WO2017101252A1

WO2017101252A1 - Docker-based container login method, server and system

Info

Publication number: WO2017101252A1
Application number: PCT/CN2016/082406
Authority: WO
Inventors: 梅平; 杨帝海; 伍宏先; 赵亮
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2015-12-17
Filing date: 2016-05-17
Publication date: 2017-06-22
Also published as: CN106899544B; CN106899544A

Abstract

A Docker-based container login method, comprising: receiving a container entering command, wherein the container entering command comprises login information; opening a virtual terminal by means of a command of an SSH protocol, and connecting same to a Docker physical machine corresponding to the login information; and entering, by means of the virtual terminal, a container corresponding to the login information.

Description

Docker-based container login method, server and system

This application claims priority to Chinese Patent Application No. 201510955719.5, entitled "Docker-Based Container Registration Method, Apparatus and System" on December 17, 2015, the entire contents of which are incorporated by reference. In this application.

[Technical Field]

The present invention relates to the field of security technologies, and in particular, to a Docker-based container login method, server, and system.

【Background technique】

Docker is an open source application container engine that allows developers to package applications and dependencies into a portable container and then publish them to any popular Linux. Virtualization can also be implemented on the machine. After the business program is deployed in the Docker container, the IP address of the container is usually invisible to the outside world. There is no way to log in directly.

Some of the existing login methods are to log in directly to the Docker physical machine and then enter the container through commands. When multiple services are deployed in a Docker physical machine, the containers of each service are placed on a Docker physical machine, and the physical machine login permission is opened, which poses a great security risk. Some use the webshell login method, which is equivalent to opening a back door to log in to the container, and security is difficult to guarantee.

[Summary of the Invention]

In accordance with various embodiments disclosed herein, a Docker based container login method, server, and system are provided.

A Docker-based container login method that includes:

Receiving a container entry command, the container entry command including login information;

The virtual terminal is connected to the Docker physical machine corresponding to the login information by using a command of the SSH protocol; and

Entering, by the virtual terminal, a container corresponding to the login information.

A first server includes a memory and a processor, the memory storing instructions that, when executed by the processor, cause the processor to perform the following steps:

A Docker-based container login system that includes:

a first server, configured to receive a container entry command, where the container entry command includes login information,

The first server is further configured to open a virtual terminal connection and a Docker physical machine corresponding to the login information by using a command of the SSH protocol;

Docker physical machine for running containers;

The first server is further configured to enter a container corresponding to the login information by using the virtual terminal.

Details of one or more embodiments of the invention are set forth in the accompanying drawings and description below. Other features, objects, and advantages of the invention will be apparent from the description and appended claims.

[Description of the Drawings]

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is an application environment diagram of a Docker-based container login method in an embodiment;

Figure 2 is a diagram showing the internal structure of the first server of Figure 1 in an embodiment;

3 is a flow chart of a Docker-based container login method in one embodiment;

4 is a flow chart of a Docker-based container login method in another embodiment;

5 is a structural block diagram of a Docker-based container login system in one embodiment;

6 is a structural block diagram of a Docker-based container login system in another embodiment;

7 is a structural block diagram of a Docker-based container login device in one embodiment;

8 is a structural block diagram of a Docker-based container login device in another embodiment;

FIG. 9 is a structural block diagram of a Docker-based container login apparatus in still another embodiment.

【detailed description】

FIG. 1 is an application environment diagram of a Docker-based container login method in an embodiment. As shown in FIG. 1, the application environment includes a first server 110 and a Docker physical machine 120, wherein the first server 110 and the Docker physical machine 120 communicate over a network.

The first server 110 is generally the starting machine of the login server, and can be a springboard. The Docker physical machine 120 can run multiple containers, each of which corresponds to a different service. The first server 110 establishes a connection with the Docker physical machine 120 according to the received command and enters the corresponding container on the Docker physical machine through the virtual terminal.

In one embodiment, the internal structure of the first server 110 of FIG. 1 is as shown in FIG. 2. The first server 110 includes a processor, an internal memory, a non-volatile storage medium, and a network interface connected by a system bus. The non-volatile storage medium of the first server 110 stores an operating system and a Docker-based container login device, and the Docker-based container login device is used to implement a Docker-based container login method suitable for the first server 110. . The processor of the first server 110 is configured to provide computing and control capabilities configured to perform a Docker based container login method. The network interface of the first server 110 is used to communicate with the Docker physical machine 120 over a network connection, such as a container entering the Docker physical machine 120.

