WO2019024669A1 - Netlink资源的容器隔离方法及装置 - Google Patents

Netlink资源的容器隔离方法及装置 Download PDF

Info

Publication number
WO2019024669A1
WO2019024669A1 PCT/CN2018/095581 CN2018095581W WO2019024669A1 WO 2019024669 A1 WO2019024669 A1 WO 2019024669A1 CN 2018095581 W CN2018095581 W CN 2018095581W WO 2019024669 A1 WO2019024669 A1 WO 2019024669A1
Authority
WO
WIPO (PCT)
Prior art keywords
netlink
container
namespace
entry
kernel
Prior art date
Application number
PCT/CN2018/095581
Other languages
English (en)
French (fr)
Inventor
钟国城
张亮
杨坚锐
刘金苗
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18841240.7A priority Critical patent/EP3644182A4/en
Publication of WO2019024669A1 publication Critical patent/WO2019024669A1/zh
Priority to US16/777,516 priority patent/US11500666B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/542—Event management; Broadcasting; Multicasting; Notifications
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/30072—Arrangements for executing specific machine instructions to perform conditional operations, e.g. using predicates or guards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/545—Interprogram communication where tasks reside in different layers, e.g. user- and kernel-space
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present application relates to the field of computer networks, and in particular, to a container isolation method and apparatus for a netlink resource.
  • Linux containers are operating system-level virtualization technologies that isolate different Linux systems (also known as containers) that use the same Linux kernel on a host. It packages the application software system into a container, which can include user space. The user space is the storage area where the application runs. The execution of the application must depend on the resources provided by the kernel of the host where the container is located (such as CPU). Resources, storage resources, I/O resources).
  • the Linux namespace is used to isolate kernel resources allocated for different containers. This makes system resources such as process identifier (PID), inter-process communication (IPC) channel, and network forwarding entries not available. It is global, but belongs to a specific namespace. The resources in each namespace are opaque to other namespaces (ie, invisible). The namespace is simply to put resources into different namespaces. The resources in each namespace are isolated from each other, and the resources in each namespace are called by different processes. Generally, one container corresponds to one container namespace, and one container namespace can correspond to multiple containers. The container namespace can include one or more sub-namespaces.
  • FIG. 1 is a schematic diagram of a logical structure of an operating system. As shown in FIG. 1, the operating system is divided into a user space and a kernel.
  • the user space includes a container 1, a container 2, and a container 3.
  • the kernel includes a namespace 1 and a namespace 2.
  • the container 1 and the container 3 correspond to the namespace 1, and the container 2 corresponds to the namespace 2.
  • the namespace 1 and the named space 2 respectively send information of the corresponding container subscription to the container 1, the container 2 and the container 3 through the netlink message through the netlink message.
  • the namespace of the existing container cannot be isolated from the netlink message and is sent to multiple containers in the form of multicast or broadcast through the netlink message due to the update of the entry resources (such as arp, routing, interface, etc.) in the kernel.
  • the user space that is, the namespace 1 in Figure 1 is sent to the container 1 and the netlink message container 2 of the container 3 can be received. This causes all the containers sharing the kernel to receive the entry, causing the entries to flood.
  • the application provides a container isolation method and device for a netlink resource.
  • the isolation of the netlink resources is enabled. After the entries in the kernel are broadcasted through the netlink message, only the user space of the corresponding container will receive the entry, and all the processes sharing the kernel will receive the entry, resulting in an entry. Broadcast flooding.
  • a container isolation method for a netlink resource may include: the kernel receiving a trigger instruction sent by an application for creating a container.
  • the kernel creates a container corresponding to the application according to the trigger instruction, establishes a netlink namespace of the container, and sends a success notification of the netlink namespace creation to the application.
  • the kernel receives the first netlink message delivered by the container, and the first netlink message includes an entry generated by the container runtime.
  • the kernel stores the entry according to the identifier of the netlink namespace to send the entry required by the container to the user space of the container.
  • the method can isolate the netlink channel, reduce the broadcast storm of the netlink message, and improve the processing efficiency of the netlink multicast packet.
  • the method further includes: the kernel parsing the first netlink message, and obtaining the identifier of the netlink namespace, so as to synchronously store the received entry to the corresponding Isolation storage in the namespace.
  • the method further includes: determining, by the kernel, an identifier of a netlink namespace corresponding to the target entry in the entry.
  • the kernel determines the target network namespace based on the identity of the netlink namespace.
  • the kernel sends the target entry to the container's user space unicast or multicast according to the identifier of the target network namespace.
  • the target entry is all or part of the entry in the stored table entry.
  • the kernel sends the target entry to the container user space unicast or multicast according to the identifier of the target network namespace, including: the kernel creates the container according to the identifier of the target network namespace and the target entry. The transmission channel between the cores; the kernel sends the target entry unicast or multicast to the user space of the container through the channel.
  • the netlink message sent by the entry management system in the kernel is only received by the user space of the container that generates the entry in the netlink message, and the isolation of the netlink channel is implemented.
  • the method may further include: the kernel sending a second netlink message to the forwarding plane for inter-container communication, where the second netlink message includes a netlink namespace type and a target entry,
  • the forwarding plane obtains the identifier of the netlink namespace to which the target entry belongs, and determines the container corresponding to the target entry according to the identifier of the netlink namespace to which the target entry belongs.
  • the target entry is all or part of the stored entry. In this way, data forwarding in user space can be implemented to reduce data forwarding delay.
  • a container isolation device for a netlink resource having a function of implementing a container isolation device behavior of a netlink resource in the above method.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a container isolation device for another netlink resource comprising: a processor and a memory.
  • the memory is for storing a program
  • the processor is configured to execute the program, and the program can implement the methods in the foregoing first aspect and the implementation manners of the first aspect when executed.
  • a computer program product comprising instructions for causing a computer to perform the methods of the first aspect and the implementations of the first aspect, when the computer program product is run on a computer.
  • a computer readable storage medium stores a computer program that, when executed by the processor, implements the methods of the first aspect and the implementations of the first aspect.
  • FIG. 1 is a schematic diagram of a logical structure of an operating system
  • FIG. 2 is a schematic diagram of a logical structure of another operating system
  • FIG. 3 is a schematic flowchart of a method for isolating a container of a netlink resource according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a method for storing an entry according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a process for transmitting a netlink message under an isolated netlink channel according to an embodiment of the present invention
  • FIG. 6 is a flowchart of a method for a kernel to transmit an entry to a container according to an embodiment of the present invention
  • FIG. 7 is a schematic structural diagram of a netlink message according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of a process of forwarding an entry in a user space according to an embodiment of the present disclosure
  • FIG. 9 is a schematic structural diagram of a container isolation device for a netlink resource according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another container isolation device for providing netlink resources according to an embodiment of the present invention.
  • Netlink is an asynchronous full-duplex communication method that supports the initiative to initiate communication to the user space by the kernel state (or kernel).
  • Netlink enables interprocess communication methods to provide a two-way full-duplex asynchronous transfer between the kernel and user space, enabling the host to initiate transport communications without the need for user space (eg, using simplex methods such as ioctl). In this way, the user space does not need to continuously poll when waiting for some trigger condition of the kernel to be satisfied, and can directly receive the kernel message asynchronously.
  • Netlink supports multicast transmission, that is, the kernel can send messages to multiple receiving processes in the user space, so that each process does not need to be queried separately.
