| Name (Title) |
Immutable Service Container Dock |
| Description |
An Immutable Service Container Dock (ISC Dock) is a specialized type of a Secure Execution Container (SEC) has been constructed to house one or more Immutable Service Containers (ISCs). In this way, the ISC Dock functions as a hypervisor controlling access to (virtual or physical) resources that are granted to individual ISCs. Examples of resources include compute, memory, and storage capacity as well as network bandwidth. ISCs are fully dependent upon an ISC Dock, and the ISC Dock has sufficient privilege to provision, enable, disable, and destroy ISCs under its control. ISC Docks will often also provide additional security enforcement and monitoring capabilities beyond that provided by the ISCs themselves. This is done to help ensure that misconfigured or rogue ISCs do not negatively impact the IT environment or other ISCs under the ISC Dock's control. Additional security controls may include resource constraints, packet filtering, network address translation, auditing, integrity checking and other capabilities as supported by the actual implementation. |
| Alias |
ISC Dock |
| Intent |
The intent is to provide a well-defined enclosure capable of securely hosting and managing one or more Immutable Service Containers. The ISC Dock is the primary gateway through which ISCs have access to virtual or physical resources as well as external connectivity. The ISC Dock also is responsible for performing actions that operate on ISCs themselves such as provisioning, quarantine, snapshot, destruction, and similar functions. |
| Motivation |
The ISC Dock provide a flexible and extensible way to aggregate ISCs in a way that supports strong security containment, enforcement and monitoring requirements. Serving both as a hypervisor and gateway, the ISC Dock has a unique position relative to the ISCs it manages. The ISC Dock will ensure that ISCs have the only resources they need and that they interact with external systems and services as well as one another only as appropriate (defined by a pre-defined policy). Lastly, the ISC Dock provides an essential abstraction allowing ISC-level operations to be completed without knowledge of or access to the internals of individual ISCs. |
| Applicability |
The Immutable Service Container Dock is tethered to the use of one or more ISCs. An ISC Dock must exist before an ISC can be provisioned into it, and it must remain in place until all of the ISCs have been destroyed. That said, this pattern can be used in any environment and with any ISC (assuming implementation compatibility). |
| Structure |
- Single Immutable Service Container
- Multiple Immutable Service Containers
|
| Participants |
- Immutable Service Container. The Immutable Service Container is an execution environment installed within an ISC Dock used to execute a given Service.
- Immutable Service Container Dock. The Immutable Service Container is managed by an ISC Dock. An ISC Dock offers a way of aggregating one or more ISCs (on a single logical system). The ISC Dock also provides additional security protections such as centralized log and audit collection, resource control (e.g., compute, storage, and memory capacity, network bandwidth, etc.), and also network-level protections to ensure that ISCs only communicate in accordance with a defined policy.
- External Networking Boundary. This is actually a component of the ISC Dock. Only for the sake of clarity was it shown to be a separate entity in the above diagrams. It should be considered to be a functional element of the ISC Dock.
- Security Controls. There are a variety of security controls that can be implemented by the ISC and ISC Dock. The nature of these controls will vary based upon the implementation model chosen. In the representative diagram above, several representative examples have been shown. Additional security controls should be selected as appropriate.
|
| Collaboration |
As noted above. |
| Consequences |
This use of this pattern is required when using Immutable Service Containers. It provides the necessary architectural container into which Immutable Service Containers are deployed, security policy is enforced, and resource access is controlled. While the ISC Dock is intended to be platform and vendor agnostic, depending upon the implementation chosen, the type of ISCs that can be deployed may be limited to a particular vendor or platform. |
| Implementation |
OpenSolaris ISCs |
| Known uses |
OpenSolaris and Solaris Global Zone, VirtualBox |
| Related patterns |
Secure Execution Container, Immutable Service Container |
| Author |
Rafat Alvi, Glenn Brunette, Joel Weise |
| Reviewer |
Joel Weise |
Sign up or Log in to add a comment or watch this page.