WO2020001162A1 - 容器管理方法、装置和设备 - Google Patents

容器管理方法、装置和设备 Download PDF

Info

Publication number
WO2020001162A1
WO2020001162A1 PCT/CN2019/085509 CN2019085509W WO2020001162A1 WO 2020001162 A1 WO2020001162 A1 WO 2020001162A1 CN 2019085509 W CN2019085509 W CN 2019085509W WO 2020001162 A1 WO2020001162 A1 WO 2020001162A1
Authority
WO
WIPO (PCT)
Prior art keywords
container
container image
user
identifier
image
Prior art date
Application number
PCT/CN2019/085509
Other languages
English (en)
French (fr)
Inventor
丁文强
李娟�
徐启帅
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19826827.8A priority Critical patent/EP3796616A4/en
Publication of WO2020001162A1 publication Critical patent/WO2020001162A1/zh
Priority to US17/117,698 priority patent/US12106253B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/08—Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01N—INVESTIGATING OR ANALYSING MATERIALS BY DETERMINING THEIR CHEMICAL OR PHYSICAL PROPERTIES
    • G01N21/00—Investigating or analysing materials by the use of optical means, i.e. using sub-millimetre waves, infrared, visible or ultraviolet light
    • G01N21/84—Systems specially adapted for particular applications
    • G01N21/88—Investigating the presence of flaws or contamination
    • G01N21/90—Investigating the presence of flaws or contamination in a container or its contents
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45562—Creating, deleting, cloning virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
    • G06F3/0484—Interaction techniques based on graphical user interfaces [GUI] for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G06F8/63—Image based installation; Cloning; Build to order

