Method and apparatus for providing isolated virtual space

摘要

Various embodiments provide a method and apparatus of creating an application isolated virtual space without the need to run multiple OSs. Application isolated virtual spaces are created by an Operating System (OS) utilizing a resource manager. The resource manager isolates applications from each other by re-writing the network stack and the I/O subsystem of the conventional OS kernel to have multiple isolated network stack/virtual I/O views of the physical resources managed by the OS. Isolated network stacks and virtual I/O views identify the resources allocated to an application's isolated virtual space and are mapped to applications via an isolating identifier.

主权项

1. A method for serving a plurality of system call requests in an application isolated virtual space, comprising:
at a processor communicatively coupled to a digital data storage, receiving a first system call request; retrieving, by the processor in cooperation with the digital data storage, a first isolating identifier based on the first system call request, the first isolating identifier corresponding to a first application isolated virtual space; wherein the first application isolated virtual space comprises a first plurality of resources allocated to the first application; and utilizing, by the processor in cooperation with the digital data storage, a first application resource to satisfy a first of the system call requests based on the first isolating identifier; wherein the first plurality of resources comprises the first application resource; receiving, by the processor in cooperation with the digital data storage, a second system call request associated with a second application; retrieving, by the processor in cooperation with the digital data storage, a second isolating identifier based on the second system call request, the second isolating identifier corresponding to a second application isolated virtual space; wherein the second application isolated virtual space comprises a second plurality of resources allocated to the second application; and utilizing, by the processor in cooperation with the digital data storage, a second application resource to satisfy a second of the system call requests based on the second isolating identifier; wherein the second plurality of resources comprises the second application resource.