Abstract: A system can be provided for deploying a software application in a unikernel to facilitate safety compliance. For example, the system may determine that a software application associated with a computing system satisfies encapsulation criteria of the computing system. The software application may further be associated with a functional safety standard issued by a standard-setting organization. The system may then identifying a minimum set of dependencies for executing the software application on the computing system. Additionally, the system can generate a unikernel comprising the software application and the minimum set of dependencies and deploy the unikernel on the computing system to facilitate execution of the software application on the computing system and compliance of the software application with the functional safety standard.

Abstract: A modification to a filesystem may be identified. It may be determined that the modification to the file system corresponds to a link in the filesystem. A processing device may update a current graph representation of links in the filesystem to produce an updated graph representation of links in the filesystem including the link that corresponds to the modification to the filesystem based on determining the modification to the file system corresponds to the link in the filesystem.

Abstract: Techniques for distributing automation packages are disclosed. An example method includes receiving a playbook that includes a task to be performed by a set of target devices. The method also includes generating an automation package that includes the task included in the playbook. The method also includes encapsulating the automation package in one or more messages, where the one or more messages include a topic identifier that identifies a topic corresponding to the set of target devices. The method also includes sending, by a processing device, the one or more messages to a message service to be published to the topic, where the set of target devices are configured to subscribe to the topic.

Abstract: In some examples, a system can establish a container-registry mesh network across a group of nodes of a computer network. Each node in the group of nodes can execute a container registry API that provides details about container image layers locally stored in the node. The system can receive a request for one or more layers of a container image from a client device. In response, the system can determine one or more nodes storing the one or more layers by transmitting queries to the respective container registry APIs of group of nodes. The system can then instruct the client device to obtain the one or more layers of the container image from the one or more nodes.

Abstract: Packet loss associated with endpoint location changes can be reduced using the technique described herein. In one example, a system can receive a data packet from a sending device, where the data packet is intended for a destination endpoint. The system can determine that a location of the destination endpoint changed from a first location to a second location. This location change might normally result in loss of the data packet. But, based on receiving the data packet and determining that the location of the destination endpoint changed, the system can generate a notification indicative of the location change. The system can then transmit the notification to the sending device. Based on this notification, the sending device can retransmit the packet’s content to the second location to prevent data loss.

Abstract: The present disclosure provides new and innovative systems and methods for automating functional safety scoring in applications. An example method includes a computing device having a processor detecting a requirement to generate a functional safety score for at least a portion of a program. The functional safety score may be based on a functional safety standard (e.g., the ISO 26262 standard). The method may further include determining one or more provisions of the functional safety standard; and identifying one or more signatures for each of the one or more provisions. For each provision, the processor may query the portion of the program for the corresponding one or more signatures. For each provision, the processor may determine a subscore based on the query for the corresponding one or more signatures, resulting in a set of subscores. Based on the set of subscores, the processor may generate the functional safety score.

Abstract: Services can be executed on nodes using initial random access memory disk (initrd) schemes. For example, a system can receive, from an orchestrator node, a request to execute a service at a host node. The request can include data indicative of the service, and the host node can include an initrd scheme. The system can determine that the service is available for execution at the host node based on the service being included in the initrd scheme. In response to determining that the service is available, the system can further transmit a notification to the orchestrator node indicating that the service is available for execution at the host node. Additionally, the system can execute the service on the host node as part of executing the initrd scheme.

Abstract: A system includes a memory, a processor in communication with the memory, and a first TEE instance. The first TEE instance is configured to maintain an encrypted secret, obtain a cryptographic measurement associated with a second TEE instance, validate the cryptographic measurement, and provision the second TEE instance with the encrypted secret. Additionally, the first TEE instance and the second TEE instance are both configured to service at least a first type of request.

Abstract: Some examples of the present disclosure relate to executing configuration files generated from specification files. In one particular example, a system can receive a specification file defining functions for an application programming interface (API) associated with a software entity. The system can generate a graph identifying keywords and relationships associated with the functions. The system can generate, based on the graph, a mapping dictionary that maps the functions to tasks usable in an executable file associated with the API. The system can generate the executable file including one or more of the tasks based on the mapping dictionary and execute the executable file to perform operations associated with the API and the software entity at a node.

Abstract: Techniques for peer to peer sharing of files in a mobile environment are provided. In response to meeting a communication parameter of a second device, a processing device may determine whether the second device will maintain the communication parameter with a first device for at least a threshold amount of time. An amount of data that can be transferred between the first and second devices during a transfer window with the second device may be determined. Software manifests of the first and second devices may be compared to determine a set of software of the first device that need to be updated. A number of chunks for a first software of the set of software may be received from the second device, the number of chunks based on the amount of data that can be transferred between the first and second devices during the transfer window.

