Guest Virtual File System for Isolated Zone Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In zone-based virtualization, when a non-global zone becomes non-functional, users face challenges in accessing and restoring the virtual environment without compromising the privacy of their backup media, as existing methods do not effectively isolate and manage data access within a unified archive accessible to multiple guest users.
Innovation Solution
A method and system that utilize a unified archive accessible via a virtual file system, where a guest virtual file system is created within the non-global zone, allowing access only to the specific data associated with that zone, using a reduced index to isolate and manage data access, enabling the creation and restoration of virtual environments while maintaining data privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a unified archive is made accessible to multiple users via a shared virtual file system, then resource efficiency and ease of operation are improved, but data privacy and security are compromised
Solution Approach 1:
The unified archive's virtual file system is segmented into multiple isolated guest virtual file systems, each accessible only to a specific non-global zone. The index structure is divided into separate index files for each guest, allowing selective access to only the relevant portions of the unified archive. This segmentation enables multiple users to share the same physical storage infrastructure while maintaining logical isolation and data privacy.
2Ease of repair
If backup media is stored in a shared location accessible to the host system, then ease of restoration is improved, but unauthorized access to other users' data becomes possible
Solution Approach 1:
A guest virtual file system acts as an intermediary layer between the host system and the unified archive. This intermediary provides controlled access to backup media by filtering and restricting which portions of the unified archive are visible to each guest zone. The zone manager and VFS daemon work together to ensure that restoration operations can access necessary backup data while other users' data remains inaccessible, thus enabling ease of repair without compromising security.
3Object-affected harmful factors
If a complete virtual file system is provided to each non-global zone, then data isolation is improved, but system resource consumption and device complexity increase
Solution Approach 1:
Guest virtual file systems are nested within the host global zone's virtual file system infrastructure. Each guest VFS is a logical construct that references portions of the unified archive through a simplified index, rather than maintaining completely independent file system structures. This nesting approach provides effective data isolation for each non-global zone while avoiding the overhead of duplicating entire file system structures, thus reducing device complexity and resource consumption.
Data Source
AI summary
A method for creating a virtual environment (VE) in a non-global zone (NGZ) from a unified archive (UA). An instruction is received to create a VE within a NGZ of a global zone (GZ) using an image file of the VE located in the UA. The contents of the UA are accessible via a virtual file system (VFS) having an index. A directory of the VFS corresponding to guest data of the UA is identified. The guest data is associated with the NGZ and includes the image file. A copy of the index including only portions of the index corresponding to the guest data is created. A guest VFS is created within the NGZ based on the copy. The guest VFS makes only the contents of the UA corresponding to the guest data accessible. The image file is accessed using the guest VFS and used to create the VE.