JP6749094B2 - Container accommodation device, container creation method, and program - Google Patents

Description

The present invention relates to a service providing method in a shared hosting service.

In recent years, virtual server type hosting services that occupy CPU/memory/disks such as VPS (Virtual Private Server) and cloud are spreading. However, in the virtual server type hosting service, a user has to manage and operate the server for each individual server. On the other hand, by sharing server resources with other users, a shared hosting service that is low in cost and does not require server management is widely used mainly by SME users.

In the conventional shared hosting service providing method, a single process is shared by many accommodating users in one housing. Specifically, a shared daemon process is prepared, the users are sorted by user-specific information such as a domain, and the housing resources are shared by the accommodating users.

JP-A-2014-235644

However, in the method of sharing the process among the users as described above, for example, when a part of the accommodated users occupies a large amount of resources, other users may be unable to use the service. .. In addition, there is also a problem that a common resource setting must be used among all users who use the process.

That is, the conventional technology has a problem in that, in a shared hosting service in which server resources are shared among users, resource control cannot be appropriately performed for each user.

The present invention has been made in view of the above points, and it is an object of the present invention to provide a technology that enables appropriate control of resources for each user in a shared hosting service in which server resources are shared between users. And

According to an embodiment of the present invention, a container accommodating device for accommodating a container which is a virtual environment for operating a process of a specific user isolated from processes of other users,
Wherein when receiving the instruction to create a particular user of the container, and the user area templates for setting the container templates and user area for the common use, the common area set in the container create each user, the A container management unit for creating a container for the specific user by using the specific user individual setting file for setting the specific user individual for the setting based on the user area template ,
The container management means connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. A container storage device is provided.

In addition, according to the embodiment of the present invention, there is provided a container creating method executed by a container housing apparatus that houses a container which is a virtual environment in which a process of a specific user is operated in isolation from processes of other users. hand,
Wherein when receiving the instruction to create a particular user of the container, and the user area templates for setting the container templates and user area for the common use, the common area set in the container create each user, the A container creating step of creating a container of the specific user by using the specific user individual setting file for setting the specific user individual with respect to the setting based on the user area template ,
In the container creating step, the container accommodation device connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. A method of creating a container is provided.

According to the embodiments of the present invention, it is possible to provide a technique that enables appropriate resource control for each user in a shared hosting service in which server resources are shared between users.

It is the whole system block diagram in the form of execution of this invention. FIG. 6 is a diagram showing a configuration example after a container is generated in the container housing device 100. It is a figure which shows the structure of the container accommodation apparatus 100 more concretely. It is a figure which shows the outline of container preparation. It is a figure which shows the content example of a template. It is a flow chart which shows the example of processing at the time of container creation. It is a figure which shows the outline of an update process. It is a flow chart which shows the example of processing at the time of update. It is a figure showing an example of distribution processing of a user field template. It is a figure for explaining an example which uses storage of user data properly. It is a figure for demonstrating cooperation with an external service.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the following embodiments.

(Outline of Embodiment)
In this embodiment, a container template including a server application, a library module, common settings, etc. is created, and a container for each user is created from the container template. As a result, the process space of the accommodation user accommodated in each container is separated. As a result, it becomes possible to appropriately control resources in container units.

In addition, the data created by the user and the customizable setting file are secured as a data area in a storage separate from the container, the virtual storage created as a container is layered, and the data area is bound and mounted to Can transparently handle the file system without paying particular attention to the boundary between the common area (container) and the data area type.

<About the container>
Here, a brief description of the container is given. The container itself is an existing technology. Generally, the inside of the OS is divided into a user space used by an application (software operating on the OS) and a kernel space used by the kernel. When the application is executed, a process (program execution unit) is generated in the user space. In container technology, processes are grouped and operated in a space isolated from other groups and processes that do not belong to any group. This space (virtual environment) is called a container.

With the container technology, a process in a container cannot access a process in another container. Further, with respect to the CPU, memory, device, etc., the range available from the container is limited for each container.

