Container infrastructure at Google. containerd reviewer and security advisor.
- Triaging containerd's inbound vulnerability reports and fixing the real ones.
- Led GKE's migration to containerd 2.0. Published a socket tracer for finding workloads still on the removed CRI API.
- Driving the containerd Node Resource Interface to 1.0, the plugin API that node-level resource controls are built on.
- Co-authored KEP-5474 (writable cgroups). Authored KEP-2485, the ReadWriteOncePod access mode, stable in 1.29.



