WO2021232845A1 - 一种基于容器的镜像更新发布方法及装置 - Google Patents

一种基于容器的镜像更新发布方法及装置 Download PDF

Info

Publication number
WO2021232845A1
WO2021232845A1 PCT/CN2021/073903 CN2021073903W WO2021232845A1 WO 2021232845 A1 WO2021232845 A1 WO 2021232845A1 CN 2021073903 W CN2021073903 W CN 2021073903W WO 2021232845 A1 WO2021232845 A1 WO 2021232845A1
Authority
WO
WIPO (PCT)
Prior art keywords
image
mirror
information
client
hosting platform
Prior art date
Application number
PCT/CN2021/073903
Other languages
English (en)
French (fr)
Inventor
罗平
陈海钊
季统凯
贺忠堂
Original Assignee
国云科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 国云科技股份有限公司 filed Critical 国云科技股份有限公司
Publication of WO2021232845A1 publication Critical patent/WO2021232845A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G06F8/63—Image based installation; Cloning; Build to order
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the embodiments of the present application relate to the field of computer technology, and in particular, to a container-based image update and release method and device.
  • container technology is very popular in the application market due to its high security, isolation, and portability.
  • container technology adopts continuous integration and continuous deployment methods, which greatly simplifies the development, testing, and deployment processes, speeds up product delivery, and is more in line with the continuous iteration of software products in today's application market , Rapid deployment, and high reliability requirements.
  • Containerized technology Small and medium-sized enterprises usually manage their own images by building private image warehouses, but when dealing with continuous product interaction and deployment, they usually need to deploy private image warehouses to the public network environment.
  • the public network environment needs to register domain names with network operators, rent servers, and daily operation and maintenance, which obviously increases the cost of software development and maintenance.
  • the embodiment of the application provides a container-based image update release method and device, which can reduce costs by adopting the deployment mode of publishing end-hosting platform-client, and by combining the local image information of the publishing end and the network image information of the hosting platform. Compare to determine whether to update the information at the hosting platform, and then complete the mirror update release on the client.
  • the embodiments of the present application provide a container-based image update and release method, including:
  • the client obtains the corresponding new version image and image metadata from the corresponding third-party public hosting platform, and completes the update and release of the image on the client, including:
  • the client obtains the network mirror information of the corresponding third-party public hosting platform and the client mirror information in the client's local mirror warehouse;
  • the third-party public hosting platform includes a public interface layer, an adaptation proxy layer, and a hosting platform driver layer.
  • the public interface layer is used to implement image push operations or pull operations
  • the adaptation proxy layer is used to implement The adaptation between the common interface layer and the hosting platform driver layer
  • the hosting platform driver layer is used to implement the client of the hosting and storage platform.
  • the layered image file is encrypted using the SHA256 algorithm, and the image metadata records the SHA256 value of the image layered file.
  • the method further includes:
  • the obtaining the local mirror information in the local mirror warehouse of the publishing end includes:
  • uploading the image metadata and the layered image file to a third-party public hosting platform includes:
  • the image metadata is encrypted and uploaded to multiple third-party public hosting platforms
  • the third-party public hosting platform includes Dockerhub platform, Github platform and object storage service platform.
  • an embodiment of the present application provides a container-based image update and release device, including:
  • the first acquisition module used to acquire the local mirror information in the local mirror warehouse of the publishing end;
  • the second acquisition module used to acquire network mirroring information of a third-party public hosting platform, where there are multiple types of the third-party public hosting platform;
  • Judging module used to judge whether the acquired local mirroring information is consistent with the network mirroring information, and if not, execute the third acquiring module;
  • the third acquisition module used to acquire the new version image pushed to the local mirror warehouse and the image metadata corresponding to the new version image, where the new version image includes a hierarchical image file;
  • Upload module used to upload the image metadata and the layered image file to multiple third-party public hosting platforms so that the client can obtain the corresponding new version image and image metadata from the corresponding third-party public hosting platform, and Complete the update and release of the mirror on the client.
  • an electronic device including:
  • Memory and one or more processors
  • the memory is used to store one or more programs
  • the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors implement the container-based image update release method as described in the first aspect.
  • the embodiments of the present application provide a storage medium containing computer-executable instructions, which are used to perform the container-based image update described in the first aspect when the computer-executable instructions are executed by a computer processor. Publishing method.
  • the embodiment of the application adopts the deployment mode of publishing end-hosting platform-client to realize rapid release and deployment of images, and compares the local mirror information of the publishing end with the network image information of the hosting platform to determine whether to perform information on the hosting platform. Update, and then complete the mirror update on the client.
  • the container image synchronization from the publishing end to the client is realized, and through the use of multiple methods of mirroring public network storage, and the encryption and decryption of the image metadata information, Ensure the security of the entire service.
  • FIG. 1 is a flowchart of a container-based image update and release method provided by an embodiment of the present application
  • FIG. 2 is an operation sequence diagram of a container-based image update and release method provided by an embodiment of the present application
  • Fig. 3 is a flowchart of a method for encrypting image metadata provided by an embodiment of the present application
  • FIG. 4 is a flowchart of a method for updating and publishing a mirror image of a client provided by an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a container-based image update and release apparatus provided by an embodiment of the present application.
  • Fig. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the container-based image update publishing method provided in this application adopts the deployment mode of publishing end-hosting platform-client, so that the container image synchronization from the publishing end to the client can be realized with the help of a public hosting platform without applying for a public domain name. Significantly reduce costs. And by adopting multiple ways of mirroring public network storage, the flexibility and security of the entire service are guaranteed.