There are various types of software for creating a container (referred to as "container management software"), but this embodiment assumes that Docker (registered trademark) is used as an example. ing. However, the container management software to which the present invention can be applied is not limited to a specific container management software, and various container management software can be applied to implement the present invention.

(Overall system configuration)
FIG. 1 is a diagram showing an example of the overall configuration of a system according to an embodiment of the present invention. As shown in FIG. 1, the system according to the present embodiment has a container housing device 100 and a management device 200.

The container accommodating apparatus 100 and the management apparatus 200 are apparatuses connected to a network, respectively, and the container accommodating apparatus 100 and the management apparatus 200 can communicate with each other. Further, each of the container housing device 100 and the management device 200 may be one or a plurality of physical servers (computers) or one or a plurality of virtual servers. The container housing device 100 may be referred to as a “host”.

<Container storage device>
The container housing device 100 is a device that provides a shared hosting service to each user. In the present embodiment, a container for each user is created in the container housing device 100.

As shown in FIG. 1, the container housing device 100 includes a container management unit 110, a template storage unit 120, and a monitor control unit 130. The container management unit 110 is a functional unit for creating and updating a container based on an instruction from the management device 200, and in the present embodiment, a function realized by container management software, a provisioning script (program), or the like. It is a department.

The template storage unit 120 stores a container template and a user area template. The container template of this embodiment may be referred to as a container image, is common to the containers, and is data that may be a template of the container (may be referred to as model data). A container for each user is created based on the template, and at that time, individual settings are made for each user.

The user area template includes initial settings of user areas (user rewritable areas) in the container, initial data, and the like. The user area template itself is common to the containers, but individual settings (setting file storage, etc.) are made when the container is created.

The monitoring control unit 130 monitors the frequency or amount of reading and writing of user data that occurs with the execution of a process in the container, and uses a storage or the like that stores user data according to the frequency or amount of data. Is. The monitoring control unit 130 may be a functional unit realized by a program that forms a container (that is, a program that forms a container template), or a program external to the container (a program executed by the container accommodating apparatus 100). ) May be a functional unit.

The monitor control unit 130 also has a resource control function regarding the use of the container by the user. This function is based on the idea of "fair share". Specifically, the monitoring controller 130 has a relative value of resources (eg, CPU resources, memory resources) available to each user (one container) and a maximum value. Values are set, and the monitoring control unit 130 performs resource control based on these values.

The relative value is the amount of resources allocated to one user. The monitoring control unit 130 limits the resource of each user to a relative value when the overall load of the container accommodating apparatus 100 is high. Allow the use of. However, the maximum value cannot be exceeded. By such resource control, the entire resources of the container housing device 100 can be effectively used, and the resources can be equally used among a plurality of containers.

The maximum value represents a resource upper limit value that can be used by one user in a state where the container accommodating apparatus 100 has sufficient resources. By setting such an upper limit value, even if one container runs out of control, it is possible not to occupy the entire resource of the container housing device 100.

That is, the monitoring control unit 130 enables resources to be used evenly among a plurality of containers and, even when there is a margin in the total resources, the resource control for limiting the resources used by one container to a predetermined upper limit value. Have a function.

The resource control function in the monitor control unit 130 may be realized by using the container function 37 in the OS described later, or may be realized as a function different from the container function 37. Further, the function of resource control may be provided as a functional unit separate from the monitoring control unit 130.

The container accommodating apparatus 100 according to the present embodiment, for example, causes one or more computers to execute a program describing the processing content in the container management unit 110 and the monitoring control unit 130 described in the present embodiment. It is feasible. That is, the functions of the container housing apparatus 100 are realized by executing a program corresponding to the processing executed in the container housing apparatus 100, using the hardware resources such as the CPU, the memory, and the hard disk built in the computer. It is possible to The above program can be recorded in a computer-readable recording medium (portable memory or the like), and can be stored or distributed. It is also possible to provide the above program through a network such as the Internet or electronic mail.

