VM Cloning for Container Isolation and Resource Recycling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Container migration in data centers often requires booting a new VM, which takes a long time, especially when transitioning from high isolation to high density deployments, impacting efficiency and resource utilization.
Innovation Solution
The solution involves cloning a VM to create a separate instance, implementing a copy-on-write mechanism to share memory, and using virtual switches to reroute network connections, allowing containers to run concurrently and efficiently transition between isolation and density modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new VM is booted to provide strong isolation for containers, then security and isolation are improved, but provisioning time increases significantly
Solution Approach 1:
The system performs preliminary actions by cloning the VM configuration and memory state before actual migration. The copy-on-write mechanism pre-establishes the isolated environment structure, so that when isolation is needed, the VM is already prepared and only needs activation rather than full booting, thus reducing provisioning time while maintaining strong isolation.
Solution Approach 2:
The patent uses VM cloning to create a copy of the virtual machine with identical configuration and memory state. This copied VM can be quickly activated to provide isolated container execution without going through the slow process of booting a new VM from scratch, thereby resolving the contradiction between fast provisioning and strong isolation.
2Reliability
If containers are migrated to separate VMs for strong isolation, then security is improved, but resource utilization decreases due to duplicated OS kernels
Solution Approach 1:
The patent implements a universal OS kernel that can be shared across multiple VM instances through the copy-on-write mechanism. The same kernel image serves multiple containers even when they are isolated in separate VMs, eliminating the need for duplicate kernel copies and thus maintaining high resource utilization while providing strong isolation through VM boundaries.
Solution Approach 2:
The system recovers memory resources by using copy-on-write, where memory pages are shared between VMs until modification is needed. When a VM is cloned for isolation, it initially shares memory with the parent VM, and only creates duplicate copies when actual writes occur. This allows the system to discard redundant memory copies and recover resources, maintaining high resource utilization while enabling strong isolation when needed.
3Reliability
If container migration is implemented with full VM booting, then isolation is ensured, but efficiency and flexibility are reduced
Solution Approach 1:
The patent introduces dynamic behavior to the VM migration process by making the isolation mechanism adaptable. The system can dynamically switch between sharing and isolating VMs based on container requirements. When containers need isolation, the system dynamically clones the VM with copy-on-write; when isolation is not needed, containers can share the same VM. This dynamic approach ensures isolation when required while maintaining efficiency and flexibility when isolation is not necessary.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples may include techniques to run one or more containers on a virtual machine (VM). Examples include cloning a first VM to result in a second VM. The cloned first VM may run at least a set ofcontainers capable of separately executing one or more applications. In some examples, some cloned containers are stopped at either the first or second VMs to allow for at least some resources provisioned to support the first or second VMs to be reused or recycled at a hosting node. In other examples, the second VM is migrated from the hosting node to a destination hosting node to further enable resources to be reused or recycled at the hosting node.