor Project - the maintainers session what we have accomplished!
In Harbor v2.11, we've successfully integrated SBOM (Software Bill of Materials) within the platform, enhancing our security and compliance capabilities. We're also exploring innovative trends in AI, such as an AI-assisted registry (not to be confused with an AI-integrated bot).
Join Vadim and Orlin as they guide you through the latest developments in the Harbor project, along with some exciting side projects within our community that you may find intriguing. This session is a perfect opportunity for software engineers and DevOps professionals to dive into Harbor's advancements and explore new possibilities together.
We invite you to join us for firsthand information about what's coming next in Harbor and learn how you can actively contribute to the project. Together, let's make Harbor even better!
Harbor and the world of SBOMs
Discover how integrating SBOM (Software Bill of Materials) with Harbor enhances your software supply chain security. In this lightning talk, we'll cover:
- What is SBOM?: Quick overview of its role in software transparency.
- Integration with Harbor: Highlights of the SBOM integration in Harbor v2.11.
- Security Best Practices: Using SBOM to identify and address vulnerabilities.
Perfect for software engineers, DevOps professionals, and security enthusiasts looking to strengthen their software supply chain.
Dynamically Proxy Helm Charts As OCI Artifact
While Helm Charts can be stored in OCI registries, most public Helm Charts are in the Repository styled format. This can become a real pain if you work with OCI registries and 3rd party public Helm Charts. In my lightning talk, I present a tool together with some enlightening workflows to transparently proxy and transform Chart Repository styled Helm Charts as OCI artifacts.
Thanks to the open-source tool github.com/container-registry/helm-charts-oci-proxy, you can work with all 3rd party Helm Charts in your OCI compliant registry. Having your Helm Charts on your side opens up many opportunities and greatly increases the security posture of your organization.
Cloud Native Days Austria Sessionize Event
KCD Sofia 2025 Sessionize Event
Cloud Native Summit 2025 Sessionize Event
Project Lightning Talk + ContribFest + Maintainer Track: KubeCon + CloudNativeCon North America 2024 Sessionize Event
Maintainer Track + ContribFest: KubeCon + CloudNativeCon Europe 2024 Sessionize Event
KubeCon + CloudNativeCon North America 2023 Sessionize Event
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top