Containerized Multitenant Middleware Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multitenant middleware environments face challenges in isolating tenant-unaware OS processes from other tenants, leading to loss of tenant context and runtime separation when these processes execute outside the application server environment, sharing common OS resources.
Innovation Solution
The system and method provide tenant-scoped execution by associating partitions and tenant-aware programs with tenants, collecting tenancy information, and setting up a process execution environment and resources, using containerized applications to ensure runtime isolation of tenant-unaware processes through environment variables, virtual tenant filesystems, and process builders.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If tenant-unaware OS processes execute outside the application server environment, then ease of operation is improved, but runtime isolation and tenant context preservation deteriorate
Solution Approach 1:
The patent introduces a process execution environment as an intermediary layer between the tenant-unaware OS process and the multitenant middleware. This environment acts as a mediator that translates tenant context from the middleware into OS-level process isolation mechanisms, enabling runtime isolation without requiring modifications to the OS process itself. The intermediary captures tenant identification information from the middleware and uses it to establish isolated execution contexts.
Solution Approach 2:
The patent segments the execution environment into tenant-specific isolated contexts. Each tenant receives a dedicated process execution environment with isolated resources, environment variables, and filesystem views. This segmentation allows multiple tenant-unaware OS processes to run simultaneously on the same OS while maintaining strict runtime isolation through virtualized execution contexts.
2Productivity
If tenant-unaware OS processes share common OS resources, then productivity is improved, but loss of information increases due to tenant context loss
Solution Approach 1:
The patent performs preliminary capture of tenant context information before the OS process executes. The process execution environment intercepts and stores tenant identification information, security credentials, and contextual data from the multitenant middleware at the time of process invocation. This preliminary action ensures tenant context is preserved and made available throughout the OS process execution, preventing information loss despite shared OS resources.
Solution Approach 2:
The patent implements local quality by providing each tenant with customized execution environment properties while sharing underlying OS resources. Each tenant's process execution environment has localized quality attributes such as tenant-specific environment variables, isolated filesystem views, and customized resource access permissions. This allows productive sharing of OS resources while maintaining distinct tenant contexts through localized environment properties.
3Reliability
If containerized applications are used for runtime isolation, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal process execution environment that can handle multiple tenants and various types of OS processes through a single standardized interface. The same isolation mechanism and context capture logic apply regardless of the specific tenant or OS process being executed. This universality reduces device complexity by avoiding the need for separate isolation infrastructure for each tenant while maintaining reliable runtime isolation through the unified multitenant-aware execution environment.
Data Source
AI summary
In accordance with an embodiment, described herein is a system and method for supporting multitenant execution of a tenant-unaware program invoked from a multitenant middleware application. An exemplar method can provide, at one or more computers, including an application server environment executing thereon, a plurality of partitions, and a plurality of tenant-aware programs, wherein each of the plurality of tenant-aware programs is associated with a partition. The method can associate each of the plurality of partitions and the plurality of tenant-aware programs with a tenant of a plurality of tenants. The method can invoke the tenant-unaware process from a calling partition of the plurality of partitions, and collect tenancy information about the calling tenant. Based upon the collected tenancy information, the method can scope execution of the tenant-unware process to the calling tenant by launching the tenant-unware process as a containerized process.