Abstract: A system for reducing overlay network overhead includes a memory, a processor in communication with the memory, a first container and a second container running on a first host, and a container scheduler executing on the processor. Each of the first container and second container expose a network service port(s). The container scheduler executes on the processor to assign a network complexity weight to the first host. The network complexity weight is based on a quantity of network service ports that the first container and the second container expose. The container scheduler also filters hosts based on resource availability corresponding to each host and ranks the hosts based on a respective network complexity weight corresponding to each host. Additionally, the container scheduler dispatches a third container to a second host based on the resource availability and network complexity weight corresponding to the second host.

Abstract: Flexible deprovisioning of distributed storage is disclosed. For example, an orchestrator executes on a processor to measure a current storage demand factor based on a current count of service guests and a storage capacity of a plurality of storage nodes. A projected storage demand factor is calculated by (i) adjusting the current count of service guests with a timing factor resulting in a projected count, and (ii) combining the projected count with a storage class associated with the service guests. The orchestrator determines that the projected storage demand factor is lower than the current storage demand factor, and in response requests termination of a first storage node of the plurality of storage nodes based on the first storage node lacking an active communication session with the service guests. Cancel termination of the first storage node based on an association between the first storage node and a second storage node.

Abstract: An example system includes a memory, one or more processors in communication with the memory, and a container image generator. The container image generator receives a first set of information. The container image generator receives a second set of information, including secure information that requires validation to be accessed. The container image generator generates a first container layer, including a first URL associated with the first set of information. The container image generator generates a second container layer, including a second URL associated with the second set of information. The container image generator stores the first container layer and the second container layer at a storage location.

Abstract: Methods and systems for detecting and responding to fabricated or unauthorized events received by serverless computing environments are provided. In one embodiment the method is provided that includes receiving an event from an event source external to the serverless computing environment for execution by function. The method may then include creating a message that includes the events and signing the message with an identifier of the event source. The message may then be received at the function and the identifier of the event source may be validated. The event may then be executed with the function of the serverless computing environment if the identifier of the event sources successfully validated. However, if the identifier of the event source is not successfully validated, execution of the event with the function may be prevented.

Abstract: One exemplary system described herein can detect a first request associated with invoking a serverless function in a sequence of serverless functions. In response, the system can deploy a primary container and a secondary container in a cloud computing environment. The primary container can execute the serverless function and transmit a second request for invoking a second serverless function in the sequence. The secondary container can intercept the second request and generate a modified second request. The secondary container can then transmit the modified second request to a destination other than an endpoint of the second serverless function, where the destination can cause the second serverless function to be executed in response to receiving the modified second request.

Abstract: Container images can be copied. For example, a computing device can segment a container image into at least two data chunks. The computing device can determine a reference count for a data chunk among the at least two data chunks. The computing device can determine that the reference count for the data chunk is below a threshold value. In response to determining that the reference count for the data chunk is below the threshold value, the computing device can prevent a destination device from being queried about the data chunk prior to transmitting the data chunk to the destination device.

Abstract: An implementation of the disclosure provides a method including identifying, by a processing device, a plurality of transactions in a transaction queue within a cloud computing environment, each of the transactions comprising an operation associated with a storage device of the cloud computing environment, comparing a priority status of at least one operation comprised by the transaction queue with a status threshold level associated with the snapshot policy, and responsive to determining that the priority status of at least one operation meets the status threshold level, providing, by the processing device subsequent to an execution of the at least one operation, a request to generate a point-in-time snapshot of at least a portion of the storage device, the point-in-time snapshot comprising state information corresponding to an application in the storage device.

Abstract: A method includes creating an application instance that corresponds to a client, creating a partition on the cloud storage device, the partition corresponding to the client, and associating attributes with the partition. The attributes include a client identifier corresponding to the client, a service-level objective corresponding to the client, and an application identifier corresponding to the application instance. The method further includes receiving a request from the application instance to access the partition and accessing, in response to the request, the attributes corresponding to the partition. The method further includes ordering the request in a data structure relative to one or more other requests, the ordering based on at least one attribute of the attributes, an order in which the request was submitted, and a latency sensitivity of the application instance. The method further includes dispatching the request from the data structure in an order corresponding to the ordering.

Abstract: Requests for data can be distributed among servers based on indicators of intent to access the data. For example, a kernel of a client device can receive a message from a software application. The message can indicate that the software application intends to access data at a future point in time. The kernel can transmit an electronic communication associated with the message to multiple servers. The kernel can receive a response to the electronic communication from a server of the multiple servers. Based on the response and prior to receiving a future request for the data from the software application, the kernel can select the server from among the multiple servers as a destination for the future request for the data.

Abstract: A first command is received from a workload, by a host system executing a nested container storage interface (CSI) driver, to create a persistent volume. The nested CSI driver converts the first command used by the workload to create the persistent volume to a second command used by the host system to increase a capacity of a previously generated persistent volume allocated to the workload. The second command is transmitted to an undercluster CSI driver of the host system, wherein the second command causes the undercluster CSI driver to increase the capacity of the previously generated persistent volume.

