Method and apparatus for container deployment in network constrained environment

Abstract

Systems, apparatus, articles of manufacture, and methods for deploying containers in a network constrained environment are disclosed. An example apparatus includes an interface circuit; a machine readable instruction; and programmable circuitry to at least one of instantiate or execute machine readable instructions to: access a first unencrypted shared file; accessing a second encrypted file; creating a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; and deploying the third file to the container runtime environment for execution.

Description

[0001] Related Applications

[0002] This patent originates from the national phase of International Application No. PCT / CN2023 / 111667 filed on August 8, 2023. International Application No. PCT / CN2023 / 111667 is hereby incorporated by reference in its entirety. Priority to International Application No. PCT / CN2023 / 111667 is hereby claimed. Technical Field

[0003] The present disclosure relates generally to computing virtualization and, more particularly, to methods and apparatus for container deployment in network constrained environments. Background Art

[0004] Computing virtualization is the use of a virtualized or emulated computing environment rather than a physical environment. Virtualization often utilizes emulated versions of hardware, operating systems, peripherals, etc. Containers are a form of virtualization. Containers typically include executable files, binary code, libraries, configuration files, etc. to enable execution of specific tasks and / or programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 is an example container image format showing supplemental and common layers.

[0006] Figure 2 Is a sample environment for launching applications.

[0007] Figure 3 It is used to realize Figure 2 Block diagram of the application enabler circuit.

[0008] Figure 4 and Figure 5 is a representation that can be executed, instantiated and / or run by an example programmable circuit to implement Figure 2 A flowchart of example machine readable instructions and / or example operations of an application launcher circuit.

[0009] Figure 6 is used Figure 2 An example implementation of an open source project for an application launcher circuit.

[0010] Figure 7 is an example per-layer encryption method.

[0011] Figure 8 is used Figure 7 An alternative container image format for the per-layer encryption method.

[0012] Fig. 9 is comprised of example machine-readable instructions and / or programs configured to execute, instantiate and / or run Figure 3 and / or Figure 4 Example operation to achieve Figure 2 Block diagram of an example processing platform with a programmable circuit for an application enabler circuit.

[0013] Fig.10 yes Fig. 9 A block diagram of an example implementation of a programmable circuit.

[0014] Fig.11 yes Fig. 9 A block diagram of another example implementation of a programmable circuit.

[0015] Generally, the same reference numbers will be used throughout the drawings and accompanying written description to refer to the same or like parts.The drawings are not necessarily drawn to scale.

[0016] As used in this patent, stating that any part (e.g., a layer, film, region, area, or plate) is in any way on (e.g., located, positioned on, disposed on, or formed on, etc.) another part indicates that the referenced part is either in contact with the other part or that the referenced part is above the other part with one or more intermediate parts located therebetween.

[0017] Unless otherwise expressly stated, descriptors such as "first", "second", "third", etc., used herein are not attributed to or otherwise indicate any meaning of priority, physical order, arrangement in a list, and / or ordering in any way, but are merely used as labels and / or arbitrary names to distinguish elements so that the disclosed examples are easy to understand. In some examples, the descriptor "first" may be used to refer to an element in a specific embodiment, while the same element may be referred to by a different descriptor (e.g., "second" or "third") in the claims. In this case, it should be understood that such descriptors are only used to clearly identify those elements within the context of a discussion where those elements may, for example, otherwise share the same name (e.g., within the claims).

[0018] As used herein, the phrase "communication" (including variations thereof) encompasses direct communication and / or indirect communication through one or more intermediate components, and does not require direct physical (e.g., wired) communication and / or continuous communication, but additionally includes selective communication at periodic intervals, scheduled intervals, non-periodic intervals and / or one-time events.

[0019] As used herein, "programmable circuitry" is defined to include: (i) one or more special-purpose circuits (e.g., application-specific integrated circuits (ASICs)) that are constructed to perform specific operations and include one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors); and / or (ii) one or more general-purpose semiconductor-based circuits that are programmed with instructions for performing specific functions and / or operations and include one or more semiconductor-based logic devices (e.g., electrical hardware implemented by one or more transistors). Examples of programmable circuitry include programmable microprocessors, such as a central processing unit (CPU) that can execute a first instruction to perform one or more operations and / or functions, a field programmable gate array (FPGA) that can be programmed with a second instruction to configure and / or construct the FPGA to instantiate one or more operations and / or functions corresponding to the first instruction, a graphics processor unit (GPU) that can execute a first instruction to perform one or more operations and / or functions, a digital signal processor (DSP) that can execute a first instruction to perform one or more operations and / or functions, an XPU that can execute a first instruction to perform one or more operations and / or functions, a network processing unit (NPU) or one or more microcontrollers, and / or integrated circuits (e.g., application-specific integrated circuits (ASICs)). For example, an XPU may be implemented by: a heterogeneous computing system that includes multiple types of programmable circuits (e.g., one or more FPGAs, one or more CPUs, one or more GPUs, one or more NPUs, one or more DSPs, etc. and / or any combination thereof); and orchestration technology (e.g., an application programming interface (API)) that can dispatch computing tasks to any of the multiple types of programmable circuits that are suitable and available to perform the computing tasks. DETAILED DESCRIPTION

[0020] In order to deploy a container-based application on a computing device, the container image must be sent from an image repository (e.g., a remote image repository) to a local file structure. The size of a container image is typically on the order of hundreds of megabytes and can be as large as several gigabytes. If the computing device is operated in a network-constrained environment (e.g., an edge cloud), the transmission of container images places a heavy burden on the network. An edge cloud is likely to host multiple edge applications. This makes the situation worse and results in a large delay in launching applications at the edge.

[0021] In the existing container image format standard, a container image can include multiple layers. The content of each layer is uniquely identified by a hash value calculated from a public algorithm. When obtaining a container image, if the same identifier can be found in a previously obtained local cache layer, the bandwidth used for the transmission of certain layers can be saved.

[0022] Each image layer can contain many files. For two layers, even if there is only one different file, the identifiers of the two layers will be different, which greatly reduces the benefit of layer reuse.

[0023] In the examples disclosed herein, a container image format is used that defines two layers: supplementary layers and public layers. The supplementary layers contain a calculated identifier associated with each file instead of the actual file content. In some examples, the calculated identifier includes a hash value. The public layer contains the real file content. Any number of public layers and / or supplementary layers can be included in a container. For example, a container can include a single public layer and a single supplementary layer. Alternatively, a single public layer and two or more supplementary layers can be used. As another example, two or more public layers and a single supplementary layer can be used.

[0024] The examples disclosed herein maintain a local file pool for public files. Each file is identified by a hash value.

[0025] In the examples disclosed herein, the container launcher requests public files from the local file pool when needed during the launch of an application or the construction of a local file structure to launch / execute an application. In some examples, the container launcher implements a virtual execution environment (VEE) (e.g., a container image, a virtual machine, an operating system, etc.).

[0026] The examples disclosed herein reduce the amount of data to be sent for container images (e.g., saving bandwidth), reduce the latency of starting container-based applications (e.g., improving system performance), and enable fast application upgrade and rollback solutions.

[0027] Container-based applications are often built on popular OS images (e.g., CentOS, Ubuntu, BusyBox, Alpine, etc.). A large number of files are shared between these applications. The example method disclosed herein proposes a container image format to make these shared files fully sharable in a network-constrained environment (e.g., edge cloud).

[0028] Figure 1 is an example container image 100 including a common layer 110 and a supplemental layer 120. Figure 1 In the example of FIG. 1 , the supplemental layer 120 is layered below (eg, subsequent to / after) the common layer 110 .

[0029] For the public layer 110, the layer format defined in the existing container image format is used. The public layer 110 is a layer whose content can be addressed by an identifier. This layer contains real files. The public layer 110 is suitable for the basic OS layer and the layer for specific application binary files. Figure 1The common layer 110 includes a common layer header 112 and common layer data 114. The common layer header 112 includes general information about the common layer 110 (e.g., how much data is stored in the layer, identification information (e.g., location) of the source of the data, etc.). Examples of data stored in the common layer data 114 include, but are not limited to, file identifiers, file structures, file address locations, etc.

[0030] Supplementary layer 120 includes supplementary layer header 122 and supplementary layer data 124. In the examples disclosed herein, supplementary layer 120 supplements (e.g., adds, subtracts, replaces, etc.) common layer 110 to launch / execute an application. In some examples, supplementary layer header 122 includes general information about supplementary layer 120 (e.g., how much data is stored in the layer, identification information (e.g., location) of the source of the data, etc.).

[0031] exist Figure 1 In the example of , the supplemental layer data 124 may include file structures, hash values, metadata, etc. Figure 1 In the example of , each file associated with the supplementary layer 120 is represented by a hash value plus some metadata information (e.g., file name, path, attributes, etc.). In operation, the supplementary layer 120 is suitable for layers with common dependencies (e.g., common libraries, tools, etc.).

[0032] In some examples, the container image 100 is created using a first file associated with the common layer 110 and a second file associated with the supplemental layer 120. In such examples, the container image 100 is created by merging the first file and the second file (e.g., combining, concatenating, supplementing, etc.). The first file is accessed from a storage device (e.g., a non-transitory computer-readable medium), and the second file is also accessed from the storage device. In this example, the container image 100 is also referred to as a third file.

[0033] Figure 2 is an example environment 200 for launching an application. Figure 2 In the illustrated example, the central cloud 210 communicates with the edge cloud 240 via a network connection, a remote connection, a wireless connection, etc.

