I am extremely grateful to Linux Foundation for giving me the opportunity to attend Open Source Summit India 2026. I learned a lot and met a lot of new people out there, I tried to log my learnings throughout using some makeshift notes. Until I write a proper draft I will post whatever I wrote during the 2 day event.

Day - 01

Key Note 01

  • Consumption -> Global Leardership
  • LFX insights: look into this
  • PARAS under CDAC
  • Agentic AI, tokenomics, OCUDU

Key Note 02

  • From Bots to Agents(Reactive to Autonomous)

Key Note 03 Linus

  • PR should have explanation because nobody looks at code now Linus hasn’t in decades
  • Git+Email+Google more than enough for everything, work with people not with tools OS operates on Trust
  • Java version of Git
  • Logic errors -> not memory safe
  • Kernel development -> start with drivers
  • A lot of efforts getting wasted in bug reports due AI slop
  • Suggestive patch, a human element during bug report
  • Zero to demo LLM works here but Zero to prod? Main question lies here
  • LLMs mostly for demo stuff

Key Note 04

  • DPDAA coming in India, basically a privacy enforcement policy
  • Trust registry
  • Resolution is 792(Iata)

Hey Yocto Buid me a custom linux

  • Customized opinionated Linux Distro
  • LTS releases for embedded
  • After 5.3 things changed
  • For a linux image need:
    • Bootloader
    • A kernel image
    • ARM/RISCV(need a Device Tree Blob DTB - for laying out hardware maps)
    • root file system(clib, init, apps)
  • Poky dont use because it is not as secure
  • distro is a superset of image, image is customized according to scenarios
  • BusyBox: goto for embedded linux
  • BB: BitBake

I break things AI fixes them:

  • Workflows good at automating but not at fixing stuff hence agentic
  • Agentic CI
  • Traditional CI: Fails -> Notifications on error but in Agentic AI: Fails -> Automated PR+RCA
  • GitHub Actions as trigger + LangGraph as orchestration + Gemini as reasoning engine + Docker
  • Full observability is important in LangGraph
  • Following are measure for secure operations
    • Human in the loop is a must here
    • Secure execution and validation
  • https://github.com/PR3MM/
  • Cannot fix any architecture level of failures

CI/CD Basics:

  • Choice fatigue for tools
  • Main question arises where to actually start
  • Modern development consists a lot things to keep in check
  • API first development break the dependency change
  • Monolith vs Microservices
  • Monolith obviously easy to build but not really scale-able
  • APIs + Microservices + Containerization + CI/CD
  • Tekton Architecture: Kubernetes yaml files something for CI
  • ArgoCD: GitOps
    • API server
    • Repo server
    • App controller
    • Redis cache
  • Using ArgoCD makes your deployment declarative
  • API Gateways
  • Which API should we use?
    • REST
    • GraphQL: flexible frontend queries
    • Event driven
  • But what if an event driven system a operation is supposed to be canceled later?
  • Scaling issues: instead of traditional scaling use kubernetes
  • In kubernetes we have got pods
  • In serverless we have to make a request
  • CNCF scaling tools: Knative, Karmada, Karpenter all are kubernetes native
  • https://landscape.cncf.io
  • Graduated and incubating CNCF projects are good ones as they have more support from developers

Recipes and Runtimes:

  • Basic concepts on Containerization
  • Provenance? Supply chain poisoning?
  • chroot: sys-call to change process of a child, first instance of process isolation
  • FreeBSD Jails -> Solaris Containers -> LXC linux containers cgroups(control groups what resources each process uses), namespaces
  • Containerizing our micro-services? -> micro-bakery?
  • For Containerizing need reproducible environment, recipe
  • Image hardening to reduce the attack surface remove the unnecessary packages
  • Multi-stage builds to reduce file size of docker image for them
  • Using either alpine as a base image, but for python you will have to see a lot of workarounds or just distroless, but in here things can be complex
  • There is also a third approach aka chisel
  • Rockcraft another OCI(open container initiative) compliant tools
    • declarative not imperative like bash
    • pebble process orchestrator
    • chisel -> basically ubuntu but with just what is needed
  • .rock file is oci archive
  • Multipass great way to spin-up a VM
  • Without chisel still there is filesystem in image for any attacker to exploit
  • Now with rockcraft we have a bare base
  • Without bash, how does one debug a chisel image? for this we coreutils_bins in yaml
  • To avoid container escape run as non root user preferably using podman, since docker by default needs root permission

Journey of a packet:

