Red Hat, Inc.

Alexander Larsson

Pierre-Yves Chibon

Daniel J Walsh

Giuseppe Scrivano

Matthias Clasen

Debarshi Ray

Raymond Strode, Jr

Aspects of the disclosure provide for mechanisms for managing containers across operating systems in a computer system. A method of the disclosure includes: causing a first container management agent in a first container to run a user interface in the first container, receiving a user request to create a copy of the first container, creating a second container in view of the first container, receiving, from the user interface running in the first container, a first command to switch from the first container to the second container, and responsive to receiving the first command to switch from the first container to the second container: configuring the second container in view of one or more configurations of the first container, causing a second container management agent in the second container to run the user interface in the second container, and causing execution of the first container to stop.

Managing containers across multiple operating systems

A computing device receives a container image from a container registry, the container image comprising a plurality of layers. The computing device extracts, from the container image, a plurality of files into a filesystem of the computing device, each file of the plurality of files corresponding to one of the layers of the plurality of layers. The computing device generates a metadata file that describes a directory structure of the plurality of files in the filesystem. The computing device mounts the metadata file to a location in the filesystem, wherein mounting the metadata file causes a digest of the metadata file to be generated and the metadata file and the plurality of files in the filesystem to be read-only.

Validation of container images

A method includes intercepting, by a proxy service running on a first node of a distributed computing system, a first request for a first service running on the first node; determining, by the proxy service, that the first service is dependent on a second service running on a second node of the distributed computing system; responsive to determining that the first service is dependent on the second service, invoking, by the proxy service, the second service running on the second node; receiving, by the proxy service, a first response from the second service; and transmitting, by the proxy service, to the first service, the first response received from the second service.

Using proxy services for dependencies in distributed computing systems

A computing device executing a kernel-based operating system, during a boot process of the operating system, can start a first system and service manager that is configured to start processes from unit files stored in a predetermined directory on a first root volume. The computing device can start, by the first system and service manager, a process from a first unit file that causes generation of a first restricted container environment that includes a second system and service manager, and a second root volume can be mounted to the first restricted container environment. The computing device can start, by the second system and service manager, a process from a second unit file stored in a predetermined directory on the second root volume and the process can execute inside the first restricted container environment.

Freedom from interference using containers

A computing device executing a kernel-based operating system creates a content-addressed object store containing files of a filesystem. The computing device generates a metadata file that describes characteristics of the files of the filesystem that are in the content-addressed object store. The computing device, in a kernel of the operating system, generates a Merkle tree of the metadata file and a Merkle tree of the content-addressed object store. The Merkle trees contain hashes of blocks of the metadata file and hashes of blocks of the files in the content-addressed object store. The computing device, in the kernel, verifies that a digest corresponding to the metadata file matches an expected digest for the metadata file and that digests corresponding to the files in the content-addressed object store match expected digests for the files in the content-addressed object store. The computing device mounts the metadata file to a location in the filesystem.

Growing community of inventors

Stockholm, Sweden

Alexander Larsson