[0034] The example central cloud 210 includes a remote image repository 220 and a remote file cache pool 230. The remote image repository 220 holds container images (e.g., container image 100). In some examples, the remote image repository 220 stores all container images within the environment and can be accessed by the edge cloud 240. In the examples disclosed herein, the remote image repository 220 populates the common layer 110 and the supplemental layer 120.

[0035] The remote file cache pool 230 holds cache files to be accessed by the edge cloud 240. In some examples, the remote file cache pool 230 holds cache files for the entire environment, allowing the edge cloud 240 to access cache files that are not locally available to the edge cloud 240. In the examples disclosed herein, the first file associated with the common layer 110 and / or the second file associated with the supplemental layer 120 can be stored in the remote file cache pool 230. In some examples, the first file and the second file correspond to a data structure representing the container image 100.

[0036] exist Figure 2 In the example shown, the edge cloud 240 includes an application launcher 250, a local file cache pool 260, and a plurality of applications 270, 272, 274. Figure 2 The examples shown in FIG. 1 show more than one application, but the examples disclosed herein may operate in an environment with a single application to be executed / launched.

[0037] The application launcher circuit 250 executes / starts the application in the edge cloud 240. To start the application in the edge cloud 240, the application launcher circuit 250 pulls (e.g., obtains, gets, requests, etc.) the container image 100 of the application 270, 272, 274 from the remote image repository 220. In some examples, the size of the image is relatively small (e.g., less than 300 megabytes). The application launcher circuit 250 parses the container image 100 and begins to build a file structure for the application 270, 272, 274 based on the files associated with the common layer 110 and the supplementary layer 120.

[0038] The local file cache pool 260 includes local cache files corresponding to the hash values ​​and / or metadata. These local cache files can be obtained by the application launcher circuit 250 to build file structures for applications 270, 272, 274 relatively quickly because these files do not need to be obtained from the central cloud 210. In some examples, the files cached in the local file cache pool 260 correspond to previously launched / executed applications. In other examples, the files cached in the local file cache pool 260 correspond to new and / or expected applications to be launched / executed. In the examples disclosed herein, the first file associated with the public layer 110 and / or the second file associated with the supplementary layer 120 can be stored in the local file cache pool 260.

[0039] For the common layer 110, the application launcher circuit 250 checks whether the files associated with the common layer 110 have been cached before (e.g., cached locally in the local file cache pool 260). Then, if the cached files exist, the application launcher circuit 250 can reuse them. Alternatively, the application launcher circuit 250 can initiate a request for files from the remote image repository 220.

[0040] For each file associated with the supplemental layer 120, the application launcher circuit 250 obtains the file corresponding to the hash value (either from the local file cache pool 260 or from the remote file cache pool 230). Once the file is obtained, the launcher stores the file in the local file cache pool 260 for later use. To increase efficiency, in some examples, the launcher can request all unavailable files of a layer with one request.

[0041] Once the file structure is ready, the application launcher circuit 250 launches / executes / starts the application. In some examples, for container-based applications, more than one application may be included in a single container image. The container image contains all the dependencies required by these applications. Using this approach simplifies the building and / or publishing of applications. When launching one of those applications, not all files in the container image are needed. Therefore, the loading time of those unused files can be saved.

[0042] In some examples, the loading of a file is postponed until the file is needed. For example, assume that there is a dynamic library "a.so". During the process of building the file structure, the application launcher circuit 250 does not need to pull "a.so" from the remote file cache pool 230, even if it is not available locally. When the application is started in the container image, if the library is needed, a file missing will occur. At this time, the application launcher circuit 250 will ingest "a.so" from the central cloud 210. If the library is not needed during the startup of the application, the ingestion operation will not occur and some bandwidth can be saved.

[0043] This post-loading can affect the startup time of the application. Since the application launcher circuit 250 knows which application is to be launched, the application launcher circuit 250 can analyze the dependencies of the application and ingest all the required files when building the file structure. For example, for C / C++ applications, tools such as ldd, readelf, objdump, etc. can be used to get all the dependencies. In this way, file missing can be reduced as much as possible and the impact on the startup time of the application can be avoided.

[0044] In some examples, for better performance, the local file cache pool 260 can be built on a storage device that meets two operating requirements: data persistence and high read / write performance. For example, PMem and NVMe SSD are suitable for this use case. In some examples, a CXL-based non-volatile memory pool may also be suitable for use.

[0045] Figure 3 It is shown Figure 2 2 is a block diagram of an example implementation of the application launcher circuit 250. Figure 3The example application launcher circuit 250 includes a central cloud communication circuit 310, a container image analyzer circuit 320, a file structure builder circuit 330, an application distribution circuit 340 and an application executor circuit 350.

[0046] The central cloud communication circuit 310 communicates with the central cloud 210. In some examples, the central cloud communication circuit 310 sends instructions and / or requests to the central cloud 210 to obtain the container image 100 from the remote image repository 220. In some examples, the central cloud communication circuit 310 sends instructions and / or requests to the central cloud 210 to obtain a file containing a hash value associated with the supplemental layer 120 from the remote file cache pool 230.

[0047] The container image analyzer circuit 320 analyzes the container image 100. In some examples, analyzing the container image 100 includes identifying the common layer 110 and / or the supplemental layer 120. In some examples, analyzing the container image 100 includes determining whether the file and / or layer is cached in the local file cache pool 260.

[0048] The file structure builder circuit 330 builds a file structure to launch / execute one or more applications. In some examples, each application uses a different file structure, so the file structure builder circuit 330 builds a file structure for each application. In other examples, multiple applications can use a shared file structure or part of a file structure (e.g., one or more files are shared), and the file structure builder circuit 330 takes into account the shared files to build the file structure.

[0049] The application allocation circuit 340 allocates files in the file structure based on the application to be launched / executed. In some examples, where each application utilizes a separate file structure, each file in the file structure is allocated separately. In other examples, where more than one application shares a file, each unique file (e.g., each file that is not shared) is allocated separately, and shared files are allocated once.

[0050] The application executor circuit 350 launches / starts the application. In some examples, the application executor circuit 350 launches each application individually. In the case where another application to be launched requires a specific application, it may be desirable to launch each application individually. In other examples, the applications are launched in parallel (e.g., simultaneously).

[0051] Figure 3 The application launcher circuit 250 may be instantiated (e.g., created as an instance, made to last any length of time, materialized, implemented, etc.) by a programmable circuit (e.g., a central processing unit (CPU) executing a first instruction). Additionally or alternatively, Figure 3The application launcher circuit 250 may be instantiated (e.g., created, made to last any length of time, materialized, implemented, etc.) by (i) an application specific integrated circuit (ASIC) and / or (ii) a field programmable gate array (FPGA) constructed and / or configured in response to executing a second instruction for performing an operation corresponding to the first instruction. It should be understood that Figure 3 Some or all of the circuits of may thus be instantiated at the same or different times. The circuits may be instantiated, for example, in one or more threads that execute concurrently on hardware and / or serially on hardware. Figure 3 In addition, in some examples, Figure 3 Some or all of the circuits may be implemented by microprocessor circuits executing instructions for implementing one or more virtual machines and / or containers and / or FPGA circuits executing operations for implementing one or more virtual machines and / or containers.

[0052] exist Figure 4-Figure 5 The representation shown in the figure can be executed by a programmable circuit to implement and / or instantiate Figure 3 Example machine readable instructions of the application launcher circuit 250 and / or executable by a programmable circuit to implement and / or instantiate Figure 3 The machine-readable instructions may be a flowchart of an example operation of the application launcher circuit 250. The machine-readable instructions may be for programmable circuits (e.g., the following combined Fig. 9 The example processor platform 900 shown in the discussion of programmable circuits 912) may be executed by one or more executable programs or portions of one or more executable programs, and / or may be to be executed by the following combination Fig.10 and / or Fig.11 One or more functions or portions of functions performed by an example programmable circuit (e.g., FPGA) discussed. In some examples, machine-readable instructions enable operations, tasks, etc. to be run and / or performed in an automated manner in the real world. As used herein, "automated" means without human involvement.

[0053] The program may be embodied in instructions (e.g., software and / or firmware) stored on one or more non-transitory computer-readable and / or machine-readable storage media (e.g., cache memory, magnetic storage devices or disks (e.g., floppy disks, hard disk drives (HDDs), etc.), optical storage devices or disks (e.g., Blu-ray disks, compact disks (CDs), digital versatile disks (DVDs), etc.), redundant arrays of independent disks (RAIDs), registers, ROMs, solid-state drives (SSDs), SSD memories, non-volatile memories (e.g., electrically erasable programmable read-only memories (EEPROMs), flash memories, etc.), volatile memories (e.g., any type of random access memory (RAM), etc.), and / or any other storage devices or storage disks). The instructions of the non-transitory computer-readable and / or machine-readable media may program and / or be executed by programmable circuits located in one or more hardware devices, but the entire program and / or portions thereof may alternatively be executed and / or instantiated by one or more hardware devices other than programmable circuits, and / or embodied in dedicated hardware. The machine-readable instructions may be distributed across multiple hardware devices and / or executed by two or more hardware devices (e.g., a server and a client hardware device). For example, the client hardware device may be implemented by an endpoint client hardware device (e.g., a hardware device associated with a human and / or machine user) or an intermediate client hardware device gateway (e.g., a radio access network (RAN)) that may facilitate communication between a server and an endpoint client hardware device. Similarly, a non-transitory computer-readable storage medium may include one or more media. Furthermore, although reference is made to Figure 4-Figure 5 The flowchart shown describes an example program, but many other methods of implementing the example application launcher circuit 250 may be used alternatively. For example, the execution order of the blocks of the flowchart may be changed, and / or some of the blocks described may be changed, eliminated, or combined. Additionally or alternatively, one or more hardware circuits (e.g., processor circuits, discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, comparators, operational amplifiers (op-amps), logic circuits, etc.) configured to perform corresponding operations without executing software or firmware may implement any or all of the blocks of the flowchart. The programmable circuits may be distributed in different network locations, and / or may be local to one or more hardware devices (e.g., single-core processors (e.g., single-core CPUs), multi-core processors (e.g., multi-core CPUs, XPUs, etc.). For example, the programmable circuit may be a CPU and / or FPGA located in the same package (e.g., the same integrated circuit (IC) package or in two or more separate housings), one or more processors in a single machine, multiple processors distributed across multiple servers of a server rack, multiple processors distributed across one or more server racks, etc., and / or any combination thereof.