Definitions

  • the present application relates to the field of computer technology, and in particular, to a container management method, device, and device.
  • Container technology is a lightweight virtualization technology for sharing server resources.
  • a container can provide a virtual execution environment for a process.
  • a virtual execution environment is a container.
  • the container image provides the programs, libraries, resources, and configuration required by the container runtime. It does not contain any dynamic data and is a read-only special file system.
  • a container management system can distribute and run containers based on container images, or convert containers to container images and save them.
  • a container management system is loaded on a host, and the container management system can issue a container to a user and provide the user with a storage space for storing a container image on the host.
  • the user can customize the container image and store the container image to the above storage space, while other users can download the container image and start the container by themselves.
  • the present application provides a container management method, device, and equipment to overcome the security problems existing in the conventional technology.
  • the present application provides a container management method, including: obtaining a container issuance request, the container issuance request is a request for issuing a first container based on a first container image, and the container issuance request carries an identifier of the first container image And the identity of the first user; query the container image information database corresponding to the identity of the first user, because the container image information store is used to store the mapping relationship between the identity of the first user and the first container image, so when the container image When the identifier of the first container image exists in the information base, the first container image is obtained according to the identifier of the first container image, thereby realizing the issuance of the first container according to the first container image.
  • the container image information base of the first user during the container release process By querying the container image information base of the first user during the container release process, without querying the container image information base of other users, the container image of other users will not be obtained, thereby realizing user data in the container release process.
  • User-level isolation ensures the security of user data.
  • the above container image information database is registered and created, and the identity of the first user is also obtained during registration, and the container image information store is used to store one or more associated with the identity of the first user. Identifiers of two container images; if the first container image is one of one or more container images associated with the identifier of the first user, the container image information database includes the identifier of the first container image. Registering and creating the above-mentioned container image information database can ensure the correspondence between the container image information database and the identity of the first user. The container image information database of the first user cannot be obtained based on the identity of other users, further ensuring the first user's user. Data security.
  • information of the first container image is obtained according to an identifier of the first container image, and the information of the first container image may be included in the foregoing container image information database, or may be included in other information sets. And the information of the first container image can be obtained through the identifier of the first container image, so that the first container image can be obtained according to the information of the first container image.
  • the first container image may be stored in a local storage space. Through this acquisition method, the security of user data is guaranteed.
  • the first container image when the identifier of the first container image carried in the container issuance request is not included in the above container image information database, the first container image can also be obtained from the container image warehouse according to the attributes of the first container image.
  • the storage location of the private container mirror warehouse and the public container mirror warehouse of the first user may not be in the local storage space, for example, stored in the cloud, which is beneficial to the centralized management of the container mirror.
  • container images are stored separately for public or private according to their attributes, which facilitates subsequent search and isolation and further guarantees the security of user data.
  • the method may further include: generating a second container image according to the first container, and the second container image may be the same as or different from the first container image, where the second container image includes the first User information, application, and / or driver; the identity of the second container image can also be added to the container image information database, that is, the identity of the second container image is associated with the identity of the first user in the container image information database ; The second container image can also be uploaded to the private container image warehouse of the first user for container distribution, and the isolation of different user data is thereby achieved to ensure the security of user data.
  • an authentication result may also be obtained according to the identifier of the first user; when the authentication result is passed, query the foregoing container.
  • the operation of the mirror repository. The authentication operation can further improve the security of user data in the container management method by using a strict authentication algorithm.
  • the present application provides a container management apparatus, where the apparatus includes various modules for executing the container management method in the first aspect or any possible implementation manner of the first aspect.
  • a container management device includes a processor and a memory, and the memory stores at least one instruction, and the instruction is loaded and executed by the processor to implement any of the foregoing.
  • Container management methods are provided.
  • a computer-readable storage medium stores at least one instruction, and the instruction is loaded and executed by a processor to implement any one of the container management methods described above.
  • a computer program product containing instructions is provided, and when the computer program product runs on a computer, the computer is caused to execute any one of the container management methods described above.
  • This application queries the container image information database corresponding to the user's identity. After querying the container image identity from the user's container image information base, the container image is obtained based on the container image identity, and then the container is issued based on the container image. In the process of container issuance, the container image information database of the user is queried, but the container image information database of other users is not queried, and the container image of other users is not obtained, thereby realizing the user of the user data during the container release process Level isolation guarantees the security of user data.
  • FIG. 1 is a schematic diagram of a storage form of a container image in a conventional technology
  • FIG. 2 is a system architecture diagram involved in a container management method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a container image information database in a container management method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a container management method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a container management method according to an embodiment of the present invention.
  • FIG. 6 is a system architecture diagram involved in a container management method according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of a container management method according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of a container management method according to an embodiment of the present invention.
  • FIG. 9 is a structural block diagram of a container management apparatus according to an embodiment of the present invention.
  • FIG. 10 is a structural block diagram of a container management apparatus according to an embodiment of the present invention.
  • FIG. 11 is a structural block diagram of a container management apparatus according to an embodiment of the present invention.
  • Container technology is a lightweight virtualization technology for sharing server resources.
  • Container technology can provide a virtual execution environment for a process.
  • a container provides a virtual execution environment.
  • the virtual execution environment can be bound to a specific central processing unit (CPU) and a memory node to allocate a specific percentage of CPU time.
  • Input and output (IO) time limit the amount of memory that can be used, and provide device access control.
  • containers are lighter, easier to distribute, perform better, and consume less.
  • Container images provide programs, libraries, resources, and configurations required by the container runtime. They do not contain any dynamic data and are read-only special files. Container images include one or more of the following information: user information, applications, and drivers.
  • Container mirroring is a hierarchical structure that includes multiple layers of read-only data, including one or more of the following layers: the base mirroring layer, the application layer, and the user-defined layer.
  • UFS unified file system
  • a container is an instance created based on a container image, and this instance is an object that includes user configuration and running configuration required to implement the functions of the container image.
  • Distributing a container based on a container image may be based on adding a read-write layer to the read-only layer of the container image, and the multiple read-only layers and read-write layers may be integrated into a container through a union mount (UM) technology.
  • Containers are divided into application containers and system containers according to different application scenarios.
  • the application container is mainly for stateless application orchestration and scheduling.
  • the application container image contains the application itself and the running environment configuration.
  • the system container is orchestration and scheduling for computing resources such as CPU, memory, storage, etc.
  • the system container has a full operating system (OS) environment, supports stateful applications, and can provide dynamic resource allocation.
  • OS operating system
  • a computing service system that provides computing services generally includes a management host for managing the provided computing services and a business host that provides specific computing services.
  • the computing service system may further include a storage host, a storage host Used to store data about the computing services provided.
  • a business host is loaded with a container management system, which provides users with containers running on the business host, and provides the user with local storage space for storing container images on the business host. In the local storage space of the business host, multiple container images of one or more users may be stored.
  • the attributes of a container image can include: public and private.
  • a container image with a public property is called a public container image, which means that the container image is a container image that is open to all users.
  • a container image with a private property is called a private container image.
  • the private container image can be specified by the user whether it is open to all users.
  • container image A and container image B of the first user, and container image B and container image C of the second user are stored.
  • container image B is a public container image
  • container image A is a private container image of a first user
  • container image C is a private container image of a second user.
  • the storage of container image A, container image B, and container image C on the business host is not isolated at the user level.
  • the container image of the first user and the container image of the second user can be obtained in the local storage space of the business host, that is, container image A, container image B, and container image C. Distribute containers based on container image A, container image B, or container image C.
  • the container management system cannot provide isolation of container images of different users on the business host, which is not conducive to protecting the security of user data.
  • the present invention provides a container management scheme to implement user-level isolation of user data during container distribution.
  • This container management solution can provide users with a container management solution based on infrastructure as a service (IaaS), and IaaS can provide computing services based on a complete computer infrastructure, such as cloud computing services.
  • IaaS infrastructure as a service
  • the system architecture includes business hosts, management hosts, and storage hosts.
  • the business host is used to provide specific cloud computing services
  • the management host is used to manage the provided cloud computing services
  • the storage host is used to store relevant data of the provided cloud computing services.
  • the service host, the management host, and the storage host may be the same physical host or virtual host, or may be different physical hosts or virtual hosts.
  • the physical host or virtual host may be a host in the IaaS computing resource pool.
  • a container management system runs in the cloud service management system, and the container management system includes at least a container engine and a container image warehouse.
  • a business host has at least a computing control module of a cloud service management system, a container engine of a container management system, and a container image warehouse; the management host has at least an authentication module of a cloud service management system;
  • the storage host has at least a container image warehouse of a container management system, and the container image warehouse includes a public container image warehouse and a private container image warehouse.
  • the cloud service management system may further include other business hosts in which a computing control module and a container engine are deployed. Each module of the container management system is on the business host.
  • the deployment methods on management hosts and storage hosts are not limited to the above examples.
  • the computing control module is used to deploy cloud computing, including running instances, managing networks, and controlling users.
  • Authentication module A module for managing authentication, service rules, and token functions.
  • the container engine is used for container-related management and user management.
  • Container image warehouses are used for storage and distribution of container images, including public container image warehouses and private container image warehouses.
  • the local storage space of the business host also stores one or more container images of users who are users of the container engine registered on the business host.
  • the one or more container images can be downloaded from the public container image warehouse in the container image warehouse or the user's private container image warehouse, or can be obtained by converting the containers on the business host.
  • the container image information database includes the identity of the container image associated with the user's identity in the local storage space of the business host.
  • the container image's identity can also be used to obtain the container image information.
  • the container image information includes one of the following information: One or more types: attributes of the container image and storage location information of the container image, such as storage index information. It should be noted that the container image information can be contained in the user's container image information database, or can be stored in other information storage spaces or in other information collections, but no matter where it is stored, it can be mirrored through the container. The mapping relationship between the identifier and the information mirrored by the container can be found.
  • the identity of the user may be a user's identification (ID) and / or a user's token.
  • the identifier of the container image may be the ID of the container image and / or the name of the container image. It should be noted that the user has the right to query the container image database of the user, but does not have the right to query the container image database of other users.
  • the container image information database of the first user includes the identifier of the container image A and the identifier of the container image B.
  • the container image information database of the second user includes the identifier of the container image B and the identifier of the container image C.
  • container image B is a public container image
  • container image A is a private container image of a first user
  • container image C is a private container image of a second user.
  • Container image A includes layers A1, A2, and B
  • container image B includes layer B
  • container image C includes layers B and C.
  • layer A1 is the user-defined layer for the first user
  • layer A2 is the application layer for the first user
  • layer B is the public base image layer
  • layer C is the user-defined layer for the second user.
  • the container mirroring information database also includes storage index information of container mirroring layer A1, A2, and B, container mirroring layer B of storage mirroring information, and container mirroring layer C and storage indexing information of layer C.
  • the container image information database of the first user in the service host includes an identifier of the container image associated with the identity of the first user
  • the container image information database of the second user includes the container image associated with the identity of the second user. Identification, the user cannot query the container image information base of other users, that is, the identity of the container image in the container image information base of other users cannot be obtained, thereby achieving user-level isolation of user data.
  • FIG. 2 The system architecture shown in FIG. 2 is taken as an example to describe the method embodiment of the present invention.
  • FIG. 4 a flowchart of a container management method according to an embodiment of the present invention is shown.
  • the method manages a container distribution process, and includes:
  • Step 401 The calculation control module obtains a registration request of the first user, registers information of the first user according to the registration request, and obtains an identity of the first user.
  • the registration request of the first user is obtained by a computing control module in the service host.
  • the user interaction interface of the computing control module obtains the information of the first user, and generates the identifier of the first user based on the information of the first user. .
  • Step 402 The container engine obtains the identity of the first user from the calculation control module.
  • Step 403 The container engine registers and creates a container image information database of the first user based on the identifier of the first user, and the container image information database includes one or more container image identifiers associated with the identifier of the first user.
  • Step 404 The container engine stores the container image information of the first user into a local storage space of a business host where the container engine is located.
  • steps 401 to 404 are the processes of creating a container image information database.
  • the container image information database is not required to be re-created every time. Therefore, the above steps 401 to 404 are the steps in the container distribution process. Optional steps.
  • Step 405 The container engine obtains a container issuance request, and the container issuance request carries an identifier of the first user and an identifier of the first container image.
  • the identifier of the first container image is used to indicate the first container image required by the first container requested by the container issuance request.
  • the identifier of the first container image may be the ID of the first container image and / Or the name of the first container image; the identity of the first user is used for operations such as authentication during the container issuance process, and obtaining the container image warehouse of the first user; optionally, the identity of the first user may include the ID of the first user and / Or the token of the first user.
  • step 405 includes:
  • the container engine obtains the user's container issuance request through the user interaction interface.
  • the user interaction interface may also be implemented by other components deployed on a business host or a management host.
  • a container issuance request is obtained through the user interaction interface, and it is output to a container engine, which is obtained by the container engine.
  • Step 406 The container engine obtains the container image information database corresponding to the identifier of the first user from the local storage space.
  • the container image information database of the first user corresponds to the ID of the first user one by one
  • the container image information database corresponding to the identifier of the first user is the container image information database corresponding to the ID of the first user.
  • the ID of the first user may be obtained by the container engine through a computing control module deployed in the service host, and the ID of the first user is generated when the first user registers through the computing control module.
  • the container image information database of the first user is stored in a data file in a local storage space of a business host where the container engine is located, and the container image information database includes an ID associated with the first user.
  • an optional implementation manner of step 406 includes: the container engine obtains an authentication result based on the identity of the first user, and when the authentication passes, the container engine queries the identity of the first user for Container image repository.
  • the authentication operation may be that the container engine authenticates the token of the first user based on the user registration information in the container management system, or the container engine outputs the token of the first user to other authentication modules through an interface. Authentication.
  • Step 407 The container engine queries the identifier of the first container image in the container image information database corresponding to the identifier of the first user.
  • step 407 includes:
  • the container engine queries the identifier of the first container image in the container image information database corresponding to the identifier of the first user according to the ID of the first user.
  • the identifier of the first container image may be used to obtain information of the first container image.
  • the information of the first container image may include: an identifier of one or more read-only layers included in the first container image, and storage index information of the one or more read-only layers, where the storage index information is used for local storage Get read-only layers in space.
  • the information of the first container image may be contained in the container image information database of the first user, or may be stored in other information storage spaces or contained in other information collections.
  • step 408 is performed.
  • the container engine may also obtain the first container image from the container image repository.
  • An optional implementation manner is that the method further includes:
  • the container engine obtains the first container image from the private container image repository of the first user;
  • the container engine obtains the first container image from the public container image repository.
  • the private container mirror repository and the public container mirror repository of the first user can be deployed on the business host or other hosts.
  • the container engine can be obtained from the private container mirror repository or the public container mirror repository of the first user through a local interface or a remote interface.
  • the first container is mirrored.
  • the attributes of the first container image are obtained by the container engine from the management host according to the identifier of the first image.
  • Step 408 When the identifier of the first container image exists in the container image information database of the first user, the container engine obtains the first container image from the local storage space of the host where the container engine is located based on the identifier of the first container image, and according to the first A container mirrors the first container.
  • step 408 when the identifier of the first container image exists in the container image information database of the first user, step 408 includes:
  • the container engine obtains the information of the first container image according to the identifier of the first container image; the container engine obtains the first container image from the local storage space based on the information of the first container image, and the container engine starts the first container according to the first container image. For example, the container engine obtains one or more read-only layers included in the first container image from the local storage space according to the information of the first container image; the container engine associates the one or more read-only layers with the first container to be issued The required read-write layer is integrated into the first container through the UM technology, and the first container is issued.
  • a container image information database corresponding to a user's identity is queried. After the container image identity is queried from the user's container image information base, a container image is obtained based on the container image identity, and then based on the container image Dispensing container. In the process of container issuance, only the container image information base of this user is queried, and the container image information base of other users is not queried, and the container image of other users is not obtained, thereby realizing user data in the container issuance process.
  • User-level isolation ensures the security of user data.
  • the container management method may also be used to manage a process of submitting a container image.
  • FIG. 5 a flowchart of a container management method according to an embodiment of the present invention is shown. The method manages the process of submitting a container image, including:
  • Step 501 The container engine obtains a container image submission request.
  • the container image submission request is used to request a second container to be converted into a second container image and submitted.
  • the second container is a container instance of the first user in the service host, and the container image submission request carries the identifier of the first user and the identifier of the second container.
  • the identifier of the second container may be the ID of the second container and / or the name of the second container; the identifier of the first user is used for operations such as authentication in the container image submission process, and obtaining the container image warehouse of the first user.
  • the identity of the first user may include an ID of the first user and / or a token of the first user.
  • the container image submission request may be a container image submission request obtained by a user through a user interaction interface.
  • the user interaction interface may also be implemented by other components deployed on a business host or a management host.
  • the component obtains a container image submission request through the user interaction interface and outputs it to the container engine, which is obtained by the container engine.
  • Step 502 The container engine obtains a second container, and the second container is stored in a local storage space of a host where the container engine is located.
  • Step 503 The container engine generates a second container image according to the second container.
  • step 503 includes:
  • the container engine reads the read-only layers included in the second container separately and loads them layer by layer to obtain a second container image.