Abstract: A method includes receiving input data that is used by a machine learning model to generate a first inference. The machine learning model was previously trained using a set of training data. The method also includes generating a set of modified input data based on the input data. The set of modified input data is generated without using the training data. The method further includes obtaining, from an explanation system, an explanation array. The explanation system is to generate the explanation array based on the machine learning model and the set of modified input data.

Abstract: In one example, a system can execute a first version of a software program during a time window. While executing the first version of the software program during the time window, the system can generate a software bill of materials (SBOM) for the software program. The SBOM can identify a dependency relied upon by the first version of the software program during the time window. The system can determine that the dependency has a vulnerability based on a Common Vulnerabilities and Exposures (CVE) record associated with the dependency. The system can then obtain an updated version of the dependency that lacks the vulnerability, generate a second version of the software program using the updated version of the dependency to mitigate the vulnerability, and deploy the second version of the software program. The system may also shut down the first version of the software program.

Abstract: Systems and methods for memory management for nested virtual machines. An example method may comprise running, by a host computer system, a hypervisor managing a first virtual machine; responsive to receiving, by the hypervisor, a request to create a second virtual machine nested within the first virtual machine, determining whether the second virtual machine will be using a physical address as a virtual address for a peripheral device; and responsive to determining that the second virtual machine will be using the physical address as the virtual address for the peripheral device, initializing a first data structure for address translation of the physical addresses of the second virtual machine corresponding to virtual addresses of the peripheral device to a host virtual addresses.

Abstract: A system can be provided for generating efforts to facilitate preparation and execution of software migrations. For example, the system can monitor software applications to generate metadata for the software applications. The system can also receive time-efforts for historical migrations of the software applications. The system can store the metadata and the time-efforts for the software applications in a database. Additionally, the system can receive, from a client device, an effort request associated with a migration of a software application. In response to receiving the effort request, the system can generate an effort for the migration of the software application based at least in part on the metadata and the time-efforts for the software applications. The system can then transmit the effort to the client device as a response to the effort request.

Abstract: Network paths can be selected based on power consumption according to some aspects of the present disclosure. In one example, a system can receive a routing request from user equipment. The system can determine a network paths of a wireless network, where each network path is a route between the user equipment and a service application associated with the routing request. The system can determine a power consumption associated with each network and select a network path for the routing request based on the power consumption associated with each network path. The system can enable the network path between the user equipment and the service application for the routing request.

Abstract: An example method may include generating a block list comprising a plurality of list items, wherein each list item identifies a respective block of a source virtual machine image, and the list items are ordered in the block list according to a timestamp of each respective block, wherein the timestamp indicates a time of a last access of the respective block, sending the block list to a destination computing device, receiving, from the destination computing device, one or more candidate blocks, determining whether the one or more candidate blocks are included in the source virtual machine image, and sending, to the destination computing device, a result indicating whether the one or more candidate blocks are included in the source virtual machine image.

Abstract: A system can be provided for managing computing resource consumption of user loaded software applications using control groups to facilitate safety compliance. For example, the system can detect an interference event between a user application executing within safety management system and a functional safety application executing within the safety management system. In response to detecting the interference event, the system can generate a control group for the user application. The control group can specify a portion of system resources of the safety management system to allocate to the user application. The system can then migrate the user application to the control group to allocate the portion of the system resources to the user application. In doing so, reoccurrence of the interference event can be prevented.

Abstract: Systems, methods, and apparatuses for regulating virtual processing device usage by emulating thermal throttling are provided herein. An example method comprises limiting a processing capacity allocated for a virtual processing device to a value equal to or below a threshold by transmitting, via a hypervisor, an indication to a guest that the virtual processing device has exceeded an operating temperature, wherein the value is below a current processing capacity of a host processing device.

Abstract: A system may comprise a group of processor cores configured to generate kernel-space threads in a kernel space and user-space threads in a user space of a Linux operating system. Each kernel-space thread may be executable by one of the processor cores to perform operations. For example, a kernel-space thread may receive a data packet transmitted from a client device via a network. The kernel-space thread may determine a particular communication channel assigned to a processor core that is executing the kernel-space thread. The kernel-space thread may determine if the data packet satisfies a condition based on information extracted from the data packet. In response to determining that the data packet does not satisfy the condition, the kernel-space thread may transmit data from the data packet via the particular communication channel to a user-space thread. The user-space thread may be configured to receive and process the data.

Abstract: Paravirtual pause loops in guest user space are provided by implementing, by a hypervisor for a virtualization environment, a paravirtual sleep command from a certain virtual machine of a plurality of virtual machines operating in the virtualization environment, the paravirtual sleep command indicating an instruction and a resource that the certain virtual machine is waiting on to perform the instruction; adding an entry to a work queue managed by the hypervisor for the plurality of virtual machines; and in response to the resource becoming available for the certain virtual machine: removing the entry from the work queue; and waking the certain virtual machine to perform the instruction with the resource.