KR20200131375A - A method for containerization of a server application and computer system performing the same - Google Patents

Abstract

Disclosed is a server application containerization method for allocating server computing resources by user so as to solve problems of server application sharing in an existing server-client distributed computing system. The server application containerization method, which is performed by a network computer system including a container image storage for storing an image of an application, a VPN server and a host server, comprises the following steps of: receiving, by the VPN server, a request for accessing the application from a user terminal and transmitting a container generation request for the user terminal to the host server; generating, by the host server, a container of the application from the image in response to the container generation request received from the VPN server; allocating, by the host server, an access IP to the generated container, and generating container access information that maps the container access IP and the user terminal to transmit the same to the VPN server; and transmitting, by the VPN server, the container access information including DNS information to the user terminal.

Description

Server application containerization method and computer system that performs it {A METHOD FOR CONTAINERIZATION OF A SERVER APPLICATION AND COMPUTER SYSTEM PERFORMING THE SAME}

The present invention relates to containerization of applications, and more particularly, containerization and allocation of specific applications to a plurality of users using a VPN server, and destruction and maintenance of images and containers according to whether or not sessions of each container are maintained. It relates to a containerization method of an application that determines the method and a computer system that performs the same.

With the recent development of computer technology, complex and various kinds of tasks are being processed by computer systems. The distributed computing environment is a technology capable of improving processing speed and resource allocation efficiency by distributing resources necessary for computing across a plurality of computer devices, and is widely used. Particularly, in a server-client distributed computing environment, functions for performing a specific task are appropriately divided and distributed to a server and a client. In this case, an application running on the server can be used by a plurality of clients. That is, a plurality of user terminals access the server and perform desired tasks through the same application provided by the server.

In such a server-client distributed computing system, when a server application is executed by a plurality of user terminals, the process to be processed by the same server application is different for each user terminal, and a phenomenon in which resources are concentrated on a specific user may occur. . When the computing resources of the server are intensively allocated to a specific user, the processing load of the server as a whole increases and the processing speed is significantly lowered or, in extreme cases, the server system is down.

In order to solve the problem of sharing server applications in such a conventional server-client distributed computing system, one or more client systems (eg, GUI elements, processing elements) having a portion of an application that allocates resources by containerizing a server application (Client application)), a server-based system (server application or server element) having the rest of the distributed application, and exchanging data between the client system and the server system (for example, providing storage for application data). It consists of a third tier server system. For example, SAP R/3 (a trademark of SAP) allows the application to run on a client portion (e.g., on a workstation such as an IBM sinkpad) and multiple server portions (e.g. on an IBM zSeries mainframe system). Driven) is a typical example of a distributed application. Due to the spread of various portable computing devices such as j phones and tablets, various types of applications have been developed and distributed. Meanwhile, operating systems of computing devices are also diversifying. Due to such rapid development of IT technology, an application development operating environment that enables rapid development and distribution of applications is required.

The present invention is to solve the problem of server application sharing in the conventional server-client distributed computing system, and an object of the present invention is to provide a network computer system and method for allocating server computing resources for each user by containerizing server applications. .

In addition, in containerization of server applications, it is an object to enhance the efficiency and security of container allocation for each user.

Another object of the present invention is to enhance the stability of server application execution by maintaining a session of an already created container when an image, which is a basis for containerization of a server application, is updated.

The containerization method according to an embodiment of the present invention is performed in a network computer system including a container image storage storing an image of an application, a VPN server, and a host server, and the VPN server requests access to the application from a user terminal. Receiving and transmitting a container creation request for the user terminal to the host server; Generating, by the host server, a container of the application from the image in response to the container creation request received from the VPN server; Assigning, by the host server, an access IP to the created container, generating DNS information of the access IP, and transmitting the DNS information to the VPN server; And transmitting, by the VPN server, container access information including the DNS information to the user terminal.

The containerization method includes the steps of: receiving, by the VPN server, DNS information corresponding to an access IP from the user terminal, and transmitting a call of the container to the host server; Determining, by the host server, whether to update the image in response to the container call; And when it is determined that the image is updated, the host server regenerating a container from the updated image and allocating the access IP to the regenerated container.

