An electronic apparatus adapted for a container and a software updating method for a running container system are provided. A first software installation package is installed in a host system. The first software installation package includes an executable component used by the host system and a second software installation package. The executable component provides information required by an installation operation of the first software installation package. The second software installation package is made accessible to a container system by the host system based on the executable component. The second software installation package is installed in the container system to update an application in the container system.

Methods, systems, apparatuses, and computer-readable storage mediums described herein enable executable code of a hardware security platform (HSP) circuit to communicate with a hypervisor in a separate processor. The hypervisor generates and manages virtual machines. The HSP code comprises trusted platform module (TPM) logic, that processes TPM commands received via the hypervisor, and in response to the processing, communicates security information (e.g., measurements, keys, authorization data) with the virtual machines via the hypervisor. The TPM logic receives security information related to a virtual machine from the hypervisor and stores the security information in non-volatile memory of the HSP circuit, where security information from a particular VM is distinguishable from security information from another VM in the HSP memory. The hypervisor (and VMs) communicate via a network fabric with the HSP circuit within an SOC, or the HSP may reside on a discrete chip and communicate via a secure encrypted channel.

A method may include receiving, via a first computing node, a first pod from a second computing node. The method may also include retrieving a first image file that may include a first set of containers from a registry based on the first pod. The first set of containers may cause a control system to halt operations. The method may then involve generating a first package based on the first set of containers and storing the first package in a filesystem, receiving a second pod from the second computing node, and retrieving a second image file having a second set of containers from the registry. The second pod may include the second set of containers may cause the control system to update software components. The method may also involve generating a second package based on the second set of containers and storing the second package in the filesystem.

A data management and storage (DMS) cluster of peer DMS nodes manages data of a tenant of a multi-tenant compute infrastructure. The compute infrastructure includes an envoy connecting the DMS cluster to virtual machines of the tenant executing on the compute infrastructure. The envoy provides the DMS cluster with access to the virtual tenant network and the virtual machines of the tenant connected via the virtual tenant network for DMS services such as data fetch jobs to generate snapshots of the virtual machines. The envoy sends the snapshot from the virtual machine to a peer DMS node via the connection for storage within the DMS cluster. The envoy provides the DMS cluster with secure access to authorized tenants of the compute infrastructure while maintaining data isolation of tenants within the compute infrastructure.

The present disclosure provides a method, an apparatus, and a non-transitory computer readable medium for scheduling tasks. The method includes acquiring task information of a current task to be executed, the task information describing the current task to be executed; determining an execution time for the current task to be executed according to the task information; and comparing the execution time with a preset scheduling time corresponding to the current task to be executed, and adjusting an actual scheduling time corresponding to a next task to be executed according to the comparison result so as to determine whether to schedule the next task to be executed

A unique embedded system is disclosed that locally operates an application virtual machine (VM) and a system VM in isolation from each other. The application VM executes application-specific code for a given purpose of the embedded system. The system VM executes a host operating system (OS) and various security, compatibility, and updating functions independent of the application VM. Each VM is connected to its own unique hardware on the embedded system to ensure that changes to the application code or the system code do not impact the other.

A method, apparatus and computer program product for automated security policy synthesis and use in a container environment. In this approach, a binary analysis of a program associated with a container image is carried out within a binary analysis platform. During the binary analysis, the program is micro-executed directly inside the analysis platform to generate a graph that summarizes the program's expected interactions within the run-time container environment. The expected interactions are identified by analysis of one or more system calls and their arguments found during micro-executing the program. Once the graph is created, a security policy is then automatically synthesized from the graph and instantiated into the container environment. The policy embeds at least one system call argument. During run-time monitoring of an event sequence associated with the program executing in the container environment, an action is taken when the event sequence is determined to violate the security policy.

In an approach to virtualizing communication channels between one or more hardware components and a controller, a system includes: a first controller implemented in a reconfigurable hardware device; and a virtual platform stratus having a plurality of input/output (I/O) ports for electrically coupling with the one or more hardware components and receiving one or more electrical signals therefrom, and where the VPS is configured to generate one or more data frames from the one or more electrical signals; and where the virtual platform stratus is configured to send the data frames to the first controller and/or provide electrical signaling to the one or the one or more hardware components based on data frames received from the first controller.

A computer-implemented method for building socket transferring between containers in cloud-native environments by using kernel tracing techniques is provided including probing a connection-relevant system call event by using an eBPF to collect and filter data at a router, creating a mirror call at a host namespace with a dummy server and dummy client by creating the dummy server with mirror listening parameters, sending a server host address mapping to overlay the server host address to the client coordinator in an overlay process, and creating and connecting the dummy client to return a client host address to the server coordinator. The method further includes transferring mirror connections to the overlay process via a forwarder by temporary namespaces entering and injecting socket system calls and probing a transfer call event to map an overlay socket with a transferred dummy socket to activate duplication when the overlay socket is not locked.

Aspects of the subject disclosure may include, for example, identifying a request to install a guest virtual machine on a physical host; identifying a UUID of the physical host; generating a virtual machine reference value; defining a modified UUID of the guest virtual machine comprising the UUID of the physical host and the virtual machine reference value; and assigning the modified UUID to the guest virtual machine, the physical host being identifiable via the modified UUID of the guest virtual machine. Other embodiments are disclosed.