  • the container isolation method of the netlink resource provided by the present application can be applied to the operating system shown in FIG. 2.
  • the user space of the operating system may include multiple containers, such as container 1, container 2, and container 3.
  • the kernel may include multiple entries (such as routing, ARP, interface, etc.), such as entry 1. Table 2 and Table 3, where the kernel stores and manages the entries.
  • the kernel can receive the entry delivered by the container through the netlink message, and the container can invoke the entry in the kernel through the netlink message.
  • the operating system may be a Linux operating system, a Windows operating system, or other operating system that implements container technology.
  • This application first creates a netlink namespace in the container and completes the initialization of the creation.
  • User space can issue netlink trigger instructions to the kernel to enable the kernel to create a netlink namespace.
  • the container user space communicates with the kernel through the netlink message, and the table is sent to the kernel.
  • the new netlink namespace is used to isolate the netlink resource under the linux container, especially the table entry is isolated, wherein one container
  • a container namespace can correspond to multiple containers. Isolation means that the netlink channel of a container to which a namespace belongs does not allow the container to which other namespaces belong or use.
  • the kernel When the kernel sends an entry in the multicast mode, it only sends the container user space to the namespace of the entry. The user space of other unrelated containers cannot receive this message.
  • the kernel entry is sent to the forwarding plane of the user space through a netlink message (such as a user space virtual switch), and the netlink message includes information indicating that the netlink message is a netlink namespace, so as to be in the user space.
  • a netlink message such as a user space virtual switch
  • the netlink message includes information indicating that the netlink message is a netlink namespace, so as to be in the user space.
  • FIG. 3 is a schematic flowchart of a method for isolating a container of a netlink resource according to an embodiment of the present invention.
  • the method can include:
  • Step 300 The application sends a trigger instruction to the kernel.
  • the container creates a namespace through a system call creation instruction, such as calling the clone() system call instruction with the CLONE_NEW* type to create a namespace.
  • Namespaces can include inter-process communication (IPC) namespaces, network namespaces, mount namespaces, process (PID) namespaces, UNIX namespaces (independent outbound hostnames and network information services), and users. (user) namespace.
  • CLONE_NEW* types can include CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, CLONE_NEWUTS, and CLONE_NEWUSER, which represent the resources separated by the namespace.
  • the user sends a trigger instruction to the kernel through the application, which is used to instruct the kernel to create a container, thereby creating a container's netlink namespace.
  • Step 310 The kernel creates a container corresponding to the application according to the trigger instruction, establishes a netlink namespace, and sends a netlink namespace creation success notification to the application.
  • the kernel builds a container based on the trigger instruction, and then establishes the container's netlink namespace.
  • the netlink namespace can include an identifier, which can be information that uniquely represents the namespace, such as an inode number.
  • the kernel initializes other resources and completes the initialization of creating the netlink namespace.
  • the kernel sends a netlink namespace creation success notification to the application.
  • Step 320 The kernel receives the first netlink message sent by the container, where the first netlink message carries the entry generated when the container is running, and stores the entry.
  • the kernel parses the first netlink message to obtain the identifier of the netlink namespace.
  • the kernel stores the received entry in the corresponding namespace according to the identifier of the netlink namespace corresponding to the first netlink message, and specifically stores the entry in the hash table of the namespace, thereby making the user of the container According to the identifier of the netlink namespace, the space can query related entries of its own.
  • FIG. 4 is a flowchart of a method for storing an entry according to an embodiment of the present invention. As shown in FIG. 4, the method may include:
  • Step 41 The kernel parses the first netlink message, and acquires a task_struct structure of the first netlink message stored by the kernel.
  • Step 42 The kernel acquires a corresponding module (nsproxy) of the storage namespace according to the current task_struct structure.
  • nsproxy there is a pointer to nsproxy in the task_struct structure, so the kernel can obtain the corresponding nsproxy according to the current task_struct structure.
  • the kernel provides multiple namespaces such as PID, IPC, and NS, a process may belong to multiple namespaces. Since nsproxy stores a set of pointers to various types of namespaces, nsproxy can uniformly manage the namespace to which the process belongs.
  • Step 43 The kernel determines, according to the information stored in the nsproxy, the netlink namespace corresponding to the first netlink message, and obtains the identifier of the netlink namespace.
  • Step 44 The kernel stores the entry according to the identifier of the netlink namespace, to send the entry required by the container to the user space of the container.
  • a timing mechanism may be set in the kernel, so that the entry management system (or subsystem) in the kernel periodically multicasts the netlink message.
  • step 340 When the kernel entry management system periodically sends a netlink message, or is triggered by the user space of the container, and the kernel entry management system multicasts the netlink message, step 340 is performed.
  • process of the container generation entry and the process of obtaining the entry may be different processes of the same container or the same process.
  • Step 330 The kernel acquires an identifier of a netlink namespace to which the target entry belongs.
  • the kernel entry management system obtains the identifier of the netlink namespace to which the target entry belongs, such as an inode number.
  • Step 340 The kernel determines the target network namespace according to the identifier of the netlink namespace, and sends the target entry to the container user space unicast or multicast according to the identifier of the target network namespace.
  • the target entry is all or part of the entry in the table generated by the container stored in the kernel's namespace.
  • the kernel first obtains the corresponding nsproxy, and then determines the network namespace corresponding to the target entry according to the pointer in the nsproxy, thereby obtaining the identifier of the network namespace, such as the packet structure.
  • the kernel uses the network namespace identifier and the target table entry as input parameters of the netlink_kernel_create function, creates a kernel netlink kernel instance, and creates a transport channel between the container and the kernel, such as a socket channel, so that the kernel entries
  • the management system sends the target entry unicast or multicast to the user space of the container through the channel. Wherein, when there are multiple processes in the user space of the container, the kernel entry management system multicasts the target entry to the user space of the container through the transmission channel, and only one process exists in the user space of the container or only When there is a process that requires the target entry, the kernel entry management system unicasts the target entry to the container's user space through the transport channel.
  • the netlink message sent by the entry management system in the kernel is only received by the user space of the container that generates the entry in the netlink message, and the isolation of the netlink channel is implemented.
  • FIG. 5 is a schematic diagram of a process for transmitting a netlink message transmission under an isolated netlink channel according to an embodiment of the present invention.
  • the netlink message sent by the subsystem 1 of the corresponding container 1 in a unicast or multicast manner is only received by the process 1 and the process 2 in the container 1, and the process 1 and the process 2 in the container 2 cannot receive.
  • the netlink message sent by the subsystem 2 of the corresponding container 2 in unicast or multicast only the process 1 and the process 2 in the container 2 can receive, and the process 1 and the process 2 in the container 1 cannot receive it.
  • FIG. 6 is a flowchart of a method for a kernel to transfer an entry to a container according to an embodiment of the present invention. As shown in FIG. 6, the method may include:
  • Step 61 The subsystem 1 in the kernel corresponding to the container 1 determines the nsproxy corresponding to the container 1 according to the inode number of the netlink namespace of the container 1.
  • Step 62 The subsystem 1 obtains the netlink namespace corresponding to the entry management system of the target entry (that is, the entry management system of the system 1) according to the information of the nsproxy.
  • Step 63 The netlink namespace identifier and the target entry are used as input parameters of the netlink_kernel_create function, and the netlink kernel instance is created in the kernel.
  • Step 64 Create a socket channel between the container 1 and the kernel according to the identifier of the netlink namespace.
  • Step 65 Send a netlink message to the user space of the container 1 through the socket channel, where the netlink message includes a target entry.