In this case, the containerization method includes: updating, by the host server, the image stored in the image storage; And determining whether sessions of the plurality of containers generated based on the image before the update are being maintained at the time when the image change is detected, at least among the plurality of containers generated based on the image before the update. If more than one session is being maintained, the image before the update can be maintained without destroying it.

Meanwhile, when the session of all the plurality of containers generated based on the image before the update is terminated, the host server may destroy the image before the update.

In addition, the host server may destroy a container in which a session is terminated among a plurality of containers generated based on the image before the update.

1 is a block diagram showing a network computer system according to an embodiment of the present invention.
2 is a flowchart illustrating a method for containerizing an application executed by the system of FIG. 1.
3 is a diagram showing a state in which containers created by the method of FIG. 2 are allocated to a plurality of user terminals
FIG. 4 is a flowchart illustrating a process of processing an access request to a container created by the method of FIG. 2.
5 is a flowchart illustrating a processing procedure when an image is updated according to an embodiment of the present invention.

In the present invention, various modifications may be made and various forms may be applied, and specific embodiments will be illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to a specific form disclosed, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention. In describing each drawing, similar reference numerals are used for similar components. In the accompanying drawings, dimensions of structures may be exaggerated than actual for clarity of the present invention.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are only used for the purpose of distinguishing one component from another component. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may be referred to as a first component.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or a combination thereof described in the specification, but one or more other features or It is to be understood that the presence or addition of numbers, steps, actions, components, parts, or combinations thereof does not preclude the possibility of preliminary exclusion. In addition, A and B are'connected' and'coupled' means that A and B are directly connected or combined, and other components C are included between A and B, so that A and B are connected or combined. To include that.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs. Terms as defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not. Further, in the claims for the method invention, the order of each step may be interchanged with each other, as long as each step is not clearly bound to the order.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings.

1 is a block diagram showing a network computer system according to an embodiment of the present invention.

Referring to FIG. 1, the network computer system includes a plurality of user terminals 10, an image storage 20, a VPN server 30, and a host server 40.

The image storage 20 is a device for storing and managing a container image of an application, and may be a storage medium such as a hard disk or a solid state drive (SSD). Specifically, the image storage 20 may receive and store an image transmitted from the host server 40 or an external developer device. In addition, the image storage 20 may transmit an image so that the host server 10 can pull the image. The image storage 20 may be a public storage or a private storage.

An image is an unmodifiable and static file containing executable code so that independent processes on an information processing technology (IT) infrastructure can be performed. In the present specification, an image is a package corresponding to a specific application, and means a package including system libraries for executing processes of an application, system tools, and various configuration files. Such an image can be created by the build command of the virtualization engine. Images can be read-only or set to be read and writeable. The image is used to create a container to be described later. That is, the host server 40 of the present invention creates an application container based on the image stored in the image storage. One image may be used to create one container, or may be used to create a plurality of containers. According to an embodiment of the present invention, the host server 40 is configured to create a plurality of containers allocated to each of a plurality of users based on one application image.

The image may be built by various external devices such as a developer device outside the host server 40. The external device refers to a computing device equipped with various development platforms other than the host server 40. In this case, an external device such as a developer device transmits the built image to the image storage 20.

As another example, the image stored in the image storage 20 may be built on the host server 40 according to a command of an external developer device. In this case, the host server 40 may transmit the built image to the image storage 20. The host server 40 can pull an image from the image storage 20.

The VPN server 30 is a server constituting a virtual private network and performs a function of redirecting Internet traffic of a user, hiding an IP address, or encrypting data exchanged. According to an embodiment of the present invention, the VPN server 30 receives a request for access to the application from the user terminal 10.

The VPN server 40 receiving the request for access to the application from the user terminal 10 authenticates whether the user terminal 10 that transmitted the access request is the user terminal 10 registered in the host server.

When the user terminal 10 is the user terminal 10 registered in the host server, the VPN server 40 transmits a container creation request for the user terminal 10 to the host server 40.