<Management device>
As illustrated in FIG. 1, the management device 200 includes an order management unit 210, a container storage device management unit 220, and a template storage unit 230. The order management unit 210 is a functional unit that instructs the container housing apparatus 100 to create a container according to an order from an operator or the like. The container accommodating apparatus management unit 220 receives the update command from the operator and executes the container update. The template storage unit 230 stores various versions of templates and has a function of distributing the templates to the container housing device 100.

The management device 200 according to the present embodiment can be realized, for example, by causing one or more computers to execute a program describing the processing content described in the present embodiment. That is, the functions of the management device 200 are realized by executing a program corresponding to the processing executed by the management device 200, using hardware resources such as a CPU, a memory, and a hard disk built in the computer. Is possible. The above program can be recorded in a computer-readable recording medium (portable memory or the like), and can be stored or distributed. It is also possible to provide the above program through a network such as the Internet or electronic mail.

(Detailed example of container container 100)
FIG. 2 is a diagram showing a configuration example of the container housing device 100 in which a container has been created for each user. In the example shown in FIG. 2, each container (container 1, container 2, container 3) is generated based on the container template 10. A common area and a user area are shown in each container. The setting file 11, the library 12, and the daemon 13 are shown in the common area. A setting file 21 and user data 22 are shown in the user area.

Regarding "common area", it is called "common area" because it is an area (function) that provides common functions between containers such as applications (daemons) and libraries, but its operation (operation as a process) is , Each container is independent. Substantial data such as the setting file 11, the library 12, and the daemon (program) 13 is a container template 10 (container image). Due to the functionality of the container, it is perceived by each user as the only one using them. Note that the area in which the container template 10 (container image) is stored is the actual “common area”, and the “common area” shown in FIG. 2 is an area having the same contents as the contents of the common area. means.

The “user area” is an area in which the user can rewrite. Initial values of files and data in the user area are set based on the user area template 20. After the initial value is set, the user-specific setting file 21 and the like are stored (copied) so that the user-specific setting is performed. To the user, a predetermined user data area of the file system provided by the container appears as a storage area for the user data 22, but the external area is band-mounted to connect the external area to the user data area of the container. Actual reading/writing of user data is performed in the external area. That is, the substance of the user data area is in the external area. The setting file 21 may be stored in the external area by bind mounting, or may be stored in the container area without performing bind mounting.

FIG. 3 is a diagram more specifically showing the configuration of the container housing device 100. As shown in FIG. 3, there are hardware 36 and OS 30. Any OS can be used as the OS 30 as long as it can provide a container function, and for example, Linux (registered trademark) can be used. The functions of the OS 30 include a driver 31 and a container function 37.

The container function 37 is a function of the OS used for realizing the container, and examples thereof include Namespaces, cgroups, selinux, and the like.

The management interface 34 corresponds to container management software (Docker or the like).

In the present embodiment, the container image 33 corresponds to the container template 10. Since the contents of the container image 33 become the contents of the common area in the container, the portion of the container image 33 is described as the common area in FIG.

In the example of FIG. 3, an example in which the container 1 and the container 2 are activated is shown. AUFS shown in FIG. 3 is one of the file system functions. All the parent file system (container image 33 in the example of FIG. 3) is made read-only, a writable layer is overlaid on it, and one It is a function that makes it possible to handle it like a file system. However, using AUFS is only an example.

FIG. 3 shows that bind mounting is performed from the external user data area 35 storing user data for each user to a common file system directory created in each container. The user data area 35 outside the container may be provided in the container housing device 100 or may be provided in another device. With such a bind mount, the user can access his/her own data from the container without being aware of the external user data area 35.

Note that the bind mount is a type of mount and is a function that allows a certain file path to be bound to another directory for mounting. For example, when "/ABC /XYZ" is specified as an argument of the bind mount command, the contents of /ABC are bound to /XYZ, and the contents of /ABC are as if the user using /XYZ were Appears to exist in XYZ.

