Change with Confidence: Containerlab at Proton#

Speakers: John Howard (Proton)

• Why: This is the strongest talk on the program for anyone running DC fabric operations: a full production migration story — vendor switch, greenfield build, and an 86-device brownfield cutover — where the entire risk was retired in container-based labs before hardware shipped. It is a transferable process story, not a Proton anecdote.
• What: Proton (privacy services, ex-CERN) built a new Norwegian datacenter in 2024 on a vendor they had never operated (Nokia 7220 IXR / SR Linux fabric, 7750 SR-1 / SR OS edge), with no hardware lab available, and then repeated the trick in 2025 with an 86-device Swiss brownfield migration plus a 23.10→24.10 upgrade backfilled to Norway. Reported results: 36 devices racked-to-in-service in 14 days, zero post-deploy config changes, and 100% of scaling limits measured in containerlab held on real hardware. The slides are candid about why they left Juniper (QFX hardware failure cascades, monthly bugs, weak virtual lab tooling, pricing) and about containerlab's limits.
• How: Containerlab runs vendor-faithful NOS container images (not slow QEMU VMs like vQFX/vMX) with YAML topology + configs + deploy/test scripts versioned in a repo; a whole multi-layer EVPN-VXLAN fabric fit on a 32 GB laptop. Validation covered control plane and data plane (Linux netns/vnet links for capture, injection, flap, packet loss). Design changes in round two: VRF leaking replaced with interface ACLs toward the core, simplified anycast routing, and unnumbered IPv6 BGP everywhere (numbered BGP and OSPF removed). Documented failure modes include HW-only bugs (a gNMI race when tagging many VLAN interfaces, link-local ND quirks, BFD-over-unnumbered-BGP broken in v23) and lifecycle gaps (an upgrade that swapped CentOS for Debian and missed SSD trim) — caught during commissioning, not in prod.
• Where applicable: Broadly applicable to any shop building or migrating EVPN fabrics — the technique is vendor-agnostic in principle (containerlab supports multiple NOSes), though the faithful-image claim and the 100%-scaling-figures-held result are specific to Nokia-provided SR Linux images. Performance testing is explicitly out of scope for containers ("you can't speed test a container"). Next steps stated: CI/CD for every change (templates → CMDB → config → lab → prod) and a Clabernetes cluster to lab the global network. Based on the speaker's slides.