  • the container image submission request further includes a token of the first user.
  • An optional implementation of step 503 includes:
  • the container engine obtains the authentication result according to the token of the first user
  • the container engine If the authentication is passed, the container engine generates a second container image according to the second container.
  • step 406 For the authentication operation, refer to the related description of step 406, and details are not described herein again.
  • Step 504 The container engine adds the identifier of the second container image to the container image information database of the first user.
  • step 504 includes:
  • the container image information database of the first user is stored in the service host, and the container engine obtains the container image information database of the first user in the service host according to the ID of the first user; the container engine stores the second container image locally in the service host In the storage space, the identifier of the second container image is added to the container image information database of the first user, and the information of the second container image is associated with the identifier of the first user.
  • step 504 includes:
  • the container engine obtains the authentication result based on the identity of the first user.
  • For the authentication operation refer to the related description in step 406, and details are not described herein again.
  • the identity of the second container image is added to the container image information database of the first user, and the addition operation may be implemented by the container engine or other components deployed on the management host.
  • the authentication based on the identity of the first user may be that the container engine performs authentication based on the token of the first user included in the identity of the first user.
  • the method further includes: Step 505, the container engine uploads the second container image to the private container image repository of the first user.
  • the container engine stores the second container image into the private container image repository of the first user through a local interface or a remote interface.
  • the container engine stores the second container image into the private container image repository of the first user on the storage host through a local interface or a remote interface.
  • a user's container is converted into a container image, and an identifier of the container image is added to the container image information database of the user, so that the container image information database of the user includes the identifier of the container image belonging to the user, and services can be obtained.
  • the container image of the user belongs to the storage space of the host without obtaining the container images of other users, thereby achieving user-level isolation of user data and ensuring the security of user data.
  • the cloud service management system may be openstack
  • the container management system may be a docker container management system.
  • openstack includes at least nova, keystone (authentication), and glance (openstack image service component).
  • nova includes nova API (interface), nova inductor, nova scheduler (scheduler), and nova compute (calculation).
  • the docker container management system includes at least docker and docker registry (repository).
  • nova compute and docker on the business host may be the same physical host or virtual host, and the deployment methods of the above components on the business host, management host, and storage host are not limited to the above examples.
  • Nova is used for docker-related interfaces to implement container management on business hosts, and its functions are similar to the above-mentioned cloud service management system.
  • Keystone is an authentication module, which is used to interface with docker to authenticate the user's identity.
  • the information of the container image includes but is not limited to the following information: the identity of the container image and the attributes of the container image.
  • Docker is used to implement user management and container management on the business host, and its functions are similar to the above container engine.
  • the docker registry is used for storage and distribution of container images, including public registry and private registry.
  • Public registry stores public container images
  • private registry stores user's private container images.
  • the functions are similar to the above container image management warehouse.
  • docker can also include one or more of the following interfaces:
  • the docker authentication interface is used to authenticate the user's identity, and the authentication result is used to determine whether the user has the current operation authority; if the authentication result is passed, the user has the current operation authority; if the authentication result is If it fails, the user does not have permission for the current operation.
  • the docker authentication interface can proxy other authentication modules and provide interfaces for other authentication modules to implement authentication operations.
  • the docker authentication interface can proxy openstack's keystone, output the user's identity to keystone through the relevant interface, and obtain and output the result of keystone's authentication of the user's identity to complete the authentication of the user's identity right.
  • the identity of the user includes the user's token.
  • the docker authentication interface may be added to docker in the form of a plug-in.
  • Docker user management interface used to implement user registration, logout, and query functions. It also allows users to register and create a container image database of the user in docker through the docker user management interface. It is also possible to unregister and delete the user's container. Image repository.
  • the function implementation of the docker user management interface may include: outputting information related to a user's registration, deregistration, or query request to keystone through the docker user management interface, and obtaining and outputting keystone's registration, deregistration, or query request for the user the result of.
  • the docker user management interface may also output the registration, logout, or query results through a user interaction interface.
  • Docker interface It is used to download the container image from a private registry or a public registry according to user requirements. The process is as follows: the user's identity is authenticated through the docker authentication interface; if the authentication result is passed, and the user's container image information is passed The library does not include information about the container image. Download the container image from a private registry or a public registry to the local storage space of the business host. In addition, the docker pull interface can also add the container image information to the user's container image information database.
  • dockercommit interface used to convert the user's container into the user's private container image, the process is as follows: the user's identity is authenticated through the docker authentication interface; if the authentication result is passed, and the user exists on the business host The container image repository; convert the container into a container image and add the container image information to the user's container image repository.
  • the docker commit interface can also save the converted container image in the local storage space of the business host.
  • Docker creates a container instance interface It is used to create a container according to user needs. The process is as follows: authentication is performed based on the user's identity through the docker authentication interface; if the authentication result is passed, it is determined whether the user's container image exists on the business host.
  • the container image database of the user if the container image database of the user exists, query the required container image information in the user's container image database; if the user's container image database includes the container image information, based on the container The image information is used to obtain the container image; if the user's container image information database does not include the container image information, call the docker pull interface to download the container image from the private registry or the public registry to the business host; create a container based on the container image Or, add the downloaded container image information to the user's container image information base, obtain the container image information through the user's container image information base, obtain the container image based on the container image information, and based on the container Image creation container.
  • docker interface used to upload a local container image to a private registry or a public registry, the process is as follows: authentication is based on the user's identity through the docker authentication interface; if the authentication result is passed, the information is mirrored in the user's container Information on the container image is queried in the database; if the container image information of the user includes the information of the container image, the container image is uploaded to the user's private registry or public registry.
  • Docker container image information query interface used to query the container image information associated with the user's identity according to user needs.
  • the docker container image information query interface may query information of a container image included in a container image information database of the user.
  • the docker container image information query interface calls glance to query information of the container image included in the user's private registry.
  • the information about the container image is an identifier of the container image.
  • the docker container image information query interface can also output query results through a user interaction interface.
  • Container image management includes submitting container images, downloading container images, and viewing container images.
  • FIG. 7 a flowchart of a container management method provided by the present invention is shown. Taking the method for issuing containers in an openstack-based docker container management system shown in FIG. 6 as an example, the method includes:
  • Step 701 Nova receives a container issuance request through Nova API.
  • the container issuance request is used to request a third container to be issued.
  • the container issuance request includes at least the identity of the first user and the third container image that initiated the container issuance request.
  • the third container image is the container image required to issue the third container.
  • the identifier of the first user may include an ID of the first user and / or a token of the first user; the identifier of the third container image is an ID of the third container image and / or a name of the third container image .
  • Step 702 Nova invokes keystone to authenticate the token of the first user; if the authentication result is passed, step 703 is performed.
  • step 702 further includes: if the authentication result is not passed, issuing the container fails.
  • nova invokes nova scheduler to select a business host to issue a third container, and passes information related to the container issuance request to the nova compute deployed on the business host.
  • Step 704 Nova Compute calls glance to obtain the attributes of the third container image according to the identity of the third container image.
  • Nova Compute is deployed on the business host, and the attributes of the third container image are public or private.
  • step 704 it may further include: Nova Compute calls glance to obtain the name of the third container image according to the ID of the third container image.
  • Step 705 Nova Compute calls docker, and passes the related information of the container issuance request to docker.
  • the related information of the container issuance request includes, but is not limited to, the container issuance request, the identity of the first user, and the identity of the third container image.
  • Step 706 The docker invokes keystone to authenticate the token of the first user; if the authentication result is passed, step 707 is performed; if the authentication result is not passed, issuing the container fails.
  • Step 707 docker invokes the docker user management interface to query whether the container image information database of the first user exists; if the container image information database of the first user exists, execute step 708; if the container image information database of the first user does not exist, issue Container failed.
  • step 707 further includes: if the container image information database of the first user does not exist, and the container fails to be distributed, the information of the non-existence of the container image information database of the first user is fed back to the A user, the first user may trigger the establishment of the container image information database of the first user according to the feedback result of Nova API. For the operation of establishing the container image information database of the first user, see step 501.
  • Step 708 Docker calls the docker container image information query interface to query whether the information of the third container image exists in the container image information database of the first user. If the information of the third container image exists, step 709 is performed. If the information does not exist, go to step 710.
  • Step 709 The docker obtains the information of the third container image, and obtains the third container image based on the information of the third container image, and executes step 713.
  • step 710 docker determines the attributes of the third container image; if the attributes of the third container image are public, step 711 is performed; if the attributes of the third container image are private, step 712 is performed.
  • Step 711 Docker calls the docker pull interface to download the third container image from the public registry, and executes step 713.
  • Step 712 The docker invokes the docker pull interface to download the third container image from the private registry of the first user, and executes step 713.
  • Step 713 Docker creates and issues a third container based on the third container image.
  • steps 706-713 are implemented by docker calling docker to create a container instance interface.
  • the invention queries the container image information database corresponding to the user's identity. After querying the container image identity from the user's container image information base, the container image is obtained based on the container image identity, and then the container is issued based on the container image. In the process of container issuance, the container image information database of the user is queried, but the container image information database of other users is not queried, and the container image of other users is not obtained, thereby realizing the user of the user data during the container issuance process. Level isolation guarantees the security of user data.
  • the docker interface in docker is used to transfer instructions, information and / or data to various modules in the openstack system, which can reuse user registration, authentication and other functions in the openstack system to ensure the user data under the docker container management system. safety.
  • FIG. 8 shows a flowchart of a container management method provided by the present invention. Taking the method for managing the process of submitting a container image in an openstack-based docker container management system shown in FIG. 6 as an example, the method includes :
  • Step 801 Nova receives a container image submission request through Nova API.
  • the container image submission request is used to request that the fourth container be converted into a fourth container image and submitted.
  • the request for issuing the container includes:
  • Step 802 Nova calls keystone to authenticate the token of the first user; if the authentication result is passed, step 803 is performed.
  • Step 803 Nova obtains the identity of the business host and the fourth container where the docker container instance is located according to the identity of the docker container instance.
  • Step 804 Nova passes information related to the container image submission request to Nova Compute.
  • the related information of the container image submission request includes, but is not limited to, the container image submission request, the identity of the first user, and the identity of the fourth container.
  • Nova Compute is deployed on the business host.
  • Step 805 Nova Compute calls docker, and passes the relevant information of the container image submission request to docker.
  • Step 806 Docker invokes keystone to authenticate the token of the first user; if the authentication result is passed, step 807 is performed; if the authentication result is not passed, submission of the container image fails.
  • Step 807 Docker calls the docker user management interface to query whether the container image information database of the first user exists; if the container image information database of the first user exists, execute step 808; if the container image information database of the first user does not exist, submit the container Mirroring failed.
  • Step 808 Docker calls the docker commit interface to convert the fourth container into a fourth container image, and adds the information of the fourth container image to the container image information database of the first user.
  • Step 809 Nova compute calls glance to create a glance image.
  • the glance image is a mirror of the fourth container image in glance, so that Nova can use the glance image for container distribution on other business hosts.
  • step 809 further includes: establishing a mapping relationship between an identifier of the glance image and a name of the fourth container image.
  • Step 810 Docker calls the docker push interface to upload the fourth container image to the private registry of the first user.
  • step 810 includes: docker calls docker push interface, docker push interface calls docker user management interface to output the first user's token to keystone for authentication, and if the authentication result is passed, upload the fourth container image To the user's private registry.
  • a container of a user is converted into a container image and an identifier of the container image is added to a container image information database of the user, so that the container image information database of the user includes an identifier of a container image belonging to the user, and a service host can be obtained.
  • the container image belonging to the user in the storage space of the server does not obtain the container images of other users, thereby achieving user-level isolation of user data and ensuring the security of user data.
  • the docker interface in docker is used to transfer instructions, information and / or data to various modules in the openstack system, which can reuse user registration, authentication and other functions in the openstack system to ensure the user data under the docker container management system. safety.
  • FIG. 9 shows a block diagram of a container management apparatus 900 provided by the present invention, which includes: an obtaining module 910, a querying module 920, and a issuing module 930.
  • the obtaining module 910 is configured to obtain a container issuance request.
  • the container issue request carries the identifier of the first user and the identifier of the first container image.
  • the query module 920 is configured to query a container image information database corresponding to the identifier of the first user, and the container image information database is used to store a mapping relationship between the identifier of the first user and the first container image.
  • the issuing module 930 is configured to obtain a first container image based on the identifier of the first container image when the identifier of the first container image exists in the container image information database, and issue the first container according to the first container image.
  • the issuing module 930 is configured to obtain information of the first container image based on the identifier of the first container image; obtain the first container image from the local storage space according to the information of the first container image, and Start the first container according to the first container image.
  • the query module 920 is configured to obtain an authentication result based on the identity of the first user; when the authentication result is passed, query the container image information database corresponding to the identity of the first user.
  • the issuing module 930 is further configured to: when the identifier of the first container image does not exist in the container image information database and the attribute of the first container image is private, remove the private container from the first user.
  • the first container image is obtained from the image repository; or when the identifier of the first container image does not exist in the container image information base and the attributes of the first container image are public, sometimes the first container image is obtained from the public container image repository.
  • the container management apparatus 900 further includes:
  • a creating module is configured to register and create a container image information base corresponding to the first user's identity based on the identity of the first user, and the container image information base includes one or more container image identity associated with the first user's identity.
  • the container management apparatus 900 further includes:
  • the generating module 940 is configured to generate a second container image according to the first container, where the second container image includes at least one of information, applications, and drivers of the first user.
  • the adding module 950 is configured to add the identifier of the second container image to the container image information database of the first user.
  • the uploading module 960 is configured to upload the second container image to the private container image repository of the first user.
  • the container management device 900 may be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (programmable logic device (PLD)).
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above PLD may be a complex program Logic devices (complex, programmable, logical, device, CPLD), field-programmable gate array (FPGA), general array logic (GAL), or any combination thereof.
  • the container management method shown in FIG. 4 or FIG. 5 can also be implemented by software, the device and each module thereof may also be software modules.
  • the container management apparatus 900 may correspond to executing the method described in the embodiment of the present invention, and the above and other operations and / or functions of the respective units in the container management apparatus 900 are implemented in order to implement FIG. 4 or FIG. 5, respectively.
  • the corresponding processes performed by the container engine in each of the methods are not repeated here for brevity.
  • the invention queries the container image information database corresponding to the user's identity. After querying the container image identity from the user's container image information base, the container image is obtained based on the container image identity, and then the container is issued based on the container image. In the process of container issuance, the container image information database of the user is queried, but the container image information database of other users is not queried, and the container image of other users is not obtained, thereby realizing the user of the user data during the container release process Level isolation guarantees the security of user data.
  • the user's container is converted into a container image, and the identity of the container image is added to the user's container image information database, so that the user's container image information database includes the identity of the container image belonging to the user, thereby realizing user data User-level isolation, ensuring the security of user data.
  • the container management device 1100 includes a processor 1101, a memory 1102, a communication interface 1103, a bus 1104, and a graphics processor 1105.
  • the processor 1101, the memory 1102, the communication interface 1103, and the storage device 1105 communicate through the bus 1104, and communication may also be implemented by other means such as wireless transmission.
  • the memory 1102 is configured to store instructions, and the processor 1101 is configured to execute instructions stored in the memory 1102.
  • the memory 1102 stores program code, and the processor 1101 can call the program code stored in the memory 1102 to perform the following operations:
  • the container issuance request carries an identifier of a first user and an identifier of a first container image
  • the container image information database Querying the container image information database corresponding to the identifier of the first user, where the container image information database is used to store the mapping relationship between the identifier of the first user and the first container image;
  • the first container image is obtained based on the identifier of the first container image, and the first container is issued according to the first container image.
  • the processor 1101 may be a CPU, and the processor 1101 may also be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a field programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable Gate Array
  • a general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor 1101 may be a processor supporting an ARM architecture.
  • the memory 1102 may include a read-only memory and a random access memory, and provide instructions and data to the processor 1101.
  • the memory 1102 may further include a non-volatile random access memory.
  • the memory 1102 may also store device type information.
  • the memory 1102 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), or Erase programmable read-only memory (EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • direct RAMbus RAM direct RAMbus RAM, DR RAM
  • the bus 1104 may include a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, various buses are marked as the bus 1104 in the figure.
  • the container management device 1100 may correspond to the container management apparatus 900 shown in FIG. 9 or FIG. 10 in the embodiment of the present invention, and may correspond to the execution of FIG. 4 or FIG.
  • the container engine in the method shown in 5 is an operation step of executing the main body, and the above and other operations and / or functions of each module in the container engine are to implement the corresponding process of each method in FIG. 4 or FIG. 5, respectively, and for simplicity, I will not repeat them here.
  • An embodiment of the present invention further provides a non-transitory computer-readable storage medium, and when the instructions in the storage medium are executed by a processor of a computing system, the computing system can execute any of FIG. 4, 5, 7, or 8 A provided container management method.
  • a computer program product containing instructions that, when run on a computer, causes the computer to execute instructions for performing the container management method provided in any one of FIG. 4, 5, 7, or 8.
  • all or part may be implemented by software, hardware, firmware, or any combination thereof.
  • software When implemented using software, it may be all or partly implemented in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a device, all or part of the processes or functions according to the embodiment of the present invention are generated.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, a computer, a server, or a data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a device or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape, etc.), an optical medium (such as a Digital Video Disk (DVD), etc.), or a semiconductor medium (such as a solid state hard disk, etc.).
  • sequence numbers of the foregoing embodiments of the present invention are merely for description, and do not represent the superiority or inferiority of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Economics (AREA)
  • Immunology (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Biochemistry (AREA)
  • General Health & Medical Sciences (AREA)
  • Chemical & Material Sciences (AREA)
  • Pathology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Development Economics (AREA)
  • Health & Medical Sciences (AREA)
  • Analytical Chemistry (AREA)
  • Human Resources & Organizations (AREA)
  • Marketing (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Strategic Management (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Facsimiles In General (AREA)
  • Processing Or Creating Images (AREA)

