No SSH? What is Talos, this Linux Distro for Kubernetes?
Container-based Linux distributions are gaining traction, especially for edge deployments that demand lightweight and secure operating systems. Talos Linux, developed by Sidero Labs, is purpose-built for Kubernetes with security-first features like a fully immutable file system and disabled SSH access. In a demo, Sidero CTO Andrew Rynhard and Head of Product Justin Garrison explained Talos’s design philosophy, highlighting its minimalism and focus on automation. Inspired by CoreOS, Talos removes traditional tools like systemd and Bash, replacing them with machineD, a custom process manager written in Go.
Talos emphasizes API-driven management rather than SSH, making Kubernetes cluster operations more scalable and consistent. Its design supports cloud, bare metal, Docker, and edge devices like Raspberry Pi. Kernel immutability is reinforced by ephemeral signing keys. Through Sidero's Omni SaaS, Talos nodes connect securely via WireGuard. The operating system handles all certificates and network connectivity internally, streamlining security and deployment. As Garrison notes, Talos delivers a portable API for “big iron, small iron—no matter what.”
Learn more from The New Stack about Sidero Labs:
Is Cluster API Really the Future of Kubernetes Deployment?
Choosing a Linux Distribution
Join our community of newsletter subscribers to stay on top of the news and at the top of your game. https://thenewstack.io/newsletter/
Flavors of Ship It! (Interview)
Flavors of Ship It on The Changelog — if you’re not subscribed to Ship It yet, do so at shipit.show or by searching for “Ship it” wherever you listen to podcasts. Every week Justin Garrison and Autumn Nash explore everything that happens after git push — and today’s flavors include running infrastructure in space, managing millions of machines at Meta, and what it takes to control your 3D printer with OctoPrint.
Join the discussion
Changelog++ members save 11 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Speakeasy – Production-ready, enterprise-resilient, best-in-class SDKs crafted in minutes. Speakeasy takes care of the entire SDK workflow to save you significant time, delivering SDKs to your customers in minutes with just a few clicks! Create your first SDK for free!
Supabase – Supabase just finished their 12th launch week! Check it out
Test Double – Find out more about Test Double’s software investment problem solvers at testdouble.com.
Unblocked – Other developer tools can’t tell you how your codebase works and why. Unblocked can. We augment your code with context from Slack, Confluence, Jira, and more, so you get accurate answers without having to search for them. Sign up for free at getunblocked.com
Featuring:
Andrew Guenther – Website, GitHub, LinkedIn, X
Anita Zhang – GitHub, LinkedIn, Mastodon, X
Gina Häußge – Website, GitHub, LinkedIn, Mastodon
Justin Garrison – GitHub, LinkedIn, X
Autumn Nash – GitHub, LinkedIn, X
Show Notes:
This episode is from these original episodes of Ship it:
Ship It! #92: Shipping in SPAAAACCEEE with Andrew Guenther from Orbital Sidekick
Ship It! #102: Managing Meta’s millions of machines with Anita Zhang from Meta
Ship It! #107: 3D printed infrastructure with Gina Häußge from OctoPrint
Something missing or broken? PRs welcome!
The Pros of On-Prem Kubernetes with Justin Garrison
Justin Garrison, Director of Developer Relations at Sidero, joins Corey to discuss Justin's experience transitioning from large companies like AWS and Disney to a more agile company like Sidero, the benefits of using simplified Linux distributions like Talos OS for running Kubernetes, and the pros of on-premises setups for certain workloads. The conversation touches upon challenges with cloud provider limitations, the impacts of computing power on both an economic and environmental scale and Corey and Justin’s frustration with businesses touting their use of AI when they’ve already abandoned those projects.
