WO2017097116A1

WO2017097116A1 - Inter-container communication method and apparatus

Info

Publication number: WO2017097116A1
Application number: PCT/CN2016/107228
Authority: WO
Inventors: 修剑锋; 叶磊; 于浩
Original assignee: 华为技术有限公司
Priority date: 2015-12-11
Filing date: 2016-11-25
Publication date: 2017-06-15
Also published as: CN105550576A; CN105550576B

Abstract

Embodiments of the present invention provide an inter-container communication method and apparatus. The method comprises: receiving an authentication request sent by a first container for requesting communication with a second container, the first container and the second container being located on an identical host, and both the first container and the second container mounting a shared directory of the host; generating a communication file under the shared directory of the host according to the authentication request, the communication file comprising a communication resource for communication between the first container and the second container; and sending file information of the communication file to the first container and the second container, in order that the first container and the second container determine the communication file under the shared directory of the host according to the file information of the communication file and communicate according to the communication file. Two containers isolated from each other can communicate.

Description

Method and device for communication between containers

The present application claims priority to Chinese Patent Application No. 201510919506.7, entitled "Method and Apparatus for Inter-Container Communication" on December 11, 2015, the entire contents of which are incorporated herein by reference. .

Technical field

The present application relates to the field of communications and, more particularly, to methods and apparatus for communication between containers.

Background technique

The container is an operating system-level lightweight virtualization technology, and its underlying technical Linux namespace (Namespace), Linux Control Group (Control Group, C Group) is completely kernel-specific, without any intermediate layer overhead, for resources. High utilization and performance close to physical machines.

The Linux Namespace is an operating system level virtual machine technology that provides a resource isolation scheme. System resources such as Unix Timesharing System (UTS), Inter-Process Communication (IPC), file system (MOUNT), and Process IDentifier (PID) are no longer global. Instead, it belongs to a specific namespace, and the resources in each namespace are transparent to other namespaces.

A container is similar to a virtual machine. It is a software sandbox, a security mechanism that provides an isolated environment for running programs and tightly controls the resources that can be accessed by programs in the container. The Linux Namespaces mechanism provides a good foundation for implementing container-based virtualization technology. Containers use this feature to achieve resource isolation. Processes in different containers belong to different Namespaces, which are transparent to each other and do not interfere with each other.

Summary of the invention

The present application provides a method and apparatus for communication between containers that enables communication between two mutually isolated containers.

In a first aspect, the present application provides a method for inter-container communication, the method comprising: receiving an authentication request sent by a first container for requesting communication with a second container, wherein the first container and the second The container is located on the same host, and the first container and the second container are mounted a shared directory of the host; generating, according to the authentication request, a communication file under the shared directory of the host, the communication file including a communication resource that the first container communicates with the second container; to the first container and the second The container sends the file information of the communication file, so that the first container and the second container determine the communication file under the shared directory of the host according to the file information of the communication file, and perform communication according to the communication file.

The method for communicating between containers provided by the present application, the authentication module receives an authentication request sent by the first container for requesting communication of the second container, where the first container and the second container are located in the same host, and the first container A container and the second container both mount a shared directory of the host, and generate a communication file including the first container and the second container communication resource according to the authentication request, and send the communication file to the first container and the second container Sending the file information of the communication file enables communication between the two containers that are isolated from each other.

With reference to the first aspect, in a first possible implementation manner of the first aspect, before the generating the communication file in the shared directory of the host according to the authentication request, the method further includes: determining, according to the authentication request, Whether the first container and the second container are in a preset trusted container list, wherein the authentication request carries the identifier of the first container and the identifier of the second container; if the first container and the second container The containers are all in the preset list of trusted containers, and it is determined that the first container has the right to communicate with the second container.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the generating the communication file in the shared directory of the host according to the authentication request includes: And determining, according to the authentication request, a communication manner between the first container and the second container; and generating the communication file according to the communication manner.

Optionally, the authentication request may include an identifier of the first container and an identifier of the second container, and may further include a communication manner used by the first container and the second container.

In conjunction with the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the generating the communication file according to the communication manner includes: determining the first container and the second container Using a Unix domain socket communication method, generating a socket file, the socket file is used to describe that the first container communicates with the second container to provide a socket; and/or if the first container and the first The second container adopts a shared memory communication method to generate a shared memory file, and the shared memory file is used to provide shared memory for the first container to communicate with the second container in the host's memory.

The method for communication between containers provided by the present application, the first container and the second container adopt Unix The domain socket communicates, the communication speed is fast, and the security is good; the first container and the second container communicate by using a shared memory mode, and the communication performance is good and the quality is high.

In a second aspect, the present application provides another method for communication between containers, comprising: receiving file information of a communication file sent by an authentication module of a host, where the communication file includes a communication resource for communicating between the first container and the second container, The first container and the second container both mount a shared directory of the host, and the communication file is located in a shared directory of the host; the first container is in the shared directory of the host according to file information of the communication file. Determining the communication file; the first container communicates with the second container based on the communication file.

With reference to the second aspect, in a first possible implementation manner of the second aspect, before receiving the file information of the communication file sent by the authentication module of the host, the method further includes: sending, by the first container, the authentication module An authentication request for requesting communication with the second container, the first container and the second container are both located in the host.

