Nested Application Containers for Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to isolate applications with conflicting processes within the same container and efficiently allocate container resources, as they do not allow for the creation and launching of isolated Application Containers inside another container.
Innovation Solution
A method for creating and launching Application Containers inside a selected container by creating an image file, mounting a virtual disk, defining boundaries, and establishing an interface for data exchange, while protecting the image file and file system from modification, allowing processes to connect as if they are native host OS processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If applications are run inside the same container, then resource sharing is improved, but application isolation deteriorates causing conflicts between processes
Solution Approach 1:
The patent divides a container into multiple isolated Application Containers, each capable of running applications independently. This segmentation allows multiple applications to share the parent container's resources while maintaining process isolation through separate file systems and namespace boundaries, resolving the conflict between resource sharing and application isolation.
Solution Approach 2:
The patent implements nested container structures where Application Containers are created inside a parent container. Each nested Application Container has its own isolated file system and process namespace but shares the parent container's host OS resources. This nesting approach enables both efficient resource sharing at the parent level and application isolation at the child level.
2Reliability
If Application Containers are created inside a container, then application isolation is improved, but device complexity deteriorates due to nested virtualization layers
Solution Approach 1:
The patent introduces a container manager as an intermediary component that handles the creation, management, and coordination of Application Containers within the parent container. This intermediary abstracts the complexity of nested virtualization, providing simplified interfaces for resource allocation and process management while maintaining the isolated environment needed for application separation.
3Ease of operation
If processes are allowed to access host OS directly, then ease of operation is improved, but system security deteriorates due to unauthorized modifications
Solution Approach 1:
The patent adds an intermediate dimension between Application Containers and the host OS by introducing protected file system layers and controlled interfaces. Processes within Application Containers can access host OS resources through defined boundaries and interfaces, maintaining ease of operation for legitimate access while preventing unauthorized modifications through the protective file system barriers and namespace isolation.
Data Source
AI summary
Method for partitioning environments includes instantiating a parent VEE under a host OS; opening a file system of the parent VEE for modification; inside the FS of the parent VEE, creating an image file of an Application Container; mounting a virtual disk that corresponds to the image file; mounting the Application Container file system inside the image file; defining boundaries of the Application Container; placing Application Container files inside the Application Container file system; and creating an interface between the parent VEE and the Application Container for exchanging data. The processes of the Application Container connect to processes of the parent VEE as if they were native host OS processes. The Application Container can only request data from the host OS through the interface of the parent VEE. The image file is protected from modification by the parent VEE. The processes of the Application Container are launched inside the boundaries.