When the user terminal 10 is not registered with the host server, the VPN server performs a procedure for registering the user terminal 10 with the host server 40. For example, the VPN server may connect the user terminal 10 to a user registration web page provided by the host server 40.

The host server 40 receives the container creation request from the VPN server 30, generates a container of the application from the container image in response to the container creation request, and allocates a container access IP to the created container do. At this time, the host server 40 generates container access information in which the container access IP and the user terminal 10 are mapped, stores it in a storage device such as a memory, and transmits the generated access information to the VPN server 30. .

The access information may be a domain name corresponding to the container access IP assigned to the user terminal 10.

A container is a set of one or more processes isolated from the rest of the system, and is a virtual isolated area for running applications. The host server 40 creates and allocates a container for each of the registered user terminals 10, and the created container may be stored in a memory built into the host server 40. Containers can be created from images by containerization commands. Containers Containers share the same operating system kernel and isolate application processes from the rest of the system. Meanwhile, a container for executing an application may be configured including a binary, essential library, dependent elements and files. That is, the container does not separately include a guest operating system, and can execute an application using a binary and a library based on the kernel of the host operating system.

The host server 40 may create a container based on the built or pooled image. For example, the host server 40 creates a container by pooling images stored in the image storage 20 and executes the containerized application by executing the created container on the host operating system of the host server. That is, the host server 40 may execute an application included in the container by using a supporting file including a binary and a library based on the kernel of the operating system of the host server.

Hereinafter, operations of the image storage 20, the VPN server 30, and the host server 40 in the container creation process of the network computer system according to the embodiment of FIG. 1 will be described in more detail with reference to FIGS. 2 and 3. Explain.

FIG. 2 is a flowchart illustrating a containerization method of an application executed by the system of FIG. 1, and FIG. 3 is a diagram illustrating a state in which containers created by the method of FIG. 2 are allocated to a plurality of user terminals 10.

Referring to FIG. 2, first, the user terminal 10 accesses a VPN server and requests access to an application. The application is provided by the host server and runs on the host server. The VPN server 30 receives an access request from the user terminal to the application (S110), and authenticates whether the user terminal 10 that has transmitted the access request is a user terminal registered in the host server (S120).

If the user terminal is not registered with the host server, the VPN server performs a procedure for registering the user terminal with the host server 40. For example, the VPN server may connect the user terminal to a use registration web page provided by the host server 40.

When the user terminal is a user terminal registered in the host server, the VPN server 40 transmits a container creation request for the user terminal to the host server 40 (S130).

The host server 40 generates a container from the image stored in the image storage in response to the container creation request received from the VPN server (S140). The created container is exclusively assigned to the user terminal that requested the container creation. The host server 40 allocates a container access IP to the created container and maps the container access IP to the user terminal 10 in order to exclusively allocate the created container to the corresponding user terminal that requested container creation. Information is generated and stored in a storage device such as a memory, and the generated container access information is transmitted to the VPN server 30 (S140).

The container access information may include DNS information mapped to the access IP.

Subsequently, the VPN server 30 transmits the received container access information to the user terminal 10 (S150).

The user terminal 10 may access the VPN server using the received container access information, and execute the application through the assigned container.

Referring to FIG. 3, a host server operating system (host server OS) is installed in the host server 40, and an image IMG_APP1 for containerization of the application APP1 is stored in the image storage 20. In addition to APP1, images (IMG_APP2, IMG_APP3,...) for containerization of other applications (APP2, APP3...) may be stored in the image storage 20.

When a plurality of user terminals UT1, UT2, and UT3 each request access to the same application APP1, the host server 40 goes through the process of FIG. 2, based on the image of the application APP1 (IMG_APP1). Containers CT1, CT2, CT3 allocated for each of (UT1, UT2, UT3) are created. In other words, the host server 40 creates a first container CT1 in response to an access request for the application APP1 of the user terminal UT1, and creates a second container CT2 in response to the access request for the application APP1 of the user terminal UT2. The third container CT3 is created in response to a request for access to the application APP1 of the user terminal UT3. As described above, the first to third containers CT1, CT2, and CT3 are all generated from the image IMG_APP1 of the same application APP1.

