Microsoft Technology Licensing, LLC

Margarit Simeonov Chenchev

Hari R Pulapaka

Benjamin M Schultz

Frederick Justus Smith

John Andrew Starks

Giridhar Viswanathan

Jonathan David Wiswall

Michael Bishop Ebersol

Richard O Wolcott

Balaji Balasubramanyan

Ankit Srivastava

Matthew David Kurjanowicz

Narasimhan Ramasubramanian

Graham Wong

Frederick J Smith, Iv

Raphael Gianotti Serrano Dos Santo

Nived Kalappuraikal Sivadas

Ravinder S Thind

Scott Daniel Anderson

Jonathan D Schwartz

David Bradley Probert, Jr

David John Linsley

Harish Srinivasan

Kinshumann Kinshumann

Axel Rietschin

Charles Glenn Jeffries

Paresh J Maisuria

Kinshumann

Yanan Zhang

Bryan R Born

JianMing M Zhou

Paul Bozzay

David Guy Weston

Prakhar Srivastava

Gopikrishna Kannan

Peteris Ledins

Arup Roy

Paresh Maisuria

Frederick J Iv Smith

Frederick Justus Iv Smith

Jianming Zhou

Distribution and management of services in virtual environments is described herein. In one or more implementations, a service distribution and management model is implemented in which system services and applications are seamlessly distributed across multiple containers which each implement a different runtime environment. In one or more implementations, a system for distributing access to services in a host operating system of a computing device includes a host operating system configured to implement a host runtime environment, and one or more services implemented by the host operating system. The system further includes a service control manager configured to enable communication between a client stub of a service implemented in a client runtime environment and a service provider of the service that is implemented in a service runtime environment that is separate from the first client runtime environment.

Distribution and management of services in virtual environments

A layered composite boot device, and a corresponding layered composite file system, can be implemented by a boot manager. Requests directed to the layered composite boot device and file system, can be serviced from a primary device and file system that are encapsulated by the layered composite boot device and file system. The primary device and file system can correspond to a virtualized file system within a container environment, thereby enabling changes within the container environment to affect early stages of operating system booting in the container environment. Should such requests not be serviceable from the primary layers, the composite device and file system can comprise secondary layers that can correspond to a container host connection and the host file system, providing fallback to existing data if changes within the container environment were not made, thereby enabling booting to proceed in a traditional manner.

Layered composite boot device and file system for operating system booting in file system virtualization environments

A virtualization partition (VP) is executed by a virtualization layer. The VP contains guest software that executes in isolation within the VP. The guest software has a background task (BT) that needs to be performed in the future. The BT is virtualized by a BT service that executes outside of the VP. The guest software registers the BT, through the virtualization layer, with a BT virtualization service. An event occurs outside of the VP that triggers the BT. The BT virtualization service responds to the event by assuring that the VP is available (executing), and optionally triggers (possibly indirectly) the execution of code in the application.

Virtualized background activations

Technologies are described for selective persistence of data utilized by software containers. A configuration policy is defined that includes data that specifies one or more data stores for which data is not to be persisted following accesses to a software container and one or more data stores for which data is to be persisted following accesses to the software container. When the software container is first accessed, the data stores identified in the configuration policy are attached to the software container. Upon a subsequent access to the container, such as at the conclusion of a user session or upon destruction of the container, the data in the attached data stores is persisted or deleted based upon the configuration policy. When the software container is once again accessed, the data store containing the persisted data can be re-attached to the software container.

Selective persistence of data utilized by software containers

Securely performing file operations. A method includes determining a licensing characteristic assigned to a file. When the licensing characteristic assigned to the file meets or exceeds a predetermined licensing condition, then the method includes performing a file operation on the file in a host operating system while preventing the file operation from being performed in the guest operating system. When the licensing characteristic assigned to the file does not meet or exceed the predetermined licensing condition, then the method includes performing the file operation on the file in the guest operating system while preventing the file operation from being performed directly in the host operating system.

Method and system for persisting files

Techniques of migrating containerized software packages between source and destination computing devices are disclosed herein. In one embodiment, a method includes receiving, at a destination device, a request to migrate a source container currently executing on the source device to the destination device. The method also includes synchronizing a list of handles utilized by the source container on the source device between the destination device and the source device and instantiating, in the destination device, a destination container using a copy of an image, a memory snapshot, and the synchronized list of handles of the source container on the source device. Upon completion of instantiating the destination container, the destination device can transmit a remote display output of the application to be surfaced on the source device in place of the local display output generated by the source container.

Container migration in computing systems

Securely performing file operations. A method includes determining a trust characteristic assigned to a file. When the trust characteristic assigned to the file meets or exceeds a predetermined trust condition, then the method includes performing a file operation on the file in a host operating system while preventing the file operation from being performed in the container operating system. When the trust characteristic assigned to the file does not meet or exceed the predetermined trust condition, then the method includes performing the file operation on the file in the container operating system while preventing the file operation from being performed directly in the host operating system.

Method and system for persisting untrusted files

Facilities are provided to secure guest runtime environments (GREs). Security policy specifications may be associated with GREs. A GRE's security policy may be specific to the GRE and may also include security policy inherited from higher levels such as a host operating environment. The security policy of a GRE specifies restrictions and/or permissions for activities that may be performed within the scope of execution of the GRE. A GRE's security policy may limit what the GRE's guest software may do within the GRE. Restrictions/permissions may be applied to objects such as files, configuration data, and the like. Security specifications may be applied to execution initiated within a GRE. A GRE's security specification may restrict/permit executable objects from loading and executing within the GRE. The executability or accessibility of objects may be conditioned on factors such as the health/integrity of the GRE, the host system, requested files, and others.

Securing virtual execution environments

Deploying containers constrained by power profiles on a host system. A method includes identifying a container template, a set of reusable stored characteristics, to be used for deploying a container instance. The method further includes obtaining a power profile, defining at least one power consumption threshold, for the container instance based on at least one of the set of reusable stored characteristics of the container template or other information about the container instance. The method further includes deploying the container instance on the host system by applying the set of reusable stored characteristics and the power profile by applying one or more configuration layers which causes power to the container instance to be at least one of regulated or monitored based on information in the power profile.

Power and energy profiling for efficient virtual environments

Growing community of inventors

Sammamish, WA, United States of America

Margarit Simeonov Chenchev