In conjunction with the first possible implementation of the second aspect, in a second possible implementation of the second aspect, the authentication request carries a manner in which the first container communicates with the second container.

Optionally, the communication manner between the first container and the second container may be set in advance by a user.

With reference to the second aspect, the first or the second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the communication file includes: a socket file and/or a shared memory file, The set of interface files is used to describe that the first container communicates with the second container to provide a socket, and the shared memory file is used to provide shared memory for the first container to communicate with the second container in the host's memory.

In a third aspect, the present application provides an apparatus for inter-container communication for performing the method of any of the above first aspect or any of the possible implementations of the first aspect. In particular, the apparatus comprises means for performing the method of any of the above-described first aspect or any of the possible implementations of the first aspect.

In a fourth aspect, the present application provides an apparatus for inter-container communication for performing the method of any of the above-described second aspect or any of the possible implementations of the second aspect. In particular, the apparatus comprises means for performing the method of any of the above-described second aspect or any of the possible implementations of the second aspect.

In a fifth aspect, the present application provides an apparatus for inter-container communication, the apparatus comprising: a receiver, a transmitter, a memory, a processor, and a bus system. Wherein the receiver, the transmitter, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing the instructions stored by the memory to control the receiver to receive signals and control the sending Send a signal, And when the processor executes the instructions stored by the memory, the executing causes the processor to perform the method of the first aspect or any of the possible implementations of the first aspect.

In a sixth aspect, the present application provides an apparatus for inter-container communication, the apparatus comprising: a receiver, a transmitter, a memory, a processor, and a bus system. Wherein the receiver, the transmitter, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing the instructions stored by the memory to control the receiver to receive signals and control the sending The transmitter transmits a signal, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of any of the second aspect or any of the possible implementations of the second aspect.

In a seventh aspect, the application provides a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.

In an eighth aspect, the present application provides a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of any of the second aspect or any of the possible implementations of the second aspect.

DRAWINGS

FIG. 1 is a schematic diagram of a Linux system to which an embodiment of the present invention is applied.

FIG. 2 is a schematic flowchart of a method for communication between containers according to an embodiment of the present invention.

FIG. 3 is a schematic flowchart of another method for communication between containers according to an embodiment of the present invention.

FIG. 4 is a schematic flowchart of another method for communication between containers according to an embodiment of the present invention.

FIG. 5 is a schematic block diagram of an apparatus for communication between containers according to an embodiment of the present invention.

FIG. 6 is a schematic block diagram of another apparatus for communication between containers according to an embodiment of the present invention.

FIG. 7 is a schematic block diagram of another apparatus for communication between containers according to an embodiment of the present invention.

FIG. 8 is a schematic block diagram of another apparatus for communication between containers according to an embodiment of the present invention.

detailed description

Embodiments of the present application will be described below with reference to the accompanying drawings.

FIG. 1 shows a schematic diagram of a Linux system 100 to which an embodiment of the present invention is applied. The Linux system can include an authentication module and a plurality of containers. Optionally, due to the namespace isolation mechanism of the Linux operating system, all the containers in the Linux system share the same kernel, and the host of the Linux system provides a virtual environment with its own process and network space for each container. The internal applications of multiple containers in the system are isolated from each other and do not interfere with each other.

FIG. 1 exemplarily shows an authentication module 110, a container 121, and a container 122. Alternatively, the Linux system may include other containers in the host, which is not limited by the embodiment of the present invention.

The authentication module 110 is configured to receive an authentication request of the container 121 by using an authentication channel, where the authentication request is used to request communication with the container 122; according to the authentication request, determining the authority of the container 121 to communicate with the container 122, that is, determining the container 121 and whether the container 122 is a trusted container; if the container 121 and the container 122 are both trusted containers, generating a communication file for communicating between the two containers, the communication file includes communication resources for communicating between the two containers, and The file information of the communication file is sent to the container 121 and the container 122 through the authentication channel, respectively, so that the two containers find the communication file in the shared directory of the host according to the file information of the communication file, and perform the container between the containers through the communication file. Communication.

The container 121 and the container 122 are configured to receive the file information of the communication file sent by the authentication module 110, determine the communication file in the host shared directory that is respectively mounted, and perform communication according to the communication file.

Optionally, the container 121 may request to communicate with the container 122, and the container 122 may also request to communicate with the container 121, which is not limited by the embodiment of the present invention.

Optionally, the container 121 may also request to communicate with other containers in the host, and the other containers may be one or more. The authentication module may send file information of the communication file to all containers having communication rights, such that one or A plurality of the other containers may communicate with each other between the container 121 and the container 122, which is not limited in the embodiment of the present invention.

It should be understood that before the container 121 sends an authentication request for communication with the container 122 to the host authentication module, the container 121 and the container 122 should first mount the shared directory of the host, so that the container 121 and the container 122 can read the shared directory of the host. . The mounting process can be implemented by software, so that the container 121 and the container 122 can shield the details of the physical partition of the host, and use the logical concept uniformly, that is, everything is a file.