The host server 40 allocates container access IPs (IP1, IP2, IP3) to each container created for each user terminal, and provides container access information (ACI1, ACI2, ACI3) mapping the assigned container access IP to the user terminal. Create and save.

As described above, each of the containers CT1 to CT3 includes an application and a supporting file (including binaries, libraries, layers, etc.) for driving the application, and is executed on the host server OS based on the kernel of the host server. .

As described above, it is natural that containerization similar to that of FIG. 3 may be performed for the images IMG_APP2 and IMG_APP3 of other applications stored in the image storage through the same processing of FIG. 2.

Referring to FIG. 4, a process of processing an access request to a container generated by the method of FIG. 2 by the host server 40 will be described in more detail.

FIG. 4 is a flowchart illustrating a process of processing an access request to a container created by the method of FIG. 2.

First, the user terminal 10 transmits an application container access request to the VPN server 30 using DNS information included in the container access information.

The VPN server 30 receives an application container access request (S210), and transmits a container call request corresponding to the container access information to the host server 40 (S220).

The host server 40 calls a container corresponding to the container access IP mapped to the access information, that is, a container allocated to a corresponding user terminal by using the access information included in the call request (S240).

The user terminal 10 may execute an application using the called container.

As described above, when it is necessary to modify an application, change a library, a binary, or the like, or add a layer, the image itself can be newly built. The newly built image is used to containerize the modified application. Hereinafter, for convenience, a case where an image is newly built by reflecting the modification (update) of the application is referred to as "update of the image", and the newly built image due to the modification of the application, etc. is referred to as "update image".

The host server 40 determines whether to update the image in response to the container call (S230). That is, when a container call is requested from the user terminal 10, the host server 40 determines whether there is a new image build according to the modification of the containerized application.

If it is determined that the image has been updated, the host server regenerates the container from the updated image (S250), and calls the regenerated container to provide it to the requested user terminal. In this case, the already allocated IP is allocated again to the regenerated container.

If it is determined that the image has not been updated, the host server 40 calls the container corresponding to the container access IP mapped to the access information by using the access information included in the call request, that is, the container assigned to the corresponding user terminal. Do (S240).

When an image is newly built due to application modification, it is common to destroy the old image and store only the newly built image in the image storage.

However, when there is another user terminal that is using an application by accessing a container created by the previous image, if the previous image is immediately destroyed, the container session may be forcibly terminated.

Therefore, in the containerization method according to an embodiment of the present invention, when an image stored in an image storage is newly built, a plurality of images generated based on the previous image are newly built at the time when a new build of the image is detected. May be configured to determine if a session of the container of the device is being maintained.

5 is a flowchart illustrating a processing process when an image is updated according to an embodiment of the present invention.

First, the host server updates the image stored in the image storage (S310). That is, when there is a need to modify an application, change a library, binary, etc., or add a layer, the host server 40 newly builds the update image itself, and stores the newly built update image in the image storage 20 do.

At this time, the build of the update image may be performed by the host server 40 or by an external developer device, and when performed by an external developer device, the newly built update image is image storage ( 20) can be pushed and saved.

When the image update is performed as described above, the host server 40 determines whether sessions of a plurality of containers generated based on the image before the update are being maintained at the time when the image update is detected (S320).

As a result of the determination, if at least one session is being maintained among a plurality of containers generated based on the image before the update, the image before the update may be maintained without destroying (S340).

As a result of the determination, when the session of all the plurality of containers generated based on the image before the update is terminated, the host server may destroy the image before the update (S330). That is, when the session of all of the plurality of containers created based on the image before the update is terminated, the host server may leave only the updated image in the image storage and delete the image before the update from the image storage.

