Abstract: A workflow is expressed as an arrangement of a set of executable tile. In some embodiments, the tiles include operations expressed in different programming languages. A tile can include a declarative specification of datatypes so that external agents, e.g., workflow services, can identify the datatypes and schemas required as arguments and produced as result; this simplifies the defining of a workflow, e.g., by a workflow coder. A tile can have zero, one, or plural user interfaces; selection of a user interface from plural user interfaces can be based on a user selection, on user roles, or on tile lifecycle stage. Workflow services can communicate with each other so that workflows can be distributed and shifted among processor nodes.

Abstract: One or more embodiments provide techniques for migrating a virtual machine (VM) from a private data center to a cloud data center. A hybridity manager receives a request at the cloud data center to replicate a VM from the private data center on the cloud data center. The hybridity manager identifies a source network associated with the VM. The hybridity manager identifies whether there exists a stretched network associated with the source network of the VM. Responsive to determining that there is a stretched network associated with the source network of the VM, the hybridity manager replicates the VM on the stretched network without reconfiguring internet-protocol (IP) settings of the VM.

Abstract: User interface virtualization describes a technique for providing a user with access to a web application from a computing device, while translating the ergonomics of the web application's user interface style into the ergonomics of the computer device's. A proxy agent exchanges metadata and input events with a corresponding client running on a client device that accepts a “touch and swipe” style input. The proxy agent parses web content, such as markup documents and scripting code, that makes the presentation tier of the web application. The client constructs and displays native graphical user interface elements at the client device that are virtual representations of a corresponding user interface element of the web application.

Abstract: An example method is provided for a computing device to perform access control for a user account. The method may include receiving a request for the user account to access a resource, wherein the resource is accessible via the computing device, and determining a permission set required to access the resource. The method may further include performing a bidirectional search to determine whether the user account is assigned to the permission set, the bidirectional search including a first search and a second search. In response to determination that the user account is included in a nested group membership that assigns the user account to the permission set based on the bidirectional search, the method may include permitting the user account to access the resource using the permission set.

Abstract: A number of hosts in a logical cluster is adjusted up or down in an elastic manner by tracking membership of hosts in the cluster using a first data structure and tracking membership of hosts in a spare pool using a second data structure, and upon determining that a triggering condition for adding another host is met and that all hosts in the cluster are being used, selecting a host from the spare pool, and programmatically adding an identifier of the selected host to the first data structure and programmatically deleting the identifier of the selected host from the second data structure.

Abstract: A host computer has a virtualization software that supports execution of a plurality of virtual machines, where the virtualization software includes a virtual machine monitor for each of the virtual machines, and where each virtual machine monitor emulates a virtual central processing unit (CPU) for a corresponding virtual machine. A virtual machine monitor halts execution of a virtual CPU of a virtual machine by receiving a first halt instruction from a corresponding virtual machine and determining whether the virtual machine is latency sensitive. If the virtual machine is latency sensitive, then a second halt instruction is issued from the virtual machine monitor to halt a physical CPU on which the virtual CPU executes. If the virtual machine is not latency sensitive, then a system call to a kernel executing on the host computer is executed to indicate to the kernel that the virtual CPU is in an idle state.

Abstract: A computer system that employs a solid-state memory device as a physical storage resource includes a hypervisor that is capable of supporting TRIM commands issued by virtual machines running in the computer system. When a virtual machine issues a TRIM command to its corresponding virtual storage device to invalidate data stored therein, the TRIM command is received at an interface layer in the hypervisor that translates the TRIM command to a SCSI command known as UMMAP. A SCSI virtualization layer converts the UNMAP command to a file system command to delete portions of the virtual storage device that is maintained as a file in the hypervisor's file system. Upon receiving the delete commands, the hypervisor's file system driver generates a TRIM command to invalidate the data stored in the solid-state memory device at locations corresponding to the portions of the file that are to be deleted.

Abstract: A method for scheduling computing resources with container migration includes determining a resource availability for one or more hosts, a resource allocation for one or more virtual machines (VMs), and a resource usage for one or more containers. The method includes identifying the hosts on which VMs and containers can be consolidated based on resource availability. The method also includes calculating a target resource configuration for one or more VMs. The method further includes removing or adding resources to the VMs for which a target resource configuration was calculated to achieve the target resource configuration. The method further includes allocating the one or more VMs on the one or more hosts based on the resource availability of the one or more hosts, and allocating the one or more containers on the one or more VMs based on the resource configuration of each VM and the resource usage of each container.

Abstract: The disclosure herein describes an edge device of a network for distributed policy enforcement. During operation, the edge device receives an initial packet for an outgoing traffic flow, and identifies a policy being triggered by the initial packet. The edge device performs a reverse lookup to identify at least an intermediate node that is previously traversed by the initial packet and traffic parameters associated with the initial packet at the identified intermediate node. The edge device translates the policy based on the traffic parameters at the intermediate node, and forwards the translated policy to the intermediate node, thus facilitating the intermediate node in applying the policy to the traffic flow.

Abstract: Techniques for dynamic configuration of a load balancer in a virtual network environment are described. In one example embodiment, load balancing rules are configured using virtual machine (VM) inventory objects. The configured load balancing rules are then transformed by replacing the VM inventory objects in the configured load balancing rules with associated Internet protocol (IP) addresses using an IP address management (IPAM) table or a network address translation (NAT) table. The transformed load balancing rules are then sent to the load balancer for load balancing network traffic between a plurality of VMs running on one or more host computing systems in one or more computing networks.

