Accepted Sessions

You can describe WordPress and its database in a Compose file in about five minutes. Getting that same stack onto a Kubernetes cluster usually means starting over: learn Helm, learn the packaging tooling, and rebuild by hand what you had already described once.

compose-bridge-uds shortens that path. It’s a Docker Compose Bridge template that reads your resolved Compose model and emits a Helm chart plus a package definition you can build and deploy. We’ll take a stock WordPress and MySQL Compose file and walk it all the way to a running deployment.

It lands on UDS Core, an open source platform bundle that supplies the pieces you would otherwise wire up yourself: ingress with TLS, single sign-on, network policy between services, and logging and monitoring on by default. So the converted WordPress package arrives somewhere authentication and traffic rules are already handled, instead of being the next three problems on your list.

Most engineers know TLS certificates exist. Few know that every certificate ever issued is recorded in a public, searchable, append-only log, and that anyone can search it.

Certificate Transparency was designed to improve the security of the web's certificate infrastructure. As a side effect, it creates a permanent public record of infrastructure that developers often assume is private. That staging environment with no authentication. That internal tool on an obscure subdomain. That dev portal behind a domain nobody was supposed to know about.

Security by obscurity has always been a weak strategy. CT logs make it a nonexistent one.

In this session we'll cover how Certificate Transparency works, why it exists, and what it means for anything you've ever deployed behind a TLS certificate. We'll use real search tooling to find exposed infrastructure live, walk through two real examples of sensitive services discovered this way (including one that was responsibly disclosed and quietly taken down), and end with a practical framework for auditing your own domains before someone else does.

You'll leave knowing how to search CT logs, what to look for, and how to make better decisions about what should and shouldn't have a public certificate attached to it.

Abstract
AI in Drupal has moved past demos. This session shows how we use AI features built into Varbase to cut repetitive editorial work across client sites, from alt text and tagging to content review and generated metadata. We'll also look at how Drupal Canvas and AI are changing page building, with examples from our current redesign work for the University of Tennessee at Chattanooga.

Description
Content teams spend a large share of their time on work that is necessary but repetitive: writing alt text, tagging content, drafting meta descriptions, checking pages for accessibility and SEO. We've built these tasks into Varbase so editors get AI help directly inside Drupal, with review and approval built in.

AI in Varbase, in production today

• AI alt text and taxonomy tagging: consistent, accessible image descriptions and cleaner content classification at scale
• Context Control Center (CCC): giving AI the brand, tone, and site context it needs to guide content updates and generate supporting content like FAQs and metadata
• AI content review: quality, clarity, and consistency checks before content goes live
• MCP for Varbase: connecting AI agents directly to Drupal to take action on the site
• Automatic meta descriptions
• AI-generated HTML tables from source content
• Image generation, including animated SVGs

Drupal Canvas and AI

• Figma to Canvas: turning designs into working Canvas components and pages faster
• Canvas AI review: SEO, accessibility, and page-build checks while pages are being assembled

Attendees will learn

• Which AI features deliver real time savings for content teams, and which don't yet
• How to give AI enough context to produce on-brand, usable output
• How Drupal Canvas and AI speed up design-to-page workflows
• How to keep editorial control and accessibility standards in place when using AI
• Where MCP and agent-based workflows are taking Drupal next

We'll start with a quick overview of the 'Visual Effects' projects at Linux Foundation.

We will then provide a deeper dive on the Academy Software Foundation.

We will talk about the history, members, current projects, how new projects are adopted, governance, etc.

Come have some fun peaking behind the scenes at some tech that is 'behind the scenes' - very Inception like. :)

Containers are supposed to solve "works on my machine."

They often do, right up until you move the application to a different environment.

A workload can have a Dockerfile, production container images, mature Helm charts, and years of Kubernetes experience behind it, and still require real engineering work before it will run somewhere new. The problem is not usually the container itself. It is the assumptions hidden around it.

Applications make assumptions about networking, identity, certificates, storage, CPU architecture, filesystem behavior, outbound connectivity, cloud services, and the platform they were originally built to run on. Helm charts can encode even more of those assumptions. Most of them stay invisible until the application leaves the environment where they were originally satisfied.

This talk explores the difference between a containerized application and a portable one, using patterns drawn from real application onboarding and platform integration work.

A major focus will be the distinction between configuration effort and engineering effort. Changing an endpoint, providing a secret, or supplying a certificate is configuration. Changing an application because it assumes internet access at startup, depends on a specific identity model, requires privileged execution, or cannot support a different trust model is engineering.

