Allocation of virtual interfaces to containers

Patent metadata

Field	Value
Publication number	US-10938619-B2
Application number	US-201715689438-A
Country	US
Kind code	B2
Filing date	Aug 29, 2017
Priority date	Aug 30, 2016
Publication date	Mar 2, 2021
Grant date	Mar 2, 2021

Abstract

Systems, methods, and software described herein enhance connectivity between computing systems and containers. In one implementation, a method of allocating virtual network interfaces to containers on a host includes transferring, from the host, a request to at least one configuration resource to obtain an address configuration for one or more containers to be executed on the host. The method further provides for receiving an addressing configuration for the one or more containers to be executed on the host, and assigning a virtual network interface to each of the one or more containers based on the addressing configuration.

First claim

What is claimed is:

1. A computer-implemented system for allocating virtual network interfaces to each of a plurality of containers hosted on a host computing system, said computer-implemented system comprising:
a memory module storing computer program code for allocating said virtual network interfaces to each of said containers hosted on said host computing system;
a processor communicably coupled to said memory module, said processor configured to executed said computer program code stored within said memory module, said processor, on execution of said computer program code, configured to trigger said host computing system to:
transmit a request to a remote configuration resource;
trigger said remote configuration resource, by way of said request, to return-transmit an addressing configuration necessary for configuring at least one predetermined container hosted on said host computing system, and wherein said addressing configuration includes at least a software image pre-configured to transform said predetermined container into a pre-specified service node, and wherein said software image includes at least files and repositories necessary for execution of said predetermined container on said host computing system, and wherein software image triggers said predetermined container to share at least kernel resources provided by an operating system executed on said host computing system, with other containers, despite said container and said other containers pre-configured with private access to said operating system within corresponding identifiers spaces, file system structures, and network interfaces; and

wherein said processor further triggers said host computing system to assign a virtual network interface to said predetermined container based on said addressing configuration, wherein said virtual network interface is pre-configured to connect said predetermined container to a pre-designated virtual private network (VPN), thereby confining inbound and outbound communications of said predetermined container to said pre-designated virtual private network and to devices connected to said virtual private network, and thereby preventing said predetermined container and said inbound and outbound communications from being visible and identifiable beyond said pre-designated virtual private network, and wherein assignment of said virtual network interface to said predetermined container enhances security attributed to said predetermined container, since said predetermined container is connected only to a network associated with said virtual private network.

2. The system as claimed in claim 1 , wherein the processor triggers the host computing system to transmit predetermined credentials to said remote configuration resource for receiving said addressing configuration therefrom, said processor further configured to trigger said remote configuration resource to receive and process said credentials, and determine, based on said credentials, whether said host computing system is eligible to receive said addressing configuration.

3. The system as claimed in claim 2 , wherein said host computing system is configured to selectively request and receive said predetermined credentials from an authentication server, as a response to transmission of predetermined host identifier information identifying said host computing system, to said authentication server.

4. The system as claimed in claim 1 , wherein said processor is further configured to trigger said host computing system to assign a TAP interface to said predetermined container based on said addressing configuration, and wherein said TAP interface is configured to establish an Ethernet bridge from said predetermined container to said devices connected to said virtual private network.

5. The system as claimed in claim 1 , wherein said addressing configuration corresponding to said predetermined container, return-transmitted by said remote configuration resource onto said host computing system includes information identifying at least said virtual private network and said devices connected to said virtual private network.

6. The system as claimed in claim 1 , wherein said processor triggers said host computing system to assign respective virtual network interfaces to each of said plurality of containers hosted therein, such that each of said virtual network interfaces connects a corresponding container to a predetermined, disparate virtual private network, thereby separating each of said containers and said inbound and outbound communications, based on said virtual private network connected to each of said containers.

7. A computer-implemented method, executable on a computer processor, for allocating virtual network interfaces to each of a plurality of containers hosted on a host computing system, said computer-implemented method comprising the following steps:
triggering, by said processor, said host computing system to transmit a request to a remote configuration resource for addressing configuration corresponding to at least one predetermined container;
triggering, by said processor, said remote configuration resource to return-transmit, in response to said request, an addressing configuration necessary for configuring said at least one predetermined container, and wherein said addressing configuration includes at least software image pre-configured to transform said predetermined container into a pre-specified service node, and wherein said software image includes at least files and repositories necessary for execution of said predetermined container on said host computing system, and wherein software image triggers said predetermined container to share at least kernel resources provided by an operating system executed on said host computing system, with other containers, despite said container and said other containers pre-configured with private access to said operating system within corresponding identifiers spaces, file system structures, and network interfaces; and
triggering, by said processor, said host computing system to assign a virtual network interface to said predetermined container based on said addressing configuration, wherein said virtual network interface is configured to connect said predetermined container to a pre-designated virtual private network (VPN), thereby confining inbound and outbound communications of said predetermined container to said pre-designated virtual private network and to devices connected to said virtual private network, and thereby preventing said predetermined container and said inbound and outbound communications from being visible and identifiable beyond said pre-designated virtual private network, and thereby enhancing security attributed to said predetermined container, since said predetermined container is connected only to a network associated with said virtual private network.

8. The method as claimed in claim 7 , wherein the method further includes the steps of:
triggering, by said processor, said host computing system to transmit predetermined credentials to said remote configuration resource for receiving said addressing configuration therefrom;
triggering, by said processor, said remote configuration resource to receive and process said credentials, and determine, based on said credentials, whether said host computing system is eligible to receive said addressing configuration.

9. The method as claimed in claim 8 , wherein the method further includes the step of triggering said host computing system, by said processor, to selectively request and receive said predetermined credentials from an authentication server, as a response to transmission of predetermined host identifier information identifying said host computing system, to said authenticati

Assignees

• Colortokens Inc

Inventors

• Rachamadugu Raghavendra

Classifications

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F9/4856 Primary

  resumption being on a different machine, e.g. task migration, virtual machine migration (G06F9/5088 takes precedence) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title