Container Memory Isolation via Namespace Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In container technology, concurrent running of multiple containers leads to data inconsistency due to shared memory spaces, affecting the normal operation of application services.
Innovation Solution
Each container is allocated its own private memory and private service linked list, ensuring data consistency and independence through a namespace filtering module that manages inter-process communication namespaces and memory allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple containers share the same memory space for inter-process communication, then memory utilization is improved, but data consistency deteriorates
Solution Approach 1:
The patent divides the shared memory space into separate memory spaces for different containers. Each container is allocated its own memory space through the namespace filtering module, which prevents other containers from accessing this memory space. This segmentation maintains memory isolation and data consistency while still enabling efficient inter-process communication within each container's boundaries.
Solution Approach 2:
The patent introduces a namespace filtering module as an intermediary between containers and the memory space. This module manages memory allocation and access rights, ensuring that each container can access its designated memory space without interfering with other containers. The namespace filtering module acts as a mediator that enables safe shared memory usage while preventing data inconsistency.
2Productivity
If containers use shared memory for communication, then communication efficiency is improved, but system complexity increases due to memory management
Solution Approach 1:
The patent implements self-service memory management where the namespace filtering module automatically handles memory space allocation and access control for each container. When a container needs to communicate with another container, the system automatically assigns appropriate memory spaces and establishes communication channels without manual intervention. This self-service approach simplifies memory management while maintaining high communication efficiency.
3Device complexity
If containers apply for shared memory sequentially, then memory allocation is simplified, but service processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-allocating memory spaces for containers before they need to communicate. The namespace filtering module prepares and assigns memory spaces in advance, so when containers need to establish communication, the memory allocation is already complete. This eliminates the sequential application process and reduces service processing time while maintaining simple memory allocation management.
Data Source
Figure 1~2
Figure 3A
Figure 3B
AI summary
This application provides a data processing method. The method is applied to a server, the server includes a first container and an Android driver (240), and a first service manager is deployed in the first container. The first service manager receives a request message of a first process, and then sends the request message to the Android driver (240). The Android driver (240) first determines a first inter-process communication IPC namespace based on a PID of the first service manager carried in the request message, and then determines a first Android namespace based on a pointer of a structure of the first IPC namespace. Then, control information in the request message is stored into a first private service linked list of the first Android namespace, and content information in the request message is stored into first private memory of the first Android namespace. In the technical solutions provided in this application, each container is allocated its respective private memory (2412, 2422, and 2432) and private service linked list (2411, 2421, and 2431), so as to avoid a problem in a conventional technology of data inconsistency and affected service processing caused by sharing of same memory by a plurality of containers.