Abstract

一种容器管理方法、装置和设备。方法包括获取携带第一用户的标识和第一容器镜像的标识的发放请求，从第一用户的容器镜像信息库中查询得到第一容器镜像的标识，再基于该第一容器镜像的标识获得容器镜像，进而基于该容器镜像发放容器。以此保证了用户数据的安全性。

Description

容器管理方法、装置和设备 技术领域
本申请涉及计算机技术领域，尤其涉及一种容器管理方法、装置和设备。
背景技术
容器技术是一种轻量级的虚拟化技术，用于实现服务器资源的共享。容器可以为进程提供虚拟的执行环境，一个虚拟的执行环境就是一个容器。容器镜像提供容器运行时所需的程序、库、资源和配置，其不包含任何动态数据，是个只读的特殊文件系统。一个容器管理系统可以基于容器镜像分发并运行容器，也可以将容器转换成容器镜像并保存。
传统技术中，在一个主机上装载有容器管理系统，该容器管理系统可为用户发放容器，并在该主机上为该用户提供存储容器镜像的存储空间。用户可以自定义容器镜像，并存储该容器镜像至上述存储空间，而其他用户可以自行下载该容器镜像并启动容器。
然而，上述容器管理系统在发放容器时，用户不仅可以获得该用户存储的容器镜像，也可以获得其他用户存储的容器镜像，可能会导致用户数据的泄露，存在安全问题。
发明内容
本申请提供一种容器管理方法、装置和设备，以克服传统技术中存在的安全问题。
一方面，本申请提供一种容器管理方法，包括：获取容器发放请求，该容器发放请求是用于发放基于第一容器镜像的第一容器的请求，该容器发放请求携带第一容器镜像的标识和第一用户的标识；查询该第一用户的标识所对应的容器镜像信息库，由于该容器镜像信息库用于存储第一用户的标识与第一容器镜像的映射关系，因而当该容器镜像信息库中存在第一容器镜像的标识时，根据第一容器镜像的标识获取第一容器镜像，由此实现根据该第一容器镜像发放第一容器。通过在容器发放过程中，查询该第一用户的容器镜像信息库，而不查询其他用户的容器镜像信息库，更不会获取其他用户的容器镜像，从而实现了容器发放过程中的用户数据的用户级隔离，保证了用户数据的安全性。
在一种可能的实现方式中，注册并创建上述容器镜像信息库，在注册时，还获得了第一用户的标识，该容器镜像信息库用于存储与第一用户的标识关联的一个或者多个容器镜像的标识；若第一容器镜像是第一用户的标识关联的一个或者多个容器镜像之一，则该容器镜像信息库中包括第一容器镜像的标识。注册并创建上述容器镜像信息库，可以保证该容器镜像信息库与第一用户的标识的对应性，无法根据其他用户的标识获得第一用户的容器镜像信息库，进一步保证了第一用户的用户数据的安全性。
在另一种可能的实现方式中，根据第一容器镜像的标识获取第一容器镜像的信息， 第一容器镜像的信息可以包含于上述容器镜像信息库中，也可以包含于其他信息集合中，且通过该第一容器镜像的标识能够获取到该第一容器镜像的信息，从而根据第一容器镜像的信息可以获得第一容器镜像。此外，该第一容器镜像可以存储于本地存储空间中。通过该获取方式，保证了用户数据的安全性。
在另一种可能的实现方式中，当容器发放请求所携带的第一容器镜像的标识不包含于上述容器镜像信息库中时，还可以根据第一容器镜像的属性从容器镜像仓库中获取第一容器镜像；当第一容器镜像的属性是私有时，该容器镜像仓库是第一用户的私有容器镜像仓库；当第一容器镜像的属性是公有时，该容器镜像仓库是公有容器镜像仓库。第一用户的私有容器镜像仓库和公有容器镜像仓库的存储位置可以不在本地存储空间中，例如存储在云端，有利于容器镜像的集中管理。此外，容器镜像按照其属性为公有或者私有进行分开存储，便于后续的查找和隔离，进一步保证用户数据的安全性。
在另一种可能的实现方式中，该方法还可以包括：根据第一容器生成第二容器镜像，该第二容器镜像与第一容器镜像可以相同或者不同，其中第二容器镜像包括有第一用户的信息、应用和/或驱动；还可以将第二容器镜像的标识添加到上述容器镜像信息库中，即在上述容器镜像信息库中将第二容器镜像的标识与第一用户的标识关联；还可以将第二容器镜像上传至第一用户的私有容器镜像仓库，以用于容器发放，且由此实现不同用户数据的隔离，保证用户数据的安全性。
在另一种可能的实现方式中，在查询第一用户的标识对应的容器镜像信息库之前，还可以根据第一用户的标识获得鉴权结果；当鉴权结果是通过时，进行查询上述容器镜像信息库的操作。鉴权操作可以使用严密的鉴权算法进一步提高该容器管理方法中的用户数据的安全性。
第二方面，本申请提供一种容器管理装置，所述装置包括用于执行第一方面或第一方面任一种可能实现方式中的容器管理方法的各个模块。
第三方面，提供了一种容器管理设备，所述装置包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上面所述的任一容器管理方法。
第四方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现上面所述的任一容器管理方法。
第五方面，提供了一种包含指令的计算机程序产品，当所述计算机程序产品在计算机上运行时，使得所述计算机执行上面所述的任一容器管理方法。
本申请提供的技术方案至少包括以下有益效果：
本申请查询用户的标识对应的容器镜像信息库，从该用户的容器镜像信息库中查询到容器镜像的标识后，再基于该容器镜像的标识获得容器镜像，进而基于该容器镜像发放容器。使得在容器发放的过程中，查询该用户的容器镜像信息库，而不查询其他用户的容器镜像信息库，更不会获取其他用户的容器镜像，从而实现了容器发放过程中的用户数据的用户级隔离，保证了用户数据的安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不 能限制本申请。
附图说明
图1是传统技术中容器镜像的存储形式的示意图；
图2是本发明实施例提供的一种容器管理方法所涉及的系统架构图；
图3是本发明实施例提供的容器管理方法中的容器镜像信息库的示意图；
图4是本发明实施例提供的一种容器管理方法的流程图；
图5是本发明实施例提供的一种容器管理方法的流程图；
图6是本发明实施例提供的一种容器管理方法所涉及的系统架构图；
图7是本发明实施例提供的一种容器管理方法的流程图；
图8是本发明实施例提供的一种容器管理方法的流程图；
图9是本发明实施例提供的一种容器管理装置的结构方框图；
图10是本发明实施例提供的一种容器管理装置的结构方框图；
图11是本发明实施例提供的一种容器管理装置的结构方框图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
在对本发明实施例进行详细的解释说明之前，先对本发明实施例涉及的应用场景予以介绍。
容器技术是一种轻量级的虚拟化技术，用于实现服务器资源的共享。容器技术可以为进程提供虚拟的执行环境，一个容器提供一个虚拟的执行环境，该虚拟的执行环境可绑定特定的中央处理器(central processing unit，CPU)和内存节点，分配特定比例的CPU时间、输入输出(input output，IO)时间，限制可以使用的内存大小，提供设备访问控制等。与虚拟机相比，容器具有更轻量、更易分发、性能更高、损耗更小等特点。
容器镜像提供容器运行时所需的程序、库、资源和配置，不包含任何动态数据，是只读的特殊文件，容器镜像包括以下信息中的一个或者多个：用户的信息、应用和驱动。容器镜像是分层结构，包括多层只读数据，其中包括以下层中的一个或者多个：基础镜像层、应用程序层和用户自定义层等。通过统一文件系统(union file system，UFS)技术可以将多个只读层整合成一个容器镜像。
容器是基于容器镜像创建的实例，该实例是包括实现该容器镜像的功能所需要的用户配置和运行配置的对象。基于容器镜像发放容器可以是在容器镜像的只读层的基础上增加读写层，并可以通过联合安装(union mount，UM)技术将该多个只读层和读写层整合成一个容器。容器根据应用场景的不同分为应用容器和系统容器。应用容器主要面向无状态应用编排调度，应用容器镜像包含应用本身和运行环境配置。系统容器则是面向如CPU、内存、存储等计算资源的编排调度，系统容器拥有全量操作系统(operating system，OS)环境，支持有状态应用，能够提供动态资源分配。
传统技术中，提供计算服务的计算服务系统一般包括用于对所提供的计算服务进 行管理的管理主机和提供具体的计算服务的业务主机，此外，该计算服务系统还可以包括存储主机，存储主机用于存储所提供的计算服务的相关数据。在一个业务主机上装载有容器管理系统，为用户发放在该业务主机上运行的容器，并在该业务主机上为该用户提供存储容器镜像的本地存储空间。在该业务主机的本地存储空间中，可能存储有一个或者多个用户的多个容器镜像。容器镜像的属性可以包括：公有和私有，属性为公有的容器镜像称为公有容器镜像，是指该容器镜像是面向所有用户开放的容器镜像；属性为私有的容器镜像称为私有容器镜像，是指该容器镜像是某个用户私有的容器镜像，该私有容器镜像可以由用户指定是否开放给所有用户使用。如图1所示，在业务主机上，存储有第一用户的容器镜像A和容器镜像B、第二用户的容器镜像B和容器镜像C。其中，容器镜像B是公有容器镜像，容器镜像A是第一用户的私有容器镜像，容器镜像C是第二用户的私有容器镜像。容器镜像A、容器镜像B和容器镜像C在业务主机上的存储在用户级别上不是隔离的。在第一用户通过容器管理系统发放容器时，可以在业务主机的本地存储空间中获得第一用户的容器镜像和第二用户的容器镜像，即容器镜像A、容器镜像B和容器镜像C，可以基于容器镜像A、容器镜像B或者容器镜像C发放容器。第二用户通过容器管理系统发放容器时，情况与第一用户类似，在此不再赘述。可见，该容器管理系统无法提供在业务主机上的不同用户的容器镜像的隔离，不利于保护用户数据的安全性。
为了保护用户数据的安全性，本发明提供了一种容器管理方案，以实现容器发放过程中用户数据的用户级隔离。该容器管理方案可以基于基础设施即服务(infrastructure as a service，IaaS)为用户提供容器管理方案，IaaS可以基于完善的计算机基础设施提供计算服务，例如，云计算服务。
参见图2，其示出了本发明实施例的一种云服务管理系统的系统架构。在该系统架构中，包括业务主机、管理主机和存储主机。其中，业务主机用于提供具体的云计算服务，管理主机用于对所提供的云计算服务进行管理，存储主机用于存储所提供的云计算服务的相关数据。
需要说明的是，业务主机、管理主机和存储主机可以是同一个物理主机或者虚拟主机，也可以是不同的物理主机或者虚拟主机，该物理主机或者虚拟主机可以是IaaS计算资源池中的主机。
进一步地，在该云服务管理系统中运行有容器管理系统，该容器管理系统至少包括容器引擎和容器镜像仓库。以图2所示的系统架构为例，业务主机至少部署有云服务管理系统的计算控制模块、容器管理系统的容器引擎和容器镜像仓库；管理主机至少部署有云服务管理系统的鉴权模块；存储主机至少部署有容器管理系统的容器镜像仓库，该容器镜像仓库包括公有容器镜像仓库和私有容器镜像仓库。可选地，除图2所示的系统外，本发明实施例所涉及的云服务管理系统中还可以包括部署了计算控制模块和容器引擎的其他业务主机，容器管理系统的各个模块在业务主机、管理主机和存储主机上的部署方式也不限于以上举例。
其中，计算控制模块用于部署云计算，包括运行实例、管理网络以及控制用户等。鉴权模块用于管理身份验证、服务规则和令牌功能的模块。容器引擎用于容器相关的 管理、用户管理等。容器镜像仓库用于容器镜像的存储与分发，包括公有容器镜像仓库和私有容器镜像仓库。
除了部署于存储主机的容器镜像仓库用于存储容器镜像之外，业务主机的本地存储空间中还存储有用户的一个或者多个容器镜像，该用户是注册于该业务主机上的容器引擎的用户，该一个或者多个容器镜像可以从上述容器镜像仓库中的公有容器镜像仓库或者该用户的私有容器镜像仓库中下载得到，也可以是该业务主机上的容器转换得到。
容器镜像信息库包括在该业务主机的本地存储空间中与该用户的标识关联的容器镜像的标识，通过容器镜像的标识还可以获得容器镜像的信息，该容器镜像的信息包括以下信息中的一种或者多种：容器镜像的属性和容器镜像的存储位置信息，例如存储索引信息等。需要说明的是，该容器镜像的信息可以包含于用户的容器镜像信息库中，也可以存储于其他信息存储空间或者包含于其他信息集合中，但无论存储在哪里，均可以通过该容器镜像的标识与该容器镜像的信息之间的映射关系查找得到。其中，该用户的标识可以是用户的标号(identification，ID)和/或用户的令牌(token)。容器镜像的标识可以是该容器镜像的ID和/或容器镜像的名称。需要说明的是，用户具有查询该用户的容器镜像信息库的权限，但没有查询其他用户的容器镜像信息库的权限。
参见图3，其示出了用户的容器镜像信息库的一种示例。在第一用户的容器镜像信息库中，包括有容器镜像A的标识和容器镜像B的标识。在第二用户的容器镜像信息库中，包括有容器镜像B的标识和容器镜像C的标识。其中，容器镜像B是公有容器镜像，容器镜像A是第一用户的私有容器镜像，容器镜像C是第二用户的私有容器镜像。容器镜像A包括A1层、A2层和B层；容器镜像B包括B层；容器镜像C包括B层和C层。例如，A1层是第一用户的用户自定义层，A2层是第一用户的应用程序层，B层是公有的基础镜像层，C层是第二用户的用户自定义层。在容器镜像信息库中还包括容器镜像A的A1层、A2层和B层的存储索引信息，容器镜像B的B层的存储索引信息，容器镜像C的B层和C层的存储索引信息。
另外，在该业务主机中的第一用户的容器镜像信息库包括与第一用户的标识关联的容器镜像的标识，第二用户的容器镜像信息库包括与第二用户的标识关联的容器镜像的标识，用户不能查询其他用户的容器镜像信息库，也即不能获得其他用户的容器镜像信息库中的容器镜像的标识，从而可以实现用户数据的用户级隔离。
下面以图2所示的系统架构为例，对本发明的方法实施例予以介绍。参见图4，其示出了本发明实施例提供的一种容器管理方法的流程图，该方法针对容器发放的过程进行管理，包括：
步骤401、计算控制模块获取第一用户的注册请求，根据该注册请求对第一用户的信息进行注册并得到第一用户的标识。
其中，该第一用户的注册请求是通过业务主机中的计算控制模块获得的，例如，计算控制模块的用户交互界面获取第一用户的信息，基于该第一用户的信息生成第一用户的标识。
步骤402、容器引擎从计算控制模块获取第一用户的标识。