For example, in the example of FIG. 3, when the application APP1 is modified and the image IMG_APP1 of APP1 is newly built, the newly built image is assumed to be IMG_APP1'. The host server 40 stores the newly built image IMG_APP1' in the image storage. After the image is updated, for example, when the first user terminal UT1 requests access to the first container CT1, the host server 40 creates a new first container CT1' based on the updated image IMG_APP1'. do. The newly created first container CT1' uses the IP allocated to the previous first container CT1 as it is. Accordingly, the container access information assigned to the first user terminal does not change. Meanwhile, after the image is updated, the host server 40 determines whether there is a container in which a session is maintained among the containers CT1, CT2, and CT3 generated based on the previous image IMG_APP1 according to the processing of FIG. 5. For example, if the second user terminal UT2 is working by accessing the previous second container CT2 before the image is updated, the session of the second container is maintained, so the previous image IMG_APP1 is not deleted from the image storage. . Thereafter, when the session of the second user terminal UT2 is terminated, all sessions of containers created based on the previous image IMG_APP1 have been terminated, so that the previous image IMG_APP1 does not need to be maintained in the image storage any more. Accordingly, the host server 40 deletes the old image IMG_APP1 from the image storage, and leaves only the updated new image IMG_APP1' in the image storage.

In this case, the host server may destroy a container in which a session is terminated among a plurality of containers generated based on the image before the update.

In the detailed description of the present invention described above, it has been described with reference to preferred embodiments of the present invention, but those skilled in the art or those of ordinary skill in the art will have the spirit of the present invention described in the claims to be described later. And it will be appreciated that various modifications and changes can be made to the present invention within a range not departing from the technical field.

In addition, the image storage 20 according to an embodiment of the present invention may be a Docker Registry Hub, but is not limited thereto.

10: user terminal 20: image storage
30: VPN server 40: host server

Claims (11)

A method of containerizing an application executed by a network computer system including a container image store, a VPN server and a host server for storing an image of the application,
Receiving, by the VPN server, a request for access to the application from a user terminal, and transmitting a container creation request for the user terminal to the host server;
Generating, by the host server, a container of the application from the image in response to the container creation request received from the VPN server;
Allocating, by the host server, an access IP to the created container, generating container access information in which the container access IP and the user terminal are mapped, and transmitting it to the VPN server; And
Transmitting, by the VPN server, container access information including the container access information to the user terminal
How to include.
The method of claim 1,
Receiving, by the VPN server, a container access request using the access information from the user terminal, and transmitting a container call request corresponding to the access information to the host server;
Determining, by the host server, whether to update the image in response to the container call request; And
If it is determined that the image has been updated, the host server regenerating a container from the updated image and allocating the access IP to the regenerated container
How to further include.
The method of claim 1,
Updating, by the host server, the image stored in the image storage; And
Determining whether a session of at least one container created based on the image before the update is being maintained at the time when the image change is detected
It further includes,
When a session of at least one container generated based on the image before the update is being maintained, the image before the update is maintained without being destroyed.
The method of claim 3,
When the session of all containers created based on the image before the update is terminated, the image before the update is discarded.
The method of claim 3,
And destroying a container in which a session has ended among the plurality of containers generated based on the image before the update.
User terminal;
A container image store that stores a container image of an application;
A VPN server that receives a request for access to the application from the user terminal and transmits a container creation request to the user terminal; And
Receiving the container creation request from the VPN server, generating a container of the application from the container image in response to the container creation request, allocating a container access IP to the created container, and assigning the container access IP and the user Host server that generates terminal-mapped container access information and transmits it to the VPN server
Network computer system comprising a. The method of claim 1,
The user terminal accesses the VPN server by using the container access information, thereby requesting access to the assigned container.
The method of claim 7,
The VPN server, in response to the container access request, transmits a container call request corresponding to the container access IP to the host server,
The host server determines whether or not the image is updated in response to the container call request, and if the image is determined to be updated, regenerates a container from the updated image, and assigns the access IP to the regenerated container. Network computer system.
The method of claim 6, wherein the host server,
Detects whether the image stored in the image storage is updated,
When an update of the image is detected, it is determined whether sessions of a plurality of containers created based on the image before the update are being maintained,
A network computer system that maintains the image before the update without destroying it when at least one session is being maintained among the plurality of containers generated based on the image before the update.
The method of claim 9, wherein the host server,
A network computer system for destroying the image before the update when the sessions of all of the plurality of containers generated based on the image before the update are ended.
The method of claim 9, wherein the host server,
A network computer system for destroying a container in which a session is terminated among a plurality of containers generated based on the image before the update.

Images