  • Figure 1 shows a flowchart of a container-based image update and release method provided by an embodiment of the present application
  • Figure 2 is an operation sequence diagram of the container-based image update and release method provided in an embodiment of the present application, which is provided in this embodiment
  • the container-based image update publishing method can be executed by a container-based image update publishing device
  • the container-based image update publishing device can be implemented by software and/or hardware
  • the container-based image update publishing device can be two Or it can be composed of multiple physical entities, or it can be composed of one physical entity.
  • the container-based image update release device can be a computer, mobile phone, tablet, or server.
  • the server as a device that executes the container-based image update and release method as an example. 1 and 2, the container-based image update and release method specifically includes:
  • the publishing side includes a local warehouse registry and an execution side executor.
  • the execution side mainly implements functions such as mirror information timing query, synchronization update, platform adaptation, concurrent upload, resumable upload, and permission control.
  • the release of a mirror by the software mirror publisher means that the publisher uploads the mirror to the local mirror warehouse and stores the mirror meta information such as the id, name, version, access authority, and synchronization platform of the changed mirror in the local database.
  • the above-mentioned action for triggering the update can be actively made by the user, that is, by clicking the update button to complete the triggering, or it can be implemented by setting other strategies.
  • the mirror synchronization can be triggered by a planned strategy such as setting the synchronization interval or manual mode. Synchronization refers to when the mirror version is inconsistent, that is, the preconditions for triggering synchronization are met. Specifically, the acquisition of the local mirror warehouse on the publishing end Local mirror information, including:
  • the step of triggering the update is performed every other week or when it reaches a certain day, for example, when the set time is May 1, 2020, then the mirror synchronization operation will be triggered when this day is reached.
  • S102 Obtain network mirroring information of a third-party public hosting platform, where there are multiple types of the third-party public hosting platform.
  • the entire multi-platform adaptation is divided into three layers of management: the public interface layer Registry API, the adaptation proxy layer Proxy, and the hosting platform driver layer.
  • the public interface layer mainly implements interface operations such as mirroring pull and push.
  • the adaptation agent layer implements functions such as adaptation and data assembly from the upper-layer public interface to the lower-layer driver.
  • the hosting platform driver layer refers to the clients that implement various hosting and storage platforms of dockerhub client, github client, and object storage service ossclient. In the three-layer adaptation of this method, each layer is fully decoupled, and the expansion is very convenient and flexible.
  • the public hosting platform in this embodiment refers to a third-party hosting platform that can be accessed in the public network environment, which mainly includes three categories: 1. dockerhub platform officially maintained by docker; 2. public hosting platforms such as github and code cloud; 3. each An object storage service in cloud services, such as Ali’s OSS.
  • the public hosting platform implements container image storage, which means that the image is stored in a specific file directory format on the platform, and does not require special support for the hosting platform image, so it can realize cross-platform image storage. More preferably, the number of third-party public hosting platforms is three, and the three third-party public hosting platforms include the Dockerhub platform, the Github platform, and the object storage service platform.
  • the third-party public hosting platform refers to a third-party platform for public storage services.
  • the file directory format of the hosting platform in this embodiment mainly includes two parts: manifest and blobs.
  • the manifests directory stores the metadata manifest file of each mirror.
  • the content of the manifest file includes the id, name, version, and layers of the mirror (each mirror is divided into two parts).
  • Layer sha256 value which means that the complete image file can be obtained by obtaining the image metadata, and the image name is in the image "id_name_version" format.
  • Blobs stores all mirrored hierarchical mirrored data files, and each file is named after the mirror sha256 value, which is consistent with the value stored by the mirror in the local mirror database.
  • This step is mainly to determine whether the local mirroring information is consistent with the information stored at the hosting platform. If they are consistent, no update operation is performed, and if they are not consistent, an update operation is required.
  • the execution end receives the hosting platform and returns the platform mirror information, where the mirror information refers to the list of manifest file names in the "id_name_version" naming format under the platform manifests directory, obtain the existing image and version information of the platform; the provider execution end compares local If the name and version information of the mirror information obtained by the mirror warehouse and third-party hosting platform are inconsistent, it means that there is a new mirror, which triggers the mirror update operation.
  • S104 Obtain a new version image and image metadata corresponding to the new version image pushed to the local mirror warehouse, where the new version image includes a hierarchical image file.
  • the publishing end execution end obtains the new image in the registry, and the image and image metadata are set separately in the registry.
  • the image storage also adopts a hierarchical storage structure. Each layer of image files is commanded in sha256 mode, and each image contains all The hierarchical image files are all recorded in the metadata, so all hierarchical image files can only be obtained by obtaining the metadata file manifest.
  • the registry refers to the local mirror warehouse of the publishing end.
  • FIG. 3 is a flowchart of a method for encrypting image metadata provided by an embodiment of the present application, as shown in FIG. 3,
  • S104a Use the RSA algorithm to perform asymmetric encryption on the image metadata.
  • S104b Send the public key corresponding to the image metadata to the corresponding client.
  • the above steps mainly indicate that the image metadata is encrypted.
  • the user can more conveniently realize the authority control, and only the user who has the corresponding key can download the corresponding image.
  • the layered image file is encrypted using the SHA256 algorithm, and the image metadata records the SHA256 value of the image layered file.
  • S105 Upload the image metadata and the layered image file to multiple third-party public hosting platforms so that the client can obtain the corresponding new version image and image metadata from the corresponding third-party public hosting platform, and upload them to the client’s Complete the update and release of the mirror.
  • the mirror concurrent upload method is to obtain the name and version information of each mirror in the local mirror database of the local mirror warehouse when specified.
  • the existence of a new mirror or a new version of an existing mirror indicates that the mirror needs to be uploaded to the public hosting platform.