步骤403、容器引擎基于第一用户的标识注册并创建第一用户的容器镜像信息库，容器镜像信息库包括第一用户的标识关联的一个或者多个容器镜像的标识。
其中，第一用户的容器镜像信息库参见图2相关说明，在此不再赘述。
步骤404、容器引擎将第一用户的容器镜像信息库存入容器引擎所在的业务主机的本地存储空间中。
需要说明的是，上述步骤401至步骤404为创建容器镜像信息库的过程，针对容器发放，并不是每次都需要重新创建容器镜像信息库，因而上述步骤401至步骤404为容器发放过程中的可选步骤。
步骤405、容器引擎获取容器发放请求，该容器发放请求携带第一用户的标识和第一容器镜像的标识。
其中，第一容器镜像的标识用于指示该容器发放请求所请求发放的第一容器所需要的第一容器镜像，可选地，第一容器镜像的标识可以是第一容器镜像的ID和/或第一容器镜像的名称；第一用户的标识用于发放容器过程中鉴权、获取第一用户的容器镜像仓库等操作，可选地，第一用户的标识可以包括第一用户的ID和/或第一用户的令牌。
在一种可能的实现方式中，步骤405包括：
容器引擎通过用户交互界面获得用户的容器发放请求。
可选地，该用户交互界面还可以由部署于业务主机或者管理主机上的其他组件实现，通过该用户交互界面获得容器发放请求，并将其输出至容器引擎，由容器引擎获得。
步骤406、容器引擎从本地存储空间中获取第一用户的标识对应的容器镜像信息库。
可选地，第一用户的容器镜像信息库与第一用户的ID是一一对应的，第一用户的标识对应的容器镜像信息库即是第一用户的ID对应的容器镜像信息库。第一用户的ID可以是容器引擎通过部署于业务主机中的计算控制模块获得的，该第一用户的ID是在第一用户通过计算控制模块注册时产生的。
在一种可能的实现方式中，第一用户的容器镜像信息库是以数据文件的形式存储于容器引擎所在的业务主机的本地存储空间中，该容器镜像信息库包括与第一用户的ID关联的一个或者多个容器镜像的标识。
为了确认第一用户具有当前操作的权限，步骤406的一种可选实现方式包括：容器引擎基于第一用户的标识获取鉴权结果，当鉴权通过时，容器引擎查询第一用户的标识对应的容器镜像信息库。该鉴权操作可以是该容器引擎基于容器管理系统中的用户注册信息对第一用户的令牌进行鉴权，也可以是容器引擎通过接口将第一用户的令牌输出至其他鉴权模块进行鉴权。
步骤407、容器引擎在第一用户的标识对应的容器镜像信息库中查询第一容器镜像的标识。
在一种可能的实现方式中，步骤407包括：
容器引擎根据第一用户的ID在第一用户的标识对应的容器镜像信息库中查询第一容器镜像的标识。该第一容器镜像的标识可以用于获得第一容器镜像的信息。该第 一容器镜像的信息可以包括：第一容器镜像所包括的一个或者多个只读层的标识，以及该一个或者多个只读层的存储索引信息，该存储索引信息用于在本地存储空间中获得只读层。该第一容器镜像的信息可以包含于第一用户的容器镜像信息库中，也可以存储于其他信息存储空间或者包含于其他信息集合中。
当容器镜像信息库中存在第一容器镜像的标识时，执行步骤408，当容器镜像信息库中不存在第一容器镜像的标识时，容器引擎还可以从容器镜像仓库中获取第一容器镜像，一种可选的实施方式为该方法还包括：
当容器镜像信息库中不存在第一容器镜像的标识，且第一容器镜像的属性是私有时，容器引擎从第一用户的私有容器镜像仓库中获取第一容器镜像；
当容器镜像信息库中不存在第一容器镜像的标识，且第一容器镜像的属性是公有时，容器引擎从公有容器镜像仓库中获取第一容器镜像。
其中，第一用户的私有容器镜像仓库和公有容器镜像仓库可以部署于业务主机或者其他主机上，容器引擎可以通过本地接口或者远程接口从第一用户的私有容器镜像仓库或者公有容器镜像仓库中获取第一容器镜像。
其中，第一容器镜像的属性参见图2相关说明，在此不再赘述。
可选地，第一容器镜像的属性是容器引擎根据第一镜像的标识从管理主机中查询得到的。
步骤408、当第一用户的容器镜像信息库中存在第一容器镜像的标识时，容器引擎基于第一容器镜像的标识从容器引擎所在主机的本地存储空间中获取第一容器镜像，并根据第一容器镜像发放第一容器。
在一种可能的实现方式中，当第一用户的容器镜像信息库中存在第一容器镜像的标识时，步骤408包括：
容器引擎根据第一容器镜像的标识获取第一容器镜像的信息；容器引擎基于第一容器镜像的信息从本地存储空间中获取第一容器镜像，容器引擎根据第一容器镜像启动第一容器。例如，容器引擎根据第一容器镜像的信息从本地存储空间中获得第一容器镜像所包括的一个或者多个只读层；容器引擎将该一个或者多个只读层与待发放的第一容器所需要的读写层通过UM技术整合成第一容器，并发放第一容器。
本发明提供的方法，查询用户的标识对应的容器镜像信息库，从该用户的容器镜像信息库中查询到容器镜像的标识后，再基于该容器镜像的标识获得容器镜像，进而基于该容器镜像发放容器。使得在容器发放的过程中，仅查询该用户的容器镜像信息库，而不查询其他用户的容器镜像信息库，更不会获取其他用户的容器镜像，从而实现了容器发放过程中的用户数据的用户级隔离，保证了用户数据的安全性。
基于上述实施例，在一种可选实现方式中，该容器管理方法还可以用于管理提交容器镜像的过程。参见图5，其示出了本发明实施例提供的一种容器管理方法的流程图，该方法针对提交容器镜像的过程进行管理，包括：
步骤501、容器引擎获取容器镜像提交请求，容器镜像提交请求用于请求将第二容器转换成第二容器镜像并提交。
其中，第二容器是第一用户在业务主机中的一个容器实例，容器镜像提交请求携带有第一用户的标识和第二容器的标识。可选地，第二容器的标识可以是第二容器的 ID和/或第二容器的名称；第一用户的标识用于容器镜像提交过程中鉴权、获取第一用户的容器镜像仓库等操作，可选地，第一用户的标识可以包括第一用户的ID和/或第一用户的令牌。
该容器镜像提交请求可以是容器引擎通过用户交互界面获得用户发出的容器镜像提交请求。可选地，该用户交互界面还可以由部署于业务主机或者管理主机上的其他组件实现，该组件通过该用户交互界面获得容器镜像提交请求，并将其输出至容器引擎，由容器引擎获得。
步骤502、容器引擎获取第二容器，该第二容器存储于容器引擎所在主机的本地存储空间中。
步骤503、容器引擎根据第二容器生成第二容器镜像。
在一种可能的实现方式中，步骤503包括：
容器引擎将第二容器所包括的只读层分别读取并逐层加载得到第二容器镜像。
为了确认第一用户具有当前操作的权限，该容器镜像提交请求还包括第一用户的令牌，步骤503的一种可选实施方式包括：
容器引擎根据第一用户的令牌获取鉴权结果；
若鉴权通过，容器引擎根据第二容器生成第二容器镜像。
其中，该鉴权操作参见步骤406的相关说明，在此不再赘述。
步骤504、容器引擎将第二容器镜像的标识添加至第一用户的容器镜像信息库。
在一种可选的实现方式中，步骤504包括：
第一用户的容器镜像信息库存储于业务主机中，容器引擎根据第一用户的ID在该业务主机中获得第一用户的容器镜像信息库；容器引擎将第二容器镜像存入业务主机的本地存储空间中，并将第二容器镜像的标识添加至第一用户的容器镜像信息库，并将第二容器镜像的信息与第一用户的标识关联。
为了确认第一用户具有当前操作的权限，步骤504的一种可选的实现方式包括：
容器引擎基于第一用户的标识获取鉴权结果，该鉴权操作可以参见步骤406中的相关说明，在此不再赘述；
若鉴权通过，将第二容器镜像的标识添加至第一用户的容器镜像信息库，该添加操作可以由容器引擎实现，还可以由部署于管理主机上的其他组件实现。
其中，基于第一用户的标识进行鉴权可以是容器引擎基于第一用户的标识所包括的第一用户的令牌进行鉴权。
可选地，该方法还包括：步骤505，容器引擎将第二容器镜像上传至第一用户的私有容器镜像仓库。示例性地，容器引擎通过本地接口或者远程接口将第二容器镜像存入第一用户的私有容器镜像仓库。例如，容器引擎通过本地接口或者远程接口将第二容器镜像存入存储主机上的第一用户的私有容器镜像仓库。
本发明实施例将用户的容器转换为容器镜像，并将该容器镜像的标识加入该用户的容器镜像信息库，使得该用户的容器镜像信息库包括属于该用户的容器镜像的标识，可获得业务主机的存储空间中属于该用户的容器镜像，而不获得其他用户的容器镜像，从而实现了用户数据的用户级隔离，保证了用户数据的安全性。
在一种可能的实现方式中，云服务管理系统可以是openstack，容器管理系统可以是docker容器管理系统。参见图6，其示出了一种基于openstack的docker容器管理系统的系统架构图。如图6所示，openstack至少包括nova、keystone(鉴权)和glance(openstack镜像服务组件)。其中，nova包括nova api(接口)、nova conductor、nova scheduler(调度器)和nova compute(计算)。docker容器管理系统至少包括docker和docker registry(仓库)。在业务主机上部署nova compute和docker；在管理主机上部署nova api、nova conductor、nova scheduler、keystone和glance；在业务主机、管理主机或者存储主机上部署docker registry。需要说明的是，业务主机、管理主机和存储主机可以是同一个物理主机或者虚拟主机，上述各个组件在业务主机、管理主机和存储主机的部署方式不限于以上举例。
在图6所示的基于openstack的docker容器管理系统中，各个组件的功能如下：
nova用于对接docker相关接口在业务主机上实现容器的管理，功能与上述云服务管理系统类似。
keystone是鉴权模块，用于对接docker相关接口对用户的标识进行鉴权。
glance用于对接docker相关接口管理用户信息和容器镜像的信息。容器镜像的信息包括但不限于以下信息：容器镜像的标识和容器镜像的属性。
docker用于在业务主机上实现用户的管理和容器的管理，功能与上述容器引擎类似。
docker registry用于容器镜像的存储与分发，包括公有registry和私有registry，公有registry中储存有公有容器镜像，私有registry中储存有用户的私有容器镜像，功能与上述容器镜像管理仓库类似。
此外，docker还可以包括以下接口中的一个或者多个：
docker鉴权接口，用于对用户的标识进行鉴权，鉴权结果用于判断该用户是否具有当前操作的权限；若鉴权结果是通过，则该用户具有当前操作的权限；若鉴权结果是未通过，则该用户不具有当前操作的权限。可选地，该docker鉴权接口可以代理其他鉴权模块，为其他鉴权模块提供接口的方式实现鉴权操作。示例性地，该docker鉴权接口可以代理openstack的keystone，通过相关的接口将用户的标识输出至keystone，获取并输出keystone对该用户的标识的鉴权结果，以完成对该用户的标识的鉴权。可选地，该用户的标识包括用户的令牌。可选地，该docker鉴权接口可以以插件的形式加入docker中。
docker用户管理接口：用于实现用户注册、注销和查询等功能，还可以让用户通过该docker用户管理接口在docker中注册并创建该用户的容器镜像信息库，也可以注销并删除该用户的容器镜像信息库。可选地，docker用户管理接口的功能实现方式可以包括：通过docker用户管理接口将用户的注册、注销或者查询请求的相关信息输出至keystone，获取并输出keystone对该用户的注册、注销或者查询请求的结果。可选地，docker用户管理接口还可以通过用户交互界面输出该注册、注销或者查询结果。
docker pull接口：用于根据用户需求从私有registry或者公有registry下载容器镜像，其过程如下：通过docker鉴权接口对用户的标识进行鉴权；若鉴权结果是通过，且该用户的容器镜像信息库不包括该容器镜像的信息，从私有registry或者公有registry 下载该容器镜像至业务主机的本地存储空间中。此外，docker pull接口还可以将该容器镜像的信息加入该用户的容器镜像信息库。
docker commit接口：用于将用户的容器转换为该用户的私有容器镜像，其过程如下：通过docker鉴权接口对用户的标识进行鉴权；若鉴权结果是通过，且该业务主机上存在用户的容器镜像信息库；将该容器转换成容器镜像并将该容器镜像的信息添加至该用户的容器镜像信息库。此外，docker commit接口还可以将该转换完成的容器镜像保存在业务主机的本地存储空间中。
docker创建容器实例接口：用于根据用户需求创建容器，其过程如下：通过docker鉴权接口基于用户的标识进行鉴权；若鉴权结果是通过，判断所在业务主机上是否存在该用户的容器镜像信息库；若存在该用户的容器镜像信息库，在该用户的容器镜像信息库中查询所需要的容器镜像的信息；若该用户的容器镜像信息库中包括该容器镜像的信息，基于该容器镜像的信息获得该容器镜像；若该用户的容器镜像信息库中不包括该容器镜像的信息，调用docker pull接口从私有registry或者公有registry下载该容器镜像到该业务主机；基于该容器镜像创建容器，或者，将该下载的容器镜像的信息添加至该用户的容器镜像信息库，通过该用户的容器镜像信息库获得该容器镜像的信息，基于该容器镜像的信息获得该容器镜像，基于该容器镜像创建容器。
docker push接口：用于将本地的容器镜像上传到私有registry或者公有registry，其过程如下：通过docker鉴权接口基于用户的标识进行鉴权；若鉴权结果是通过，在该用户的容器镜像信息库中查询该容器镜像的信息；若该用户的容器镜像信息库中包括该容器镜像的信息，将该容器镜像上传到该用户的私有registry或者公有registry。
docker容器镜像信息查询接口：用于根据用户需求查询与该用户的标识关联的容器镜像的信息。可选地，docker容器镜像信息查询接口可以查询该用户的容器镜像信息库中包括的容器镜像的信息。可选地，docker容器镜像信息查询接口调用glance查询该用户的私有registry中包括的容器镜像的信息。可选地，上述容器镜像的信息是容器镜像的标识。可选地，docker容器镜像信息查询接口还可以通过用户交互界面输出查询结果。
在基于openstack的docker容器管理系统中，可以实现以下容器相关操作中的一种或者多种：
发放或者删除容器、启动容器、容器镜像管理等。其中容器镜像管理包括提交容器镜像、下载容器镜像、查看容器镜像等。
