If you want to warm up and enjoy a little bit of exercise before sitting down for the conference talks feel free to join us for a fun run near close to the conference venue.

We want to meet at the #1 tram stop "Tylova" at 7:00 am on Thursday the 18th and are planning to run for about 30-40 minutes.

We will run similar to the following track but shorten it if necessary.
https://mapy.com/s/nupesofalo

All types of runners, whether fast or slow, are welcome to join. We'll adjust our pace to accommodate everyone so that we can all enjoy it and of course, we can also adjust our route if we need to.

Booths are located on the street level in D and E buildings.

D building booths:
D01: Red Hat
D02: Canonical
D03: openSUSE
D04: Microsoft
D05: Fedora
D06: Pulp
D07: Foreman
D08: Podman
D09: OpenSSL
D10: KubeVirt

E building booths:
E01 + E02: Videogame history
E03 + E04: 3D printing & open HW
E05 + E06: Base 48
E07: Grafana
E08: FreeIPA
E09: FSFE
E10: Tolgee
E11: Hands-on cyber security
E12: INDUSTRA

Join the organizers for the conference opening. We'll share all you need to know to have a great experience at DevConf.CZ 2026!

There's been a monumental increase in the number of CVEs tracked in Open Source. Nearly 50,000 identified in the last year: 130 a day. In part, this is due to AI.

We see an opportunity here to change Open Source software to be fundamentally more secure: Agents can cross check for exploitability and vulnerable patterns, port more easily to secure languages, and we can work at scales that were impossible before.

However, the current tsunami of CVEs has made it nearly impossible for users to determine what software they use is actually vulnerable. Manually assessing vulnerabilities, and backporting patches, the way traditional Linux distributions have done for decades, is becoming untenable at this scale. The math no longer works.

We'll look at one approach that does work: Hummingbird which consists of minimal, distroless containers built as close to upstream as possible on a fully automated supply chain, no humans involved until required. The result: zero known CVEs at time of delivery.

But that’s not enough. Lets get beyond this tsunami, and how we get to prevention of vulnerabilities.

The Free Software Foundation Europe runs two main activities for young people in Europe: Youth Hacking 4 Freedom and the illustrated book „Ada & Zangemann: A Tale of Software, Skateboards and Raspberry Ice Cream“ by Matthias Kirschner and Sarah Brandstätter.
Youth Hacking 4 Freedom is our programming competition, that is open for all teenagers in Europe.
While Youth Hacking 4 Freedom is targeted for teenagers, we also have our inspiring Ada and Zangemann story. A fun story for children from the age of 6 and adults alike about a girl who loves to tinker, and decides to confront the mighty inventor Zangemann.

In this talk, I will briefly introduce those activities, share some fun anecdotes, and highlight our learnings about engaging with younger people through the glasses of Free Software.

Both activities aim at encouraging people to get active in Free Software and to own your technology.

Storage kernel extensions provide the critical interfaces between the operating system’s vnode and Virtual File System (VFS) layers, enabling custom file systems to be integrated and recognized as native components.
In this session, I will offer a concise overview of how file system kernel extensions are used within Software‑Defined Storage (SDS) architecture.
I will walk through the end‑to‑end process of building and deploying kernel modules in both containerized and traditional (non‑containerized) SDS environments, highlighting practical considerations and common challenges.
Finally, I will demonstrate how the Kernel Module Management (KMM) Operator for Kubernetes and OpenShift streamlines the lifecycle of file system kernel modules — simplifying their build, deployment, and maintenance within a modern SDS system.

strlen("Dvořák") returns 8, not 6. If that surprises you, this talk is for you.

We have all seen it: Dvořák turns into DvoÅák, names become question marks. You try things until it works. But what is actually going on?

I will start with how we got here: ASCII, code pages, Unicode, and what it left unsolved. That part will be quick. Where I really want to dig in is what the C library does next: how iconv converts between encodings, how the gconv pipeline inside glibc works, and why things like //IGNORE behave inconsistently.

As a glibc contributor, I learned most of this the long way. I will share those experiences and the surprises along the way.

You will walk away with a working mental model of character encoding in general and especially in C, from history to implementation.

Talking about Network observability brings to mind horror stories of dealing with vendor MIBs, SNMP traps not firing or NetFlow overwhelming your backbone. Technologies like SNMP and NetFlow can be very useful but don't integrate well in a cloud native context.

One way to modernize network observability is with the OpenTelemetry eBPF Instrumentation Project (OBI). While its main focus is on applications, it also contains an entire subsystem dedicated to Network Observability!

This talk showcases how OBI can be used to monitor Kubernetes & cloud provider network relationships to help you diagnose issues which might go unnoticed otherwise. After that, we'll explore how OBI can be used outside and beyond Kubernetes as well. We'll also uncover how eBPF is used to gather these metrics and what to optimize for.

Most OpenShift developers saw the dreaded Tide retest many times. All jobs are green and for SOME REASON Tide decides to run everything again and now the PR will not merge for several hours. It is not a bug, it is a feature. What if the green jobs actually ran a month ago when the code was much different? They surely do not provide reliable signal for a merge decision. They need to be retested.

It is indeed a feature, but that feature comes at a cost. Retests take time. They cost money. What if we stopped doing them? What would we save, and what risk would we open ourselves to? I will explore that in this talk.

The talk aims to be of interest even to attendees not familiar with OpenShift CI and Tide. These attendees may find it useful as a case study of how OpenShift organization merges code at scale, how it sets up quality gates, and what factors and tradeoffs affect the developer experience in such a system.

In this workshop, we will teach you how to easily create a custom Podman Desktop extension. With these extensions, you will be able to run commands, monitor container logs, and build features tailored exactly to your needs.

Please read the 'Prerequisites' (slide 2 and 3 before attending) in the presentation and try to setup the env before the workshop.

We will guide you through the Podman Desktop API and the entire development journey—from initial setup to a finished product for you and your team. Finally, we will show you how to automate the process using CI/CD to build extension images and how to install them directly into Podman Desktop.

As open-source projects grow, governance becomes a bottleneck. Tracking enhancement proposals across repositories, enforcing deadlines, ensuring process compliance - these don't scale with volunteer maintainers.

Enter the VEP Police Agent - an AI agent built with LangGraph, MCP, and LLMs for KubeVirt, a CNCF project for running VMs on Kubernetes. It autonomously monitors the enhancement proposal lifecycle: discovering proposals across GitHub, tracking compliance in parallel, performing cross-domain risk analysis, and delivering prioritized alerts via Slack and email.

We'll dive into the architecture: a LangGraph state machine with parallel nodes, a two-tier LLM strategy (fast models for MCP tool-calling, powerful models for reasoning), and phase-aware analysis that keeps alerts context-sensitive. A live demo will show the agent catching real governance issues in real time.

While built for KubeVirt, the patterns apply to any project facing governance growing pains.

Over the past years, DevConf.CZ featured several talks on bpftrace, an eBPF-powered observability tool for Linux. Most of the talks shared the same selling point - bpftrace is awesome at writing powerful one-liners, usually straight in the command line, to trace practically any part of your system.

While this remains an important capability, the eBPF ecosystem has evolved into a point where users want to write complex applications intended to run and be maintained for long periods of time. This is where bpftrace has struggled historically, however, users still value its simple domain-specific language, which allows to abstract away complexities of eBPF program development.

Things have recently started to change in this area and bpftrace gained several new features which evolve it into flexible and composable framework and language. In this talk, we will present these new features and show you that today, bpftrace should be your default choice for an observability tool on Linux.

The "Bigger is Better" era of AI is hitting a physical limit. While trillion-parameter models dominate the cloud, the real-world demand for private, low-latency, and energy-efficient intelligence is growing at the edge. Enter LFM 2.5, the latest flagship from Liquid AI. Built on a hybrid "Liquid" architecture rather than standard Transformers, LFM 2.5-1.2B-Thinking achieves frontier-grade reasoning in a sub-1GB RAM footprint.

In this 15-minute lightning talk, we will explore the shift from "System 1" (probabilistic chat) to "System 2" (deliberative reasoning) on consumer hardware. We will dissect how LFM 2.5 uses Linear Implicit Variable (LIV) operators to achieve 2x CPU throughput over Llama 3.2 and Qwen, enabling 300+ tokens/sec on mobile NPUs. Finally, we will demonstrate a "Reasoning Trace" running locally on Fedora using vLLM and llama.cpp, proving that you don't need a data center to build a "thinking" agent.

Insider threats remain one of the most complex security challenges because they originate from trusted identities with legitimate access. Traditional perimeter-based controls and static rule engines are no longer sufficient to detect subtle misuse, compromised accounts, or risky behavior.

This session explores how to build a unified behavioral view of users by correlating identity context, access patterns, device posture, network activity, and sensitive data interactions. It demonstrates how AI-driven models create dynamic baselines of normal behavior and detect anomalies in real time.

Attendees will learn how to reduce false positives, move from reactive incident response to proactive risk management, and design people-centric security monitoring architectures suitable for modern engineering environments.

Eclipse Qrisp is an open-source Python client library that enables you to create quantum algorithms using ordinary logical and arithmetic operations, in contrast to the low-level quantum circuit and gate approach supported by most other client libraries. The QFrame open-source library (layered above Qrisp) goes a step further, enabling you to define high-level algorithms within a powerful quantum search framework. This presentation gives an introduction to coding with QFrame and Qrisp, providing a glimpse of how quantum computers are likely to be programmed in the future.

I'm a developer on the Migration Toolkit for Virtualization (MTV) team. MTV is an Kubernetes operator that migrates workloads from platforms like vSphere and oVirt to KubeVirt on Kubernetes. I like writing CLI programs, so when I was tasked with creating an MCP server for MTV, I looked at how we can reuse our kubectl-mtv CLI tool code and structured output to auto-generate the server. In this talk I'll demystify MCP servers, explain how AI learns to use tools, how we let it ask for help the same way a human would, and why a CLI with clear command structure and helpful help text works well for both humans and machines. I'll cover the small gaps between how humans and machines read the same text and demo how we leveraged existing patterns of CLI design like help text, examples and flags to combine with new AI patterns and tool-chains. I'll demo the end result, the kubectl-mtv MCP browsing, planning, and running VM migrations through OpenShift Lightspeed.

Local development stacks tend to sprawl: databases, agents, schedulers, and sidecars all wired together with ad‑hoc scripts. This talk shows how to turn that kind of environment into a reproducible Fedora Cloud Edition deployment using a combination of Fedora Containers, Fedora Cloud Edition and Podman Quadlets. With a working agent framework as a real‑world example, we will review decomposing a multi‑service local AI driven setup into declarative quadlet units.

