Container Endpoint ACLs Using eBPF for Scalable Network Isolation

Solution Overview

Problem

The existing method of relying on virtual private cloud (VPC) security groups for container network security isolation leads to high activation delays and quota limitations, making it unsuitable for large-scale deployments.

Innovation Solution

Implementing a network endpoint-level access control list using an extended Berkeley packet filter (cBPF) program to determine and manage access actions between container network endpoints, allowing or denying communication based on preconfigured rules, independent of underlying infrastructure capabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If VPC security group is used for container network security isolation, then security isolation is achieved, but activation delay increases and quota limitations occur

Engineering Contradiction:

Improvesecurity isolationVSAvoidactivation delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the security control mechanism from the VPC security group level down to the network endpoint level within containers. By implementing access control lists at the network endpoint level using eBPF, the system divides the monolithic VPC security group control into finer-grained, independent control units that can be activated immediately without waiting for VPC-level policy propagation, thus reducing activation delay while maintaining security isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces eBPF (extended Berkeley packet filter) as an intermediary layer between the container network endpoints and the VPC security group. This intermediary implements access control lists that enforce security policies locally at the network endpoint level, bypassing the need for frequent VPC security group operations and reducing activation delay while eliminating quota limitations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If VPC security group is used for container network security isolation, then security isolation is achieved, but adaptability to large-scale deployment decreases due to quota limitations

Engineering Contradiction:

Improvesecurity isolationVSAvoidadaptability to large-scale deployment

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the security control mechanism from the VPC security group level down to the network endpoint level within containers. By implementing access control lists at the network endpoint level using eBPF, the system divides the monolithic VPC security group control into finer-grained, independent control units that can be activated immediately without waiting for VPC-level policy propagation, thus reducing activation delay while maintaining security isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent enables each container's network endpoint to enforce its own access control policies locally through eBPF programs. This self-service approach allows containers to independently manage their security isolation without relying on centralized VPC security group operations, eliminating quota limitations and enabling scalable deployment across large numbers of containers.

Inventive Principle:

Principle #25Self-service

3Reliability

If VPC security group rules are frequently operated during container creation and deletion, then security isolation is maintained, but operation complexity and time consumption increase

Engineering Contradiction:

Improvesecurity isolationVSAvoidoperation complexity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent configures access control lists at the network endpoint level in advance using eBPF programs during container initialization. This preliminary action ensures that security isolation is already in place before containers are created or deleted, eliminating the need for frequent post-creation security group rule operations and reducing operational complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent enables each container's network endpoint to enforce its own access control policies locally through eBPF programs. This self-service approach allows containers to independently manage their security isolation without relying on centralized VPC security group operations, eliminating quota limitations and enabling scalable deployment across large numbers of containers.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20260032121A1Container network access control method, apparatus, medium, and device

Publication Date: 2026.01.29 BEIJING VOLCANO ENGINE TECH CO LTD

AI summary

The present disclosure relates to a container network access control method and apparatus, a medium, a device, and a program product. The method includes: determining, by a filter, identity information of a first network endpoint and identity information of a second network endpoint, searching for a target access action corresponding to the identity information of the first network endpoint and the identity information of the second network endpoint based on a network endpoint-level access control list preconfigured for the Pod, and performing the target access action.