Abstract: Described herein are technologies that provide an element of security related to file system operations. Individual nodes in a file system, such as a directory or a file, can be associated with information that describes how to handle letter case when a file name included in a file system operation request is used to locate a file in the file system. For example, a case sensitive designation associated with a directory can require a case sensitive match between a file name included in a request and a file name included in the directory, in order to perform the requested file system operation. In another example, a case preferring designation associated with a directory first checks for a case sensitive match between file names. If a case sensitive match does not exist, then a case insensitive match between the file names can be used to perform the requested file system operation.

Abstract: Using metadata for a contentless file to provide a guest context access to file content. Within a guest context, a file system is mounted from a container image which lacks a first file's content and which includes metadata defining properties of the first file and mapping data defining information for identifying a second file within another filesystem from which the first file's content is obtainable Based on the properties, a filesystem operation involving the first file is performed without switching to a host context, and a requested access to the first file's content is responded to. Responding includes, based on the mapping data, communicating a request for the host context to supply the first file's content and, after returning from a context switch, responding to the requested access by supplying content of the second file from guest memory page(s) which are mapped to host memory page(s) containing the second file's content.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Abstract: Described herein are technologies that provide an element of security related to file system operations. Individual nodes in a file system, such as a directory or a file, can be associated with information that describes how to handle letter case when a file name included in a file system operation request is used to locate a file in the file system. For example, a case sensitive designation associated with a directory can require a case sensitive match between a file name included in a request and a file name included in the directory, in order to perform the requested file system operation. In another example, a case preferring designation associated with a directory first checks for a case sensitive match between file names. If a case sensitive match does not exist, then a case insensitive match between the file names can be used to perform the requested file system operation.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e., composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a container engine interface supports creating, mounting, and providing access to and from composite images or composite containers. In operation, a plurality of files for generating a composite image are accessed. The composite image for the plurality of files is generated. The composite image includes a set of common flat files. The composite image is communicated to cause mounting of the composite image, where mounting the composite image is based on a metadata file from the set of common flat files.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations to support resource isolation and operating system (OS) virtualization functionality. In particular, a layout manager operates with a composite engine interface to support generating composite images with optimized configurations (i.e., pre-alignment and pre-computed hashes of for executable files). In operation, a plurality of files for generating a composite image are accessed.

Abstract: Methods, systems, and computer storage media for providing a set of common flat files in a composite image that can be mounted as a container (i.e. composite container) to support isolation and interoperation of computing resources. Container management is provided for a container management system based on a composite image file system engine that executes composite operations. In particular, a remote sharing manager operates with a composite engine interface to support generating composite images configured for split layer memory sharing, split layer direct access memory sharing, and dynamic base images. In operation, a plurality of files and a selection of a remote sharing configuration for generating a composite image are accessed. The composite image for the plurality of files and the remoting sharing configuration is generated. The composite image is communicated to cause sharing of the composite image, sharing of the composite image is based on the remote sharing configuration.

Abstract: Described herein are technologies that provide an element of security related to file system operations. Individual nodes in a file system, such as a directory or a file, can be associated with information that describes how to handle letter case when a file name included in a file system operation request is used to locate a file in the file system. For example, a case sensitive designation associated with a directory can require a case sensitive match between a file name included in a request and a file name included in the directory, in order to perform the requested file system operation. In another example, a case preferring designation associated with a directory first checks for a case sensitive match between file names. If a case sensitive match does not exist, then a case insensitive match between the file names can be used to perform the requested file system operation.

Abstract: The techniques described herein enable client APIs to be deployed within isolated computing environments while externally exposing and/or maintaining a log of computing events that the client APIs perform and/or attempt to perform within the isolated computing environments. Generally described, configurations disclosed herein enable audit parameters associated with client application programming interfaces (APIs) to be deployed within an isolated computing environment to generate a log of computing events performed by the client APIs. Ultimately, access to the log of computing events is provided externally to the isolated computing environment without exposing sensitive computing resources (e.g., a host operating system (OS)) to the various client APIs.

Abstract: A computer system maintains identifiers that identify changed blocks of virtual machine (VM) storage. The computer system accesses a stable VM checkpoint comprising a restorable VM image at a time, and that stores a representation of data of at least one block as it existed at the time. The computer system converts the checkpoint to a reference point. Reference point information is transferable with the VM, such that if the VM is moved to a different computing system, any data identified by the reference point is recoverable. The conversion includes querying the storage to determine an identifier corresponding to the block of the checkpoint at the time, storing this identifier as a part of the reference point, and releasing the representation of the data of the block from the checkpoint. The computer system then uses the reference point to identify changes in the blocks of the storage since the time.

Abstract: A computer system maintains identifiers that identify changed blocks of virtual machine (VM) storage. The computer system accesses a stable VM checkpoint comprising a restorable VM image at a time, and that stores a representation of data of at least one block as it existed at the time. The computer system converts the checkpoint to a reference point. Reference point information is transferable with the VM, such that if the VM is moved to a different computing system, any data identified by the reference point is recoverable. The conversion includes querying the storage to determine an identifier corresponding to the block of the checkpoint at the time, storing this identifier as a part of the reference point, and releasing the representation of the data of the block from the checkpoint. The computer system then uses the reference point to identify changes in the blocks of the storage since the time.

Abstract: Embodiments are directed to establishing efficient virtual machine reference points and to specifying a virtual machine reference point to query incremental changes. In one scenario, a computer system accesses a stable virtual machine checkpoint that includes portions of underlying data stored in data storage, where the checkpoint is associated with a specific point in time. The computer system then queries the data storage to determine data storage identifiers that reference the point in time associated with the checkpoint and stores the determined data storage identifiers as a virtual machine reference point, where each subsequent change to the data storage results in an update to the data storage identifier, so that virtual machine reference point is usable to identify incremental changes from specific points in time on.

Abstract: Embodiments are directed to establishing efficient virtual machine reference points and to specifying a virtual machine reference point to query incremental changes. In one scenario, a computer system accesses a stable virtual machine checkpoint that includes portions of underlying data stored in data storage, where the checkpoint is associated with a specific point in time. The computer system then queries the data storage to determine data storage identifiers that reference the point in time associated with the checkpoint and stores the determined data storage identifiers as a virtual machine reference point, where each subsequent change to the data storage results in an update to the data storage identifier, so that virtual machine reference point is usable to identify incremental changes from specific points in time on.