From DevConf 2025 and recent NIST recommendations, this session presents updates to the QUBIP OpenSSL Provider and QUBIP Firefox, demonstrating practical post-quantum cryptography (PQC) integration.
A live demo will show a familiar Firefox browsing session seamlessly using PQC. By inspecting the security tab while connecting to a PQ-enabled QUBIP server, we'll demonstrate successful mutual authentication and key exchange enabled via qryptotoken, a Rust-based PKCS#11 soft-token derived from Kryoptic, loaded alongside Firefox’s default NSS token.
On the server-side, nginx runs over OpenSSL 3.2 with aurora - our Rust-based OpenSSL Provider. This architecture improves cryptographic agility through shallow loadable modules, separating stable systems from the rapidly evolving PQC ecosystem - beyond what can be approximated with vanilla Firefox and OpenSSL using oqsprovider.
The session concludes with a discussion of methodology and how significant such modular designs are in PQC world.

In today's modern internet transport landscape, HTTP/3 and QUIC are often presented as the next step in the evolution of web transport, promising lower latency and improved multiplexing. However, adopting QUIC is not just a protocol upgrade - it fundamentally reshapes how application stacks, networking layers, and infrastructure interact.

In this talk we explore how QUIC and HTTP/3 change the traditional layering between transport, TLS, and application protocols. Using practical examples from working with HTTP/3 implementations across the stack - deployments with nginx and client-side experimentation with curl - we look at what it means to integrate QUIC into existing infrastructure. Topics include connection management, retry semantics, operational visibility, and performance trade-offs when introducing QUIC into production environments.

Finally, we discuss how QUIC’s architecture enables a gradual unification of the tech stack around shared transport abstractions.

I started on the sysadmin side: customer environments, incidents and the daily reality that systems fail. With no traditional CS background and no predefined path, I needed to extract value from every task, piece of advice, mistake and incident. This lightning talk is an honest account of how that shaped my move into software engineering. Sometimes it was an advantage (debugging discipline, failure-mode thinking and respect for blast radius), sometimes friction (perfectionism, fear of code and collecting technologies without shipping). I’ll reflect on the moments that changed how I learn and how I work, including two accelerators: AI, which shortened the path from “I don’t get this algorithm” to “I can apply it,” and mentorship, which turned scattered effort into focused progress by challenging and correcting mental models. The goal isn’t to prescribe a path, just to share real tradeoffs, mistakes and turning points from a non-traditional route into engineering.

Sometimes, the conference can be a bit overwhelming (too crowded, too loud, too busy).
This activity gives attendees a place to relax, recharge, or meet new people in a low-pressure kind of way.
There are different opportunities to get involved, to get to know each other, or simply to take a break.
- Get a supporting message and leave another one for the next person.
- Recommend a book that left an impression on you.
- Use a mentoring board to get opinions on a problem you are currently trying to solve or help others by offering a solution yourself.
- Let's color a poster together!
- Or just hang around
Everyone is welcome.

The authentication in Fedora is changing. What does this mean for users? Will you be affected by the change? Why we are doing this? What will it bring?
If you want to know answers for any of these questions, this talk is just for you.
We will also look at how is this done and when does this happen.

Slides: https://github.com/Zlopez/fedora_slides/blob/master/DevConf.CZ%202026/End_of_OpenID_in_Fedora.pdf

Lights won't turn on when you enter the room? Lost in a bunch of voice assistants and smart speakers? Want to know how to keep your house warm during the day, cool at night, and save money on heating bills?

Come to a meetup of home automation enthusiasts, learn about new developments in the field, and discuss problems with like-minded people

GitHub provides public API for obtaining detailed information about various events performed by users across public repositories: git pushes, pull requests and reviews, github issues and comments, github stars, etc. The information about these events is available at https://gharchive.org in the form of per-hour compressed files with JSON lines representing all the events. The number of events recorded per year is ~1.5 billions. The total size of events per year is ~7 terabytes. This sounds like a big data. The talk shows how to explore this data at high speed and minimal costs and how to obtain interesting insights from this data.

Mixture of Experts (MoE) architectures trade dense computation for conditional sparsity activating only a subset of experts per input token. But this sparsity doesn't come for free: dynamic routing decisions, irregular memory access, and excessive kernel launches can quietly undermine performance. This talk covers optimization strategies for MoE inference using PyTorch 2.x's compilation stack alongside vLLM's serving framework. We will show Profiler traces to illustrate four key areas for optimization: kernel fusions, FX graph optimizations, memory layout optimization, and dynamic shape specialization for variable batch sizes. After that will discuss how to extract insights from profiler data mapping kernel timelines to specific fusion passes, identifying memory-bound vs. compute-bound expert execution, and validating that compiled MoE forward passes maintain batch size flexibility without guard-induced recompilation.

Systemd has been growing new features that extend or replace traditional Linux security components:
- systemd-nsresourced instead of subuid/subgid
- systemd-mountfsd for unprivileged mounting of file systems
- run0 instead of sudo
- empower group with magic root rights
- Varlink to allow easy turning of command-line programs into services
- Polkit rules to allow privilege escalation with centralized policy

Why are we building new components that augment/enhance/replace existing tools?
Are installations with no setuid/setgid binaries possible?
What are some cool things that weren't possible before?
What are the threat models that this is trying to address?
Are distros like Fedora really making full use of those features or should we rely on them more?
Where is this all going?

In this workshop, we will introduce and practice four techniques, enabling the discovery and free floating of essential information between teams in a project, or projects in a program, tasked with delivering large, complex, and uncertain assignments:
1. Project metadata technique; designed to increase information awareness and the discovery of predefined project metadata elements
2. Result Breakdown Structures are designed to visually represent the project's scope, enabling more accurate cost and work hour estimates
3. Power Kanban: distribution of key information between teams on demand, see who is working on what, determine whether you are a stakeholder in a decision, and dashboards
4. Agile Rolling Wave Planning is designed to balance the conflicting needs between long-term and short-term planning.
Participants will be involved in planning the construction of a dream house with a pool and renewable energy systems, experience each technique firsthand, and share their findings.

Please remember to bring your laptop for this workshop.

X.509 certificates are vital for Internet security, yet their inner workings often remain a mystery. This intermediate workshop moves beyond the "black box" to provide practical skills in Public Key Infrastructure (PKI) and certificate management using FreeIPA.

Attendees will explore diverse use cases, including WebPKI, Smart Card auth, Kerberos PKINIT, and 802.1X EAP, essential for system administrators or DevOps engineers.

Hands-on topics include:
* PKI fundamentals and X.509 anatomy.
* Using OpenSSL to generate keys and CSRs.
* ACME (Let's Encrypt) and FreeIPA issuance.
* Configuring certificate profiles, sub-CAs, and enabling ACME.
* External signing and renewal of the FreeIPA CA.
* Linux Smart Card authentication and host configuration.
* Future trends: Certificate Transparency and Post-Quantum cryptography.

Prerequisites: Participants will access a cloud lab and will only need an SSH client and to be comfortable with the Unix command line.

Update one package in your container image and watch your users re-download 500MB of unchanged content. Traditional Dockerfile layers are instruction-based—a single package update invalidates an entire layer.

This talk introduces chunkah, a tool that post-processes container images into content-based layers. Files are grouped by package, not Dockerfile structure. Update one package, users download only that layer.

We'll cover:

• Why instruction-based layers hurt pull performance (with numbers)
• How content-based splitting works under the hood
• Live demo: chunkah in action, before/after comparison
• How podman history reveals package-to-layer mapping

From Project Hummingbird, where we run 70+ production container images with chunkah, we'll show real metrics on bandwidth savings and how to adopt this in your own builds.

Audience: Container image builders, CI/CD engineers, registry operators, anyone who's wondered why their image pulls are so slow.

Updating a specific fact in a 70-billion-parameter model usually feels like using a sledgehammer for heart surgery. Traditional retraining is slow and expensive, often breaking unrelated behaviors in the process. ROME (Rank-One Model Editing) offers a more surgical alternative, treating model weights like a database that can be precisely updated without a full rebuild.
We move past the black box mystery to show how we can locate where a specific fact lives within a transformer's architecture. We will explore the mechanics of knowledge neurons, the risk of unintended side effects like hallucinations, and the serious security implications of malicious fact injections or stealth patching. Through live demonstrations using our open-source toolkit, we will show how ROME performs precision strikes on state-of-the-art models, highlighting both its efficiency and the scenarios where the method’s assumptions break down.
This talk is an ongoing collaborative research between Red Hat and FIT BUT.

Migrating from Hyper-V to OpenShift is often a manual nightmare of custom scripts and fragile workarounds. The Migration Toolkit for Virtualization changes the game with new support that enables direct, agentless, and automated migrations into OpenShift Virtualization.

This lightning talk cuts through the noise to show you exactly how the Migration Toolkit for Virtualization now connects to Hyper-V under the hood, leveraging WinRM remoting for live VM discovery and SMB shares for disk streaming, all without installing agents or modifying the source environment. Stop scripting, start migrating.

The EU-funded CCAT project is transitioning academic security tools from lab prototypes to professional-grade software. Because poor usability often leads to crypto misuse and security failures, we are conducting usability research to ensure these tools fit real-world workflows. We invite attendees to test these prototypes and help shape their development.
The CCAT toolset:
1. TLS-Scanner (2016–Present): a tool for checking the settings of TLS clients and servers. Target users: security solution providers.
2. SCRUTINY (2006–Present): a toolset for assessing cryptographic implementations in hardware devices (smartcards, TPM, etc.) and software libraries. Target users: crypto-evaluation specialists
3. sec-certs (2022–Present): an analysis tool for the CC, FIPS 140, and EUCC landscapes, mapping the relationships between certification documents and products. Target users: vendors, authorities, and certificate consumers.

A product owner is accountable for effective product backlog management, but open source is different than the average corporate environment. At any time a contributor can come by with a feature you didn't count on. Project maintainers from outside your company can object to your plans. And how to even balance upstream and downstream backlogs? These are just a few of the many challenges you may face.

Whether you're an experienced product owner but new to open source or experienced in open source but new to product owner, this session is for you. I'll share my experiences transitioning from a developer to a product owner and welcome any questions & comments.