  • the provider obtains the identified image metadata file manifest, and obtains the image metadata to obtain all the information related to the image, including the name, version, and all hierarchical image file names (sha256 value). Since metadata and mirrored hierarchical storage are separated, each layer of images can be uploaded concurrently. By comparing the corresponding metadata information of the mirror in the hosting platform, you can learn whether there is a failure of the mirrored layered transmission, and if it fails, it will be retransmitted. This layer is mirrored.
  • permission control means that the Provider uses RSA to encrypt the content in each manifest, and provides the public key of the manifest to the client with corresponding permissions, so as to achieve limited permission control.
  • the execution end concurrently uploads the hierarchical image file to the platform blobs directory, and uploads the content in the manifest file to the platform manifests directory after using RSA asymmetric encryption. Because the mirroring adopts hierarchical storage, all mirror files can be uploaded concurrently.
  • the implementation of resumable upload is that the execution end can judge whether there is a mirror file transmission failure of a certain layer caused by the jitter of the public network by comparing the manifest file. If the transmission fails, the file of this layer will be transmitted again to realize the resumable transmission.
  • uploading the image metadata and the layered image file to a third-party public hosting platform includes:
  • the image metadata is encrypted and uploaded to a third-party public hosting platform
  • FIG. 4 is an example of the image update release method of the client provided in this embodiment of the application.
  • the flow chart, as shown in Figure 4, includes:
  • S105a The client obtains the network mirror information of the third-party public hosting platform and the client mirror information in the local mirror warehouse of the client.
  • S105b Determine whether the network mirroring information is consistent with the customer mirroring information, and if not, execute the next step.
  • S105c Obtain a new version image and image metadata of the third-party public hosting platform, where the new version image includes a hierarchical image file.
  • S105d Obtain the corresponding hierarchical image file according to the image metadata, and download the corresponding new version image from the third-party public hosting platform.
  • S105e Push the new version image to the local image warehouse of the client.
  • the above-mentioned mirror download method means that the client periodically obtains the file name list information of all manifests in the manifests directory of the public hosting platform, and obtains the name and version information corresponding to each mirror through the file name. If there is a new mirror or an existing mirror For the new version of the mirror, get the content in the manifest.
  • the underlying platform client is called through the public interface registry API to download the files in the blobs directory indicated in the manifest file. Tag the downloaded local mirror file and push it to the local mirror warehouse registry of the client.
  • Permission verification on the client side means that the client side obtains the public key of each manifest file from the provider side, decrypts the content in the manifest, and realizes limited permission control. In this embodiment, the client only has read permissions.
  • the hosting platform supports multiple mirrored public network storage methods such as dockerhub, github, oss (Alibaba Cloud Object Storage Service), and the hosting platform adaptation adopts a hierarchical structure of public interface layer, adaptation agent layer, and platform driver layer , The adaptation of each platform is highly loosely coupled, which ensures the flexibility, security, and availability of the entire service.
  • the permission control uses asymmetric encryption to encrypt the content of each manifest file and give the public key to the client to a certain extent Ensure that the resource permissions on the hosting platform are controllable.
  • the embodiment of the application adopts the deployment mode of publishing end-hosting platform-client to realize rapid release and deployment of images, and compares the local mirror information of the publishing end with the network image information of the hosting platform to determine whether to perform information on the hosting platform. Update, and then complete the mirror update on the client.
  • the container image synchronization from the publishing end to the client is realized, and through the use of multiple methods of mirroring public network storage, and the encryption and decryption of the image metadata information, Ensure the security of the entire service.
  • FIG. 5 is a schematic structural diagram of a container-based image update and release apparatus provided by an embodiment of the application.
  • the container-based image update and release apparatus provided by this embodiment specifically includes:
  • the first obtaining module 21 used to obtain the local mirror information in the local mirror warehouse of the publishing end;
  • the second obtaining module 22 used to obtain network mirroring information of a third-party public hosting platform, where there are multiple types of the third-party public hosting platform;
  • Judging module 23 used to determine whether the acquired local mirroring information is consistent with the network mirroring information, and if not, execute the third acquiring module;
  • the third obtaining module 24 used to obtain the new version image pushed to the local mirror warehouse and the image metadata corresponding to the new version image, where the new version image includes a hierarchical image file;
  • Upload module 25 used to upload the image metadata and the layered image file to multiple third-party public hosting platforms so that the client can obtain the corresponding new version image and image metadata from the corresponding third-party public hosting platform, And complete the mirror update release on the client.
  • the embodiment of the application reduces costs by adopting the deployment method of publishing end-hosting platform-client, and compares the local mirroring information of the publishing end with the network mirroring information of the hosting platform to determine whether to update the information at the hosting platform. And then complete the mirror update release on the client.
  • adopting the deployment method of publishing end-hosting platform-client it can realize the synchronization of container images from the publishing end to the client with the help of the public hosting platform without applying for a public domain name, which significantly reduces costs. And through the use of multiple ways of mirroring public network storage, the flexibility and security of the entire service are guaranteed.
  • the container-based image update and release apparatus provided in the embodiment of the present application can be used to execute the container-based image update and release method provided in the foregoing embodiment, and has corresponding functions and beneficial effects.
  • the electronic device includes a processor 31, a memory 32, a communication module 33, an input device 34, and an output device 35.
  • the number of processors 31 in the electronic device may be one or more, and the number of memories 32 in the electronic device may be one or more.
  • the processor 31, the memory 32, the communication module 33, the input device 34, and the output device 35 of the electronic device may be connected by a bus or other methods.
  • the memory 32 can be used to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the container-based image update publishing method described in any embodiment of the present application (for example, based on The first acquiring module 21, the second acquiring module 22, the judging module 23, the third acquiring module 24, and the uploading module 25 in the image update release device of the container).
  • the memory 32 may mainly include a program storage area and a data storage area.