  • the entries of the container stored in the kernel are posted to the forwarding process of the user space of the container (such as a user mode vSwitch), and data forwarding in the user space is implemented to reduce data. Forward delays to enhance the user experience.
  • the embodiment of the present application implements data forwarding between containers by sending an entry of the container to a public forwarding plane for communication between the containers.
  • the method is performed after the kernel stores the table items in isolation (step 320), and the method is described in detail below.
  • Step 350 The kernel creates a second netlink message, where the second netlink message includes a netlink namespace type and a target entry.
  • the second netlink message is a netlink message sent by the kernel to the forwarding plane for inter-container communication.
  • the kernel implements the forwarding plane by adding a new netlink namespace type (such as NLM_F_NETLINK_NAMESPACE 32) to the netlink header.
  • a new netlink namespace type such as NLM_F_NETLINK_NAMESPACE 32
  • FIG. 7 is a schematic structural diagram of a netlink message according to an embodiment of the present invention.
  • the netlink message includes a netlink message header and a netlink message body, and the netlink message header includes a length field, a type field, a flag field, a sequence number field, and a process identifier (ID) field.
  • ID process identifier
  • the length field specifies the total length of the message and occupies 4 bytes.
  • the type field is used to apply the type of the internally defined message and takes up 2 bytes.
  • the flag field is used to set the message identifier and takes up 2 bytes.
  • the sequence number field is used to track the message, indicating the sequence number, which occupies 4 bytes.
  • the process identification field is used to trace the message, indicating the source process ID, which occupies 4 bytes.
  • the kernel adds the NLM_F_NETLINK_NAMESPACE 32 to the flag field of the netlink message header (nlmsg_flags parameter) to indicate that the netlink message is a message for the netlink namespace.
  • the target entry is all or part of the entry that the container sends to the entry in the kernel.
  • the forwarding plane for inter-container communication is a common forwarding plane, which may be a container and a virtual switch (vSwitch) on the host where the kernel resides.
  • vSwitch virtual switch
  • the kernel may periodically send a second netlink message to the forwarding plane.
  • the kernel subsystem corresponding to a container periodically sends a second netlink message including the target entry corresponding to the container to the forwarding plane.
  • Step 370 The forwarding plane parses the second netlink message, and obtains an identifier of a netlink namespace to which the target entry belongs.
  • the second netlink message may also include an identifier of a netlink namespace to which the target entry belongs, such as a first inode number.
  • Step 380 The forwarding plane determines a container corresponding to the target entry according to the identifier of the netlink namespace to which the target entry belongs.
  • the forwarding plane Before performing step 380, the forwarding plane needs to obtain the identifier of the netlink namespace of all the containers on the host where the forwarding plane is located, such as the second inode number.
  • the forwarding plane matches the first inode number with the second inode number of the netlink namespace of all containers on the forwarding plane. If the matching is successful, that is, when the first inode number is the same as the second inode number, the forwarding plane determines that the container to which the second inode number belongs is the target container that receives the target entry. That is, the forwarding plane determines the target container corresponding to the target entry by identifying the consistency of the first inode number and the second inode number.
  • FIG. 8 is a schematic diagram of a process of forwarding an entry in a user space according to an embodiment of the present invention.
  • the application on the server deploys a virtual network function (VNF) container instance VNF1, VNF2...VNFn through an application container engine (docker), and the kernel creates a VNF container after creating the VNF container.
  • Netlink namespace such as namespace 1, namespace 2... namespace n.
  • the private entry of the VNF container exists.
  • the private entry A of the VNF1 container is sent to the kernel through the netlink1 message, and is stored in the namespace 1 by the kernel.
  • the private entry B of the VNF2 container is sent to the kernel through the netlink2 message and is isolated by the kernel.
  • the private entry N of the VNFn container is sent to the kernel via a netlink message and stored in the namespace n by the kernel.
  • the private entry in the kernel (such as at least one of the entry A, the entry B, and the entry N) can be synchronized to the forwarding plane used for communication between the containers by using a netlink message, for example, a fast-forward plane ( Fastpath), fastpath obtains the inode number of the netlink namespace to which the entry belongs by parsing the netlink message.
  • the fastpath determines the target VNF container of the entry based on the inode number of the netlink namespace to which the obtained entry belongs and the inode number of the netlink namespace of all VNF containers. That is, fastpath establishes the association between the VNF container instance and the entry through the inode number. Data exchange can be performed between the VNF container instances via fastpath.
  • VNF1 and VNF2 When VNF1 and VNF2 send entries to the kernel, and then the kernel issues VNF1 and VNF2 entries to fastpath, VNF1 and VNF2 can directly perform data interaction through fastpath.
  • the method can be used to isolate the netlink channel, reduce the broadcast storm of the netlink message, and improve the processing efficiency of the netlink multicast packet.
  • the embodiment of the present invention corresponding to the foregoing method further provides a container isolation device for the netlink resource.
  • the device may include: a receiving unit 910, a processing unit 920, a storage unit 930, and a sending unit 940.
  • the receiving unit 910 is configured to receive a trigger instruction issued by the application for creating a container.
  • the processing unit 920 is configured to create a container corresponding to the application according to the triggering instruction, and establish a netlink namespace of the container.
  • the sending unit 940 is configured to send a netlink namespace creation success notification to the application.
  • the receiving unit 910 is further configured to receive a first netlink message delivered by the container, where the first netlink message includes an entry generated by the container when the container is running.
  • the storage unit 930 is further configured to store an entry according to the identifier of the netlink namespace to send the entry required by the container to the user space of the container.
  • the processing unit 920 is further configured to parse the message type of the first netlink message, and obtain the identifier of the netlink namespace.
  • the device further includes a sending unit 940,
  • the processing unit 920 is further configured to determine an identifier of a netlink namespace corresponding to the target entry in the entry, and determine a target network namespace according to the identifier of the netlink namespace;
  • the sending unit 940 is configured to send the target entry to the user space of the container unicast or multicast according to the identifier of the target network namespace.
  • processing unit 920 is further configured to create a transmission channel between the container and the kernel according to the identifier of the target network namespace and the target entry.
  • the sending unit 940 is configured to send a target entry by using a channel to the user space of the container by unicast or multicast.
  • the sending unit 940 is further configured to send a second netlink message to the forwarding plane used for the inter-container communication, where the second netlink message includes a netlink namespace type and a target entry, so that the forwarding plane obtains the target entry.
  • the identifier of the netlink namespace is determined by the identifier of the netlink namespace to which the entry to be sent belongs.
  • the target entry is all or part of the stored entry.
  • FIG. 10 is a schematic structural diagram of another container isolation device for providing netlink resources according to an embodiment of the present invention.
  • the device can be deployed on the server in the form of VNF.
  • the device is suitable for servers, network devices, etc. (as long as the container technology can be deployed), and is not limited to a central processing unit (CPU).
  • the apparatus can include a memory 1010 and a processor 1020.
  • the processor is configured to execute the software program, and when executed, the program can be implemented in various embodiments of the present invention.
  • the embodiment of the present invention further provides a computer readable storage medium.
  • a computer program stored on the computer readable storage medium is executed by the processor 1020.
  • Embodiments of the present invention also provide a computer program product comprising instructions.
  • the processor 1020 is caused to perform the method described above with respect to FIG.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both.
  • the software instructions may be composed of corresponding software modules, which may be stored in random access memory, flash memory, read only memory, erasable programmable read-only memory (EPROM) memory, and electrically erasable.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium may also reside as a discrete component in the user device.