How does Linux "sound" to a blind user? This practical, demo-heavy session explores the accessibility stack through the Orca screen reader, moving beyond compliance to help developers understand the non-visual mental model.
Using examples, we will dive into:
- The Power of Focus: Why the "one object at a time" constraint is the foundation of non-visual navigation and UI flow.
- Exploration Patterns: How users discover apps via Tab navigation, menus, and the "Flat Review" fallback for non-standard interfaces.
- UX Friction: Real-world examples of how unlabeled controls and poor grouping break workflows.
- The Terminal Paradox: Why the CLI is a double-edged sword—ideal for text, yet challenging for structured data and complex TUIs due to its line-oriented nature.
Attendees will learn to identify "accessibility smells" and gain practical techniques for building more inclusive software.

N-ATLaS is a multilingual African-language LLM we took from research to production on Kubernetes. This lightning talk shares the practical lessons from making it reproducible, observable, and affordable under real infrastructure constraints. I’ll cover the platform patterns that mattered most: Argo-based orchestration, repeatable deployment, observability, supply-chain hygiene, autoscaling, caching, and rollout strategies that improved latency, uptime, and cost. Rather than focusing on model theory, this talk is about operational reality, what broke, what worked, and what we would do differently after real usage. Attendees will leave with practical patterns for running LLM workloads in production, especially in resource-constrained environments and for low-resource languages

How do we provide platform engineers and security architects with the same immutability and integrity for the operating system (OS) that they expect from containers? While OSTree pioneered transactional deployments, the ecosystem has shifted toward OCI images and sealed, hardware-rooted attestation, leaving a gap for a standardized, verifiable OS delivery path.

This talk introduces a shift in image-mode Linux, aligning the OS directly with the OCI model using bootc and composefs. By consuming OCI images and materializing them through composefs, we create a bootable, verifiable filesystem with strong lifecycle and update guarantees.

We compare this approach with traditional OSTree methods, examining layering, updates, and operational trade-offs. We will demonstrate deploying a sealed UKI composefs-backed system on RHEL 10.2!

After this talk, attendees will be ready to build, verify, and deploy OCI-native operating systems with production-grade integrity.

Continuous Performance Testing (CPT) is critical to understanding system behavior beyond functional validation. In this talk, we share how the OpenStack Perf & Scale team built an automated OpenStack CPT framework using Prow CI to continuously test Red Hat OpenStack Services on OpenShift (RHOSO). We automated end-to-end cluster deployment and workload execution across core services such as Nova, Cinder, Neutron, and Barbican. Beyond workload automation, we engineered a metrics pipeline with Elasticsearch for persistent storage and Grafana dashboards for real-time visualization and trend analysis. We implemented change-point detection to proactively identify performance shifts.Along this journey, we developed internal tools like JetBrew, streamlined automation workflows, and reduced multi-day manual efforts into hours. This session highlights our technical architecture, tooling evolution, lessons learned, and how CPT became part of our day-to-day engineering practice.

Kubernetes excels at scaling workloads, but what happens when your workload is a cloud development environment? There’s no shortage of resources on scaling traditional workloads, but cloud-based development environments come with their own challenges. While they offer consistency, security, and automation, scaling them pushes the limits of scheduling, storage, and platform stability. We’ll share lessons learned from operating large-scale, multi-tenant cloud development environments in production.

Learn how we developed a controller-based, policy-driven model for workspace management, leveraging CNCF Devfile spec to standardize workloads and tune for density and multi-tenancy. By making some tweaks to our Kubernetes cluster, we reduced etcd load and improved stability at large scale. This talk will equip you with practical patterns and architecture insights for building and scaling non-traditional workloads on Kubernetes.

Your computer has a TPM (Trusted Platform Module), but are you actually using it? Despite being ubiquitous in modern hardware, this dedicated security processor remains one of the most underutilized components in the standard security stack. This introductory talk aims to make accessible the use of this chip.

We will start with the fundamentals of TPM architecture, then we will move into a few high-impact, low-effort real world use cases to leverage your TPM for a more secure and seamless workflow. Whether you are securing your SSH keys or automating disk decryption, you will leave with a clear understanding of how the hardware works and a toolkit of practical examples you can implement immediately.

You are probably familiar with the well-known XKCD comic Dependency describing fragile dependencies. Would you like to see what this image would look like for YOUR system? Based on real data? That is exactly what
I am working on in my bachelor's thesis. I will show you what I have done so far, where the pitfalls are, and what is still left to do.

At DevConf.CZ 2025 this workshop packed the room and helped generate 25 pull requests, with multiple first-time contributors submitting their first open-source PR. We're back with a twist: bring your AI tool of choice.

Podman is a CNCF Sandbox project heading to incubation and it needs contributors. This workshop gives you two paths to your first (or next) contribution:
Path A — Traditional. Find an issue, write a fix, submit a PR the classic way with Podman experts guiding you.
Path B — AI-assisted. Use Cursor, Claude, or your preferred AI tool to help write a fix. We'll teach you to contribute AI-generated code well — review what the AI produces, verify it solves the problem, and submit a PR maintainers will want to merge.

Both paths end the same way: a real pull request on the Podman repo, tested and ready for review.

Pre-req
Basic programming knowledge
A GitHub account
Familiarity with Git is a plus
Podman on your laptop
For Path B: your preferred AI coding tool and the above

During this workshop, we will build fully operational observability stack using OpenTelemetry, Mimir, Grafana, and other notoriously known tools. We will explore the key differences between Prometheus and OpenTelemetry + Mimir OSS. By the end of the workshop, you will understand basic functionalities of all mentioned and be capable of configuring and deploying them in a way that you will never lose metrics again!

We'd like to ask all attendees to pre-pull all docker images and pre-create their local kubernetes environment before the workshop, so we can avoid any troubles with internet connection. All instructions are written in the readme: https://github.com/obabec/devconf2026-workshop-obs/blob/main/BEFORE_CONFERENCE.md

Commercial LLM-based assistants such as ChatGPT or Claude can call tools, query data, and power agents out of the box. In enterprise settings, these products are delivered through managed external services, creating vendor lock-in and data governance risks. Small self-hosted language models offer a compelling alternative, but require a different approach to build reliable AI assistants.

In this session, we present the design and implementation of an AI assistant powering Red Hat AIPCC Productization’s Release Dashboard. The assistant queries internal data, calls internal tools, and synthesizes answers without relying on external LLM providers. We show how decomposing assistant behavior into a four-layer architecture of action classification, tool selection, argument generation, and answer synthesis makes small, self-hosted language models viable for building reliable AI assistants. We conclude by discussing the metrics and feedback signals used to observe and improve the system.

Sweetest meetup on DevConf. Bring a candy, eat a candy

In performance critical domains like fintech, gaming, real-time analytics, AI inference, and edge computing, even small inefficiencies can cause event loop stalls and unpredictable tail latency.

This talk explores how to push Node.js beyond its perceived limits by combining modern platform capabilities: worker_threads for true parallelism, native modules via N-API (Rust or C++) for CPU-intensive workloads, and fine-grained performance analysis of the event loop. Through a real-world API example, we’ll show how to offload heavy computation without blocking request handling, reduce serialization overhead, and achieve stable, low-latency responses under high load.

Attendees will learn how to identify CPU bottlenecks, design worker pools, decide when JavaScript is “fast enough,” and integrate native code without sacrificing maintainability. The session includes live demos, profiling graphs, and before/after latency benchmarks using tools like clinic.js.

Smartwatches are usually tied to proprietary mobile apps and closed ecosystems. Open-source projects are changing this by allowing users to connect wearable devices with open platforms and build their own integrations.

This talk introduces the open smartwatch ecosystem through projects such as PineTime, Bangle.js, AsteroidOS, and Amazfish. The main focus will be on Amazfish, an open-source companion application connecting smartwatches with Linux-based systems.

We will look at the challenges of building a smartwatch companion app that runs across multiple platforms, including Ubuntu Touch, Sailfish OS, and desktop Linux via Flatpak. The talk will cover portability challenges, architectural decisions, and how open technologies enable a shared ecosystem across different devices and operating systems.

We’ve all seen the demos: an AI builds a flashy app from scratch, and everyone asks, "What prompt did you use?" But try that "magic prompt" on a massive legacy system or deep inside Linux OS tools, and it falls apart. The "perfect prompt" is a myth. In real-world codebases, agents suffer from "Context Amnesia" - forgetting architectural constraints as the chat grows. They also over-engineer, duplicate code, hallucinate and add redundant fallbacks just to be safe.

This is why human engineers are irreplaceable. We hold the big-picture context and the judgment of what not to build.

This talk cuts through the "autonomous AI" hype. Instead of endless prompt-hacking, I’ll share a practical, design-first workflow for tools like Cursor and Claude Code. You will learn how to:

• Anchor Context: use Markdown design docs as the agent's "external memory."
• Filter the Bloat: force agents to plan first, catching garbage before it's coded.
• Steer, Don't Prompt: recover when the agent gets stuck.

Industrial edge deployments face a forced choice between three imperfect options:
Kubernetes (powerful but ~512 MB of overhead on 1 GB devices),
Docker Compose (simpler but with a root-daemon SPOF),
or native .deb/.rpm packages (zero overhead but no isolation or portability).
Each excels in its design context, yet none fits the widest device tier — DIN-rail gateways and compact controllers with 256 MB–1 GB RAM.
This talk introduces the fourth option: Podman Quadlets — OCI containers as native systemd services. A 16-line .container file gives you kernel watchdog, cgroups v2 limits, seccomp/SELinux, and automatic recovery — all supervised by PID 1. No daemon, no orchestrator, zero runtime overhead.
Live demos on a Raspberry Pi show a Quadlet deployment from scratch, WebAssembly via crun on the same stack, and Compose-to-Quadlet conversion with podlet. We close with the specification proposal to the Margo.org (Linux Foundation), adding quadlet.v1 as a third deploymentprofil

This talk will explore how to apply the docs-as-code principles to generate, manage and deliver documentation with the same rigour as software. We will examine how to create maintainable, versioned documentation that can be delivered continuously and scales seamlessly with your infrastructure and applications.

Moving beyond tooling and pipelines, we will explore how concepts from microservices architecture, such as modularity, clear boundaries, ownership and independent deployment, can be applied to documentation. By structuring documentation as loosely coupled, domain-driven components, teams can improve clarity, reduce duplication and allow different documentation areas to evolve independently, just as they would with services.

Finally, we will address a frequently overlooked truth: simply writing documentation does not solve the problem. It must be readable and understandable and designed with its audience in mind.

The EU Cyber Resilience Act (CRA) was designed to protect European consumers, but its global implications have left many in the open source community - especially individual contributors and maintainers - feeling confused or even afraid. While most discussions focus on the obligations of Manufacturers or Open Source Stewards, individual contributors are often left asking: "Will I be liable? Should I stop contributing?"