参见图7，其示出了本发明提供的容器管理方法的流程图，以该方法在图6所示的基于openstack的docker容器管理系统中发放容器为例，该方法包括：
步骤701、nova通过nova api接收到容器发放请求。
其中，容器发放请求用于请求发放第三容器。该容器发放请求至少包括发起该容器发放请求的第一用户的标识和第三容器镜像的标识，第三容器镜像是发放第三容器所需要的容器镜像。
可选地，该第一用户的标识可以包括第一用户的ID和/或第一用户的令牌；该第三容器镜像的标识是第三容器镜像的ID和/或第三容器镜像的名称。
步骤702、nova调用keystone对第一用户的令牌进行鉴权；若鉴权结果是通过，执行步骤703。
可选地，步骤702还包括：若鉴权结果是不通过，发放容器失败。
步骤703、nova调用nova scheduler选择业务主机用以发放第三容器，并将该容器发放请求的相关信息传递给部署于该业务主机上的nova compute。
步骤704、nova compute调用glance根据第三容器镜像的标识获得第三容器镜像的属性。
其中，nova compute部署于该业务主机上，第三容器镜像的属性是公有或者私有。
可选地，在步骤704中，还可以包括：nova compute调用glance根据第三容器镜像的ID获得第三容器镜像的名称。
步骤705、nova compute调用docker，并将该容器发放请求的相关信息传递给docker。
其中，该容器发放请求的相关信息包括但不限于：该容器发放请求、第一用户的标识和第三容器镜像的标识。
步骤706、docker调用keystone对第一用户的令牌进行鉴权；若鉴权结果是通过，执行步骤707；若鉴权结果是不通过，发放容器失败。
步骤707、docker调用docker用户管理接口查询该第一用户的容器镜像信息库是否存在；若第一用户的容器镜像信息库存在，执行步骤708；若第一用户的容器镜像信息库不存在，发放容器失败。
在一种可选的实施方式中，步骤707还包括：若第一用户的容器镜像信息库不存在，发放容器失败，通过nova api将第一用户的容器镜像信息库不存在的信息反馈给第一用户，第一用户可以根据nova api的反馈结果，触发建立第一用户的容器镜像信息库，建立第一用户的容器镜像信息库的操作参见步骤501。
步骤708、docker调用docker容器镜像信息查询接口在第一用户的容器镜像信息库中查询第三容器镜像的信息是否存在；若第三容器镜像的信息存在，执行步骤709，若第三容器镜像的信息不存在，执行步骤710。
步骤709、docker获得第三容器镜像的信息，并基于第三容器镜像的信息获得第三容器镜像，执行步骤713。
步骤710、docker判断第三容器镜像的属性；若第三容器镜像的属性是公有，执行步骤711；若第三容器镜像的属性是私有，执行步骤712。
步骤711、docker调用docker pull接口从公有registry中下载第三容器镜像，执行步骤713。
步骤712、docker调用docker pull接口从第一用户的私有registry中下载第三容器镜像，执行步骤713。
步骤713、docker基于第三容器镜像创建并发放第三容器。
在一种可能的实现方式中，步骤706-713是docker调用docker创建容器实例接口实现的。
本发明查询用户的标识对应的容器镜像信息库，从该用户的容器镜像信息库中查询到容器镜像的标识后，再基于该容器镜像的标识获得容器镜像，进而基于该容器镜像发放容器。使得在容器发放的过程中，查询该用户的容器镜像信息库，而不查询其 他用户的容器镜像信息库，更不会获取其他用户的容器镜像，从而实现了容器发放过程中的用户数据的用户级隔离，保证了用户数据的安全性。
此外，通过docker中的docker接口来与openstack系统中的各个模块传递指令、信息和/或数据，可以复用openstack系统中的用户注册、鉴权等功能，以保证docker容器管理系统下用户数据的安全性。
参见图8，其示出了本发明提供的容器管理方法的流程图，以该方法在图6所示的基于openstack的docker容器管理系统中对提交容器镜像的过程进行管理为例，该方法包括：
步骤801、nova通过nova api接收到容器镜像提交请求。
其中，该容器镜像提交请求用于请求将第四容器转换为第四容器镜像并提交。
其中，该发放容器的请求包括：
发起容器镜像提交请求的第一用户的标识和docker容器实例的标识；第一用户的标识包括第一用户的ID和/或第一用户的令牌；docker容器实例的标识是第四容器所在的docker容器实例的标识；
步骤802、nova调用keystone对第一用户的令牌进行鉴权；若鉴权结果是通过，执行步骤803。
若鉴权结果是未通过，提交容器镜像失败。
步骤803、nova根据docker容器实例的标识获得该docker容器实例所在的业务主机和第四容器的标识。
步骤804、nova将容器镜像提交请求的相关信息传递给nova compute。
其中，容器镜像提交请求的相关信息包括但不限于：该容器镜像提交请求、第一用户的标识和第四容器的标识。
其中，nova compute部署于该业务主机上。
步骤805、nova compute调用docker，并将该容器镜像提交请求的相关信息传递给docker。
步骤806、docker调用keystone对第一用户的令牌进行鉴权；若鉴权结果是通过，执行步骤807；若鉴权结果不通过，提交容器镜像失败。
步骤807、docker调用docker用户管理接口查询第一用户的容器镜像信息库是否存在；若第一用户的容器镜像信息库存在，执行步骤808；若第一用户的容器镜像信息库不存在，提交容器镜像失败。
步骤808、docker调用docker commit接口将第四容器转换成第四容器镜像，并将第四容器镜像的信息加入第一用户的容器镜像信息库。
步骤809、nova compute调用glance创建glance镜像。
其中，该glance镜像是第四容器镜像在glance中的镜像，使得nova能够在将该glance镜像用于其他业务主机上的容器发放。
可选地，在步骤809中还包括：建立glance镜像的标识与第四容器镜像的名称之间的映射关系。
步骤810、docker调用docker push接口将第四容器镜像上传至第一用户的私有 registry。
可选地，步骤810包括：docker调用docker push接口，docker push接口调用docker用户管理接口将第一用户的令牌输出至keystone进行鉴权，若鉴权结果是通过，则将第四容器镜像上传到该用户的私有registry。
本发明实施例将用户的容器转换为容器镜像并将该容器镜像的标识加入该用户的容器镜像信息库，使得该用户的容器镜像信息库包括属于该用户的容器镜像的标识，可获得业务主机的存储空间中属于该用户的容器镜像，而不获得其他用户的容器镜像，从而实现了用户数据的用户级隔离，保证了用户数据的安全性。
此外，通过docker中的docker接口来与openstack系统中的各个模块传递指令、信息和/或数据，可以复用openstack系统中的用户注册、鉴权等功能，以保证docker容器管理系统下用户数据的安全性。
上文中结合图1至图8，详细描述了根据本发明实施例所提供的容器管理方法，下面将结合图9至图11描述根据本发明实施例所提供的容器管理的装置和设备。
参见图9，其示出了本发明提供的一种容器管理装置900的框图，包括：获取模块910、查询模块920和发放模块930。
获取模块910，用于获取容器发放请求。
其中，该容器发放请求携带第一用户的标识和第一容器镜像的标识。
查询模块920，用于查询第一用户的标识对应的容器镜像信息库，该容器镜像信息库用于存储第一用户的标识和第一容器镜像之间的映射关系。
发放模块930，用于当容器镜像信息库中存在第一容器镜像的标识时，基于第一容器镜像的标识获取第一容器镜像，并根据第一容器镜像发放第一容器。
在一种可选的实施方式中，发放模块930，用于基于第一容器镜像的标识获取第一容器镜像的信息；根据第一容器镜像的信息从本地存储空间中获取第一容器镜像，并根据第一容器镜像启动第一容器。
在一种可选的实施方式中，查询模块920，用于基于第一用户的标识获取鉴权结果；当鉴权结果为通过时，查询第一用户的标识对应的容器镜像信息库。
在一种可选的实施方式中，发放模块930，还用于当容器镜像信息库中不存在第一容器镜像的标识，且第一容器镜像的属性是私有时，从第一用户的私有容器镜像仓库中获取第一容器镜像；或者，当容器镜像信息库中不存在第一容器镜像的标识，且第一容器镜像的属性是公有时，从公有容器镜像仓库中获取第一容器镜像。
在一种可选的实施方式中，容器管理装置900还包括：
创建模块，用于基于第一用户的标识注册并创建第一用户的标识对应的容器镜像信息库，容器镜像信息库包括第一用户的标识关联的一个或者多个容器镜像的标识。
在一种可选的实施方式中，参见图10，该容器管理装置900还包括：
生成模块940，用于根据第一容器生成第二容器镜像，该第二容器镜像中包括第一用户的信息、应用和驱动中至少一种。
添加模块950，用于将第二容器镜像的标识添加至第一用户的容器镜像信息库。
上传模块960，用于将第二容器镜像上传至第一用户的私有容器镜像仓库。
应理解的是，本发明实施例的容器管理装置900可以通过专用集成电路(application-specific integrated circuit，ASIC)实现，或可编程逻辑器件(programmable logic device，PLD)实现，上述PLD可以是复杂程序逻辑器件(complex programmable logical device，CPLD)，现场可编程门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。也可以通过软件实现图4或图5中所示的容器管理方法时，该装置及其各个模块也可以为软件模块。
根据本发明实施例的容器管理装置900可对应于执行本发明实施例中描述的方法，并且容器管理装置900中的各个单元的上述和其它操作和/或功能分别为了实现图4或图5中的各个方法中容器引擎所执行的相应流程，为了简洁，在此不再赘述。
本发明查询用户的标识对应的容器镜像信息库，从该用户的容器镜像信息库中查询到容器镜像的标识后，再基于该容器镜像的标识获得容器镜像，进而基于该容器镜像发放容器。使得在容器发放的过程中，查询该用户的容器镜像信息库，而不查询其他用户的容器镜像信息库，更不会获取其他用户的容器镜像，从而实现了容器发放过程中的用户数据的用户级隔离，保证了用户数据的安全性。
另外，将用户的容器转换为容器镜像，并将该容器镜像的标识加入该用户的容器镜像信息库，使得该用户的容器镜像信息库包括属于该用户的容器镜像的标识，从而实现了用户数据的用户级隔离，保证了用户数据的安全性。
参见图11，其示出了本发明实施例提供的一种容器管理设备的结构示意图。该设备可能是服务器或者终端，如图11所示，该容器管理设备1100包括处理器1101、存储器1102、通信接口1103和总线1104、图形处理器1105。其中，处理器1101、存储器1102、通信接口1103、存储设备1105通过总线1104进行通信，也可以通过无线传输等其他手段实现通信。该存储器1102用于存储指令，该处理器1101用于执行该存储器1102存储的指令。该存储器1102存储程序代码，且处理器1101可以调用存储器1102中存储的程序代码执行以下操作：
获取容器发放请求，该容器发放请求携带第一用户的标识和第一容器镜像的标识；
查询第一用户的标识对应的容器镜像信息库，该容器镜像信息库用于存储第一用户的标识和第一容器镜像之间的映射关系；
当容器镜像信息库中存在第一容器镜像的标识时，基于第一容器镜像的标识获取第一容器镜像，并根据第一容器镜像发放第一容器。
应理解的是，在本发明实施例中，该处理器1101可以是CPU，该处理器1101还可以是其他通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。值得说明的是，处理器1101可以是支持ARM架构的处理器。
该存储器1102可以包括只读存储器和随机存取存储器，并向处理器1101提供指令和数据。存储器1102还可以包括非易失性随机存取存储器。例如，存储器1102还可以存储设备类型的信息。
该存储器1102可以是易失性存储器或非易失性存储器，或可包括易失性和非易失 性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
该总线1104除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线1104。
应理解，根据本发明实施例的容器管理设备1100可对应于本发明实施例中的图9或图10所示的容器管理装置900，并可以对应于执行根据本发明实施例中图4或图5所示方法中的容器引擎为执行主体的操作步骤，并且容器引擎中的各个模块的上述和其它操作和/或功能分别为了实现图4或图5中的各个方法的相应流程，为了简洁，在此不再赘述。
本发明实施例还提供了一种非临时性计算机可读存储介质，当所述存储介质中的指令由计算系统的处理器执行时，使得计算系统能够执行图4、5、7或者8其中任一项提供的容器管理方法。
一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行进行图4、5、7或者8其中任一项提供的容器管理方法的指令。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现，当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令，在装置上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴光缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是装置能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(如软盘、硬盘和磁带等)，也可以是光介质(如数字视盘(Digital Video Disk，DVD)等)，或者半导体介质(如固态硬盘等)。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (13)

