Container Network Virtualization via Routable IP Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face limitations in network connectivity and functionality for containers, as they are assigned non-routable network addresses, restricting communication between containers on different hosts and access to network services like load balancing and SDN capabilities.
Innovation Solution
Assigning routable IP addresses to containers within virtual networks, allowing direct network traffic and full connectivity on all ports, enabling seamless communication and access to SDN features without altering existing infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If containers are assigned non-routable network addresses in an isolated namespace, then network security and isolation are improved, but network connectivity and functionality between containers on different hosts deteriorate
Solution Approach 1:
The patent introduces a network address translation (NAT) device as an intermediary between containers with non-routable addresses and the external network. The NAT device translates private container addresses to public routable addresses, enabling containers to maintain isolated non-routable addresses internally while achieving external connectivity through the translation mediator.
Solution Approach 2:
The patent adds a network address translation layer as an additional dimensional level between the container network namespace and the physical network. This creates a dual-address system where containers maintain their original non-routable addresses in one dimension while gaining access to routable addresses in another dimension through the NAT translation layer.
2Quantity of substance
If containers share the same operating system kernel, then resource efficiency is improved, but individual network address assignment and routing capabilities deteriorate
Solution Approach 1:
The patent segments the network address space by introducing virtual network interfaces and NAT translation for each container, allowing containers to maintain individual network identities and address assignments even while sharing the host operating system kernel. Each container receives dedicated public IP addresses through the NAT device, enabling individual routing capabilities.
Solution Approach 2:
The shared operating system kernel provides universal resource management and networking capabilities that benefit all containers, while the overlay of virtual network interfaces and NAT translation adds individualized address assignment functionality. This multi-functional approach allows the system to simultaneously achieve resource efficiency through kernel sharing and individual network addressing through virtualization layers.
3Ease of operation
If network address translation is used for container connectivity, then basic network access is improved, but access to advanced network services like load balancing and routing selection deteriorates
Solution Approach 1:
The patent introduces a virtual network interface and SDN controller as intermediaries between containers and the physical network infrastructure. These intermediaries enable containers to access advanced network services like load balancing and routing selection by translating container network requests into standardized network service calls, bridging the gap between simple NAT functionality and sophisticated network service access.
4Reliability
If containers are limited to host-specific network addresses, then network security within the host is improved, but communication between containers on different hosts deteriorates
Solution Approach 1:
The patent introduces SDN controllers and virtual network interfaces as intermediaries that enable secure inter-host container communication. The SDN controller manages routing policies and security rules across the network, allowing containers on different hosts to communicate through controlled pathways that maintain security boundaries while enabling necessary communication for cloud service operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques of network virtualization of containers in cloud-based system are disclosed herein. In one embodiment, a method includes receiving a selection of a host in the computer system to instantiate a container in response to a request from a user. In response to the received selection, the method includes identifying parameters of network operations on the selected host to instantiate the requested container and assigning a network address to the container to be instantiated on the selected host in the computer system, the assigned network address is addressable from outside of the selected host without network name translation. The method can then include transmitting an instruction to the selected host to instantiate the requested container based on the assigned network address.