  • the program storage area may store an operating system and an application program required by at least one function; the data storage area may store data created according to the use of the device, and the like.
  • the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.
  • the memory may further include a memory remotely provided with respect to the processor, and these remote memories may be connected to the device through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the communication module 33 is used for data transmission.
  • the processor 31 executes various functional applications and data processing of the device by running the software programs, instructions, and modules stored in the memory 32, that is, implements the above-mentioned container-based image update and release method.
  • the input device 34 can be used to receive inputted numeric or character information, and generate key signal input related to user settings and function control of the device.
  • the output device 35 may include a display device such as a display screen.
  • the electronic device provided above can be used to execute the container-based image update and release method provided in the above embodiment, and has corresponding functions and beneficial effects.
  • the embodiment of the present application also provides a storage medium containing computer-executable instructions, when the computer-executable instructions are executed by the computer processor 31, they are used to execute a container-based image update publishing method.
  • the container-based image update Publishing methods include:
  • Storage medium any of various types of storage devices or storage devices.
  • the term "storage medium” is intended to include: installation media, such as CD-ROM, floppy disk or tape device; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc. ; Non-volatile memory, such as flash memory, magnetic media (such as hard disk or optical storage); registers or other similar types of memory elements.
  • the storage medium may further include other types of memory or a combination thereof.
  • the storage medium may be located in the first computer system in which the program is executed, or may be located in a different second computer system connected to the first computer system through a network (such as the Internet).
  • the second computer system can provide the program instructions to the first computer for execution.
  • the term “storage medium” may include two or more storage media residing in different locations (for example, in different computer systems connected through a network).
  • the storage medium may store program instructions executable by one or more processors 31 (for example, embodied as
  • the storage medium containing computer-executable instructions provided by the embodiments of the present application is not limited to the container-based image update and release method described above, and can also execute any of the embodiments of the present application. Related operations in the container-based image update release method.
  • the container-based image update and release device, storage medium, and electronic equipment provided in the above embodiments can execute the container-based image update and release method provided in any embodiment of this application.