Abstract: Network bandwidth is allocated to virtual machines (VMs) according to a node hierarchy that includes a root node, intermediate nodes, and leaf nodes, wherein each leaf node represents a queue of packet transmission requests from a VM and each intermediate node represents a grouping of leaf queues. As VMs generate requests to transmit packets over the network, the network bandwidth is allocated by queuing packets for transmission in the leaf nodes, and selecting a leaf node from which a packet is to be transmitted based on tracking data that represent how much network bandwidth has been allocated to the nodes. Upon selecting the leaf node, the tracking data of the selected leaf node and the tracking data of an intermediate node that is a parent node of the selected leaf node are updated, and a command to transmit the packet of the selected leaf node is issued.

Abstract: A computer system that employs a solid-state memory device as a physical storage resource includes a hypervisor that is capable of supporting TRIM commands issued by virtual machines running in the computer system. When a virtual machine issues a TRIM command to its corresponding virtual storage device to invalidate data stored therein, the TRIM command is received at an interface layer in the hypervisor that translates the TRIM command to a SCSI command known as UMMAP. A SCSI virtualization layer converts the UNMAP command to a file system command to delete portions of the virtual storage device that is maintained as a file in the hypervisor's file system. Upon receiving the delete commands, the hypervisor's file system driver generates a TRIM command to invalidate the data stored in the solid-state memory device at locations corresponding to the portions of the file that are to be deleted.

Abstract: A framework for converting between copy-on-write (COW) and redo-based technologies is disclosed. To take a virtual disk snapshot, disk descriptor files, which include metadata information about data stored in virtual volumes (vvols), are “swizzled” such that the descriptor file for a latest redo log, to which IOs are currently performed, points to the base vvol of a COW-based vvol hierarchy. A disk descriptor file previously associated with the base vvol may also be updated to point to the vvol newly created by the snapshot operation. To revert to an earlier disk state, a snapshot may be taken before copying contents of a snapshot vvol of the COW-based vvol hierarchy to a base vvol of the hierarchy, thereby ensuring that the reversion can be rolled back if it is unsuccessful. Reference counting is performed to ensure that vvols in the vvol hierarchy are not orphaned in delete and revert use cases.

Abstract: One embodiment of the present invention is a method for a virtual machine to access data from a virtual device, the method including: (a) attaching the virtual device to the virtual machine with a backing store that is a virtual image of a file system conforming to a predetermined file system format, wherein: (i) file system data is stored in one or more files, (ii) the virtual image includes metadata stored apart from the file system data, which metadata corresponds to the predetermined file system format, (iii) the metadata includes one or more directory records, and (iv) the one or more directory records include information that points directly or indirectly to the file system data; (b) issuing a read request for a block of data from the file system as if stored in the predetermined file system format; (c) accessing the metadata and determining the location of the requested block of data in the file system data; and (d) retrieving the requested block of data from the file system data.

Abstract: In a virtual machine, swap activities of a hypervisor and a guest OS are reconciled so that redundant input-output operations (IOs) can be avoided and a synchronous response time of the virtual machine improved. This is achieved with a map of memory pages to blocks of storage. For a write IO to write contents of a memory page into a target block, the map is examined to see if it contains a valid entry for the memory page. If the map contains the valid entry, the write IO is prevented from being issued and a data structure is updated so that subsequent IOs to the target block is redirected from the target block to a block that is associated with the physical memory page in the valid entry. On the other hand, if the map does not contain the valid entry, the write IO is issued.

Abstract: A user instruction communicated over a communications network via a first communication channel to a relying entity for action, is confirmed by having a trusted entity receive verification information corresponding to the communicated user instruction from the user over the network via a second communication channel and/or verification information corresponding to a received user instruction from the relying entity via a third communication channel. If verification information is received from only the user, it is communicated to the relying entity. If from both, the trusted entity verifies the received user instruction based on the received verification information. If from only the relying entity, it is communicated to the user.

Abstract: An architecture and system are described that provide a unified file access service within in a managed computing environment composed of diverse networks, computing devices, and storage devices. The service provides mechanisms for remotely accessing the file systems of any managed computer or disk snapshot, independently of the computer's current state (powered on, suspended or powered off), its location within the environment, its hardware type (virtual vs. physical), its operating system type, and its file system formats. The system isolates centralized FPAs from the details of clients, proxies and storage elements by providing a service that decomposes offloaded file system access into two steps. A FPA or a requester acting on behalf of the FPA first expresses the disk set or the computer containing the file systems it wishes to access, along with requirements and preferences about the access method.

Abstract: A virtual computer system including multiple virtual machines (VMs) is implemented in a single physical computer system. The multiple VMs have their own layer 2 and layer 3 addresses, but they share a common network connection for which only a single layer 2 address may be used, such as in the case of a standard wireless network interface card (NIC) or in the case of multiple NICs and a standard NIC teaming solution. For outgoing data frames from a VM to a network entity outside the virtual computer system, the layer 2 address of the VM contained in the source address field is generally replaced with the layer 2 address of the network connection. For incoming data frames from a network entity to a VM, the layer 2 address of the network connection contained in the destination address field is generally replaced with the layer 2 address of the VM.