FIG. 2 illustrates a method 200 for inter-container communication provided by an embodiment of the present invention. The method 200 for inter-container communication can be applied to the host system 100 shown in FIG. 1, but the embodiment of the present invention is not limited thereto.

S210. The first container sends an authentication request to the authentication module of the host, where the authentication request is used to request to communicate with the second container.

It should be understood that the first container may request to establish communication with one or more containers, and the embodiment of the present invention only describes the communication of the embodiment of the present invention by taking the first container request to establish communication with the second container. The embodiment of the present invention is not limited thereto. The first container and the second container are located on the same host, and the first container and the second container both mount a shared directory of the host, so that the first container and the second container can be read. Take the host memory.

Optionally, the authentication request may carry the identifier of the first container and the identifier of the second container.

S220. The authentication module generates a communication file in the shared directory of the host according to the authentication request sent by the first container, where the communication file may include a communication resource that the first container communicates with the second container.

Optionally, the first container and the second container may communicate in various manners, for example, by Unix domain socket communication, or by shared memory, or through a Unix domain socket and The shared memory communicates in two ways, which is not limited in this embodiment of the present invention.

It should be understood that the communication between the two communicating containers may be determined by the user. If the user requests the performance and quality of the communication, the shared memory communication mode may be selected; if the user requests the communication speed and security, then The communication mode of the Unix domain socket may be selected, or other communication modes may be used according to actual needs, which is not limited in the embodiment of the present invention.

Optionally, the communication manner between the first container and the second container may be carried in the authentication request of the first container, the communication mode is obtained by the authentication module, and the communication file is generated according to the authentication request, and may also be according to actual needs. The communication mode used is set in advance in the authentication module, which is not limited in this embodiment of the present invention.

As an optional embodiment, if it is determined that the first container and the second container use a Unix domain socket communication manner, the authentication module may generate a communication file in the host shared directory, and the communication file may be, for example, a set. An interface file, the socket file describes a socket for the authentication module to perform communication distribution between the first container and the second container.

As another optional embodiment, if it is determined that the first container and the second container use a shared memory communication manner, the authentication module may generate a communication file in the host shared directory, and the communication file may be, for example, a shared memory. A file, the shared memory file can be determined in the memory of the host as shared memory allocated by the first container to communicate with the second container. Optionally, the allocated shared memory may be a host memory other than the host memory occupied by the first container and the second container.

Optionally, before S220, the authentication module may determine, according to the identifier of the first container and the identifier of the second container carried in the authentication request, whether the first container and the second container have Communication authority, if the first container has communication authority with the second container, generating a communication file, the communication file including a communication resource that the first container communicates with the second container.

As an optional embodiment, the authentication module may preset a list of trusted containers, where all trusted containers in the host are listed, and the identifier of the first container and the second container are sent according to the authentication module. And determining whether the first container and the second container that need to establish communication are in the trusted container list, that is, determining whether the first container and the second container are both trusted containers, if the first container And the second container is a trusted container, and the first container and the second container have the right to communicate with each other. As another optional embodiment, the authentication module may also establish a communication list in which all containers in the host that can communicate with each other are listed, and the first container and the first are determined according to the communication list. Whether the second container has communication authority, but the embodiment of the present invention is not limited thereto.

Optionally, the authentication module may configure the authentication module by using a mandatory access control technology, for example, by using Security Enhanced Linux (SE Linux) technology or Security App (Apparmor) technology, so that the communication file is The access rights are only open to the container of the access rights, but the embodiment of the invention is not limited thereto.

S230. The authentication module sends file information of the communication file to the first container and the second container.

Optionally, the file information of the communication file may include a file name of the communication file.

Optionally, the authentication module may separately send the file information of the communication file to the first container and the second container, and may also send the file name of the communication file to all containers having communication rights in a broadcast manner. The embodiment of the invention is not limited thereto.

As an optional embodiment, if the authentication module generates a socket file, the file name of the socket file may be sent to the first container and the second container, and if the authentication module generates a shared memory file, And sending the file information of the shared memory file to the first container and the second container, where the file information of the shared memory file may include a file name, and optionally, the file information of the shared memory file may further include the shared memory file. The starting address and length of the shared memory, through the file information of the shared memory file, the specific memory allocated by the authentication module for the container communication can be determined.

S240. The first container and the second container respectively determine the communication file in the host shared directory that is mounted according to the file information of the communication file.

Optionally, the communication file may also be a file in a subdirectory of the shared directory, the communication file The file information may further include information indicating a path of a file in a subdirectory of the shared directory, but the embodiment of the present invention is not limited thereto.

S250. The first container and the second container communicate according to the communication file.

As an optional embodiment, when the first container communicates with the second container by using a Unix socket communication mode, a kernel channel is established through the socket file, and the socket file is read during communication to read the kernel channel. It does not need to go through the network protocol stack, package unpacking, etc., just copy the application layer data from one process to another, which is fast and safe.

