Software Development and AI with Scott Johnston at JFrog swampUP 2024

This is Textron tv. Hey everyone. We're back here.

Live day two of Swamp Up in Austin, 10th annual Swamp Up. You know, it's been a great show, but I, as I said earlier, we've got some real heavyweights coming up. Here's one of them.

It doesn't look that heavy. Yeah. Well come on.

But, uh, if you don't know Scott Johnston. Scott is the CEO of Docker, Scott. It's gotta be, what, six years, seven years that your CEO at Docker?

Oh, No, no. It's C-E-O-C-E-O coming up on five. Uh, and then You were Chief product Officer for long time before That, 10 plus a Docker.

So Yeah, I remember it's been a Journey. com and all the other affiliated sites, you've been there. Yeah.

Well, Scott's been a constant in, uh, in this seed, Hopefully growing together with the community industry. I, I was just gonna say, that can be good figure, Say, which side of that do I fall on? Exactly.

But you know, Scott, speaking of growing together, yeah. I would say the last year and a half has been some of the most profound change that I've seen. Yes.

In 30 plus years. Yes. Right.

In tech AI is responsible for a lot of it. We're gonna talk about it, but before we do, I know you were on stage here at Swamp Up today, spoke a little bit software supply chain, right. Software supply chain security for, you know, people watching this probably weren't here.

Hence they're watching this in hope. Sure. Um, give them a little, if you wouldn't mind, a little bit about what they missed.

Sure. And I, I think the whole conference is, is in the same spirit, which is one of the things we've learned over the last handful of years, and it's, it's, I think taken from other disciplines is that the more you can move things to the left, SDLC left to right and help developers make smart decisions early, or even better yet, have them start with known good. So they just focus on building their applications around the known good.

You solve so many problems downstream. Yeah. The analogy we like to use is, if you think about bricks and mortar manufacturing, right?

You think about automobile manufacturing. The, the modern manufacturing practices have the Andon cord on the line. Yeah.

So any, any line worker can stop the line and fix the issue right then and there because they've learned that fixing it then and there is the cheapest, safest, fastest way to do it. Versus it gets to inventory or it gets on the ship bound for the United States, or it gets into the showroom, or God forget it, God forbid it gets in the hands of a customer that then has to be recalled, like Each one of those, and that gets real expensive. Oh, Each one of those is orders of magnitude, right?

Yeah. And so that same mindset applied to software, it's like, help the dev make smart decisions, or better yet, they don't have to even make a decision. It's already there.

And good. And I think so many of our efforts, and Jfr is obviously a major partner here, is providing the dev with known good upfront. So outta the gate they're 10 x, a hundred x safer than they were Yeah.

In the old versus the old world. So that was a big part of the conversation. That last sentence though, I, it's, look, my background's security, right?

Yeah, For sure. We hear so much about, oh, this breach. I, I just got noticed by my credit monitoring agency that my social security's numbers on the dark web now, as many other people are, right?

Yes. Yes. I think I know where it came from.

A, I'm not gonna mention their name, But a, a, a national public company that sells boats, uh, was breached. And I got a letter from them that my information, including social security number, was part of that. Ouch.

Ouch. So now I've locked out, you know, had to lock down everything. But that being said, we worry more than ever about security for sure.

And you would think it's because our security's gotten worse, but it hasn't, our security's probably gotten better for sure. We're better at security for sure. Docker does great things around security, for sure.

Jfr does great things. A hundred percent the industry as a whole. But yet For sure, And it's Not enough.

It it, it's not enough. And that's because, uh, crime pays. I mean, it, it sounds great, but, but no, it does, crime pays, right?

And so I think, I think we have gotten a lot further, and I think one of the big shifts was instead of a prophylactic or a patch downstream, turn it around and go upstream and start with known good, right? So instead of like, oh, we have a cv, let's patch it down there before it goes to production, or let's, let's catch a vulnerability once it's actually deployed. Like, whoa, whoa, whoa.

Right? That gives the criminals plenty of surface area. So instead walk that all the way back up and we're, we're now getting the tools, the insights, the data, the, the automation to make that possible.

Yes. So I think we're fighting a good fight, but to your point, it's a fight that is a never ending one because crime pays. Yeah.

And they use Yeah, we talked about AI briefly. We're gonna talk more about it. Yeah.

They use the same AI we do. For sure. For sure.

Right. For sure. And they're using it for a different purpose.

For sure. And they, and I was talking earlier, I know if you had a chance to see this woman, Victoria Espinal this morning talk, no. org.

So she was the, um, the IP czar under Obama. Okay. She was responsible for negotiating trade agreements around ip.

What a no wh job that is, uh, with nations around the world. Right? Tough gig.

Tough gig. That's not a job I'd sign up for. And, and BSA org, uh, company now they, they help governments around the world draft legislation, and they're trying to draft legislation and make AI Mm-hmm.

