Red Hat, Inc.

Daniel J Walsh

Giuseppe Scrivano

Vivek Goyal

Eric L Paris

Henri Han Van Riel

Warren I Togami, Jr

Shishir Mahajan

Pierre-Yves Chibon

Michael P McGrath

Colin G Walters

Jeremy John Eder

Alexander Larsson

Jason Greguske

Eric Sandeen

Huamin Chen

Jay Vyas

Sergio Lopez Pascual

Ian Scott McLeod

Christoph Goern

Miklos Szeredi

Daniel W Riek

Mrunal Patel

Jeffrey T Geib

David Howells

Karl Wirth

Paul Moore

James Morris

Vaclav Pavlin

Jesse C Geib

Valentin Rothberg

Langdon White

Aaron Weitekamp

Michael Virgil

Tomas Mraz

Embodiments of the present disclosure provide a substitute audit log for use by applications in the user-space of a host operating system to write audit information. When a container makes a system call attempting to write audit information to an audit log of the kernel, the kernel may utilize a predefined set of instructions indicating how to detect such system calls and how such system calls are to be modified so as to reroute the system call to an unprivileged socket. The kernel write the audit information of the system call to an unprivileged socket that is connected to a substitute audit log. A container management program monitoring the unprivileged socket may write the audit information to the substitute log which is defined in container specific directories of the container.

Containers system auditing through system call emulation

A method includes intercepting, by a proxy service running on a first node of a distributed computing system, a first request for a first service running on the first node; determining, by the proxy service, that the first service is dependent on a second service running on a second node of the distributed computing system; responsive to determining that the first service is dependent on the second service, invoking, by the proxy service, the second service running on the second node; receiving, by the proxy service, a first response from the second service; and transmitting, by the proxy service, to the first service, the first response received from the second service.

Using proxy services for dependencies in distributed computing systems

A computing device executing a kernel-based operating system, during a boot process of the operating system, can start a first system and service manager that is configured to start processes from unit files stored in a predetermined directory on a first root volume. The computing device can start, by the first system and service manager, a process from a first unit file that causes generation of a first restricted container environment that includes a second system and service manager, and a second root volume can be mounted to the first restricted container environment. The computing device can start, by the second system and service manager, a process from a second unit file stored in a predetermined directory on the second root volume and the process can execute inside the first restricted container environment.

Freedom from interference using containers

Embodiments of the present disclosure relate to specifying security settings for containers and extracting and applying such security settings from container images provided by e.g., developers or vendors of an application. More specifically, a developer of an application may determine a minimum level of security that is necessary for the application to operate and generate custom security settings based on the determined minimum level of security. The custom security settings may be embedded into a container image corresponding to the application. A user of the application may retrieve the container image and extract the custom security settings and compare them to default security settings. In response to determining that the custom security settings are a subset of the default security settings, the custom security settings may be applied to a container that is run based on the container image.

Embedding security requirements in container images

Systems and methods for deploying and running webassembly workloads on compute nodes using a webassembly unikernel. A computing device having a processor generates, using a container engine, a container runtime. The computing device generates, using the container runtime, a unikernel configured to run a plurality of webassembly applications, thereby resulting in a webassembly unikernel. The computing device may receive a request to run an application. A container image corresponding to the application may be retrieved, via the container engine, from a container registry. A webassembly payload may be stored for the application from the container image. Furthermore, the computing device may cause the webassembly unikernel to run the webassembly payload for the application.

Unikernel for webassembly containers

A method includes receiving a system call from an application within a container executing on an operating system, the system call comprising a synchronization operation to synchronize memory of the application to storage. The method further includes determining, by the kernel, whether a system call filtering policy associated with the container indicates that the system call is to be prevented. preventing, by the kernel, performance of the synchronization operation in view of the system call filtering policy.

Speedup build container data access via system call filtering

A method includes receiving, an operation from a container to synchronize container data from memory to a file system mounted by the container and determining whether the file system indicates that the operation is to be ignored. The method further includes, in response to determining that the file system indicates that the operation is to be ignored, preventing, by the operating system kernel executing on the processing device, performance of the operation.

Speedup containers in production by ignoring sync to file system

A filesystem can be shared between containers. For example, a computing device having a host filesystem can launch a first container from an image file. Launching the first container can include creating an initialization directory for the first container on the host filesystem. The initialization directory can include a filesystem to be shared between containers. Launching the first container can also include creating a first filesystem directory for the first container on the host filesystem and mounting the initialization directory to the first filesystem directory. The computing device can also launch a second container from the image file. Launching the second container can include creating a second filesystem directory for the second container on the host filesystem and mounting the initialization directory to the second filesystem directory to enable the second container to access the filesystem.

Sharing filesystems between containers

Allocation of access control identifiers to a container can be optimized. For example, a system can determine a largest value for a particular type of access control identifier (ACID) associated with a container image by analyzing content of the container image, the container image being for deploying a container. Next, the system can determine an amount of the particular type of ACID to allocate to the container based on the largest value. The system can then allocate the amount of the particular type of ACID to the container.

Optimizing allocation of access control identifiers to a container

Implementations of the disclosure provide for size adjustable volumes for containers. A method of the disclosure includes determining, by a processing device of a Platform-as-a-Service (PaaS) system, a size limitation of a container, where the size limitation is associated with disk space usage of a storage volume group. The amount of disk space used by applications of the container is monitored in view of the size limitation of the container. Responsive to determining that the amount of the disk space used by the applications of the container satisfies a threshold, a storage volume of the storage volume group is allocated to the container in view of the size limitation of the container.

Size adjustable volumes for containers

Methods, systems, and computer program products are included for deploying a composite application. A method includes receiving, at a computing device, a container image that includes a nulecule. The nulecule is parsed to identify a first service, a second service, and a parameter of the first service. An input value is received corresponding to the parameter of the first service. A configuration value of the first service is modified to include the input value. The first service and the second service are deployed on the computing device, with the first service being configured with the configuration value.

Active representation of a composite application

An access control engine can enable a host operating system to propagate a private resource of an isolated virtual environment, such as a container, running on the host operating system outside of the isolated virtual environment. The private resource can include, for example, a file system mounted within the isolated virtual environment. The access control engine can receive a command and launch the isolated virtual environment in response to the command. Also, in response to the command, the access control engine can interface with a kernel of the host operating system to configure the isolated virtual environment so that the private resource is accessible outside the isolated virtual environment.

Accessing file systems in a virtual environment

An example method of installing one or more files on a host file system includes extracting, by an operating system, a container image from a container. The container image stores a set of files and provides an indication of a hierarchical structure for the set of files. The method also includes obtaining, by the operating system, a package in accordance with the container image. The package includes the set of files. The method further includes installing the package on the host file system in accordance with the hierarchical structure for the set of files.

Growing community of inventors

Marlboro, MA, United States of America

Daniel J Walsh