In another optional embodiment, when the first container communicates with the second container in a shared memory communication manner, the communication is performed through a shared memory allocated in the host, and the data packet of the communication can pass through the ring buffer (ring -buffer) is exchanged, that is, a ring-buffer provides a service entry for a pair of communicating containers, assuming that the second container is the receiving end of the communication, and the first container is the transmitting end of the communication, then the first container is in the first container When the second container communicates, the receiving end can read the message from the head of the ring-buffer, and the sending end can send the message from the tail of the ring-buffer, and the communication performance is good and the quality is high. Optionally, the first container and the second container may also exchange data packets by using other buffers or other manners, which is not limited in this embodiment of the present invention.

It should be understood that when the first container and the second container perform communication in a shared memory communication manner, in addition to data exchange, a synchronization mechanism is needed to ensure that the first container and the second container are sent and received in the communication process. Synchronization of data messages.

As an optional embodiment, the first container and the second container may adopt a polling synchronization mechanism, and if the second container is a receiving end of the communication, the first container is a transmitting end of the communication, and the first container is in the first container When the second container communicates, the sending end only sends a message to the ring-buffer without notifying the receiving end, and the receiving end actively queries whether there is a data packet in the ring-buffer. If there is a data packet, the receiving end receives the packet. The terminal can read the message, otherwise, the receiving end continues to query.

The method for communicating between containers according to the embodiment of the present invention, the authentication module receives an authentication request sent by the first container for requesting communication of the second container, where the first container and the second container are located in the same host, and The first container and the second container both mount a shared directory of the host, and generate a communication file including the first container and the second container communication resource according to the authentication request, and send the communication file to the first container and the second container The container sends the file information of the communication file to enable communication between the two containers that are isolated from each other.

In the method for communication between containers according to the embodiment of the present invention, the first container and the second container communicate by using a Unix domain socket mode, and the communication speed is fast and the security is good; the first container and the second container are The device uses shared memory to communicate, and the communication performance is good and the quality is high.

FIG. 3 illustrates a method 300 for inter-container communication provided by an embodiment of the present invention. The method 300 for inter-container communication can be applied to the Linux system 100 shown in FIG. 1 and can be performed by the authentication module in FIG. 1.

S310. Receive an authentication request sent by the first container for requesting communication with the second container, where the first container and the second container are located on the same host, and the first container and the second container are both The shared directory of the host is mounted.

Specifically, the authentication module may receive an authentication request sent by the first container for requesting communication with a second container on the same host, where the first container and the second container both mount the host Shared directory.

Optionally, the authentication request may include an identifier of the first container and an identifier of the second container.

S320. Generate, according to the authentication request, a communication file in a shared directory of the host, where the communication file includes a communication resource that the first container communicates with the second container.

Specifically, the authentication module may determine, according to the authentication request sent by the first container, a communication manner between the first container and the second container, and determine the first container and the first according to a specific communication manner. The second container generates a communication file that includes communication resources for communication such that the first container and the second container can communicate based on communication resources in the communication file.

Specifically, as an optional embodiment, if it is determined that the first container and the second container use a Unix domain socket communication manner, the authentication module may generate a communication file in the host shared directory, and the communication file For example, it may be a socket file, and the socket file describes a socket for the authentication module to perform communication distribution between the first container and the second container.

Specifically, before S310, the authentication module may determine, according to the authentication request, the communication authority of the first container and the second container, and the communication permission between the containers is only open to the container that is granted the permission.

Optionally, the authentication module may determine, according to the authentication request, the first container and the second container Whether the device is in the default trusted container list, if yes, it indicates that the first container and the second container are both trusted lists and have communication authority.

Optionally, if at least one of the first container and the second container is not in the trusted container list preset by the authentication module, it indicates that there may be a malicious container, and the two containers cannot be granted the right to communicate. Therefore, The communication file is not generated for the first container and the second container.

Optionally, the authentication request may request to communicate with one or more second containers, the authentication module needs to authenticate all the containers in the request, when all the containers in the authentication request are trusted containers The communication file for communication may be generated for the first container and the one or more of the second containers, which is not limited by the embodiment of the present invention.

S330. Send file information of the communication file to the first container and the second container, so that the first container and the second container determine the communication file in a shared directory of the host according to the file information of the communication file. And communicate according to the communication file.

Specifically, after the communication module generates the communication file, the file information of the communication file may be sent to the first container and the second container, and information for indicating the communication resource is sent to the first container and the a second container, so that the first container and the second container determine a communication resource according to the indication information, and perform communication according to the communication resource.

Optionally, the authentication module may broadcast the communication information of the communication file to the first container and the second container, and may also separately send the first container to the second container, which is not used by the embodiment of the present invention. limited.

Optionally, the file information of the file may be a file name of the file, and may also be resource information included in the file.

Optionally, the communication file may also be a file in a subdirectory of the shared directory, and the file information of the communication file may further include information indicating a path of the file in the subdirectory of the shared directory, but the present invention implements The example is not limited to this.

In another optional embodiment, when the first container communicates with the second container in a shared memory communication manner, the communication is performed through a shared memory allocated in the host, and the communication data packet can pass through the ring-buffer. Mode exchange, that is, a ring-buffer provides a service entry for a pair of mutually communicating containers, assuming that the second container is the receiving end of the communication, and the first container is the transmitting end of the communication, then the first container and the second container are During communication, the receiving end can read the message from the head of the ring-buffer, and the transmitting end can send the message from the tail of the ring-buffer, and the communication performance is good and the quality is high. Optionally, the first container and the second container may also exchange data packets by using other buffers or other manners, which is not limited in this embodiment of the present invention.

