Front-End Proxy Container for Secure Back-End Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deploying containers for applications on front-end hosts can compromise network security and is error-prone, as it provides both front-end and back-end access, and managing separate back-end and front-end containers is tedious.
Innovation Solution
Deploying a container on a back-end host and a proxy container on a front-end host, allowing the proxy container to manage traffic and provide external connectivity without requiring a container on the front-end host, thereby enhancing security and simplifying management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a container is deployed on a front-end host to provide external connectivity, then the application gains external access, but network security is compromised and management becomes error-prone
Solution Approach 1:
The system segments the container deployment into two distinct components: a back-end container deployed on the back-end host that provides the actual application service, and a front-end proxy container deployed on the front-end host that handles external connectivity. This segmentation allows the application to gain external access through the proxy container while the back-end container remains isolated and secure on the back-end host, thus resolving the contradiction between external connectivity and network security.
2Adaptability or versatility
If separate back-end and front-end containers are deployed, then external connectivity is provided, but management becomes tedious and complex
Solution Approach 1:
The system merges the management of back-end and front-end containers into a unified orchestration framework. A single deployment action automatically creates and configures both the back-end container on the back-end host and the front-end proxy container on the front-end host, along with their interconnections. This unified management approach eliminates the tedium of manually managing separate containers while maintaining the security and connectivity benefits of the segmented architecture.
3Adaptability or versatility
If a container is deployed on a front-end host, then external connectivity is achieved, but processing resources are consumed on the front-end host
Solution Approach 1:
The system extracts the computationally intensive application workload from the front-end host and relocates it to the back-end host within a back-end container. The front-end host only hosts a lightweight proxy container that handles network traffic routing and connectivity management. This extraction significantly reduces the processing resource consumption on the front-end host while maintaining external connectivity capabilities through the proxy container.
Data Source
AI summary
A device can receive a request to deploy a container to provide a service. The request can include information identifying a set of parameters associated with the container. The device can validate the request using the information identifying the set of parameters. The device can deploy the container on a back-end host. The back-end host can lack connectivity to an external network. The device can receive a first indication that the container was successfully deployed on the back-end host. The device can deploy a proxy container on a front-end host. The front-end host can have connectivity to the external network. The device can receive a second indication that the proxy container was successfully deployed on the front-end host. The device can provide a third indication. The third indication can indicate that the container was successfully deployed.