[0054] The machine-readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a segmented format, a compiled format, an executable format, a packaged format, etc. The machine-readable instructions described herein may be stored as data (e.g., computer-readable data, machine-readable data, one or more bits (e.g., one or more computer-readable bits, one or more machine-readable bits, etc.), a bit stream (e.g., a computer-readable bit stream, a machine-readable bit stream, etc.), or a data structure (e.g., as part of instructions, code, a representation of code, etc.) that may be used to create, manufacture, and / or generate machine-executable instructions. For example, the machine-readable instructions may be segmented and stored in one or more storage devices, disks, and / or computing devices (e.g., located at the same or different locations in a network or collection of networks (e.g., in the cloud, in an edge device, etc.) , server). The machine-readable instructions may need to be installed, modified, adapted, updated, combined, supplemented, configured, decrypted, decompressed, unpacked, distributed, reassigned, compiled, etc., so that they can be directly read, interpreted and / or executed by a computing device and / or other machine. For example, the machine-readable instructions may be stored in multiple parts that are individually compressed, encrypted and / or stored on separate computing devices, where the parts, when decrypted, decompressed and combined, form a set of computer-executable and / or machine-executable instructions that implement one or more functions and / or operations, which functions and / or operations may together form a program (e.g., the program described herein).

[0055] In another example, the machine-readable instructions may be stored in a state where they can be read by a programmable circuit, but a library (e.g., a dynamic link library), a software development kit (SDK), an application programming interface (API), etc., may need to be added in order to execute the machine-readable instructions on a particular computing device or other device. In another example, the machine-readable instructions may need to be configured (e.g., stored settings, input data, recorded network addresses, etc.) before the machine-readable instructions and / or corresponding programs can be executed in whole or in part. Therefore, the computer-readable and / or machine-readable medium used herein may include instructions and / or programs regardless of the specific format or state of the machine-readable instructions and / or programs.

[0056] Any past, present or future instruction language, scripting language, programming language, etc. may represent the machine-readable instructions described herein. For example, any of the following languages ​​may be used to represent machine-readable instructions: C, C++, Java, C#, Perl, Python, JavaScript, Hypertext Markup Language (HTML), Structured Query Language (SQL), Swift, etc.

[0057] As described above, the present invention may be implemented using executable instructions (e.g., computer-readable and / or machine-readable instructions) stored on one or more non-transitory computer-readable and / or machine-readable media. Figure 4-Figure 5 Example operation. As used herein, the terms non-transient computer-readable medium, non-transient computer-readable storage medium, non-transient machine-readable medium and / or non-transient machine-readable storage medium are clearly defined to include any type of computer-readable storage device and / or storage disk, and do not include propagation signals and do not include transmission media. Examples of such non-transient computer-readable medium, non-transient computer-readable storage medium, non-transient machine-readable medium and / or non-transient machine-readable storage medium include optical storage devices, magnetic storage devices, HDDs, flash memory, read-only memory (ROM), CDs, DVDs, caches, any type of RAM, registers and / or any other storage device or storage disk that stores information for any duration (e.g., for an extended period of time, permanently, for a short moment, for temporary buffering and / or for caching of information). As used herein, the terms "non-transient computer-readable storage device" and "non-transient machine-readable storage device" are defined to include any physical (mechanical, magnetic and / or electrical) hardware to retain information for a period of time, but do not include propagation signals and do not include transmission media. Examples of non-transitory computer-readable storage devices and / or non-transitory machine-readable storage devices include any type of random access memory, any type of read-only memory, solid-state memory, flash memory, optical disks, magnetic disks, disk drives, and / or redundant arrays of independent disks (RAID) systems. As used herein, the term "device" refers to a physical structure such as a mechanical and / or electrical device, hardware, and / or circuit that may or may not be configured by computer-readable instructions, machine-readable instructions, etc. and / or manufactured to perform computer-readable instructions, machine-readable instructions, etc.

[0058] "Including" and "comprising" (and all forms and tenses thereof) are used herein as open-ended terms. Thus, whenever a claim employs any form of "include" or "comprise" (e.g., comprises, includes, comprising, including, having, etc.) as a preamble or within any kind of claim recitation, it should be understood that additional elements, terms, etc. may be present without falling outside the scope of the corresponding claim or recitation. As used herein, when the phrase "at least" is used as a transitional term, such as in the preamble of a claim, it is open-ended in the same manner as the terms "comprising" and "including" are open-ended. The term "and / or," when used, for example, in a form such as A, B, and / or C, refers to any combination or subset of A, B, C (e.g., (1) A alone, (2) B alone, (3) C alone, (4) A and B, (5) A and C, (6) B and C, or (7) A and B and C). As used herein in the context of describing structures, components, items, objects, and / or things, the phrase “at least one of A and B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing structures, components, items, objects, and / or things, the phrase “at least one of A or B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. As used herein in the context of describing the execution or performance of processes, instructions, acts, and / or activities, the phrase “at least one of A and B” is intended to refer to implementations that include any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B. Similarly, as used herein in the context of describing the operation or execution of processes, instructions, actions and / or activities, the phrase "at least one of A or B" is intended to refer to an implementation that includes any of the following: (1) at least one A, (2) at least one B, or (3) at least one A and at least one B.

[0059] As used herein, singular references (e.g., "a," "an," "first," "second," etc.) do not exclude the plural. As used herein, the term "a" or "an" object refers to one or more of the object. The terms "a" (or "an"), "one or more," and "at least one" are used interchangeably herein. In addition, although listed separately, multiple components, elements, or actions may be implemented by, for example, the same entity or object. In addition, although various features may be included in different examples or claims, these features may possibly be combined, and inclusion in different examples or claims does not imply that a combination of features is not feasible and / or advantageous.

[0060] Figure 4 is a flow diagram representative of example machine readable instructions and / or example operations 400 that may be executed, instantiated, and / or run by a programmable circuit to analyze a container image and execute / launch an application / VEE. Figure 4 The example machine readable instructions and / or example operations 400 begin at block 410: the central cloud communication circuit 310 communicates with the central cloud 210 to obtain the container image 100 from the remote repository 220. In some examples, the cloud communication circuit 310 also communicates with the central cloud 210 to obtain files from the remote file cache pool 230.

[0061] When cloud communication circuitry 310 obtains container image 100 from central cloud 210, container image analyzer circuitry 320 analyzes container image 100 (block 420). In some examples, analyzing container image 100 includes identifying common layers 110 and supplemental layers 120. In some examples, analyzing supplemental layers 120 includes collecting data from files in supplemental layers 120 and organizing the data using a combination of hash values ​​and metadata.

[0062] In some examples, when analyzing common layer 110, data is accessed from common layer 110 (e.g., via common layer data 114). Accessing this data may allow container image analyzer circuitry 320 to determine whether files associated with common layer 110 are already cached or need to be obtained from central cloud 210.

[0063] In some examples, when analyzing supplemental layer 120, one or more files are accessed from supplemental layer 120 (e.g., via supplemental layer data 124). Accessing files associated with supplemental layer 120 may allow container image analyzer circuitry 320 to determine whether the file associated with the hash value of the supplemental layer has been cached or needs to be obtained from central cloud 210.

[0064] Once the container image analyzer circuit 320 analyzes the container image 100, the file structure builder circuit 330 builds / generates a file structure to start the application / VEE 270, 272, 274 (block 430). In some examples, each application requires a unique file structure, so the file structure builder circuit 330 builds / generates a file structure for each application. In the examples disclosed herein, the first file associated with the common layer 110 is populated into the file structure. The second file associated with the supplemental layer 120 is used to supplement / populate the generated file structure with the second file.

[0065] Once the file structure builder circuit 330 has built the file structure, the application allocation circuit 340 allocates files based on the application / VEE to be launched (box 440). In some examples, the applications / VEEs 270, 272, 274 use unique files, so each application will need to have appropriately allocated files. In other examples, the applications 270, 272, 274 can share files required to launch the applications, and this sharing is also considered in the file allocation. In some examples, the file structure is allocated based on the characteristics of the application. Examples of such characteristics include, but are not limited to, the amount of available computing resources (e.g., CPU operating threshold, available memory, etc.).

[0066] Once the application allocation circuitry 340 allocates the file, the application executor circuitry 350 launches / starts the application 270, 272, 274 (block 450). In some examples, if more than one application is to be launched / started, the application executor circuitry 350 launches / starts each application individually. In other examples, the applications are launched / started simultaneously (e.g., at relatively the same time).

[0067] Figure 5 is a flow diagram representative of example machine-readable instructions and / or example operations that may be executed, instantiated, and / or run by programmable circuitry to analyze the container image 100 . Figure 5 The example machine readable instructions and / or example operations begin at block 510: the container image analyzer circuit 320 parses the container image 100 to identify the common layers 110 and the supplementary layers 120. In some examples, identifying the layers 110, 120 includes identifying a plurality of common layers 110 and a plurality of supplementary layers 120 in the container image 100.

