Palantir: Building AI for Defense and Enterprise

Palantir: Building AI for Defense and Enterprise

Speakers: Shyam Sankar, CTO, Palantir

Conference: CS153 Infra @ Scale 2025

YouTube: https://www.youtube.com/watch?v=jB13kCmWT2k

Overview

In this insightful talk at CS153 Infra @ Scale 2025, Shyam Sankar, CTO and Executive Vice President of Palantir, provided a comprehensive look into the foundational infrastructure and philosophical underpinnings that enable Palantir to deliver cutting-edge AI capabilities for both defense and commercial enterprises. With 19 years at the company, Sankar shared a unique perspective on Palantir's evolution from a Stanford side project to a global leader in computing infrastructure, emphasizing the critical role of its software delivery and orchestration platforms in navigating highly complex, heterogeneous, and mission-critical environments.

The core of Sankar's presentation centered on Palantir's proprietary Apollo and Rubik's platforms, detailing how these systems address the unique challenges of deploying and managing software across air-gapped, on-premise, and cloud environments, often under extreme operational constraints. He highlighted how Palantir's approach, which treats software as the most malleable weapon system, allows for unprecedented speed and resilience in crisis situations, transforming traditional infrastructure constraints into strategic capabilities.

This talk is particularly relevant for infrastructure engineers, security professionals, and technology strategists interested in large-scale, secure, and adaptable software deployment in demanding sectors. Sankar's discussion extends beyond mere technology, delving into the broader implications of leveraging advanced software to rebuild trust in institutions, foster national security, and drive economic prosperity, underscoring Palantir's dual focus on "freedom and prosperity" through technology that connects decision-making from the factory floor to the highest levels of government.

Background

▶ Watch: Shyam's early career and joining the PayPal mafia (0:45)

Palantir emerged from a unique intersection of Silicon Valley ambition and a profound commitment to national security in the post-9/11 era. Shyam Sankar, the 13th employee, joined a small group driven by the desire to tackle critical problems for the government, a stark contrast to the prevailing consumer internet focus of the dot-com bust's aftermath. Initially, this mission was met with skepticism from the venture capital community, who viewed government work as a "waste of talent." Over time, this evolved into more political resistance, though Sankar notes a recent shift back towards recognizing the importance of such collaboration, echoing the 1950s when Lockheed Martin was Silicon Valley's largest employer.

The technological landscape at Palantir's inception was fundamentally different from today. Sankar recalled a time before AWS and S3, when infrastructure was predominantly on-premises, and monolithic applications were the norm. Scaling infrastructure was a nascent concept, largely confined to research environments like Google's. For Palantir, this challenge was compounded by the nature of its customers: air-gapped, classified environments that precluded remote SSH access and necessitated physical presence. Obtaining additional hardware could be a six-month process, creating immense pressure to optimize early on.

This environment meant traditional Site Reliability Engineering (SRE) models, where engineers had full root access and immediate incident response capabilities, were untenable. Palantir initially had to "forward deploy" SREs to customer sites, a manpower-intensive and unscalable approach given the heterogeneity of their deployments. Their infrastructure was not a handful of multi-tenant cloud stacks, but thousands of production environments, hundreds of which were air-gapped, running on platforms as diverse as M1 Abrams tanks, submarines, and large multi-tenant cloud setups. This extreme heterogeneity demanded an entirely new approach to software delivery and operations, laying the groundwork for the development of Palantir's bespoke infrastructure solutions.

Key Findings

▶ Watch: Personal story and motivation for national security work (2:15)

The central findings of Sankar's talk revolve around Palantir's innovative approach to software delivery, deployment, and operational resilience across highly diverse and mission-critical environments. The core contributions are the Apollo and Rubik's platforms, which together form a "software delivery infrastructure" designed to automate and abstract away the complexities of heterogeneous deployments.

Firstly, Apollo is highlighted as the linchpin enabling rapid, independent releases for thousands of microservices across thousands of production environments, including air-gapped systems. It transforms what was once an arduous, manual, and error-prone process of quarterly monolithic releases into a highly automated, declarative system. Engineers can define their dependencies, upgrade strategies (e.g., blue/green, soak times), and health metrics, entrusting Apollo to orchestrate canary deployments, auto-rollbacks, and provide comprehensive observability. This system processes approximately 100,000 upgrades per week, effectively replacing human SREs with "robots."