Better. Mm-Hmm. Safer.

Safer, Sure. You know, the whole thing. But, but, but the point of it is, we, we need to, yes, it gets harder.

Yes. But we have nation states today that do stupid things. We have these, these guys, it's not just crime pays.

Crime pays big. Right? Right.

These guys are making, we are not, you know, you're not talking guys who are making 50 or a hundred bucks, they're looking Billions Of dollars figure. Right. Eight figures.

So it, it's important, um, I'd love to talk to you about what Docker specifically is doing on it, but I don't think we're gonna have time in 15 minutes. So if you don't mind, I'd like you to weave that in. Sure.

But let's talk about, you know, how AI is changing this whole software supply chain again, And, and there is an intersection there, right? Good. So we see, uh, gen AI having two fantastic fundamental transformations in software development.

One is the very nature, the very composition of applications is cha right? We spent the last decades, um, focused on code, compiled code and shipping it through the SDLC. And now of course, code will continue, but now developers wanna take advantage of the power of gen AI with that code.

So you're talking code and models and data that now have to be engineered and, and you have to bring engineering practices to now those two other artifacts that to date are software supply chains. Our tooling has just been focused on code. And so that's a change that we're all going through.

Jfr is already doing fantastic work there. We've got work going on in docker hub and our product line. The, the second is, um, if that's the, the what or the, the nature of applications, the how they're built is also changing.

Yeah. Right. The classic, the classic application development team is a, a pm a designer and a handful of engineers.

Great. So the, the, the gate to delivery there is just humans. Okay.

With Gen ai, we're now seeing that a lot of that code can be written by machines, can be written by agents, bots fix your favorite label. So now humans are no longer the gate. They're still playing a role.

They're guiding, they're giving definitions, they're giving requirements, they're checking the work. But now you can horizontally scale infinitely. Yes.

The, the bots that are cranking out the code, that are creating the tests that are, that are running the tests. And so the f the fundamental way in which software is developed is changing radically. And That like right before our eyes.

Right before our eyes, this is not a, this is not the usual evolution. No, no. We're, we're, we're, we're accomplishing in, uh, years or months what would take five years to a decade.

Absolutely. That it's that type of adoption. So coming back to software supply chain, you still need foundational secure components, whether that's a bot or a human that's putting together that application.

So they have to start with a known good base image. They want to use a secure database, they want to use a front end that has the appropriate security configurations. And so all of that means the foundational work that ourselves, jfr many of the partners here is doing, continues to be extremely relevant.

Um, you could almost argue more so relevant when there's an automated bot doing the work versus a human who might be Actually aware. Right? Right.

So it's exciting to see the intersection of all the work we've been doing on software supply chain intersect now this new emerging market around gen ai. And the other thing I will mention with the gen AI generated code is that code is only as good as the code you put into the LLMA Hundred percent into the training, the requirements that you've given it, the guidance that you've given it. A hundred percent.

And so there's that in there. You know, one of the things, Scott, it was in I think, Shlomi keynote yesterday was, you know, and, and I firmly believe this, there's two ways of looking at this AI thing. One is to kind of cower and fear that it's gonna take your job away.

And, and I'm not gonna sugarcoat it. There are gonna be some jobs lost even in development Or transformed at least. Good try.

Go ahead. Or the low end stuff. Yeah.

Yeah. But I think the, the other way of looking at it is, you know, it's like you put the boy in the room full of horse manure and the one boy says there's a pony here somewhere. Somewhere.

Absolutely. Absolutely. The other way of looking at it is, wow, I could harness this and think what a Uber developer I'm gonna be.

Correct. Correct. Now we, we look, if we go back and look at history of transformation of industries and technologies, yes, there's been retraining required.

Yes. Some of the lower and lower skilled roles have diminished, have diminished. But in no occasion, in no event has the market actually shrunk.

Never, Never. There's never less jobs. There's never less Jobs, there's never less opportunity.

There's never less innovation. It always expands the market. And so this is, I believe the lens, you just framed it nicely by analogy, that, that, that this industry is gonna unlock innovation across the board.

And we, we see it just in our world, through the lens of developers. There's 27 million mumble developers in the market today that's going to 45 million mumble by the end of the decade. Gen AI is gonna put not just 10%, 20% more there.

It's gonna make it accessible to orders of magnitude more. So we're talking half a billion developers in the market by the end of this decade, who are creating fantastic applications. Absolutely.

That is, that is opportunity. That is opportunity. It's an opportunity for Docker.

And let's talk about that because you've spent 10 plus years at Docker, and you are developing solutions for developers and DevOps and cloud native engineers and so forth. Right? Now all of a sudden, that 25 plus million, 40 million in 10 years, everybody's a developer with ai.

'cause AI makes me a developer. I don't need to know. That's natural language develop like a, a dream come true for early, early computer people.

