Multi-tenant support on virtual machines in cloud computing networks

A method, comprising:

• implementing a virtual machine on which a plurality of network containers is instantiated, each of the network containers encapsulating networking policies applicable to computing workloads hosted on the virtual machine, in which the computing workloads are mapped to respective network containers;
• associating each of the plurality of network containers with a single network interface controller (NIC) on the virtual machine, the NIC being configured to interface with a network switch;
• and
• at the network switch, processing the computing workloads for each network container to enforce the networking policies using independent datapaths on the virtual machine, the processing including matching data packets in the computing workloads to one or more rules that express the networking policies, wherein the network containers are associated with a single tenant of the virtual machine, and each network container is mapped to a different virtual network, wherein the tenant is switched between virtual networks by processing the computing workloads associated with a respective mapped network container.

One or more hardware-based non-transitory computer readable memory devices storing computer-executable instructions which, upon execution by one or more processors in a computer server, cause the server to:

• implement a virtual machine on which a plurality of network containers is instantiated, each of the network containers encapsulating networking policies applicable to computing workloads hosted on the virtual machine, in which the computing workloads are mapped to respective network containers;
• associate each of the plurality of network containers with a single network interface controller (NIC) on the virtual machine, the NIC being configured to interface with a network switch;
• and
• at the network switch, process the computing workloads for each network container to enforce the networking policies using independent datapaths on the virtual machine, the processing including matching data packets in the computing workloads to one or more rules that express the networking policies, wherein the network containers are associated with a single tenant of the virtual machine, and each network container is mapped to a different virtual network, wherein the tenant is switched between virtual networks by processing the computing workloads associated with a respective mapped network container.