(About creating a container)
FIG. 4 is a diagram showing an outline of container creation. As shown in FIG. 4, based on an order (command) from the operator via the GUI or an order using the API from the order server, the order management unit 210 of the management device 200 stores the container in the server. (Container storage device 100) is determined, and the container management unit 110 of the determined container storage device 100 is instructed to create a container.

As a result, the provisioning script configuring the container management unit 110 is executed, and the container is created (started) by using the container template and the user area template.

The order management unit 210 includes a container management DB (database) 211. The container management DB 211 stores, for example, an account information table, a host information table, and an IP resource information table. The account information table stores, for example, information such as account ID, accommodation host name, IP address, provisioning status (Active, Holding), domain name, contract plan, and option contract.

The host information table stores information such as a host name (container accommodating device name), a host IP address, the number of free resources, and an upper limit of accommodable resources. The IP resource information table stores information such as a host IP address, a user assignment IP address, an account ID and the like.

Upon receiving the order, the order management unit 210 determines and determines which host (container storage device) to accommodate the account from, for example, the availability of resources from the host information table and the IP resource information table. A container creation instruction and input parameters are given to the container management unit 110 of the container housing device 100.

FIG. 5 shows an example of the container template and the user area template. Note that FIG. 5 shows a part of the data included in each of the container template and the user area template. The container template shown in FIG. 5A includes a library, an application, an installer script and the like. The library is an OS module, various program modules, and the like. The applications are an authentication server, a web server, a mail server, a mailing list server, a DB server, a monitoring server, etc. The installer script is an installation package of the provided application.

As shown in FIG. 5B, the user area template includes a setting file, a data directory, and a data file. Regarding the setting file, initial setting information is stored for each user when the container is created. The data directory is a directory that stores various data. In addition, the data file stores initial data.

FIG. 6 is a flowchart showing an example of a processing procedure of the container management unit 110 that receives a container creation instruction. This processing procedure corresponds to the content of the provisioning script. The operation of the container management unit 110 will be described with reference to FIG.

The container management unit 110 receives, from the order management unit 210, an account ID, a password, a domain name, an IP address, a used container template ID, etc. as input parameters of the container creation command.

The container management unit 110 creates an account with the account ID (step S101) and creates a container (step S102). Here, a container corresponding to the container template specified by the container template ID is created. Further, in step S102, a process of bind-mounting a predetermined user data area (for example, an area identified by an account ID) to a predetermined area in the container is also executed.

Next, the user area template is expanded (step S103). As a result, initial data is stored in a user rewritable area. Then, the initial setting of the container is performed (step S104). Here, for example, LDAP entry creation, setting file creation, etc. are performed. Then, the container access setting (step S105), the monitoring setting (step S106), and the resource restriction setting (step S107) are performed.

In the resource limit setting in step S107, for example, the upper limit value of the CPU resource (eg, allocation time per unit time) that can be used by one container, the upper limit value of the memory capacity, and the like are set.

(About container update)
In the present embodiment, the container management unit 110 has a container update function (update function). The update process will be described with reference to FIG. Note that updating means, for example, replacing the container of the old version with that of the new version. Moreover, the container update may be performed collectively for a plurality of containers of a plurality of users accommodated in the container accommodation device 100, or may be performed for each individual user.

FIG. 7A shows a state before the container is replaced. Here, for example, it is assumed that the operator inputs an update command to the container storage device management unit 220. The update command includes information for identifying the container to be updated (account ID or container ID may be used) and information for identifying the container template corresponding to the updated container (container template ID). The container template (new container template) corresponding to the updated container may be stored in advance in the container housing device 100, or may be acquired from the template storage unit 230 at the time of updating.

Upon receipt of the command, the container housing device management unit 220 sends an update command designating the new container template to the container management unit 110 of the target container housing device 100.

