Container Storage Isolation via Namespace Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container technologies face challenges in efficiently managing storage resources, as they require full file copies for each container, leading to increased storage demands and reduced density, especially when multiple containers need to access shared files.
Innovation Solution
The implementation of a namespace virtualization component coupled with a copy-on-write mechanism allows containers to access files via normal file system calls while maintaining isolation, using placeholder files and directories that represent shared files, thereby reducing storage needs by redirecting read-only accesses to shared locations and creating private copies for modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full file copies are created for each container, then container isolation is ensured, but storage consumption increases and storage density decreases
Solution Approach 1:
Multiple containers share a single copy of read-only files through namespace virtualization, merging storage resources that would traditionally be duplicated across containers. The shared namespace allows containers to access the same underlying file system objects without requiring separate copies, thereby reducing overall storage consumption while maintaining isolation through virtualized access paths.
Solution Approach 2:
The system creates a virtual copy of the file system namespace that appears as a complete file system to the container but actually points to shared underlying storage. This virtual copying mechanism allows each container to have its own isolated view of files without physically duplicating the data, resolving the contradiction between isolation and storage efficiency.
2Reliability
If full file copies are created for each container, then container isolation is ensured, but storage density decreases
Solution Approach 1:
The patent merges multiple container file system views into a single shared namespace for read-only content, increasing storage density by eliminating physical duplication. Multiple containers can simultaneously access the same storage blocks through different virtualized paths, thereby提高 storage density while preserving isolation boundaries through the virtualization layer.
3Quantity of substance
If shared files are accessed by multiple containers, then storage efficiency improves, but file modification isolation becomes complex
Solution Approach 1:
The file system access is segmented into read-only and read-write paths. Read-only access to shared files goes through the shared namespace, while modification operations are intercepted and redirected to container-specific writable layers. This segmentation allows efficient shared read access while maintaining simple isolation for writes, reducing the complexity of modification handling.
Solution Approach 2:
The namespace virtualization layer acts as an intermediary between containers and the underlying file system. It mediates read operations by directing them to shared storage and write operations by redirecting them to container-specific copies, thereby simplifying the isolation mechanism while maintaining storage efficiency for read-only content.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An application running in a container is able to access files stored on disk via normal file system calls, but in a manner that remains isolated from applications and processes in other containers. In one aspect, a namespace virtualization component is coupled with a copy-on-write component. When an isolated application is accessing a file stored on disk in a read-only manner, the namespace virtualization component and copy-on-write component grant access to the file. But, if the application requests to modify the file, the copy-on-write component intercepts the I/O and effectively creates a copy of the file in a different storage location on disk. The namespace virtualization component is then responsible for hiding the true location of the copy of the file, via namespace mapping.