[0068] Once the container image analyzer circuit 320 identifies the common layer 110 and the supplemental layer 120, the container image analyzer circuit 320 selects a layer for further analysis (block 520). In some examples, either the common layer 110 or the supplemental layer 120 may be analyzed (e.g., the supplemental layer 120 need not be analyzed after the common layer 110).

[0069] When the container image analyzer circuit 320 determines that the public layer 110 is to be analyzed (e.g., block 520 returns a result of "public"), the container image analyzer circuit 320 determines whether the files associated with the public layer 110 have been previously cached (block 530). In some examples, as described above, the files associated with the public layer 110 may be stored in the local file cache pool 260 or accessed from the remote image repository 220.

[0070] When the container image analyzer circuit 320 determines that the file associated with the common layer 110 has been previously cached (e.g., block 530 returns a “yes” result), then the container image analyzer circuit 320 reuses the cached file associated with the common layer 110 (block 540). In some examples, reusing the cached file associated with the common layer 110 includes accessing the file associated with the common layer 110 from the local file cache pool 260.

[0071] When the container image analyzer circuit 320 determines that the file associated with the common layer 110 has not been previously cached (e.g., block 530 returns a “no” result), the container image analyzer circuit 320 requests the file associated with the common layer 110 from the remote image repository 220 (block 550). In some examples, requesting the file associated with the common layer 110 from the remote image repository 220 includes accessing the remote file cache pool 230. In other examples, the container image analyzer circuit 320 may send an instruction to the central cloud 210 for the central cloud 210 to obtain the file associated with the common layer 110 from the remote file cache pool 230 to send to the edge cloud 240.

[0072] When the container image analyzer circuit 320 determines that the supplemental layer 120 is to be analyzed (e.g., block 520 returns the result “supplemental”), the container image analyzer circuit 320 determines whether the file associated with the hash value of the supplemental layer 120 exists / is available in the local file cache pool 260 (block 560). In some examples, as described above, the file associated with the hash value of the supplemental layer 120 may be stored in the local file cache pool 260 or in the remote file cache pool 230.

[0073] When the container image analyzer circuit 320 determines that the file associated with the hash value of the supplemental layer 120 is available / present in the local file cache pool 260 (e.g., block 560 returns a “yes” result), then the container image analyzer circuit 320 obtains the file associated with the hash value of the supplemental layer 120 from the local file cache pool 260 (block 570). In some examples, more than one file is associated with the hash value of the supplemental layer 120, and therefore more than one file can be accessed from the local file cache pool 260.

[0074] When the container image analyzer circuit 320 determines that the file associated with the hash value of the supplemental layer 120 is not available / existent in the local file cache pool 260 (e.g., block 560 returns a “no” result), then the container image analyzer circuit 320 requests the file associated with the hash value of the supplemental layer 120 from the remote file cache pool 230 (block 580). In some examples, requesting the file associated with the hash value of the supplemental layer 120 from the remote file cache pool 230 includes directly accessing the remote file cache pool 230 (e.g., via a network connection). In other examples, the container image analyzer circuit 320 may send an instruction to the central cloud 210 for the central cloud 210 to obtain the file associated with the hash value of the supplemental layer 120 from the remote file cache pool 230 to send to the edge cloud 240.

[0075] When the container image analyzer circuit 320 has requested the file associated with the common layer 110 from the remote image repository 220 (e.g., block 550 is completed), or when the container image analyzer circuit 320 has requested the file associated with the hash value of the supplemental layer 120 from the remote file cache pool 230 (e.g., block 580 is completed), then the container image analyzer circuit 320 stores the file associated with the common layer 110 or the file associated with the hash value of the supplemental layer 120 in the local file cache pool 260 (block 585). In some examples, storing the file associated with the common layer 110 and / or the file associated with the hash value of the supplemental layer 120 in the local file cache pool 260 includes storing information about the layers 110, 120, and / or the files. Storing such information may allow the local file cache pool 260 to store the file associated with the common layer 110 or the file associated with the hash value of the supplemental layer 120 in the local file cache pool 260 (block 585). Figure 5 The layers 110, 120 and / or files may be accessed relatively faster in subsequent iterations of the operation.

[0076] Once the container image analyzer circuit 320 has stored the file associated with the common layer 110 or the file associated with the hash value of the supplemental layer 120 in the local file cache pool 260 (e.g., block 585 is completed), when the container image analyzer circuit 320 reuses the cached file associated with the common layer 110 (e.g., block 540 is completed), or when the container image analyzer circuit 320 obtains the file associated with the hash value of the supplemental layer 120 (e.g., block 570 is completed), the container image analyzer circuit 320 determines whether additional layers need to be analyzed (block 590). In some examples, each layer 110, 120 is analyzed independently, so one at a time may need to be analyzed. In some examples, the container image 100 includes multiple common layers 110 and / or multiple supplemental layers 120. Therefore, each layer may need to be analyzed to determine how to build a file structure to launch / execute the application 270, 272, 274.

[0077] When the container image analyzer circuit 320 determines that additional layers do need to be analyzed (e.g., block 590 returns a “yes” result), the operations of blocks 520 through 585 are repeated until no layers remain to be analyzed. When the container image analyzer circuit 320 determines that no layers remain to be analyzed (e.g., block 590 returns a “no” result), Figure 5 The example operation ends, and Figure 4 Operation resumes at block 430 .

[0078] Figure 6 is an example container image launcher 600 showing an overview of how to construct some example open source projects. Figure 6 In the example shown in , Kubernetes, Containerd / CRI-O, and runc work together to start the container. Figure 6 Examples include a kernel 610 , a runtime executor 620 , and a container launcher 630 . Figure 6 The example kernel 610 of includes a Kubernetes kernel, but any other kernel interface may be used interchangeably herein.

[0079] The runtime executor 620 allows the Kubernetes kernel (e.g., the example kernel 610) to use the container runtime interface (CRI) to interact with Containerd / CRI-O that performs preparation tasks (e.g., loading images and populating container file systems). In some examples, the runtime executor 620 interfaces with the kernel 610 to allow the Kubernetes kernel to interact with Containerd / CRI-O. In the examples disclosed herein, the central cloud communication circuit 310, the container image analyzer circuit 320, the file structure builder circuit 330, and the application allocation circuit 340 can be housed within the runtime executor 620.

[0080] After the runtime executor 620 is prepared, Containerd / CRI-O interacts with runc using the Open Container Initiative (OCI) to start the container. Figure 6 In the example of , the container initiator 630 starts the container. Figure 6 As shown, the application executor circuit 350 interacts with the runtime executor 620 to launch the container.

[0081] The examples disclosed in this article can be integrated into the existing container ecosystem. The key is to support the proposed CRI-compliant container image format. In the software stack, Containerd / CRI-O is responsible for loading images and populating the container file system. In some examples, the image service module of Containerd / CRI-O can be extended to support Figure 1 and / or Figure 8These changes will be transparent to Kubernetes and runc.

[0082] In recent years, more and more applications have been deployed in the form of containers. One security concern about containers is the confidentiality of data and code (which may include proprietary algorithms, machine learning models, etc.) within the container image. In order to protect these sensitive codes and data, cryptographic techniques can be used to encrypt / decrypt these containers. However, considering the size and amount of container images to be deployed on a specific node / host / client, the encryption / decryption of these container images requires intensive computing power, which will bring increased burdens to both the host server (encrypting the container image) and the client (decrypting the container image).

[0083] Examples disclosed herein utilize a multi-layer container image format with security properties. By using this format, encryption and decryption operations can be performed per layer and per file, which can reduce the computational requirements for encryption and decryption. In some examples, a secure key management service is used to store and manage decryption keys to decrypt layers and files.

[0084] In the examples disclosed herein, the goal of encrypting a container image is to protect sensitive code and / or data included in the container image, rather than the entire container image. Encrypting the entire container image often results in more encrypted content (e.g., code and / or data) than is necessary to protect the sensitive code and / or data. This over-encryption results in the use of additional computing resources (e.g., resources used to encrypt and / or decrypt non-sensitive code and / or data).

[0085] As described above, a container image (e.g., container image 100) includes one or more layers. The bottom layer is typically an OS layer and several runtime layers with dependencies. These layers typically contain libraries and configuration files required by the application during runtime. These libraries and configuration files are common to all kinds of applications. Such libraries typically do not include any sensitive information. The top layer is typically an application layer. The application layer typically includes specific applications and related configuration files, which should generally be protected if sensitive information is included.

[0086] Watch now Figure 7 , in the examples disclosed herein, a “layer-by-layer encryption” approach is utilized. Figure 7 An example layer-by-layer encryption method 700 is shown, which includes a first layer 710, an encryption state 720, a second layer 730, a third layer 740, and a fourth layer 750. In the metadata section of each layer, the encryption state 720 is used to indicate whether the layer is a normal layer or an encrypted layer. Only layers marked with this "encrypted" field are encrypted. Figure 7 In the example of FIG. 7 , the first layer 710 is the only encrypted layer, while the second layer 730 , the third layer 740 , and the fourth layer 750 are normal layers.

[0087] Therefore, on the client side, only the encryption layer needs to be decrypted. In this way, only a smaller portion of the container image needs to be decrypted. This approach reduces the computing resource requirements for decryption operations on the client side. This can also reduce the computing resource requirements for encrypting the entire container image on the server side. In some examples, the application layer 710 includes a secure key management service for storing and managing decryption keys. In some examples, the secure key management service is an application running within the application layer 710.