  • the technical details that are not described in detail in the above embodiments can be Refer to the container-based image update release method provided by any embodiment of this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请实施例公开了一种基于容器的镜像更新发布方法及装置。本申请实施例提供的技术方案，采用发布端-托管平台-客户端的部署方式实现镜像快速发布、部署，并且通过将发布端的本地镜像信息与托管平台的网络镜像信息进行比对以判断是否对托管平台处的信息进行更新，进而完成在客户端进行镜像更新。在无需申请公网域名的环境下，借助公共托管平台，实现发布端到客户端的容器镜像同步，并且通过采用多种方式的镜像公网存储方式，和对镜像元数据信息的加、解密处理，保证了整个服务的安全性。

Description

一种基于容器的镜像更新发布方法及装置 技术领域
本申请实施例涉及计算机技术领域，尤其涉及一种基于容器的镜像更新发布方法及装置。
背景技术
目前，容器技术由于其具备较高安全性、隔离性、可移植性，在应用市场的热度很高。作为一种轻量级的应用打包、隔离的技术，容器技术采用持续集成、持续部署方式，极大地简化开发、测试、部署流程，加快产品的交付速度，更加符合当今应用市场对软件产品持续迭代、快速部署、高可靠性的需求。
但是，在应用过程中容器技术还存在有如下缺陷：
一、服务引用容器化后，具有高度的可移植性，因此容器化技术应用非常普遍。容器化技术中小企业通常采用构建私有镜像仓库的方式管理自己的镜像，但是在处理产品持续交互、部署时，通常需要将私有镜像仓库部署到公网环境。公网环境需要向网络运营商注册域名、租用服务器、日常运维，这显然增加了软件的研发及维护成本。
二、由于网络带宽及网络抖动等客观因素的存在，因此公网上获取镜像就需要考虑的下载性能问题、数据传输断点续传等。目前已有的方案，均为就此作深入的讨论，这对应用的可靠性、灵活性提升都将不可或缺。
三、安全性问题，由于docker是一家美国公司，国内托管到dockerhub上个的镜像服务可用性无法保证。当国家利益间存在冲突时，如果采用单一的镜像托管平台容易产生较大的使用风险。
发明内容
本申请实施例提供一种基于容器的镜像更新发布方法及装置，能够通过采用发布端-托管平台-客户端的部署方式来减低成本，并且通过将发布端的本地镜像信息与托管平台的网络镜像信息进行比对以判断是否对托管平台处的信息进行更新，进而完成在客户端进行镜像更新发布。
在第一方面，本申请实施例提供了一种基于容器的镜像更新发布方法，包 括：
获取发布端本地镜像仓库中的本地镜像信息；
获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的种类为多个；
判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行下一步；
获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台以使客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端完成镜像的更新发布。
进一步的，所述客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布，包括：
客户端获取对应的第三方公共托管平台的网络镜像信息和客户端本地镜像仓库中的客户镜像信息；
判断所述网络镜像信息与所述客户镜像信息是否一致，如果否，则执行下一步；
获取所述第三方公共托管平台的新版本镜像和镜像元数据，所述新版本镜像包括分层镜像文件；
根据所述镜像元数据得到对应的分层镜像文件，并从第三方公共托管平台下载对应的新版本镜像；
将所述新版本镜像推送至客户端的本地镜像仓库中。
进一步的，所述第三方公共托管平台包括公共接口层、适配代理层和托管平台驱动层，所述公共接口层用于实现镜像推送操作或拉取操作，所述适配代理层用于实现公共接口层与托管平台驱动层之间的适配；所述托管平台驱动层用于实现托管以及存储平台的客户端。
进一步的，所述分层镜像文件采用SHA256算法进行加密，所述镜像元数据记录有镜像分层文件的SHA256值。
进一步的，所述获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据之后，还包括：
采用RSA算法对所述镜像元数据进行非对称加密；
发送与所述镜像元数据对应的公钥至对应的客户端。
进一步的，所述获取发布端本地镜像仓库中的本地镜像信息，包括：
每隔预设时间获取发布端本地镜像仓库中的本地镜像信息；或，
在预设时间点获取发布端本地镜像仓库中的本地镜像信息。
进一步的，所述将所述镜像元数据和所述分层镜像文件上传至第三方公共托管平台，包括：
将所述镜像元数据进行加密后上传至多个第三方公共托管平台；
并发上传所述分层镜像文件至多个第三方公共托管平台。
进一步的，所述第三方公共托管平台包括Dockerhub平台、Github平台和对象存储服务平台。
在第二方面，本申请实施例提供了一种基于容器的镜像更新发布装置，包括：
第一获取模块：用于获取发布端本地镜像仓库中的本地镜像信息；
第二获取模块：用于获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的种类为多个；
判断模块：用于判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行第三获取模块；
第三获取模块：用于获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
上传模块：用于将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台以使客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端完成镜像的更新发布。
在第三方面，本申请实施例提供了一种电子设备，包括：
存储器以及一个或多个处理器；
所述存储器，用于存储一个或多个程序；
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如第一方面所述的基于容器的镜像更新发布方法。
在第四方面，本申请实施例提供了一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器执行时用于执行如第一方面所述的基于容器的镜像更新发布方法。
本申请实施例采用发布端-托管平台-客户端的部署方式实现镜像快速发 布、部署，并且通过将发布端的本地镜像信息与托管平台的网络镜像信息进行比对以判断是否对托管平台处的信息进行更新，进而完成在客户端进行镜像更新。在无需申请公网域名的环境下，借助公共托管平台，实现发布端到客户端的容器镜像同步，并且通过采用多种方式的镜像公网存储方式，和对镜像元数据信息的加、解密处理，保证了整个服务的安全性。
附图说明
图1是本申请实施例提供的一种基于容器的镜像更新发布方法的流程图；
图2是本申请实施例提供的基于容器的镜像更新发布方法的操作时序图；
图3是本申请实施例提供的对镜像元数据进行加密方法的流程图；
图4是本申请实施例提供的客户端的镜像更新发布方法的流程图；
图5是本申请实施例提供的一种基于容器的镜像更新发布装置的结构示意图；
