Isolating applications at the edge

Patent metadata

Field	Value
Publication number	US-11068281-B2
Application number	US-201916292100-A
Country	US
Kind code	B2
Filing date	Mar 4, 2019
Priority date	Mar 2, 2018
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

Disclosed herein are enhancements for deploying application in an edge system of a communication network. In one implementation, a runtime environment identifies a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application. In response to the request, the runtime environment may identify an isolation resource to support the request, initiate execution of code for the application, and pass context to the code. Once initiated, the runtime environment may copy data from the artifact to the isolation resource using the context and return control to the HTTP accelerator service upon executing the code.

First claim

What is claimed is:

1. A method comprising:
identifying, in an isolation runtime environment, a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application;
identifying an isolation resource from a plurality of isolation resources reserved in advance of the request;
identifying an artifact associated with the application;
initiating execution of code for the application and passing context to the code;
after initiating execution of the code, copying data from the artifact to the isolation resource using the context; and
returning control to the HTTP accelerator service upon executing the code.

2. The method of claim 1 , wherein the data comprises at least one variable.

3. The method of claim 1 , wherein the isolation resource comprises a memory space, wherein the context comprises an addressing pointer to a memory location in the memory space.

4. The method of claim 1 , wherein the isolation resource comprises a memory space, wherein the method further comprises identifying a fault caused by the code attempting to access the memory space, and wherein copying the data from the artifact to the isolation resource occurs in response to identifying the fault.

5. The method of claim 1 further comprising:
generating the artifact from the application written in a first language, the artifact comprising the code compiled from the application in the first language and the metadata, wherein the metadata comprises at least one global variable for use by the application.

6. The method of claim 5 further comprising:
determining memory constraints associated with the application; and
compiling the code from the application in the first language based on the memory constraints.

7. The method of claim 1 , wherein the isolation resource comprises a memory space, and wherein the method further comprises identifying a completion event for the code and erasing the memory space in response the completion event.

8. An apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to:
identify, in an isolation runtime environment, a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application;
identify an isolation resource from a plurality of isolation resources reserved in advance of the request;
identify an artifact associated with the application;
initiate execution of code for the application and passing context to the code;
after initiating execution of the code, copying data from the artifact to the isolation resource using the context; and
returning control to the HTTP accelerator service upon executing the code.

9. The apparatus of claim 8 , wherein the data comprises at least one variable.

10. The apparatus of claim 8 , wherein the isolation resource comprises a memory space, wherein the context comprises an addressing pointer to a memory location in the memory space.

11. The apparatus of claim 8 , wherein isolation resource comprises a memory space, wherein the method further comprises identifying a fault caused by the code attempting to access the memory space, and wherein copying the data from the artifact to the isolation resource occurs in response to identifying the fault.

12. The apparatus of claim 8 , wherein the program instructions further direct the processing system to identify a fault in the execution of the code and determine a response to the fault based on metadata stored as part of the artifact.

13. The apparatus of claim 8 , wherein the program instructions further direct the processing system to generate the artifact from the application written in a first language, the artifact comprising the code compiled from the application in the first language and the metadata.

14. The apparatus of claim 13 , wherein the program instructions further direct the processing system to:
determine memory constraints associated with the application; and
compile the code from the application in the first language based on the memory constraints.

15. The apparatus of claim 8 , wherein the isolation resource comprises a memory space, and wherein the program instructions further direct the processing system to identify a completion event for the code and erase the memory space in response the completion event.

16. A method comprising:
identifying an application in a first language;
compiling the application into WebAssembly code;
determining metadata for the application, wherein the metadata comprises one or more global variables for the application or a trap data structure indicative of constraints of the application;
generating an application artifact, wherein the application artifact comprises compiled native code generated from the WebAssembly code and the metadata; and
deploying the application artifact to one or more cache nodes of a content delivery network.

17. The method of claim 16 further comprising, in a cache node of the one or more cache nodes:
identifying, in an isolation runtime environment for the cache node, a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by the application;
identifying an isolation resource from a plurality of isolation resources reserved in advance of the request;
initiating execution of code for the application and passing context to the code;
after initiating execution of the code, copying data from the artifact to the isolation resource using the context; and
returning control to the HTTP accelerator service upon executing the code.

18. The method of claim 17 , wherein the isolation resource comprises a memory space, and wherein the program instructions further direct the processing system to identify a completion event for the code and erase the memory space in response the completion event.

19. The method of claim 16 , wherein the program instructions further direct the processing system to determine memory constraints associated with the application and compiling the native code from the WebAssembly code based on the memory constraints.

20. A method of operating a management system of a content delivery network, the method comprising:
identifying an application in a first language;
compiling the application into WebAssembly code;
determining whether the application in WebAssembly complies with constraints for cache nodes of the content delivery network;
when the application in WebAssembly complies with the constraints, compiling the application into native code for the cache nodes; and
deploying the application as the native code in one or more virtual nodes in the content delivery network.

Assignees

• Fastly Inc

Inventors

• Mcmullen Tyler
• Foote Jonathan
• Hickey Patrick
• Cook Jason

Classifications

• H04L67/568

  Storing data temporarily at an intermediate stage, e.g. caching · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F8/41

  Compilation · CPC title

• G06F8/60 Primary

  Software deployment · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title