Hypervisor-Based Container Isolation via Source Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current container orchestration systems, such as Kubernetes, face challenges in effectively applying hypervisor-based containers to clusters running on Infrastructure as a Service (IaaS) clouds due to high-overhead nested virtualization requirements for virtual machine instances, which negatively impact performance, and limited availability of flexible and cost-effective bare machine instances.
Innovation Solution
Creating a network tunnel between a worker node and a sandbox environment without packet encapsulation, using source routing to route packets from the worker node to the sandbox environment, allowing hypervisor-based containers to be applied to a cluster by sharing the same IP address and eliminating the need for nested virtualization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If nested virtualization is used to create sandbox environments on IaaS cloud worker nodes, then isolation is improved, but performance deteriorates due to high overhead
Solution Approach 1:
The patent applies nested virtualization by creating a sandbox environment (nested virtual machine) within the worker node virtual machine instance on the IaaS cloud. The container runtime creates this nested sandbox to isolate pod workloads, accepting the performance overhead as necessary for achieving proper isolation in a multi-tenant cloud environment.
Solution Approach 2:
The patent introduces a network tunnel as an intermediary component between the worker node and the sandbox environment. This tunnel enables direct packet routing without requiring packet encapsulation/decapsulation operations, thereby reducing the performance overhead associated with nested virtualization while maintaining isolation.
2Reliability
If packet encapsulation is used in network tunneling, then network isolation is improved, but network throughput deteriorates
Solution Approach 1:
The patent extracts the packet encapsulation/decapsulation operations from the network tunneling process. Instead of encapsulating packets within tunnel protocols, the system creates a direct network tunnel that routes packets transparently between the worker node and sandbox environment, eliminating the performance penalty of encapsulation while maintaining network isolation through routing controls.
Solution Approach 2:
The network tunnel acts as an intermediary that provides isolation without encapsulation. By using source routing and direct tunneling, the system achieves network isolation through controlled packet forwarding paths rather than through protocol-layer encapsulation, thereby maintaining higher network throughput.
3Reliability
If hypervisor-based containers are applied to IaaS cloud clusters, then isolation is improved, but device complexity increases due to nested virtualization requirements
Solution Approach 1:
The patent implements nested virtualization by creating a sandbox environment within the worker node VM instance. The container runtime (e.g., Kata Container) provisions this nested sandbox, which provides strong isolation for pod workloads while running on the IaaS cloud infrastructure.
Solution Approach 2:
The network tunnel serves as an intermediary that simplifies the virtualization architecture by eliminating the need for complex packet encapsulation mechanisms. This reduces device complexity while maintaining the isolation benefits of hypervisor-based containers.
Data Source
AI summary
A computer-implemented method, system and computer program product for applying hypervisor-based containers to a cluster of a container orchestration system. A container runtime of a worker node in the cluster of the container orchestration system issues a request to create a sandbox environment to store a pod containing one or more containers. Upon creating the sandbox environment for each pod to improve isolation, a network tunnel is created between the worker node and the sandbox environment without packet encapsulation in which the sandbox environment shares the same Internet Protocol (IP) address as the other end of the network tunnel in the worker node. Packets may then be routed (forwarded) from the worker node to the sandbox environment via the network tunnel using source routing. By utilizing such source routing, packet looping is prevented. In this manner, hypervisor-based containers may be applied to a cluster of a container orchestration system.