We will start this session with a short presentation, but most of the time will be dedicated to answering your questions (AMA - Ask Me Anything), taking whiteboard and brainstorming on your case studies and the CRA roles that might be applicable to you, your organization, your open source projects or your community. We will focus specifically on SW developers, contributors and maintainers and show that the regulations are manageable. There are no “stupid” questions about the CRA as it’s the most complex and impactful regulation that the open source. We got your back.

If you love your community but struggle to stay on top of event organising, or the multi-layered calendar of deadlines and milestones, then you're not alone. It is relentless (and not all that much fun).

In this lightning talk, I'm going to cover some timelines for running events – whether it be in-person or virtual, recurring or one-off – that you can put into action for your community. I'll cover some tools and processes that have helped me and my community, as well as identify some pitfalls to avoid.

Container Images are foundational to modern infrastructure, yet their internal structure can often be opaque and difficult to debug. Large image sizes, hidden redundant files, and inefficient layering can lead to slower deployments and wasted resources. Manually dissecting layers or understanding disk usage across an image stack is often cumbersome and time-consuming.

This lightning talk introduces skiff, a powerful command-line utility designed to simplify OCI image introspection. Built using podman's container libraries, skiff provides developers and operators with tooling to introspect image layers. We will demonstrate how skiff can be used for the following tasks:
- Identify large layers and files
- Explore layer contents directly
- Diff installed packages
- Locate wasted space

Join this session to learn how skiff can help you analyze, debug, and optimize container images for better performance and resource utilization.

Confidential Containers bring hardware-backed Trusted Execution Environments (TEE) into the Kubernetes ecosystem, enabling workloads to run with stronger isolation and encrypted memory while preserving cloud-native workflows. As platform teams move toward zero-trust architectures, protecting data in use becomes essential for multi-tenant clusters, AI pipelines, and regulated environments.

This talk explores the architecture behind Confidential Containers, including attestation flows, runtime integration, and scheduling considerations in Kubernetes platforms. We will discuss real-world design patterns, trade-offs, and operational impacts when introducing confidential computing into hybrid and multi-cloud environments. Attendees will leave with a practical understanding of how to enhance workload security without breaking existing DevOps practices or developer experience.

The transition to AI-assisted development is a fundamental paradigm shift in software engineering. However, rapid code generation has introduced a Productivity Paradox: the speed of delivery is often negated by the rising costs of remediation and the erosion of deep technical oversight.
In this talk, we analyze high-integrity practices for building with AI assistants, starting with the Knowledge Premium—the reality that deep architectural expertise is critical for providing precision. We will examine strategies for prioritizing context over syntax through Intent-Driven Development. IDD represents a transition from "writing code" to "orchestrating intent," where the human engineer defines the destination and constraints, and the AI serves as a high-level collaborator. Finally, we will demonstrate a set of senior-level "tricks" and best practices designed to increase both the velocity and integrity of your codebase.

In an era where "the cloud" often implies surrendering control to proprietary hyperscalers, OpenStack remains the bastion of infrastructure freedom and data sovereignty. However, the operational complexity of managing a truly free cloud can sometimes be a barrier to entry.

In this talk, we introduce the OpenStack Resource Controller (ORC), a tool designed to lower that barrier without compromising on freedom. By marrying the declarative power of Kubernetes Custom Resource Definitions (CRDs) with OpenStack’s mature, open ecosystem, ORC enables a true GitOps workflow for private cloud infrastructure.

We will demonstrate how ORC simplifies the complexity of self-hosted environments through built-in dependency management and the Kubernetes self-healing reconcile loop. We will also compare ORC against other Infrastructure-as-Code solutions, candidly discussing strengths and trade-offs. Join us to discover how to achieve seamless, robust orchestration that respects your data sovereignty.

There is a massive gap between a flashy prototype and an AI service you can trust. While implementing an agentic service to automate RPM packaging, we learned that while AI handles complex tasks, your code must provide reliability. The real challenge was building a "safety harness" to keep a non-deterministic model from breaking deterministic systems.
This talk shares the practical engineering required to make agents production-ready:
- Sandboxing: Why you should never let an agent run free and how to use isolated environments to ensure AI commands can't damage your system.
- Validation loops: Automated checks that treat every AI suggestion as an untrusted draft that must be verified before execution.
- Observability: Move beyond the "black box" by tracking an agent’s "train of thought" so you can debug AI failures like any other software bug.

If you want to build AI tools as stable, observable, and secure as traditional code, this session provides the blueprint we used to get there.

A recent study by Anthropic researchers shows that developers who rely heavily on generative‑AI assistants experience slower skill formation. This finding aligns with other works, which report more passive engagement and reduced problem‑solving depth when AI is uncriteriously.

The long‑term development of professionals is therefore at risk: diminished troubleshooting ability, weaker mental models of system architecture, and reduced confidence in writing clean, maintainable code. Importantly, the Anthropic analysis also reveals that the impact is not uniform—certain usage patterns mitigate the negative effects, whereas treating the AI as a black‑box code generator amplifies them.

This talk will (1) summarize the empirical evidence, (2) dissect the usage patterns that lead to healthier learning outcomes, and (3) propose concrete guidelines for teams and managers to integrate AI tools responsibly. Attendees will leave with actionable strategies to adopt AI‑assisted development.

Distributed tracing assumes HTTP headers carry context. Kubernetes-native CI/CD has no requests - causality flows through resource manifests and reconciliation loops across controllers, clusters, and time gaps.

This talk introduces Controller-Native Trace Propagation: controllers inject W3C trace context onto Kubernetes resources they create, and downstream runtimes graft execution spans under it. One trace per delivery encodes stage-level causality across the Continuous Delivery lifecycle - build, test, and release - no custom correlation needed.

Using a Tekton-based platform, I show how a Snapshot resource anchors trace continuity: the triggering component's context propagates through integration and release, while timestamp-derived spans decompose each stage into wait vs. execution time.

The pattern generalizes to any controller creating resources with trace parent adoption. Attendees leave with a named, reusable propagation model and practical delivery latency techniques.

Whether you’re managing a single-node cluster for a personal project or hundreds of nodes running production applications at scale, there’s one part of the cluster lifecycle you can’t escape: updates.

Cluster updates can feel like magic, a mysterious ritual that keeps clusters healthy and users confident. In this talk, we’ll peek behind the curtain of OpenShift updates and show how recent engineering work is making this essential process more transparent, reliable, and even a bit more fun.

You’ll hear about new mechanisms, challenges encountered, and lessons learned. This talk offers a glimpse into the ongoing effort to make updates more seamless for everyone, from lifting the hood on cluster updates to ensuring reliability in a world where every cluster is unique.

Open source success is often measured in commits and pull requests, but long-term sustainability depends equally on non-code contributions. Documentation, community support, advocacy, and knowledge sharing are critical yet undervalued components of thriving ecosystems.

This lightning talk highlights how non-code contributions shape large-scale projects like OpenSearch. Through a real journey from user to contributor and community advocate, it demonstrates how individuals can meaningfully participate without writing production code.

The talk includes a practical example of contributing to Apache Lucene, showing how small improvements in documentation and community engagement create real impact.

Attendees will leave with clear, actionable ways to start contributing immediately and understand how diverse contributions strengthen open source communities.

Forecasting demand for thousands of fashion items across 20 brands is hard. Doing it with siloed, inconsistent data is nearly impossible. At Bestseller, we solved this by building a self-service data analytics platform grounded in strong opinions held loosely: clear engineering standards balanced with flexibility.

With a team of just three engineers, we built, rebuilt, and now operate a platform serving more than 1000 users across data engineering, data science and commercial roles.

This talk shares how we applied DevOps principles and software engineering practices to Terraform, Snowflake, dbt and Airflow to create reusable data products at scale. You’ll learn the architectural decisions that worked, the ones that didn’t, and how maintaining firm-but-flexible opinions helped us survive fast growth and changing requirements.

AI tools can generate code faster than ever before, but speed without clarity often leads to rework, confusion, and fragile systems. Ever experienced your AI assisted project getting completely derailed a few iterations in? Exactly that.

In this talk, I propose Spec-Driven Development - an increasingly popular approach in this space - as a lightweight, practical way of building software in AI-assisted teams.

Instead of treating specifications as documentation, we will show how concise, testable specs can act as execution contracts for both humans and AI. We’ll discuss where this approach comes from, walk through several popular frameworks such as Shotgun.CLI, GSD, and Spec-Kit, and demonstrate live what working with an agent equipped with such a framework actually looks like.

"I thought we turned that on?" is a phrase no engineer wants to hear after a security incident. In a growing GitHub organization, branch protection rules—like mandatory PR reviews and signed commits—often suffer from configuration drift.

In this compact, demo-driven session, we’ll move beyond "manual checklists" to an automated governance model using the OpenSSF Gemara project. We’ll demonstrate a "simple-by-design" architecture that uses Gemara to define policy, ComplyTime to manage the lifecycle, and Ampel to provide "Traffic Light" verification via signed attestations.

The secret sauce? GitHub Reusable Workflows. I will showcase a live "Red-to-Green" transition, showing how any team can adopt these hardened controls instantly. Attendees will leave with a practical 25-minute blueprint for turning branch protection into a continuously monitored, verifiable asset of their software supply chain.

In theory, it sounds perfect: seniors provide expertise and precision, while juniors bring energy, fresh perspectives and innovation. In practice, however, teams often struggle with diverging approaches and opinions at every decision point. Communication bottlenecks and possibly conflicts arise, and "team spirit" becomes nothing more than a hollow phrase.

Managing a wide range of experience levels is a common challenge in engineering teams. If left unaddressed, it leads to inefficiency, difficulties in relationships between members, and, ultimately, may cause attrition.

In this presentation, we will examine the root causes of experience-based conflicts and explore strategies and tools to mitigate them. I will also share my personal insights and observations. This session will equip you with the knowledge to improve collaboration, spot emerging issues early and strengthen your team.

Inspired by talks at 2025's DevConf.cz, I returned home and promptly bought a second hand workstation, and then a GPU on Prime Day. The plan was not to spend a lot of money. It was not to buy the latest and greatest hardware. It was to see could be achieved on hardware that is abundant and affordable. Results have been, mixed, and at times I've asked myself if I was doing it wrong, if the hype about certain technologies (such as OpenClaw) were deserved, and whether the whole endeavour was misguided. Whilst everyone else is raving about M4 (now M5) Mac's, Framework Desktop, Dell GB10's and more, I wanted to see what I could do with US$500 and tech that there's no waiting list for. This presentation distils for everyone what I've learned, the pain points, the successes, and ultimately whether I'd do it all over again. (Spoiler - I would!)

