Pith. sign in

REVIEW 4 major objections 5 minor 107 references

Enabling Secure and Ephemeral AI Workloads in Data Mesh Environments

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Pairing an immutable container operating system with infrastructure-as-code, this paper argues, lets enterprises spin up secure, disposable Kubernetes clusters from scratch in under ten minutes, on premises or in any cloud.

desk verdict A coherent and unusually honest architecture blueprint for ephemeral Kubernetes clusters, but the paper's central 'under ten minutes on any cloud' claim rests on a single unverifiable assertion with no logs, code, or timing data. read the letter →

arxiv 2506.00352 v1 pith:UAZUGQN4 submitted 2025-05-31 cs.DC cs.AIcs.DB

Chinkit Patel , Kee Siong Ng This is my paper
classification cs.DCcs.AIcs.DB
keywords self-serviceKubernetesimmutableoperatingsystemsinfrastructureascodedatameshephemeralAIworkloadsTalosLinuxPulumiplatformengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the hardest part of AI adoption in large regulated enterprises, getting secure self-service compute, can be automated away with two existing technologies: Talos Linux, an immutable container-specific operating system, and Pulumi, a programming-language-based infrastructure-as-code tool. The resulting architecture gives every decentralised data team its own short-lived Kubernetes cluster, created from scratch by a single command-line tool, sskuba-ctl, and destroyed when the experiment ends, so nothing is patched or drifted. The paper reports that the prototype creates a cluster in AWS, Azure, and vSphere in under ten minutes, integrated with enterprise identity, public key infrastructure, and secrets services. A sympathetic reader would care because, if true, this gives data mesh environments a repeatable, portable, cost-efficient alternative or complement to commercial platform-as-a-service offerings, including a lightweight path to air-gapped and edge deployments.

What carries the argument

The central object is sskuba-ctl, a statically compiled, configuration-driven command-line tool that turns a three-section YAML file (metadata, target environment, GitOps repository) into a running Kubernetes cluster. The mechanism that carries the argument is the pairing of immutability with infrastructure-as-code: Talos Linux removes the node as a mutable surface that needs patching, and Pulumi makes the whole environment a versioned expression in a real programming language, so the same logic reproduces the cluster on AWS, Azure, and vSphere. The cluster is then declarative end to end, because FluxCD continuously synchronises it with the state declared in a git repository, while Teleport integrates enterprise identity with short-lived X.509 certificates. The paper's design principles, deploy anywhere, immutable infrastructure, automate aggressively, low-friction enterprise integration, and secure by design, are what motivate each of these component choices.

What would settle it

Run the documented sskuba-ctl apply -f cluster.yaml against an environment the paper names as a goal but does not demonstrate, such as Google Cloud Platform or bare metal, and check whether a cluster comes up without environment-specific code changes; any bespoke networking path, driver, or image that must be added by hand breaks the vendor-neutrality claim. Independently, timing cluster creation from the same invocation on AWS, Azure, and vSphere would directly test the under-ten-minutes claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that an ephemeral, secure Kubernetes cluster need not be assembled from a configuration space of fragile choices: the node operating system and the cloud environment can be reduced to two disciplined abstractions. Talos Linux makes every node a minimal, read-only, API-driven artifact with no shell, no SSH, and no package manager, so a cluster cannot silently mutate into an unknown state. Pulumi expresses the entire cluster footprint, virtual networks, load balancers, virtual machines, storage, and security groups, in general-purpose programming languages, so one code path can target different environments. sskuba-ctl, a configuration-driven Go binary, walks these abstractions through a fixed sequence: create a Pulumi stack, provision Talos VMs with freshly generated PKI certificates, bootstrap etcd and Kubernetes, load NVIDIA drivers on GPU nodes, then hand the cluster to FluxCD so its state converges to a git repository, with Teleport issuing short-lived certificates for access. The demonstrated outcome is a working cluster, in AWS, Azure, or vSphere, in under ten minutes, designed to be replaced rather than maintained.

Load-bearing premise

The load-bearing premise is that the Talos Linux and Pulumi abstractions cover every target-environment difference (networking, load balancing, storage, GPU drivers, authentication) with only slight variations; only AWS, Azure, and vSphere have been demonstrated, so the vendor-neutral, any-cloud claim stands or falls on that abstraction not leaking.

Editorial extensions

If this is right

  • Decentralised data teams can create and destroy their own AI and data compute platforms without waiting on a central platform team for each cluster.
  • Because clusters are replaced rather than patched, configuration drift and long-term attack surface shrink, and the infrastructure stays fully knowable from source code.
  • The same cluster-creation path runs on-premises (vSphere) and in hyperscaler clouds, easing interoperability across the mix of modern and legacy infrastructure found in data mesh environments.
  • Air-gapped and denied, degraded, intermittent, and limited (DDIL) environments can host lightweight Kubernetes clusters for edge deployments and temporary operations.
  • Each cluster ships with a curated set of open-source data and AI tools, so teams can start building on the first day rather than assembling their own stack.
  • Consistent integration with enterprise identity, PKI, secrets, and logging across environments supports faster, repeatable security accreditation for AI applications.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural test the paper itself does not run: deploy the documented sskuba-ctl configuration to an environment it names but does not demonstrate, such as Google Cloud Platform or bare metal; whether the abstraction holds without new code is the boundary of the vendor-neutrality claim.
  • If the approach scales to hundreds of teams as intended, platform-team economics shift from maintaining long-lived shared clusters with hard multi-tenancy to recreating disposable clusters on demand, a trade that only pays off for the stateless, short-lived workloads the paper's own limitations section says sskuba is optimised for.
  • The paper's balanced-autonomy governance model could be measured directly: compare how quickly a data product moves from a developer's ephemeral cluster into an accredited production environment against a centralised platform-as-a-service path.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes `sskuba`, a prototype platform for self-service, ephemeral Kubernetes clusters targeting AI and data workloads in data mesh environments. The claimed core innovation is a CLI tool `sskuba-ctl` that combines Talos Linux (an immutable container OS), Pulumi (programmatic infrastructure as code), Flux/GitOps, and shared services such as Teleport to create clusters from scratch in under ten minutes across AWS, Azure, and vSphere, with vendor-neutral portability to "any cloud environment." A secondary contribution is a curated set of data and AI tool kits that can be preloaded into each cluster. The manuscript is primarily an architecture/design description with extensive comparisons to alternative technologies and a limitations section, but it does not contain an experimental evaluation, reproducible measurements, a security analysis, or a link to a working artifact.

