Abstract: An access control engine can enable a host operating system to propagate a private resource of an isolated virtual environment, such as a container, running on the host operating system outside of the isolated virtual environment. The private resource can include, for example, a file system mounted within the isolated virtual environment. The access control engine can receive a command and launch the isolated virtual environment in response to the command. Also, in response to the command, the access control engine can interface with a kernel of the host operating system to configure the isolated virtual environment so that the private resource is accessible outside the isolated virtual environment.

Abstract: Methods, systems, and computer program products are included for deploying a composite application. A method includes receiving, at a computing device, a container image that includes a nulecule. The nulecule is parsed to identify a first service, a second service, and a parameter of the first service. An input value is received corresponding to the parameter of the first service. A configuration value of the first service is modified to include the input value. The first service and the second service are deployed on the computing device, with the first service being configured with the configuration value.

Abstract: An access control engine can enable a host operating system to propagate a private resource of an isolated virtual environment, such as a container, running on the host operating system outside of the isolated virtual environment. The private resource can include, for example, a file system mounted within the isolated virtual environment. The access control engine can receive a command and launch the isolated virtual environment in response to the command. Also, in response to the command, the access control engine can interface with a kernel of the host operating system to configure the isolated virtual environment so that the private resource is accessible outside the isolated virtual environment.

Abstract: Allocation of access control identifiers to a container can be optimized. For example, a system can determine a largest value for a particular type of access control identifier (ACID) associated with a container image by analyzing content of the container image, the container image being for deploying a container. Next, the system can determine an amount of the particular type of ACID to allocate to the container based on the largest value. The system can then allocate the amount of the particular type of ACID to the container.

Abstract: Some embodiments include a control bypass system for industrial cold storage facilities. In some embodiments, the control bypass system includes a cloud scheduler and a bypass controller. The cloud scheduler may be located in a remote location. The cloud scheduler may create a power draw prescription for one or more items of cold storage equipment at the industrial cold storage facility. The power draw prescription, for example, can include a desired power draw level for one or more items of cold storage equipment at the industrial cold storage facility and the desired power draw level changes over a period of time. The bypass controller can be located at the industrial cold storage facility and receives the power draw prescription from the cloud scheduler, produces an environmental setpoint for the one or more items of equipment, and outputs the environmental setpoint to a device or system controller.

Abstract: A filesystem can be shared between containers. For example, a computing device having a host filesystem can launch a first container from an image file. Launching the first container can include creating an initialization directory for the first container on the host filesystem. The initialization directory can include a filesystem to be shared between containers. Launching the first container can also include creating a first filesystem directory for the first container on the host filesystem and mounting the initialization directory to the first filesystem directory. The computing device can also launch a second container from the image file. Launching the second container can include creating a second filesystem directory for the second container on the host filesystem and mounting the initialization directory to the second filesystem directory to enable the second container to access the filesystem.

Abstract: Some embodiments include electric power demand stabilization methods and systems that may include receiving an indication that a specific controllable device will have a high power draw event; retrieving a power draw profile for the specific controllable device that includes at least a maximum power draw and an event duration; identifying a plurality of low priority controllable devices with a combined power draw that is substantially equal to the maximum power draw of the specific controllable device; and turning off the plurality of low priority controllable devices for a time period substantially equal to the event duration.

Abstract: Some embodiments include electric power demand stabilization methods and systems that may include measuring the power draw of a plurality of controllable devices; determining a rolling average power draw for the plurality of controllable devices over a period of time; measuring an instantaneous power draw of the plurality of controllable devices; and calculating a power budget comprising the difference between the instantaneous power draw and the rolling average power draw. In the event the power budget is positive, increasing power to at least a first subset of the plurality of controllable devices. In the event the power budget is negative, decreasing power to at least a second subset of the plurality of controllable devices.

Abstract: Some embodiments include electric power demand stabilization methods and systems that may include measuring the power draw of a plurality of controllable devices; determining a rolling average power draw for the plurality of controllable devices over a period of time; measuring an instantaneous power draw of the plurality of controllable devices; and calculating a power budget comprising the difference between the instantaneous power draw and the rolling average power draw. In the event the power budget is positive, increasing power to at least a first subset of the plurality of controllable devices. In the event the power budget is negative, decreasing power to at least a second subset of the plurality of controllable devices.

Abstract: A filesystem can be shared between containers. For example, a computing device having a host filesystem can launch a first container from an image file. Launching the first container can include creating an initialization directory for the first container on the host filesystem. The initialization directory can include a filesystem to be shared between containers. Launching the first container can also include creating a first filesystem directory for the first container on the host filesystem and mounting the initialization directory to the first filesystem directory. The computing device can also launch a second container from the image file. Launching the second container can include creating a second filesystem directory for the second container on the host filesystem and mounting the initialization directory to the second filesystem directory to enable the second container to access the filesystem.

