# US 10,007,537 B2 · Method for targeted resource virtualization in containers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,007,537 B2
- Document ID: US10007537B2
- Status: Granted
- Kind: B2
- Application number: 15/163,492
- Filed: 2016-05-24
- Published: 2016-09-15
- Granted: 2018-06-26
- Earliest claimed: 2013-11-26
- Assignees: Parallels
- Applicants: Parallels
- Inventors: Pavel Emelyanov; Igor Petrov; Stanislav S. Protassov; Serguei M. Beloussov
- Web page: https://patentgrep.com/patent/US10007537B2

## CPC

- G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F 9/4555: {Para-virtualisation, i.e. guest operating system has to be modified}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method and computer program product for targeted container virtualization, where only separate components of a computer system or a server are virtualized. The OS kernel and other server resources are not virtualized. Only selected components—applications or resources are targeted for virtualization instead of virtualization of the entire system. Targeted virtualization provides for more flexible container isolation from each other and from a host node. This, in turn, provides for optimized more flexible cloud infrastructure. Each element within a container virtualization model is optional in terms of virtualization. The element's virtualization option can be turned on and off by an administrator or by a client who owns the container.

## Claims

### Claim 1

A system for targeted virtualization, the system comprising:
a host hardware node having a host OS;
a plurality of host OS objects implemented under the host OS;
a plurality of containers running on the host hardware node, the containers virtualizing the host OS and sharing at least some of the host OS objects,
wherein:
at least some utilities of the host OS have a virtualization on-off switch, and
at least some of the host OS objects are virtualized inside the containers if a corresponding utility virtualization on-off switch is switched on.

### Claim 2 (depends on 1)

The system of claim 1, wherein the virtualization on-off switch is turned on by a container administrator.

### Claim 3 (depends on 1)

The system of claim 1, wherein the utility virtualization switch is turned on based on a container user requirements.

### Claim 4 (depends on 1)

The system of claim 1, wherein the host OS objects are not virtualized.

### Claim 5 (depends on 1)

The system of claim 1, wherein the host OS objects are shared among containers running on the hardware node.

### Claim 6 (depends on 1)

The system of claim 1, wherein the container uses selected virtualized host OS objects and shared host OS objects based on user requirements.

### Claim 7 (depends on 1)

The system of claim 1, wherein the host OS is patched for selected virtualization of utilities in a form of separate utility modules.

### Claim 8 (depends on 1)

The system of claim 1, wherein the host OS objects are any of:
memory;
I/O operations;
disk;
network;
users and groups;
devices;
PID tree;
IPC objects;
real object IDs;
IPC semaphores;
event queue;
descriptors of shared memory segments;
system message queue;
PID table;
process tree
a hash table of IDs;
proc file system superblocks;
host name;
domain name;
network devices;
routing information;
configured IP addresses;
service TCP;
IP sockets;
netlink sockets;
firewall rules;
configuration semaphores;
hash tables for user sockets and configuration, and
C-group tree root.

### Claim 9 (depends on 1)

The system of claim 1, wherein the utilities include any of: network stack, IPC, process management, UTS (UNIX Timesharing Systems), mount point tree, memory controller, I/O controller, device access policies and enforcement modules, kernel memory controller, CPU scheduler, and controller tree.

### Claim 10

A system for network stack virtualization, the system comprising:
a host hardware node having a host OS;
a network stack implemented under the host OS, the network stack having a plurality of network stack objects;
a container running on the host hardware node, the container virtualizing the network stack and sharing at least some host OS objects with other containers on the host hardware node,
wherein:
the network stack is implemented as a utility with a virtualization on-off switch that is switched on, and
the network stack objects are virtualized by the container to enable the container to provide network services to other virtualized entities on the host hardware node.

### Claim 11 (depends on 10)

The system of claim 10, wherein the utility virtualization switch is turned on based on a container user requirements.

### Claim 12 (depends on 10)

The system of claim 10, wherein the container uses selected virtualized host OS objects and shared host OS objects based on user requirements.

### Claim 13 (depends on 12)

The system of claim 12, wherein the shared host OS objects are not virtualized.

### Claim 14 (depends on 10)

The system of claim 10, wherein the shared host OS objects are shared among all containers running on the hardware node.

### Claim 15 (depends on 10)

The system of claim 10, wherein the host OS is patched for selected virtualization of utilities in a form of separate utility modules.

### Claim 16 (depends on 10)

The system of claim 10, wherein the utilities include any of: network stack, IPC, process management, UTS (UNIX Timesharing Systems), mount point tree, memory controller, I/O controller, device access policies and enforcement modules, kernel memory controller, CPU scheduler, and controller tree.

### Claim 17

A computer-implemented method for targeted virtualization in a container, the method comprising:
(a) launching an OS kernel on a host hardware node;
(b) executing a network stack utility under the host OS, the network stack utility including a plurality of host OS objects;
(c) turning on a utility virtualization on-off switch for the network stack utility;
(d) launching a container on the hardware node, the container virtualizing at least some elements of the host OS;
(e) virtualizing the host OS kernel objects of the network stack utility inside the container;
(f) using the container to provide network services to other virtualized entities on the hardware node.

### Claim 18 (depends on 17)

The method of claim 17, wherein the selecting of the host OS kernel objects is implemented based on user requirements.

### Claim 19 (depends on 17)

The method of claim 17, wherein the host OS objects include any of:
IPC objects;
real object IDs;
IPC semaphores;
event queue;
descriptors of shared memory segments;
system message queue;
host name;
domain name;
network devices;
routing information;
configured IP addresses;
service TCP;
IP sockets;
netlink sockets; and
firewall rules.

### Claim 20

A computer program product comprising non-transitory medium storing computer code for performing the following steps:
(a) launching an OS kernel on a host hardware node;
(b) executing a network stack utility under the host OS, the network stack utility including a plurality of host OS objects;
(c) turning on a utility virtualization on-off switch for the network stack utility;
(d) launching a container on the hardware node, the container virtualizing at least some elements of the host OS;
(e) virtualizing the host OS kernel objects of the network stack utility inside the container;
(f) using the container to provide network services to other virtualized entities on the hardware node.