Selective persistence of data utilized by software containers
Technologies are described for selective persistence of data utilized by software containers. A configuration policy is defined that includes data that specifies one or more data stores for which data is not to be persisted following accesses to a software container and one or more data stores for which data is to be persisted following accesses to the software container. When the software container is first accessed, the data stores identified in the configuration policy are attached to the software container. Upon a subsequent access to the container, such as at the conclusion of a user session or upon destruction of the container, the data in the attached data stores is persisted or deleted based upon the configuration policy. When the software container is once again accessed, the data store containing the persisted data can be re-attached to the software container.
1. A computer-implemented method, comprising:
storing a configuration policy for a software container, the configuration policy comprising data defining:
a first data store for storing first data for the software container that is not to be persisted following destruction of the software container and
a second data store for storing second data for the software container that is to be persisted following destruction of the software container;
responsive to a first access to the software container:
attaching the first data store and the second data store to the software container;
receiving a request to store content from an application executing within the software container;
determining if the content includes malicious content;
selectively persisting the malicious content to the first data store, and
selectively persisting non-malicious content to the second data store;
responsive to the end of the first access to the software container:
deleting the first data stored in the first data store and
persisting the second data stored in the second data store; and
responsive to a second access to the software container:
attaching a second instance of the first data store to the software container and
attaching the second data store comprising the persisted second data to the software container.
2. The computer-implemented method of claim 1 , wherein the configuration policy comprises further data defining a third data store for storing third data for the software container that is to be persisted following the first access to the software container, and wherein the method further comprises:
responsive to the first access to the software container, identifying the third data store, and attaching the third data store to the software container;
following the first access to the software container, persisting the third data stored in the third data store; and
responsive to the second access to software container, identifying the third data store based on the configuration policy, and attaching the third data store comprising the persisted third data to the software container.
3. The computer implemented method of claim 2 , wherein the third data comprises system data.
4. The computer-implemented method of claim 2 , wherein the third data comprises data generated by a single application.
5. The computer-implemented method of claim 1 , wherein the second data comprises user data.
6. The computer-implemented method of claim 1 , wherein multiple applications define the third data.
7. The computer-implemented method of claim 1 , wherein the first data store, the second data store, or the third data store comprise data uniquely identifying the software container.
8. A computing system, comprising:
one or more processors; and
at least one computer storage medium having computer executable instructions stored thereon which, when executed by the one or more processors, cause the apparatus to
store a configuration policy for a software container executing on the one or more processors, the configuration policy comprising data defining
a first data store for storing first data for the software container that is not to be persisted following destruction of the software container and
a second data store for storing second data for the software container that is to be persisted following destruction of the software container;
responsive to a first access to the software container:
attach the first data store and the second data store to the software container;
receive a request to store content from an application executing within the software container;
determine if the content includes malicious content;
selectively persist the malicious content to the first data store, and
selectively persist non-malicious content to the second data store;
responsive to the end of the first access to the software container:
delete the first data stored in the first data store and
persist the second data stored in the second data store; and
responsive to a second access to the software container:
attach a second instance of the first data store to the software container and
attach the second data store comprising the persisted second data to the software container.
9. The computing system of claim 8 , wherein the configuration policy comprises further data defining a third data store for storing third data for the software container that is to be persisted following the first access to the software container, and wherein the at least one computer storage medium stores further computer executable instructions which, when executed by the one or more processors,
identify the third data store and attach the third data store to the software container responsive to the first access to the software container,
persist the third data stored in the third data store following the first access to the software container, and
responsive to the second access to software container, identify the third data store based on the configuration policy, and attach the third data store comprising the persisted third data to the software container.
10. The computing system of claim 9 , wherein the third data comprises system data.
11. The computing system of claim 8 , wherein the second data comprises user data.
12. The computing system of claim 8 , wherein the first data store, the second data store, or the third data store comprises a physical hard disk, a virtual hard disk, or a networked data store.
13. The computing system of claim 8 , wherein the first data store, the second data store, or the third data store comprise data uniquely identifying the software container.
14. The computing system of claim 8 , wherein an association between the software container and the software container is calculated based on one or more of available storage hardware, file system capabilities, or operating system versions.
15. At least one non-transitory computer storage medium having computer executable instructions stored thereon which, when executed by one or more processors of a computing device cause the computing device to:
store a configuration policy for a software container executing on the one or more processors, the configuration policy comprising data defining
a first data store for storing first data for the software container that is not to be persisted following destruction of the software container and
a second data store for storing second data for the software container that is to be persisted following destruction of the software container;
responsive to a first access to the software container:
attach the first data store and the second data store to the software container;
receive a request to store content from an application executing within the software container;
determine if the content includes malicious content;
selectively persist the malicious content to the first data store, and
selectively persist non-malicious content to the second data store;
responsive to the end of the first access to the software container:
delete the first data stored in the first data store and
persist the second data stored in the second data store; and
responsive to a second access to the software container:
attach the first data store to the software container and
attach the second data store comprising the persisted second data to the software container.
16. The at least one non-transitory computer storage medium of claim 15 , wherein the configuration policy comprises further data defining a third data store for storing third data for the software container that is to be persisted following the first access to the software container, and wherein the at least one computer storage medium stores further computer executable instructions which, when executed by the one or more processors,
identify the third data store and attach the third data store to the software container responsive to the first access to the software container,
persist the third data stored in the third data store following the first access to the software container,
responsive to the second access to software container, identify the third data store based on the configuration policy, and attach the third data store comprising the persisted third data to the software container.
17. The at least one non-transitory computer storage medium of claim 15 , wherein the second data comprises user data and wherein the third data comprises system data.
18. The at least one non-transitory computer storage medium of claim 15 , wherein the first data store or the second data store comprise a physical hard disk, a virtual hard disk, or a networked data store.
19. The at least one non-transitory computer storage medium of claim 15 , wherein the first data store and the second data store comprise data uniquely identifying the software container.
20. The at least one non-transitory computer storage medium of claim 15 , wherein the configuration policy further comprises data specifying whether the first data store or the second data store is to be encrypted.