As shown in FIG. 3, in an embodiment, a Docker-based container login method is provided to be applied to the first server 110 in the application environment, and the following steps are included:

Step S210, receiving a container entry command, and the container entry command includes login information.

Specifically, a container access command tool is provided to receive the container entry command, and the container access command tool is installed in the first server 110, and the container access command can be directly received through the first server 110, or can be accessed through the terminal first and through the SSH command. A server 110 then receives the container entry command. SSH ( Secure Shell , the security shell protocol) is a security protocol based on the application layer and the transport layer, is logged in to the first server 110 by using an SSH command, and is installed in the first server 110 because the container access command tool is installed, and only the first server 110 is logged in to input The container enters the command, increasing the security of the receipt of the container into the command. The login information can be customized as needed. For example, the login information is the container name, and the container name needs to be determined by the container name. If the received container enters the command as "go container name".

In step S220, the virtual terminal is connected to the Docker physical machine corresponding to the login information by using the command of the SSH protocol.

Specifically, the -t command of the SSH protocol is used to open a virtual terminal connection to the Docker physical machine corresponding to the login information. The Docker physical machine corresponding to the login information can be obtained by the container name, such as determining the IP of the container by the container name, and then obtaining the corresponding Docker physical machine through the IP. By connecting the Docker physical machine through the virtual terminal, there is no need to log in to the Docker physical machine. When multiple services are deployed on the Docker physical machine, the login permission of the Docker physical machine is not required to be opened, thereby improving the security of the login. When receiving the container entry command, the SSH protocol command will be automatically executed to open the virtual terminal and connect to the Docker physical machine. No need to manually input any information, which improves the convenience of login. And this method of connecting to the Docker physical machine through the virtual terminal to log in through the subsequent steps is mandatory and cannot be changed, and the security of the login is ensured.

Step S230, the container corresponding to the login information is entered through the virtual terminal.

Specifically, the execution of the docker exec command enters the inside of the container through the virtual terminal, and the command executed in step S220 and step S230 is “ssh -t 192.168.0.1”. "docker exec -ti my_container Bash", where 192.168.0.1 is the IP address of the container, and my_container is the name of the container received. The entire login process will not stay on the Docker physical machine, but through a virtual terminal, and then directly execute the Docker command to enter the container, because the user Did not stay on the Docker physical machine, even if multiple services are deployed on the Docker physical machine, because the logged-in user can not operate the Docker physical machine, the business will not be affected by the user's operation, which improves the security of the login. In the case of login security assurance, each service can be deployed on a Docker physical machine at the same time, which improves resource utilization and reduces machine cost.

In this embodiment, by receiving the container entry command, the container entry command includes login information, and the Docker physical machine corresponding to the login information is opened by the SSH protocol command, and the virtual terminal enters the container corresponding to the login information, and passes through the virtual terminal. Connect to the Docker physical machine, without logging in to the Docker physical machine, without opening the login permissions of the Docker physical machine, improving the security of the login.

In one embodiment, as shown in FIG. 4, a Docker-based container login method is provided.

The login information includes the container name, including the following steps:

Step S310, receiving a container entry command, and the container entry command includes login information.

Step S320: Acquire a currently logged-in user, and send an authentication request to the second server. The authentication request includes the container name and the information of the user, so that the second server determines the login right according to the authentication request.

Specifically, the user currently logged in is the user who logs in to the first server, and obtains the information of the currently logged-in user. The information of the user may include one or more of the user name, the level information, the time information, and the like, and the user information and the user information are carried. The authentication request of the container name is sent to the second server, and the second server stores the login authority corresponding to the user information and the container, and determines whether the user has the permission to log in to the container according to the user information and the container name, and if there is permission, returns The authentication result of the login permission, otherwise the authentication result without the login permission is returned.

Step S330, receiving the authentication result returned by the second server. If the authentication result is that there is login authority, the process proceeds to step S340, otherwise the login cannot be performed.

Specifically, only when the returned authentication result is that there is login permission, the container can be accessed through the subsequent steps. If there is no login permission, the login cannot be performed. The authentication of the login authority further improves the security of the login. Even if the container name is stolen and the user information does not match, the container cannot be accessed.

Step S340, the virtual terminal is connected to the Docker physical machine corresponding to the login information by using the command of the SSH protocol.

In step S350, the container corresponding to the login information is entered through the virtual terminal.

In an embodiment, after step S230, the method further comprises: when the container executes the exit instruction, exiting the container and directly returning to the local machine.