图6是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面结合附图对本申请具体实施例作进一步的详细描述。可以理解的是，此处所描述的具体实施例仅仅用于解释本申请，而非对本申请的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与本申请相关的部分而非全部内容。在更加详细地讨论示例性实施例之前应当提到的是，一些示例性实施例被描述成作为流程图描绘的处理或方法。虽然流程图将各项操作(或步骤)描述成顺序的处理，但是其中的许多操作可以被并行地、并发地或者同时实施。此外，各项操作的顺序可以被重新安排。当其操作完成时所述处理可以被终止，但是还可以具有未包括在附图中的附加步骤。所述处理可以对应于方法、函数、规程、子例程、子程序等等。
目前在处理产品持续交互、部署时，通常需要将私有镜像仓库部署到公网环境。公网环境需要向网络运营商注册域名、租用服务器、日常运维，这显然增加了软件的研发及维护成本。并且单一的镜像托管平台存在极大风险。本申请提供的基于容器的镜像更新发布方法通过采用发布端-托管平台-客户端的部署方式，使得在无需申请公网域名的环境下，借助公共托管平台，实现发布端 到客户端的容器镜像同步，显著降低成本。并且通过采用多种方式的镜像公网存储方式，保证了整个服务的灵活性和安全性。
图1给出了本申请实施例提供的一种基于容器的镜像更新发布方法的流程图，图2是本申请实施例提供的基于容器的镜像更新发布方法的操作时序图，本实施例中提供的基于容器的镜像更新发布方法可以由基于容器的镜像更新发布设备执行，该基于容器的镜像更新发布设备可以通过软件和/或硬件的方式实现，该基于容器的镜像更新发布设备可以是两个或多个物理实体构成，也可以是一个物理实体构成。一般而言，该基于容器的镜像更新发布设备可以是电脑，手机，平板或服务器等。
下述以服务器为执行基于容器的镜像更新发布方法的设备为例，进行描述。参照图1和图2，该基于容器的镜像更新发布方法具体包括：
S101：获取发布端本地镜像仓库中的本地镜像信息。
在发布端包括有本地仓库registry和执行端executor，执行端主要实现镜像信息定时查询、同步更新、平台适配、并发上传、断点续传、权限控制等功能。软件镜像发布方发布镜像，是指发布方将镜像上传到本地镜像仓库，并将改镜像的id、name、version、访问权限、同步平台等镜像元信息存储到本地数据库中。上述进行更新触发的动作可以是用户主动做出的，也即是点击更新按键来完成触发，也可以通过设置其他的策略方式来实现。
进一步的，可通过设置同步时间间隔或手动方式等计划性策略方式触发镜像同步，同步是指当镜像版本不一致时，即满足同步触发前提条件，具体的，所述获取发布端本地镜像仓库中的本地镜像信息，包括：
每隔预设时间获取发布端本地镜像仓库中的本地镜像信息；或，
在预设时间点获取发布端本地镜像仓库中的本地镜像信息。
上述方案具体的也即是，每隔一星期进行一次触发更新的步骤或者是到某一天时，比如设置的时间是2020年5月1号时，那么到这一天时，则触发镜像同步操作。
S102：获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的种类为多个。
整个多平台适配划分成：公共接口层Registry API、适配代理层Proxy、托管平台驱动层三层管理。公共接口层主要实现镜像pull、push等的接口操作。适配代理层则实现上层公共接口到下层驱动之间的适配、数据组装等功能。托 管平台驱动层是指实现dockerhub client、github client、对象存储服务ossclient的各种托管及存储平台的客户端。本方法的三层适配中各层与层之间充分解耦、扩展十分便利、灵活。
本实施例的公共托管平台，是指能够在公网环境访问的第三方托管平台，主要包括三类：一、docker官方维护的dockerhub平台；二、github、码云等公共托管平台；三、各种云服务中的对象存储服务，如阿里的OSS。公共托管平台实现容器镜像存储，是指镜像在平台中以特定的文件目录格式存储，并不需要托管平台镜像特殊支持，因此可以实现镜像存储跨平台。更为优选的，第三方公共托管平台的数量为3个，3个第三方公共托管平台包括Dockerhub平台、Github平台和对象存储服务平台。第三方公共托管平台是指公共存储服务的第三方平台。
本实施例中托管平台的文件目录格式主要包括manifest、blobs两个部分内容，manifests目录存放每个镜像的元数据manifest文件,manifest文件内容包括镜像的id、name、version、layers(每个镜像分层sha256值)，即意味着获取镜像元数据就可得到完整的镜像文件,并且镜像命名采用以镜像“id_name_version”格式。blobs存放所有镜像的分层镜像数据文件，每个文件均以镜像sha256值命名，该值与镜像在本地镜像数据库中存储的值一致。
S103：判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行下一步。
本步骤主要是为了判断本地镜像信息与托管平台处存储的信息是否一致，如果一致的话，则不进行更新操作，如果不一致的话则需要进行更新操作。当执行端接收到托管平台返回平台镜像信息，此处镜像信息指平台manifests目录下的各个“id_name_version”命名格式的manifest文件名列表，获取得到平台已有的镜像及版本信息；provider执行端比较本地镜像仓库、第三方托管平台获取的镜像信息名称和版本信息，如果不一致则表示有新镜像，即触发镜像更新操作。
S104：获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件。
具体的，发布端执行端获取registry中的新镜像，在registry中镜像、镜像元数据分离设置，镜像存储也采用分层存储结构，每层镜像文件都以sha256方式命令，每个镜像包含的所有分层镜像文件均在元数据中都有记录，因此只 有获取元数据文件manifest才能获的所有的分层镜像文件。本实施例中，registry指的是发布端的本地镜像仓库。
进一步的，图3是本申请实施例提供的对镜像元数据进行加密方法的流程图，如图3所示，
S104a：采用RSA算法对所述镜像元数据进行非对称加密。
S104b：发送与所述镜像元数据对应的公钥至对应的客户端。
上述步骤主要是表明镜像元数据是经过加密处理的，通过上述加密处理能够使得用户较为方便的实现权限控制，只有拥有对应密钥的用户才能够下载相应的镜像。进一步的，所述分层镜像文件采用SHA256算法进行加密，所述镜像元数据记录有镜像分层文件的SHA256值。
S105：将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台以使客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布。
镜像并发上传方式，是指定时获取本地镜像仓库本地镜像数据库中每个镜像name、version信息，存在新的镜像或者已有镜像的新版本这标记该镜像需要上传到公共托管平台。provider获取标识的镜像元数据文件manifest，得到该镜像的元数据即可获得所有与该镜像相关的信息，包括名称、版本、所有分层镜像文件名(sha256值)。由于元数据、镜像分层存储是分离的，因此可实现并发上传每层镜像，通过比对托管平台中镜像对应元数据信息即可获悉是否存在镜像分层传输失败的情形，若失败则重传该层镜像。
在本实施例中权限控制，是指Provider采用RSA将每个manifest中的内容加密，并向具有相应权限的client端，提供该manifest的公钥，实现有限的权限控制。
在本实施例中，具体的，执行端并发上传分层镜像文件至平台blobs目录下，及将manifest文件中的内容采用RSA非对称加密后上传至平台manifests目录下。由于镜像采用分层存储，因此可以采用并发方式上传所有镜像文件，断点续传实现是执行端通过比对manifest文件即可判断是否存在由于公网网络抖动导致的某层镜像文件传输失败，如果传输失败则单独再次传输该层文件实现断点续传。
进一步的，所述将所述镜像元数据和所述分层镜像文件上传至第三方公共托管平台，包括：
