Container Data Path Interception for Storage-Agnostic Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection operations in containerized environments are complicated by the use of different container and storage providers, requiring high permission levels and often impractical or impossible to implement across various platforms, especially with orchestration systems like Kubernetes and Docker.
Innovation Solution
An agnostic data protection system intercepts data traffic by introducing a protection container that mimics a storage device, allowing data protection operations to be performed independently of specific orchestration systems, with capabilities for snapshot generation, mirroring, and data filtering, while maintaining platform independence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional data protection operations are implemented in containerized environments with multiple storage providers, then data protection coverage is improved, but system complexity and permission requirements increase significantly
Solution Approach 1:
The patent introduces a storage class device as an intermediary layer between containers and multiple storage providers. This mediator abstracts the complexity of different storage systems (NFS, CIFS, SMB, cloud storage) and handles data protection operations centrally, eliminating the need for complex permission configurations on each storage provider while maintaining comprehensive data protection coverage.
Solution Approach 2:
The storage class device is designed with multi-functionality to work with various container orchestration systems (Kubernetes, Docker Swarm, Mesos) and multiple storage providers simultaneously. It provides universal data protection capabilities including snapshots, mirroring, and filtering across heterogeneous environments without requiring provider-specific implementations.
2Reliability
If storage providers are changed or overridden to enable data protection operations, then data protection capability is improved, but operational feasibility deteriorates
Solution Approach 1:
Instead of changing or overriding storage providers, the patent positions the storage class device as an intermediary that sits in front of existing storage providers. This approach maintains operational feasibility by preserving the original storage provider configurations while enabling data protection capabilities through the intermediary layer, avoiding the need to modify or replace existing storage infrastructure.
3Ease of manufacture
If platform-specific data protection solutions are implemented, then integration with orchestration systems is improved, but platform portability deteriorates
Solution Approach 1:
The storage class device is designed as a universal solution that can be deployed across multiple container orchestration platforms including Kubernetes, Docker Swarm, and Mesos. It provides consistent data protection functionality across different platforms without requiring platform-specific implementations, thereby maintaining both integration ease and platform portability through its architecture that works with standard container interfaces.
Solution Approach 2:
The patent segments the data protection functionality into a独立的 storage class device that can be deployed independently of the container orchestration platform. This segmentation allows the same data protection solution to be ported across different platforms without tight coupling, improving platform portability while maintaining effective integration through standardized interfaces.
Data Source
AI summary
An agnostic data path interception in containerized environments is disclosed. A protection container configured to perform an operation such as a data protection operation is packaged as a device interface. A configuration of a main container that is the subject of the operation is changed to point to the device interface of the protection container. This allows the protection container to be positioned in a path between the main container and assigned storage and allows the operation to be performed on input/outputs associated with running the main container.