Abstract: Apparatus and method for a multi-frequency vertex shader. For example, one embodiment of a graphics processing apparatus comprises a plurality of vertex caches to store vertex data associated with graphics primitives; and graphics execution circuitry to execute vertex shaders operable at different processing rates for different sets of the vertex data, each of the different sets of vertex data to having a different type of identifier associated therewith to identify the vertex data.

Abstract: A particle counter and classification system and method wherein a first stage magnetometer sensor subsystem for the fluid is tuned to detect and determine the size of ferrous and/or conducting particles in the fluid above a predetermined size. A pump is configured to drive a volume of the fluid through the first stage magnetometer sensor subsystem. A processing subsystem is responsive to the first stage magnetometer sensor subsystem and is configured to count the number of ferrous and/or conducting particles above the predetermined size based on the output of the first stage magnetometer sensor subsystem and to determine and report the concentration of the ferrous and/or conducting particles above the predetermined size as a function of the size of the particles, their number, and the volume of the fluid.

Abstract: An example method of installing one or more files on a host file system includes extracting, by an operating system, a container image from a container. The container image stores a set of files and provides an indication of a hierarchical structure for the set of files. The method also includes obtaining, by the operating system, a package in accordance with the container image. The package includes the set of files. The method further includes installing the package on the host file system in accordance with the hierarchical structure for the set of files.

Abstract: Systems and methods for industrial process control coordination and implementation are disclosed. In some embodiments, a facility coordinator may be configured to: receive a facility prescription from a remote server; translate the facility prescription into one or more commands understood by one or more of a plurality of controllable devices; communicate the one or more commands to the one or more controllable devices; receive sensor data from one or more of a plurality of environmental sensors; determine based on the sensor data whether an aspect of an environment or one or more of the controllable devices violates one or more constraints; and in the event operational, safety, or physical constraints are or will soon be violated, determine a corrective action and send corrective action commands to one or more of the plurality controllable devices.

Abstract: Apparatus and method for a multi-frequency vertex shader. For example, one embodiment of a graphics processing apparatus comprises a plurality of vertex caches to store vertex data associated with graphics primitives; and graphics execution circuitry to execute vertex shaders operable at different processing rates for different sets of the vertex data, each of the different sets of vertex data to having a different type of identifier associated therewith to identify the vertex data.

Abstract: An implementation of this disclosure provides a system comprising memory to store a plurality of layers and a processing device coupled to that memory to set up the layers and to mount them into an overlay. The layers comprise an upper and one or more lower layers. The overlay provides access to a plurality files stored in the overlay filesystem. A request from an application to access a file in the mounted overlay is received. An access policy for the mounter that mounted the layers is identified in view of the mounter's credentials. The processing device checks, in view of the access policy, whether a security context label for the file provides access to the application and to the mounter of the overlay in at least one lower layer comprising the file. An instruction to provide the application with access to the file is issued in view of the check.

Abstract: An example method of installing one or more files on a host file system includes extracting, by an operating system, a container image from a container. The container image stores a set of files and provides an indication of a hierarchical structure for the set of files. The method also includes obtaining, by the operating system, a package in accordance with the container image. The package includes the set of files. The method further includes installing the package on the host file system in accordance with the hierarchical structure for the set of files.

Abstract: Systems and methods for industrial process control coordination and implementation are disclosed. In some embodiments, a facility coordinator may be configured to: receive a facility prescription from a remote server; translate the facility prescription into one or more commands understood by one or more of a plurality of controllable devices; communicate the one or more commands to the one or more controllable devices; receive sensor data from one or more of a plurality of environmental sensors; determine based on the sensor data whether an aspect of an environment or one or more of the controllable devices violates one or more constraints; and in the event operational, safety, or physical constraints are or will soon be violated, determine a corrective action and send corrective action commands to one or more of the plurality controllable devices.

Abstract: An example method of installing one or more files on a host file system includes extracting, by an operating system, a container image from a container. The container image stores a set of files and provides an indication of a hierarchical structure for the set of files. The method also includes obtaining, by the operating system, a package in accordance with the container image. The package includes the set of files. The method further includes installing the package on the host file system in accordance with the hierarchical structure for the set of files.

Abstract: Systems and methods are disclosed for facilitating collaboration amongst individuals working on a coordinated campaign toward certain goals. In furtherance of these goals, the individual team members use technical resources provided by specialized tools, which are also sometimes referred to as applications or products. As the campaign progresses, these applications generate a large volume of data, some of which may be useful to teams other than those which were originally responsible for producing the data. In certain embodiments a campaign manager platform is used to facilitate data sharing and collaboration amongst the various teams that comprise a campaign. In such embodiments the individual team members interact not only with the applications specifically adapted for their team, but also with the campaign manager, which provides a medium for exchanging data and ideas with other teams.