Specifically, when the container executes the "exit" exit command, the exit container will immediately return to the first server, and will not stay on the Docker physical machine, so that the user can not operate the Docker physical machine, thereby improving security.

In one embodiment, as shown in FIG. 5, a Docker-based container login system is provided, including:

The first server 410 is configured to receive a container entry command, and the container entry command includes login information.

Specifically, the first server 410 is installed with a container access command tool to receive the container entry command, and may directly receive the container entry command through the first server 110, or may be connected to the first server 110 through the SSH command and then received by the terminal. The container enters the command. SSH ( Secure Shell , the security shell protocol) is a security protocol based on the application layer and the transport layer, is logged in to the first server 410 by using an SSH command, and is installed in the first server 410 because the container access command tool is installed, and only the first server 410 is logged in to input. The container enters the command, increasing the security of the receipt of the container into the command. The login information can be customized as needed. For example, the login information is the container name, and the container name needs to be determined by the container name. If the received container enters the command as "go Container name."

The first server 410 is further configured to open a virtual terminal connection with a Docker physical machine corresponding to the login information by using a command of the SSH protocol.

Specifically, the first server 410 opens a virtual terminal connection to the Docker physical machine corresponding to the login information by using the -t command of the SSH protocol. The Docker physical machine corresponding to the login information can be obtained by the container name, such as determining the IP of the container by the container name, and then obtaining the corresponding Docker physical machine through the IP. By connecting the Docker physical machine through the virtual terminal, there is no need to log in to the Docker physical machine. When multiple services are deployed on the Docker physical machine, the login permission of the Docker physical machine is not required to be opened, thereby improving the security of the login. When receiving the container entry command, the SSH protocol command will be automatically executed to open the virtual terminal and connect to the Docker physical machine. No need to manually input any information, which improves the convenience of login. And this method of connecting to the Docker physical machine through the virtual terminal to log in through the subsequent steps is mandatory and cannot be changed, and the security of the login is ensured.

Docker physical machine 420 for running containers.

Specifically, a Docker physical machine 420 can run one or more containers. In one embodiment, there are multiple containers, each corresponding to a different service.

The first server 410 is further configured to enter a container corresponding to the login information by using the virtual terminal.

Specifically, the first server 410 executes the exec command of the docker to enter the inside of the container through the virtual terminal, and the command executed in step S220 and step S230 is “ssh-t”. 192.168.0.1 "docker exec -ti my_container Bash", where 192.168.0.1 is the IP address of the container, and my_container is the name of the container received. The entire login process will not stay on the Docker physical machine, but through a virtual terminal, and then directly execute the Docker command to enter the container, because the user Did not stay on the Docker physical machine, even if multiple services are deployed on the Docker physical machine, because the logged-in user can not operate the Docker physical machine, the business will not be affected by the user's operation, which improves the security of the login. In the case of login security assurance, each service can be deployed on a Docker physical machine at the same time, which improves resource utilization and reduces machine cost.

In this embodiment, the system consisting of the first server 410 and the Docker physical machine 420 receives the container entry command through the first server 410. The container entry command includes login information, and the Docker physics corresponding to the login information is opened by the SSH protocol command. The machine enters the container corresponding to the login information through the virtual terminal, and connects to the Docker physical machine through the virtual terminal, without logging in the Docker physical machine, and does not need to open the login right of the Docker physical machine, thereby improving the security of the login.

In one embodiment, the login information includes a container name. As shown in FIG. 6, the system further includes a second server 430. The first server is further configured to acquire a currently logged-in user, send an authentication request to the second server 430, and perform authentication. The request includes information about the container name and the user.

Specifically, the currently logged-in user is a user who logs in to the first server, and obtains information of the currently logged-in user, such as a user name, and sends an authentication request carrying the user information and the container name to the second server.

The second server 430 is configured to determine the login authority according to the authentication request, and return an authentication result to the first server.

Specifically, the second server stores the corresponding login permission between the user information and the container, and determines, according to the user information and the container name, whether the user has the permission to log in to the container, and if there is permission, returns the authentication result with the login permission, otherwise Returns the authentication result without login privileges.

The first server 410 is further configured to open the Docker physical machine corresponding to the login information by using the SSH protocol command if the authentication result is the login permission, otherwise the login cannot be performed.

Specifically, the first server 410 can open the Docker physical machine corresponding to the login information by using the SSH protocol command if the returned authentication result is the login permission. If the login permission is not available, the first server 410 cannot log in. The authentication of the login authority further improves the security of the login. Even if the container name is stolen and the user information does not match, the container cannot be accessed.