Do you want to try how assistive technologies work?
Do you want to learn how to test accessibility of an application?

Depending on the interest of workshop participants, we will give practical demonstrations of selected topics from the following list of GNOME desktop accessibility features:

• Orca - basic operations, flat review, learn mode,
• accerciser - inspect applications from the screen reader's point of view,
• brltty-xw - virtual Braille display,
• (screen) magnification,
• appearance - contrast, dark mode, text size, cursor size, ...
• suppress moving and flashing content,
• on-screen keyboard,
• visual alerts,
• typing assist - repeat keys, slow keys, sticky keys, bounce keys
• mouse assist - mouse keys, locate pointer, secondary click, hover click

As impaired users (and developers), we would like to show you what is important for us in GUI and how applications should work not to make our lives (even) more complicated.

If you work with source code, you probably care about its integrity. Signing an artifact like a file enables others to not only verify that it wasn't corrupted, but also figure out who authorized it. When used correctly, this information can protect against a range of supply-chain attacks.

In this workshop, you'll learn how to verify and sign artifacts, and manage certificates. (We won't cover encryption.) We'll use Sequoia, which is the OpenPGP implementation used by Fedora, RHEL, Debian and Ubuntu to authenticate packages.

We'll start by learning how to verify a file and discuss what it means to verify a signature. The focus will be not just on the steps, but understanding what they accomplish. We'll then move on to signing your own software. We'll generate a key, talk about how to protect it and how to get it to your users so they can verify your software. Finally, we'll configure git to sign commits and experiment with sq-git, a tool that helps manage a project's signing policy.

This talk explores Forklift, an open-source project designed to simplify the migration of virtual machines from traditional platforms (VMware, HyperV, OVA, oVirt, OpenStack) to Kubernetes via KubeVirt. We will hilight how collaborations with storage vendors have improved migration speeds by minimizing the need to copy VM data.

We will hilight how Forklift bypasses traditional network-heavy transfers using copy offload:
- Intra-array copying: Transfering the data within the storage array itself rather than over the network.
- Zero-copy integration: Utilizing NetApp Shift, eliminating the need to copy data altogether.

Join us to learn how these storage-level innovations are making cloud-native transitions faster and more efficient than ever (https://github.com/kubev2v/forklift).

https://docs.google.com/presentation/d/1zgy3jv_ErqVsJ78wDESzz63eKtdfHl1n4RPgKycfZzE/edit?usp=sharing

Image Mode for RHEL redefines how Red Hat Enterprise Linux is built, packaged, and delivered by adopting proven cloud-native technologies.
This session shows how to apply CI/CD practices to Image Mode for RHEL, with practical and actionable examples using tools like Tekton, GitHub Actions, GitLab CI, Jenkins, and Ansible Automation Platform, enabling reliable, scalable RHEL builds and deployments.

Software engineering is undergoing its most radical shift since the move to Cloud. As AI assistants evolve from writing simple snippets to suggesting entire system architectures, the line between human-authored and machine-generated code is blurring. However, this newfound speed introduces a new breed of technical debt and ethical risk. How do we evolve our day-to-day practices without losing our grip on security, maintainability, and accountability?
This session will explore the transition from Human-Driven to AI-Driven Engineering. We will ask the hard questions and discuss practical strategies for: how to manage "synthetic debt," redefine peer reviews for AI-generated code, and ensure that 10x velocity doesn't bypass safety.
We will explore a series of community-driven practices designed to maintain quality while navigating the move from "experimental" to "operational" AI.

This talk presents a system enhancing upper limb rehabilitation using unsupervised ML (PCA, K-Means, SOM). Analyzing data from AR/VR games, we classify movement patterns to track patient recovery. We will demonstrate the architecture and a clinical dashboard that visualizes biomechanical metrics. Learn how data-driven insights empower professionals to objectively monitor progress and optimize treatment protocols beyond traditional methods.

Your application feels instant on localhost but slows down in production. This common gap between development and real environments is a major, often misunderstood source of performance issues. This talk explains why “fast locally” becomes “slow in production,” showcasing post-deployment factors like caching behaviour, HTTP headers, CDN interactions, runtime differences, and missing observability.

Attendees will walk away with clear insights into:
• How caching layers, headers, and CDNs are misunderstood and misconfigured
• Key differences between local environments and production runtimes
• Why latency issues stay invisible without observability
• How small configuration choices create outsized performance impact
• Thinking production-first from day one

Using concrete examples from real systems, the talk will demonstrate how to think about end-to-end latency, validate assumptions with data, and design applications that behave predictably at scale and under production traffic.

Podman 6.0, arriving in Spring 2026, marks a major milestone in modernizing the container ecosystem. This session explores the transition from legacy backends to a high-performance architecture, finalizing the removal of CNI plugins, Slirp4netns, and BoltDB in favor of Netavark, Pasta, and SQLite3. We will dive into the new client/server configuration logic designed to resolve long-standing UX friction on Windows and macOS.

A key highlight is the reimagined Podman Machine. We’ll discuss the shift toward a "provider-agnostic" CLI that resolves machine names regardless of the hypervisor , and the strategic adoption of libkrun as the default provider to enable GPU-accelerated AI and LLM workloads. Attendees will also learn about networking upgrades in Netavark, including the move to Nftables and improved network ordering. Join us to see how Podman 6.0 delivers a faster, more secure, and AI-ready environment.

In the community of self-hosters, email infrastructure has a reputation of being a nightmare due to the maintenance of the infrastructure and the complexity involved. We will see in this talk how one can combine modern tooling like bootc and Fedora Image Mode with the mail server Stalwart and others simpler server to get a very low maintenance email stack running on the cheapest possible VM, while following current best practices.

The presentation will explain the pitfalls of building a custom image, how to automate the upgrades with dependabot and how to get the smallest possible image to run on a normal openstack cloud provider without specific support for bootc image.

We're excited to announce that there will be a social event held during the conference. We invite all speakers, volunteers, and attendees to join us on Thursday evening. You will need your conference badge to enter.

Where:
Koupaliště Dobrák
Dobrovského 96/29
612 00 Brno

What to expect:
- Food and Drink: A light dinner will be served, including a welcome drink, with additional beverages available for purchase.

The social event is held outdoors near the swimming pool. Please note, we do not plan to use the swimming pool for a variety of reasons. We chose the place because it is located conveniently and there is a beautiful outdoor deck that can create the right atmosphere for us.

Booths are located on the street level in D and E buildings.

D building booths:
D01: Red Hat
D02: Canonical
D03: openSUSE
D04: Microsoft
D05: Fedora
D06: Pulp
D07: Foreman
D08: Podman
D09: OpenSSL
D10: KubeVirt

E building booths:
E01 + E02: Videogame history
E03 + E04: 3D printing & open HW
E05 + E06: Base 48
E07: Grafana
E08: FreeIPA
E09: FSFE
E10: Tolgee
E11: Hands-on cyber security
E12: INDUSTRA

The European Commission plans to strengthen European technological sovereignty and considers the Open Source a key ecosystem for its development. Will the Czech Open Source benefit from this ecosystem?

No one knows at the moment!

The Commission will set out "strategies for open digital ecosystems". Will it meet the expectations of Czech open source ecosystem? How can Czech companies adapt to this strategy or other political or situation changes?

Now is the time for an alliance for an Open Source businesses to make sure Czech don't miss this train. the goal of such alliance could be:

• Advocating for supportive policies and sharing best practices.
• Strengthen businesses through training, awareness of tenders and better visibility.
• Engage with decision-makers to promote openness, accessibility, and interoperability in public services.
• Propagate knowledge through events, communications, and community support to highlight the value of Open Source.

LLM agents look impressive in demos, but problems arise when they hit production. They hallucinate, break your JSON schema, ignore system prompts, and occasionally decide they know better than your business logic.

In this talk, we’ll move beyond agentic “Hello World” and explore what it really takes to build reliable LLM agents in Java with Quarkus.

We'll examine the different options for building agentic systems, with a focus on architecture. You'll see how to secure both agent inputs and outputs with guardrails, how to make agent interactions observable, and — last but not least — the testing strategies to verify your agents’ functionality. Step by step, we'll build a production-ready LLM agent so that you can understand the different problems and their solutions.

We can't make LLM agents fully reliable. But with the tools presented in this talk, we can at least make them predictable.

Container images get signed and verified. AI models almost never do. A poisoned checkpoint can run arbitrary code at deserialization, yet Kubernetes clusters treat model weights as trusted blobs. The tooling to change this reached v1.0 in 2025.

This talk walks through a practical enforcement pipeline for model trust on Kubernetes using three open source tools: Sigstore model signing (OMS v1.0) to sign model artifacts, the Sigstore Model Validation Operator for admission time verification, and Kyverno policies to block workloads referencing unsigned models. We trace the lifecycle: signing in CI, recording in Rekor, and blocking a tampered checkpoint at deploy time.

We also cover what still breaks: verification with quantized and adapter merged models, hashing instability across formats, and where AIBOM metadata fits into the attestation chain. A live demo signs, deploys, and blocks an unsigned model on a running cluster.

Modern systems produce more metrics than any single person can reason about. As systems grow and change, defining fixed thresholds becomes harder and unexpected behavior often appears without clearly crossing an alert boundary.
This talk looks at anomaly detection as a complementary way of working with metrics. Instead of relying on predefined limits, anomaly detection focuses on identifying behavior that deviates from what is normally observed over time.
Using a live walkthrough with real metric data, we show how anomalies can surface gradual changes, unusual patterns, and subtle shifts that are easy to miss in dashboards. The focus is on how developers can interpret these signals, where anomaly detection is useful and where it is not.
This session is exploratory and practical, aimed at developers who work with metrics and want additional ways to understand system behavior without introducing complex models or heavy tooling.

In this workshop, we demonstrate how engineers can write protocol specifications as code to systematically produce test scenarios for their systems. We focus on distributed systems that may fail in unexpected ways. We engage the audience in thinking about complex behaviors of distributed systems as runs of an executable specification, extending code with explicit non-determinism. This approach lets us distill complex system interactions while testing them against the actual deployment.

Our approach draws on years of experience building simulation tools and model checkers in both academia and industry. In the workshop, we:
- Write an executable specification and discuss modeling and abstraction patterns.
- Write executable tests (replacing whiteboard sequence diagrams).
- Generate tests via random and symbolic execution.
- Use the specification to drive adversarial tests of an implementation.
- Establish safety and liveness properties via model checking.

