Service Container Mobility via Sidecar Proxy Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sidecar containers in micro-services applications have limited mobility and are non-transparent, and legacy virtual machines require inline services like load balancing and intrusion detection systems to be deployed through middleboxes, which restricts flexibility and mobility.
Innovation Solution
Configuring multiple sets of service containers on a host computer to perform service operations on data messages, with a module identifying and directing data messages to appropriate service containers for operations like firewall, load balancing, and encryption, allowing for flexible deployment and migration across machines and networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sidecar containers are deployed in series with forwarding across individual service containers, then service operations such as authentication, service discovery, encryption, and load balancing can be handled, but mobility of the container is restricted due to dependency on the attached sidecar proxy
Solution Approach 1:
The patent introduces a service mesh architecture with a sidecar proxy acting as an intermediary between service containers and the network. The sidecar proxy handles service operations (authentication, service discovery, encryption, load balancing) while the service container remains mobile. The proxy is attached to the service container but manages network communications independently, allowing the container to move while maintaining service capabilities through the proxy's mediation.
2Reliability
If web server or application server container is configured to send traffic to sidecar proxy in non-transparent mode, then service operations can be performed, but deployment is fixed and requires configuration changes to the container
Solution Approach 1:
The sidecar proxy serves as an intermediary that intercepts and manages traffic between the service container and the network. The proxy is configured to receive traffic from the service container and perform service operations (authentication, service discovery, encryption, load balancing) before forwarding to the destination. This allows service operations to be performed without requiring configuration changes to the service container itself, as the proxy handles all service-related traffic management.
3Reliability
If inline services are deployed through middleboxes for virtual machines running legacy applications, then services like load balancing and intrusion detection can be provided, but the architecture lacks flexibility and mobility
Solution Approach 1:
The patent replaces traditional middlebox architecture with a sidecar proxy model. The sidecar proxy is attached to each service container and acts as an intermediary that provides service operations (load balancing, intrusion detection, authentication) directly at the container level. This eliminates the need for separate middleboxes and allows services to move with the containers, providing both service provision and architectural flexibility.
Solution Approach 2:
The patent segments service operations from service containers by introducing sidecar proxies. Each service container gets its own dedicated sidecar proxy that handles all service operations for that container. This segmentation allows service containers to be independent and mobile while the proxy handles service functionality, enabling flexible deployment architectures where services can be distributed across multiple containers and hosts.
Data Source
AI summary
Some embodiments provide a method for performing services on a host computer that executes several machines in a datacenter. The method configures a first set of one or more service containers for a first machine executing on the host computer, and a second set of one or more service containers for a second machine executing on the host computer. Each configured service container performs a service operation on data messages associated with a particular machine. For each particular machine, the method also configures a module along the particular machine's datapath to identify a subset of service operations to perform on a set of data messages associated with the particular machine, and to direct the set of data messages to a set of service containers configured for the particular machine to perform the identified set of service operations on the set of data messages.