In one embodiment, the container is configured to exit and return directly to the first server when the exit instruction is executed.

Specifically, when the container executes the "exit" exit command, the container will be immediately returned to the first server and will not stay on the Docker physical machine, so that the user cannot operate the Docker physical machine, which improves the security.

In one embodiment, as shown in FIG. 7, a Docker-based container login device is provided, including:

The receiving module 510 is configured to receive a container entry command, and the container entry command includes login information.

The virtual terminal connection module 520 is configured to open a virtual terminal connection and a Docker physical machine corresponding to the login information by using a command of the SSH protocol.

The module 530 is configured to enter a container corresponding to the login information through the virtual terminal.

In one embodiment, as shown in FIG. 8, the login information includes a container name, and the device further includes:

The authentication module 540 is configured to obtain the currently logged-in user, and send an authentication request to the second server. The authentication request includes the container name and the user information, so that the second server determines the login permission according to the authentication request, and receives the second server to return. If the authentication result is that there is login permission, the virtual terminal connection module is entered, otherwise the login cannot be performed.

In an embodiment, as shown in FIG. 9, the device further includes:

The return module 550 is configured to exit the container and directly return to the local machine when the container executes the exit instruction.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, or a read-only storage memory (Read-Only) A nonvolatile storage medium such as a memory or a ROM, or a random access memory (RAM).

The technical features of the above-described embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be considered as the scope of this manual.

The above-described embodiments are merely illustrative of several embodiments of the present invention, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A Docker-based container login method that includes:

Receiving a container entry command, the container entry command including login information;

The virtual terminal is connected to the Docker physical machine corresponding to the login information by using a command of the SSH protocol; and

Entering, by the virtual terminal, a container corresponding to the login information.
The method according to claim 1, wherein the login information includes a container name, and after the step of the receiving container entering the command, the method further includes:

Obtaining the currently logged-in user, and sending the authentication request to the second server, where the authentication request includes the container name and the information of the user, so that the second server determines the login authority according to the authentication request;

Receiving the authentication result returned by the second server, if the authentication result is that there is a login right, the step of opening the virtual terminal to connect to the Docker physical machine corresponding to the login information by using the command of the SSH protocol, otherwise the login cannot be performed. .
The method according to claim 1, wherein the step of entering the container corresponding to the login information by the virtual terminal further comprises:

When the exit instruction is executed at the container, the container is exited and returned directly to the machine.
A first server includes a memory and a processor, the memory storing instructions that, when executed by the processor, cause the processor to perform the following steps:

Receiving a container entry command, the container entry command including login information;

The virtual terminal is connected to the Docker physical machine corresponding to the login information by using a command of the SSH protocol; and

Entering, by the virtual terminal, a container corresponding to the login information.
The first server of claim 4, wherein the login information comprises a container name, and when the instructions are executed by the processor, the processor further causes the processor to perform the following steps:

Obtaining the currently logged-in user, and sending the authentication request to the second server, where the authentication request includes the container name and the information of the user, so that the second server determines the login authority according to the authentication request;

Receiving the authentication result returned by the second server, if the authentication result is that there is a login right, the step of opening the virtual terminal to connect to the Docker physical machine corresponding to the login information by using the command of the SSH protocol, otherwise the login cannot be performed. .
The first server of claim 4 wherein said instructions, when executed by said processor, further cause said processor to perform the following steps:

When the exit instruction is executed at the container, the container is exited and returned directly to the machine.
A Docker-based container login system that includes:

a first server, configured to receive a container entry command, where the container entry command includes login information, and the first server is further configured to open a virtual terminal connection and a Docker physical machine corresponding to the login information by using a command of the SSH protocol;

Docker physical machine for running containers;

The first server is further configured to enter a container corresponding to the login information by using the virtual terminal.
The system of claim 7 wherein said login information comprises a container name and said system further comprises a second server:

The first server is further configured to acquire a currently logged-in user, and send an authentication request to the second server, where the authentication request includes the container name and information about the user;

The second server is configured to determine, according to the authentication request, a login right, and return an authentication result to the first server;

The first server is further configured to: if the authentication result is a login permission, open a virtual terminal connection to the Docker physical machine corresponding to the login information by using a command of the SSH protocol, otherwise the login cannot be performed.
The system of claim 7 wherein said container is operative to exit and return directly to said first server when an exit instruction is executed.
The system according to claim 7, wherein the plurality of containers are corresponding to different services.