Show Highlights:
(00:00) - Introduction
(01:09) - Justin’s Background and Career Journey
(02:39) - Transition to Sidero
(03:51) - Using Personal Devices for Work
(08:09) - Talos Linux and Kubernetes
(15:19) - Kubernetes Upgrades and On-Prem Challenges
(19:21) - Building Your Own Cloud Platform
(21:52) - Multi-Cloud vs. Hybrid Cloud
(25:15) - Scaling and Resource Management
(28:02) - Gaming and Cloud Bursting
(32:46) - AI and GPU Challenges
(34:54) - Balancing On-Prem and Cloud Solutions
(40:49) - Final Thoughts and Contact
About Justin:
Justin is a historian living in the future. Lucky enough to play with cool technologies and hopeful enough to bring others along for the ride.
Links Referenced:
Justin’s Website: http://justingarrison.com
Justin on Bluesky: https://bsky.app/profile/justingarrison.com
Justin Garrison on LinkedIn: https://www.linkedin.com/in/justingarrison/
*Sponsor
Panoptica: https://www.panoptica.app/
Shift left, seriously. (Interview)
This week we’re going deep on security and what it takes to shift left, seriously. Adam is joined by Justin Garrison (co-host of Ship It), plus two members of the BoxyHQ team — Deepak Prabhakara, Co-founder & CEO and Schalk Neethling, Community Manager and DevRel as well as fellow Changelog Slack member.
We discuss how to shift left, the role of the developer and the burden of security, the importance of tooling, the difference between authentication and authorization, and a mindset change for when security takes place — it’s a matter of “when” not “who.”
Join the discussion
Changelog++ members get a bonus 10 minutes at the end of this episode and zero ads. Join today!
Sponsors:
Vercel – With zero configuration for over 35 frameworks, Vercel’s Frontend Cloud makes it easy for any team to deploy their apps. Today, you can get a 14-day free trial of Vercel Pro, or get a customized Enterprise demo from their team. Visit vercel.com/changelogpod to get started.
Synadia – Take NATS to the next level via a global, multi-cloud, multi-geo and extensible service, fully managed by Synadia. They take care of all the infrastructure, management, monitoring, and maintenance for you so you can focus on building exceptional distributed applications.
Read Write Own – Read, Write, Own: Building the Next Era of the Internet—a new book from entrepreneur and investor Chris Dixon—explores one possible solution to the internet’s authenticity problem: Blockchains. From AI that tracks its source material to generative programs that compensate—rather than cannibalize—creators. It’s a call to action for a more open, transparent, and democratic internet. One that opens the black box of AI, tracks the origins we see online, and much more. Order your copy of Read, Write, Own today at readwriteown.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Deepak Prabhakara – Website, GitHub, LinkedIn, X
Schalk Neethling – Website, GitHub, LinkedIn, Mastodon
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Justin Garrison – GitHub, LinkedIn, X
Show Notes:
BoxyHQ.com
SAML Jackson - Enterprise SSO made simple
Enterprise SaaS Starter Kit
MVSP (Minimum Viable Secure Product
Minimum Viable Secure Product (MVSP) checklist
Something missing or broken? PRs welcome!
Amazon's silent sacking (Interview)
Justin Garrison joins us to talk about Amazon’s silent sacking, from his perspective. He should know. He works there. Well, as of yesterday he quit. We discuss how the cloud and Kubernetes have transformed the way software is developed and deployed, the impact silent layoffs have on employees and their careers, speaking out about workplace issues (the right way), how changes in organizational structure can lead to gaps in expertise and responsibility which can lead to potential outages and slower response times.
By the way, we officially let the cat off out of the bag in this episode. Justin has joined the ranks here at Changelog and is taking over as the host of Ship It! Expect new episodes soon.
Join the discussion
Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Neon – The fully managed serverless Postgres with a generous free tier. We separate storage and compute to offer autoscaling, branching, and bottomless storage.
Socket – Secure your supply chain and ship with confidence. Install the GitHub app, book a demo or learn more
Sentry – Get $100 towards your error monitoring with Sentry! Use the code changelog.
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Justin Garrison – GitHub, LinkedIn, X
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
Amazon’s Silent Sacking
mintCast
Ship It
Justin on Ship It takeover
Something missing or broken? PRs welcome!
