Dynamically provisioning peripherals to containers
Peripherals may be dynamically provisioned to containers. A peripheral arbitrator may be run in the host operating system environment to detect when containers are started. When a container is started, the peripheral arbitrator may determine which peripherals an application running in the container may use or require. The peripheral arbitrator may then identify any available peripherals matching the application's peripheral requirements and provision the peripherals to the container to thereby make the peripherals accessible to the application. In some instances, the peripheral arbitrator may use a trust score to determine whether to provision available peripherals to a container.
1. A method for dynamically provisioning a peripheral to a container, the method comprising:
identifying a first container on a computing device;
determining peripheral requirements of a first application running in the first container including determining that the first application has registered for peripheral removal notifications;
determining that a first peripheral available on the computing device matches the peripheral requirements of the first application;
based on determining that the first application has registered for peripheral removal notifications, provisioning the first peripheral to the first container at the function level;
identifying a second container on the computing device;
determining peripheral requirements of a second application running in the second container including determining that the second application has registered for peripheral removal notifications;
determining that the first peripheral matches the peripheral requirements of the second application; and
based on determining that the second application has registered for peripheral removal notifications, provisioning the first peripheral to the second container at the function level such that the first peripheral is simultaneously accessible to the first application running in the first container and the second application running in the second container.
2. The method of claim 1 , wherein identifying the first container on the computing device comprises receiving a notification that the first container has been started or created on the computing device.
3. The method of claim 1 , wherein identifying the first container on the computing device comprises receiving container information from a container agent running in the container.
4. The method of claim 3 , wherein the container information includes an identification of the first application running in the first container.
5. The method of claim 1 , wherein determining the peripheral requirements of the first application running in the first container comprises accessing a peripheral list.
6. The method of claim 5 , wherein accessing the peripheral list comprises determining that the peripheral list associates an identifier of the first container with the peripheral requirements.
7. The method of claim 6 , wherein the identifier of the first container includes one or more of:
a unique identifier of the first container;
an identifier of the first application running in the first container; or
an IP address of the first container.
8. The method of claim 1 , wherein determining the peripheral requirements of the first application running in the first container comprises examining the first application running in the first container.
9. The method of claim 8 , wherein examining the first application running in the first container comprises examining an import address table or a library of the first application.
10. The method of claim 8 , further comprising:
storing an association between the peripheral requirements and the first container in a peripheral list.
11. The method of claim 10 , wherein the association between the peripheral requirements and the first container comprises an association between a type or class of peripheral and an identifier of the first container or the first application running in the first container.
12. The method of claim 1 , further comprising:
determining a trust score for the computing device;
determining, based on the trust score, that the first peripheral is allowed to be provisioned to the first container;
wherein the first peripheral is provisioned to the first container after determining, based on the trust score, that the first peripheral is allowed to be provisioned to the first container.
13. One or more computer storage media storing computer executable instructions which when executed on a computing device implement a method for dynamically provisioning peripherals to containers on the computing device, the method comprising:
detecting when an application has been launched in a container;
determining peripheral requirements for the application;
determining a trust score for the computing device;
determining whether the trust score exceeds a threshold; and
provisioning one or more peripherals to the container based on the peripheral requirements only when the trust score exceeds the threshold.
14. The computer storage media of claim 13 , wherein the method further comprises:
determining that a peripheral list does not include an entry matching the application or the container; and
updating the peripheral list to associate the peripheral requirements for the application with an identifier of the application or the container.
15. The computer storage media of claim 13 , wherein determining the peripheral requirements for the application comprises examining a library or an import address table of the application.
16. A computing device comprising:
one or more processors; and
one or more computer storage media storing:
a peripheral arbitrator that executes in a host operating system environment; and
a container agent that executes within a container;
wherein the peripheral arbitrator and the container agent are configured to identify peripheral requirements for an application executing in the container and to provision one or more peripherals to the container based on the peripheral requirements, wherein the peripheral arbitrator selectively provisions the one or more peripherals to the container based on a trust score of the computing device.