[0088] Layer-by-layer encryption / decryption can reduce the amount of encryption / decryption computation for container images. When inspected at the application layer, in most cases, not everything in the application layer is sensitive. This enables further reduction of the overhead of encryption / decryption operations.

[0089] Figure 8 Shown for Figure 1 The container image 100 is replaced with the container image format 800. Figure 8 In the example shown in , a layer-by-layer and file-by-file encryption method is used to avoid encrypting the entire container image based on the disclosed container image format (e.g., Figure 7 method). Figure 8 As shown, the common layer 110 is not encrypted, while the supplemental layer 120 includes an encryption state 720. In some examples, the supplemental layer data 124 includes additional encryption parameters within the information stored in the file. In this way, the overhead of encryption and decryption of container images at both the client and server sides will be reduced. Therefore, the method disclosed herein helps to achieve faster application deployment for end users and improve the utilization of the platform.

[0090] Fig. 9 is configured to execute and / or instantiate example machine-readable instructions (e.g., Figure 4-Figure 5 Example instructions) to achieve Figure 3 The programmable circuit platform 900 is a block diagram of an example programmable circuit platform 900 of the application launcher circuit 250. The programmable circuit platform 900 can be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., a neural network), a mobile device (e.g., a cellular phone, a smart phone, a tablet computer (e.g., an iPad TM )), personal digital assistant (PDA), or any other type of computing and / or electronic device.

[0091] The programmable circuit platform 900 of the illustrated example includes a programmable circuit 912. The programmable circuit 912 of the illustrated example is hardware. For example, the programmable circuit 912 can be implemented by one or more integrated circuits, logic circuits, FPGAs, microprocessors, CPUs, GPUs, DSPs, and / or microcontrollers from any desired series or manufacturer. The programmable circuit 912 can be implemented by one or more semiconductor-based (e.g., silicon-based) devices. In this example, the programmable circuit 912 implements the central cloud communication circuit 310, the container image analyzer circuit 320, the file structure builder circuit 330, the application distribution circuit 340, and the application executor circuit 350.

[0092] The programmable circuit 912 of the illustrated example includes a local memory 913 (e.g., cache, registers, etc.). The programmable circuit 912 of the illustrated example communicates with a main memory 914, 916 (which includes a volatile memory 914 and a non-volatile memory 916) via a bus 918. The volatile memory 914 may be a synchronous dynamic random access memory (SDRAM), a dynamic random access memory (DRAM), Dynamic Random Access Memory The non-volatile memory 916 may be implemented by flash memory and / or any other desired type of memory device. Access to the main memories 914, 916 of the illustrated example is controlled by a memory controller 917. In some examples, the memory controller 917 may be implemented by one or more integrated circuits, logic circuits, microcontrollers, or any other type of circuitry from any desired family or manufacturer to manage the flow of data into and out of the main memories 914, 916.

[0093] The programmable circuit platform 900 of the illustrated example also includes an interface circuit 920. The interface circuit 920 may be implemented by hardware according to any type of interface standard (e.g., an Ethernet interface, a Universal Serial Bus (USB) interface, a Bluetooth interface, a Near Field Communication (NFC) interface, a Peripheral Component Interconnect (PCI) interface, and / or a Peripheral Component Interconnect Express (PCIe) interface).

[0094] In the example shown, one or more input devices 922 are connected to the interface circuit 920. The input devices 922 allow a user (e.g., a human user, a machine user, etc.) to input data and / or commands into the programmable circuit 912. The input devices 922 may be implemented by, for example, an audio sensor, a microphone, a camera (still or video), a keyboard, buttons, a mouse, a touch screen, a trackpad, a trackball, an isopoint device, and / or a voice recognition system.

[0095] One or more output devices 924 are also connected to the interface circuit 920 of the illustrated example. The output device 924 may be implemented, for example, by a display device (e.g., a light emitting diode (LED), an organic light emitting diode (OLED), a liquid crystal display (LCD), a cathode ray tube (CRT) display, an in-plane switch (IPS) display, a touch screen, etc.) or any other form of output device. Therefore, the interface circuit 920 of the illustrated example typically includes a graphics driver card, a graphics driver chip, and / or a graphics processor circuit (e.g., a GPU).

[0096] The interface circuitry 920 of the illustrated example also includes communication devices (e.g., transmitters, receivers, transceivers, modems, residential gateways, wireless access points, and / or network interfaces) to facilitate the exchange of data with external machines (e.g., any kind of computing device) over a network 926. Communications may be via, for example, an Ethernet connection, a digital subscriber line (DSL) connection, a telephone line connection, a coaxial cable system, a satellite system, a beyond-line-of-sight wireless system, a line-of-sight wireless system, a cellular telephone system, an optical connection, etc.

[0097] The programmable circuit platform 900 of the illustrated example also includes one or more mass storage disks or devices 928 to store firmware, software and / or data. Examples of such mass storage disks or devices 928 include magnetic storage devices (e.g., floppy disks, drives, HDDs, etc.), optical storage devices (e.g., Blu-ray disks, CDs, DVDs, etc.), RAID systems, and / or solid-state storage disks or devices (e.g., flash memory devices and / or SSDs).

[0098] Can be Figure 4-Figure 5 The machine-executable instructions 932 implemented by the machine-readable instructions may be stored in the mass storage device 928, in the volatile memory 914, in the non-volatile memory 916, and / or on at least one non-transitory computer-readable storage medium (e.g., a CD or DVD) that may be removable.

[0099] Fig.10 yes Fig. 9 912. In this example, Fig. 9 The programmable circuit 912 is implemented by the microprocessor 1000. For example, the microprocessor 1000 may be a general-purpose microprocessor (eg, a general-purpose microprocessor circuit). The microprocessor 1000 executes Figure 4-Figure 5 Some or all of the machine-readable instructions to efficiently convert Figure 3 In some such examples, the circuits are instantiated as logic circuits to perform operations corresponding to those machine-readable instructions. Figure 3The circuit is instantiated by a combination of hardware circuits of the microprocessor 1000 and machine-readable instructions. For example, the microprocessor 1000 may be implemented by a multi-core hardware circuit (e.g., a CPU, a DSP, a GPU, an XPU, etc.). Although it may include any number of example cores 1002 (e.g., 1 core), the microprocessor 1000 of this example is a multi-core semiconductor device including N cores. The cores 1002 of the microprocessor 1000 may operate independently, or may cooperate to execute machine-readable instructions. For example, machine code corresponding to a firmware program, an embedded software program, or a software program may be executed by one of the cores 1002, or may be executed by multiple cores in the cores 1002 at the same or different times. In some examples, the machine code corresponding to the firmware program, the embedded software program, or the software program is split into threads and executed in parallel by two or more cores in the core 1002. The software program may correspond to a thread executed by Figure 4-Figure 5 Represents some or all of the machine-readable instructions and / or operations.

[0100] The core 1002 can communicate via a first example bus 1004. In some examples, the first bus 1004 can be implemented by a communication bus to implement communications associated with one (or more) cores in the core 1002. For example, the first bus 1004 can be implemented by at least one of an inter-integrated circuit (I2C) bus, a serial peripheral interface (SPI) bus, a PCI bus, or a PCIe bus. Additionally or alternatively, the first bus 1004 can be implemented by any other type of computing or electrical bus. The core 1002 can obtain data, instructions, and / or signals from one or more external devices via an example interface circuit 1006. The core 1002 can output data, instructions, and / or signals to one or more external devices via the interface circuit 1006. Although the core 1002 of this example includes an example local memory 1020 (e.g., a level 1 (L1) cache that can be split into an L1 data cache and an L1 instruction cache), the microprocessor 1000 also includes an example shared memory 1010 (e.g., a level 2 (L2 cache)) that can be shared by the cores for high-speed access to data and / or instructions. Data and / or instructions can be transferred (e.g., shared) by writing to and / or reading from the shared memory 1010. The local memory 1020 and shared memory 1010 of each core 1002 can be a plurality of levels of cache memory and main memory (e.g., Fig. 9 Caches are part of a hierarchy of storage devices (main memory 914, 916). Typically, higher-level memories in the hierarchy exhibit shorter access times and have smaller storage capacities than lower-level memories. Changes to the various levels of the cache hierarchy are managed (e.g., coordinated) by a cache coherence policy.

[0101] Each core 1002 may be referred to as a CPU, DSP, GPU, etc., or any other type of hardware circuit. Each core 1002 includes a control unit circuit 1014, an arithmetic and logic (AL) circuit (sometimes referred to as an ALU) 1016, a plurality of registers 1018, a local memory 1020, and a second example bus 1022. Other structures may exist. For example, each core 1002 may include a vector unit circuit, a single instruction multiple data (SIMD) unit circuit, a load / store unit (LSU) circuit, a branch / jump unit circuit, a floating point unit (FPU) circuit, etc. The control unit circuit 1014 includes a semiconductor-based circuit configured to control (e.g., coordinate) data movement within the corresponding core 1002. The AL circuit 1016 includes a semiconductor-based circuit configured to perform one or more mathematical and / or logical operations on data within the corresponding core 1002. The AL circuit 1016 of some examples performs integer-based operations. In other examples, the AL circuit 1016 also performs floating-point operations. In yet other examples, AL circuit 1016 may include a first AL circuit that performs integer-based operations and a second AL circuit that performs floating-point operations. In some examples, AL circuit 1016 may be referred to as an arithmetic logic unit (ALU).