As shown in FIG. 7B, the container management unit 110 that has received the update command deletes (stops) the current container and updates the container template. Updating the container template may be downloading a new container template or reading out a new container template stored in advance in the container housing device 100. Then, as shown in FIG. 7C, a new container is created by the new container template.

FIG. 8 is a flowchart showing the operation of the container management unit 110 that receives the update command.

As shown in FIG. 8, first, the old container is stopped (step S201). Then, the new container is activated using the new container template (step S202). The bind mount is set as in the case of creating the container described above. Further, similarly to the case of creating the container described above, the access setting of the container (step S203), the monitoring setting (step S204), and the resource restriction setting (step S205) are performed.

As described above, even if the container (that is, the common area) is replaced with the image of another template, user data and customized settings are retained. Therefore, customizability and software update work become easy.

(Example of user area template distribution processing)
FIG. 9 is a diagram showing an example of user area template distribution processing. The template storage unit 230 stores a container template of each version and a user area template of each version. In the example of FIG. 9, for example, a new version user area template is distributed from the template storage unit 230 to the container housing apparatus 100(A), and the user area template is applied in the container housing apparatus 100(A). Further, it is shown that the operator copies the individual user setting file to the setting file set by the user area template, and the individual user setting is performed.

Further, in the example of FIG. 9, as an example, it is shown that the user area template is distributed from the template storage unit 230 to the new container storage device 100(B) via the container storage device management unit 220. There is.

(Example of using different storage in the user data area)
The monitoring control unit 130 in the container housing apparatus 100 determines the frequency of reading/writing user data (eg, the number of times of reading/writing per unit time), the amount of data to be read/written (eg: data amount per unit time), for each file (for each directory). But it's okay). The “read/write” may be only “read” (read), “write” (write) only, or the total of “read” and “write”. Moreover, the monitoring method is not limited to a specific method. For example, a file/directory of the file system set in the container (that is, a file/directory visible to the user) may be monitored, or a file/directory of the original area (external area) of the bind mount may be monitored. Good.

The monitoring control unit 130 regards frequently read/written data (eg, a file/directory having a read/write frequency higher than a predetermined threshold) as hot data, and data that is rarely accessed (eg, a file having a read/write frequency less than or equal to a predetermined threshold). / Directory) is used as cold data to selectively use the target storage for bind mount. As a result, high-speed storage such as SSD is used for data that requires higher I/O performance, and high-capacity, low-cost storage is used for cold data that rarely reads and writes. It can be used properly according to the type. That is, it is possible to flexibly control the storage resource.

FIG. 10 is a diagram illustrating an example in which the storage is selectively used. In the example of FIG. 10, since the frequency of reading and writing data in the directory /home/user/mail in the container is high, the user data area of storage A, which is a high-speed storage, binds to /home/user/mail. It is mounted. On the other hand, since the frequency of reading and writing data in the directory /home/archive/files is low, the user data area of the storage B, which is a slow storage, is bind-mounted to /home/archive/files. The monitoring control unit 130 can dynamically switch the bind mount.

(Example of cooperation with external services)
An external service can be used by the container in this embodiment. FIG. 11 is a diagram for explaining the procedure.

As shown in FIG. 11, for example, a user makes a contract for an external cloud application such as SaaS (step S301).

Then, the user or the operator bind-mounts the area of the provided application (the area of the server where the external application is provided) with the user area of the container (the area of the user data) (step S302). Thereby, the user can use the external service as if the application is installed in his/her own container without being aware of the external service (step S303).

Further, by describing the bind mount process from the external service in the provisioning script which constitutes the container management unit 110, the container can be started in a state of being linked with the external service.

(Effects of the embodiment)
In the conventional technology in which a process is shared between users, when a part of the accommodated users occupies a large amount of resources, the influence that other users cannot use the service, the account is taken over, etc. If there is an abuse, the overall response of the user will be adversely affected. There are also security concerns if the software has serious bugs such as privilege escalation.

