CONNECT. NETWORK. DEVELOP.
October 22, 2026 — Warsaw, Poland
Three CDF Ambassadors will speak at this event: https://cloudnativedayspoland.org/
Data sovereignty – what it really means?
Pawel Piwosz | DevOps in Agile way
In many places, the term “data sovereignty” has become a bigger topic than even AI. But what does it really mean?
When we talk about “where data lives,” it’s not just about the storage location. It’s also about where the data is processed, transformed, and governed, and which jurisdiction ultimately has control over it. And we need to talk about these too!
In this talk, we unpack the complex reality behind modern data sovereignty. We dig into the difference between data storage, data processing, and data governance locations.
We discover, if and how the headquarters of a company determines which national law has the upper hand.
We ask a important questions, like why encryption mechanisms and key management practices might be crucial to sovereignty (and how they can both protect and expose your data).
We take a look on regulations and what they means for our data and processes.
And finally, we discuss European alternatives and we build the checklist to better understand how deep we need to care about sovereign setup for our organizations.
Operators in Action: Making Kubernetes Work for You
Verena Traub | Cloud & DevOps Consultant, b’nerd
When our team needed to automate the creation of multiple app instances, we quickly realized that existing tools weren’t enough. Writing a custom operator turned out to be the most practical way to manage their lifecycle — and a surprisingly effective way to see how Kubernetes works under the hood.
In this talk, I’ll walk you through the lessons learned while building an operator for a real-world multi-service application. We’ll explore designing Custom Resources, implementing reconciliation logic, and handling state and configuration challenges. Along the way, I’ll share the pitfalls I ran into, debugging tricks that helped, and the patterns that made the operator framework click.
Whether you’re curious about what goes on behind the scenes in Kubernetes operators or planning to build one yourself, you’ll leave with practical tips and a clear roadmap to get started confidently.
After Docker: Isolation for Agentic Workloads
Yair Etziony | Founder, False Systems · CD Foundation Ambassador
Isolation was a solved problem in 2000, just not in the way the industry remembers it.
FreeBSD Jails were not stronger than everything that came after. They were coherent: one kernel-level boundary, designed as a boundary, and auditable as a single thing. Solaris Zones refined the same idea a few years later.
Then Linux containers took a different path.
Docker did not win because it was the purest isolation model. It won because it made containers usable. It gave developers a clean interface, a simple workflow, a good mental model, and a way to package and run software without caring too much about the machinery underneath. That mattered. Good developer experience beat a cleaner theory of isolation, and for the workloads of the time, that was mostly the right trade.
A service was usually predictable. It had a known filesystem shape, a known network posture, a mostly stable syscall surface, and most of its behavior was decided before runtime. You could build an image, ship it, constrain it, observe it, and move on.
Agents break that assumption.
An agent can spawn subprocesses at runtime. It can call endpoints nobody hardcoded. It can write to paths created from context gathered mid-run. It can use credentials, tools, plugins, prompts, generated code, and remote APIs as part of one execution flow. The behavior that matters is no longer fully visible when the container starts.
Agents also do not carry the operational judgment humans quietly rely on. They do not naturally understand ownership, blast radius, production etiquette, or the difference between “technically allowed” and “obviously a bad idea.” They can follow instructions and use tools, but they do not share the human context that usually stops an operator before the damage happens.
That is why the old isolation question comes back.
Not because Jails or Zones should simply return as they were. And not because Docker was wrong. Docker solved usability for a generation of software delivery. But agentic workflows expose a different problem: how do you isolate something whose shape is discovered while it runs?
This talk traces the line from Jails and Zones to Docker and Linux containers, and then asks what should be revived for the agentic era. The answer is not nostalgia. It is old ideas rebuilt with new mechanisms: coherent boundaries, runtime policy, and isolation-first design for workloads that no longer know their own edges in advance.
eBPF LSM is one possible way Linux can get there. It matters because it lets policy live close to the kernel boundary while still being programmable at runtime. But the larger point is simpler: the next runtime should not only be easy to use. It should be built for the strange, dynamic, semi-informed workloads we are now creating.