Abstract: A system includes a memory, a processor in communication with the memory, a hypervisor executing on the processor, a pool of hypervisor resources, and a cloud-sharing module (CSM). The CSM runs in a kernel to assign an anonymous identity to a hypervisor resource from the pool of hypervisor resources. The CSM broadcasts a transaction for the hypervisor resource and determines which provider owns the hypervisor resource. A first provider is associated with a second anonymous identity and a second provider is associated with a third anonymous identity. Additionally, the CSM receives mining information that includes a block associated with the transaction, where the block is part of a blockchain. The CSM completes the transaction for the first anonymous identity associated with the hypervisor resource between the second anonymous identity and the third anonymous identity.

Abstract: Database-aware snapshotting is disclosed. It is determined that a first snapshot of a database having a plurality of shards should be taken. Each shard has a corresponding snapshot sidecar container of a plurality of snapshot sidecar containers. A consensus state among the plurality of snapshot sidecar containers that the first snapshot should be taken is determined. A snapshot controller is directed to take the first snapshot of the database, the first snapshot generating a shard volume snapshot for each shard of a plurality of shards. Subsequent to the snapshot controller taking the first snapshot of the database, each snapshot sidecar container is informed to allow activity on the corresponding shard.

Abstract: Network interface provisioning of containerized instances based on tenant policies. A network interface assignment process (NIAP) receives a first request to assign a network interface to a first containerized instance comprising at least one container. The NIAP determines that a first tenant of a plurality of different tenants is associated with the first containerized instance. The NIAP accesses a first network assignment tenant policy (NATP) that corresponds to the first tenant. Based on the first NATP, the NIAP assigns, to the first containerized instance, a first network interface via which the first containerized instance can communicate with other containerized instances associated with the first tenant.

Abstract: A processing device determines a change to one or more parameters at a particular point in time. The one or more parameters describe a computing environment hosting an application. The processing device stores the changed one or more parameters as one or more tags in a set of hierarchical tags. The processing device creates a snapshot of data associated with the computing environment at the particular point in time. The processing device links a data source tag of the snapshot with the one or more tags in the set of hierarchical tags. In response to receiving a request to recreate the application from the particular point in time, the processing device recreates the application from the particular point in time using the one or more tags in the set of hierarchical tags and the snapshot.

Abstract: Methods and systems for storing and injecting bytecode are provided. In one embodiment, a method is provided that includes receiving a first function for execution at a first time and generating a first bytecode based on the first function for use in executing the first function. The first bytecode may then be stored with an identifier of the first function. At a second time after the first time, a second function may be received for execution. The second function may be identified as corresponding to the first function and the first bytecode may be received. The first bytecode may then be injected into a container for execution of the second function.

Abstract: Methods and systems for scaling computing processes within a serverless computing environment are provided. In one embodiment, a method is provided that includes receiving a request to execute a computing process in the serverless computing environment. A first node may be created within the serverless computing environment to execute the computing process. A first amount of computing resources may be assigned to the first node. It may be determined later that the first amount of computing resources are not sufficient to implement the first node. A second amount of computing resources may be determined with a vertical autoscaling process and a second node may be created within the serverless computing environment using a horizontal autoscaling process. The second node may be assigned the second amount of computing resources. The computing process may then be executed using both the first and second nodes within the serverless computing environment.

Abstract: A method includes detecting, by a webhook controller, an inference serverless function invocation. The method further includes determining that the inference serverless function can be optimized. The method further includes generating an optimized version of the inference serverless function using a graph compiler, in response to the determining. The method further includes replacing, by a processing device of the webhook controller, a storage volume in an init container of the inference serverless function with a new storage volume comprising the optimized version of the inference serverless function.

Abstract: A method includes determining whether a code update for the service is available at a central repository of the computing environment and, in response to determining that the code update is available, retrieving the code update from the central repository. The method further includes performing a modification of the service in view of the code update.

Abstract: Scalable object storage with intelligent replication is disclosed. A container image storage system executing on one or more processor devices receives a container image comprising a plurality of objects. For each object, a reference count indicative of how many different container images stored in the container image storage system include the object is determined. For each object, a number of copies of the object to be stored in a storage based on the reference count is determined. For each object, the number of copies of the object are stored in the storage.

Abstract: A container intrusion detection and prevention system includes a memory, a physical processor in communication with the memory, and an image scanner executing on the physical processor. The image scanner scans an image of a container in a container image registry. The container includes an application. The image scanner creates an image tag of the container and a set of generic rules for the container. The image scanner packages the image tag of the container with the set of generic rules to form a tuple and stores the tuple in an application rule registry.

Abstract: Container images can be copied. For example, a computing device can segment a container image into at least two data chunks. The computing device can determine a reference count for a data chunk among the at least two data chunks. The computing device can determine that the reference count for the data chunk is below a threshold value. In response to determining that the reference count for the data chunk is below the threshold value, the computing device can prevent a destination device from being queried about the data chunk prior to transmitting the data chunk to the destination device.