On the other hand, according to the technique of this embodiment, the container is created based on the template of the server application, the library module, the common setting, etc., and the process space of the accommodating user is separated. It becomes possible to control in container units. In addition, since the process space is independent for each container, with respect to the security problem, even if each process is eroded, the influence range can be kept within the container.

Further, in the conventional technology in which a process is shared between users, common settings must be used for all users. This limits the use case of the user and lacks customizability. In addition, among the conventional technologies, there is a service that launches a virtual server using the cloud and manages it by the hosting company, which realizes the same convenience for users as shared hosting. However, there is a problem that the operating cost becomes higher than that of the process-sharing type hosting due to the increase in the amount of work.

With respect to these problems, according to the technique of the present embodiment, data created by the user and a customizable setting file are secured as a data area in a storage different from the container, and the data area is bind-mounted. The user can transparently handle the file system without paying particular attention to the boundary between the types of the common area and the data area. As a result, the user's data and customized settings are retained even if the common area is replaced with another template, so that customizability and software update work are facilitated, and operational problems can be solved.

That is, according to the technique of the present embodiment, the independence of user resource control can be ensured by separating processes for each user. As a result, it is possible to individually detect the takeover for each user, to drop the process of the user who exceeds the limit value, and to take actions such as deprivation of authority.

Also, by placing a setting file in the user data area and including it, it is possible to customize settings and options for each user. Also, a process for each user is started for each container, but since the process is idle while the user is not using it, it does not consume disk IO and CPU resources, which are bottlenecks, so resources are used efficiently. It becomes possible to do.

In addition, the technique of the present embodiment allows a plurality of versions of applications to be provided and the user to select the version to be used. The executable file is installed in a common area (eg, the area where the substance of the container template (image) is stored), but the setting file is placed in the user area (eg, user data area for bind mount) to set the settings. Can be overridden. That is, the setting of the user data area can be reflected.

Further, the software can be easily updated by dividing the user data area and the common area and replacing only the common area. That is, the user data area is transparently made persistent to the file system and does not change before and after the replacement of the common area. In addition, the common area can be used as a template for each release to manage file differences and version management.

(Summary of Embodiments)
As described above, according to the present embodiment, a container accommodating device that accommodates a container that is a virtual environment in which a process of a specific user is isolated from processes of other users and operates, When a container creation instruction for a specific user is received, the container management means is provided for creating a container for the specific user by using model data commonly used in creating the container for each user. Is connected to an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. Provided.

When the container management unit receives an instruction to update the container of the specific user to another container, the container management unit stops the container of the specific user and stores model data corresponding to the other container. It may be used to create the other container.

Further, the container accommodating device monitors a frequency or a data amount of data read from or written to the data area, and based on the frequency or the data amount, a monitoring control unit that determines an external area to be connected to the data area. May be provided.

When the frequency or the amount of data is larger than a predetermined threshold, the monitoring control unit determines an external area to be connected to the data area as an area in a high-speed storage, and the frequency or the amount of data is equal to or less than a predetermined threshold. In some cases, the external area connected to the data area may be determined as an area in a storage slower than the high-speed storage.

Further, as the external area, an area in a server that provides a predetermined application service may be used.

In addition, the container accommodating device is provided with resource control means for enabling equal use of resources among a plurality of containers and for limiting resources used by one container to a predetermined upper limit value even if there is a margin in the total resources. May be.