Significance. If the performance and portability claims were substantiated, this work would offer a useful practical pattern for enterprises that need ephemeral AI infrastructure without managed-PaaS lock-in, particularly in hybrid and data mesh settings. The design choices are sensible and grounded in real, widely used technologies (Talos Linux, Pulumi, Flux, Teleport), and the paper is honest about several design limitations, such as the unsuitability of the approach for long-lived geo-distributed databases. However, the central empirical claims are currently unsupported: the sub-ten-minute cluster creation figure appears only as a one-sentence assertion, and the broad "any cloud" claim is qualified by the paper's own enumeration of target-specific shims. As it stands, the contribution is an architectural proposal rather than a validated system, and its significance depends on future evidence.

major comments (4)
  1. [Abstract, §4.3] The central performance claim, that `sskuba-ctl` "has been demonstrated to create a sskuba cluster in AWS, Azure and vSphere under ten minutes," is presented without any supporting methodology or data. The text gives no cluster size, node types, network conditions, number of repeated runs, timing breakdown, machine or CI environment, logs, or artifact/repository for reproduction. Since this claim is the main quantitative differentiator from existing Kubernetes installers such as `eksctl`, Kubespray, and Cluster API, it is load-bearing. The paper needs an evaluation section with reproducible measurements, or a clear and prominent statement that the ten-minute figure is anecdotal.
  2. [Abstract, §4.1, §4.3.2] The abstract's promise of creating clusters "in any cloud environment" is not supported by the demonstrated scope and is further qualified by the details in §4.3.2. Only AWS, Azure, and vSphere are claimed to be demonstrated; GCP, bare metal, edge, and air-gapped modes appear only as goals. Moreover, §4.3.2 lists target-specific OS images (including a separate NVIDIA-driver image), target-specific CSI storage classes, native cloud secret managers versus Vault, native cloud CLI/OIDC authentication, and a vSphere-specific Big-IP load balancer. These are exactly the points where the Pulumi/Talos abstraction can leak environment-specific requirements. The paper should either provide evidence that the parameterized components cover the claimed environments or restrict the portability claim to the demonstrated set.
  3. [Title, §4.1, §4.2] The title and design principle 5 promise a "secure" platform, but the paper contains no threat model, no security evaluation, and no validation of the security properties invoked, such as Talos immutability, mTLS protection, short-lived certificates, or Teleport integration. The security discussion is limited to feature citations from the underlying tools. A claim that these clusters can be "trusted to operate effectively even in contested cyber environments" requires at least an explicit threat model and ideally a security assessment or a comparison against the enterprise controls the platform is supposed to inherit.
  4. [§5.2] The reference implementation of the data and AI tool kits is described with a figure and a statement that the authors have used it to "test and build out the integrated architecture of sskuba over multiple use cases," but no use cases, test results, or integration details are provided. If Section 5 is intended to support the claim of a working reference implementation, the paper should describe what was actually built, which components were exercised, and how the tool kits were verified to work inside the ephemeral clusters.
minor comments (5)
  1. [Throughout] The names `sskuba` and `sskuba-ctl` are frequently run together with adjacent words, for example "Thesskuba," "doessskuba-ctlwork?", and "sskubaclusters." This appears to be a formatting or rendering issue and should be fixed for readability.
  2. [Figures 2–8] Several figures are referenced in the text but are not present in the submitted manuscript. Please include the actual figures or replace them with complete textual descriptions, since the architecture description depends heavily on them.
  3. [Appendices A.3–A.5] These appendices state that the comparison text was generated by Perplexity.ai and "checked by the authors." Please provide a clearer methodology for that checking, or shorten the appendices so that the paper does not rely on unverifiable generated content for its comparison narrative.
  4. [§4.3.1] The text says "The exact steps taken in cluster creation are as follows" but gives no expected duration for any step. Adding a per-step timing breakdown would make the ten-minute claim in §4.3 interpretable and would help identify where the time budget is spent.
  5. [§4.4.4] The statement that AWS runs serverless functions in single-tenant virtual machines while Azure multiplexes multiple tenants on one kernel in separate containers would benefit from a direct citation to a primary source, since it is used to support a security comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper makes empirical architecture claims with no derivation chain, fitted parameters, or load-bearing self-citations.

full rationale

The paper is a systems/architecture proposal rather than a mathematical derivation, so the circularity patterns based on equations, fitted parameters, or self-referential definitions do not apply. The central claim is that sskuba-ctl can create Kubernetes clusters in AWS, Azure, and vSphere in under ten minutes and that the approach is vendor-neutral and portable. This is an empirical assertion about a prototype, not a result derived from prior work by the same authors. The self-citations by the authors (e.g., [33], [37], [53], [54]) appear only as background references for topics such as SQL analytics libraries, probabilistic logic, homomorphic encryption, and privacy technologies; they do not supply the load-bearing portability or efficiency claim. The paper contains no fitted parameters and no prediction that reduces by construction to its inputs. The strongest concerns are evidentiary: no timing methodology, logs, or reproducible artifact are provided, and Section 4.3.2 lists target-specific components such as cloud-specific OS images, CSI storage classes, secret managers, and a vSphere-specific load balancer. Those concerns undermine the strength of the empirical and portability claims, but they are issues of verification and correctness risk, not circularity. Under the review rules, an unverified or under-supported empirical claim is not circular, and self-citation becomes circular only when it is load-bearing and unverified. Neither condition is met here.