[0102] Registers 1018 are semiconductor-based structures for storing data and / or instructions (e.g., the results of one or more operations performed by the AL circuit 1016 of the corresponding core 1002). For example, registers 1018 may include vector registers, SIMD registers, general registers, flag registers, segment registers, machine-specific registers, instruction pointer registers, control registers, debug registers, memory management registers, machine check registers, etc. Registers 1018 may be arranged into banks, such as Fig.10 As shown. Alternatively, registers 1018 may be organized in any other arrangement, format, or structure (e.g., by being distributed throughout core 1002 to reduce access time). Second bus 1022 may be implemented by at least one of an I2C bus, an SPI bus, a PCI bus, or a PCIe bus.

[0103] Each core 1002 (and / or more generally, microprocessor 1000) may include structures that are additional and / or alternative to the structures shown and described above. For example, there may be one or more clock circuits, one or more power supplies, one or more power gates, one or more cache home agents (CHA), one or more aggregation / common grid stops (CMS), one or more shifters (e.g., barrel shifters), and / or other circuits. Microprocessor 1000 is a semiconductor device manufactured to include many transistors interconnected to implement the above structures in one or more integrated circuits (ICs) contained in one or more packages.

[0104] The microprocessor 1000 may include and / or collaborate with one or more accelerators (e.g., acceleration circuits, hardware accelerators, etc.). In some examples, the accelerator is implemented by a logic circuit to perform a specific task faster and / or more efficiently than can be performed by a general-purpose processor. Examples of accelerators include ASICs and FPGAs (e.g., those discussed herein). GPUs, DSPs, and / or other programmable devices may also be accelerators. The accelerator may be onboard the microprocessor 1000, in the same chip package as the microprocessor 1000, and / or in one or more packages separated from the microprocessor 1000.

[0105] Fig.11 yes Fig. 9 1 is a block diagram of another example implementation of a programmable circuit 912. In this example, the programmable circuit 912 is implemented by an FPGA circuit 1100. For example, the FPGA circuit 1100 can be implemented by an FPGA. The FPGA circuit 1100 can be used, for example, to execute a program that can be executed by executing corresponding machine-readable instructions. Fig.10 However, once configured, the FPGA circuit 1100 instantiates the operations and / or functions corresponding to the machine-readable instructions in hardware and can therefore often perform them faster than a general-purpose microprocessor executing corresponding software could perform the operations / functions.

[0106] More specifically, Fig.10 The microprocessor 1000 (which can be programmed to execute Figure 4-Figure 5 Compared to general-purpose devices that contain some or all of the machine-readable instructions but whose interconnections and logic circuits are fixed once manufactured, Fig.11 The example FPGA circuit 1100 includes interconnects and logic circuits that can be configured, constructed, programmed, and / or interconnected in different ways after fabrication to instantiate, for example, Figure 4-Figure 5 The machine-readable instructions represented by the FPGA circuit 1100 correspond to some or all operations / functions. Specifically, the FPGA circuit 1100 can be considered as an array of logic gates, interconnects, and switches. The switches can be programmed to change how the logic gates are interconnected by the interconnects, effectively forming one or more dedicated logic circuits (unless and until the FPGA circuit 1100 is reprogrammed). The configured logic circuits enable the logic gates to cooperate in different ways to perform different operations on the data received by the input circuit. These operations can correspond to Figure 4-5 Thus, FPGA circuit 1100 may be configured and / or constructed to effectively instantiate the same as Figure 4-Figure 5Some or all of the operations / functions corresponding to the machine-readable instructions of the FPGA circuit 1100 are implemented as dedicated logic circuits to perform the operations / functions corresponding to those software instructions in a dedicated manner similar to an ASIC. Therefore, the FPGA circuit 1100 can perform more operations / functions than a general-purpose microprocessor can. Figure 4-Figure 5 Some or all of the machine-readable instructions may more quickly execute the operations / functions corresponding thereto.

[0107] exist Fig.11 In some examples, the FPGA circuit 1100 is configured and / or constructed in response to being programmed (and / or reprogrammed one or more times) based on a binary file. In some examples, the binary file can be compiled and / or generated based on instructions of a hardware description language (HDL) (e.g., Lucid, Very High Speed ​​Integrated Circuit (VHSIC) Hardware Description Language (VHDL), or Verilog). For example, a user (e.g., a human user, a machine user, etc.) can write code or a program corresponding to one or more operations / functions in HDL; the code / program can be translated into a low-level language as needed; and the code / program (e.g., code / program in a low-level language) can be converted (e.g., by a compiler, a software application, etc.) into a binary file. In some examples, Fig.11 The FPGA circuit 1100 can access and / or load a binary file to enable Fig.11 The FPGA circuit 1100 is configured and / or constructed to perform one or more operations / functions. For example, a binary file can be composed of a bit stream (e.g., one or more computer-readable bits, one or more machine-readable bits, etc.), data (e.g., computer-readable data, machine-readable data, etc.), and / or for Fig.11 The FPGA circuit 1100 can be implemented by machine-readable instructions accessible to cause Fig.11 Configuration and / or construction of FPGA circuit 1100 or a portion thereof.

[0108] In some examples, a binary file is compiled, generated, converted, and / or otherwise output from a unified software platform used to program the FPGA. For example, the unified software platform can translate a first instruction (e.g., code or program) corresponding to one or more operations / functions in a high-level language (e.g., C, C++, Python, etc.) into a second instruction corresponding to one or more operations / functions in an HDL. In some such examples, a binary file is compiled, generated, and / or otherwise output from the unified software platform based on the second instruction. In some examples, Fig.11 The FPGA circuit 1100 can access and / or load a binary file to enable Fig.11The FPGA circuit 1100 is configured and / or constructed to perform one or more operations / functions. For example, a binary file can be composed of a bit stream (e.g., one or more computer-readable bits, one or more machine-readable bits, etc.), data (e.g., computer-readable data, machine-readable data, etc.), and / or for Fig.11 The FPGA circuit 1100 can be implemented by machine-readable instructions accessible to cause Fig.11 Configuration and / or construction of FPGA circuit 1100 or a portion thereof.

[0109] Fig.11 The FPGA circuit 1100 includes an example input / output (I / O) circuit 1102 to obtain data from and / or output data to an example configuration circuit 1104 and / or external hardware 1106. For example, the configuration circuit 1104 can be implemented by an interface circuit that can obtain a binary file for configuring the FPGA circuit 1100 or a portion thereof, and the binary file can be implemented by a bitstream, data, and / or machine-readable instructions. In some such examples, the configuration circuit 1104 can obtain the binary file from a user, a machine (e.g., a hardware circuit (e.g., a programmable or dedicated circuit) that can implement an artificial intelligence / machine learning (AI / ML) model to generate a binary file, etc. and / or any combination thereof). In some examples, the external hardware 1106 can be implemented by an external hardware circuit. For example, the external hardware 1106 can be implemented by Fig.10 The microprocessor 1000 is implemented.

[0110] FPGA circuit 1100 also includes an array of example logic gate circuits 1108, a plurality of example configurable interconnects 1110, and example storage circuits 1112. Logic gate circuits 1108 and configurable interconnects 1110 may be configured to instantiate Figure 4-Figure 5 At least some of the machine-readable instructions correspond to one or more operations / functions and / or other desired operations. Fig.11 The logic gate circuits 1108 shown are manufactured in blocks or groups. Each block includes a semiconductor-based electrical structure that can be configured as a logic circuit. In some examples, the electrical structure includes a logic gate (e.g., an AND gate, an OR gate, a NOT gate, etc.) that provides a basic building block for the logic circuit. There are electrically controllable switches (e.g., transistors) in each logic gate circuit 1108 to enable configuration of the electrical structure and / or logic gate to form a circuit for performing the desired operation / function. The logic gate circuit 1108 may include other electrical structures (e.g., a lookup table (LUT), a register (e.g., a flip-flop or latch), a multiplexer, etc.).

[0111] The configurable interconnect 1110 of the illustrated example is a conductive path, trace, via, or the like, which may include an electrically controllable switch (e.g., a transistor) whose state can be changed by programming (e.g., using an HDL instruction language) to activate or deactivate one or more connections between one or more logic gate circuits 1108 to program a desired logic circuit.

[0112] The storage circuit 1112 of the illustrated example is configured to store the results of one or more operations performed by the corresponding logic gates. The storage circuit 1112 may be implemented by a register, etc. In the illustrated example, the storage circuit 1112 is distributed among the logic gate circuit 1108 to facilitate access and increase execution speed.

[0113] Fig.11 The example of FPGA circuit 1100 also includes an example dedicated operation circuit 1114. In this example, the dedicated operation circuit 1114 includes a dedicated circuit 1116, which can be called to implement common functions to avoid the need to program those functions on site. Examples of the dedicated circuit 1116 include memory (e.g., DRAM) controller circuits, PCIe controller circuits, clock circuits, transceiver circuits, memories, and multiplier-accumulator circuits. There may be other types of dedicated circuits. In some examples, the FPGA circuit 1100 may also include an example general-purpose programmable circuit 1118 (e.g., an example CPU 1120 and / or an example DSP 1122). There may be other general-purpose programmable circuits 1118 (e.g., GPUs, XPUs, etc.) that can be programmed to perform other operations in addition or alternatively.

[0114] Although Fig.10 and Fig.11 Show Fig. 9 These are two example implementations of programmable circuit 912, but many other approaches are contemplated. For example, an FPGA circuit may include an onboard CPU (e.g., Fig.11 1120). Therefore, Fig. 9 The programmable circuit 912 may additionally be configured by combining at least Fig.10 An example microprocessor 1000 and Fig.11 In some such hybrid examples, Fig.10 One or more cores 1002 may execute Figure 4-Figure 5 a first portion of machine-readable instructions to perform a first operation / function, Fig.11 The FPGA circuit 1100 may be configured and / or constructed to perform with Figure 4-Figure 5 The second portion of the machine-readable instructions corresponds to a second operation / function, and / or the ASIC may be configured and / or constructed to perform the same as that specified by Figure 4-Figure 5The third portion of the machine-readable instructions represents a third operation / function corresponding to the third operation / function.

