Abstract: Described herein is a system and method for flow state save/restore of a virtual filtering platform. A first instance of a driver manages policy and flow state for ongoing flows between client device(s) and virtual machine(s). The virtual filtering platform is transitioned from the first instance of a driver to a second instance of the driver by serializing the policy and state for the ongoing flows on the first instance of the driver using a one pass algorithm. The serialized policy and state for the ongoing flows can be de-serialized with the ongoing flows re-established and/or reconciled on the second instance of the driver in accordance with the de-serialized policy and state for the plurality of ongoing flows. In some embodiments, a memory management technique can use a single operating system memory allocation call to allocate memory for the transition, with the technique managing utilization of the allocation memory.

Abstract: An example virtualized computing system includes a host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts, the virtualization layer supporting execution of virtual machines (VMs), the VMs including pod VMs, the pod VMs including container engines supporting execution of containers in the pod VMs; and an orchestration control plane integrated with the virtualization layer, the orchestration control plane including a master server configured to manage the pod VMs and first VMs of the VMs. The virtualized computing system further includes a guest cluster executing in the first VMs and managed by the orchestration control plane, the guest cluster including a guest master server configured to, in cooperation with the master server, deploy first pods in the pod VMs.

Abstract: A vehicle system having: a hardware level, a first operating system, and a virtual machine integrated on the hardware level having a second operating system. A hypervisor operates the virtual machine such that the first and the second operating systems) are operated in parallel on the hardware. A first application is executed on the first operating system and a second application is executed on the second operating system. The first application has a higher safety standard than the second application. The second operating system is configured to be operated in suspend-to-RAM mode while the first operating system is switched off.

Abstract: A current display system comprises a plurality of computer blades, interconnected with each other and each hosting a graphics processor and a plurality of virtualized operating systems (OS) run by an hypervisor and sharing said graphics processor. Each computer blade is connected directly to a set of display devices including a part of a plurality of display devices. All computer blades are connected to all the display devices. Each virtualized OS runs a global compositor instance and at least one application. The global compositor instance of a first virtualized OS transmits a graphical output to a display device driven by a second virtualized OS, via the global compositor instance of said second virtualized OS, so that an application content from an application run by said first virtualized OS is displayed on said second display device.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Abstract: Computer systems and methods are disclosed to implement a virtual machine monitor (VMM) that stores cryptographic keys for guest virtual machines (VMs) and securely executes cryptographic operations on the VMs' behalf using the stored cryptographic keys. The cryptographic keys are maintained in a key store that is accessible to the VMM but not accessible to the guest VMs. The cryptographic operations are executed in a manner that does not reveal the cryptographic keys to the guest VMs. In embodiments, the guest VMs may invoke the cryptographic operations via a device driver, a memory access interface, or some other mechanism. Advantageously, the guest VMs cannot obtain the cryptographic keys in their own memory space, so that the keys cannot be exfiltrated from the guest VMs. Embodiments of the VMM may be used to implement cryptographic operations such as request signing and verification, data encryption and decryption, and others.

Abstract: In some examples, a system associates, with a plurality of virtual resources deployed in a cloud environment, properties representative of characteristics of the virtual resources, the properties comprising a performance level of a virtual resource. The system receives a request to create a virtual resource in the cloud environment, and, in response to determining that properties of the virtual resource to be created for the request satisfy a criterion with respect to properties of a given virtual resource of the plurality of virtual resources, selects the given virtual resource as a candidate virtual resource for the request.

Abstract: Techniques perform storage management. In accordance with such techniques, in response to determining that there is an abnormal process in a process group of an application, and a first size of storage space occupied by the abnormal process exceeds a first threshold, an abnormal process is terminated. A second size of storage space occupied by other processes than the abnormal process in the process group after the abnormal process is terminated is determined. In response to the second size exceeding a second threshold, at least one process in the process group to reduce the second size is terminated, where the at least one process is different from the abnormal process.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Abstract: A system and method include reception of a request to create a virtual machine associated with a requested number of resource units of each of a plurality of resource types, determination, for each of the plurality of resource types, of a pool of available resource units, random selection, for each of the plurality of resource types, of the requested number of resource units from the pool of available resource units of the resource type, and allocation of the selected resource units of each of the plurality of resource types to the virtual machine.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Abstract: A computer program stored in a computer readable storage medium is provided. It includes encoded commands, in which when the computer program is executed by one or more processors of a computer system. The computer program allows the one or more processors to perform certain commands for distributing resources of a computing device.

Abstract: The disclosure provides an approach for eliminating issues associated with the use of an L2 extension and ARP calls after migrating a virtual machine from one host to another host. The approach involves placing nodes within a network within their own subnetworks, each subnetwork having an IP address range of one address. Placing nodes into subnets of one avoids intra-subnet forwarding, eliminating the need for ARP calls and for L2 extensions.

Abstract: Apparatus and associated methods relate to constructing a resource and attribute tasking solution to complete a user's objective with resource and attribute characteristics defining the tasked objects, in response to receiving a task definition, and satisfying a task definition constraint. An object includes of a set of resource and attribute dimensions each of which have a set of possible values. A tasking solution is the union of all valid solution vectors in the dimension space. The solution identifies all valid values to present to a user or other agent to make further decisions on further constraining resource and attribute characteristics for a final materializable tasking. In an illustrative example, the objective may be mapping resource supply to task demand. The task demand may be, for example, delivering a database-as-a-service platform configured based on rules generated to satisfy task definition capacity constraints.

Abstract: Described is a system (and method) that provides the ability to create an endpoint to allow cloud-based components to access services directly using network infrastructure of a cloud system. To provide such an ability, access connections from components of a production system to the cloud system may be monitored to derive a storage service and a datastore based on portions of a domain name. The derived storage service and datastore are then used to determine configuration settings required to automatically create a service endpoint. The service endpoint may then be deployed within the cloud system allowing the cloud-based component to access the storage service directly. Accordingly, the system provides the ability to automatically configure and deploy service endpoints by leveraging information derived from monitoring network access connections between a production environment and a cloud environment.

Abstract: Provided is a system for automatically generating a set of parameters that can be used to execute a user application on a cluster of compute instances on behalf of a user, where the set of parameters specifies the one or more container images that need to be executed as part of executing the user application. For example, the user may specify a set of container images that are part of the user application, and the system may automatically determine the parameters that define the computing environment in which the user application is to be executed, such as the resource allocation and networking configuration parameters, without the user having to provide such parameters to the system. These parameters can be packaged into the set of parameters (also referred to herein as a task definition), which can be used in future executions of the user application.

Abstract: A hypervisor on a destination host receives a request to migrate a virtual machine (VM) from a source host to the destination host and determines a total amount of memory associated with the VM on the source host. The hypervisor on the destination host allocates one or more memory pages in a page table on the destination host to satisfy the total amount of memory associated with the VM on the source host, where the one or more memory pages are to be associated with the VM on the destination host. Responsive to determining that the one or more memory pages have been allocated on the destination host, the hypervisor on the destination host initiates migration of the VM from the source host to the destination host.

Abstract: Examples include registering a device driver with an operating system, including registering available hardware offloads. The operating system receives a call to a hardware offload, inserts a binary filter representing the hardware offload into a hardware component and causes the execution of the binary filter by the hardware component when the hardware offload is available, and executes the binary filter in software when the hardware offload is not available.

Abstract: Examples include registering a device driver with an operating system, including registering available hardware offloads. The operating system receives a call to a hardware offload, inserts a binary filter representing the hardware offload into a hardware component and causes the execution of the binary filter by the hardware component when the hardware offload is available, and executes the binary filter in software when the hardware offload is not available.