Abstract

公开了一种netlink资源的容器隔离方法及装置。内核接收应用程序下发的用于创建容器的触发指令。内核根据触发指令创建对应应用程序的容器，建立容器的netlink命名空间，并向应用程序发送netlink命名空间创建成功通知。内核接收容器下发的第一netlink消息，所述第一netlink消息包括容器运行时生成的表项。内核根据netlink命名空间的标识，存储表项，以使容器从内核获取所需的表项。该方法通过创建netlinknamespace机制，实现了netlink通道的隔离，减少netlink消息的广播风暴，提高了netlink组播报文的处理效率。

Description

Netlink资源的容器隔离方法及装置
本申请要求于2017年7月31日提交中国专利局、申请号为201710637129.7、发明名称为“Netlink资源的容器隔离方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机网络领域，尤其涉及一种netlink资源的容器隔离方法及装置。
背景技术
Linux软件容器(Linux containers，LXC)是一种操作系统层虚拟化(operating system–level virtualization)技术，用于隔离一个主机上使用同一个Linux内核的不同Linux系统(又称为容器)。它将应用软件系统打包成一个容器，该容器可以包括用户空间(user space)，用户空间为应用程序运行的存储区域，应用程序的执行必须依托于容器所在的主机的内核提供的资源(如CPU资源、存储资源、I/O资源)。
目前使用Linux命名空间(namespace)技术隔离为不同容器分配的内核资源，这使得进程标识(process identifier,PID),进程间通信(inter-process communication，IPC)通道,网络转发表项等系统资源不再是全局性的，而是属于特定的namespace。每个namespace里面的资源对其他namespace都是不透明的(即不可见的)。namespace简单的来说就是将资源放到不同的命名空间中，各个命名空间中的资源是相互隔离的,各个命名空间中的资源被不同的进程调用。通常，一个容器对应一个容器命名空间，一个容器命名空间可以对应多个容器，该容器命名空间可以包括一个或多个子命名空间。当内核向容器发送容器订阅的信息时，内核可通过netlink通道以netlink消息的方式将该信息发送给该容器。图1为一种操作系统的逻辑结构示意图。如图1所示，操作系统分为用户空间和内核，用户空间包括容器1、容器2和容器3，内核包括命名空间1和命名空间2。容器1和容器3对应命名空间1，容器2对应命名空间2，命名空间1和应命名空间2分别通过netlink通道以netlink消息向容器1、容器2和容器3发送相应容器订阅的信息。
然而，现有容器的namespace不能实现netlink消息的隔离并且由于内核中表项资源(如arp、routing、interface等表项)的更新，都会通过netlink消息以组播或者广播的形式发送到多个容器的用户空间，即图1中命名空间1发给容器1和容器3的netlink消息容器2页可以接收。，这导致共享该内核的所有容器都会接收到该表项，造成表项广播泛滥。
发明内容
本申请提供了一种netlink资源的容器隔离方法及装置。实现netlink资源的隔离，使内核中的表项通过netlink消息广播发送后，只有对应的容器的用户空间会接收到该表项，避免共享该内核的所有进程都会接收到该表项，造成表项广播泛滥。
第一方面，提供了一种netlink资源的容器隔离方法，该方法可以包括：内核接收 应用程序下发的用于创建容器的触发指令。内核根据触发指令创建对应应用程序的容器，建立容器的netlink命名空间，并向应用程序发送netlink命名空间创建成功通知。内核接收容器下发的第一netlink消息，第一netlink消息包括容器运行时生成的表项。内核根据netlink命名空间的标识，存储表项，以向所述容器的用户空间发送所述容器需要的表项。
该方法通过创建netlink namespace机制，实现了netlink通道的隔离，减少netlink消息的广播风暴，提高了netlink组播报文的处理效率。
在一个可选的实现中，内核接收容器下发的第一netlink消息之后，该方法还包括：内核解析第一netlink消息，获取netlink命名空间的标识，以便将接收到的表项同步存储到相应的命名空间中进行隔离存储。
在一个可选的实现中，存储表项之后，该方法还包括：内核确定表项中的目标表项对应的netlink命名空间的标识。内核根据netlink命名空间的标识，确定目标network命名空间。内核根据目标network命名空间的标识，向容器的用户空间单播或组播发送目标表项。目标表项为存储的表项中的全部或部分表项。
在一个可选的实现中，内核根据目标network命名空间的标识，向容器的用户空间单播或组播发送目标表项，包括：内核根据目标network命名空间的标识和目标表项，创建容器与内核间的传输通道；内核通过通道向容器的用户空间单播或组播发送目标表项。
可见，在创建netlink namespace机制下，内核中的表项管理系统发送的netlink消息，只会被生成该netlink消息中携带的表项的容器的用户空间接收到，实现netlink通道的隔离。
在一个可选的实现中，存储表项之后，该方法还可以包括：内核向用于容器间通信的转发平面发送第二netlink消息，第二netlink消息包括netlink命名空间类型和目标表项，以使转发平面获取目标表项所属netlink命名空间的标识，并根据目标表项所属netlink命名空间的标识，确定目标表项对应的容器，目标表项为存储的表项中的全部或部分表项。通过该方式，能够实现在用户空间上的数据转发，以降低数据转发时延。
第二方面，提供了一种netlink资源的容器隔离装置，该装置具有实现上述方法中netlink资源的容器隔离装置行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第三方面，提供了另一种netlink资源的容器隔离装置，该装置可以包括：处理器和存储器。所述存储器用于存储程序，所述处理器用于执行所述程序，所述程序在执行时能够实现上述第一方面及第一方面的各实现方式中的方法。
第四方面，提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述第一方面及第一方面的各实现方式中的方法。
第五方面，提供了一种计算机可读存储介质。该计算机可读存储介质上存储有计 算机程序，该程序被处理器执行时实现上述第一方面及第一方面的各实现方式中的方法。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍。
图1为一种操作系统的逻辑结构示意图；
图2为另一种操作系统的逻辑结构示意图；
图3为本发明实施例提供的一种netlink资源的容器隔离方法流程示意图；
图4为本发明实施例提供的一种存储表项的方法流程图；
图5为本发明实施例提供的一种在隔离的netlink通道下传输netlink消息的过程示意图；
图6为本发明实施例提供的一种内核向容器传输表项的方法流程图；
图7为本发明实施例提供的一种netlink消息的结构示意图；
图8为本发明实施例提供的一种在用户空间上表项转发过程的示意图；
图9为本发明实施例提供一种netlink资源的容器隔离装置的结构示意图；
图10为本发明实施例提供另一种netlink资源的容器隔离装置的结构示意图。
具体实施方式
下面通过附图和实施例，对本发明的技术方案做进一步的详细描述。
首先介绍下Netlink相关知识。
Netlink是一种异步全双工的通信方式，它支持由内核态(或称内核)主动向用户空间发起通信。Netlink使进程间通信方法在内核和用户空间间提供了一种双向全双工异步传输，支持由内核主动发起传输通信，而不需要用户空间发出(例如使用ioctl这类的单工方式)。如此用户空间在等待内核某种触发条件满足时就无需不断轮询，直接异步接收内核消息即可。并且Netlink支持组播传输，即内核可以将消息发送给用户空间的多个接收进程，这样就不用每个进程单独来查询了。
本申请提供的netlink资源的容器隔离方法可以应用在图2所示的操作系统中。如图2所示，该操作系统的用户空间可以包括多个容器，如容器1、容器2和容器3，内核可以包括多个表项(如路由、ARP、接口等)，如表项1、表项2和表项3，其中，内核对表项进行存储和管理。内核可以通过netlink消息接收容器下发的表项，容器可以通过netlink消息调用内核中表项。