In the method for communicating between containers according to the embodiment of the present invention, the first container and the second container communicate by using a Unix domain socket mode, and the communication speed is fast and the security is good; the first container is shared with the second container. Communication in memory mode, communication performance is good, and quality is high.

FIG. 4 illustrates a method 400 for inter-container communication provided by an embodiment of the present invention. The method 400 for inter-container communication can be applied to the Linux system 100 shown in FIG. 1.

S410: Receive file information of a communication file sent by an authentication module of the host, where the communication file includes a communication resource that the first container communicates with the second container, where the first container and the second container both mount the host Shared directory, and the communication file is located under the shared directory of the host.

It should be understood that a plurality of mutually isolated containers may be included in the same host, and the multiple containers are mutually transparent due to the Linux Namespace mechanism. The plurality of containers can mount the shared directory of the host, so that each container and the host can communicate with each other and read the files in the shared directory.

Specifically, the plurality of containers in the host may receive file information sent by the authentication module for indicating a communication file of the communication resource, where the communication is located in a shared directory of the host that is mounted by the plurality of containers, the plurality of The container may determine, according to the file information, a communication resource allocated by the authentication module for communication between the plurality of containers, and the plurality of containers may establish communication with each other according to the communication resource.

As an alternative embodiment, prior to S410, a first one of the plurality of containers may send an authentication request to the authentication module to request communication with the second container.

Optionally, the authentication request may include the identifier of the first container that identifies the second container, so that the authentication module authenticates the first container and the second container according to the authentication request.

Optionally, the second container may be one or more, which is not limited by the embodiment of the present invention.

S420. The first container determines the communication file according to the information of the communication file.

Specifically, both the first container and the second container may determine the communication file according to the information of the communication file, and the communication file includes a communication resource that the first container communicates with the second container.

Optionally, the resource information of the communication file may be a file name of the communication file, and may also be identifier information of the communication file or attribute information of the communication file, etc., and may be used for determining the first container and the second container. The information of the communication file is not limited in this embodiment of the present invention.

S430. The first container communicates with the second container according to the communication file.

In particular, the first container and the second container can communicate in accordance with the communication file, the communication file including communication resources for communication.

As an optional embodiment, when the first container communicates with the second container by using a Unix socket communication mode, a kernel channel is established through a socket provided by the socket file, and the socket file is read during communication. Read the kernel channel, do not need to go through the network protocol stack, package unpacking, etc., just copy the application layer data from one process to another, fast, and high security.

The method for communicating between containers according to the embodiment of the present invention, by receiving file information of a communication file sent by an authentication module, the communication file includes communication resources of the first container and the second container located in the same host, and the A container and the second container both mount a shared directory of the host, the first container determines the communication file according to the file information of the communication file, and communicates with the second container through the communication file, thereby being able to isolate each other Communicate between the two containers.

It should be understood that the size of the sequence numbers of the above processes does not imply a sequence of executions, and the order of execution of the processes should be determined by its function and internal logic, and should not be construed as limiting the implementation process of the embodiments of the present invention.

The method of communication between containers according to an embodiment of the present invention is described in detail above with reference to FIGS. 1 through 4. Hereinafter, an apparatus for communication between containers according to an embodiment of the present invention will be described in detail with reference to FIGS. 5 through 8.

FIG. 5 shows an apparatus 500 for communication between containers according to an embodiment of the present invention. The apparatus 500 includes:

The receiving unit 510 is configured to receive an authentication request sent by the first container for requesting communication with the second container, where the first container and the second container are located on the same host, and the first container is The second container both mounts the shared directory of the host;

The generating unit 520 is configured to generate, according to the authentication request received by the receiving unit 510, a communication file in a shared directory of the host, where the communication file includes a communication resource that the first container communicates with the second container;

The sending unit 530 is configured to send, to the first container and the second container, file information of the communication file generated by the generating unit 520, so that the first container and the second container are in accordance with file information of the communication file. The communication file is determined under the shared directory of the host, and communication is performed according to the communication file.

Optionally, the apparatus 500 further includes: a determining unit, configured to determine, according to the authentication request, the first container and the authentication file according to the authentication request, before generating the communication file in the shared directory of the host Whether the second container is in the preset trusted container list, wherein the authentication request carries the identifier of the first container and the identifier of the second container; if the first container and the second container are both in the In the set of trusted containers, it is determined that the first container has the right to communicate with the second container.

Optionally, the generating unit 520 is specifically configured to: according to the authentication request, determine a communication manner between the first container and the second container; and generate the communication file according to the communication manner.

Optionally, if it is determined that the first container and the second container use a Unix domain socket communication manner, the generating unit 520 generates a socket file, where the socket file is used for the first container and the second The container is configured to provide a socket; and/or, if it is determined that the first container and the second container are in a shared memory communication manner, the generating unit 520 generates a shared memory file, the shared memory file is used in the host memory Providing shared memory for the first container to communicate with the second container.