[0115] It should be understood that the Figure 3 For example, Fig.10 The same and / or different portions of microprocessor 1000 may be programmed to execute portions of machine-readable instructions at the same and / or different times. In some examples, Fig.11 The same and / or different portions of FPGA circuit 1100 may be configured and / or constructed to perform operations / functions corresponding to portions of the machine-readable instructions at the same and / or different times.

[0116] In some examples, the code may be instantiated, for example, in one or more threads that execute concurrently and / or serially. Figure 3 For example, Fig.10 The microprocessor 1000 can execute machine-readable instructions in one or more threads of execution concurrently and / or serially. In some examples, Fig.11 The FPGA circuit 1100 can be configured and / or constructed to perform operations / functions concurrently and / or serially. In addition, in some examples, Figure 3 Some or all of the circuitry may be Fig.10 The microprocessor 1000 is implemented within one or more virtual machines and / or containers.

[0117] In some examples, Fig. 9 The programmable circuit 912 may be in one or more packages. For example, Fig.10 The microprocessor 1000 and / or Fig.11 The FPGA circuit 1100 may be in one or more packages. In some examples, the XPU may be comprised of a Fig. 9 For example, the XPU may include a CPU (e.g., Fig.10 Microprocessor 1000, Fig.11 1120, etc.), a DSP is included in another package (e.g., Fig.11 1122), a GPU in yet another package, and an FPGA in yet another package (e.g., Fig.11 FPGA circuit 1100).

[0118] From the foregoing it should be appreciated that example systems, apparatuses, articles of manufacture, and methods have been disclosed that facilitate deployment of containers in a network constrained environment. The disclosed systems, apparatuses, articles of manufacture, and methods improve the efficiency of using a computing device by reducing the amount of information that must be sent to enable execution of a container. The disclosed systems, apparatuses, articles of manufacture, and methods accordingly relate to one or more improvements in the operation of a machine (e.g., a computer or other electronic and / or mechanical device).

[0119] Disclosed herein are example methods, apparatus, systems, and articles of manufacture for facilitating deployment of containers in a network constrained environment. Further examples and combinations thereof include the following:

[0120] Example 1 includes: an apparatus comprising: an interface circuit; machine-readable instructions; and a programmable circuit for at least one of: instantiating or executing the machine-readable instructions to: access a first unencrypted shared file; access a second encrypted file; create a third file by integrating the contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; and deploying the third file to a container runtime environment for execution.

[0121] Example 2 includes: the apparatus of Example 1, wherein the programmable circuit is further used to: decrypt the second file to produce a decrypted second file before integrating the contents of the first file and the second file to create the third file.

[0122] Example 3 includes the apparatus of Example 2, wherein, to decrypt the second file, the programmable circuit is to use a decryption key obtained from a secure key management service.

[0123] Example 4 includes: an apparatus as described in any of Examples 1-3, wherein, in order to access the first file and the second file, the programmable circuit is used to: obtain the first file and the second file from a distributed file system.

[0124] Example 5 includes the apparatus of any of Examples 1-4, wherein the second file is associated with a supplemental layer of the third file, the supplemental layer comprising one or more files that are not shared across multiple computing devices.

[0125] Example 6 includes the apparatus of any of Examples 1-5, wherein the first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

[0126] Example 7 includes: an apparatus as described in any of Examples 1-6, wherein the third file includes a calculated identifier of the second file.

[0127] Example 8 includes: an apparatus as described in Example 7, wherein the calculated identifier is a hash.

[0128] Example 9 includes: an apparatus as described in any of Examples 1-8, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0129] Example 10 includes: at least one non-transitory machine-readable storage medium, comprising instructions that cause at least one processor to at least: access a first unencrypted shared file; access a second encrypted file; create a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; store the third file; and deploy the third file to a container runtime environment for execution.

[0130] Example 11 includes: at least one non-transitory computer-readable storage medium as described in Example 10, wherein the instructions cause the at least one processor to: decrypt the second file to produce a decrypted second file before integrating the contents of the first file and the second file to create the third file.

[0131] Example 12 includes the at least one non-transitory computer-readable storage medium of Example 11, wherein, to decrypt the second file, the instructions cause the at least one processor to: use a decryption key obtained from a secure key management service.

[0132] Example 13 includes: at least one non-transitory computer-readable storage medium as described in any of Examples 10-12, wherein, in order to access the first file and the second file, the instructions cause the at least one processor to: obtain the first file and the second file from a distributed file system.

[0133] Example 14 includes at least one non-transitory computer-readable storage medium as described in any of Examples 10-13, wherein the second file is associated with a supplemental layer of the third file, the supplemental layer including one or more files that are not shared across multiple computing devices.

[0134] Example 15 includes at least one non-transitory computer-readable storage medium as described in any of Examples 10-14, wherein the first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

[0135] Example 16 includes at least one non-transitory computer-readable storage medium as described in any of Examples 10-15, wherein the third file includes a calculated identifier of the second file.

[0136] Example 17 includes at least one non-transitory computer-readable storage medium as described in Example 16, wherein the calculated identifier is a hash.

[0137] Example 18 includes at least one non-transitory computer-readable storage medium as described in any of Examples 10-17, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0138] Example 19 includes: a method comprising: accessing a first unencrypted shared file; accessing a second encrypted file; creating a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; and deploying the third file to a container runtime environment for execution.

[0139] Example 20 includes the method of Example 19, further comprising: before integrating the contents of the first file and the second file to create the third file, decrypting the second file to produce a decrypted second file.

[0140] Example 21 includes the method of Example 20, further comprising decrypting the second file using a decryption key obtained from a secure key management service.

[0141] Example 22 includes: a method as described in any of Examples 19-21, wherein accessing the first file and the second file includes: obtaining the first file and the second file from a distributed file system.

[0142] Example 23 includes the method of any of Examples 19-22, wherein the second file is associated with a supplemental layer of the third file, the supplemental layer comprising one or more files that are not shared across multiple computing devices.

[0143] Example 24 includes the method of any of Examples 19-23, wherein the first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

[0144] Example 25 includes: a method as described in any of Examples 19-24, wherein the third file includes a calculated identifier of the second file.

[0145] Example 26 includes: a method as described in Example 25, wherein the calculated identifier is a hash.

[0146] Example 27 includes: a method as described in any of Examples 19-26, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0147] Example 28 includes: an apparatus comprising: an interface circuit; machine-readable instructions; and a programmable circuit for at least one of: instantiating or executing the machine-readable instructions to: process a request to access a data structure, the data structure comprising a common layer and a supplementary layer, the common layer being associated with a first file to be used to create a local file structure, the supplementary layer being associated with a second file to be used to supplement the local file structure to implement a virtual execution environment (VEE) image; and causing the interface circuit to send the data structure to an external device.

[0148] Example 29 includes the apparatus of Example 28, wherein the supplemental layer comprises a computed identifier of the second file.

[0149] Example 30 includes: an apparatus as described in Example 29, wherein the calculated identifier is a hash.

[0150] Example 31 includes: an apparatus as described in any of Examples 28-30, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0151] Example 32 includes an apparatus as described in any of Examples 28-31, wherein the programmable circuit is used to: store the data structure in a file cache, the file cache is accessible by the external device to implement the VEE image.

[0152] Example 33 includes: a non-transitory machine-readable storage medium comprising instructions that cause a programmable circuit to at least: process a request to access a data structure, the data structure comprising a common layer and a supplementary layer, the common layer being associated with a first file to be used to create a local file structure, the supplementary layer being associated with a second file to be used to supplement the local file structure to implement a virtual execution environment (VEE) image; and cause the data structure to be transmitted to an external device.

[0153] Example 34 includes the non-transitory machine-readable storage medium of Example 33, wherein the supplemental layer includes a computed identifier of the second file.

[0154] Example 35 includes the non-transitory machine-readable storage medium of Example 34, wherein the calculated identifier is a hash.

[0155] Example 36 includes: a non-transitory machine-readable storage medium as described in any of Examples 33-35, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0156] Example 37 includes the non-transitory machine-readable storage medium of any of Examples 33-36, wherein the instructions cause the programmable circuit to: store the data structure in a file cache accessible by the external device to implement the VEE image.

[0157] Example 38 includes: a method comprising: processing a request to access a data structure, the data structure comprising a common layer and a supplementary layer, the common layer being associated with a first file to be used to create a local file structure, the supplementary layer being associated with a second file to be used to supplement the local file structure to implement a virtual execution environment (VEE) image; and causing the data structure to be transmitted to an external device.

[0158] Example 39 includes the method of Example 38, wherein the supplemental layer includes a calculated identifier of the second file.

[0159] Example 40 includes: a method as described in Example 39, wherein the calculated identifier is a hash.

[0160] Example 41 includes: a method as described in any of Examples 38-40, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0161] Example 42 includes: the method as described in any of Examples 38-41, further comprising: storing the data structure in a file cache, the file cache is accessible by the external device to implement the VEE image.

[0162] Example 43 includes: an apparatus comprising: an interface circuit for obtaining a data structure; machine-readable instructions; and a programmable circuit for at least one of: instantiating or executing the machine-readable instructions to: generate a local file structure based on a first file associated with a common layer of the data structure; and populating the local file structure with a second file associated with a supplementary layer of the data structure, the second file facilitating supplementing the local file structure to implement a virtual execution environment (VEE) image.

