Docker Container File System Isolation via Virtual Instances
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Docker containers face isolation issues due to shared kernel resources, leading to lock competition and file system resource competition, which existing solutions do not adequately address, especially in cloud computing environments.
Innovation Solution
A Docker-container-oriented method that classifies lock resources into fine and coarse locks, allocates host file system resources based on container requests, and configures fine replicas of locks to prevent competition, allowing containers to manage their resources independently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If containers share the host file system, then resource utilization is improved, but lock competition and resource interference occur
Solution Approach 1:
The patent segments the host file system resources by introducing virtual file system instances for each container. Each container is assigned a dedicated virtual file system instance that provides isolated access to file system resources, preventing lock competition while maintaining efficient resource utilization. The virtual file system acts as an intermediary layer between containers and the host file system.
2Speed
If containers share the same kernel, then performance is improved, but isolation is weakened
Solution Approach 1:
The patent introduces a virtual file system instance as an intermediary between containers and the host file system. This intermediary layer provides isolated access paths for each container, preventing direct competition for kernel locks while maintaining efficient file system operations. The virtual file system instance mediates all file system access requests from containers.
3Productivity
If more containers are deployed on a server, then resource efficiency is improved, but resource competition intensifies
Solution Approach 1:
The patent segments file system resource access by creating dedicated virtual file system instances for each container. This segmentation allows multiple containers to be deployed on a single server without direct resource competition, as each container operates within its own isolated virtual file system instance that provides dedicated access paths to the host file system.
4Productivity
If a malicious container creates huge amounts of files, then file creation capability is improved, but other containers are prevented from creating files
Solution Approach 1:
The patent segments the global inode pool into container-specific inode pools by introducing virtual file system instances. Each container is allocated a dedicated portion of inodes within its virtual file system instance, preventing any single container from exhausting the host file system's inode resources. This segmentation isolates resource consumption to individual container boundaries.
Data Source
AI summary
The present invention relates to a Docker-container-oriented method for isolation of file system resources, which allocates host file system resources according to access requests from containers and checks lock resources corresponding to the access requests. The method creates a plurality of new containers; allocating the host file system resources according to file resource request parameters required by the new containers; and controlling execution of the file system operation according to an amount of the file system resources that have been allocated to the new containers.