Managed Forwarding Element Ports for Container Network Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container-based virtualization systems face challenges in efficiently managing network traffic and policies for multiple containers and applications within a single virtual machine, as they often require distinct IP interfaces, MAC addresses, and different networking policies, which complicates network forwarding and virtualization.
Innovation Solution
Implementing a managed forwarding element (MFE) on a host machine that creates separate ports for each IP interface within a virtual machine, allowing multiple virtual network interface cards (VNICs) to connect to multiple MFE ports, with each port having its own forwarding table entries and policies, and utilizing a controller to manage the lifecycle of these ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple containers or applications in a VM share a single VNIC to communicate with external applications, then resource utilization is improved, but network traffic management complexity increases due to the need to distinguish between different IP interfaces, MAC addresses, and networking policies
Solution Approach 1:
The patent segments the network interface by creating a separate MFE port for each IP interface within a VM, even though they share a common VNIC. This allows the system to maintain resource efficiency while managing network traffic complexity through logical separation of forwarding paths for different containers or applications.
Solution Approach 2:
The Managed Forwarding Element (MFE) acts as an intermediary between the VNIC and the network. It receives traffic from the shared VNIC, identifies the source IP interface, applies appropriate policies, and forwards traffic accordingly. This mediator approach resolves the contradiction by centralizing the complexity management in a dedicated component.
2Reliability
If each IP interface in a VM is assigned a separate MFE port with its own forwarding table entries and policies, then network policy enforcement is improved, but device complexity increases
Solution Approach 1:
The system automatically creates MFE ports, forwarding table entries, and applies policies when IP interfaces are detected or registered. This self-service mechanism reduces manual configuration complexity while maintaining reliable policy enforcement for each IP interface.
Solution Approach 2:
The MFE port framework provides a universal structure that can handle multiple IP interfaces, containers, and applications through a standardized paradigm. This multi-functionality reduces overall system complexity by reusing the same port management mechanisms across different scenarios.
3Ease of operation
If a controller manages the lifecycle of MFE ports for containers and applications, then ease of operation is improved, but device complexity increases due to additional control components
Solution Approach 1:
The controller automatically manages port creation, deletion, and configuration based on IP interface detection and registration events. This automated self-service approach simplifies operation while containing controller complexity through event-driven, rule-based logic rather than manual intervention.
Data Source
AI summary
A method of creating containers in a physical host that includes a managed forwarding element (MFE) configured to forward packets to and from a set of data compute nodes (DCNs) hosted by the physical host. The method creates a container DCN in the host. The container DCN includes a virtual network interface card (VNIC) configured to exchange packets with the MFE. The method creates a plurality of containers in the container DCN. The method, for each container in the container DCN, creates a corresponding port on the MFE. The method sends packets addressed to each of the plurality of containers from the corresponding MFE port to the VNIC of the container DCN.