Containerized Code Execution Isolation via Closure Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing environments lack effective isolation for executing automation or configuration code, leading to potential disruptions in the execution context and infrastructure when failures occur, as the execution environment is not properly isolated.
Innovation Solution
Implementing a scalable, lightweight service that uses containers to execute code in an isolated, asynchronous manner, allowing for sandboxed code execution through a closure service that spawns containers for executing code snippets or scripts, thereby isolating the execution environment and its dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If code is executed in a shared computing environment without isolation, then resource utilization is improved, but system stability deteriorates due to potential disruptions from failures
Solution Approach 1:
The patent segments the computing environment into isolated containers, where each container executes code in a separate namespace with restricted access to host system resources. This segmentation allows multiple code executions to share the host environment while preventing failure propagation between containers, thus maintaining both high resource utilization and system stability.
Solution Approach 2:
The patent introduces a container runtime as an intermediary layer between the host operating system and the executed code. This intermediary manages resource allocation, enforces isolation boundaries, and handles container lifecycle operations, enabling safe sharing of computing resources while protecting the host system from disruptions.
2Reliability
If a sandbox mechanism is implemented to isolate code execution, then system stability is improved, but device complexity increases due to additional isolation infrastructure
Solution Approach 1:
The patent implements a universal container platform that provides sandboxing capabilities across diverse computing environments. The container runtime and image management system serve multiple functions including isolation, resource management, deployment, and execution, reducing the need for separate specialized infrastructure components and thereby limiting the increase in device complexity.
3Reliability
If containers are spawned for each code execution request, then isolation effectiveness is improved, but productivity decreases due to container creation overhead
Solution Approach 1:
The patent performs preliminary actions by pre-building and storing container images in a registry before execution requests arrive. When code needs to be executed, the system retrieves the pre-built image and spawns a container from it, avoiding the time-consuming process of building containers at runtime. This preliminary preparation maintains strong isolation while significantly reducing execution latency.
Data Source
AI summary
Methods and apparatus are disclosed to provide a sandboxed code execution in a virtualized environment. An example apparatus includes a closure service to receive a request for execution of code. The example closure service is to generate a closure to trigger execution of the code within the apparatus. The example apparatus includes a container host to form a host environment for a container image. The example container image is to spawn, in response to the closure, a container to execute the code. The example container is to execute the code and keep code execution and result inside the container. Code execution and result inside the container do not affect operation of the apparatus.