How do you as dockers say, how do I serve that base? Sure. It's a different persona.

Yeah. They're a developer, but it's not that developer. It's, it's one that thinks about the customer problem, right.

Is able to articulate that customer problem to an agent or to a bot, and then to define the boundaries within which the bot is gonna generate that code. Check what comes back, oh, wait a minute. Need to tweak that boundary, tweak that definition, refine that requirement.

Um, look, we're already seeing it in the early days. We have, if, if I can, we have a, a very exciting extension to get up copilot. It's still in private preview, but we're already in, in talking and reviewing with customers.

We're already seeing like, Hey, this is fantastic because it does two things for me. One is it, it's a lower on-ramp to onboard my developers to docker. 'cause docker can be complex.

There are command lines, there are switches. And now it's like they talk to the bot, the bot walks them through it. Second is, it helps the developer take a legacy blob of code and transform that into a cloud native microservice that can be deployed to the cloud.

Crazy. Both of those, which by the way also isn't simple, right? It's, it's also not simple.

That's right. Right. So think about it for a second.

You can now take a task that used to require a 10 x engineer or a very senior staff engineer and let fresh kid fresh outta college come in. Just natural language. AI does it.

Right? Right. And so extend that out to where it goes naturally.

It's like all of a sudden you can come in with a customer problem. You, you, you know what good looks like, you know what the outcome looks like, but you don't necessarily know how to code c plus plus or you don't know how to code in rust. But you can guide Who needs to, You can guide the agents to an outcome.

Absolutely. And, and that, so to me, that's the world we're heading in. You know, rust today, you're a king of the universe, but tomorrow, B, FD.

Right. As long as you can define what good looks like, as long as you can define requirements, If I can define my requirements and tell the AI to develop it in raw, give it to me in rust, and it does, and I could use some other thing to kind of check it. You gotta be able to check it.

Right? 'cause 'cause human is still defining what good looks like. It's giving the guidance.

So you still have to have a clarity of, of mind. Right. Clear intention of what you're trying to accomplish, but you don't Have to.

And make sure that it does accomplish that. Correct. And then validate that.

That's right. So let me ask you a question though. Is that a way station for humans?

Because eventually, it seems to me we could probably automate that too. Well, so it, it's like turtles all the way down, right? Like where do your abstractions end at the end of the day, um, humans are, are approaching agents and bots with a desired outcome.

So, so you have to start with I wanna achieve this, right? I do that. It's To define that outcome.

That's Right. That's right. And that outcome can be broken down into steps or details or stages.

So, um, there is still human involved, but the way in which they're involved and the roles, like going back to like other industry shifts, like there's gonna be retraining, retooling, re-skilling, and those that lean in and are excited by that, they're gonna be in a fantastic position. Absolutely. Look, I, I'll tell you this, if I was, you know, 35 years younger, 40 years younger, coming outta school right now, I'd be excited.

So Wouldn't be drive, you wouldn't be allowed to drive if you were 35 years younger. Come on. Yeah.

Something like that. You're right. It depends what state you're in.

Right. But yeah, I was on a tractor when I was 12, but no. Alright, alright.

Um, but seriously, what a great time. Oh, to, I mean, 'cause the wide open, like the, the world's your oyster, right? That's right.

That's right. There's so much opportunity. Let me bring it back down to Docker though.

Yeah, please. When do you start building the solutions for these 500 million developers? I mean, we're already underway.

Um, I mentioned kind of near term the extension on copilot, right? We've got an integration with Nvidia that, that just launched a couple weeks ago to bring really democratize AI for developers and data scientists. So again, lower the friction demo, make it easier.

Right. Just mentioned the data scientist role. Yes.

Is that a new persona for you guys? It is. What's interesting, again, very community driven in the community.

Data scientists are already using Docker. Um, but they're data scientists. They're not engineers.

Right. So how do we make it simpler for data scientists to get the power of Docker as part of their workflow? Right.

And then we are already, uh, we have a group called Docker Labs publishing and producing agents and agentic workflows to show what this new world of agent to agent interaction looks like. That is, of course, guided by humans, but humans aren't the bottleneck. They're not in the middle of the work and interaction.

So we're already on that train. The community's been fantastic in their feedback and the future's so bright. We all need sunglasses.

I don't have my, where I wear our sunglasses. I love it. But, well, we've got the sun coming in here.

Hey Scott, just a little housekeeping people. Look swamp ups been great. Yes.

Dock con's. Another great Yes. Event.

What, what's the, what's the timeline on that? Watch this space. We'll be making an announcement soon.

So that's my tease. Okay. You've heard it here.

com Right? Is the, is the website Scott Johnston, CEO of Docker, here at Swamp Up talking AI software supply chain security. We're gonna take a break.

We'll be back with more. Stay tuned.