Red Hat, Inc.

Pierre-Yves Chibon

Leigh Griffin

Alexander Larsson

Daniel J Walsh

Giuseppe Scrivano

Ian Scott McLeod

Robert Starr

Eric Curtin

Adam Miller

A computing device receives a filesystem image comprising a filesystem tree, a container runtime, and an on-board container registry including a plurality of container images, the on-board container registry operable to provide a container image to a requesting container runtime. The computing device is booted using the filesystem image. The computing device instructs the container runtime to initiate a first container from a first container image. The computing device requests, by the container runtime from the on-board container registry, the first container image. The computing device receives, by the container runtime, the first container image from the on-board container registry. The computing device initiates, by the container runtime, the first container from the first container image.

Generating filesystem images with integrated container registries having container runtime to initiate the first container image

Access requests for policy-based access control systems can be managed according to some examples. In one example, a system can receive, from a client device, a first access request for accessing a particular resource. The system can determine a first response approving or denying the first access request based on an access control policy. The system can store a data entry indicating the first response to the first access request. The system can set a flag to indicate that a future access request for the particular resource is to be handled using the data entry. Subsequent to setting the flag, the system can receive a second access request from the client device for accessing the particular resource. Based on determining that the flag is set, the system can determine a second response to the second access request based on the data entry rather than the access control policy.

Managing access requests for policy-based access control systems in computer networks

Embodiments of the present disclosure include a processing device that determines that a first node device of a plurality of node devices in a network is non-compliant with a network policy, identifies a first subset of the plurality of node devices that are not associated with the first node device, and transmits a communication to the first subset of the plurality of node devices that instructs respective ones of the first subset of the plurality of node devices to perform an alteration of a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device.

Zoned mesh network isolation

A gateway device receives a request from a client device, the gateway to provide access to a plurality of services provided by a plurality of compute nodes. A manifest is created based on metadata associated with the request and characteristics of the plurality of services, the manifest identifying a logical view of a subset of the plurality of services provided by a subset of the plurality of compute nodes. The request is routed to one of the subset of the plurality of services based on the manifest.

Dynamic API gateway routing based on request metadata

A system and method of Byzantine fault prevention in mesh networks. The method includes detecting a consensus operation among a plurality of node devices of a network for a blockchain operation of a blockchain within the network, wherein each consensus operation includes a vote transmission associated with the blockchain within the network, wherein detecting the consensus operation includes examining an approval status of a particular vote transmission associated with a particular consensus operation. The method includes controlling, by a processing device responsive to detecting the consensus operation, content of a proxy vote transmission provided by a proxy device corresponding to at least one node device of the plurality of node devices by setting the content of the proxy vote transmission based on the approval status of the particular vote transmission. The method includes causing the proxy device to transmit the proxy vote transmission.

Byzantine fault prevention in mesh networks

Systems and methods include storing, in a first base boot partition, an image of a first base operating system; storing, in a first overlay boot partition, a first overlay file system comprising a first encrypted file; configuring the first overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the first overlay filesystem; and responsive to detecting an attempt to access the first encrypted file, designating the first base boot partition as an active boot partition.

Dynamic booting of operating system by designating first base boot partition as active boot partition responsive to detecting unauthorized attempt to access first encrypted file

Processing logic may provide a first container having a first software version. Processing logic may create a second container having a second software version within the first container. Processing logic may replace the first container with the second container, in response to testing of the second container satisfying one or more criteria.

Inheritance container service

A computing device determines that an action should be performed on a first edge device operating in a computing system. The computing device accesses a data structure that identifies values of computing resources of the first edge device and computational requirements of performing the action on the first edge device. The computing device determines, based on the data structure, that the first edge device lacks a computing resource to meet the computational requirements of performing the action on the first edge device. In response to determining that the first edge device lacks the computing resource to meet the computational requirements of performing the action on the first edge device, the computing device inhibits the action from being performed on the first edge device.

Minimum viable charge exchange for service operations in edge devices

A method includes determining characteristics of nodes of a mesh network and selecting one or more nodes of the mesh to receive a payload in view of the characteristics of the plurality of nodes of the mesh network. The method further includes pushing the payload to the one or more selected nodes of the mesh network, wherein the one or more nodes propagate the payload to remaining nodes of the mesh network.

Service download optimization for nanotech mesh

Software builds can be constructed based on previously recorded modifications to metadata. For example, a computing device can record modification logs. Each of the modification logs can be associated with a modification to metadata for a software repository. The computing device can also receive, from a client device, a request for the metadata for the software repository at a particular time. The computing device can provide access, for the client device, to one or more modification logs of the modification logs associated with the particular time. The one or more modification logs can be used by the client device to produce a software build having characteristics of the metadata at the particular time.

Providing access to metadata modifications to facilitate software build reproduction

The technology disclosed herein enables receiving a first remote access command identifying a second computing system, a service on the second computing system, and an action to be performed with respect to the service by a service manager of a first computing system, and transmitting a first action command derived from the first remote access command to a service manager of the second computing system by the service manager of the first computing system. The service manager of the second computing system is enabled for remote access.

Remote service orchestration and mirroring for computing devices

A method includes intercepting, by a proxy service running on a first node of a distributed computing system, a first request for a first service running on the first node; determining, by the proxy service, that the first service is dependent on a second service running on a second node of the distributed computing system; responsive to determining that the first service is dependent on the second service, invoking, by the proxy service, the second service running on the second node; receiving, by the proxy service, a first response from the second service; and transmitting, by the proxy service, to the first service, the first response received from the second service.

Using proxy services for dependencies in distributed computing systems

Processing logic may determine that a service is absent among a plurality of nodes within a zone of a mesh network. Processing logic may nominate one of the plurality of nodes to run the service. Processing logic may request a consensus among the plurality of nodes within the zone of the mesh network to confirm the nomination. Processing logic may, in response to receiving confirmation of the nomination by the plurality of nodes in the zone of the mesh network, push the service to the one of the plurality of nodes to run the service.

Consensus driven mesh organization

A computing device executing a kernel-based operating system, during a boot process of the operating system, can start a first system and service manager that is configured to start processes from unit files stored in a predetermined directory on a first root volume. The computing device can start, by the first system and service manager, a process from a first unit file that causes generation of a first restricted container environment that includes a second system and service manager, and a second root volume can be mounted to the first restricted container environment. The computing device can start, by the second system and service manager, a process from a second unit file stored in a predetermined directory on the second root volume and the process can execute inside the first restricted container environment.

Freedom from interference using containers

A computing device executing a kernel-based operating system creates a content-addressed object store containing files of a filesystem. The computing device generates a metadata file that describes characteristics of the files of the filesystem that are in the content-addressed object store. The computing device, in a kernel of the operating system, generates a Merkle tree of the metadata file and a Merkle tree of the content-addressed object store. The Merkle trees contain hashes of blocks of the metadata file and hashes of blocks of the files in the content-addressed object store. The computing device, in the kernel, verifies that a digest corresponding to the metadata file matches an expected digest for the metadata file and that digests corresponding to the files in the content-addressed object store match expected digests for the files in the content-addressed object store. The computing device mounts the metadata file to a location in the filesystem.

Growing community of inventors

Paris la Défense, France

Pierre-Yves Chibon