需要说明的是，该操作系统可以是Linux操作系统，也可以是windows操作系统，或其他可实现容器技术的操作系统。
下面本申请以Linux操作系统为例，详细进行介绍。
本申请首先在容器中创建netlink命名空间，并完成创建的初始化工作。用户空间可以向内核下发netlink触发指令，以使内核创建netlink命名空间。之后容器用户空间通过netlink消息与内核单播通信，将表项下发至内核，实现在linux容器下使用新增 netlink命名空间对netlink资源进行隔离，特别是对表项进行隔离,其中，一个容器对应一个容器命名空间，一个容器命名空间可以对应多个容器，隔离是指一个命名空间所属容器的netlink通道不允许其他命名空间所属的容器使用或访问。
当内核以多播的方式发送表项时，只发送到表项所属namespace的容器用户空间，其他不相关的容器的用户空间接收不到此消息。
当在某些场景下，内核的表项通过netlink消息发送到用户空间的转发平面上(如用户空间虚拟交换机)，该netlink消息包括指示该netlink消息为netlink命名空间的信息，以便在用户空间上区分目标容器用户空间，实现数据转发的过程，避免了通过内核实现容器间通信，减少了通信时延。
图3为本发明实施例提供的一种netlink资源的容器隔离方法流程示意图。该方法可以包括：
步骤300、应用程序向内核发送触发指令。
容器通过系统调用创建指令创建命名空间，如调用带有CLONE_NEW*类型的clone()system call指令以创建命名空间。命名空间可以包括进程间通信(IPC)的命名空间、网络(network)命名空间、挂载(mount)命名空间、进程(PID)命名空间、UNIX命名空间(独立出主机名和网络信息服务)和用户(user)命名空间。其中，CLONE_NEW*类型可以包括CLONE_NEWIPC、CLONE_NEWNET、CLONE_NEWNS、CLONE_NEWPID、CLONE_NEWUTS和CLONE_NEWUSER，这些类型分别表示命名空间所隔离的资源。
用户通过应用程序向内核发送触发指令，该触发指令用于指示内核创建容器，进而创建该容器的netlink命名空间。
步骤310、内核根据触发指令创建对应应用程序的容器，建立netlink命名空间，并向应用程序发送netlink命名空间创建成功通知。
内核根据触发指令，建立容器，进而建立该容器的netlink命名空间。netlink命名空间可以包括标识，该标识可以是唯一表示该命名空间的信息，如索引节点号(inode number)。同时内核对其他资源进行初始化配置，完成创建netlink命名空间的初始化。
之后，内核向应用程序发送netlink命名空间创建成功通知。
步骤320、内核接收所述容器下发的第一netlink消息，该第一netlink消息携带所述容器运行时生成的表项，并存储所述表项。
内核解析该第一netlink消息，获取所述netlink命名空间的标识。
内核根据与该第一netlink消息对应的netlink命名空间的标识，将接收到的表项存储到相应的命名空间中，具体可以是将表项存储到namespace的哈希表中，从而使容器的用户空间根据netlink命名空间的标识，能够查询到属于自己的相关表项。
图4为本发明实施例提供的一种存储表项的方法流程图。如图4所示，该方法可以包括：
步骤41、内核解析该第一netlink消息，获取内核存储的该第一netlink消息的 task_struct结构。
步骤42、内核根据当前的task_struct结构，获取相应的存储命名空间的模块(nsproxy)。
在task_struct结构中存在指向nsproxy的指针，故内核根据当前的task_struct结构，可以获取相应的nsproxy。其中，由于内核提供了PID，IPC，NS等多个命名空间，一个进程可能属于多个命名空间。由于nsproxy存储了一组指向各个类型命名空间的指针，因此nsproxy可以统一管理进程所属的命名空间。
步骤43、内核根据nsproxy中存储的信息，确定与该第一netlink消息对应的netlink命名空间，获取该netlink命名空间的标识。
步骤44、内核根据netlink命名空间的标识，存储所述表项，以向所述容器的用户空间发送所述容器需要的表项。
可选地，内核中可以设置定时机制，使内核中的表项管理系统(或称子系统)周期性的组播发送netlink消息。
当内核的表项管理系统周期性的组播发送netlink消息，或者由容器的用户空间触发，使内核的表项管理系统组播发送netlink消息时，执行步骤340。
需要说明的是，容器生成表项的进程和获取表项的进程可能是同一容器的不同进程或者相同的进程。
步骤330、内核获取目标表项所属的netlink命名空间的标识。
当内核需要向容器的用户空间发送表项(称为目标表项)时，内核的表项管理系统获取目标表项所属的netlink命名空间的标识，如inode number。
步骤340、内核根据netlink命名空间的标识，确定目标network命名空间，并根据目标network命名空间的标识，向该容器的用户空间单播或组播发送目标表项。
该目标表项为内核的命名空间中存储的该容器生成的表项中的全部或部分表项。
内核根据netlink命名空间的标识，首先获取相应的nsproxy，再根据nsproxy中的指针，确定目标表项对应的network命名空间，从而获取该network命名空间的标识，如报文结构等信息。
内核将network命名空间的标识和目标表项作为netlink_kernel_create函数的输入参数，创建内核的netlink内核实例，以及创建容器与内核间的传输通道，如套接字(socket)通道，以使内核的表项管理系统通过该通道向该容器的用户空间单播或组播发送目标表项。其中，当容器的用户空间中存在多个进程时，内核的表项管理系统通过该传输通道向该容器的用户空间组播发送该目标表项，当容器的用户空间中仅存在一个进程或仅存在一个需要该目标表项的进程时，内核的表项管理系统通过该传输通道向该容器的用户空间单播发送该目标表项。
由此可知，在创建netlink namespace机制下，内核中的表项管理系统发送的netlink消息，只会被生成该netlink消息中携带的表项的容器的用户空间接收到，实现netlink通道的隔离。
在一个例子中，图5为本发明实施例提供的一种在隔离的netlink通道下传输netlink消息输的过程示意图。如图5所示，内核中对应容器1的子系统1单播或组播发送的netlink消息，只有容器1中的进程1和进程2可以接收到，容器2中的进程1和进程2 不能接收到；内核中对应容器2的子系统2单播或组播发送的netlink消息，只有容器2中的进程1和进程2可以接收到，容器1中的进程1和进程2不能接收到。
在一个例子中，图6为本发明实施例提供的一种内核向容器传输表项的方法流程图。如图6所示，该方法可以包括：
步骤61、容器1对应的位于内核中的子系统1根据容器1的netlink命名空间的inode number，确定容器1对应的nsproxy。
步骤62、子系统1根据nsproxy的信息，获取目标表项的表项管理系统(即系统1的表项管理系统)对应的netlink命名空间。
步骤63、将netlink命名空间的标识和目标表项作为netlink_kernel_create函数的输入参数，在内核中创建netlink内核实例。
步骤64、根据netlink命名空间的标识，创建容器1和内核间的socket通道。
步骤65、通过socket通道向容器1的用户空间组播发送netlink消息，该netlink消息包括目标表项。
可选地，在某些场景下，内核中存储的容器的表项会被发布到该容器的用户空间的转发进程(如用户态vSwitch)上，实现在用户空间上的数据转发，以降低数据转发时延，提升用户体验。
进一步地，本申请实施例通过将容器的表项发送到用于容器间通信的公共转发平面上实现容器间的数据转发。该方法是在内核对表项进行隔离存储(步骤320)之后执行的，下面对该方法进行详细介绍。
步骤350、内核创建第二netlink消息，该第二netlink消息包括netlink命名空间类型和目标表项。
第二netlink消息为内核向用于容器间通信的转发平面发送的netlink消息。