Assumptions & free parameters 0 free parameters · 4 assumptions · 1 invented entities

The paper introduces one invented software artifact, sskuba-ctl, which is not released. The architecture rests on several domain assumptions about Kubernetes, immutability, data mesh, and cloud abstraction that are asserted rather than empirically established in this paper.

assumptions (4)
  • domain assumption Kubernetes is the appropriate substrate for ephemeral AI workloads in data mesh environments.
    The entire architecture builds on Kubernetes; alternatives like serverless or lightweight orchestration are considered in Section 4.4 but dismissed primarily by suitability arguments.
  • domain assumption Immutable, container-specific host OS (Talos Linux) provides security and operational benefits that outweigh its constraints (no SSH, no package manager, no in-place patching) in production enterprise environments.
    Section 4.1, principle 2, and Section 4.2.1 assert this, citing NIST and security literature, but no empirical security comparison is provided.
  • domain assumption The data mesh architecture is the correct organizational model, and self-serve ephemeral clusters are the right way to support it.
    Sections 1 and 2 rely on data mesh literature [16, 28] and organizational claims such as 50-80% of time spent on infrastructure without primary data.
  • domain assumption Commodity cloud primitives (VPC, load balancers, CSI storage) can be abstracted by Pulumi into vendor-neutral clusters with only small per-environment variations.
    Section 4.3.1 says implementation details vary slightly by target environment; this uniformity is necessary for the any-cloud and vendor-neutral claims.
invented entities (1)
  • sskuba-ctl
    purpose: A Go-based CLI tool that automates creation of ephemeral Kubernetes clusters: creates a Pulumi stack, VPC, VMs, bootstraps Talos, installs Flux, and connects Teleport for access.
    No source code, binary, or repository is provided; the tool is described functionally with diagrams and a sample configuration, but is not independently verifiable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enabling Secure and Ephemeral AI Workloads in Data Mesh Environments." pith.science (2026). https://pith.science/paper/UAZUGQN4

@misc{pith2026250600352,
  author       = {Pith},
  title        = {Pith review of: Enabling Secure and Ephemeral AI Workloads in Data Mesh Environments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UAZUGQN4}},
  note         = {Machine review of arXiv:2506.00352}
}
read the original abstract

Many large enterprises that operate highly governed and complex ICT environments have no efficient and effective way to support their Data and AI teams in rapidly spinning up and tearing down self-service data and compute infrastructure, to experiment with new data analytic tools, and deploy data products into operational use. This paper proposes a key piece of the solution to the overall problem, in the form of an on-demand self-service data-platform infrastructure to empower de-centralised data teams to build data products on top of centralised templates, policies and governance. The core innovation is an efficient method to leverage immutable container operating systems and infrastructure-as-code methodologies for creating, from scratch, vendor-neutral and short-lived Kubernetes clusters on-premises and in any cloud environment. Our proposed approach can serve as a repeatable, portable and cost-efficient alternative or complement to commercial Platform-as-a-Service (PaaS) offerings, and this is particularly important in supporting interoperability in complex data mesh environments with a mix of modern and legacy compute infrastructure.

Figures

Figures reproduced from arXiv: 2506.00352 by the authors.

Figure 1
Figure 1. Layered architecture for data mesh (source: [ [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. Logical Components of sskuba-ctl 4.3.1 Cluster Creation The desired cluster setup is specified in a sskuba configuration file, which has three key sections. The Metadata section provides the details for creating a unique fully qualified domain name in the target environment. The Target section specifies the host environment (e.g. AWS, Azure, vSphere), including the number and type of virtual machines to be created. … view at source ↗
Figure 3
Figure 3. Sample configuration file - AWS Target 17 [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Sample configuration file - vSphere Target [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]
Figure 5
Figure 5. Figure 5: How does sskuba-ctl work? • The second step is creating the basic core networking required for a functioning Kubernetes cluster and the ability to route Talos OS Management traffic and ingress into the cluster. To achieve that, we create a Virtual Private Cloud (VPC), …
Figure 6
Figure 6. Figure 6: shows the component technologies in each of the shared services [PITH_FULL_IMAGE:figures/full_fig_p021_6.png]
Figure 7
Figure 7. Figure 7: Data & AI tool kits in sskuba Each capability comprises one or more component classes, which provide industry￾standard features. For example, object storage, vector databases, and graph data￾bases are all component classes within the storage capability. Within each com…
Figure 8
Figure 8. Figure 8: Reference implementation of sskuba’s data and AI tool kits readers to do their own homework on these technology choices, which can now be done easily with modern large language models like ChatGPT and Perplexity. 6 Discussion and Conclusion We have presented in this pa…
Figure 9
Figure 9. Figure 9: 2016 Big Data Landscape; for details and commentaries, see [PITH_FULL_IMAGE:figures/full_fig_p041_9.png]
Figure 10
Figure 10. Figure 10: 2024 Machine Learning, AI and Data Landscape; for details and com [PITH_FULL_IMAGE:figures/full_fig_p041_10.png]
Figure 11
Figure 11. Figure 11: Major knowledge representation formalisms in AI [PITH_FULL_IMAGE:figures/full_fig_p048_11.png]
Figure 12
Figure 12. Figure 12: Major classes of machine learning algorithms [PITH_FULL_IMAGE:figures/full_fig_p050_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

107 extracted references · 73 canonical work pages

  1. [1]

    Firecracker: Lightweight virtualization for serverless applications

    Alexandru Agache, Marc Brooker, Alexandra Iordache, Anthony Liguori, Rolf Neugebauer, Phil Piwonka, and Diana-Maria Popa. Firecracker: Lightweight virtualization for serverless applications. In17th USENIX Symposium on Net- worked Systems Design and Implementation, pages 419–434, 2020

    2020

  2. [2]

    Blending containers and virtual machines: a study of Firecracker and gVisor

    Anjali, Tyler Caraza-Harter, and Michael M Swift. Blending containers and virtual machines: a study of Firecracker and gVisor. InProceedings of the 16th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, pages 101–113, 2020

    2020

  3. [3]

