Abstract: An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment. The containers are configured to utilize storage resources of at least one storage platform. A given one of the containers comprises at least one application, and an application file system security layer configured to communicate with the storage platform. The application file system security layer comprises a container storage volume supported by the storage platform, and an encryption engine configured to encrypt and decrypt data of the container storage volume utilizing one or more data encryption keys that are encrypted under a tenant-specific key encryption key. The tenant-specific key encryption key is provided to the application file system security layer by a tenant key manager that is external to the container. The tenant key manager is illustratively controlled by the tenant for which the given container is implemented.

Abstract: At least one processing device comprises a processor coupled to a memory and implements virtualization infrastructure including a first container comprising a software agent of a locator-identifier separation protocol. The software agent is configured to communicate with a locator-identifier mapping system that associates identifiers of respective endpoints with respective locators in accordance with the locator-identifier separation protocol. The endpoints comprise respective ones of a plurality of additional containers of the virtualization infrastructure. The first container may be coupled to the plurality of additional containers via a bridge element that combines virtual interfaces of respective ones of the additional containers into a single physical network interface.

Abstract: A first virtual network storage function instance associated with a first portion of at least one network is configured to communicate with at least a second virtual network storage function instance associated with a second portion of the at least one network. The first and second virtual network storage function instances collectively comprise at least part of a virtual network storage function layer configured to interact with an underlying storage layer providing access to physical storage comprising a plurality of storage elements. The first and second virtual network storage function instances are configured to implement at least one data service that involves processing data obtained from at least one of the storage elements via at least one of the first and second portions of the at least one network, responsive to analytics performed by at least one of the first and second virtual network storage function instances.

Abstract: An apparatus comprises container host devices each implementing one or more containers, at least one storage platform coupled to the plurality of container host devices and implementing storage resources for utilization by processes running in the containers, and a controller associated with at least a subset of the container host devices and the storage platform. The containers implemented by the container host devices are arranged in container groups and the storage resources implemented by the storage platform are arranged in storage groups. The controller is configured to coordinate establishment of container host resource allocations for one or more of the container groups with establishment of storage resource allocations for one or more of the storage groups.

Abstract: An apparatus comprises at least one container host device implementing containers for respective tenants of a multi-tenant environment, a storage platform coupled to the container host device and implementing storage resources for utilization by the containers, and a container storage controller associated with the container host device. The container storage controller is configured to provision portions of the storage resources for respective ones of the containers including for each of the containers at least one virtual storage volume accessible only to that container and having an associated file system that is not visible to an operating system of the container host device. The provisioned portion of the storage resources for a given one of the containers of a corresponding one of the tenants is thereby isolated from the provisioned portions of the storage resources for respective other ones of the containers of corresponding other ones of the tenants.