Facilitating event-driven processing using unikernels

Patent metadata

Field	Value
Publication number	US-10409654-B2
Application number	US-201715648848-A
Country	US
Kind code	B2
Filing date	Jul 13, 2017
Priority date	Jul 13, 2017
Publication date	Sep 10, 2019
Grant date	Sep 10, 2019

Abstract

Event-driven processing is facilitated by a unikernel-based method which includes receiving, based on an event, a code execution request containing parameter values for an application code unikernel. The application code unikernel includes uploaded application code in a single-purpose virtual machine image. Based on receiving the code execution request, the application code unikernel is run, which includes providing the parameter values as bootvariables as part of booting the program code unikernel. Further, running the application code unikernel may include executing the application code unikernel directly on a hypervisor. The application code unikernel may include only operating system components required to run the uploaded application code.

First claim

What is claimed is:

1. A computer program product for facilitating event-driven processing using unikernels, the computer program product comprising:
a non-transitory computer readable storage medium readable by a processing circuit and storing instructions which, when executed, perform a method comprising:
based on a user uploading an application code, determining whether an existing version of the application code is stored in a data store component, the uploaded application code comprising untrusted user application code;
based on the existing version being stored in the data store component, updating the existing version using the uploaded application code, otherwise storing the uploaded application code in the data store component;
based on the updating or storing, performing, by a build component, a build event from the stored application code stored in the data store component, the build event comprising compiling an application code unikernel with runtime and previously identified dependencies into a single-purpose virtual machine image and storing the application code unikernel in an image store component, wherein the build event includes integrating static code analysis and extensive type-checking while compiling the unikernel during the build event in order to facilitate detecting malicious activity prior to executing the untrusted user application code, and wherein the build component is configured to accommodate concurrent build events, and wherein the build event is performed within a time range threshold;
receiving, based on an event, a code execution request containing parameter values for the application code unikernel, wherein the application code unikernel is sealed and parameterized to facilitate running the untrusted user application code, wherein the application code unikernel comprises the stored application code in the single-purpose virtual machine image; and
based on receiving the code execution request, initiating running the application code unikernel, wherein the initiating running includes booting, by an invoker, the application code unikernel on a virtual machine manager, the invoker being a privileged virtual machine image, wherein the parameter values are provided as bootvariables as part of booting the application code unikernel, and the stored application code is executed as part of a boot process for the application code unikernel, and wherein the stored application code uses during execution the parameter values provided as the bootvariables.

2. The computer program product of claim 1 , further comprising shutting down the application code unikernel after the executing of the stored application code as part of the booting of the application code unikernel.

3. The computer program product of claim 1 , further comprising executing the application code unikernel directly on the virtual machine manager, the virtual machine manager comprising a hypervisor.

4. The computer program product of claim 3 , wherein the initiating running of the application code unikernel is controlled by an invoker, the invoker being a privileged virtual machine image executing directly on the hypervisor.

5. The computer program product of claim 3 , wherein the application code unikernel comprises only operating system components required for the stored application code to run.

6. The computer program product of claim 1 , further comprising providing the application code unikernel, the providing including compiling the stored application code and one or more operating system components within a virtual machine image to produce the single-purpose virtual machine image, the one or more operating system components being less than a full operating system.

7. The computer program product of claim 1 , wherein the application code unikernel is a current version of the application code unikernel, and wherein the method further comprises determining whether an earlier version of the application code unikernel exists, and based on determining that the earlier version of the application code unikernel exists, replacing in storage the earlier version of the application code unikernel with the current version of the application code unikernel.

8. The computer program product of claim 1 , wherein based on receiving the code execution request, the method further comprises generating an invocation message containing the parameter values and a reference to the application code unikernel to be run, and wherein based on generating the invocation message, proceeding with the running of the application code unikernel.

9. A system of facilitating event-driven processing using unikernels, the system comprising:
a memory; and
a processing circuit communicatively coupled with the memory, wherein the system performs a method comprising:
based on a user uploading an application code, determining whether an existing version of the application code is stored in a data store component, the uploaded application code comprising untrusted user application code;
based on the existing version being stored in the data store component, updating the existing version using the uploaded application code, otherwise storing the uploaded application code in the data store component;
based on the updating or storing, performing, by a build component, a build event from the stored application code stored in the data store component, the build event comprising compiling an application code unikernel with runtime and previously identified dependencies into a single-purpose virtual machine image and storing the application code unikernel in an image store component, wherein the build event includes integrating static code analysis and extensive type-checking while compiling the unikernel during the build event in order to facilitate detecting malicious activity prior to executing the untrusted user application code, and wherein the build component is configured to accommodate concurrent build events, and wherein the build event is performed within a time range threshold;
receiving, based on an event, a code execution request containing parameter values for the application code unikernel, wherein the application code unikernel is sealed and parameterized to facilitate running the untrusted user application code, wherein the application code unikernel comprises the stored application code in the single-purpose virtual machine image; and
based on receiving the code execution request, initiating running the application code unikernel, wherein the initiating running includes booting, by an invoker, the application code unikernel on a virtual machine manager, the invoker being a privileged virtual machine image, wherein the parameter values are provided as bootvariables as part of booting the application code unikernel, and the stored application code is executed as part of a boot process for the application code unikernel, and wherein the stored application code uses during execution the parameter values provided as the bootvariables.

10. The system of claim 9 , further comprising shutting down the application code unikernel after the executing of the stored application code as part of the booting of the application code unikernel.

11. The system of claim 9 , further comprising executing the application code unikernel directly on the virtual machine manager, the virtual machine manager comprising a hypervisor.

12. The system of claim 11 , wherein the initiating running of the application code unikernel is controlled by an invoker, the invoker being a privileged virtual machine image-executing directly on the hypervisor.

13. The system of claim 11 , wherein the application code unikernel comprises only op

Assignees

• IBM

Inventors

• Behrendt Michael
• Federschmidt Daniel
• Froehlich Dominik
• Nauerz Andreas

Classifications

• G06F9/485

  Task life-cycle, e.g. stopping, restarting, resuming execution (G06F9/4881 takes precedence) · CPC title

• G06F9/542 Primary

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F9/5077

  Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455) · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F8/60

  Software deployment · CPC title