One-to-One Lightweight VM Mapping for Container Hot Migration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing container hot migration processes based on Docker containers face issues with hardware resource interference and imbalance between user-mode and kernel-mode migration, leading to inefficiencies and potential security threats.

Innovation Solution

A method and device utilizing a customized virtual machine manager, such as rust-vmm, to create a one-to-one correspondence between a lightweight virtual machine and a container, enabling secure and efficient hot migration by saving and restoring memory data and running status, while leveraging KVM virtualization for resource isolation and extending kubectl commands for cloud-native operation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If traditional Docker container hot migration is used, then migration speed is improved, but hardware resource interference and imbalance between user-mode and kernel-mode migration occur

Engineering Contradiction:

Improvemigration speedVSAvoidhardware resource interference

Core Design Contradiction:

SpeedVSObject-affected harmful factors

Solution Approach 1:

The patent segments the container migration process into distinct user-mode and kernel-mode components. The user-mode container is migrated first, then the kernel-mode virtual machine is separately created and configured. This segmentation allows independent optimization of migration speed for user-mode components while ensuring stable resource allocation for kernel-mode components, thereby reducing hardware resource interference.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a customized virtual machine manager as an intermediary between the container and the physical hardware. This intermediary layer manages the mapping between container resources and physical resources, enabling efficient resource allocation and avoiding direct interference between multiple containers on the same hardware. The intermediary coordinates migration operations to prevent resource conflicts.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If traditional Docker container hot migration is used, then migration process is simplified, but user-mode and kernel-mode migration imbalance occurs

Engineering Contradiction:

Improvemigration process simplicityVSAvoidmigration completeness

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent divides the migration process into two sequential phases: user-mode container migration and kernel-mode virtual machine creation. This segmentation ensures that both user-mode and kernel-mode components are migrated completely and correctly, eliminating the imbalance present in traditional approaches while maintaining operational simplicity through automated coordination.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary actions by first migrating the user-mode container and then creating the corresponding kernel-mode virtual machine with appropriate resource configuration. This preliminary sequencing ensures that all necessary components are in place before finalizing the migration, guaranteeing migration completeness and reliability.

Inventive Principle:

Principle #10Preliminary action

3Productivity

If container hot migration is implemented, then resource utilization is improved, but security threats may arise

Engineering Contradiction:

Improveresource utilizationVSAvoidsecurity threats

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The customized virtual machine manager acts as a security intermediary that mediates between containers and physical hardware resources. It implements strict access control and resource isolation, ensuring that migrated containers cannot access or interfere with other containers' hardware resources. This intermediary layer enables high resource utilization while maintaining security through controlled resource sharing.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

By segmenting the migration process into user-mode and kernel-mode phases with separate resource allocation, the patent creates clear security boundaries. Each phase operates with limited privileges and isolated resource access, preventing security threats from spreading during migration and ensuring that resource utilization improvements do not compromise system security.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20250278290A1Container hot migration method and container hot migration apparatus

Publication Date: 2025.09.04 JD DIGITS HAIYI INFORMATION TECHNOLOGY CO LTD

AI summary

A container hot migration method, including: in response to a container hot migration instruction, determining a first virtual machine on a source physical machine where a container to be migrated is located, first virtual machines corresponding one-to-one with containers to be migrated; acquiring memory data and running status of the first virtual machine and saving same locally; sending the memory data and running status of the first virtual machine to a destination physical machine, so that a second virtual machine on the destination physical machine recovers a running process of the container to be migrated on the destination physical machine according to the received memory data and running status.