内核通过在netlink消息头中增加新的netlink命名空间类型(如NLM_F_NETLINK_NAMESPACE 32)，来实现与该转发平面的。
图7为本发明实施例提供的一种netlink消息的结构示意图。如图7所示，netlink消息包括netlink消息头和netlink消息体，在netlink消息头包括长度字段、类型字段、标志字段、顺序号字段和进程标识(identifier，ID)字段。
其中，长度字段指定消息的总长度，占用4个字节。类型字段用于应用内部定义消息的类型，占用2个字节。标志字段用于设置消息标识，占用2个字节。顺序号字段用于追踪消息，表示顺序号，占用4个字节。进程标识字段用于追踪消息，表示消息来源进程ID，占用4个字节。
内核通过在netlink消息头的标志字段(nlmsg_flags参数)中增加NLM_F_NETLINK_NAMESPACE 32以指示所述netlink消息为netlink命名空间的消息。
该目标表项为容器发送给内核中的表项的全部或部分表项。
步骤360、内核向用于容器间通信的转发平面发送第二netlink消息。
其中，该用于容器间通信的转发平面为一个公共的转发平面，其可以是容器以及内核所在的主机上的的虚拟交换机(vSwitch)。
可选地，内核可以周期性的向该转发平面发送第二netlink消息。具体来说，一个 容器对应的内核子系统周期性地向该转发平面发送包括该容器对应的目标表项的第二netlink消息。
步骤370、该转发平面解析该第二netlink消息，获取目标表项所属的netlink命名空间的标识。
可选地，第二netlink消息也可以包括目标表项所属netlink命名空间的标识，如第一inode number。
步骤380、该转发平面根据目标表项所属netlink命名空间的标识，确定目标表项对应的容器。
在执行步骤380之前，该转发平面需要获取转发平面所在的主机上所有容器的netlink命名空间的标识，如第二inode number。
该转发平面将第一inode number分别与该转发平面上所有容器的netlink命名空间的第二inode number进行匹配。若匹配成功，即第一inode number与第二inode number相同时，该转发平面确定该第二inode number所属的容器为接收该目标表项的目标容器。也就是说，该转发平面通过识别第一inode number与第二inode number的一致性，确定需要该目标表项对应的目标容器。
在一个例子中，图8为本发明实施例提供的一种在用户空间上表项转发过程的示意图。如图8所示，服务器上的应用程序通过应用容器引擎(docker)部署虚拟网络功能(Virtual Network Function，VNF)容器实例VNF1，VNF2…VNFn，内核在创建VNF容器后，相应创建该VNF容器的netlink命名空间，如命名空间1、命名空间2…命名空间n。VNF容器存在私有表项，VNF1容器的私有表项A通过netlink1消息发送到内核，并由内核隔离存储到命名空间1中，VNF2容器的私有表项B通过netlink2消息发送到内核，并由内核隔离存储到命名空间2中，以此类推，VNFn容器的私有表项N通过netlink消息发送到内核，并由内核隔离存储到命名空间n中。
进一步地，内核中的私有表项(如表项A、表项B至表项N中的至少一个表项)可以通过netlink消息同步到用于容器间通信的转发平面，例如，快转平面(fastpath)，fastpath通过解析netlink消息，获取表项所属netlink命名空间的inode number。fastpath根据获取的表项所属netlink命名空间的inode number与所有VNF容器的netlink命名空间的inode number，确定该表项的目标VNF容器。也就是说，fastpath通过inode number建立VNF容器实例与表项之间的关联关系。VNF容器实例间可通过fastpath进行数据交换。
当VNF1和VNF2发送表项到内核，然后再由内核将VNF1和VNF2的表项发布到fastpath后，VNF1和VNF2通过fastpath可直接进行数据交互。
由此可知，该方法通过创建netlink namespace机制，实现了netlink通道的隔离，减少netlink消息的广播风暴，提高了netlink组播报文的处理效率。
与上述方法对应的本发明实施例还提供一种netlink资源的容器隔离装置，如图9所示，该装置可以包括：接收单元910、处理单元920、存储单元930和发送单元940。
接收单元910，用于接收应用程序下发的用于创建容器的触发指令。
处理单元920，用于根据触发指令创建对应所述应用程序的容器，建立所述容器的netlink命名空间。
发送单元940，用于向应用程序发送netlink命名空间创建成功通知。
接收单元910，还用于接收容器下发的第一netlink消息，第一netlink消息包括容器运行时生成的表项。
存储单元930，还用于根据netlink命名空间的标识，存储表项，以向所述容器的用户空间发送所述容器需要的表项。
可选地，处理单元920，还用于解析第一netlink消息的消息类型，获取所述netlink命名空间的标识。
可选地，该装置还包括发送单元940，
处理单元920，还用于确定所述表项中的目标表项对应的netlink命名空间的标识，并根据netlink命名空间的标识，确定目标network命名空间；
发送单元940，用于根据目标network命名空间的标识，向容器的用户空间单播或组播发送目标表项。
可选地，处理单元920，还用于根据目标network命名空间的标识和目标表项，创建所属容器与内核间的传输通道。
发送单元940，用于通过通道向容器的用户空间单播或组播发送目标表项。
可选地，发送单元940，还用于向用于容器间通信的的转发平面发送第二netlink消息，第二netlink消息包括netlink命名空间类型和目标表项，以使转发平面获取目标表项所属netlink命名空间的标识，并根据待发送表项所属netlink命名空间的标识，确定目标表项对应的容器，目标表项为存储的表项中的全部或部分表项。
由于上述实施例中该装置的各单元解决问题的实施方式以及有益效果可以参见方法实施方式以及有益效果，故在此不复赘述。
图10为本发明实施例提供另一种netlink资源的容器隔离装置的结构示意图。随着云化及VNF技术的发展，该装置可通过VNF的形式部署在服务器上。该装置适用于服务器、网络设备等(只要能部署容器技术即适用)，不限制于中央处理器(central processing unit，CPU)。如图10所示，该装置可以包括：存储器1010和处理器1020。
存储器1010可通过总线与处理器1020连接。存储器1010可以是非易失存储器，例如硬盘驱动器和闪存，存储器1010中具有软件程序和设备驱动程序。软件程序能够执行本发明上述方法的各种功能；设备驱动程序可以是网络和接口驱动程序。
所述处理器用于执行所述软件程序，所述程序在执行时，能够本发明各实施方式中的方法。
由于上述实施例中该装置的各器件解决问题的实施方式以及有益效果可以参见方法实施方式以及有益效果，故在此不复赘述。
需要说明的是，本发明实施例还提供了一种计算机可读存储介质。该计算机可读存储介质上存储有计算机程序，该程序被处理器1020执行。
本发明实施例还提供了一种包含指令的计算机程序产品。当该计算机程序产品在计算机上运行时，使得处理器1020执行上述图3所述的方法。
结合本文中所公开的实施例描述的方法或算法的步骤可以用硬件、处理器执行的软件模块，或者二者的结合来实施。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器、闪存、只读存储器、可擦除可编程只读存储器(erasable programmable read-only memory，EPROM)存储器、电可擦可编程只读存储器存储器(英文：electrically erasable programmable read-only memory，EEPROM)、硬盘、光盘或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。存储介质也可以是处理器的组成部分。处理器和存储介质也可以作为分立组件存在于用户设备中。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、改进等，均应包括在本申请的保护范围之内。