Gleaming the KubeCon (Interview)
This week we’re gleaming the KubeCon. Ok, some people say CubeCon, while others say KubeCon…we talk with Solomon Hykes about all things Dagger, Tammer Saleh and James McShane about going beyond cloud native with SuperOrbital, and Steve Francis and Spencer Smith about the state of Talos Linux and what they’re working on at Sidero Labs.
Join the discussion
Changelog++ members save 12 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Neon – The fully managed serverless Postgres with a generous free tier. We separate storage and compute to offer autoscaling, branching, and bottomless storage.
.Tech Domains – They’re giving selected startups guest spots on the biggest podcasts, conferences, and billboards in the tech game. Apply at startups.tech/changelog
Traceroute – Listen and follow Season 3 of Traceroute starting November 2 on Apple, Spotify, or wherever you get your podcasts!
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Solomon Hykes – GitHub, X
Tammer Saleh – Website, GitHub, LinkedIn, X
James McShane – GitHub, X
Steve Francis – GitHub, LinkedIn
Spencer Smith – GitHub, LinkedIn
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Gerhard Lazu – Website, GitHub, LinkedIn, X
Show Notes:
SOTL 2023
dagger.io
SuperOrbital
Talos Linux
Something missing or broken? PRs welcome!
Talos, with Andrew Rynhard
Kubernetes lets us manage our infrastructure declaratively, so why do we still manage the underlying OS with a myriad of different text files? And why allow shell and SSH access to a machine that should be immutable? So asked Andrew Rynhard before creating Talos, a Linux distribution built for Kubernetes. He's now CTO of Talos Systems, a company founded to take it to market.
Do you have something cool to share? Some questions? Let us know:
web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod
Chatter of the week 40 years of the IBM PC 5150 emulator and docs
What was it like to use?
Twitter thread about the cost of add-ons
41 years ago: the story of the creation of the PC
DONKEY.BAS Play it on the 5150 emulator
Learn about it
Play it on the iPhone or Apple Watch
Commodore 64 Wheel of Fortune
Little Computer People
C64 vs IBM advertising
6502 and derivative CPUs: the C64 used a 6510
Bender
News of the week Litmus 2.0.0 Episode 56, with Evan Powell
SPIRE security audit Episode 45, with Andrew Jessup
Bovine by Nick Gerace Rust Cloud Native
Verify GKE services are up with dedicated uptime checks
LFX projects open for (Northern) Fall term
Links from the interview Talos (the OS)
Linux from Scratch
Talos (the robot)
COSI
Comparing k3s to vanilla Kubernetes on Talos
Talos announcement on Reddit and Hacker News
Talos Systems Launch blog
Brazilian jiu-jitsu
COSI announcement from KubeCon EU 2021
Andrew Rynhard on Twitter
Cloud Native Patterns for Ops, with Justin Garrison
Justin Garrison is both a student and a teacher. A senior systems engineer in the media industry, he has boiled his experience and wisdom, as well as that of his co-author Kris Nova, into the book Cloud Native Infrastructure. He talks to Craig and Adam about the Kubernetes community and the process of writing.
Do you have something cool to share? Some questions? Let us know:
web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod
Chatter KubeCon NA '17 keynote: Your Philips Hue Light Bulbs Are Turned On By Kubernetes by Mark van Straten
Philips Lighting case study on Google Cloud
News of the week Cisco Hybrid Cloud Platform for Google Cloud is now generally available Enter the Cisco & Google Cloud Challenge! Win things!
Consul + Kubernetes from Hashicorp
Open Match announced by Google Cloud and Unity Agones 0.4.0 released
Couchbase Autonomous Operator
Amazon EKS now available in Ireland Google Cloud now available in Finland
Platform9 introduces spot instance arbitrage
External DNS 0.5.6 released
Red Hat on Kubernetes and application servers
Links from the interview mintCast, which featured Justin a long time ago
Cloud Native Infrastructure book: website and O'Reilly The Economics of Writing a Technical Book
Justin's last KubeCon talk: Let's Build Kubernetes, With a Spreadsheet and Volunteers!
Justin Garrison on Twitter and GitHub Dashiell, rothgar/v2
Justin's blog