Level: Beginner+ (and curious experts)
Goal: Get your first (or your nth) patch merged into the GNU C Library!

After two years of incredible growth, jumping from six patches in 2024 to over fifteen submitted in 2025, the glibc development workshop is back for its third year. Whether you are new to C or a seasoned systems engineer, you can help us make the GNU C Library better, one patch at a time.

As in previous years, we will work on picking low-hanging fruit, producing small, incremental improvements, and getting some new names (yours?) on the glibc commit log. We will fix typos, improve documentation, improve existing tests, add new ones, and even squash a bug or three.

The workshop starts with a quick introduction to glibc and its codebase. Then, each willing participant will receive an individual cheat-sheet featuring one small, well-defined problem and pointers on how to solve it. Experienced glibc contributors will be around to help you across the finish line.

In Red Hat OpenShift, the default pod network is a flat, shared space across tenants. While this works for many scenarios, organizations with stringent security and compliance requirements need stronger network isolation — right at the pod network level. User Defined Networks (UDN) provide that capability, enabling fine-grained segmentation and paving the way for truly secure multi-tenancy.
In this session, you will:
Understand the "Why", "what" and "How" factors of User Defined Networks.
Explore best practices and benefits of using UDN in OpenShift Virtualization networking use cases.
Dive deep into BGP protocol support into the core of OpenShift Networking including UDN.
The session will also feature a live demo showcasing UDN in action for virtual machine networking use cases.

This talk presents a practical, step by step walk-through of building a trusted container image using Red Hat’s cloud-native tool-chain. Starting with a local Podman build, we follow the same application through a Konflux pipeline running on OpenShift, producing a signed, immutable container image pushed to a registry. The focus is on how modern CI pipelines work in practice: image builds, provenance, and policy-ready artifacts—without introducing custom YAML or ad-hoc scripting.

Main tech stack:
- Podman (local development);
- Fedora Linux (base image);
- Konflux (Tekton pipelines);
- OpenShift (or 'crc');
- buildah (image build);
- Quay as container registry.

This Lightning talk will expand on my personal path through the OpenSource community, tracking the path from Consumer/User, now all the way to being a Maintainer.

Along the way I will mention the ups-and-downs of each stop along the path, how I made the step to move to the next stop along the way, and finally some tips/tricks for those anywhere on the path - perhaps needing some motivation to move to the next step

This talk explores the evolution of Arduino boards from the pioneering Arduino Yún (released in 2013, you will see one) to the newly introduced Arduino UNO Q, which combines a full Debian Linux environment with a real-time STM32 microcontroller. Attendees will learn how to leverage this hybrid architecture to build Python applications that seamlessly interact with hardware in real time, opening new possibilities for IoT, automation, and edge AI.

Traditionally, managing a fleet of machines meant being at the mercy of whatever your package provider published. Foreman and Katello changed that by giving you a way to curate, filter, and control exactly what and when hits your servers. Now, image-mode takes that one step further: instead of managing a shifting list of packages on a live system, you’re building, versioning, and deploying the entire OS as a single, immutable unit with your application baked in.

In this session, I’ll break down the practical differences between traditional package-mode and this new image-mode approach. We’ll look at how Foreman and Katello let you leverage the best of both worlds from image building to management of running systems.

As AI models become central to our development stacks and platforms, the community faces a critical question: what actually makes AI "Open Source" ? This session dives into the heart of the Open Source AI debate, giving developers, maintainers, and contributors the tools to cut through the hype, defend open-source principles, and build transparent AI ecosystems.

Following a quick baseline on AI/ML mechanics, attendees will learn how to:
- Navigate the Paradigm Shift: Understand why defining Open Source AI is fundamentally different (and harder) than traditional Open Source Software.
- Stress-Test Openness: Apply community frameworks like the Open Source AI Definition (OSAID) and Foundation Model Transparency Index to evaluate the models you use and build.
- Spot the Fakes: Break down the technical realities of "open weights" and learn how to call out deceptive "openwashing" in the ecosystem.

Securing a large language model today resembles an endless game of cat and mouse. Programmers try to manually write filters and prohibitions, but all it takes is one creatively written prompt and the model obediently generates dangerous content. Traditional defenses are inflexible, slow, and attackers are always one step ahead.
This talk shows how to break out of this vicious circle. We introduce our open-source framework, which is used for systematic red teaming and testing models against 25 types of prompt-based attacks. We show how to analyze AI behavior under fire. On this basis, we then introduce a new defense method based on genetic programming. Instead of manually patching holes, this "digital evolution" automatically searches for optimal rules that strengthen the model and create a defensive layer. All this without having to change a single parameter in the model's weights. You will find out why evolutionary search for system rules is more effective than an army of experts.

By 2026, the regulatory landscape for tech industry has fundamentally shifted, with unprecedented implications to open source. From the EU Cyber Resilience Act (CRA) to "Digital Sovereignty" - these terms rightfully sound like the antithesis of the open values. But the story of the last 2-3 years isn't one of defeat. It’s a story of how the open source community "debugged" the law.

In this talk we reveal how engineers entered the negotiation rooms to fix critical bugs in the legislation and standards. We will look at the technical reality behind the CRA Open Source victory, translating "Secure by Design" for open source directly into European Standards. We will also reframe Digital Sovereignty into the real engineering values of innovating resilience, quality and security that comes from transparency and freedom that only open source can offer.

Join us to see how we turn regulation from a blocker into a feature, ensuring the "Open Source Way" remains the standard for innovation.

Ever felt like finding a network issue in Kubernetes is like looking for a needle in a burning haystack? As microservices scale dynamically across nodes, traditional tools like tcpdump simply don't cut it anymore. Enter the OpenShift Network Observability Operator.

Powered by the magic of eBPF (Extended Berkeley Packet Filter), it provides deep, low-overhead, real-time visibility into your cluster's network traffic—without touching a single line of application code. In this talk, we’ll dive into how the operator translates raw kernel data into actionable insights. We’ll explore the architecture, explain why eBPF is the ultimate superpower for K8s networking, and share real-world customer success stories.

The session culminates in a live, high-stakes troubleshooting demo: we will purposefully break a microservice architecture and use the operator to diagnose complex communication failures and dropped packets in real-time. Walk away ready to master your cluster's network.

There is the problem in many companies, that women are not the same recognized as men and also their ideas are ignored and accepted only with the support of male Allys. That is also called the Authority Gap. In this talk, you are receiving an introduction, how women can use speaking methods based on Cicero for becoming more successful in arguing their ideas and why it has got such a good effect.
(applicable also outside in front of customers as an example)

Generative AI might be the future, but it still runs on Python, glibc, OpenSSL, and the Linux kernel. What happens when a critical CVE drops in these foundational components? If you blindly update, you risk breaking brittle ML dependencies. If you do nothing, your AI infrastructure becomes a massive attack vector.

In this session, we will explore incident response from the perspective of an Enterprise Linux distro engineer. We will demystify how CVE severity is analyzed specifically for AI workloads and unpack the delicate engineering decisions behind backporting security fixes without triggering regressions in complex AI runtimes.

Through a hands-on live demo, we will recreate a historical CVE in a core cryptographic library, demonstrate its impact on a running AI inference service, and apply a seamless system patch to validate service continuity. You will leave with a practical playbook for navigating security crises without sacrificing the stability of your production AI.

In the world of container orchestration, most of us just want our containers to start on boot, stay running, and be easy to update. All this can be achieved with Podman Quadlets. Since Podman version 5, Quadlets redefined declarative deployment, and containers have become simpler to manage via Systemd unit files.

Quadlets are capable of defining containers, pods or entire applications in a single file, and now all this can be handled through the API or Python.

Starting from the basic concepts, this workshop will guide the audience to write a full Quadlet deployment. Knowledge and insights will be provided about how to use Podman and Quadlets through CLI, remotely via the API, or with Python.

In short, the workshop aims to provide a comprehensive overview and to give the audience specialized tools that are needed to interoperate with Quadlets.

Prerequisites: Familiarity Podman and Systemd knowledge. A system with access to Podman and Systemd is necessary. Beginner/Intermediate.

AI output often has a distinctive and often disliked style. But does it have to?

Kimi K2 Instruct, an extremely large language model (1T parameter MoE), has developed a "vibe" uniquely attractive to technical users. with low sycophancy and enjoyable to read. It is not fully preserved in later Kimi models.

Can we transplant this "vibe", or at least style, to a smaller model? Can we use such a transplant to improve the style of technical text?

I chose the smaller IBM Granite 4 hybrid models as my distillation targets; the Mamba-hybrid architecture seems to take style transplantation well. The results so far are very imperfect, but interesting.

In this interactive meetup, we'll run an un-conference style discussion on the topic of LLMs/GenAI and FOSS. Bring your opinions and thoughts. If you're completely against LLMs, we want to hear from you! If you haven't written any code by hand for the last 6 months and want talk about your tools and techniques, we want to hear from you too!

The goal of this meetup is especially to focus in on those who need/want to LLMs safely and responsibly for "important" software. What are the shared best practices, tools and procedures? What can we do to use these tools to address prior problems around things like supply chain security?

The submitter of this workshop has a lot of of experience and opinions, but is looking to have a realistic in-person discussion where different tools and experiences are presented and attendees can learn from each other.

Proposed topics:

• Scale of change
• Contribution policies
• Sandboxing & Security
• Effectiveness (Ralph loops, Planning vs exec models, skills, ...)
• Orchestrators and workflow (Gastown, Fullsend, Paperclip)
• Discussion of the future

Achieving high VM density in Kubernetes demands advanced memory management. This talk details our journey building the VM higher density solution for OpenShift Virtualization (KubeVirt).

With Kubernetes swap previously in Beta, we needed an immediate way to enable worker node swap. Enter wasp-agent: our custom project to mimic K8s swap externally. We will explore the technical hurdles of this approach, detailing our experiments with Linux cgroups, runtime hooks, and evictions.

As we trace the solution’s evolution from Dev Preview to GA, attendees will learn about memory overcommit mechanisms (FPR, KSM). Crucially, we'll detail our transition plan: deprecating wasp-agent to adopt the newly GA'ed native Kubernetes swap, highlighting the platform tunings required for maintainability and consistency.

Finally, we'll evaluate deployment strategies, comparing Operator-driven automation against manual methods, and the trade-offs of enabling swap at install-time vs on a running cluster.

Giving your first conference talk is terrifying. You worry about forgetting what to say, embarrassing yourself in front of experienced engineers, or freezing in front of a room full of strangers.