Claims (13)

  1. 一种netlink资源的容器隔离方法，其特征在于，所述方法包括：
    内核接收应用程序下发的用于创建容器的触发指令；
    所述内核根据所述触发指令创建对应所述应用程序的容器，建立所述容器的netlink命名空间，并向所述应用程序发送netlink命名空间创建成功通知；
    所述内核接收所述容器下发的第一netlink消息，所述第一netlink消息包括所述容器运行时生成的表项；
    所述内核根据所述netlink命名空间的标识，存储所述表项，以向所述容器的用户空间发送所述容器需要的表项。
  2. 根据权利要求1所述的方法，其特征在于，所述内核接收所述容器下发的第一netlink消息之后，所述方法还包括：
    所述内核解析所述第一netlink消息，获取所述netlink命名空间的标识。
  3. 根据权利要求1或2所述的方法，其特征在于，所述存储所述表项之后，所述方法还包括：
    所述内核确定所述表项中的目标表项对应的所述netlink命名空间的标识；
    所述内核根据所述netlink命名空间的标识，确定目标netlink命名空间；所述内核根据所述目标netlink命名空间的标识，向所述容器的用户空间单播或组播发送所述目标表项；
    所述目标表项为所述存储的表项中的全部或部分表项。
  4. 根据权利要求3所述的方法，其特征在于，所述内核根据所述目标netlink命名空间的标识，向所述容器的用户空间单播或组播发送所述目标表项，包括：
    所述内核根据所述目标netlink命名空间的标识和所述目标表项，创建所述容器与所述内核间的传输通道；
    所述内核通过所述通道向所述容器的用户空间单播或组播发送所述目标表项。
  5. 根据权利要求1或2所述的方法，其特征在于，所述存储所述表项之后，所述方法还包括：
    所述内核向用于容器间通信的转发平面发送第二netlink消息，所述第二netlink消息包括netlink命名空间类型和目标表项，以使所述转发平面获取所述目标表项所属netlink命名空间的标识，并根据所述目标表项所属netlink命名空间的标识，确定所述目标表项对应的容器，所述目标表项为所述存储的表项中的全部或部分表项。
  6. 一种netlink资源的容器隔离装置，其特征在于，所述装置包括：
    接收单元，用于接收应用程序下发的用于创建容器的触发指令；
    处理单元，用于根据所述触发指令创建对应所述应用程序的容器，建立所述容器的netlink命名空间；
    发送单元，用于向所述应用程序发送netlink命名空间创建成功通知；
    所述接收单元，还用于接收所述容器下发的第一netlink消息，所述第一netlink消息包括所述容器运行时生成的表项；
    所述装置还包括存储单元，用于根据所述netlink命名空间的标识，存储所述表项，以向所述容器的用户空间发送所述容器需要的表项。
  7. 根据权利要求6所述的装置，其特征在于，
    所述处理单元，还用于解析所述第一netlink消息，获取所述netlink命名空间的标识。
  8. 根据权利要求6或7所述的装置，其特征在于，
    所述处理单元，还用于确定所述表项中的目标表项对应的所述netlink命名空间的标识，并根据所述netlink命名空间的标识，确定目标netlink命名空间；
    所述发送单元，用于根据所述目标netlink命名空间的标识，向所述容器的用户空间单播或组播发送所述目标表项；
    所述目标表项为所述存储的表项中的全部或部分表项。
  9. 根据权利要求8所述的装置，其特征在于，所述处理单元，还用于根据所述目标netlink命名空间的标识和所述目标表项，创建所述容器与所述内核间的传输通道；
    所述发送单元，用于通过所述通道向所述容器的用户空间单播或组播发送所述目标表项。
  10. 根据权利要求6或7所述的装置，其特征在于，
    所述发送单元，还用于向用于容器间通信的转发平面发送第二netlink消息，所述第二netlink消息包括netlink命名空间类型和所述目标表项，以使所述转发平面获取所述目标表项所属netlink命名空间的标识，并根据所述目标表项所属netlink命名空间的标识，确定所述目标表项对应的容器，所述目标表项为所述存储的表项中的全部或部分表项。
  11. 一种netlink资源的容器隔离装置，其特征在于，所述装置包括：
    处理器和存储器，所述存储器用于存储程序，所述处理器用于执行所述程序，所述程序在执行时，能够实现权利要求1至5中任意一项所述的方法。
  12. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求1-5任意一项所述的方法。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1-5任意一项所述的方法。
PCT/CN2018/095581 2017-07-31 2018-07-13 Netlink资源的容器隔离方法及装置 WO2019024669A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18841240.7A EP3644182A4 (en) 2017-07-31 2018-07-13 CONTAINER ISOLATION METHOD AND DEVICE FOR NETWORK LINK RESOURCE
US16/777,516 US11500666B2 (en) 2017-07-31 2020-01-30 Container isolation method and apparatus for netlink resource

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710637129.7 2017-07-31
CN201710637129.7A CN109324908B (zh) 2017-07-31 2017-07-31 Netlink资源的容器隔离方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/777,516 Continuation US11500666B2 (en) 2017-07-31 2020-01-30 Container isolation method and apparatus for netlink resource

Publications (1)

Publication Number Publication Date
WO2019024669A1 true WO2019024669A1 (zh) 2019-02-07

