Providing containers access to container daemon in multi-tenant environment

Patent metadata

Field	Value
Publication number	US-10360410-B2
Application number	US-201615350120-A
Country	US
Kind code	B2
Filing date	Nov 14, 2016
Priority date	Nov 14, 2016
Publication date	Jul 23, 2019
Grant date	Jul 23, 2019

Abstract

An example system includes a plurality of containers associated with a plurality of tenants. The plurality of containers are to execute code in isolation for the associated plurality of tenants. The system also include a container daemon communicatively coupled to the plurality of containers via an internal proxy. The container daemon is to provide a service to the plurality of containers. The internal proxy is to receive a daemon access policy. The internal proxy is to further intercept a daemon command from a container. The internal proxy is to detect that the container is allowed access to the container daemon based on the daemon access policy. The internal proxy is to also generate a modified daemon command and forward the modified daemon command to the container daemon.

First claim

What is claimed is:

1. A system, comprising:
a memory device comprising a plurality of containers associated with a plurality of tenants, the plurality of containers to execute code in isolation for the associated plurality of tenants; and
a processor to execute a container daemon communicatively coupled to the plurality of containers via an internal proxy, the container daemon to provide a service to the plurality of containers, the internal proxy to cause the processor to:
receive a daemon access policy;
intercept a daemon command from a container in the plurality of containers;
detect that the container is allowed access to the container daemon based on the daemon access policy; and
generate a modified daemon command and forward the modified daemon command to the container daemon.

2. The system of claim 1 , wherein the internal proxy is to receive data from the container daemon in response to the modified command, modify the data to generate modified data, and forward the modified data to the container.

3. The system of claim 1 , comprising an external proxy communicatively coupled to an endpoint of the container, the external proxy to provide access to container functionality to an external computing device.

4. The system of claim 1 , comprising an external proxy communicatively coupled to the container daemon, the external proxy to provide access to container functionality to an external computing device.

5. The system of claim 1 , wherein the internal proxy is to generate a container tenant mapping between the plurality of tenants and the plurality of containers, the container tenant mapping indicating each of the plurality of tenants associated with each of the plurality of containers.

6. The system of claim 1 , wherein the internal proxy is coupled to the plurality of containers via a plurality of dedicated container endpoints, wherein the dedicated container endpoints are to each provide access to one or more of the containers associated with a single tenant.

7. The system of claim 1 , wherein the internal proxy is to run a plurality of processes, wherein each process is associated with a different user permission.

8. A computer-implemented method, comprising:
receiving, via an internal proxy, a daemon access policy;
intercepting, via the internal proxy, a daemon command from a container;
detecting, via the internal proxy, that the container is allowed daemon access based on the daemon access policy; and
modifying, via the internal proxy, the daemon command and forwarding the modified daemon command to a container daemon.

9. The computer-implemented method of claim 8 , comprising:
receiving, via the internal proxy, data from the container daemon in response to the modified daemon command;
modifying the data to generate modified data; and
forwarding the modified data to the container.

10. The computer-implemented method of claim 8 , comprising sending container functionality to a computing device via an external proxy.

11. The computer-implemented method of claim 8 , wherein intercepting the daemon command comprises monitoring a proxy endpoint that is shared by a plurality of tenants.

12. The computer-implemented method of claim 8 , wherein intercepting the daemon command comprises monitoring a dedicated endpoint that is dedicated to a single tenant.

13. The computer-implemented method of claim 8 , wherein modifying the daemon command comprises translating between a container view and a host view of the container.

14. The computer-implemented method of claim 8 , comprising mapping a tenant to the container.

15. The computer-implemented method of claim 8 , comprising mapping a tenant to a plurality of containers comprising the container.

16. A computer program product for container daemon access, the computer program product comprising a computer-readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program code executable by a processor to cause the processor to:
receive a daemon access policy;
intercept a daemon command from a container;
detect that the container is allowed access to a container daemon based on the daemon access policy;
generate a modified daemon command and forward the modified daemon command to the container daemon;
receive data in response to the modified command;
modify the data to generate a modified data; and
forward the modified data to the container.

17. The computer program product of claim 16 , comprising program code executable by the processor to filter events belonging to other containers.

18. The computer program product of claim 16 , comprising program code executable by the processor to translate between a container view and a host view of the container.

19. The computer program product of claim 16 , comprising program code executable by the processor to map a tenant to the container.

20. The computer program product of claim 16 , comprising program code executable by the processor to map a tenant to a plurality of containers comprising the container.

Assignees

• IBM

Inventors

• Cahana Zvi
• Lev-Ran Etai
• Zach Idan

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/629 Primary

  to features or functions of an application · CPC title