I know that feeling well — because my first talk didn’t go well. I rushed the preparation, overcomplicated the slides, panicked halfway through the talk (around minute two), and forgot half of what I wanted to say. At one point I spent almost a full minute staring at a slide saying “ehmmm… ehmmm…” while 80 engineers watched. To make things even better, the talk was supposed to be given by two speakers — but the day before the conference my co-speaker told me he couldn’t make it.

It felt like a failure. But it taught me something important: your first talk doesn’t need to be perfect — it just needs to happen.

In this talk I’ll share that story and the lessons I learned so others can prepare their first talk, survive the stage, and maybe even enjoy it.

Modern large-scale performance testing often runs up against a fundamental limitation: traditional virtual machines simply don’t scale economically or practically when simulating thousands of systems. Provisioning and managing 4,000–5,000 VMs quickly becomes cost-prohibitive and operationally unmanageable, making it difficult to accurately emulate real-world distributed workloads.

In this talk, I present a container-based approach for high-density system simulation that replaces VM-centric test environments with lightweight containers orchestrated on a small number of powerful hosts. Using Podman to run large numbers of containers on a single machine, we demonstrate how to spin up thousands of isolated test environments rapidly with significantly lower overhead than VMs.

I will walk through the challenges faced in this approach - like resource exhaustion , kernel limits and how to overcome those.We would wrap up by discussing how to run tests and collect metrics under high load.

As the Software-Defined Vehicle (SDV) evolves, the kernel must juggle a complex mix of safety-critical functions and general-purpose applications. But how do we prove that a bug in a non-critical 'Quality Managed' (QM) container won't disrupt the deterministic performance required for an ASIL-B context? This is the challenge of Freedom From Interference (FFI).

In this session, we dive into a specialized test suite designed for the Red Hat In-Vehicle Operating System. We’ll demonstrate a 'worst-case scenario' architecture where we execute a syscall fuzzer (Syzkaller) inside the QM environment to intentionally try to break the system from the inside out while simultaneously validating functional integrity and scheduler latency.

Bonnie is the host and, alongside Øjvind the editor of the FSFE's Software Freedom Podcast, a podcast dedicated to Free Software. In this workshop Bonnie will share her knowledge and skills on how to produce podcasts using Free Software, sharing different tools and techniques with you to create your own podcast projects.

This is the perfect workshop for everybody who wants to share their ideas and thoughts with others through podcasts. Learn the basics of recording, editing, and publishing podcasts with Free Software tools, and discover how to create quality content without relying on proprietary software. Everybody is welcome to join us from beginners and those looking to switch to Free Software!

To be best prepared for attending the workshop, as we will be doing some live editing together, please install the software 'Audacity'
(https://www.audacityteam.org/) on your laptop before the workshop.

Linux distributions, container images, mobile devices come with about 150 root certificates from OpenSSL and Mozilla. Do we really know who is issuing these certificates? Why do we trust random government bodies from the EU, US and China? Why does some post office have the same trust that some telecom operator has? In practice, any one of them can issue a certificate for any domain on the internet.

This talk argues that the default CA trust model is over-permissive and poorly understood. We need to look at what is actually inside common CA bundles.

Solution: Review your ca-bundles drop anything strange. If you develop an important application that must be 100% trustable, pin the certificate.

I would like to talk about my personal project that is a compiler from WebAssembly to lambda calculus. I started it for fun, and have learned quite a lot about WebAssembly along the way. I will discuss how I implemented key data structures and algorithms that are needed to run WebAssembly in lambda calculus. Those include numbers, random-access memory, mutual function recursion, and control flow instructions, all with reasonable space/time complexity considerations.

The compiler supports almost the entire WebAssembly 1.0 standard (except floats) and can easily compile Rust/C/C++ programs, which can then be interpreted.

I also plan to briefly mention other projects related to esoteric programming, like the C to BrainF*ck compiler or the EsoLangVM Compiler Infrastructure.

Source code: https://github.com/MarkLagodych/walc

We often treat management frameworks like rigid code-bases—expecting the same input to yield the same output from every engineer. But when I began parenting my 11-year-old nephew with Autism and ADHD, I learned quickly that standard "commands" resulted in runtime errors, timeouts, and unexpected crashes.

Surprisingly, the strategies I developed to support his executive function and sensory needs mapped directly to my initial struggles in engineering management. In this talk, we will explore the parallels between supporting a neuro-divergent teenager/child and leading a high-performing development and quality team. We will cover why "implied" context causes friction, how to manage context-switching costs, and why the "Why" matters more than the "What." You will leave with tips for creating a documentation-first, clear-communication culture that benefits your junior developers, your senior architects, and everyone in between.

Automotive, industrial, and remote systems often operate in environments where connectivity is intermittent and centralized control cannot be assumed.

Most automation assumes the network works and the controller can keep pushing state. In unreliable networks, systems must instead respond to local events, make deterministic decisions, and transition between explicit runtime states.

This talk presents an event-driven architecture for infrastructure automation based on state machines and local decision-making. We’ll examine practical design patterns for building predictable, self-healing systems under network instability, and see some demos!

Ever struggled to reproduce a CI failure on your laptop? Two recent enhancements to tmt (Test Management Tool) and Testing Farm bring us closer to identical testing environments:

Testing Environment Profiles consistently set up testing environments. Whether running locally or in CI, you get identical system setup. All custom adjustments and workarounds are in a standard place, properly documented, easy to use and contribute. No more manual tweaking repositories or buildroot, just apply the profile.

Artifact Install plugin brings consistency to package installation. Instead of installing entire Koji builds, only explicitly requested packages are installed, enabling testing of conflicting subpackages. The same approach is used locally and in CI, no more custom dark magic behind the scenes.

These two features are major steps forward to the new pipeline which fully supports multihost testing and, most importantly, brings another level of consistency between CI and user environments.

Red Hat Developer Hub (RHDH) Local is a powerful tool for testing and developing with RHDH, but initial setup requires deep knowledge of catalogs, plugins, and configurations, often taking hours. This session demonstrates how we transformed RHDH Local into an intelligent AI agent that automatically configures developer platforms using industry-standard technologies.

We'll explore a multi-LLM architecture (OpenAI, Anthropic Claude, Ollama) integrated with LangChain and LangGraph for agent orchestration. The system uses RAG (Retrieval Augmented Generation) with vector databases to provide context-aware recommendations. The agent autonomously analyzes Git repositories, detects tech stacks, generates catalog entities, recommends plugins, and configures RHDH Local, reducing setup time from hours to minutes.

The presentation covers the architecture, demonstrates live auto-configuration, and shows how the agent learns from patterns to improve recommendations.

As HPC and AI/ML workloads move to cloud-native environments, demand for low-latency networking in virtualized setups is critical. KubeVirt runs VMs alongside containers, but achieving bare-metal InfiniBand performance—the backbone of true HPC—has remained challenging.
This session explores InfiniBand integration into KubeVirt using the SR-IOV Network Operator. We'll cover architecture and how the operator automates managing InfiniBand VFs across Kubernetes clusters. IB introduces unique complexities: GUID management, IPoIB vs. RDMA modes, and passing these capabilities into VMs.
Join the SR-IOV Operator and KubeVirt networking maintainers for a technical deep-dive. Our demo will showcase VM-Pod communication over IB VFs on a single node, and scale-out performance between VMs across nodes.
You'll learn about KubeVirt's design philosophy,architectural decisions treating InfiniBand as first-class in the SR-IOV Operator, and how to deploy InfiniBand networking for VMs in your clusters.

Managing Software Bill of Materials (SBOMs) has evolved from a recommendation to a legal mandate. For large-scale projects, the challenge lies in ensuring accuracy without hindering build velocity.

In this talk, we examine how we integrated an automated SBOM lifecycle into Konflux, a Kubernetes-native software factory. We introduce Mobster, our tool for automatically generating, enriching, and storing SBOMs for every production build. We’ll demonstrate how this ensures every container image carries a transparent, verifiable record of its dependencies.

Beyond the build, we explore how SBOMs serve as strategic assets. By integrating with the Trusted Profile Analyzer, we move from per-build compliance to portfolio-wide visibility. We’ll discuss the framework for mapping vulnerabilities across thousands of components, enabling security teams to pinpoint high-risk dependencies and orchestrate rapid, large-scale remediation across the entire software catalog.

Looking for new ways to grow your tech community without the overhead of a traditional conference? Try Python Pizza, a micro-conference format designed for simplicity and inclusion. This lightning talk introduces the core benefits of this lightweight model and covers the practical requirements. You will learn what you actually need to organize and host your own edition, as well as where to find support if you decide to bring Python Pizza to your city.

Modern (game) software development often feels like a battle against complexity, bloated dependencies, massive clusters, and endless build pipelines. Solution? Develop for a machine that doesn't exist!

Enter Fantasy Game Consoles. Projects like TIC-80, PICO-8, and WASM-4 provide a deliberate return to "low-level" constraints: fixed resolutions, limited palettes, and tiny memory footprints. In this lightning talk, we will explore why these virtual machines are more than just retro-nostalgia. And we will start at its roots in the 90s with NINTENDO GameBoy and it's hardware capabilities.

Come to my session to sharpen your coding skills, find a "digital sandbox" to escape burnout, or just listen to fascinating stories about the fantasy game consoles community.

Ever shipped a "simple fix" at 4 PM on Friday that took down production? Felt like a genius after making Kubernetes work, only to realise six months later you understood nothing? Welcome to the beautiful, chaotic feedback loop of technology work. This talk explores how our brains betray us in the most predictable ways. You'll discover why dopamine hits from solving problems make us addicted to complexity, how the Dunning-Kruger effect means we're most confident when we know the least, and why the tech industry's rapid change keeps us perpetually cycling through peaks of "I've got this!" and valleys of "I know nothing."

Do you love coffee? Do you enjoy trying new beans or experimenting with different brewing methods? If yes, we would be happy to meet new friends during DevConf.cz that have the same hobby as we have!

Let’s meet, brew some coffee together and exchange our tips and tricks about coffee.

We'll bring some of the beans we love and make a lot of coffee using various methods (V60, Aeropress, Moka, French Press etc.). If you have your favorite coffee beans or method you want to show your coffee friends during DevConf.cz, we encourage you to bring it to this meetup as well!