将所述镜像元数据进行加密后上传至第三方公共托管平台；
并发上传所述分层镜像文件至第三方公共托管平台。
进一步的，所述客户端从第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布，图4是本申请实施例提供的客户端的镜像更新发布方法的流程图，如图4所示，包括：
S105a：客户端获取第三方公共托管平台的网络镜像信息和客户端本地镜像仓库中的客户镜像信息。
S105b：判断将所述网络镜像信息与所述客户镜像信息是否一致，如果否，则执行下一步。
S105c：获取所述第三方公共托管平台的新版本镜像和镜像元数据，所述新版本镜像包括分层镜像文件。
S105d：根据所述镜像元数据得到对应的分层镜像文件，并从第三方公共托管平台下载对应的新版本镜像。
S105e：将所述新版本镜像推送至客户端的本地镜像仓库中。
上述镜像下载方式，是指client端定时获取公共托管平台的manifests目录下的所有manifest的文件名列表信息，并通过文件名获取每个镜像对应的name、version信息，如果存在新的镜像或者已有镜像的新版本，则获取该manifest中的内容。通过公共接口registry API来调用底层平台client以下载manifest文件中表示的blobs目录下的文件。将下载到本地的镜像文件打tag，并push到客户端的本地镜像仓库registry中。在客户端的权限验证，是指client端向provider端获取每个manifest文件的公钥，对manifest中的内容进行解密，实现有限的权限控制。在本实施例中client仅具有读权限。
本实施例的方案主要有如下优点：
1、采用“provider—托管平台—client”的部署模式，在无需申请公网域名的环境下，借助公共托管平台，实现provider到client端的容器镜像同步，显著降低成本。
2、托管平台支持dockerhub、github、oss(阿里云对象存储服务)等多种方式的镜像公网存储方式，且托管平台适配采用公共接口层、适配代理层、平台驱动层的分层结构，各平台适配高度松耦合，保证了整个服务的灵活性、安全性、可用性。
3、利用docker镜像的元数据与镜像分离、镜像分层等存储特性，本地仓 库到托管平台之间的镜像上传、获取实现并发、断点续传功能，有效的保证了性能。
4、采用第三方托管平台，由于每个镜像都是通过manifest才能获取具体的分层镜像，因此权限控制采用非对称加密方式加密将每个manifest文件内容，并将公钥给client，在一定程度上保证托管平台上的资源权限可控。
本申请实施例采用发布端-托管平台-客户端的部署方式实现镜像快速发布、部署，并且通过将发布端的本地镜像信息与托管平台的网络镜像信息进行比对以判断是否对托管平台处的信息进行更新，进而完成在客户端进行镜像更新。在无需申请公网域名的环境下，借助公共托管平台，实现发布端到客户端的容器镜像同步，并且通过采用多种方式的镜像公网存储方式，和对镜像元数据信息的加、解密处理，保证了整个服务的安全性。
在上述实施例的基础上，图5为本申请实施例提供的一种基于容器的镜像更新发布装置的结构示意图。参考图5，本实施例提供的基于容器的镜像更新发布装置具体包括：
第一获取模块21：用于获取发布端本地镜像仓库中的本地镜像信息；
第二获取模块22：用于获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的种类为多个；
判断模块23：用于判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行第三获取模块；
第三获取模块24：用于获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
上传模块25：用于将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台以使客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布。
本申请实施例通过采用发布端-托管平台-客户端的部署方式来减低成本，并且通过将发布端的本地镜像信息与托管平台的网络镜像信息进行比对以判断是否对托管平台处的信息进行更新，进而完成在客户端进行镜像更新发布。通过采用发布端-托管平台-客户端的部署方式，使得在无需申请公网域名的环境下，借助公共托管平台，实现发布端到客户端的容器镜像同步，显著降低成本。并且通过采用多种方式的镜像公网存储方式，保证了整个服务的灵活性和安全性。
本申请实施例提供的基于容器的镜像更新发布装置可以用于执行上述实施例提供的基于容器的镜像更新发布方法，具备相应的功能和有益效果。
图6是本申请实施例提供的一种电子设备的结构示意图，参照图6，该电子设备包括：处理器31、存储器32、通信模块33、输入装置34及输出装置35。该电子设备中处理器31的数量可以是一个或者多个，该电子设备中的存储器32的数量可以是一个或者多个。该电子设备的处理器31、存储器32、通信模块33、输入装置34及输出装置35可以通过总线或者其他方式连接。
存储器32作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及模块，如本申请任意实施例所述的基于容器的镜像更新发布方法对应的程序指令/模块(例如，基于容器的镜像更新发布装置中的第一获取模块21、第二获取模块22、判断模块23、第三获取模块24和上传模块25)。存储器32可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据设备的使用所创建的数据等。此外，存储器32可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储器可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
通信模块33用于进行数据传输。
处理器31通过运行存储在存储器32中的软件程序、指令以及模块，从而执行设备的各种功能应用以及数据处理，即实现上述的基于容器的镜像更新发布方法。
输入装置34可用于接收输入的数字或字符信息，以及产生与设备的用户设置以及功能控制有关的键信号输入。输出装置35可包括显示屏等显示设备。
上述提供的电子设备可用于执行上述实施例提供的基于容器的镜像更新发布方法，具备相应的功能和有益效果。
本申请实施例还提供一种包含计算机可执行指令的存储介质，所述计算机可执行指令在由计算机处理器31执行时用于执行一种基于容器的镜像更新发布方法，该基于容器的镜像更新发布方法包括：
获取发布端本地镜像仓库中的本地镜像信息；
获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的数 量为多个；
判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行下一步；
获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
将所述镜像元数据和所述分层镜像文件上传至第三方公共托管平台以使客户端从第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布。
存储介质——任何的各种类型的存储器设备或存储设备。术语“存储介质”旨在包括：安装介质，例如CD-ROM、软盘或磁带装置；计算机系统存储器或随机存取存储器，诸如DRAM、DDR RAM、SRAM、EDO RAM，兰巴斯(Rambus)RAM等；非易失性存储器，诸如闪存、磁介质(例如硬盘或光存储)；寄存器或其它相似类型的存储器元件等。存储介质可以还包括其它类型的存储器或其组合。另外，存储介质可以位于程序在其中被执行的第一计算机系统中，或者可以位于不同的第二计算机系统中，第二计算机系统通过网络(诸如因特网)连接到第一计算机系统。第二计算机系统可以提供程序指令给第一计算机用于执行。术语“存储介质”可以包括驻留在不同位置中(例如在通过网络连接的不同计算机系统中)的两个或更多存储介质。存储介质可以存储可由一个或多个处理器31执行的程序指令(例如具体实现为计算机程序)。