    Designing access methods: The RUM conjecture

    Manos Athanassoulis, Michael S Kester, Lukas M Maas, Radu Stoica, Stratos Idreos, Anastasia Ailamaki, and Mark Callaghan. Designing access methods: The RUM conjecture. InEDBT, volume 2016, pages 461–466, 2016

    2016

  4. [4]

    Disk encryption on Talos operating system

    Parinaz Avaznejad. Disk encryption on Talos operating system. Master’s thesis, Aalto University, 2022

    2022

  5. [5]

    Variational inference: A review for statisticians.Journal of the American Statistical Association, 112(518):859–877, 2017

    David M Blei, Alp Kucukelbir, and Jon D McAuliffe. Variational inference: A review for statisticians.Journal of the American Statistical Association, 112(518):859–877, 2017

    2017

  6. [6]

    Towards avoiding the data mess: Industry insights from data mesh implementations

    Jan Bode, Niklas Kühl, Dominik Kreuzberger, and Carsten Holtmann. Towards avoiding the data mess: Industry insights from data mesh implementations. IEEE Access, 2024

    2024

  7. [7]

    Immutable operating systems: A survey

    Sebastian Bohm and Guido Wirtz. Immutable operating systems: A survey. In CEUR Workshop Proceedings, pages 52–60, 2023

    2023

  8. [8]

    Cambridge University Press, 2004

    Stephen Boyd and Lieven Vandenberghe.Convex Optimization. Cambridge University Press, 2004. 32

    2004

Show all 107 references
  1. [9]

    Top Threats to Cloud Computing 2024

    Jon-Michael Brook, Randall Brooks, Alex Getsin, Vic Hargrave, Laura Kenner, Michael Morgenstern, Stephen Pieraldi, and Michael Roza. Top Threats to Cloud Computing 2024. Technical report, Cloud Security Alliance, 2024

    2024

  2. [10]

    Kubernetesdeploymentoptionsforon-premclusters.arXiv:2407.01620, 2024

    Lincoln Bryant, Robert W Gardner, Fengping Hu, David Jordan, and Ryan P Taylor. Kubernetesdeploymentoptionsforon-premclusters.arXiv:2407.01620, 2024

    2024 arXiv

  3. [11]

    How kubernetes changes operations.;login:, 40, 2015

    Brendan Burns. How kubernetes changes operations.;login:, 40, 2015

    2015

  4. [12]

    Borg, Omega, and Kubernetes.Communications of the ACM, 59(5):50– 57, 2016

    Brendan Burns, Brian Grant, David Oppenheimer, Eric Brewer, and John Wilkes. Borg, Omega, and Kubernetes.Communications of the ACM, 59(5):50– 57, 2016

    2016

  5. [13]

    Cam- bridge University Press, 2006

    NicoloCesa-BianchiandGáborLugosi.Prediction, Learning, and Games. Cam- bridge University Press, 2006

    2006

  6. [14]

    Brian Christian.The Alignment Problem: How can Machines Learn Human Values?Atlantic Books, 2021

    2021

  7. [15]

    How can SMEs benefit from big data? Challenges and a path forward.Quality and Reliability Engineering Interna- tional, 32(6):2151–2164, 2016

    Shirley Coleman, Rainer Göb, Giuseppe Manco, Antonio Pievatolo, Xavier Tort-Martorell, and Marco Seabra Reis. How can SMEs benefit from big data? Challenges and a path forward.Quality and Reliability Engineering Interna- tional, 32(6):2151–2164, 2016

    2016

  8. [16]

    Marcombo, 2022

    Zhamak Dehghani.Data Mesh. Marcombo, 2022

    2022

  9. [17]

    Ensemble methods in machine learning

    Thomas G Dietterich. Ensemble methods in machine learning. InWorkshop on Multiple Classifier Systems, pages 1–15. Springer, 2000

    2000

  10. [18]

    Understandingsoftware-2.0: A studyofmachinelearning library usage and evolution.ACM Transactions on Software Engineering and Methodology, 30(4):1–42, 2021

    MalindaDilharaetal. Understandingsoftware-2.0: A studyofmachinelearning library usage and evolution.ACM Transactions on Software Engineering and Methodology, 30(4):1–42, 2021

    2021

  11. [19]

    Revealing information while preserving privacy

    Irit Dinur and Kobbi Nissim. Revealing information while preserving privacy. In Proceedings of the ACM Symposium on Principles of Database Systems, pages 202–210, 2003

    2003

  12. [20]

    Wireguard: Next generation kernel network tunnel

    Jason A Donenfeld. Wireguard: Next generation kernel network tunnel. In NDSS, pages 1–12, 2017

    2017

  13. [21]

    50 years of data science.Journal of Computational and Graph- ical Statistics, 26(4):745–766, 2017

    David Donoho. 50 years of data science.Journal of Computational and Graph- ical Statistics, 26(4):745–766, 2017

    2017

  14. [22]

    Thealgorithmicfoundationsofdifferentialpri- vacy.Foundations and Trends®in Theoretical Computer Science, 9(3–4):211– 407, 2014

    CynthiaDworkandAaronRoth. Thealgorithmicfoundationsofdifferentialpri- vacy.Foundations and Trends®in Theoretical Computer Science, 9(3–4):211– 407, 2014. 33

    2014

  15. [23]

    A pragmatic introduc- tion to secure multi-party computation.Foundations and Trends®in Privacy and Security, 2(2-3):70–246, 2018

    David Evans, Vladimir Kolesnikov, and Mike Rosulek. A pragmatic introduc- tion to secure multi-party computation.Foundations and Trends®in Privacy and Security, 2(2-3):70–246, 2018

    2018

  16. [24]

    The seven virtues of simple type theory.Journal of Applied Logic, 6(3):267–286, 2008

    William M Farmer. The seven virtues of simple type theory.Journal of Applied Logic, 6(3):267–286, 2008

    2008

  17. [25]

    CloudMF: Model-driven management of multi-cloud applications.ACM Transactions on Internet Technology, 18(2):1–24, 2018