It should be understood that the apparatus 500 herein is embodied in the form of a functional unit. The term "unit" herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor for executing one or more software or firmware programs (eg, a shared processor, a proprietary processor, or a group). Processors, etc.) and memory, merge logic, and/or other suitable components that support the described functionality. In an alternative example, those skilled in the art will appreciate that device 500 The device may be specifically configured as the authentication module in the foregoing embodiment, and the device 500 may be used to perform various processes and/or steps corresponding to the authentication module in the foregoing method embodiment. To avoid repetition, details are not described herein again.

FIG. 6 shows an apparatus 600 for inter-container communication provided by an embodiment of the present invention. The apparatus 600 includes:

The receiving unit 610 is configured to receive file information of the communication file sent by the authentication module of the host, where the communication file includes a communication resource that the first container communicates with the second container, and the first container and the second container are both mounted. a shared directory of the host, and the communication file is located in a shared directory of the host;

a determining unit 620, configured to determine, by the first container, the communication file in a shared directory of the host according to the file information of the communication file received by the receiving unit 610;

The communication unit 630 is configured to communicate with the second container according to the communication file determined by the determining unit 620.

Optionally, the apparatus 600 further includes: a sending unit, where the sending unit is configured to send an authentication request to the authentication module before receiving the file information of the communication file sent by the authentication module of the host, where The authentication request is for requesting communication with the second container, and the first container and the second container are both located in the host.

Optionally, the authentication request carries a manner in which the first container communicates with the second container.

Optionally, the communication file includes: a socket file and/or a shared memory file, where the socket file is used to provide a socket for the first container to communicate with the second container, where the shared memory file is used in the host The memory provides shared memory for the first container to communicate with the second container.

It should be understood that the apparatus 600 herein is embodied in the form of a functional unit. The term "unit" herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor for executing one or more software or firmware programs (eg, a shared processor, a proprietary processor, or a group). Processors, etc.) and memory, merge logic, and/or other suitable components that support the described functionality. In an alternative example, those skilled in the art may understand that the device 600 may be specifically the container in the above embodiment, and the device 600 may be used to perform various processes and/or steps corresponding to the container in the foregoing method embodiment, in order to avoid Repeat, no longer repeat them here.

FIG. 7 illustrates an apparatus 700 for inter-container communication provided by an embodiment of the present invention. The apparatus 700 includes a receiver 710, a processor 720, a transmitter 730, a memory 740, and a bus system 750. The receiver 710, the processor 720, the transmitter 730, and the memory 740 are connected by a bus system 750 for storing instructions for executing the fingers stored in the memory 740. To control the receiver 710 to receive a signal and control the transmitter 730 to send an instruction.

The receiver 710 is configured to receive an authentication request sent by the first container for requesting communication with the second container, where the first container and the second container are located on the same host, and the first container And sharing a shared directory of the host with the second container;

The processor 720 is configured to generate, according to the authentication request received by the receiver 710, a communication file in a shared directory of the host, where the communication file includes a communication resource that the first container communicates with the second container;

The transmitter 730 is configured to send, to the first container and the second container, file information of the communication file generated by the processor 720, so that the first container and the second container are in accordance with file information of the communication file. The communication file is determined under the shared directory of the host, and communication is performed according to the communication file.

Optionally, the processor 720 is specifically configured to: according to the authentication request, determine a communication manner between the first container and the second container; and generate the communication file according to the communication manner.

Optionally, if it is determined that the first container and the second container use a Unix domain socket communication manner, the processor 720 generates a socket file, where the socket file is used to describe the first container and the second a socket for communicating with the container; and/or, if it is determined that the first container and the second container are in shared memory, the processor 720 generates a shared memory file for use in the memory of the host Providing shared memory for the first container to communicate with the second container.

Optionally, the processor 720 is further configured to determine, according to the authentication request, whether the first container and the second container are preset before generating the communication file in the shared directory of the host according to the authentication request. The trusted container list, wherein the authentication request carries the identifier of the first container and the identifier of the second container; if the first container and the second container are both in the preset trusted container list, Then determining that the first container has the right to communicate with the second container.

It should be understood that the device 700 may be specifically the terminal device in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the terminal device in the foregoing method embodiments. Alternatively, the memory 740 can include read only memory and random access memory and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory can also store information of the device type. The processor 720 can be configured to execute instructions stored in a memory, and when the processor executes the instructions, the processor can perform various steps corresponding to the terminal device in the above method embodiments.

FIG. 8 shows an apparatus 800 for inter-container communication provided by an embodiment of the present invention. The device 800 packs A receiver 810, a processor 820, a transmitter 830, a memory 840, and a bus system 850 are included. The receiver 810, the processor 820, the transmitter 830, and the memory 840 are connected by a bus system 850 for storing instructions for executing instructions stored in the memory 840 to control the receiver 810. A signal is received and the transmitter 830 is controlled to transmit a signal.