Abstract: Dynamic storage provisioning for nested clusters is disclosed. A hosted cluster (HC) storage provisioner, executing in a hosted cluster that is hosted by an infrastructure cluster (IC), receives a request to dynamically provision a hosted cluster (HC) persistent volume object that is coupled to a physical storage. The HC storage provisioner causes an IC control plane executing on the IC to generate IC volume metadata that is backed by a storage volume on the physical storage. The HC storage provisioner determines that the IC volume metadata has been generated. The HC storage provisioner creates HC volume metadata on the hosted cluster that is linked to the IC volume metadata, the HC volume metadata comprising an HC persistent volume object that represents a persistent volume for use by the hosted cluster that is backed, via the IC volume metadata, by the physical storage.

Abstract: One or more metrics associated with performance of a serverless function chain are received. The one or more metrics are analyzed by a reinforcement learning (RL) model to determine a tuning factor in view of a goal provided to the RL model. The tuning factor is transmitted to a serverless function controller, wherein the serverless function controller is to utilize the tuning factor to tune the serverless function chain.

Abstract: A method performed by a computing system includes detecting that a removable data volume has been attached to the computing system, the removable data volume being identified by a unique label. The method further includes, in response to determining that a portion of the unique label matches a predefined value, invoking a catalog container based on a rule within a first rule database. The method further includes, with the catalog container, obtaining metadata stored on the removable data volume, the metadata including characteristics of a first application associated with a first piece of data that is stored on the removable data volume. The method further includes, with the catalog container, creating an application container having the first application with the characteristics. The method further includes, with the application container, processing the removable data volume.

Abstract: Secure backwards compatible orchestration of isolated guests is disclosed. For example, a current version of an isolated guest orchestrator instantiates an older version of the isolated guest orchestrator in a host as a dependent compute service. An application programming interface request is received. The application programming interface request is determined to be unsupported by the current version of the isolated guest orchestrator. The application programming interface request is sent to the dependent compute service. The application programming interface request is responded to based on a response from the dependent compute service.

Abstract: According to one example, a method includes, with a serverless function infrastructure, associated a routing secret with a function sequence. The method further includes, with a sequence controller of the serverless function infrastructure, appending the routing secret to a header of a request to invoke a first function of the function sequence. The method further includes, with the serverless function infrastructure invoking the first function of the function sequence, in response to authenticating the routing secret in the header of the request. The method further includes, after the first function has been invoked and before the first function completes execution, with a serving controller of the serverless function infrastructure, preloading subsequent functions of the function sequence.

Abstract: A system includes a memory, a processor in communication with the memory, a hypervisor executing on the processor, a pool of hypervisor resources, and a cloud-sharing module (CSM). The CSM runs in a kernel to assign an anonymous identity to a hypervisor resource from the pool of hypervisor resources. The CSM broadcasts a transaction for the hypervisor resource and determines which provider owns the hypervisor resource. A first provider is associated with a second anonymous identity and a second provider is associated with a third anonymous identity. Additionally, the CSM receives mining information that includes a block associated with the transaction, where the block is part of a blockchain. The CSM completes the transaction for the first anonymous identity associated with the hypervisor resource between the second anonymous identity and the third anonymous identity.

Abstract: A method of adjusting a set of resources allocated for a job includes analyzing, by a job tuning module, an intermediate result of a job. Processing the job includes processing a first iteration of a task and a second iteration of the same task. Additionally, the intermediate result is a result of the first iteration of the task, and the job is allocated a first set of resources during processing of the first iteration of the task. The method also includes sending a notification to a scheduler that causes the scheduler to adjust the first set of resources allocated to the job to a second set of resources for processing the second iteration of the task. The job may be allocated the second set of resources during processing of the second iteration of the task.

Abstract: A system for reducing overlay network overhead includes a memory, a processor in communication with the memory, a first container and a second container running on a first host, and a container scheduler executing on the processor. Each of the first container and second container expose a network service port(s). The container scheduler executes on the processor to assign a network complexity weight to the first host. The network complexity weight is based on a quantity of network service ports that the first container and the second container expose. The container scheduler also filters hosts based on resource availability corresponding to each host and ranks the hosts based on a respective network complexity weight corresponding to each host. Additionally, the container scheduler dispatches a third container to a second host based on the resource availability and network complexity weight corresponding to the second host.

Abstract: Flexible deprovisioning of distributed storage is disclosed. For example, an orchestrator executes on a processor to measure a current storage demand factor based on a current count of service guests and a storage capacity of a plurality of storage nodes. A projected storage demand factor is calculated by (i) adjusting the current count of service guests with a timing factor resulting in a projected count, and (ii) combining the projected count with a storage class associated with the service guests. The orchestrator determines that the projected storage demand factor is lower than the current storage demand factor, and in response requests termination of a first storage node of the plurality of storage nodes based on the first storage node lacking an active communication session with the service guests. Cancel termination of the first storage node based on an association between the first storage node and a second storage node.