Microsoft Technology Licensing, LLC

John Andrew Starks

Dustin Lyle Green

Neal Robert Christiansen

Hari R Pulapaka

Benjamin M Schultz

Frederick Justus Smith

Mathew John

Todd William Harris

Jacob Kappeler Oshins

Lars Reuther

Jonathan David Wiswall

Scott A Brender

Ping Xie

Mehmet Iyigun

Arun Upadhyaya Kishan

Senthil Rajaram

Angshuman Bezbaruah

Margarit Simeonov Chenchev

Chung Lang Dai

Michael Bishop Ebersol

Richard O Wolcott

Karan Mehra

Shaheed Gulamabbas Chagani

Craig Ashley Barkhouse

Keith Loren Mange

Taylor O'Neil Brown

Chandra Kumar Konamki Vijayamuneeswaralu

Sven Groot

Eric P Traut

Rene Antonio Vega

Manuel Costa

Gerardo Diaz-Cuellar

Giridhar Viswanathan

Daniel Vasquez Lopez

Sylvan Wesley Clebsch

Omar Cardona

Stavros Volos

Ankit Srivastava

Amber Tianqi Guo

Andrew Ernest Nicholas

Sean A Allen

Stephen E Bensley

Deepu Chandy Thomas

Abhinav Mishra

Andrei Warkentin

Lawrence Ralph Cleeton

Ian James McCarty

Frederick J Smith, Iv

Kenneth Gordon

Craig Daniel Wilhite

Judy J Liu

Antonio Nino Diaz

Joshua David Ebersol

Sylvan Clebsch

Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a layout manager operates with a composite engine interface to support generating composite images with optimized configurations (i.e., pre-alignment and pre-computed hashes of for executable files). In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated while pre-processing executable files, where pre-processing the one or more files comprises pre-aligning the executable files in the composite image or pre-computing a hash for the executable files in the composite image.

Container management system with a layout manager system

Distribution and management of services in virtual environments is described herein. In one or more implementations, a service distribution and management model is implemented in which system services and applications are seamlessly distributed across multiple containers which each implement a different runtime environment. In one or more implementations, a system for distributing access to services in a host operating system of a computing device includes a host operating system configured to implement a host runtime environment, and one or more services implemented by the host operating system. The system further includes a service control manager configured to enable communication between a client stub of a service implemented in a client runtime environment and a service provider of the service that is implemented in a service runtime environment that is separate from the first client runtime environment.

Distribution and management of services in virtual environments

Described herein are technologies that provide an element of security related to file system operations. Individual nodes in a file system, such as a directory or a file, can be associated with information that describes how to handle letter case when a file name included in a file system operation request is used to locate a file in the file system. For example, a case sensitive designation associated with a directory can require a case sensitive match between a file name included in a request and a file name included in the directory, in order to perform the requested file system operation. In another example, a case preferring designation associated with a directory first checks for a case sensitive match between file names. If a case sensitive match does not exist, then a case insensitive match between the file names can be used to perform the requested file system operation.

Techniques for handling letter case in file systems

This document describes techniques for storing virtual disk payload data. In an exemplary configuration, each virtual disk extent can be associated with state information that indicates whether the virtual disk extent is described by a virtual disk file. Under certain conditions the space used to describe a virtual disk extent can be reclaimed and state information can be used to determine how read and/or write operations directed to the virtual disk extent are handled. In addition to the foregoing, other techniques are described in the claims, figures, and detailed description of this document.

Virtual disk storage techniques

A fine-grain selectable partially privileged container virtual computing environment provides a vehicle by which processes that are directed to modifying specific aspects of a host computing environment can be delivered to, and executed upon, the host computing environment while simultaneously maintaining the advantageous and desirable protections and isolations between the remaining aspects of the host computing environment and the partially privileged container computing environment. Such partial privilege is provided based upon directly or indirectly delineated actions that are allowed to be undertaken on the host computing environment by processes executing within the partially privileged container virtual computing environment and actions which are not allowed. Aspects of the host computing environment operating system, such as the kernel, are extended to interface with container-centric mechanisms to receive information upon which actions can be allowed or denied by the kernel even if the process attempting such actions would otherwise have sufficient privilege.

Partially privileged lightweight virtualization environments

A system comprising a hosting service configured to perform: providing, to a trusted entity on a central processing unit, a command for a launch of a virtual machine (VM); assigning, to the VM, at least a portion of memory for the guest operating system; submitting, to the trusted entity, a request to measure an address space of the VM to provide a measurement digest of the address space of the guest operating system; including, in a configuration object, a policy provided by the user for the service logic, wherein the policy defines one or more rules for the service logic, wherein the one or more rules include at least one rule for which containers may run in the guest operating system; hashing the policy to provide a hash digest of the policy; submitting, to the trusted entity, the hash digest of the policy; and completing the launch of the VM.

Secure computing mechanism

Examples described herein generally relate to hosting virtual memory backed kernel isolated containers. A server includes at least one physical processor and at least one physical computer memory addressable via physical memory addresses. The at least one physical computer memory stores executable code configured to provide at least one host including a kernel and at least one kernel isolated container within the at least one host. The host allocates virtual memory having virtual memory addresses to a respective container of the at least one kernel isolated container. The host pins a subset of the virtual memory addresses to a subset of the physical memory addresses. The host performs a direct memory access operation or device memory-mapped input-output operation of the respective container on the subset of the physical memory addresses. At least part of the physical computer memory that is not pinned is oversubscribed.

Pinned physical memory supporting direct memory access for virtual memory backed containers

Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Container management system with a composite engine interface

Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Container management system with a remote sharing manager

Anonymous containers are discussed herein. An operating system running on a computing device, also referred to herein as a host operating system running on a host device, prevents an application from accessing personal information (e.g., user information or corporate information) by activating an anonymous container that is isolated from the host operating system. In order to create and activate the anonymous container, a container manager anonymizes the configuration and settings data of the host operating system, and injects the anonymous configuration and settings data into the anonymous container. Such anonymous configuration and settings data may include, by way of example and not limitation, application data, machine configuration data, and user settings data. The host operating system then allows the application to run in the anonymous container.

Anonymous containers

Growing community of inventors

Seattle, WA, United States of America

John Andrew Starks