Isolating applications at the edge

Patent metadata

Field	Value
Publication number	US-11704133-B2
Application number	US-202117378963-A
Country	US
Kind code	B2
Filing date	Jul 19, 2021
Priority date	Mar 2, 2018
Publication date	Jul 18, 2023
Grant date	Jul 18, 2023

Abstract

Disclosed herein are enhancements for deploying application in an edge system of a communication network. In one implementation, a runtime environment identifies a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application. In response to the request, the runtime environment may identify an isolation resource to support the request, initiate execution of code for the application, and pass context to the code. Once initiated, the runtime environment may copy data from the artifact to the isolation resource using the context and return control to the HTTP accelerator service upon executing the code.

First claim

What is claimed is:

1. A method of operating one or more edge computing systems of a network, comprising:
reserving a set of virtual nodes, each virtual node of the set of virtual nodes corresponding to an address range;
running a request handler process;
identifying a request from the request handler process to be processed by a first application of a group of applications;
selecting a first virtual node from the set of virtual nodes;
establishing a context at least based on the address range corresponding to the first virtual node;
initiating execution of code for the first application and passing the context to the code;
copying data to the virtual node; and
returning control to the request handler process upon executing the code.

2. The method of claim 1 , wherein the data comprises at least one variable.

3. The method of claim 1 , wherein the virtual node comprises a memory space, wherein the context comprises an addressing pointer to a memory location in the memory space.

4. The method of claim 1 , wherein the virtual node comprises a memory space, wherein the method further comprises identifying a fault caused by the code attempting to access the memory space, and wherein copying the data to the virtual node occurs in response to identifying the fault.

5. The method of claim 1 further comprising:
generating an artifact from the first application written in a first language, the artifact comprising the code compiled from the first application in the first language and metadata, wherein the metadata comprises at least one global variable for use by the application.

6. The method of claim 5 further comprising:
determining memory constraints associated with the first application; and
compiling the code from the first application in the first language based on the memory constraints.

7. The method of claim 1 , wherein the virtual node comprises a memory space, and wherein the method further comprises identifying a completion event for the code and erasing the memory space in response to the completion event.

8. An apparatus comprising:
one or more non-transitory computer readable storage media;
a processing system operatively coupled to the one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to:
reserve a set of virtual nodes, each virtual node of the set of virtual nodes corresponding to an address range;
run a request handler process;
identify a request from the request handler process to be processed by a first application of a group of applications;
select a first virtual node from the set of virtual nodes;
establish a context at least based on the address range corresponding to the first virtual node;
initiate execution of code for the first application and passing the context to the code;
copy data to the virtual node; and
return control to the request handler process upon executing the code.

9. The apparatus of claim 8 , wherein the data comprises at least one variable.

10. The apparatus of claim 8 , wherein the virtual node comprises a memory space, wherein the context comprises an addressing pointer to a memory location in the memory space.

11. The apparatus of claim 8 , wherein virtual node comprises a memory space, wherein the method further comprises identifying a fault caused by the code attempting to access the memory space, and wherein copying the data to the virtual node occurs in response to identifying the fault.

12. The apparatus of claim 8 , wherein the program instructions further direct the processing system to generate an artifact from the application written in a first language, the artifact comprising the code compiled from the application in the first language and the metadata.

13. The apparatus of claim 12 , wherein the program instructions further direct the processing system to:
determine memory constraints associated with the application; and
compile the code from the application in the first language based on the memory constraints.

14. The apparatus of claim 8 , wherein the virtual node comprises a memory space, and wherein the program instructions further direct the processing system to identify a completion event for the code and erase the memory space in response to the completion event.

15. A method comprising:
identifying an application in a first language;
identifying isolation runtime parameters;
compiling the application into an assembly code and then into a native code, wherein the compiling enforces the isolation runtime parameters;
producing an artifact, wherein the artifact comprises the compiled native code and metadata; and
deploying the application artifact to one or more nodes of an edge network, and
in a node of the one or more nodes:
identifying, in an isolation runtime environment for the node, a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by the application;
identifying an isolation resource from a plurality of isolation resources reserved in advance of the request;
initiating execution of code for the application and passing context to the code;
after initiating execution of the code, copying data from the artifact to the isolation resource using the context; and
returning control to the HTTP accelerator service upon executing the code.

16. The method of claim 15 , wherein the metadata comprises global variables used by the application.

17. The method of claim 15 , wherein the metadata comprises configuration requirements of the application.

18. The method of claim 15 , wherein the metadata comprises execution constraints of the application.

19. The method of claim 15 , wherein the compiled native code corresponds to a programming language native to the one or mode nodes of the edge network.

Assignees

• Fastly Inc

Inventors

• Mcmullen Tyler
• Foote Jonathan
• Hickey Patrick
• Cook Jason

Classifications

• G06F9/445 Primary

  Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) · CPC title

• G06F8/41

  Compilation · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F8/60 Primary

  Software deployment · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title