  • For getting the ping of both the nodes:
  • tcpdump -eni any ‘arp or icmp’
  • Why arp is actually an issue?
  • To connect two different pods across we use encapsulation
  • building an overlay network with TUN
  • TUN used encapsulate using a golang program
  • TLDR internode pod communication here undelay stays untouched
  • Consequences of L2 switching
    • ARP spoofing
    • ARP flooding, different IPs of pods
    • Natural question, what if we can remove L2?
  • Building a purely L3 routing
    • Speed at which packets are arriving is not syncing with stuff hence packet loss
  • Packet journey with VXLAN implementation
  • From IP deterministically computer the MAC, the IP that you gave yourself??
  • Bridged pods+manual overlay -> Routed pods+manual overlay -> Routed pods+standard kernel overlay
  • WIth BGP kubernetes coming very close to the hardware
  • VXLAN is a known protocol not a lot of encapsulation is required
  • Every solution removes a bottleneck but introduces a tradeoff

Day - 02

Key Note 03 Valkey

  • Valkey high performance key-value data store, sub millisecond access at any scale
  • Caching is architecture not band aid, Cache first design
  • Valkey removes redundant operations
  • In LLM will save cost on semantically same queries
  • https://valkey.io

Key Note 04 IBM Geeta Gurnani

  • Open source is powering AI acceleration but widening the Trust Gap
  • Risk Atlas Nexus https://github.com/IBM/risk-atlas-nexus/
  • India specific governance framework - MANAV
  • Scope of alignments: K R Varshney

Key Note 05 Rust in OS Greg

  • git.sr.ht/~gregkh/presentation-rust/
  • Search pragmatic engineer Linux
  • CVE2024-43884
  • C scoped locks and allocations
  • Test the bugs at compile time
  • Rust can prevent a huge majority of security bugs at build time itself
  • All data is evil, evaluate all types of data
  • 80% of CVEs would be gone if code was written in Rust
  • Rust is going to be the bedrock of android learn it
  • Rust allows you to focus on logic more taking care of the trivial things
  • Rust experiment is over now people are using it actively
  • Make the compiler do the work
  • More developers, less maintainers

Valkey

  • Chaos engineering for valkey via Valkey fuzzer demo
  • Mostly a caching solution
  • Standalone architecture or
  • Cluster mode architecture, horizontal scaling
  • Full mesh gossip protocol (TCP)
  • Shard: Independent Primary -> Replica, design of Valkey
  • Bugs: split brain- data divergence, stuck failover- partial outage, topology divergence- wrong ownership
  • Chaos fuzzer+Agentic AI between dev and prod
  • Our fuzzer will try to kill the primaries not the replicas
  • Automated bug detection in this chaos demo
  • Why it failed was quorum loss(not able to get the signal which one was primary which one replica)
  • Multi AZ always on, 3+ shards minimum, force failover testing, connection pool drain, chaos Test
  • https://github.com/valkey-io/valkey-fuzzer

Dont trash it, Hack it

  • Went in the wrong room

Hey AI train Llama

  • From slides, couldn’t understand shit

Next evolution of Java @danieloh30

  • Why tuning required? Cold start, large images, memory consumption
  • When a new container spawns up due to overload the java app takes time to start which in turn misinterprets kubernetes into unresponsive
  • Kubernetes native java with quarkus
  • Jib lean container images, also allows for fast updates since all the things are layered
  • GraalVM native images
  • Quarkus framework level optimizations
  • Class data sharing for optimizing startup applications
  • CRaC - coordinated response at checkpoint
  • Running on JVM easy not on GraalVM
  • Quarkus+Kubernetes is the way to go to put all tools together natively
  • Refer images as well

Bootloader on Android

  • Google introduces GBL rust based
  • Developed within AOSP
  • Designed as UEFI
  • Firmware stack -> UEFI Protocols(RNG. BlockIO) -> GBL(UEFI App) -> Android kernel
  • Protocols required for GBL to work
  • Cant understand shit she is just reading code from the slides
  • Flattened image tree(FIT) currently used in uboot allows kernel images to be selected
  • Boot control protocol? OTA? GBL mandates atleast two slots
  • Boot memory protocol?
  • Fastboot for custom transport layer
  • Standard UEFI boot path GBL
  • Android-16 onwards adopt GBL
  • ESP partition has to be introduced, a mandate Now
  • GBL can be debugged using trace32, but like rust it has different structures according to hardware

Practical perfetto @stefan-lengfeld

  • Perfetto, why tracing? allows you more dimension to inspect your code
  • Tracing on android ui.perfetto.dev
  • codeberg.org/lengfeld/perfetto-yocto-tutorial
  • Check the above url for tutorial on perfetto
  • In normal cases perfetto writes the configuration itself
  • Perfetto advanced usages
  • Built in histogram and stats
  • Rectangle select, try that
  • Android’s frame timeline -> every frame has additional information: jank type
  • Android’s logcat support works only with userdebug builds
  • Another server level tip is binder and flows
  • Checkout release notes of perfetto for some awesome stuff

Writing for machines

  • Came late as I had to go for a short bathroom break
  • Context gap
  • Three different things: Rule files, Specs, Prompting pattern
  • Agents.md should be cut to the chase
  • First things to do after this session
  • Couldn’t understand a lot of stuff but it was kind-of good to look into, refer pdf

Agentic Delivery

  • Refer from slides

— End of Event —