Selective Virtualization of Application Data in Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional software applications writing directly to the global file system and registry can lead to clutter and security issues, as files and registry entries are often not visible to other applications and persist after uninstallation, whereas newer containerized applications isolate writes but may not allow necessary visibility or persistence.
Innovation Solution
The system allows for selective virtualization of software application data by including virtualization exclusions in the application package, enabling specific locations in the file system and registry to be written to globally, making data visible to other applications and persisting after uninstallation, while maintaining the benefits of containerization such as decreased system clutter and increased security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If applications write directly to the global file system and registry, then data visibility to other applications is improved, but system clutter and security issues worsen
Solution Approach 1:
The patent segments the file system access into two distinct paths: virtualized paths for isolated application data and global paths for shared data. The virtualization layer divides write operations based on configuration, routing some to virtual locations (for isolation) and others to global locations (for visibility), thereby resolving the contradiction between data isolation and data sharing
Solution Approach 2:
The patent applies different virtualization behaviors to different locations based on local quality principles. Specific paths or locations can be configured to use virtualization while others bypass it. This allows certain data to be isolated while other data remains globally accessible, resolving the contradiction through selective application of virtualization properties
2Duration of action of stationary object
If applications write directly to the global file system and registry, then data persistence after uninstallation is improved, but security and isolation worsen
Solution Approach 1:
The patent implements dynamic virtualization behavior where the system can adaptively choose between virtualized and global write paths based on configuration. This dynamic approach allows data persistence for locations requiring it while maintaining isolation for locations where it should be enforced, resolving the contradiction between persistence and isolation
Solution Approach 2:
The patent changes the virtualization parameter (enabled/disabled or true/false) for different locations or paths. By modifying this parameter based on location-specific requirements, the system can achieve both persistence where needed and isolation where required, resolving the contradiction through parameter variation
3Object-affected harmful factors
If containerized applications isolate all writes to virtual file system, then system clutter is reduced, but data visibility to other applications worsens
Solution Approach 1:
The patent segments write operations into isolated virtual paths and shared global paths. The virtualization layer analyzes the write destination and routes accordingly, allowing most data to be isolated (reducing clutter) while specific data remains visible to other applications (maintaining information access)
Solution Approach 2:
The virtualization layer acts as an intermediary between the application and the file system. It mediates write operations by translating some to virtual locations and others to global locations, thereby enabling both isolation and visibility requirements to be satisfied simultaneously
Data Source
AI summary
In non-limiting examples of the present disclosure, systems, methods and devices for selectively virtualizing software application functions are presented. An application package for a containerized software application may be received. The application package may comprise an application manifest and a virtualization exclusion for a first location of a global file system of the computing device. The containerized software application may be installed in a container comprising a virtual file system. An indication to write a first new file at the first location may be received by the containerized software application. A determination may be made that the first location comprises the virtualization exclusion. The first new file may be written to the first location of the global file system based on the determination that the first location comprises the virtualization exclusion.