International Business Machines Corporation

Pradipta Kumar Banerjee

Vaidyanathan Srinivasan

Ashish Billore

Sandeep R Patil

Sasikanth Eda

Vijay K Sukthankar

Deepak R Ghuge

Dipankar Das Sarma

Harshal S Patil

Sudipta Biswas

Aneesh K Kizhake Veetil

Swarna Latha Mylavarapu

Nanjangud C Narendra

Muthu Annamalai Muthiah

Divya K Konoor

Swarnalatha Mylavarapu

Hemant K Shaw

Manjunath Kumatagi

Ananth Narayan Mavinakayanahalli Gururaja

Pooja Kulkarni

Subhojit Roy

Sachin Chandrakant Punadikar

Anbazhagan Mani

Rajan Ravindran

Nitesh Konkar

Vikas Bhardwaj

In an approach for securing container workloads, a processor encrypts workload binaries. A processor uploads the workload binaries to a software repository. A processor encrypts a workload definition. A processor replaces the workload definition with a mock workload definition. A processor references the encrypted workload definition in the mock workload definition. A processor submits the mock workload definition to a master node.

Hardware memory encryption and protection for containers

Described are techniques for secure workload configuration including a method comprising receiving a workload definition file at a worker node and from a master node, where the workload definition file comprises an encrypted immutable definition, a partially immutable definition with a predefined range of values and a first value modified by the master node, and a variable definition with a second value modified by the master node. The method further comprises decrypting, by the worker node, the encrypted immutable definition to generate a decrypted immutable definition. The method further comprises verifying, by the worker node, that the first value satisfies the predefined range of values. The method further comprises, in response to decrypting the encrypted immutable definition and verifying that the first value satisfies the predefined range of values, executing a workload based on the workload definition file in a virtual computing environment.

Secure workload configuration

Method, apparatus, and computer program product are provided for dynamically changing containerized workload isolation in response to detection of a triggering factor. In some embodiments, workload is containerized using a default container runtime (e.g., runC) that spawns one or more cgroup-based containers on a compute node using resource limiting capabilities of the compute node's host kernel including cgroups and namespaces. In some embodiments, in response to a triggering factor, such as a host kernel vulnerability, at least some of the containerized workload is migrated from running in the one or more cgroup-based containers to one or more virtual machines (VMs) launched by a standby container runtime (e.g., runV). In some embodiments, the cgroups and namespaces of the one or more cgroup-based containers are live migrated, without service interruption, to one or more VM runtimes on the one or more VMs using CRIU&#x2014;checkpoint/restore in userspace.

Dynamically changing containerized workload isolation in response to detection of a triggering factor

Technical solutions are described for assigning containers for executing functions in a software application using a server cluster that uses functions as a service architecture. An example method includes creating, by a global scheduler of the server cluster, a first container at a first host node in the server cluster for executing a first function from the software application. The method further includes intercepting, by an in-node scheduler of the first host node, a command from the first function for creating a second container for executing a second function. The method further includes assigning, by the in-node scheduler, an in-node container as the second container, the in-node container being a container executing on the first host node. The method further includes updating, by the in-node scheduler, a resource database that indicates that the second function is being executed in the in-node container on the first host node.

Computer server application execution scheduling latency reduction

A blockchain of transactions may be used for various purposes and may be later accessed by interested parties for ledger verification. One example method of operation may include one or more of monitoring one or more applications to identify application events, identifying one or more application events, determining a hash of a log message payload associated with the application events and logging the hash of the log message payload in a blockchain.

Distributed logging of application events in a blockchain

A computer program product for a network management device, including: a computer readable storage medium to store a computer readable program, wherein the computer readable program, when executed on a computer, causes the computer to perform operations for server management in a computer network. The operations include: receiving resource usage data generated at a network communication device coupled between a server and a network management device, wherein the resource usage data describes resource usage of the server; and classifying the server into a cluster of servers based on the resource usage data from the network communication device and a cluster characterization for the cluster. The cluster includes a plurality of servers with similar resource usage data, and the cluster is one of a plurality of clusters managed by the network management device.

Server consolidation system

Adjusting runtime performance includes receiving a first input file of a software application, where the software application utilizes a first software architecture. Embodiments include analyzing the first input file, including identifying dependencies for a secondary platform. Embodiments include identifying dependencies for the first software architecture, and a first set of code transformation rules based on the identified dependencies. Embodiments include generating code, based on the first set of transformation rules, where the runtime profile contains data regarding first characteristics of the first input file, the generated code allowing the first input file to utilize the second software architecture. Embodiments include identifying a second set of code transformation rules based on the identified dependencies. Embodiments include analyzing, the first input file and identifying problems that may require code changes in order to allow porting of the first input file to the second software architecture.

Transparent multi-architecture support in a container based cloud

In an approach to collecting and processing performance metrics, one or more computer processors assign an identifier corresponding to a first workload associated with a first virtual machine. The one or more computer processors record resource consumption data of at least one processor at a performance monitoring interrupt. The one or more computer processors create a relational association of the first workload and the first virtual machine to the resource consumption data of the at least one processor. The one or more computer processors determine if the first workload is complete. Responsive to determining that the first workload is not complete, the one or more computer processors calculate a difference in recorded resource consumption data between the performance monitoring interrupt and a previous performance monitoring interrupt.

Software based collection of performance metrics for allocation adjustment of virtual resources

An apparatus for implementing a user policy includes a policy module that issues a user policy for a plurality of computing devices. Two or more of the computing devices have different hardware configurations. The apparatus includes a soft metrics module that, in response to the user policy, sends soft metrics for a computing device of the plurality of computing devices, to determine if the computing device complies with the user policy, where the soft metrics are specific to a hardware configuration of the computing device. The apparatus includes an operational data module that receives, from the computing device, operational data responsive to the soft metrics, and a compliance module that analyzes the operational data to determine if the computing device complies with the user policy.

Sending hardware specific soft metrics for each of a plurality of computing devices based on a plain language user policy

Embodiments of the present invention provide methods, systems, and computer program products for using a storlet erasure code object storage architecture for image processing. In one embodiment, an object is received, the object being represented as erasure coded bits. A storage location associated with the erasure coded bits is identified. A virtual machine (VM) is invoked, where the VM is configured to compute a modification to the erasure coded bits and replace the original erasure coded bits with the modified erasure coded bits.

Using storlet in erasure code object storage architecture for image processing

A mechanism is provided for optimizing object storage workflow. A category of a computational algorithm received from a user of a client device is identified, the category identifying a set of features that are optimal for executing the computational algorithm and comprising hardware, operating system type, operating system version, and virtualization technology. Features associated with a plurality of nodes in a plurality of infrastructures in an object storage architecture are searched for at least one node that has the set of features identified by the category of the computational algorithm. Responsive to identifying a node that has the set of features identified by the category of the computational algorithm, a determination is made as to whether resources associated with the node are immediately available. Responsive to the resources associated with the node being immediately available, the computational algorithm is issued to the node for execution.

Growing community of inventors

Karnataka, India

Pradipta Kumar Banerjee