Emulated GPU Access for Secure Multi-Container Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The unique challenges in using containers for GPU-heavy applications have limited their use due to the complex interface between kernel-mode and user-mode drivers, requiring extensive engineering effort and maintenance, and existing solutions fail to provide secure, isolated GPU access for multiple containers.
Innovation Solution
A driver self-emulation approach is used to create multiple emulated GPUs, each associated with a single container, enabling secure and isolated GPU access through a kernel-mode driver that generates emulated GPUs and device nodes, allowing seamless communication with a physical GPU while enforcing quality of service and isolation policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If containers are used to access GPU resources, then GPU acceleration in containers is enabled, but the complex interface between kernel-mode and user-mode drivers creates extensive engineering effort and maintenance challenges
Solution Approach 1:
The patent introduces a kernel-mode driver as an intermediary layer between user-mode containers and the physical GPU. This driver creates emulated GPU devices that containers can access through standard device nodes, mediating all GPU access requests and translating them into appropriate operations on the physical GPU. This intermediary approach eliminates the need for complex user-mode driver interfaces in containers while maintaining full GPU functionality.
Solution Approach 2:
The patent creates emulated GPU devices that are software copies or virtual representations of the physical GPU. These emulated devices include virtual device nodes that containers can access using standard containerization interfaces. The emulated GPU copies the essential interface and functionality of the physical device, allowing containers to interact with GPU resources through simplified, standardized mechanisms rather than complex direct interfaces.
2Productivity
If multiple containers share GPU resources, then resource utilization efficiency is improved, but secure isolation between containers becomes challenging
Solution Approach 1:
The patent segments the physical GPU resources into multiple emulated GPU devices, with each emulated device assigned to a specific container. The kernel-mode driver creates separate device nodes for each container, enabling isolated access paths. This segmentation ensures that containers can share the physical GPU hardware while maintaining secure logical isolation through distinct virtual device interfaces and controlled resource allocation.
3Adaptability or versatility
If user-mode drivers are containerized, then container portability is improved, but the complexity of containerizing drivers increases significantly
Solution Approach 1:
The patent extracts the driver functionality from user-mode containers and relocates it to the kernel-mode layer. By moving the complex driver logic out of containers and into the host kernel, the solution eliminates the need to containerize drivers altogether. Containers access GPU resources through standard kernel-provided device nodes, removing driver containerization complexity while preserving container portability and the ability to access GPU acceleration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for container access to graphics processing unit (GPU) resources are disclosed herein. In some embodiments, a computing system may include a physical GPU and kernel-mode driver circuitry, to communicatively couple with the physical GPU to create a plurality of emulated GPUs and a corresponding plurality of device nodes. Each device node may be associated with a single corresponding user-side container to enable communication between the user-side container and the corresponding emulated GPU. Other embodiments may be disclosed and/or claimed.