Instrumentation is the secret ingredient that brings observability to life, revealing the intricate workings of applications in ways logs and metrics alone can’t match. In this talk, we’ll dive deep into the magic of OpenTelemetry instrumentation, exploring how to uncover hidden insights within your applications and services.
Despite the hype, automatic instrumentation is very nice to get started, but manual instrumentation is the one that helps us to really observe our system. Join us as we break down the essentials of OpenTelemetry instrumentation, by crafting custom metrics, spans and logs to track the most critical parts of workflows. You’ll see how simple, well-placed instrumentation points can reveal complex system behaviors, helping you detect bottlenecks, trace errors, and understand end-to-end request flows.
Whether you’re new to observability or looking to master OpenTelemetry, this session will show you how to harness the full potential of manual instrumentation.

Whether it's pods, nodes, or something entirely new, let's gather to talk about the state of the art with autoscaling in Kubernetes. This meetup is focused on discussing autoscaling technology and projects within the Kubernetes community. Kubernetes autoscaling isn’t just about handling traffic spikes. Efficient autoscaling means your infrastructure matches actual demand, scaling to zero when possible and provisioning exactly what you need when load increases. We will gather topics on the day of the meetup and then have discussions based on the desires of the group. Topics for discussion might include:

• Is Karpenter better than the Cluster Autoscaler?
• How to choose the right metric to scale? Is there a right metric?
• How can KEDA be tuned for LLM workloads?
• Will we see a predictive AI-based autoscaler in the near future?
• What are the day-2 operations for autoscaling?
• What are the do’s and don’ts we should think about?

One-on-one meetings can be one of the most powerful tools for building strong teams, but in many companies, they either don’t exist or become boring status updates. This is a missed opportunity.

In this talk, I will share simple and practical ways to make one-on-ones meaningful and useful for both managers and team members. We will look at how to build trust, support personal growth, and talk about real problems instead of just tasks. I will also show how to create the right structure, ask better questions, listen with empathy, and follow through on commitments.

The talk is based on my experience working with engineering and open source teams. You will leave with concrete tips, examples, and questions you can start using right away to make your conversations more honest, productive, and human.

Whether you are a manager, a team member, or someone interested in leadership, this talk will help you turn one-on-ones into real value for your team and your work.

Have you ever heard about passkeys or WebAuthn?
Yes? Great than this workshop is for deepening your knowledge!
Or
No? Great than this workshop is for building up your knowledge!

We will be building a simple application (Web or mobile, you choose) that signs up and logs a user into a web service using Passkeys (either physical or virtual).

BUT that's not all: After the user flow is established, we'll also highlight some special extensions, useful for extended use of your Passkeys. Think about encrypting data with one of them.

Let's deep dive into the magic of cryptography with passkeys and each other.

Quarkus is one of the most dynamic and fast-evolving projects in the Java ecosystem today. Even six years after its initial release, it continues to push boundaries—and it already surpassed 1,000 contributors!

In this session, we’ll introduce Quarkus in Action, the latest (and coincidentally, the first) book authored by the speaker. While we can’t cover the entire book in one talk, we’ll highlight our favorite features—the ones that truly showcase Quarkus' strengths. Expect live demos of productivity powerhouses like Dev Mode, continuous testing, Dev UI, and Dev Services. We’ll have something for you whether you’re focused on a blazing-fast local development experience, seamless deployment workflows, or even the metrics influencing your cloud bills.

This talk isn’t about explaining every Quarkus feature in detail—it’s about showing you why you should give it a try. And if we succeed in inspiring you, Quarkus in Action will be the perfect next step on your learning journey!

I will be bringing 10 copies of my book Quarkus in Action to give away and sign for free at the end of the session.

With the rapid rise of AI, organisations are eager to adopt AI models into their workflows, yet model deployment remains complex, resource-intensive, and prone to security risks, making it difficult to experiment and iterate with. Enter Ramalama, an open-source tool that simplifies inferencing of AI models with the familiar approach of containers, while keeping everything local.

In this workshop, you’ll get an in-depth introduction to Ramalama, its flexibility with container engines, model registries and inference runtimes, how it abstracts underlying complexities, can help streamline your workflow, making AI model deployment a straightforward process.

Attendee Takeaways:
Understanding of Ramalama's role in integrating AI models with container technology.
Insights into the security and performance benefits of running AI models in isolated containers.
Practical knowledge on deploying and scaling AI workloads using Ramalama.

Proliferation of multiple agentic AI systems has created a need for a common protocol, enabling agents to share information, delegate tasks and generally coordinate their behavior.

The Agent2Agent (A2A) protocol is an emerging industry answer to this issue. The protocol, now under the stewardship of Linux Foundation, is being developed in open source tradition, with implementations in multiple major programming languages.

In this talk, we will examine:
* The Protocol Architecture: How are agent communications conducted
* Implementation patterns: Adding A2A capabilities to our agents
* Governance: How is the future direction of the protocol development decided
* Protocol extensions: How can we create new capabilities for A2A

systemd-sysext is a standard mechanism for overlaying /usr on any systemd-based OS. The spec and tooling exists, but what happens when you push it past "hello world" into production software - GPU drivers, Kubernetes, container runtimes?

Flatcar Container Linux has been shipping all of these as sysext images since 2022. Docker and containerd don't exist as binaries in the base OS - they're sysext images. Kubernetes can upgrade independently of the OS via sysext + sysupdate.

This talk covers what broke, what we fixed, and what we contributed upstream to systemd. You'll see the two hardest engineering problems - dynamic linking collisions and library path isolation - and the open source tools (Flix and Flatwrap) that solve them. We'll discuss when sysext is the right tool and when rpm-ostree is better.

Whether you work on FCOS, Flatcar, or any other systemd-based distro, sysext is already in your systemd. This talk tells you what to expect when you use it for real.

Bringing GitOps and Infrastructure as Code to virtual network functions with open source tools. We combine Kubernetes operators and KubeVirt to manage virtual routers like containers.

We explore an operator that transforms router configuration into Kubernetes CRDs, enabling GitOps and Infrastructure as Code for network infrastructure. Configuration is managed through kubectl or GitOps workflows. Changes trigger reconciliation that syncs to the router VM through controllers, eliminating management networks and SSH. All changes are tracked and can be rolled back easily.

The session covers watching CRD changes, translating to router commands, and pushing updates without out-of-band management. We discuss state drift, reconciliation loops, and sync patterns. You'll see how treating Router VMs as Kubernetes resources simplifies operations and uses the same tools as your applications.

Modern Linux infrastructure is relentlessly benchmarked. Yet most storage tests share a critical flaw: they measure performance on freshly formatted filesystems.
Real systems don’t live in “day zero.” They age. Free space fragments. Metadata scatters. Allocation patterns degrade. Subtle regressions often emerge only after months or years of production churn.
By relying on day-zero testing, we miss performance cliffs that surface only in aged environments.
To close this gap, we need practical ways to rapidly age a filesystem. In this lightning talk, I will break down the methods used to simulate years of filesystem fragmentation and wear in just a matter of minutes. Finally, I will introduce Filestorm, a fully working, production-ready benchmark that encapsulates these rapid-aging techniques into a single tool, and share examples of real-world regressions it has already caught in the wild.

Have you been told that you should monitor the health of your team by means of the so-called Cycle Time? And that the Jira Control Chart can help you with that?
It's not always the case if you do this in a Scrum Team, is it?

In this talk, I will demonstrate that you really can learn something about the team health if you look at how long its tasks take to complete, but you need to dig a bit deeper. And once you do that, you will understand what is the difference between Kanban and Scrum, that a Kanban metric needs a bit of a translation before it is useful in a Scrum environment, and that Joel Spolsky knew this already 20 years ago.

Modern CI/CD pipelines promise speed and parallelism, yet testing often remains linear. Many teams rely on one large end to end flow or chained test cases where each step depends on the previous. This creates a scalability ceiling: no true parallel execution, and one early failure blocks all downstream validation.

The constraint is not tooling but state management. Parallel tests require the ability to start from any required business state without replaying earlier steps.

Two strategies enable this shift. Environment virtualization uses snapshots and layered storage to restore systems instantly into predefined states. State aware provisioning pre creates or duplicates entities across lifecycle stages so tests can begin directly from meaningful states.

Treating system state as a first class concern decouples tests, isolates failures, reduces feedback time, and turns testing into a scalability enabler.

Bootc (bootable containers) enables building bootable host systems with Containerfiles or any other container build tooling. Bootc presents a UX challenge: because bootc systems are immutable, software packages must be installed at build-time, not runtime. To install an additional package, an end user needs to edit their system's Containerfile, rebuild the image, bootc switch to the new image, and reboot. This process is more complicated than the traditional dnf install UX, doubly so if the user is directly booting a distribution base image (think Bazzite) and they don't even have a Containerfile to edit!

What's needed for dnf install (or something like it) to Just Work on bootc systems? Is it possible to reconcile imperative package management and declarative container workflows? And how can we make it fast and reproducible? In this talk, we'll discuss recent work on dnf rebuild, a new DNF5 plugin that will bring satisfying answers!

This talk will cover the most interesting and most impacting features of java platform, language and virtual machine from 22 to 27. From disabled SecuritManager, over quantum crypto, restricted JNI and new native approaches, to Virtual Threads synchronization, AOT, compact headers, vector API and much more. While staying fully backward compatible and staying in top-ten languages for years - Java remains also progressive language without any gaps to other languages.

GPU communication is the bottleneck in LLM serving. Traditional PyTorch collectives copy data and synchronize unnecessarily, adding 100+ microseconds per operation. This talk introduces symmetric memory: zero-copy RDMA between GPUs using NCCL 2.29's one-sided APIs. We'll explore three primitives (put_signal, wait_signal, barrier) that enable direct GPU memory access with <10 ms latency—10x faster than traditional collectives. The implementation integrates with torch.compile through a registration API, allowing any operator to declare symmetric memory requirements without modifying compiler code. Live demonstrations show 35% throughput improvement in tensor-parallel LLM inference. We'll cover the architecture, memory registration, compiler integration challenges, and production deployment guidance. Attendees learn when to use symmetric memory versus traditional collectives, how to integrate it into applications, and PyTorch's GPU communication roadmap.

You don’t jump ~1,197 spots on the PyTorch contributor leaderboard by accident. It was our PyTorch Engineering Team that did the high-speed driving—writing, refining, and getting their code merged to make this massive leap possible. This talk pulls back the curtain on how the team evolved their day-to-day practices to scale our open-source footprint. I’ll share how our developers streamlined community contributions, removed friction for external collaborators, and adapted their internal Agile workflows to match the breakneck speed of the broader PyTorch ecosystem. If you want to amplify your own organization’s open-source impact, come see how a async-first workflow transformed from a process requirement into a massive competitive advantage.

The final session of the conference, and it's your last chance to win cool prizes with our conference quiz!