    Nicolas Ferry, Franck Chauvel, Hui Song, Alessandro Rossini, Maksym Lush- penko, and Arnor Solberg. CloudMF: Model-driven management of multi-cloud applications.ACM Transactions on Internet Technology, 18(2):1–24, 2018

    2018

  18. [26]

    Infrastructure is software too!SSRN 2681904, 2015

    Brian Fitzgerald, Nicole Forsgren, Klaas-Jan Stol, Jez Humble, and Brian Doody. Infrastructure is software too!SSRN 2681904, 2015

    2015

  19. [27]

    A decision-theoretic generalization of on- line learning and an application to boosting.Journal of Computer and System Sciences, 55(1):119–139, 1997

    Yoav Freund and Robert E Schapire. A decision-theoretic generalization of on- line learning and an application to boosting.Journal of Computer and System Sciences, 55(1):119–139, 1997

    1997

  20. [28]

    Data mesh: a systematic gray literature review.ACM Computing Surveys, 57(1):1–36, 2024

    Abel Goedegebuure, Indika Kumara, Stefan Driessen, Willem-Jan Van Den Heuvel, Geert Monsieur, Damian Andrew Tamburri, and Dario Di Nucci. Data mesh: a systematic gray literature review.ACM Computing Surveys, 57(1):1–36, 2024

    2024

  21. [29]

    Learning from the Amazon technology platform

    Jim Gray and Werner Vogels. Learning from the Amazon technology platform. ACM Queue, 4, 2006

    2006

  22. [30]

    Adib Habbal, Mohamed Khalif Ali, and Mustafa Ali Abuzaraida. Artificial Intelligence trust, risk and security management (AI trism): Frameworks, ap- plications, challenges and future research directions.Expert Systems with Ap- plications, 240:122442, 2024

    2024

  23. [31]

    Homomorphic encryption

    Shai Halevi. Homomorphic encryption. InTutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich, pages 219–276. Springer, 2017

    2017

  24. [32]

    Immutability changes everything.Communications of the ACM, 59(1):64–70, 2015

    Pat Helland. Immutability changes everything.Communications of the ACM, 59(1):64–70, 2015

    2015

  25. [33]

    The MADlib analytics library or MAD skills, the SQL

    Joseph M Hellerstein, Christoper Ré, Florian Schoppmann, Daisy Zhe Wang, Eugene Fratkin, Aleksander Gorajek, Kee Siong Ng, Caleb Welton, Xixuan Feng, Kun Li, et al. The MADlib analytics library or MAD skills, the SQL. Proceedings of the VLDB Endowment, 5(12), 2012

    2012

  26. [34]

    An overview of multi-cloud computing

    Jiangshui Hong, Thomas Dreibholz, Joseph Adam Schenkel, and Jiaxi Alessia Hu. An overview of multi-cloud computing. InWorkshop on Web, Artificial Intelligence and Network Applications, pages 1055–1068. Springer, 2019. 34

    2019

  27. [35]

    Artificial intelligence security: Threats and counter- measures.ACM Computing Surveys, 55(1):1–36, 2021

    Yupeng Hu, Wenxin Kuang, Zheng Qin, Kenli Li, Jiliang Zhang, Yansong Gao, Wenjia Li, and Keqin Li. Artificial intelligence security: Threats and counter- measures.ACM Computing Surveys, 55(1):1–36, 2021

    2021

  28. [36]

    Rethinking AI Talent Strategy as Automated Machine Learning Comes of Age

    Holger Hürtgen, Jan Kerkhof, and Manuel Möller. Rethinking AI Talent Strategy as Automated Machine Learning Comes of Age. Technical report, McKinsey Analytics, 2020

    2020

  29. [37]

    Probabil- itiesonsentencesinanexpressivelogic.Journal of Applied Logic, 11(4):386–420, 2013

    Marcus Hutter, John W Lloyd, Kee Siong Ng, and William TB Uther. Probabil- itiesonsentencesinanexpressivelogic.Journal of Applied Logic, 11(4):386–420, 2013

    2013

  30. [38]

    Machine learning: Trends, perspectives, and prospects.Science, 349(6245):255–260, 2015

    Michael I Jordan and Tom M Mitchell. Machine learning: Trends, perspectives, and prospects.Science, 349(6245):255–260, 2015

    2015

  31. [39]

    Choosing the right IaC tool for building reusable cloud infra- structure

    Niko Kalliomaa. Choosing the right IaC tool for building reusable cloud infra- structure. Master’s thesis, University of Turku, 2024

    2024

  32. [40]

    REFORMS: Consensus-based recommendations for machine-learning-based science.Science Advances, 10(18):eadk3452, 2024

    Sayash Kapoor, Emily M Cantrell, Kenny Peng, Thanh Hien Pham, Chris- topher A Bail, Odd Erik Gundersen, Jake M Hofman, Jessica Hullman, Michael A Lones, Momin M Malik, et al. REFORMS: Consensus-based recommendations for machine-learning-based science.Science Advances, 10(18):e...

    2024

  33. [41]

    Comparison of infrastructure as code frameworks from a de- veloper perspective

    Daniel Karlsson. Comparison of infrastructure as code frameworks from a de- veloper perspective. Master’s thesis, Linkoping University, 2023

    2023

  34. [42]

    Assessing the vulnerabilities of the open-source artificial intelligence landscape: A large-scale analysis of the Hugging Face platform

    Adhishree Kathikar, Aishwarya Nair, Ben Lazarine, Agrim Sachdeva, and Sagar Samtani. Assessing the vulnerabilities of the open-source artificial intelligence landscape: A large-scale analysis of the Hugging Face platform. InIEEE Inter- national Conference on Intelligence and S...