Family

ID=65232271

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/095581 WO2019024669A1 (zh) 2017-07-31 2018-07-13 Netlink资源的容器隔离方法及装置

Country Status (4)

Country Link
US (1) US11500666B2 (zh)
EP (1) EP3644182A4 (zh)
CN (1) CN109324908B (zh)
WO (1) WO2019024669A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111669356B (zh) * 2019-03-08 2022-05-27 厦门网宿有限公司 IPsec VPN服务器中批量处理网络隔离空间的方法及IPsec VPN服务器
CN110430132B (zh) * 2019-07-05 2021-04-27 杭州迪普信息技术有限公司 绑定Socket与VRF的方法和装置
CN112540773B (zh) * 2020-12-14 2023-08-01 咪咕互动娱乐有限公司 一种云游戏安装方法、装置、电子设备及存储介质
CN113824622B (zh) * 2021-09-13 2023-06-27 京东科技信息技术有限公司 容器之间的通信控制方法、装置、计算机设备及存储介质
CN114244891B (zh) * 2021-12-22 2024-01-23 北京天融信网络安全技术有限公司 一种容器间的通信方法、装置、电子设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20050051277A (ko) * 2003-11-27 2005-06-01 한국전자통신연구원 해쉬 키를 이용한 주소 정보 처리 방법 및 이를 이용한라우터 장치
CN105487933A (zh) * 2015-11-24 2016-04-13 无锡江南计算技术研究所 一种基于核间异步消息队列与共享内存的域间通信方法
CN105939365A (zh) * 2015-06-29 2016-09-14 杭州迪普科技有限公司 主控板用户态从业务板内核态获取数据的方法及装置

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7698741B2 (en) * 2005-12-06 2010-04-13 Microsoft Corporation Controlling the isolation of an object
ATE491183T1 (de) * 2007-04-16 2010-12-15 Tixel Gmbh Verfahren und vorrichtung zur zugriffssteuerung mehrerer applikationen
CN101330390A (zh) * 2008-03-12 2008-12-24 武汉理工大学 基于多核网络处理器的慢速路径、快速路径及其接口设计方法
US8606879B2 (en) * 2009-03-12 2013-12-10 Nec Europe Ltd. Method for supporting management and exchange of distributed data of user or an entity
US8656412B2 (en) * 2009-12-25 2014-02-18 International Business Machines Corporation Pipeline across isolated computing environments
WO2012078747A1 (en) * 2010-12-08 2012-06-14 YottaStor Methods, system, and apparatus for enterprise wide storage and retrieval of large amounts of data
US8665890B2 (en) * 2011-05-20 2014-03-04 The Regents Of The University Of California Hybrid cross-layer routing protocol for MANETs
US8893261B2 (en) * 2011-11-22 2014-11-18 Vmware, Inc. Method and system for VPN isolation using network namespaces
CN103514030B (zh) * 2012-07-24 2016-12-21 Tcl集团股份有限公司 Android系统的事件收集上报系统及其收集上报方法
CN103716244B (zh) * 2013-12-27 2017-02-15 杭州华三通信技术有限公司 一种实现组播跨vpn转发的方法及装置
US20150317169A1 (en) * 2014-05-04 2015-11-05 Midfin Systems Inc. Constructing and operating high-performance unified compute infrastructure across geo-distributed datacenters
US9552250B2 (en) * 2015-03-26 2017-01-24 Vmware, Inc. Detecting X86 CPU register corruption from kernel crash dumps
US9973935B2 (en) * 2015-07-24 2018-05-15 Parallel Wireless, Inc. SON-controlled DFS
CN105099706A (zh) * 2015-08-25 2015-11-25 华为技术有限公司 一种数据通信方法、用户设备和服务器
US10146936B1 (en) * 2015-11-12 2018-12-04 EMC IP Holding Company LLC Intrusion detection for storage resources provisioned to containers in multi-tenant environments
CN105550576B (zh) * 2015-12-11 2018-09-11 华为技术服务有限公司 容器间通信的方法与装置
CN106095413B (zh) * 2016-05-31 2019-09-17 青岛海信电器股份有限公司 一种蓝牙驱动程序的配置方法及装置
US10452419B2 (en) * 2016-09-09 2019-10-22 Huawei Technologies Co., Ltd. Device virtualization for containers

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20050051277A (ko) * 2003-11-27 2005-06-01 한국전자통신연구원 해쉬 키를 이용한 주소 정보 처리 방법 및 이를 이용한라우터 장치
CN105939365A (zh) * 2015-06-29 2016-09-14 杭州迪普科技有限公司 主控板用户态从业务板内核态获取数据的方法及装置
CN105487933A (zh) * 2015-11-24 2016-04-13 无锡江南计算技术研究所 一种基于核间异步消息队列与共享内存的域间通信方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3644182A4

Also Published As

Publication number Publication date
US20200167186A1 (en) 2020-05-28
CN109324908B (zh) 2021-09-07
CN109324908A (zh) 2019-02-12
EP3644182A1 (en) 2020-04-29
EP3644182A4 (en) 2020-06-10
US11500666B2 (en) 2022-11-15

Similar Documents

Publication Publication Date Title
WO2019024669A1 (zh) Netlink资源的容器隔离方法及装置
US9529623B2 (en) Method, migration management apparatus, network device, and virtual machine server for migrating virtual machine parameters
CN109194559B (zh) 组播方法及vtep设备
EP2843906B1 (en) Method, apparatus, and system for data transmission
CN107547349B (zh) 一种虚拟机迁移的方法及装置
US9036638B2 (en) Avoiding unknown unicast floods resulting from MAC address table overflows
WO2021254330A1 (zh) 内存管理方法、系统、客户端、服务器及存储介质
EP3070887A1 (en) Communication method, device and system for virtual extensible local area network
WO2015081734A1 (zh) 一种在VxLAN中发送ARP报文发送方法、VTEP及VxLAN控制器
WO2023005773A1 (zh) 基于远程直接数据存储的报文转发方法、装置、网卡及设备
CN112631788B (zh) 数据传输方法及数据传输服务器
US10609125B2 (en) Method and system for transmitting communication data
WO2023011254A1 (zh) 基于远程直接数据存储的热迁移方法、装置及设备
US20230145093A1 (en) Packet processing method and device, advertisement method and device, bridge node, source apparatus, storage medium, and packet processing system
US20230107093A1 (en) Data download method and apparatus, computer device, and storage medium
US11537422B2 (en) Virtual machine migration downtime reduction using a multicast address
US20150055662A1 (en) Internet group management protocol (igmp) leave message processing synchronization
CN107332894B (zh) 直播方法、装置及系统、服务器、存储介质
CN112118322A (zh) 一种网络设备的数据同步方法、网络设备及系统
US9372708B2 (en) Synchronizing multicast groups
US20200218560A1 (en) Low-latency events across a virtual machine boundary
US10268532B2 (en) Application message processing system, method, and application device
US9985926B2 (en) Address acquiring method and network virtualization edge device
Liu et al. Accelerating Data Delivery of Latency-Sensitive Applications in Container Overlay Network
CN112511440B (zh) 报文转发方法、系统、存储介质和电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18841240

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018841240

Country of ref document: EP

Effective date: 20200121

NENP Non-entry into the national phase

Ref country code: DE