Abstract: A method includes determining a first upload start timestamp and a first upload end timestamp of a video file from a client device to an object storage device. The method further includes monitoring an upload of the video file from the object storage device to a server-less framework to determine a second upload start timestamp and a second upload end timestamp of the video file. The method further includes determining, by a processing device, a latency of the upload in view of the first upload timestamp, the second upload timestamp, the first upload end timestamp, and the second upload end timestamp. The method further includes providing a latency adjustment instruction to the client device in view of the latency.

Abstract: Disclosed systems and methods initiate an instance of an isolated application on a node computing device. The systems determine that the isolated application requests exclusive access to a block storage resource, create a control group associated with the block storage resource to provide access to members of the control group and set an access rate limit to zero for non-members of the control group, and assig the isolated application to the control group.

Abstract: A system for reducing overlay network overhead includes a memory, a processor in communication with the memory, a first container and a second container running on a first host, and a container scheduler executing on the processor. Each of the first container and second container expose a network service port(s). The container scheduler executes on the processor to assign a network complexity weight to the first host. The network complexity weight is based on a quantity of network service ports that the first container and the second container expose. The container scheduler also filters hosts based on resource availability corresponding to each host and ranks the hosts based on a respective network complexity weight corresponding to each host. Additionally, the container scheduler dispatches a third container to a second host based on the resource availability and network complexity weight corresponding to the second host.

Abstract: A system and method of serverless function scaling is described. The method may include receiving one or more types of serverless function invocations. The method also includes invoking one or more serverless functions and receiving metrics from the one or more serverless functions. The method also includes generating scaling heuristics for scaling of a number of serverless functions in view of the received metrics.

Abstract: An example method for data auditing for object storage public clouds includes a service broker receiving a request to store data in public object storage, where the request includes user information or a container image. The service broker, based on either the user information or the container image, determines that data auditing is necessary. The service broker creates a storage unit, in public object storage, and a storage proxy. The method further includes the storage proxy storing data, and a data auditor retrieving data from the storage proxy. The data auditor determines a data qualification for the data, and notifies the storage proxy of the data qualification.

Abstract: Methods and systems for detecting and responding to fabricated or unauthorized events received by serverless computing environments are provided. In one embodiment the method is provided that includes receiving an event from an event source external to the serverless computing environment for execution by function. The method may then include creating a message that includes the events and signing the message with an identifier of the event source. The message may then be received at the function and the identifier of the event source may be validated. The event may then be executed with the function of the serverless computing environment if the identifier of the event sources successfully validated. However, if the identifier of the event source is not successfully validated, execution of the event with the function may be prevented.

Abstract: Flexible deprovisioning of distributed storage is disclosed. For example, an orchestrator executes on a processor to measure a current storage demand factor based on a current count of service guests and a storage capacity of a plurality of storage nodes. A projected storage demand factor is calculated by (i) adjusting the current count of service guests with a timing factor resulting in a projected count, and (ii) combining the projected count with a storage class associated with the service guests. The orchestrator determines that the projected storage demand factor is lower than the current storage demand factor, and in response requests termination of a first storage node of the plurality of storage nodes based on the first storage node lacking an active communication session with the service guests. Cancel termination of the first storage node based on an association between the first storage node and a second storage node.

Abstract: Systems and methods for inter-cluster deployment of compute services using federated operator components are generally described. In some examples, a first request to deploy a compute service may be received by a federated operator component. In various examples, the federated operator component may send a second request to provision a first compute resource for the compute service to a first cluster of compute nodes. In various examples, the first cluster of compute nodes may be associated with a first hierarchical level of a computing network. In some examples, the federated operator component may send a third request to provision a second compute resource for the compute service to a second cluster of compute nodes. The second cluster of compute nodes may be associated with a second hierarchical level of the computing network that is different from the first hierarchical level.

Abstract: An access control engine can enable a host operating system to propagate a private resource of an isolated virtual environment, such as a container, running on the host operating system outside of the isolated virtual environment. The private resource can include, for example, a file system mounted within the isolated virtual environment. The access control engine can receive a command and launch the isolated virtual environment in response to the command. Also, in response to the command, the access control engine can interface with a kernel of the host operating system to configure the isolated virtual environment so that the private resource is accessible outside the isolated virtual environment.

Abstract: Software performance can be automatically managed in a distributed computing environment. In one example, a system that can receive metrics information describing resource usage by a first instance of a service in a distributed computing environment. The system can also determine a quality-of-service (QoS) constraint for the service. The system can then modify a definition file based on the metrics information and the QoS constraint, the definition file being configured for deploying instances of the service in the distributed computing environment. The system can deploy a second instance of the service in the distributed computing environment using the modified definition file. As a result, the second instance can more closely satisfy the QoS constraint than the first instance.