    2023

  35. [43]

    The impact of platform vulnerabilities in AI systems

    Ashley Hyowon Kim. The impact of platform vulnerabilities in AI systems. Master’s thesis, Massachusetts Institute of Technology, 2020

    2020

  36. [44]

    Data scientists in software teams: State of the art and challenges.IEEE Transactions on Software Engineering, 44(11):1024–1038, 2017

    Miryung Kim, Thomas Zimmermann, Robert DeLine, and Andrew Begel. Data scientists in software teams: State of the art and challenges.IEEE Transactions on Software Engineering, 44(11):1024–1038, 2017

    2017

  37. [45]

    Kubernetes distributions for the edge: serverless performance evaluation.Journal of Supercomputing, 78(11):13728–13755, 2022

    Vojdan Kjorveziroski and Sonja Filiposka. Kubernetes distributions for the edge: serverless performance evaluation.Journal of Supercomputing, 78(11):13728–13755, 2022

    2022

  38. [46]

    The MIT Press, 2009

    Daphne Koller and Nir Friedman.Probabilistic Graphical Models: Principles and Techniques. The MIT Press, 2009. 35

    2009

  39. [47]

    Lightweight kubernetes distributions: A performance comparison of microk8s, k3s, k0s, and microshift

    Heiko Koziolek and Nafise Eskandani. Lightweight kubernetes distributions: A performance comparison of microk8s, k3s, k0s, and microshift. InProceedings of the 2023 ACM/SPEC International Conference on Performance Engineering, pages 17–29, 2023

    2023

  40. [48]

    The do’s and don’ts of infrastructure code: A systematic gray literature review

    Indika Kumara, Martín Garriga, Angel Urbano Romeu, Dario Di Nucci, Fabio Palomba, Damian Andrew Tamburri, and Willem-Jan van den Heuvel. The do’s and don’ts of infrastructure code: A systematic gray literature review. Information and Software Technology, 137:106593, 2021

    2021

  41. [49]

    O’Reilly Media, 2019

    Valliappa Lakshmanan and Jordan Tigani.Google BigQuery: The Definitive Guide. O’Reilly Media, 2019

    2019

  42. [50]

    Cambridge University Press, 2020

    Tor Lattimore and Csaba Szepesvári.Bandit algorithms. Cambridge University Press, 2020

    2020

  43. [51]

    Deep learning.Nature, 521(7553):436–444, 2015

    Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning.Nature, 521(7553):436–444, 2015

    2015

  44. [52]

    BigLake: BigQuery’s evolution toward a multi-cloud lakehouse

    Justin Levandoski et al. BigLake: BigQuery’s evolution toward a multi-cloud lakehouse. InCompanion of the International Conference on Management of Data, pages 334–346, 2024

    2024

  45. [53]

    A tutorial introduction to lattice- based cryptography and homomorphic encryption.arXiv:2208.08125, 2022

    Yang Li, Kee Siong Ng, and Michael Purcell. A tutorial introduction to lattice- based cryptography and homomorphic encryption.arXiv:2208.08125, 2022

    2022 arXiv

  46. [54]

    Privacy technologies for fin- ancial intelligence.arXiv:2408.09935, 2024

    Yang Li, Thilina Ranbaduge, and Kee Siong Ng. Privacy technologies for fin- ancial intelligence.arXiv:2408.09935, 2024

    2024

  47. [55]

    John W. Lloyd. Knowledge representation and reasoning in modal higher-order logic. Technical report, Australian National University, 2007

    2007

  48. [56]

    The responsible foundation model development cheat- sheet: A review of tools & resources.arXiv:2406.16746, 2024

    Shayne Longpre et al. The responsible foundation model development cheat- sheet: A review of tools & resources.arXiv:2406.16746, 2024

    2024 arXiv

  49. [57]

    Basic lattice cryptography: The concepts behind Kyber (ML-KEM) and Dilithium (ML-DSA).Cryptology ePrint Archive, 2024

    Vadim Lyubashevsky. Basic lattice cryptography: The concepts behind Kyber (ML-KEM) and Dilithium (ML-DSA).Cryptology ePrint Archive, 2024

    2024

  50. [58]

    A comparative analysis of container orchestration tools in cloud computing

    Anshita Malviya and Rajendra Kumar Dwivedi. A comparative analysis of container orchestration tools in cloud computing. InInternational Conference on Computing for Sustainable Global Development, pages 698–703, 2022

    2022

  51. [59]

    Manifold learning: What, how, and why

    Marina Meilă and Hanyu Zhang. Manifold learning: What, how, and why. Annual Review of Statistics and Its Application, 11, 2024. 36

    2024

  52. [60]

    Immutable infra- structure calls for immutable architecture: Deploying a changeless architecture in the cloud

    Anders Mikkelsen, Tor-Morten Grønli, and Rick Kazman. Immutable infra- structure calls for immutable architecture: Deploying a changeless architecture in the cloud. InProceedings of the Hawaii International Conference on System Systems, 2019

    2019

  53. [61]

    Human-level control through deep reinforcement learn- ing.Nature, 518(7540):529–533, 2015

    Volodymyr Mnih et al. Human-level control through deep reinforcement learn- ing.Nature, 518(7540):529–533, 2015

    2015

  54. [62]

    O’Reilly, 2016

    Kief Morris.Infrastructure as code: Managing servers in the cloud. O’Reilly, 2016

    2016

  55. [63]

    Center for Strategic and International Studies, 2022

    Nand Mulchandani and John NT Shanahan.Software-defined Warfare: Ar- chitecting the DOD’s Transition to the Digital Age. Center for Strategic and International Studies, 2022

    2022

  56. [64]

    Digital transformation with a lightweight on-premise PaaS.Future Generation Computer Systems, 2024

    Din Mušić, Jernej Hribar, and Carolina Fortuna. Digital transformation with a lightweight on-premise PaaS.Future Generation Computer Systems, 2024

    2024

  57. [65]

    An overview of data warehouse and data lake in modern enterprise data management.Big Data and Cognitive Computing, 6(4):132, 2022

    Athira Nambiar and Divyansh Mundra. An overview of data warehouse and data lake in modern enterprise data management.Big Data and Cognitive Computing, 6(4):132, 2022

    2022

  58. [66]