Secondly, Rubik's serves as Palantir's multi-tenant Kubernetes orchestrator, designed to abstract away the underlying differences between various environments. Crucially, Rubik's embeds regulatory compliance and security controls directly into software, moving beyond conventional human-driven processes. A standout feature is its approach to container image security: all container images are treated as immutable, with a maximum lifespan of 72 hours. They are randomly destroyed between 40 and 72 hours and rehydrated from fully patched new images, drastically reducing the window of opportunity for advanced persistent threats (APTs).

Finally, Sankar underscored the concept of the "decision chain" as a unifying abstraction for both defense ("kill chain") and commercial ("value chain") applications. This framework allows Palantir to apply insights and solutions developed in one domain (e.g., optimizing hydrocarbon production for BP) to seemingly disparate problems in another (e.g., building the Operation Warp Speed vaccine distribution supply chain). This cross-domain applicability, combined with the extreme malleability of software, enables Palantir to turn historical constraints (like code freezes during crises) into powerful capabilities, leading to rapid development and deployment, such as building the Operation Warp Speed system in just two weeks.

Technical Deep Dive

▶ Watch: Silicon Valley's changing views on government technology (3:40)

Palantir's ability to operate at scale across highly diverse and sensitive environments is fundamentally underpinned by its unique infrastructure, primarily Apollo and Rubik's. These platforms represent a decade-long journey to automate and abstract the complexities inherent in their operational model.

Apollo: The Software Delivery Infrastructure

At its core, Apollo is designed to manage the deployment and lifecycle of Palantir's vast microservices ecosystem. Sankar stated that Palantir manages roughly 5,000 discrete microservices across 1,000 production environments, with 100 of these being air-gapped. The sheer scale and heterogeneity necessitate an automated approach, given that manual SRE deployment is impractical and unscalable. Apollo orchestrates approximately 100,000 upgrades per week, a testament to its efficiency.

Before Apollo, Palantir's software development lifecycle involved monolithic quarterly releases, followed by "upgrade hell" where engineers would manually update environments using DVDs of binaries, struggling with dependency management and rollbacks. Mission-critical environments, such as early deployments in Iraq or Afghanistan, had tight upgrade windows (e.g., daytime only) where failure meant immediate rollback and mission disruption. This led to significant "environment drift," with systems falling behind by multiple releases.

Apollo revolutionized this by enabling engineers to release their code truly independently, without needing coordination across all 5,000 microservices. It achieves this through a declarative approach. Engineers define:

• Dependencies: What other services their microservice requires.
• Versions: Specific versions of dependent services.
• Upgrade Strategy: How the service should be upgraded (e.g., blue/green deployment).
• Health Metrics: How to measure the health of the service post-upgrade.
• Soak Time: A period to observe health before fully committing an upgrade.
• Auto-Rollback Logic: Conditions under which an upgrade should automatically revert.

Once these parameters are declared, Apollo takes over, orchestrating canary paths, blue/green upgrades, and providing comprehensive observability and telemetry. This allows product development engineers, even if sitting in Palo Alto, to be operationally responsible for their code, receiving pages at 2 AM for issues in any of the thousand environments, and having the tools to cut a new release and push it through the automated system. This increased velocity is crucial; Sankar noted that in crises, code velocity increases, treating software as the most malleable weapon system, as demonstrated by the Operation Warp Speed COVID vaccine distribution supply chain, which was built in two weeks.

Rubik's: Multi-Tenant Kubernetes Orchestration with Embedded Security

Rubik's builds on Apollo's foundation by providing a multi-tenant Kubernetes orchestrator that abstracts the underlying infrastructure from the application layer. This is vital because Palantir's environments are incredibly diverse – from commercial cloud instances to specialized hardware on M1 Abrams tanks. Engineers should not need to understand the nuances of Kubernetes on an M1 tank versus in a commercial cloud. Rubik's shields them from this complexity, ensuring consistent deployment and operation.