[0163] Example 44 includes the apparatus of Example 43, wherein the supplemental layer comprises a hash of the second file.

[0164] Example 45 includes: an apparatus as described in Example 43 or 44, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0165] Example 46 includes: an apparatus as described in any of Examples 43-45, wherein the programmable circuit is used to: determine whether the first file associated with the common layer and the second file associated with the supplemental layer are cached in the local file cache.

[0166] Example 47 includes: an apparatus as described in Example 46, wherein the programmable circuit is used to: when it is determined that the second file associated with the supplemental layer is cached in the local file cache, cause the second file to be obtained from the local file cache, and determine that the second file is cached based on a calculated identifier of the second file, wherein the calculated identifier is included in the supplemental layer.

[0167] Example 48 includes the apparatus of Example 46, wherein the programmable circuit is to cause obtaining the second file from a remote file cache when it is determined that the second file is not cached in the local file cache.

[0168] Example 49 includes: an apparatus as described in any of Examples 43-48, wherein the programmable circuit is used to: execute the VEE image based on the data structure including the first file associated with the common layer and the second file associated with the supplemental layer.

[0169] Example 50 includes: a non-transitory machine-readable storage medium comprising instructions that cause a programmable circuit to at least: generate a local file structure based on a first file associated with a common layer of a data structure; and populate the local file structure with a second file associated with a supplementary layer of the data structure, the second file facilitating supplementing the local file structure to implement a virtual execution environment (VEE) image.

[0170] Example 51 includes the non-transitory machine-readable storage medium of Example 50, wherein the supplemental layer includes a hash of the second file.

[0171] Example 52 includes: a non-transitory machine-readable storage medium as described in Example 50 or 51, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0172] Example 53 includes: a non-transitory machine-readable storage medium as described in any of Examples 50-52, wherein the instructions cause the programmable circuit to: determine whether the first file associated with the common layer and the second file associated with the supplemental layer are cached in the local file cache.

[0173] Example 54 includes: a non-transitory machine-readable storage medium as described in Example 53, wherein the instructions cause the programmable circuit to: when it is determined that the second file associated with the supplemental layer is cached in the local file cache, cause the second file to be obtained from the local file cache, and determine that the second file is cached based on a calculated identifier of the second file, wherein the calculated identifier is included in the supplemental layer.

[0174] Example 55 includes the non-transitory machine-readable storage medium of Example 53, wherein the instructions cause the programmable circuit to: cause obtaining the second file from a remote file cache when it is determined that the second file is not cached in the local file cache.

[0175] Example 56 includes: a non-transitory machine-readable storage medium as described in any of Examples 50-55, wherein the instructions cause the programmable circuit to: execute the VEE image based on the data structure including the first file associated with the common layer and the second file associated with the supplemental layer.

[0176] Example 57 includes: a method comprising: generating a local file structure based on a first file associated with a common layer of a data structure; and populating the local file structure with a second file associated with a supplementary layer of the data structure, the second file facilitating supplementing the local file structure to implement a virtual execution environment (VEE) image.

[0177] Example 58 includes the method of Example 57, wherein the supplemental layer includes a hash of the second file.

[0178] Example 59 includes: a method as described in Example 57 or 58, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0179] Example 60 includes: the method of any of Examples 57-59, further comprising: determining whether the first file associated with the common layer and the second file associated with the supplemental layer are cached in the local file cache.

[0180] Example 61 includes: the method as described in Example 60, further including: when it is determined that the second file associated with the supplementary layer is cached in the local file cache, causing the second file to be obtained from the local file cache, and determining that the second file is cached based on a calculated identifier of the second file, wherein the calculated identifier is included in the supplementary layer.

[0181] Example 62 includes: the method as described in Example 60, further comprising: when it is determined that the second file is not cached in the local file cache, causing the second file to be obtained from a remote file cache.

[0182] Example 63 includes: the method as described in any of Examples 57-62, further comprising: executing the VEE image based on the data structure including the first file associated with the common layer and the second file associated with the supplemental layer.

[0183] Example 64 includes: at least one non-transitory computer-readable medium, comprising a data structure, the data structure comprising: a common layer associated with a first instruction for creating a local file structure; and a supplemental layer associated with a second instruction to supplement the local file structure, the second instruction facilitating supplementing the local file structure to implement a virtual execution environment (VEE) image.

[0184] Example 65 includes at least one non-transitory computer-readable medium as described in Example 64, wherein the supplemental layer includes a computation identifier associated with the second instruction.

[0185] Example 66 includes at least one non-transitory computer-readable medium as described in Example 65, wherein the calculated identifier is a hash.

[0186] Example 67 includes at least one non-transitory computer-readable medium as described in any of Examples 64-66, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0187] Example 68 includes: an apparatus comprising: an interface circuit; machine-readable instructions; and programmable circuitry for at least one of: instantiating or executing the machine-readable instructions to: populate a common layer of a data structure corresponding to a first file to be used to create a local file structure; populate a supplemental layer of the data structure corresponding to a second file used to facilitate supplementing the local file structure to implement a virtual execution environment (VEE) image; and causing the interface circuitry to send the data structure for use by an external device.

[0188] Example 69 includes the apparatus of Example 68, wherein the supplemental layer comprises a computed identifier of the second file.

[0189] Example 70 includes: an apparatus as described in Example 69, wherein the calculated identifier is a hash.

[0190] Example 71 includes: an apparatus as described in any of Examples 68-70, wherein the VEE image is at least one of a container image, a virtual machine, or an operating system.

[0191] Example 72 includes an apparatus as described in any of Examples 68-71, wherein the programmable circuit is used to: store the data structure in a file cache, the file cache being accessible by the external device to implement the VEE image.

[0192] The following claims are hereby incorporated into this detailed description by this reference. Although specific example systems, devices, articles of manufacture, and methods have been disclosed herein, the scope of coverage of this patent is not limited thereto. On the contrary, this patent fully encompasses all systems, devices, articles of manufacture, and methods that fall within the scope of the claims of this patent.

Claims

1. A device comprising: Interface circuit; machine-readable instructions; and programmable circuitry for at least one of: instantiating or executing the machine-readable instructions to: Accessing a first unencrypted shared file; accessing a second encrypted file; creating a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; as well as The third file is deployed to the container runtime environment for execution.

2. The device according to claim 1, wherein: The programmable circuit is also used for: Prior to integrating the contents of the first file and the second file to create the third file, the second file is decrypted to produce a decrypted second file.

3. The device as claimed in claim 2, wherein: To decrypt the second file, the programmable circuit is configured to: Use the decryption key obtained from the Security Key Management Service.

4. A device as claimed in any preceding claim, wherein In order to access the first file and the second file, the programmable circuit is configured to: The first file and the second file are obtained from a distributed file system.

5. A device as claimed in any preceding claim, wherein: The second file is associated with a supplemental layer of the third file, the supplemental layer comprising one or more files that are not shared across multiple computing devices.

6. A device as claimed in any preceding claim, wherein The first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

7. A device as claimed in any preceding claim, wherein: The third file includes a calculated identifier of the second file.

8. The device according to claim 7, wherein: The calculated identifier is a hash.

9. A device as claimed in any preceding claim, wherein: The VEE image is at least one of a container image, a virtual machine, or an operating system.

10. At least one computer-readable storage medium comprising instructions that cause at least one processor to at least: Accessing a first unencrypted shared file; accessing a second encrypted file; creating a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; as well as The third file is deployed to the container runtime environment for execution.

11. The at least one computer-readable storage medium of claim 10, wherein: The instructions cause the at least one processor to: Prior to integrating the contents of the first file and the second file to create the third file, the second file is decrypted to produce a decrypted second file.

12. The at least one computer-readable storage medium of claim 11, wherein: To decrypt the second file, the instructions cause the at least one processor to: Use the decryption key obtained from the Security Key Management Service.

13. At least one computer-readable storage medium as claimed in any preceding claim, wherein: To access the first file and the second file, the instructions cause the at least one processor to: The first file and the second file are obtained from a distributed file system.

14. At least one computer-readable storage medium as claimed in any preceding claim, wherein: The second file is associated with a supplemental layer of the third file, the supplemental layer comprising one or more files that are not shared across multiple computing devices.

15. At least one computer-readable storage medium as claimed in any preceding claim, wherein: The first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

16. At least one computer-readable storage medium as claimed in any preceding claim, wherein: The third file includes a calculated identifier of the second file.

17. The at least one computer-readable storage medium of claim 16, wherein: The calculated identifier is a hash.

18. At least one computer-readable storage medium as claimed in any preceding claim, wherein: The VEE image is at least one of a container image, a virtual machine, or an operating system.

19. A method comprising: Accessing a first unencrypted shared file; accessing a second encrypted file; creating a third file by integrating contents of the first file and the second file, the third file being a virtual execution environment (VEE) image; storing the third file; as well as The third file is deployed to the container runtime environment for execution.

20. The method of claim 19, further comprising: Prior to integrating the contents of the first file and the second file to create the third file, the second file is decrypted to produce a decrypted second file.

21. The method of claim 20, further comprising: The second file is decrypted using a decryption key obtained from a secure key management service.

22. A method as claimed in any preceding claim, wherein: Accessing the first file and the second file includes: The first file and the second file are obtained from a distributed file system.

23. A method as claimed in any preceding claim, wherein: The second file is associated with a supplemental layer of the third file, the supplemental layer comprising one or more files that are not shared across multiple computing devices.

24. A method as claimed in any preceding claim, wherein: The first file is associated with a common layer of the third file, the common layer being shared by more than one computing device.

25. A method as claimed in any preceding claim, wherein: The third file includes a calculated identifier of the second file.

Images