    Princeton University Press, 2024

    Arvind Narayanan and Sayash Kapoor.AI snake oil: What artificial intelli- gence can do, what it can’t, and how to tell the difference. Princeton University Press, 2024

    2024

  59. [67]

    SecuringphysicalITinfrastructuresthroughimmutability

    C-E.Niculicea. SecuringphysicalITinfrastructuresthroughimmutability. Mas- ter’s thesis, Lulea University of Technology, 2019

    2019

  60. [68]

    Springer, 2002

    Tobias Nipkow, Markus Wenzel, and Lawrence C Paulson.Isabelle/HOL: a proof assistant for higher-order logic. Springer, 2002

    2002

  61. [69]

    CryptDB: Protecting confidentiality with encrypted query pro- cessing

    Raluca Ada Popa, Catherine MS Redfield, Nickolai Zeldovich, and Hari Bal- akrishnan. CryptDB: Protecting confidentiality with encrypted query pro- cessing. InProceedings of the 23rd ACM Symposium on Operating Systems Principles, pages 85–100, 2011

    2011

  62. [70]

    Independent, 2024

    Nigel Poulton and Pushkar Joglekar.The Kubernetes Book. Independent, 2024

    2024

  63. [71]

    Data programming: Creating large training sets, quickly.NeurIPS, 29, 2016

    Alexander J Ratner, Christopher M De Sa, Sen Wu, Daniel Selsam, and Chris- topher Ré. Data programming: Creating large training sets, quickly.NeurIPS, 29, 2016

    2016

  64. [72]

    The role of massively multi-task and weak supervision in software 2.0

    Alexander J Ratner, Braden Hancock, and Christopher Ré. The role of massively multi-task and weak supervision in software 2.0. InCIDR, 2019. 37

    2019

  65. [73]

    O’Reilly Media, 2020

    Liz Rice.Container Security: Fundamental Technology Concepts that Protect Containerized Applications. O’Reilly Media, 2020

    2020

  66. [74]

    A survey of data security: Practices from cybersecurity and challenges of machine learning.arXiv:2310.04513, 2023

    Padmaksha Roy, Jaganmohan Chandrasekaran, Erin Lanus, Laura Freeman, and Jeremy Werner. A survey of data security: Practices from cybersecurity and challenges of machine learning.arXiv:2310.04513, 2023

    2023 arXiv

  67. [75]

    Simon and Schuster, 2017

    Peter Sbarski and Sam Kroonenburg.Serverless architectures on AWS: with examples using AWS Lambda. Simon and Schuster, 2017

    2017

  68. [76]

    MIT press, 2002

    Bernhard Scholkopf and Alexander J Smola.Learning with kernels: Support vector machines, regularization, optimization, and beyond. MIT press, 2002

    2002

  69. [77]

    Navigating the Multi-Cloud Maze: Benefits, Challenges, and Future Trends

    Dhruv Seth, Harshavardhan Nerella, Madhavi Najana, and Ayisha Tabbassum. Navigating the Multi-Cloud Maze: Benefits, Challenges, and Future Trends. International Journal of Global Innovations and Solutions, 2024

    2024

  70. [78]

    XI commandments of Kubernetes security: A systematization of knowledge related to Kubernetes security practices.IEEE Secure Development, pages 58– 64, 2020

    Md Shazibul Islam Shamim, Farzana Ahamed Bhuiyan, and Akond Rahman. XI commandments of Kubernetes security: A systematization of knowledge related to Kubernetes security practices.IEEE Secure Development, pages 58– 64, 2020

    2020

  71. [79]

    Skelton, M

    M. Skelton, M. Pais, and R. Malan.Team Topologies: Organizing Business and Technology Teams for Fast Flow. IT Revolution Press, 2019

    2019

  72. [80]

    PhD thesis, University of St

    Daniel Sokolowski.Reliable Infrastructure as Code for Decentralized Organiza- tions. PhD thesis, University of St. Gallen, 2024

    2024

  73. [81]

    Application container security guide

    Murugiah Souppaya, John Morello, and Karen Scarfone. Application container security guide. Technical Report SP 800-190, NIST, 2017

    2017

  74. [82]

    Evaluating ssh for modern deployments

    Thomas Thaulow Stöcklin. Evaluating ssh for modern deployments. Technical report, Noroff University College, 2022

    2022

  75. [83]

    Abadi, Stavros Harizopoulos, Nabil Hachem, and Pat Helland

    Michael Stonebraker, Samuel Madden, Daniel J. Abadi, Stavros Harizopoulos, Nabil Hachem, and Pat Helland. The end of an architectural era: it’s time for a complete rewrite. In Michael L. Brodie, editor,Making Databases Work: the Pragmatic Wisdom of Michael Stonebraker, pages 4...

    2019

  76. [84]

    MIT press, 2018

    Richard S Sutton and Andrew G Barto.Reinforcement Learning: An Introduc- tion. MIT press, 2018

    2018

  77. [85]

    Understanding security implications of using containers in the cloud

    Byungchul Tak, Canturk Isci, Sastry Duri, Nilton Bila, Shripad Nadgowda, and James Doran. Understanding security implications of using containers in the cloud. InUSENIX ATC, pages 313–319, 2017. 38

    2017

  78. [86]

    MLOps, LLMOps, FMOps, and beyond.IEEE Software, 42(01):26–32, 2025

    Chakkrit Kla Tantithamthavorn, Fabio Palomba, Foutse Khomh, and Joselito Joey Chua. MLOps, LLMOps, FMOps, and beyond.IEEE Software, 42(01):26–32, 2025

    2025

  79. [87]

    the theory of everything

    Max Tegmark. Is “the theory of everything” merely the ultimate ensemble theory?Annals of Physics, 270(1):1–51, 1998

    1998

  80. [88]

    Telenyk, Oleksii Sopov, Eduard Zharikov, and Grzegorz Nowakowski

    S. Telenyk, Oleksii Sopov, Eduard Zharikov, and Grzegorz Nowakowski. A com- parison of Kubernetes and Kubernetes-compatible platforms. InInternational Conference on Intelligent Data Acquisition and Advanced Computing Systems, volume 1, pages 313–317, 2021