The receiver 810 is configured to receive file information of a communication file sent by an authentication module of the host, where the communication file includes a communication resource that the first container communicates with the second container, where the first container and the second container are both The shared directory of the host is loaded, and the communication file is located in the shared directory of the host;

The processor 820 is configured to determine, by the first container, the communication file according to the file information of the communication file received by the receiver 810 in a shared directory of the host; and the communication file determined according to the processor, and the first The second container communicates.

Optionally, the sender 830 is configured to send an authentication request to the authentication module before receiving the file information of the communication file sent by the authentication module of the host, where the authentication request is used to request the first The second container is in communication, and the first container and the second container are both located in the host.

Optionally, the communication file includes: a socket file and/or a shared memory file, the socket file is used to describe a socket for communicating between the first container and the second container, and the shared memory file is used in the host The shared memory is allocated in memory for the first container to communicate with the second container.

It should be understood that the device 800 may be specifically the network device in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the network device in the foregoing method embodiments. Optionally, the memory 840 can include read only memory and random access memory and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory can also store information of the device type. The processor 820 can be configured to execute instructions stored in a memory, and when the processor executes instructions stored in the memory, the processor is operative to perform various steps and/or processes of the method embodiments described above.

It should be understood that, in the embodiment of the present invention, the processor may be a central processing unit (CPU), and the processor may also be other general purpose processors, digital signal processors (DSPs), and application specific integrated circuits (ASICs). ), off-the-shelf programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the like. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

In the implementation process, each step of the above method can pass the integration logic of the hardware in the processor. Instructions in the form of circuits or software are completed. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in a memory, and the processor executes instructions in the memory, in combination with hardware to perform the steps of the above method. To avoid repetition, it will not be described in detail here.

Those skilled in the art will appreciate that the various method steps and elements described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the steps and composition of the various embodiments have been generally described in terms of function in the foregoing description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. Different methods may be used to implement the described functionality for each particular application, but such implementation should not be considered to be beyond the scope of the application.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be in essence or part of the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a USB flash drive, a mobile hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a disk or a CD. A variety of media that can store program code.

The foregoing is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto, and any equivalents can be easily conceived by those skilled in the art within the technical scope disclosed in the present application. Modifications or substitutions are intended to be included within the scope of the present application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

Claims

A method for communication between containers, comprising:

Receiving, by the first container, an authentication request for requesting communication with the second container, wherein the first container and the second container are located on the same host, and the first container and the second The container is mounted with a shared directory of the host;

And generating, according to the authentication request, a communication file under a shared directory of the host, where the communication file includes a communication resource that the first container communicates with the second container;

Transmitting file information of the communication file to the first container and the second container, so that the first container and the second container are in a shared directory of the host according to file information of the communication file. The communication file is determined and communicated according to the communication file.
The method according to claim 1, wherein before the generating a communication file in the shared directory of the host according to the authentication request, the method further includes:

Determining, according to the authentication request, whether the first container and the second container are in a preset trusted container list, wherein the authentication request carries the identifier of the first container and the second The identity of the container;

And if the first container and the second container are both in the preset trusted container list, determining that the first container has the right to communicate with the second container.
The method according to claim 1 or 2, wherein the generating a communication file in the shared directory of the host according to the authentication request comprises:

Determining, according to the authentication request, a manner of communication between the first container and the second container;

The communication file is generated according to the communication method.
The method according to claim 3, wherein the generating the communication file according to the communication manner comprises:

If it is determined that the first container and the second container use a Unix domain socket communication manner, generating a socket file, where the socket file is used to communicate the first container with the second container Providing a socket; and/or

If it is determined that the first container and the second container adopt a shared memory communication manner, generating a shared memory file, where the shared memory file is used in the memory of the host as the first container and the first The second container communicates to provide shared memory.
A method for communication between containers, comprising:

Receiving file information of a communication file sent by an authentication module of the host, where the communication file includes a communication resource in communication between the container and the second container, wherein the first container and the second container both mount a shared directory of the host, and the communication file is located in a shared directory of the host;

Determining, by the first container, the communication file in a shared directory of the host according to file information of the communication file;

The first container communicates with the second container in accordance with the communication file.
The method according to claim 5, wherein before the receiving the file information of the communication file sent by the authentication module of the host, the method further comprises:

The first container sends an authentication request to the authentication module, where the authentication request is used to request communication with the second container, where the first container and the second container are both located in the host .
The method of claim 6 wherein said authentication request carries a manner of communication between said first container and said second container.
The method according to any one of claims 5 to 7, wherein the communication file comprises: a socket file and/or a shared memory file, the socket file being used for the first container and the The second container communicates to provide a socket, and the shared memory file is configured to provide shared memory for the first container to communicate with the second container in the memory of the host.
An apparatus for communication between containers, comprising:

a receiving unit, configured to receive an authentication request sent by the first container for requesting communication with the second container, where the first container and the second container are located on the same host, and the first container And sharing a shared directory of the host with the second container;

a generating unit, configured to generate, according to the authentication request received by the receiving unit, a communication file in a shared directory of the host, where the communication file includes communication that the first container communicates with the second container Resource

a sending unit, configured to send, to the first container and the second container, file information of the communication file generated by the generating unit, so that the first container and the second container are in accordance with the communication file File information, the communication file is determined under a shared directory of the host, and communication is performed according to the communication file.
The apparatus according to claim 9, wherein said apparatus further comprises: a determining unit,