A key innovation in Rubik's is the embedding of compliance controls directly into the software, rather than relying on human processes or conventions. This is particularly important in heavily regulated and classified environments. Sankar provided a compelling example related to security:

• Immutable Container Images: Rubik's treats all container images as immutable. This means that once deployed, an image cannot be patched or modified.
• Ephemeral Containers: Instead of patching, every container image has a maximum lifespan of 72 hours. It is randomly destroyed between 40 and 72 hours and, upon rehydration, is pulled from a fully patched, new container image. This continuous rotation significantly raises the bar for adversaries, as an Advanced Persistent Threat (APT) would need to compromise every host every 72 hours.
• Declarative Ingress/Egress: Rubik's also manages network access declaratively, reducing the surface area for misconfigurations and vulnerabilities.

This design offloads significant operational toil from both production engineering and software development teams, as they no longer need to worry about manual patching or ensuring compliance with security controls. The system ensures that a first commit from an engineer is by default production-ready and compliant within the target environment, fostering rapid experimentation and deployment velocity.

Responding to Incidents: The Log4j Example

Sankar illustrated the power of Apollo and Rubik's with the Log4j vulnerability. Most enterprises struggle to even inventory their vulnerability surface area, but Palantir, through Apollo, knew the precise versions of all software running in every environment at t=0. Apollo's awareness of CVEs allows it to auto-rollback if a new CVE is identified for a running version, a process that happens 20,000 times a week without human intervention for less critical issues. For Log4j, Palantir cut a new release of the patched library, and within 24 hours, it was deployed across their entire surface area, effectively mitigating a widespread critical vulnerability with minimal manual intervention. This demonstrates how a robust, automated infrastructure can turn what would be a major crisis for most organizations into a non-incident.

Demo / Proof of Concept

▶ Watch: Palantir's early tech stack and on-prem, air-gapped challenges (4:40)

While the talk did not feature a live technical demonstration of Apollo or Rubik's in action, Shyam Sankar effectively illustrated their capabilities through compelling real-world examples and case studies. These examples serve as powerful proof points for the effectiveness of Palantir's infrastructure in diverse and demanding scenarios.

One prominent example was the Operation Warp Speed initiative during the COVID-19 pandemic. Sankar highlighted that Palantir built the entire COVID vaccine distribution supply chain software in just two weeks. This rapid deployment was directly attributed to the malleability and speed afforded by their underlying platforms. The ability to quickly adapt and deploy mission-critical software in a crisis, rather than freezing code, showcased the "software as a malleable weapon system" philosophy in practice.

Another significant illustration was Project Maven, initiated by the US government around 2017 to explore "algorithmic warfare." Sankar explained how Palantir utilized computer vision on space-based sensors to identify objects like missile silos or transporter erector launchers, which constitute an infinitesimally small percentage of a sensor's field of view. The platform enabled rapid analysis and targeting, dramatically accelerating the OODA loop (Observe, Orient, Decide, Act) – a doctrine for rapid decision-making in warfare. This project demonstrated the ability to process vast amounts of data, apply advanced AI models, and integrate findings into decision-making processes at speed, moving from finding "a thousand things to destroy in 24 hours" to complex logistical and predictive resupply challenges.

Sankar also provided a commercial example involving BMW during the Ukraine war. A $5 wiring harness from Ukraine experienced intermittent supply, threatening the shutdown of BMW's Munich factory. Palantir's Warp Speed platform (a commercial offering based on similar principles) enabled BMW to dynamically re-plan production based on available inventory, shifting from a left-to-right customer order fulfillment model to a right-to-left "what can I build with what I have" model. This problem, which traditional SAP systems couldn't handle, was solved in "a couple days" using Palantir's software, preventing significant production disruptions. These examples collectively underscore the practical impact and versatility of Palantir's infrastructure in solving complex, real-world problems at an unprecedented pace.

Defensive Implications

▶ Watch: Palantir's unique scaling challenges with heterogeneous environments (6:05)

Palantir's approach to infrastructure and software delivery offers several profound defensive implications for organizations facing sophisticated cyber threats and operational challenges. The core strategies embedded in Apollo and Rubik's provide a blueprint for building highly resilient and secure systems.

Firstly, the automated and declarative nature of Apollo significantly enhances an organization's defensive posture by ensuring consistency and rapid response. As demonstrated with the Log4j vulnerability, Palantir's system immediately identified the full vulnerability surface area across thousands of environments. Apollo's built-in CVE awareness and auto-rollback capabilities mean that for many vulnerabilities, patches or mitigations can be applied and verified automatically, often without human intervention, or at least with drastically reduced manual effort (e.g., Log4j patched across thousands of environments in 24 hours). This dramatically shrinks the window of exposure, a critical factor in combating fast-moving threats.