    2021

  81. [89]

    CRC Press, 2022

    Bhavani Thuraisingham, Murat Kantarcioglu, and Latifur Khan.Secure Data Science: Integrating Cyber Security and Data Science. CRC Press, 2022

    2022

  82. [90]

    MIT press, 2014

    Johan Van Benthem.Logic in Games. MIT press, 2014

    2014

  83. [91]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. InAdvances in Neural Information Processing Systems, pages 5998–6008, 2017

    2017

  84. [92]

    Large-scale cluster management at Google with Borg

    Abhishek Verma, Luis Pedrosa, Madhukar Korupolu, David Oppenheimer, Eric Tune, and John Wilkes. Large-scale cluster management at Google with Borg. InEuropean Conference on Computer Systems, pages 1–17, 2015

    2015

  85. [93]

    The context- tree weighting method: Basic properties.IEEE Transactions on Information Theory, 41(3):653–664, 1995

    Frans MJ Willems, Yuri M Shtarkov, and Tjalling J Tjalkens. The context- tree weighting method: Basic properties.IEEE Transactions on Information Theory, 41(3):653–664, 1995

    1995

  86. [94]

    A comprehensive survey on graph neural networks.IEEE Trans- actions on Neural Networks and Learning Systems, 32(1):4–24, 2020

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip. A comprehensive survey on graph neural networks.IEEE Trans- actions on Neural Networks and Learning Systems, 32(1):4–24, 2020. 39 A Appendix A.1 Certified Kubernetes Distributions and Installer...

    2020

  87. [95]

    This flexibility allows de- velopers to use familiar languages, making it easier to integrate infra- structure code with application code

    Configuration Language •Pulumi: Supports multiple programming languages including Python, JavaScript, TypeScript, Go, C#, and YAML. This flexibility allows de- velopers to use familiar languages, making it easier to integrate infra- structure code with application code. •Terra...

  88. [96]

    This allows for easier sharing of state across teams and includes features like policy enforcement

    State Management •Pulumi: Manages state through its own service by default, which can also be configured to use other cloud services. This allows for easier sharing of state across teams and includes features like policy enforcement. •Terraform: Uses local JSON state files (te...

  89. [97]

    Pulumi can also utilize Terraform pro- viders, expanding its ecosystem significantly

    Community and Ecosystem •Pulumi: While newer, it has been rapidly growing and provides support for over 60 major cloud services. Pulumi can also utilize Terraform pro- viders, expanding its ecosystem significantly. •Terraform: Has a more established community with a vast libra...

  90. [98]

    This is particularly beneficial for developers needing cutting-edge features quickly

    Extensibility •Pulumi: Offers Dynamic Provider Support, allowing it to create new providers and support features faster than Terraform. This is particularly beneficial for developers needing cutting-edge features quickly. •Terraform: While extensible through community plugins,...

  91. [99]

    •Terraform: Primarilysupportsintegrationtests; unittestingislessstraight- forward due to the nature of HCL being a configuration language rather than a full programming language

    Testing and Development Workflow 42 •Pulumi: Beingabletousegeneral-purposeprogramminglanguagesallows developerstoleverageexistingtestingframeworksforunitandintegration testing, enhancing the reliability of their infrastructure code. •Terraform: Primarilysupportsintegrationtest...

  92. [100]

    •Terraform: Transitioned to a Business Source License (BSL) in August 2023, which may impose restrictions on competitive use unless an agree- ment is signed with HashiCorp

    Licensing •Pulumi: Uses the Apache License 2.0, which is permissive and straight- forward for open-source contributions. •Terraform: Transitioned to a Business Source License (BSL) in August 2023, which may impose restrictions on competitive use unless an agree- ment is signed...

    2023

  93. [101]

    It provides a more traditional Linux environment optimized for containers

    Architecture and Design •Flatcar Linux is based on CoreOS, which in turn is derived from Gentoo Linux. It provides a more traditional Linux environment optimized for containers. •Talos Linux, on the other hand, is a highly minimalistic and purpose-built OS designed specificall...

  94. [102]

    •Talos has only 12 unique binaries in the system PATH

    System Footprint – Talos Linux has a significantly smaller footprint. •Talos has only 12 unique binaries in the system PATH. •Flatcar has over 2300 binaries in the system PATH. This reduced footprint in Talos minimizes the attack surface and simplifies system maintenance

  95. [103]

    Talos also implements features like secure boot and a hardened kernel configuration

    Immutability and Security – Both systems emphasize immutability, but Talos takes this concept further: •Talos has a more extensively read-only filesystem, with only specific files mounted into configuration paths. Talos also implements features like secure boot and a hardened ...

  96. [104]

    •Talos employs a gRPC API for all system configuration and management, removing the need for SSH access

    Configuration and Management •Flatcar uses a declarative configuration approach with tools like Ignition and cloud-init. •Talos employs a gRPC API for all system configuration and management, removing the need for SSH access. This API-driven approach simplifies automation and ...

  97. [105]

    •Talos uses a custom update mechanism that is claimed to provide more granular control over updates

    Update Mechanism – Both systems use image-based updates: •Flatcar uses an A/B partition scheme inspired by ChromeOS for updates and rollbacks. •Talos uses a custom update mechanism that is claimed to provide more granular control over updates. 44

  98. [106]

    •Talos is optimised for Kubernetes environments, integrating tightly with Kubernetes and not intended as a general-purpose Linux distribution

    Use Case Focus •Flatcar is more versatile and can be used for general container workloads, including but not limited to Kubernetes. •Talos is optimised for Kubernetes environments, integrating tightly with Kubernetes and not intended as a general-purpose Linux distribution

  99. [107]

    •Flatcar has a larger community, being a direct successor to CoreOS

    Community and Support – Both projects emphasize open-source development and community engagement. •Flatcar has a larger community, being a direct successor to CoreOS. •Talos, being newer, has a smaller but growing community. In summary, while both Flatcar and Talos are designe...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.