Amazon Technologies, Inc.

Anirudh Balachandra Aithal

Michael David Marr

Kiran Kumar Meduri

Anthony Joseph Suarez

Deepak Singh

Muhammad Umer Azad

Daniel Robert Gerdesmeier

William Andrew Thurston

Euan Skyler Kemp

Matthew David Klein

Onur Filiz

Archana Srikanta

Eswar Chander Balasubramanian

Ryan John Marchand

Micah William Hausler

Sri Saran Balaji Vellore Rajakumar

Christopher Brian Barclay

Jia Bi Zhang

Samuel Benjamin Karp

Cornelle Christiaan Pretorius Janse Van Rensburg

Venkata Satya Shyam Jeedigunta

Juan Rhenals

Noah Meyerhans

A task definition is received. The task definition indicates at least a location from which one or more software image can be obtained and information usable to determine an amount of resources to allocate to one or more software containers for the one or more software image. A set of virtual machine instances in which to launch the one or more software containers is determined, the one or more software image is obtained from the location included in the task definition and is launched as the one or more of software containers within the set of virtual machine instances.

System for managing and scheduling containers

A task pool may be created and maintained, in association with a container management service, which stores a snapshot of a one or more tasks, the performance of which is suspended or paused. Tasks may be defined as applications executable in one or more software containers instantiated on a virtual machine or compute instance, where the snapshot of a task may include an image of the one or more containers associated with the task container and state information of the one or more containers. A task may be initially provisioned in a paused state or paused after executing at least a portion of the task. Paused tasks in the task pool may be readily restarted or resumed by loading the snapshot onto a compute instance. The task pool may manage provisioning new tasks and pause tasks based on changes in demand.

Task pool for managed compute instances

Techniques are described for sharing prepopulated container image caches among container execution environments to improve the performance of container launches. The container images used to prepopulate such a cache at a computing device supporting one or more container execution environments can include various container images that are used as the basis for a wide range of user-created containers such as, for example, container images representing popular operating system distributions, database servers, web-application frameworks, and so forth. Existing systems typically obtain these container images as needed at runtime when launching containers (for example, from a container registry or other external source), often incurring significant overhead in the container launch process. The use of a prepopulated container image cache can significantly improve the performance of container launches by making such commonly used container images available to container execution environments running at a computing device ahead of time.

Sharing prepopulated container image caches among container execution environments

The present application relates to providing a mechanism for specifying multiple network interfaces to be configured for on-demand compute capacity and for obtaining the credentials needed to configure the multiple network interfaces. For example, a container orchestration service may specify, in its code execution request to a serverless container management service, that multiple network interfaces are needed for the requested compute capacity. In response, the serverless container management service can identify the multiple network interfaces, determine the credential to be used to configure each of the multiple network interfaces, and attach the multiple network interfaces to the compute capacity acquired on behalf of the container orchestration service. During execution, the code running inside the compute capacity can utilize the multiple network interfaces as specified by the owner of the code.

Client-specified network interface configuration for serverless container management service

The present application relates to executing a containerized application in a nested manner on two separate container orchestration services. For example, a user may submit a request to a container orchestration service to execute a containerized application, and in response, instead of identifying one of the existing compute instances belonging to the user and executing the containerized application on the identified compute instance, the container orchestration service may generate and submit a request to a serverless container management service that can not only acquire compute resources on behalf of the container orchestration service but also manage the compute resources such that the container orchestration service (or the original requesting user) does not need to manage scaling, monitoring, patching, and security of the compute resources.

Service-managed containers for container orchestration service

At least one instance of an application is launched in a set of software containers that are distributed among a set of virtual machine instances. A set of measurements corresponding to resource utilization by a software container of the set of software containers is obtained and a timestamp is generated for the set of measurements. The set of measurements is aggregated, with other sets of measurements corresponding to the set of software containers for the application, into a set of aggregated measurements grouped in a time window group, based at least in part on the timestamp, and, as a result of fulfillment of a condition, the time window group is outputted.

Container telemetry

Systems for provisioning virtual network interfaces (VNIs) for tasks running on a virtual machine instance in a distributed computing environment are provided. The systems receive a request to launch a task corresponding to a plurality of containers in an instance in association with an instruction to provide a VNI for the task with a set of network security rules. The system may select an instance with sufficient resources to launch the task and enable communication using the VNI. The system may inhibit processes running on the instance other than containers associated with the task from communicating via the VNI.

Network interfaces for containers running on a virtual machine instance in a distributed computing environment

Systems and methods are described for managing computing resources. In one embodiment, groupings of computer resources having common firmware settings are maintained based on an abstraction firmware framework representing associations between vendor-specific firmware settings and abstracted firmware settings that provide a degree of independence from specific vendor-specific firmware settings. In response to a request for a computer resource with a specified abstracted firmware configuration, it is determined which of the groupings can support the specified abstracted firmware configuration based on at least one criterion for managing the computer resources in accordance with the abstraction firmware framework.

Automated firmware settings management

Systems and methods are described for testing computing resources. In one embodiment, a search space of computing settings is analyzed in accordance with weighted data that maps computing performance parameters with the computing settings. A subset of the computing settings is selected to generate a test population to optimize at least one computing performance parameter. One or more computing devices in a computing environment are configured in accordance with the test population, and the test conditions are iteratively updated based on test results in accordance with the test population and a fitness function.

Live data center test framework

An application is comprised of a plurality of processes. A process is able to accesses a remote service using a service access credential which is adapted to the particular requirements of the process. By providing a process with customized credential, the process is constrained from performing unnecessary operations, and the overall security of the application is improved. When processes are deployed to a host computer, an agent on a host computer collects credential information and other metadata associated with the processes running on the host computer. The agent makes the metadata available to a credential provider running on the host, and the credential provider exposes an interface that is accessible to the processes. The processes include a credential proxy which communicates with the credential provider. The credential proxies relay credential requests to the credential provider, and return the provided credentials from the credential provider to the processes.

Credential vending to processes

Systems and methods are described for managing computing resources. In one embodiment, data representative of an abstracted firmware framework is maintained. The data may comprise computing firmware settings and determined based on standardized associations between vendor-specific firmware settings and abstracted firmware settings that are independent of the vendor-specific firmware settings. In response to receiving a request for a computing firmware setting, the requested computing firmware setting is translated to one or more vendor-specific firmware settings based on the data. A computing resource capable of implementing the one or more vendor-specific firmware settings is identified.

Growing community of inventors

Seattle, WA, United States of America

Anirudh Balachandra Aithal