Container Deployment via Shared Network Namespace and Segmented IPC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container deployment methods in virtualization technologies face challenges in achieving high data communication speed between containers on the same host while maintaining isolation, as existing solutions either compromise on isolation or do not optimize communication speed effectively.
Innovation Solution
A method that creates separate network and IPC namespaces for each container, with a load balancing container sharing the network namespace and using a loopback interface for communication, ensuring isolation and optimizing access speed by setting the load balancing container's parameters to specific IPC namespaces based on association information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If containers are placed in the same IPC namespace to enable high-speed communication, then data communication speed is improved, but isolation between containers is damaged
Solution Approach 1:
The patent segments the IPC namespace at the load balancer level. Each load balancer container is assigned a dedicated IPC namespace, while service provider containers share a common IPC namespace. This segmentation allows fast IPC communication within the service provider namespace while maintaining isolation between different load balancer containers through their separate namespaces.
2Reliability
If separate IPC namespaces are used for each container to maintain isolation, then isolation between containers is preserved, but data communication speed decreases
Solution Approach 1:
The patent merges multiple service provider containers into a shared IPC namespace, enabling them to communicate at memory access speeds without the overhead of network protocols. This merging provides fast communication paths for service providers while the load balancer maintains its own separate namespace for isolation, achieving both speed and security requirements.
3Reliability
If network communication is used between containers, then isolation is maintained, but communication overhead increases and speed decreases
Solution Approach 1:
The patent introduces an intermediary load balancer container that acts as a gateway between the service consumer and service provider containers. The load balancer is deployed in the same network namespace as the service consumer (enabling network communication and isolation) while being assigned a separate IPC namespace. This intermediary structure allows service consumers to access service providers through the load balancer, achieving both isolation and efficient communication.
Data Source
Figure 1a
Figure 1b
Figure 1c
AI summary
Embodiments of the present invention disclose a container deployment method, a communication method between services, and a related apparatus, so as to increase an access speed between containers while ensuring isolation between containers on a same host. The container deployment method includes: receiving a container deployment message, where the container deployment message includes container image information and association information of a container; creating, based on the container image information, a container for a first service, and a first network namespace and a first inter-process communication IPC namespace that are corresponding to the container for the first service; creating a first load balancing container corresponding to the container for the first service, and setting a running parameter of the first load balancing container to a parameter of the first network namespace; creating a loopback interface in the first network namespace; determining, based on the association information of the container, that the network device has a container that is for a second service and that is associated with the container for the first service; and setting a starting parameter of the first load balancing container to a parameter of a second IPC namespace.