Patent ID: 11915026
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A system, comprising:
one or more computing devices;
wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices cause the one or more computing devices to:
obtain, via one or more programmatic interfaces of a container-based task management service of a provider network, a task configuration request indicating a plurality of software containers of a task, including a first software container and a second software container, wherein the task configuration request indicates that a targeted security level of the second software container exceeds a targeted security level of the first software container, and wherein the request does not indicate a resource to be used to execute a software container;
cause to be launched, by the container-based task management service, a first virtual machine and a second virtual machine to execute the first and second software containers respectively at one or more virtualization servers, wherein, in accordance with the respective targeted security levels of the first and second software containers:
(a) a first number of device types emulated for the first virtual machine exceeds a second number of device types emulated for the second virtual machine,
(b) a first number of operating system calls (syscalls) supported by an operating system kernel of the first virtual machine exceeds a second number of syscalls supported by an operating system kernel of the second virtual machine and
(c) a first number of application programming interfaces (APIs) supported by a first container runtime of the first virtual machine exceeds a second number of APIs supported by a second container runtime of the second virtual machine;

cause, by the container-based task management service, (a) the first software container to be executed within the first virtual machine and (b) the second software container to be executed within the second virtual machine, wherein one or more configuration settings of the second virtual machine prevent communication between the second software container and entities external to the second virtual machine via channels other than a secure communication channel established between the first and second virtual machines; and
cause a result of a computation performed using a security artifact at the second software container to be transmitted to the first software container, wherein the security artifact is not accessible to the first software container.