Webtask Container Multi-tenancy Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing platforms face challenges in efficiently managing and securing multi-tenant environments, particularly in terms of resource allocation, isolation, and security, which affects application density and cost effectiveness.
Innovation Solution
The system employs a multi-tenancy infrastructure that encapsulates server code and secrets within a webtask token, allowing for secure execution of arbitrary applications in isolated containers, without persistent storage, and utilizing a generic execution environment for resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional cloud computing platforms are used for multi-tenancy, then resource allocation and security can be managed, but application density is limited and costs are higher
Solution Approach 1:
The system segments application execution into isolated containers, each running in its own sandboxed environment. This allows multiple applications to run simultaneously on the same infrastructure while maintaining complete isolation between them, thereby increasing application density without compromising security or stability.
Solution Approach 2:
The patent introduces a request-response framework as an intermediary layer between clients and the execution environment. Code is encapsulated within these requests, which are then executed in isolated containers. This intermediary mechanism enables secure multi-tenancy while simplifying infrastructure management.
2Reliability
If code is persistently stored on servers, then execution can be rapid, but security risks increase and infrastructure costs increase
Solution Approach 1:
The system dynamically executes code within isolated containers rather than persistently storing it on servers. Code is received, executed, and then discarded after use. This dynamic approach eliminates security risks associated with persistent storage while maintaining rapid execution through efficient container management and code encapsulation in requests.
3Reliability
If more isolation mechanisms are implemented for tenant data, then security improves, but resource consumption increases
Solution Approach 1:
The patent employs flexible isolation mechanisms at the container level, using lightweight sandboxing techniques rather than heavy-duty physical isolation. These thin-layer isolation mechanisms provide sufficient data separation between tenants while minimizing resource consumption, allowing efficient multi-tenancy without excessive overhead.
Data Source
AI summary
A multitenant infrastructure server (MTIS) is configured to provide an environment to execute a computer routine of an arbitrary application. The MTIS receives a request from a webtask server to execute the computer routine in a webtask container. The computer routine is executed in the webtask container at the MTIS. Upon successful execution of the computer routine, a result set is returned to the webtask server. If the execution of the computer routine is unsuccessful, an error notification is returned to the webtask server. The resources consumed during the execution of the computer routine are determined. The webtask container is destroyed to prevent persistent storage of the computer routine on the MTIS.