  1. 一种容器管理方法，其特征在于，所述方法包括：
    获取容器发放请求，所述容器发放请求携带第一用户的标识和第一容器镜像的标识；
    查询所述第一用户的标识对应的容器镜像信息库，所述容器镜像信息库用于存储所述第一用户的标识和所述第一容器镜像之间的映射关系；
    当所述容器镜像信息库中存在所述第一容器镜像的标识时，基于所述第一容器镜像的标识获取所述第一容器镜像，并根据所述第一容器镜像发放第一容器。
  2. 根据权利要求1所述的方法，其特征在于，在所述获取容器发放请求之前，所述方法还包括：
    基于所述第一用户的标识注册并创建所述第一用户的标识对应的容器镜像信息库，所述容器镜像信息库包括所述第一用户的标识关联的一个或者多个容器镜像的标识。
  3. 根据权利要求1或2所述的方法，其特征在于，所述基于所述第一容器镜像的标识获取所述第一容器镜像，并根据所述第一容器镜像发放第一容器，包括：
    基于所述第一容器镜像的标识获取所述第一容器镜像的信息；
    根据所述第一容器镜像的信息从本地存储空间中获取所述第一容器镜像，并根据所述第一容器镜像启动第一容器。
  4. 根据权利要求1至3中任一所述的方法，其特征在于，所述方法还包括：
    当所述容器镜像信息库中不存在所述第一容器镜像的标识，且所述第一容器镜像的属性为私有时，从所述第一用户的私有容器镜像仓库中获取所述第一容器镜像；或者，
    当所述容器镜像信息库中不存在所述第一容器镜像的标识，且所述第一容器镜像的属性为公有时，从公有容器镜像仓库中获取所述第一容器镜像。
  5. 根据权利要求1至4中任一所述的方法，其特征在于，在所述基于所述第一容器镜像的标识获取所述第一容器镜像，并根据所述第一容器镜像发放第一容器之后，所述方法还包括：
    根据所述第一容器生成第二容器镜像，所述第二容器镜像中包括所述第一用户的信息、应用和驱动中至少一种；
    将所述第二容器镜像的标识添加至所述第一用户的容器镜像信息库；
    将所述第二容器镜像上传至所述第一用户的私有容器镜像仓库。
  6. 根据权利要求1至5中任一所述的方法，其特征在于，所述查询所述第一用户的标识对应的容器镜像信息库，包括：
    基于所述第一用户的标识获取鉴权结果，当所述鉴权结果为通过时，查询所述第一用户的标识对应的容器镜像信息库。
  7. 一种容器管理装置，其特征在于，所述装置包括：
    获取模块，用于获取容器发放请求，所述容器发放请求携带第一用户的标识和第一容器镜像的标识；
    查询模块，用于查询所述第一用户的标识对应的容器镜像信息库，所述容器镜像信息库用于存储所述第一用户的标识和所述第一容器镜像之间的映射关系；
    发放模块，用于当所述容器镜像信息库中存在所述第一容器镜像的标识时，基于所述第一容器镜像的标识获取所述第一容器镜像，并根据所述第一容器镜像发放第一容器。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    创建模块，用于基于所述第一用户的标识注册并创建所述第一用户的标识对应的容器镜像信息库，所述容器镜像信息库包括所述第一用户的标识关联的一个或者多个容器镜像的标识。
  9. 根据权利要求7或8所述的装置，其特征在于，所述发放模块，用于基于所述第一容器镜像的标识获取所述第一容器镜像的信息；根据所述第一容器镜像的信息从本地存储空间中获取所述第一容器镜像，并根据所述第一容器镜像启动第一容器。
  10. 根据权利要求7至9中任一所述的装置，其特征在于，所述发放模块，还用于当所述容器镜像信息库中不存在所述第一容器镜像的标识，且所述第一容器镜像的属性为私有时，从所述第一用户的私有容器镜像仓库中获取所述第一容器镜像；或者，当所述容器镜像信息库中不存在所述第一容器镜像的标识，且所述第一容器镜像的属性为公有时，从公有容器镜像仓库中获取所述第一容器镜像。
  11. 根据权利要求7至10中任一所述的装置，其特征在于，所述装置还包括：
    生成模块，用于根据所述第一容器生成第二容器镜像，所述第二容器镜像中包括所述第一用户的信息、应用和驱动中至少一种；
    添加模块，用于将所述第二容器镜像的标识添加至所述第一用户的容器镜像信息库；
    上传模块，用于将所述第二容器镜像上传至所述第一用户的私有容器镜像仓库。
  12. 根据权利要求7至11中任一所述的装置，其特征在于，所述查询模块，用于基于所述第一用户的标识获取鉴权结果，当所述鉴权结果为通过时，查询所述第一用户的标识对应的容器镜像信息库。
  13. 一种容器管理设备，其特征在于，所述设备包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现如权利要求1至6中任一所述的容器管理方法。
PCT/CN2019/085509 2018-06-29 2019-05-05 容器管理方法、装置和设备 WO2020001162A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19826827.8A EP3796616A4 (en) 2018-06-29 2019-05-05 CONTAINER MANAGEMENT PROCESS, APPARATUS AND DEVICE
US17/117,698 US12106253B2 (en) 2018-06-29 2020-12-10 Container management method, apparatus, and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810713108.3 2018-06-29
CN201810713108.3A CN110659100B (zh) 2018-06-29 2018-06-29 容器管理方法、装置和设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/117,698 Continuation US12106253B2 (en) 2018-06-29 2020-12-10 Container management method, apparatus, and device

