# US 12,001,867 B2 · Method and system for improving software container performance and isolation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,867 B2 - Document ID: US12001867B2 - Status: Granted - Kind: B2 - Application number: 17/046,632 - Filed: 2019-04-11 - Published: 2021-04-15 - Granted: 2024-06-04 - Earliest claimed: 2018-04-11 - Assignees: Cornell University - Applicants: Cornell University - Inventors: Zhiming Shen; Robbert van Renesse; Hakim Weatherspoon - Web page: https://patentgrep.com/patent/US12001867B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/4555: {Para-virtualisation, i.e. guest operating system has to be modified} - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 8/63: {Image based installation; Cloning; Build to order} - G06F 9/45541: {Bare-metal, i.e. hypervisor runs directly on hardware} - G06F 2009/45583: {Memory management, e.g. access or allocation} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method in one embodiment comprises implementing a kernel-based isolation layer, configuring a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system, and executing one or more user processes in the software container. The method is performed by a cloud-based processing platform, an enterprise processing platform, or other type of processing platform comprising a plurality of processing devices, with each such processing device comprising a processor coupled to a memory. The library operating system illustratively runs in the software container at a privilege level that is the same as a privilege level of the one or more user processes executing in the software container. The library operating system is illustratively configured to support automatic translation of binaries of the one or more user processes in conjunction with converting system calls into corresponding function calls. ## Claims ### Claim 1 A method comprising: implementing a kernel-based isolation layer; configuring a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system; and executing one or more user processes in the software container, wherein the method is performed by a processing platform comprising a plurality of processing devices each comprising a processor coupled to a memory, and wherein the library operating system runs in the software container at a privilege level that is the same as a privilege level of the one or more user processes executing in the software container. ### Claim 2 (depends on 1) The method of claim 1 wherein the kernel-based isolation layer is implemented in the form of an X-Kernel relative to the dedicated operating system kernel of the software container. ### Claim 3 (depends on 1) The method of claim 1 wherein the kernel-based isolation layer comprises one of a virtual machine hypervisor and a host operating system. ### Claim 4 (depends on 1) The method of claim 1 wherein the library operating system is converted from a monolithic operating system kernel of a specified type. ### Claim 5 (depends on 1) The method of claim 1 wherein executing one or more user processes in the software container comprises executing a plurality of user processes in the software container, and further wherein the library operating system runs in the software container at a privilege level that is the same as a privilege level of each of the plurality of user processes executing in the software container. ### Claim 6 (depends on 1) The method of claim 1 wherein the library operating system is configured to support automatic translation of binaries of the one or more user processes in conjunction with converting system calls into corresponding function calls. ### Claim 7 (depends on 1) The method of claim 1 wherein configuring a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system further comprises: extracting a container image of an existing software container; and utilizing the extracted container image as a virtual machine image in configuring the software container on the kernel-based isolation layer, wherein the software container on the kernel-based isolation layer comprises a wrapped version of the existing software container. ### Claim 8 (depends on 7) The method of claim 7 wherein one or more user processes of the existing software container are permitted to execute as the one or more user processes in the software container on the kernel-based isolation layer without requiring any modification of those one or more user processes. ### Claim 9 (depends on 1) The method of claim 1 wherein configuring a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system further comprises configuring a plurality of software containers on the kernel-based isolation layer with each of the plurality of software containers including a separate dedicated operating system kernel as a library operating system. ### Claim 10 (depends on 9) The method of claim 9 wherein executing one or more user processes in the software container further comprises executing distinct sets of one or more user processes in respective ones of the plurality of software containers and wherein at least one of the distinct sets comprises a plurality of different user processes. ### Claim 11 (depends on 10) The method of claim 10 wherein a first one of the distinct sets of one or more user processes executing in a first one of the plurality of software containers is isolated from a second one of the distinct sets of one or more user processes executing in a second one of the plurality of software containers. ### Claim 12 (depends on 1) The method of claim 1 wherein configuring the software container comprises configuring the software container as a para-virtualized software container in which the library operating system and the one or more user processes run in a user mode. ### Claim 13 (depends on 12) The method of claim 12 wherein implementing the kernel-based isolation layer on which the para-virtualized software container runs comprises implementing the kernel-based isolation layer as a modified version of a virtual machine hypervisor or operating system kernel. ### Claim 14 (depends on 1) The method of claim 1 wherein configuring the software container comprises configuring the software container as a hardware-assisted virtualized software container in which the library operating system and the one or more user processes run in a kernel mode within a hardware-assisted virtual machine. ### Claim 15 (depends on 14) The method of claim 14 wherein implementing the kernel-based isolation layer on which the hardware-assisted virtualized software container runs comprises implementing the kernel-based isolation layer as a virtual machine hypervisor or operating system kernel. ### Claim 16 (depends on 1) The method of claim 1 wherein the kernel-based isolation layer and the library operating system of the software container are implemented using respective first and second operating systems of different types. ### Claim 17 (depends on 1) The method of claim 1 wherein executing one or more user processes in the software container comprises executing a plurality of user processes in the software container, and further wherein the plurality of user processes comprise at least first and second concurrent user processes having respective different address spaces associated therewith. ### Claim 18 A system comprising: a processing platform comprising a plurality of processing devices, each comprising a processor coupled to a memory; the processing platform being configured: to implement a kernel-based isolation layer; to configure a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system; and to execute one or more user processes in the software container, wherein the library operating system runs in the software container at a privilege level that is the same as a privilege level of the one or more user processes executing in the software container. ### Claim 19 (depends on 18) The system of claim 18 wherein the processing platform is configured to provide different sets of one or more software containers on the kernel-based isolation layer for respective different tenants with each such software container including a dedicated operating system kernel as a library operating system. ### Claim 20 (depends on 18) The system of claim 18 wherein the processing platform comprises at least one of: a cloud-based processing platform; an enterprise processing platform; an Internet of Things (IoT) platform; and a Network Function Virtualization (NFV) platform. ### Claim 21 A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by a processing platform comprising a plurality of processing devices, each processing device comprising a processor coupled to a memory, causes the processing platform: to implement a kernel-based isolation layer; to configure a software container on the kernel-based isolation layer to include a dedicated operating system kernel as a library operating system; and to execute one or more user processes in the software container, wherein the library operating system runs in the software container at a privilege level that is the same as a privilege level of the one or more user processes executing in the software container. ### Claim 22 (depends on 21) The computer program product of claim 21 wherein executing one or more user processes in the software container comprises executing a plurality of user processes in the software container, and further wherein the library operating system runs in the software container at a privilege level that is the same as a privilege level of each of the plurality of user processes executing in the software container. ### Claim 23 (depends on 21) The computer program product of claim 21 wherein the library operating system is configured to support automatic translation of binaries of the one or more user processes in conjunction with converting system calls into corresponding function calls.