Granted Patent B2

US 12,348,392 · App. 17/988,690 · Granted Jul 1, 2025

Inventors: Anil Kumar Vishnoi (Sacramento, CA); Brent Salisbury (Frankfort, KY)

Assignee: Red Hat, Inc.

H04L43/028H04L67/60

Abstract

Claims (49)

1. A method comprising:

receiving, from a first workload executing within a first container on an edge device, a request to send data to a second workload;

determining that the second workload is executing within a second container on the edge device, wherein the first container and the second container are different; and

in response to the determining:

identifying, by a processing device and using a map, a first socket on the first container, wherein the first socket is associated with the first workload;

identifying, by the processing device and using the map, a second socket on the second container, wherein the second socket is associated with the second workload; and

routing, by the processing device, a set of data packets associated with the data from the first socket to the second socket,

wherein the routing comprises:

intercepting the request at a socket layer to determine a socket address of the second workload;

routing the request according to socket address while bypassing one or more Transmission Control Protocol/Internet Protocol (TCP/IP) layers that are lower than the socket layer; and

executing an extended Berkeley packet filter.

2. The method of claim 1 , wherein the request comprises a networking system call.

3. The method of claim 2 , wherein the networking system call comprises a payload.

4. The method of claim 1 , wherein the request is intercepted at the socket layer using a hook.

5. The method of claim 1 , wherein the map is created during orchestration of the first container and the second container on the edge device.

6. The method of claim 1 , wherein routing the set of data packets from the first socket to the second socket comprises obtaining a payload of the data prior to encapsulating the payload within a TCP/IP packet.

7. A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

receive, from a first workload executing within a first container on an edge device, a request to send data to a second workload;

determine that the second workload is executing within a second container on the edge device, wherein the first container and second container are different; and

in response to the determining:

identify, by a processing device and using a map, a first socket on the first container, wherein the first socket is associated with the first workload;

identify, by the processing device and using the map, a second socket on the second container, wherein the second socket is associated with the second workload; and

route, by the processing device, a set of data packets associated with the data from the first socket to the second socket,

wherein, to route the set of data packets, the processing device is to:

intercept the request at a socket layer to determine a socket address of the second workload;

route the request according to socket address while bypassing one or more Transmission Control Protocol/Internet Protocol (TCP/IP) layers that are lower than the socket layer; and

execute an extended Berkeley packet filter.

8. The system of claim 7 , wherein the request is intercepted at the socket layer using a hook.

9. The system of claim 8 , wherein the hook is an operating system hook.

10. The system of claim 8 , wherein the hook is a sandboxed hook.

11. The system of claim 7 , wherein the map is created during orchestration of the first container and the second container on the edge device.

12. The system of claim 7 , wherein the map comprises a set of entries, an entry comprising:

a network address;

a socket; and

a workflow.

13. The system of claim 7 , wherein the first container and the second container reside within one or more execution environments.

14. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

receive, from a first workload executing within a first container on an edge device, a request to send data to a second workload;

determine that the second workload is executing within a second container on the edge device, wherein the first container and second container are different; and

in response to the determining:

identify, by a processing device and using a map, a first socket on the first container, wherein the first socket is associated with the first workload;

identify, by the processing device and using the map, a second socket on the second container, wherein the second socket is associated with the second workload; and

route, by the processing device, a set of data packets associated with the data,

wherein, to route the set of data packets, the instructions cause the processing device to:

intercept the request at a socket layer to determine a socket address of the second workload;

route the request according to socket address while bypassing one or more Transmission Control Protocol/Internet Protocol (TCP/IP) layers that are lower than the socket layer; and

execute an extended Berkeley packet filter.

Assignments (2)

Continuity (1)

References Cited (56)