Publications (1)

Publication Number Publication Date
WO2020001162A1 true WO2020001162A1 (zh) 2020-01-02

Family

ID=68984888

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/085509 WO2020001162A1 (zh) 2018-06-29 2019-05-05 容器管理方法、装置和设备

Country Status (4)

Country Link
US (1) US12106253B2 (zh)
EP (1) EP3796616A4 (zh)
CN (1) CN110659100B (zh)
WO (1) WO2020001162A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11875167B2 (en) * 2020-03-23 2024-01-16 Nubix, Inc. Method for deploying containerized protocols on very small devices
CN111966445B (zh) * 2020-06-30 2023-07-25 北京百度网讯科技有限公司 调用应用程序接口的处理方法和装置
US20220253342A1 (en) * 2021-02-09 2022-08-11 Red Hat, Inc. Dynamic containerized content delivery
CN114579520B (zh) * 2022-03-04 2023-05-05 北京百度网讯科技有限公司 镜像数据处理方法、镜像数据加载方法及装置
CN115129429B (zh) * 2022-09-01 2023-06-13 南京翼辉爱智物联技术有限公司 容器应用管理方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106487850A (zh) * 2015-08-29 2017-03-08 华为技术有限公司 一种云环境下获取镜像的方法、装置和系统
CN106874357A (zh) * 2016-12-28 2017-06-20 新华三技术有限公司 一种Web应用的资源定制方法和装置
CN107819802A (zh) * 2016-09-13 2018-03-20 华为软件技术有限公司 一种在节点集群中的镜像获取方法、节点设备及服务器
US20180095973A1 (en) * 2016-09-30 2018-04-05 International Business Machines Corporation Docker layer deduplication with layer referencing

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6954930B2 (en) * 2002-02-19 2005-10-11 International Business Machines Corporation Remote validation of installation input data
US20060218164A1 (en) * 2005-03-23 2006-09-28 Fujitsu Limited Document management device and document management program
US8214747B1 (en) * 2008-10-10 2012-07-03 Adobe Systems Incorporated Role based state and dynamic feature enablement for collaborative and non-collaborative workspaces and imbeded applications
US9201610B2 (en) * 2011-10-14 2015-12-01 Verizon Patent And Licensing Inc. Cloud-based storage deprovisioning
US9804880B2 (en) * 2015-06-16 2017-10-31 Vmware, Inc. Reservation for a multi-machine application
US10032032B2 (en) * 2015-12-18 2018-07-24 Amazon Technologies, Inc. Software container registry inspection
US11314880B2 (en) * 2016-10-31 2022-04-26 Red Hat, Inc. Decoupling container image layers to preserve privacy
US11093297B2 (en) * 2017-02-08 2021-08-17 Dell Products L.P. Workload optimization system
US10747568B2 (en) * 2017-05-30 2020-08-18 Magalix Corporation Systems and methods for managing a cloud computing environment
CN107229507A (zh) * 2017-05-31 2017-10-03 郑州云海信息技术有限公司 一种容器镜像构建方法及装置
US11153381B2 (en) * 2017-08-22 2021-10-19 Red Hat, Inc. Data auditing for object storage public clouds
CN107643940A (zh) * 2017-09-26 2018-01-30 华为技术有限公司 容器创建方法、相关设备及计算机存储介质
US10324708B2 (en) * 2017-11-14 2019-06-18 Red Hat, Inc. Managing updates to container images
US11023529B2 (en) * 2018-01-04 2021-06-01 Red Hat, Inc. System and method for generating container image suggestions
US10922118B2 (en) * 2018-05-11 2021-02-16 International Business Machines Corporation Distributed container image repository service
CN109656686A (zh) * 2018-12-17 2019-04-19 武汉烽火信息集成技术有限公司 OpenStack上部署容器云方法、存储介质、电子设备及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106487850A (zh) * 2015-08-29 2017-03-08 华为技术有限公司 一种云环境下获取镜像的方法、装置和系统
CN107819802A (zh) * 2016-09-13 2018-03-20 华为软件技术有限公司 一种在节点集群中的镜像获取方法、节点设备及服务器
US20180095973A1 (en) * 2016-09-30 2018-04-05 International Business Machines Corporation Docker layer deduplication with layer referencing
CN106874357A (zh) * 2016-12-28 2017-06-20 新华三技术有限公司 一种Web应用的资源定制方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3796616A4 *

Also Published As

Publication number Publication date
CN110659100B (zh) 2022-05-24
EP3796616A4 (en) 2021-07-21
US12106253B2 (en) 2024-10-01
US20210097476A1 (en) 2021-04-01
CN110659100A (zh) 2020-01-07
EP3796616A1 (en) 2021-03-24

Similar Documents

Publication Publication Date Title
WO2020001162A1 (zh) 容器管理方法、装置和设备
CN113039568B (zh) 多租户区块链网络中的轻量级节点
US10560330B2 (en) Techniques for cloud control and management
US10079905B2 (en) Cross domain in-browser proxy
US11044257B1 (en) One-time access to protected resources
WO2020062131A1 (zh) 一种基于区块链技术的容器云管理系统
US20140344340A1 (en) Service request processing
US10037430B2 (en) System and method for controlling the on and off state of features of business logic at runtime
CN111414381B (zh) 数据处理方法、装置、电子设备及存储介质
US20220232010A1 (en) Protected resource authorization using autogenerated aliases
US10678657B1 (en) Reversion operations for virtual computing environments
US10356155B2 (en) Service onboarding
WO2018119589A1 (zh) 账户管理方法、装置及账户管理系统
US10104163B1 (en) Secure transfer of virtualized resources between entities
WO2021047227A1 (zh) 跨区域共享服务的方法、装置、管理设备及存储介质
US11695840B2 (en) Dynamically routing code for executing
US11500893B2 (en) System and method for dynamically finding database nodes and replication state
US11716380B2 (en) Secure self-contained mechanism for managing interactions between distributed computing components
US10911371B1 (en) Policy-based allocation of provider network resources
CN116566656A (zh) 资源访问方法、装置、设备及计算机存储介质
WO2021232860A1 (zh) 通信方法、装置及系统
CN117014175A (zh) 云系统的权限处理方法、装置、电子设备及存储介质
US11297065B2 (en) Technology for computing resource liaison
US11546324B1 (en) Single use execution environment with scoped credentials for on-demand code execution
US11874797B1 (en) Smart privilege escalation in a cloud platform

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19826827

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019826827

Country of ref document: EP

Effective date: 20201217

NENP Non-entry into the national phase

Ref country code: DE