Attendees will learn how to recognize these portability smells earlier, ask better questions before migration work begins, and evaluate whether a target environment can be expressed through configuration the application already supports, or whether the application itself needs to change.

Containers make environments more reproducible.

Portability is something the application still has to earn.

Most universities and large organizations run dozens of websites, often one per department or program, across Drupal, WordPress and more. Each has its own versions, owners and security exposure, tracked in a spreadsheet that was accurate once.

As an agency, we hit this with almost every client. Security advisories came by email, one site at a time, and every tool we tried covered only part of the picture. This session shares what we learned fixing that:

• Seeing security advisories and outdated core, modules and plugins across every site in one place
• Knowing which sites are patched and who owns the fix
• Checking best practices (accessibility, SEO, performance) continuously, not once a year
• Turning policies into automated checks with evidence ready when asked

We'll briefly show the platform we ended up building, but the focus is patterns and open source building blocks you can use on your own sites.

AI and Drupal Canvas are changing how we build websites, but what do these tools actually mean for everyday Drupal site builders?

In this beginner-friendly session, we’ll introduce Drupal’s AI capabilities and the visual page-building experience of Drupal Canvas. Through practical demonstrations, you’ll see how these tools can simplify common tasks, improve content creation, and make building pages easier.

We’ll explore what each tool does, where they fit into your existing workflow, and how to get started. You’ll also walk away with a fully customizable, ADA compatible theme that uses canvas and AI.

No AI or Drupal Canvas experience required. Just bring your curiosity and a willingness to explore what’s next for Drupal site building.

Somebody in this room is going to pitch an app, and it will be live on the internet before the session ends.

ScriptHammer is an open source Next.js template that runs real client sites. This talk is about what happens when you hand a template to someone else — and about running the project that maintains it, where most of the work is done by AI agents filing tickets, opening pull requests and getting told no.

We start with a field study. RaisedPaws.com is a pet adoption tracker that shares ScriptHammer's very first commit and went live on its own domain about ten weeks later. We'll look at what it inherited for free and what its team actually had to build.

Then we do it live. Take a suggestion from the room, fork the template, run the rebrand script across 2,872 files, sketch the wireframes and push. GitHub Pages does the rest in about six minutes. You get the repository afterwards.

Along the way, the uncomfortable part: most of the bugs I found last year were not failing tests. They were passing ones that measured nothing — including an account deletion that deleted nothing and reported success. We'll look at how agents make that failure mode more common, and the gate that now catches it.

You will leave knowing whether this template is worth forking, and with a way to tell whether your own green checks mean anything.

Session agenda:

• Introduction
• Understanding Enterprise Problems
• How To 'Date' Enterprise Customers
• Exclusive Content - My Top Enterprise Gaps The Are Underdeveloped / Untouched / Poorly Monopolized
• Exclusive Content - Open idea exchange session

Exclusive Content Warning: To foster open discussion on unrealized potentially lucrative ideas, the final segment of this session will not be recorded. This in-person-only, idea-exchange segment will cater to open discussion about ideas that could potentially evolve into businesses.

Previously, smaller businesses that couldn't afford to drop tens of thousands of dollars on custom software to streamline their workflows, had to just wing it with spreadsheets, or check lists, etc,  and just deal with the human error that goes along with that.
Now in the era of AI coding, they can vibe together what they want.
This will most likely be a security nightmare, but they have just brain-dumped their requirements for you. The discovery phase of this project is now 80%+ done. 
You can build a better, professional, more secure, and future proof version using their vibe-coded prototype as an example.
Previously you have to have lots of meetings, lots of documents flying backwards and forwards for the specifications. Where previously there would be a miscommunication of different functions, you now have a "working" example.

Using their vibe coded app, as a "prototype to throw away", then building and deploying a professional built app, for a lot less than the pre AI era. As you will also be using AI to help build.

This talk shows you one way to build these kinds of apps for your clients, quickly and securely, and deploy live easily.
We will use the Open Source technologies of Laravel, Filament, and make use of Laravel/Boost AI guidelines built into the tool.
From Database schema to working app in almost no time at all.
 

The purpose of this session is to provide an overview of Nextcloud, the open source content collaboration platform being used by tens of millions of people in thousands of organizations across the globe, and use it as an example of how open source works and the variety of applications available as free open source software. Attendees will learn how to get a Nextcloud account, how to navigate and set up the app, how to use it for their purposes, and how it works with other open source apps and services. They will also learn about what open source software is and its strategic implications — how it saves money, increases flexibility, and enables innovation.