(Item 1)
A container accommodating device for accommodating a container, which is a virtual environment in which a process of a specific user is isolated and operated from processes of other users,
A container management means for creating a container for the specific user by using model data commonly used in creating the container for each user when receiving a container creation instruction for the specific user,
The container management means connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area.
A container accommodating device characterized by the above.
(Item 2)
When the container management unit receives an instruction to update the container of the specific user to another container, the container management unit stops the container of the specific user and stores model data corresponding to the other container. Create another container using
The container accommodating apparatus according to item 1, wherein:
(Section 3)
Monitoring and control means for monitoring the frequency or amount of data read or written to the data area and determining an external area to be connected to the data area based on the frequency or data amount.
The container accommodating apparatus according to claim 1 or 2, further comprising:
(Section 4)
When the frequency or the amount of data is larger than a predetermined threshold, the monitoring control unit determines an external area to be connected to the data area as an area in a high-speed storage, and the frequency or the amount of data is equal to or less than a predetermined threshold. In some cases, the external area to be connected to the data area is determined as the area in the storage slower than the storage fast.
The container housing device according to item 3, wherein:
(Section 5)
The external area is an area within a server that provides a predetermined application service.
The container accommodating device according to any one of the first to fourth aspects.
(Section 6)
Resource control means for enabling equal use of resources among a plurality of containers and for limiting the resources used by one container to a predetermined upper limit value even if there is a margin in the total resources
The container accommodating apparatus according to any one of the first to fifth aspects, further comprising:
(Section 7)
A method for creating a container executed by a container accommodating device that accommodates a container that is a virtual environment that operates by isolating a process of a specific user from processes of other users,
A container creating step of creating a container of the specific user by using model data commonly used in creating the container of each user when receiving a creating instruction of the container of the specific user,
In the container creating step, the container accommodation device connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. Do
A method of creating a container characterized by the following.
(Section 8)
A program for causing a computer to function as each unit in the container accommodating apparatus according to any one of items 1 to 6.
The present invention is not limited to the above-described embodiment, and various modifications and applications are possible within the scope of the claims.

100 container accommodation device 110 container management unit 120 template storage unit 130 monitoring control unit 200 management device 210 order management unit 220 container storage device management unit 230 template storage unit

Claims (8)

A container accommodating device for accommodating a container, which is a virtual environment in which a process of a specific user is isolated and operated from processes of other users,
Wherein when receiving the instruction to create a particular user of the container, and the user area templates for setting the container templates and user area for the common use, the common area set in the container create each user, the A container management unit for creating a container for the specific user by using the specific user individual setting file for setting the specific user individual for the setting based on the user area template ,
The container management means connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. Container accommodation device. When the container management unit receives an instruction to update the container of the specific user to another container, the container management unit stops the container of the specific user and stores model data corresponding to the other container. The container accommodating apparatus according to claim 1, wherein the other container is created by using the container. It is characterized by further comprising a monitoring control means for monitoring the frequency or amount of data read or written to the data area and determining an external area to be connected to the data area based on the frequency or data amount. The container accommodation device according to claim 1 or 2. When the frequency or the amount of data is larger than a predetermined threshold, the monitoring control unit determines an external area to be connected to the data area as an area in a high-speed storage, and the frequency or the amount of data is equal to or less than a predetermined threshold. The container accommodating apparatus according to claim 3, wherein in some cases, the external area to be connected to the data area is determined as an area in a storage slower than the high-speed storage. The container accommodating apparatus according to any one of claims 1 to 4, wherein the external area is an area within a server that provides a predetermined application service. In addition to enabling equal use of resources among a plurality of containers, the system further comprises resource control means for limiting the resources used by one container to a predetermined upper limit value even if there is a margin in the total resources. The container accommodating device according to any one of claims 1 to 5. A method for creating a container executed by a container accommodating device that accommodates a container that is a virtual environment that operates by isolating a process of a specific user from processes of other users,
Wherein when receiving the instruction to create a particular user of the container, and the user area templates for setting the container templates and user area for the common use, the common area set in the container create each user, the A container creating step of creating a container of the specific user by using the specific user individual setting file for setting the specific user individual with respect to the setting based on the user area template ,
In the container creating step, the container accommodation device connects an external area outside the container to a data area recognized by the specific user in the container so that data is stored in the external area. A method of creating a container characterized by: A program for causing a computer to function as each unit in the container accommodating apparatus according to any one of claims 1 to 6.

Images