Secondly, Rubik's unique security model, centered on immutable container images and their ephemeral nature, provides a robust defense against advanced persistent threats. By ensuring that no container image lives longer than 72 hours and is randomly destroyed and rehydrated with a freshly patched version, the effort required for an adversary to maintain persistence within the environment becomes exponentially higher. An attacker would need to re-compromise every host every 72 hours, a formidable challenge that significantly deters nation-state actors and sophisticated APTs. This approach essentially eliminates the common patching toil and the associated risks of missed patches or configuration drift that often create vulnerabilities.

Thirdly, the principle of embedding compliance and security controls into software rather than relying on manual processes or conventions is a powerful defensive strategy. This programmatic enforcement ensures that security best practices are applied consistently across all heterogeneous environments, from cloud to air-gapped systems. Declarative management of ingress/egress rules, for instance, reduces human error and establishes a clear, auditable security posture by default. This "security by design" philosophy ensures that even a developer's first commit is production-ready and compliant, preventing security debt from accumulating.

Finally, Palantir's philosophy of turning "constraints into capabilities" and embracing increased code velocity during crises is a paradigm shift for defensive operations. Instead of freezing changes during an incident, which can hobble an organization's ability to adapt, Palantir's infrastructure enables rapid iteration and deployment of defensive measures. This agility allows organizations to respond dynamically to real-world events, such as instantaneous spikes in user load during geopolitical crises, by quickly scaling resources or deploying new protective functionalities. This proactive, software-defined resilience is crucial for modern defense in an era of rapidly evolving threats.

Key Takeaways

• Automated, Declarative Software Delivery is Essential: Palantir's Apollo platform automates the deployment and management of 5,000 microservices across 1,000 heterogeneous production environments (including 100 air-gapped ones), processing 100,000 upgrades per week and enabling engineers to declaratively define their release strategies and health metrics.
• Embedded Security through Ephemeral Infrastructure: Rubik's, Palantir's Kubernetes orchestrator, enforces security by treating all container images as immutable and ephemeral, with a maximum lifespan of 72 hours. Images are randomly destroyed and rehydrated from fully patched versions, making persistence for advanced threats extremely difficult.
• Rapid Incident Response and Vulnerability Management: The infrastructure enables unprecedented speed in mitigating critical vulnerabilities, as demonstrated by patching Log4j across their entire surface area within 24 hours, largely through automated inventory and deployment mechanisms.
• Software as a Malleable Weapon System: Palantir's platforms allow for increased code velocity during crises, transforming traditional constraints (like code freezes) into capabilities, exemplified by the two-week development of the Operation Warp Speed supply chain and the rapid iteration in Project Maven.
• Universal "Decision Chain" Abstraction: The underlying architectural principles apply equally to defense ("kill chain") and commercial ("value chain"), enabling cross-domain learning and problem-solving, from optimizing oil and gas production to designing ships or managing automotive supply chains.
• Rebuilding Institutional Trust through Precision Control: Palantir's mission extends to providing "real steering wheels" to institutions (government and commercial) by connecting decision-makers with real-time feedback and control, fostering competence and trust in an era of "legitimation crisis."

About the Speaker(s)

Shyam Sankar is the Chief Technology Officer (CTO) and Executive Vice President of Palantir Technologies, where he has been a pivotal figure for nearly two decades, joining the company as its 13th employee. His journey began after graduating from Cornell for his undergraduate studies and later attending Stanford, where he sought to enter the burgeoning Silicon Valley tech scene. Sankar was an early employee at Xoom (co-founded by Kevin Hartz), connecting him to the influential "PayPal mafia."

Driven by a deep-seated interest in national security, stemming from his family's refugee experience and a desire to contribute after 9/11, Sankar found his calling at Palantir. He has been instrumental in shaping Palantir's technological vision and infrastructure, overseeing the development of core platforms like Apollo and Rubik's that enable the company to tackle some of the world's most complex data and operational challenges for both defense and commercial clients. Sankar is known for his philosophical approach to technology, viewing Palantir's mission through the lens of enhancing "freedom and prosperity" by building software that empowers institutions and pushes the efficient frontier of security and civil liberties.