# US 10,484,392 B2 · Isolating containers on a host > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,392 B2 - Document ID: US10484392B2 - Status: Granted - Kind: B2 - Application number: 15/699,611 - Filed: 2017-09-08 - Published: 2019-03-14 - Granted: 2019-11-19 - Earliest claimed: 2017-09-08 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: Manish Chugtu; Karan Kapoor; Damascene M. Joachimpillai - Web page: https://patentgrep.com/patent/US10484392B2 ## CPC - H04L 63/105: {Multiple levels of security} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A device can receive a request to deploy, on the device, a container associated with a tenant. The request can include information identifying one or more parameters related to the container. The device can configure, for the container, an Internet protocol (IP) address that includes information identifying the tenant with which the container is associated. The IP address can permit the container to be reachable from outside of the device. The device can configure an interface for the container to isolate the container from another container deployed on the device. The other container can be associated with another tenant. The tenant and the other tenant can be different. The device can configure a set of rules related to traffic associated with the container. The device can perform an action related to the container after deploying the container with the IP address, the interface, and the set of rules. ## Claims ### Claim 1 A device, comprising: a memory to store instructions; and one or more processors to execute the instructions to: receive a request to deploy, on the device, a container associated with a tenant, the request including information identifying one or more parameters related to the container; configure, for the container, an Internet protocol (IP) address that includes information identifying the tenant with which the container is associated, the IP address to permit the container to be reachable from outside of the device; configure an interface for the container to isolate the container from another container deployed on the device, the other container being associated with another tenant, the tenant and the other tenant being different; configure a bridge, associated with the interface, on the device to connect the container and the other container, the bridge being used to prevent the container from reading or sniffing one or more packets associated with the other container; configure a set of rules related to traffic associated with the container, the set of rules to permit the container to exchange traffic with a set of containers associated with the tenant, and the set of rules to prevent the container from exchanging traffic with another set of containers associated with the other tenant; and perform an action related to the container after deploying the container with the IP address, the interface, the bridge, and the set of rules. ### Claim 2 (depends on 1) The device of claim 1, where the one or more parameters include: an amount of resources to be provided for the container, a type of the container, an image of the container, a network with which the container is to be associated, information identifying the tenant with which the container is to be associated, or an identifier that identifies the container. ### Claim 3 (depends on 1) The device of claim 1, where the one or more processors, when configuring the IP address, are to: configure the IP address according to a particular format; and where the one or more processors, when configuring the interface, are to: configure the interface after configuring the IP address according to the particular format. ### Claim 4 (depends on 1) The device of claim 1, where the interface is a media access control (MAC) virtual local area network (VLAN) (MACVLAN) interface. ### Claim 5 (depends on 1) The device of claim 1, where the one or more processors are further to: perform a lookup of information identifying the tenant; determine the IP address to configure based on a result of the lookup; and where the one or more processors, when configuring the IP address, are to: configure the IP address after determining the IP address. ### Claim 6 (depends on 1) The device of claim 1, where the one or more processors, when configuring the set of rules, are to: configure the set of rules after configuring the bridge. ### Claim 7 (depends on 1) The device of claim 1, where the one or more processors, when configuring the set of rules, are to: configure the set of rules within the container; and where the one or more processors, when performing the action, are to: perform the action after configuring the set of rule within the container. ### Claim 8 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors, cause the one or more processors to: receive a request to deploy, on a device, a container associated with a tenant, the request including information identifying one or more parameters related to the container; configure, for the container, an Internet protocol (IP) address that includes information identifying the tenant with which the container is associated, the IP address to permit the container to be reachable from outside of the device; configure an interface for the container to isolate the container from another container deployed on the device, the other container being associated with another tenant, the tenant and the other tenant being different; configure a bridge, associated with the interface, on the device to connect the container and the other container, the bridge being used to prevent the container from reading or sniffing one or more packets associated with the other container; configure a set of rules related to traffic associated with the container, the set of rules to permit the container to exchange traffic with a set of containers associated with the tenant, and the set of rules to prevent the container from exchanging traffic with another set of containers associated with the other tenant; and perform an action related to the container after deploying the container with the IP address, the interface, the bridge, and the set of rules. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the IP address, cause the one or more processors to: configure the IP address to include an identifier that identifies the tenant in a last octet of the IP address. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the bridge, cause the one or more processors to: configure a media access control (MAC) virtual local area network (VLAN) (MACVLAN) bridge, the container to be connected to the MACVLAN bridge via the interface. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the set of rules, cause the one or more processors to: configure a rule, of the set of rules, to permit the container to receive the traffic associated with the tenant. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the set of rules, cause the one or more processors to: configure a rule, of the set of rules, to prevent the container from receiving the traffic associated with the other tenant. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the IP address, cause the one or more processors to: configure the IP address according to a particular format, the particular format relating to an octet of the IP address. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, that cause the one or more processors to configure the set of rules, cause the one or more processors to: configure the set of rules using an agent associated with the device. ### Claim 15 A method, comprising: receiving, by a device, a request to deploy, on the device, a container associated with a tenant, the request including information identifying one or more parameters related to the container; configuring, by the device and for the container, an Internet protocol (IP) address that includes information identifying the tenant with which the container is associated, the IP address to permit the container to be reachable from outside of the device; configuring, by the device, an interface for the container to isolate the container from another container deployed on the device, the other container being associated with another tenant, the tenant and the other tenant being different; configuring, by the device, a bridge, associated with the interface, on the device to connect the container and the other container, the bridge being used to prevent the container from reading or sniffing one or more packets associated with the other container; configuring, by the device, a set of rules related to traffic associated with the container, the set of rules to permit the container to exchange traffic with a set of containers associated with the tenant, and the set of rules to prevent the container from exchanging traffic with another set of containers associated with the other tenant; and performing, by the device, an action related to the container after deploying the container with the IP address, the interface, the bridge, and the set of rules. ### Claim 16 (depends on 15) The method of claim 15, further comprising: requesting that a remote network plugin configure an IP address for the container according to an IP address management (IPAM) scheme; and where configuring the IP address comprises: configuring the IP address based on requesting that the remote network plugin configure the IP address. ### Claim 17 (depends on 15) The method of claim 15, further comprising: requesting that a remote network plugin configure a media access control (MAC) virtual local area network (VLAN) (MACVLAN) interface for the container; and where configuring the interface comprises: configuring the interface based on requesting that the remote network plugin configure the MACVLAN interface. ### Claim 18 (depends on 15) The method of claim 15, where configuring the IP address comprises: configuring the IP address to include the information identifying the tenant in a last octet of the IP address. ### Claim 19 (depends on 15) The method of claim 15, further comprising: configuring the bridge after configuring the interface, the bridge to be connected to the container and to the other container. ### Claim 20 (depends on 15) The method of claim 15, where performing the action comprises: providing a notification to another device that indicates that the container is deployed.