System and method for guest operating system using containers

Patent metadata

Field	Value
Publication number	US-11042398-B2
Application number	US-201916504075-A
Country	US
Kind code	B2
Filing date	Jul 5, 2019
Priority date	Jul 9, 2018
Publication date	Jun 22, 2021
Grant date	Jun 22, 2021

Abstract

A method for operating an electronic device, the method including spawning a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS. The method further includes spawning, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and dropping, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

First claim

What is claimed is:

1. A method for operating an electronic device, the method comprising:
spawning a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS;
spawning, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS; and
dropping, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

2. The method of claim 1 , further comprising:
executing a process written for the guest OS natively within the container for the guest OS,
wherein the process is mapped to the dedicated domain in the host OS.

3. The method of claim 1 , further comprising:
restricting a view of processes running in the container for the guest OS from the host OS.

4. The method of claim 3 , wherein the view of processes running in the container for the guest OS is restricted using one or more of mount namespace, pivot_root, or unshare.

5. The method of claim 1 , further comprising modifying a kernel to mask information regarding a host OS process to processes in the container for the guest OS.

6. The method of claim 1 , further comprising:
connecting a management application running on the host OS with a daemon in the container for the guest OS to establish a secure command and control channel.

7. The method of claim 6 , further comprising:
sending, from the management application running on the host OS to the daemon, at least one of a stop command, a start command, or a resume command;
detecting, by a host OS process, a resource availability event; and
responsive to detecting the resource availability event, sending by the management application, and instruction associated with a group of processes executing in the container for the guest OS,
wherein the instruction is at least one of a pause command or a resume command.

8. The method of claim 6 , further comprising:
generating a private/public key pair for the secure command and control channel;
sending, by the management application, a public key of the private/public key pair and a set of initial set up commands to the daemon in the container for the guest OS; and
saving the public key, by the daemon in the container for the guest OS.

9. The method of claim 8 , further comprising:
transmitting, by the management application, a command to the daemon in the container for the guest OS, wherein the command is wrapped with a private key of the private/public key pair.

10. The method of claim 1 , further comprising:
running an instance of a target application in an environment of the host OS; and
running a debugging client associated with the target application in the container for the container for the guest OS,
wherein an activity plugin in a framework of the host OS controls an activity status of the target application to prevent the target application from freezing the debugging client.

11. An apparatus, comprising:
a processor; and
a memory comprising a host OS,
the memory contains instructions, which, when executed by the processor, cause the apparatus to:
spawn a name space tool (NST) as part of a boot process of the host OS, wherein the NST is a process with a plurality of root privileges of the host OS,
spawn, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and
spawn, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

12. The apparatus of claim 11 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to:
execute a process written for the guest OS natively within the container for the guest OS,
wherein the process is mapped to the dedicated domain in the host OS.

13. The apparatus of claim 11 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to restrict a view of processes running in the container for the guest OS from the host OS.

14. The apparatus of claim 13 , wherein the view of processes running in the container for the guest OS is restricted using one or more of mount namespace, pivot_root, or unshare.

15. The apparatus of claim 11 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to modify a kernel to mask information regarding a host OS process to processes in the container for the guest OS.

16. The apparatus of claim 11 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to connect a management application running on the host OS with a daemon in the container for the guest OS to establish a secure command and control channel.

17. The apparatus of claim 16 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to:
send, from the management application running on the host OS to the daemon, at least one of a stop command, a start command, or a resume command,
detect, by a host OS process, a resource availability event, and
responsive to detecting the resource availability event, send by the management application, and instruction associated with a group of processes executing in the container for the guest OS,
wherein the instruction is at least one of a pause command or a resume command.

18. The apparatus of claim 16 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to:
generate a private/public key pair for the secure command and control channel,
send, by the management application, a public key of the private/public key pair and a set of initial set up commands to the daemon in the container for the guest OS, and
save the public key, by the daemon in the container for the guest OS.

19. The apparatus of claim 18 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to:
transmitting, by the management application, a command to the daemon in the container for the guest OS, wherein the command is wrapped with a private key of the private/public key pair.

20. The apparatus of claim 11 , wherein the memory further contains instructions, which, when executed by the processor, cause the apparatus to:
run an instance of a target application in an environment of the host OS, and
run a debugging client associated with the target application in the container for the container for the guest OS,
wherein an activity plugin in a framework of the host OS controls an activity status of the target application to prevent the target application from freezing the debugging client.

21. A non-transitory, computer readable medium, comprising program code, which, when executed by a processor, causes an apparatus to:
spawn a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS,
spawn, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and
spawn, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.

22. The non-transitory, computer-readable medium of claim 21 , further comprising instructions, which, when executed by the processor, cause the apparatus to:
execute a p

Assignees

• Samsung Electronics Co Ltd

Inventors

• Ganesh Guruprasad
• Herle Sudhi
• Azab Ahmed M
• BHUTKAR Rohan
• Getta Ivan
• Chen Xun
• Shen Wenbo
• Wang Ruowen
• Chen Haining
• Elwazeer Khaled
• Li Mengmeng
• Ning Peng
• Yu Hyungseok
• Cha Myungsu
• Lee Kyungsun
• Choi Se Young
• Choe Yurak
• Shin Yong
• Shin Kyoung-Joong
• Seo Donguk
• Choi Junyong

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F9/485

  Task life-cycle, e.g. stopping, restarting, resuming execution (G06F9/4881 takes precedence) · CPC title

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F9/44526

  Plug-ins; Add-ons · CPC title