The determining unit is configured to determine, according to the authentication request, whether the first container and the second container are in the request according to the authentication request, before generating a communication file in a shared directory of the host a preset trusted container list, wherein the authentication request carries a label of the first container Identifying the identity of the second container;

And if the first container and the second container are both in the preset trusted container list, determining that the first container has the right to communicate with the second container.
The device according to claim 9 or 10, wherein the generating unit is specifically configured to:

Determining, according to the authentication request, a manner of communication between the first container and the second container;

The communication file is generated according to the communication method.
The device according to claim 11, wherein the generating unit is specifically configured to:

If it is determined that the first container and the second container use a Unix domain socket communication manner, generating a socket file, where the socket file is used to communicate the first container with the second container Providing a socket; and/or

If it is determined that the first container and the second container adopt a shared memory communication manner, generating a shared memory file, where the shared memory file is used in the memory of the host as the first container and the first The second container communicates to provide shared memory.
An apparatus for communication between containers, comprising:

a receiving unit, configured to receive file information of a communication file sent by an authentication module of the host, where the communication file includes a communication resource that the first container communicates with the second container, where the first container and the second container are both Carrying a shared directory of the host, and the communication file is located under a shared directory of the host;

a determining unit, configured to determine, by the first container, the communication file in a shared directory of the host according to file information of the communication file received by the receiving unit;

a communication unit, configured to communicate with the second container by the first container according to the communication file determined by the determining unit.
The device according to claim 13, wherein the device further comprises: a transmitting unit,

The sending unit is configured to: before the file information of the communication file sent by the authentication module of the receiving host, the first container sends an authentication request to the authentication module, where the authentication request is used for requesting The second container communicates, the first container and the second container being both located in the host.
The device according to claim 14, wherein said authentication request carrying station The manner in which the first container communicates with the second container is described.
The apparatus according to any one of claims 13 to 15, wherein the communication file comprises: a socket file and/or a shared memory file, the socket file being used for the first container and the The second container communicates to provide a socket, and the shared memory file is configured to provide shared memory for the first container to communicate with the second container in the memory of the host.
An apparatus for communication between containers, comprising: a receiver, a transmitter, a processor, and a memory, wherein the memory is for storing an instruction, and the processor is configured to invoke the instruction to perform the following processing:

Receiving, by the receiver, an authentication request sent by the first container for requesting communication with the second container, wherein the first container and the second container are located on the same host, and the first container And sharing a shared directory of the host with the second container;

And generating, according to the authentication request received by the receiver, a communication file in a shared directory of the host, where the communication file includes a communication resource that the first container communicates with the second container;

Transmitting, by the sender, file information of the communication file generated by the processor to the first container and the second container, so that the first container and the second container are in accordance with the communication file File information, the communication file is determined under a shared directory of the host, and communication is performed according to the communication file.
The device according to claim 17, wherein the processor is further configured to:

Before the generating the communication file in the shared directory of the host according to the authentication request, determining, according to the authentication request, whether the first container and the second container are in a preset trusted container In the list, wherein the authentication request carries an identifier of the first container and an identifier of the second container;

And if the first container and the second container are both in the preset trusted container list, determining that the first container has the right to communicate with the second container.
The device according to claim 17 or 18, wherein the processor is specifically configured to:

Determining, according to the authentication request, a manner of communication between the first container and the second container;

The communication file is generated according to the communication method.
The device according to claim 19, wherein the processor is specifically configured to:

If it is determined that the first container and the second container use a Unix domain socket communication manner, Generating a socket file, the socket file being used to provide a socket for communication between the first container and the second container; and/or

If it is determined that the first container and the second container adopt a shared memory communication manner, generating a shared memory file, where the shared memory file is used in the memory of the host as the first container and the first The second container communicates to provide shared memory.
An apparatus for communication between containers, comprising: a receiver, a transmitter, a processor, and a memory, wherein the memory is for storing an instruction, and the processor is configured to invoke the instruction to perform the following processing:

Receiving, by the receiver, file information of a communication file sent by an authentication module of the host, where the communication file includes a communication resource that the first container communicates with the second container, where the first container and the second container are both Carrying a shared directory of the host, and the communication file is located under a shared directory of the host;

Determining, according to file information of the communication file received by the receiver, the communication file under a shared directory of the host;

Communicating with the second container via the receiver and/or the transmitter in accordance with the communication file determined by the processor.
The device according to claim 21, wherein the transmitter is specifically configured to:

Sending an authentication request to the authentication module, where the authentication request is used to request communication with the second container, before the file information of the communication file sent by the authentication module of the receiving host Both the container and the second container are located in the host.
The apparatus of claim 22 wherein said authentication request carries a manner of communication between said first container and said second container.
The apparatus according to any one of claims 21 to 23, wherein the communication file comprises: a socket file and/or a shared memory file, the socket file being used for the first container and the The second container communicates to provide a socket, and the shared memory file is configured to provide shared memory for the first container to communicate with the second container in the memory of the host.