Application Containerization for Multi-OS Resource Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems require separate installations for each application due to resource conflicts, version incompatibilities, and security concerns, leading to increased costs and complexity in managing multiple systems.
Innovation Solution
The method involves creating secure application containers that can execute on a single computing platform with a shared operating system, allowing multiple applications to share resources without conflicts, using a kernel-based system call intercept to manage resource usage and isolate applications within their own containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate computer systems are deployed for each application to avoid resource conflicts and version incompatibilities, then application reliability and compatibility are improved, but system management complexity and cost increase significantly
Solution Approach 1:
The patent segments applications into isolated containers that each have their own file system, process space, and resource allocation. This allows multiple applications to run on a single server without interfering with each other, resolving the contradiction between needing separate systems for compatibility and wanting to reduce overall system complexity.
Solution Approach 2:
The patent introduces a containerization layer as an intermediary between applications and the operating system. This intermediary provides resource isolation and compatibility management, allowing applications to run independently on shared hardware without direct conflicts, thus improving reliability while reducing management complexity.
2Object-affected harmful factors
If separate computer systems are deployed for each application to securely separate data between users, then data security is improved, but the number of systems requiring management increases
Solution Approach 1:
The patent creates separate containerized environments for each application or user, with isolated file systems and resource access controls. This segmentation provides data security without requiring separate physical servers, as each container is isolated within the shared server environment.
Solution Approach 2:
The patent implements a universal containerization platform that can host multiple applications and users on a single server. This multi-functional approach provides security isolation while consolidating multiple systems into one manageable platform, reducing the quantity of systems needed.
3Reliability
If Virtual Machine technology is used to allow multiple application/operating system images to co-exist on a single compute platform, then application isolation is improved, but performance overhead increases and operating system licensing and management requirements remain
Solution Approach 1:
The patent extracts the operating system kernel from each virtual machine instance, allowing multiple applications to share a single OS kernel. This eliminates the performance overhead and licensing requirements associated with multiple OS instances while maintaining application isolation through container-level separation.
Solution Approach 2:
The patent merges multiple virtual machine instances into a single containerized environment that shares common OS resources. This consolidation maintains application isolation through namespace and mount namespace mechanisms while eliminating the performance penalties and management overhead of running separate OS instances.
Data Source
AI summary
A system is disclosed having servers with operating systems that may differ, operating in disparate computing environments, wherein each server includes a processor and an operating system including a kernel a set of associated local system files compatible with the processor. This invention discloses a method of providing at least some of the servers in the system with secure, executable, applications related to a service, wherein the applications may be executed in a secure environment, wherein the applications each include an object executable by at least some of the different operating systems for performing a task related to the service. The method of this invention requires storing in memory accessible to at least some of the servers a plurality of secure containers of application software. Each container includes one or more of the executable applications and a set of associated system files required to execute the one or more applications, for use with a local kernel residing permanently on one of the servers. The set of associated system files are compatible with a local kernel of at least some of the plurality of different operating systems. The containers of application software exclude a kernel; and some or all of the associated system files within a container stored in memory are utilized in place of the associated local system files resident on the server.