当然，本申请实施例所提供的一种包含计算机可执行指令的存储介质，其计算机可执行指令不限于如上所述的基于容器的镜像更新发布方法，还可以执行本申请任意实施例所提供的基于容器的镜像更新发布方法中的相关操作。
上述实施例中提供的基于容器的镜像更新发布装置、存储介质及电子设备可执行本申请任意实施例所提供的基于容器的镜像更新发布方法，未在上述实施例中详尽描述的技术细节，可参见本申请任意实施例所提供的基于容器的镜像更新发布方法。
上述仅为本申请的较佳实施例及所运用的技术原理。本申请不限于这里所述的特定实施例，对本领域技术人员来说能够进行的各种明显变化、重新调整及替代均不会脱离本申请的保护范围。因此，虽然通过以上实施例对本申请进行了较为详细的说明，但是本申请不仅仅限于以上实施例，在不脱离本申请构思的情况下，还可以包括更多其他等效实施例，而本申请的范围由权利要求的 范围决定。

Claims (10)

  1. 一种基于容器的镜像更新发布方法，其特征在于，包括：
    获取发布端本地镜像仓库中的本地镜像信息；
    获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的种类为多个；
    判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行下一步；
    获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
    将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台以使客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端完成镜像的更新发布。
  2. 根据权利要求1所述的基于容器的镜像更新发布方法，其特征在于，所述客户端从对应的第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布，包括：
    客户端获取对应的第三方公共托管平台的网络镜像信息和客户端本地镜像仓库中的客户镜像信息；
    判断所述网络镜像信息与所述客户镜像信息是否一致，如果否，则执行下一步；
    获取所述第三方公共托管平台的新版本镜像和镜像元数据，所述新版本镜像包括分层镜像文件；
    根据所述镜像元数据得到对应的分层镜像文件，并从第三方公共托管平台下载对应的新版本镜像；
    将所述新版本镜像推送至客户端的本地镜像仓库中。
  3. 根据权利要求1所述的基于容器的镜像更新发布方法，其特征在于，所述第三方公共托管平台包括公共接口层、适配代理层和托管平台驱动层，所述公共接口层用于实现镜像推送操作或拉取操作，所述适配代理层用于实现公共接口层与托管平台驱动层之间的适配；所述托管平台驱动层用于实现托管以及存储平台的客户端。
  4. 根据权利要求1所述的基于容器的镜像更新发布方法，其特征在于，在所述获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据之后，还包括：
    采用RSA算法对所述镜像元数据进行非对称加密；
    发送与所述镜像元数据对应的公钥至对应的客户端。
  5. 根据权利要求1所述的基于容器的镜像更新发布方法，其特征在于，所述获取发布端本地镜像仓库中的本地镜像信息，包括：
    每隔预设时间获取发布端本地镜像仓库中的本地镜像信息；或，
    在预设时间点获取发布端本地镜像仓库中的本地镜像信息。
  6. 根据权利要求1所述的基于容器的镜像更新发布方法，其特征在于，所述将所述镜像元数据和所述分层镜像文件上传至多个第三方公共托管平台，包括：
    将所述镜像元数据进行加密后上传至多个第三方公共托管平台；
    并发上传所述分层镜像文件至多个第三方公共托管平台。
  7. 根据权利要求1-6中任意一项所述的基于容器的镜像更新发布方法，其特征在于，所述第三方公共托管平台包括Dockerhub平台、Github平台和对象存储服务平台。
  8. 一种基于容器的镜像更新发布装置，其特征在于，包括：
    第一获取模块：用于获取发布端本地镜像仓库中的本地镜像信息；
    第二获取模块：用于获取第三方公共托管平台的网络镜像信息，所述第三方公共托管平台的数量为多个；
    判断模块：用于判断获取到的所述本地镜像信息与所述网络镜像信息是否一致，如果否，则执行第三获取模块；
    第三获取模块：用于获取推送至所述本地镜像仓库中的新版本镜像和与新版本镜像对应的镜像元数据，所述新版本镜像包括分层镜像文件；
    上传模块：用于将所述镜像元数据和所述分层镜像文件上传至第三方公共托管平台以使客户端从第三方公共托管平台获取对应的新版本镜像和镜像元数据，并在客户端的完成镜像的更新发布。
  9. 一种电子设备，其特征在于，包括：
    存储器以及一个或多个处理器；
    所述存储器，用于存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求1-7任一所述的基于容器的镜像更新发布方法。
  10. 一种包含计算机可执行指令的存储介质，其特征在于，所述计算机可执 行指令在由计算机处理器执行时用于执行如权利要求1-7任一所述的基于容器的镜像更新发布方法。
PCT/CN2021/073903 2020-05-22 2021-01-27 一种基于容器的镜像更新发布方法及装置 WO2021232845A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010443323.3 2020-05-22
CN202010443323.3A CN111654531B (zh) 2020-05-22 2020-05-22 一种基于容器的镜像更新发布方法及装置

Publications (1)

Publication Number Publication Date
WO2021232845A1 true WO2021232845A1 (zh) 2021-11-25

Family

ID=72349677

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/073903 WO2021232845A1 (zh) 2020-05-22 2021-01-27 一种基于容器的镜像更新发布方法及装置

Country Status (2)

Country Link
CN (1) CN111654531B (zh)
WO (1) WO2021232845A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114047938A (zh) * 2022-01-11 2022-02-15 北京云歌科技有限责任公司 一种构建镜像的方法、装置、设备及可读存储介质
CN114466028A (zh) * 2022-02-16 2022-05-10 京东科技信息技术有限公司 镜像同步方法、装置、设备及存储介质
CN115063146A (zh) * 2022-06-29 2022-09-16 支付宝(杭州)信息技术有限公司 保护数据隐私的风险评估方法、系统及装置
CN115292265A (zh) * 2022-07-05 2022-11-04 深圳市连用科技有限公司 跨网络的容器镜像文件自动导入的方法、设备及存储介质
CN115766739A (zh) * 2022-10-14 2023-03-07 济南浪潮数据技术有限公司 一种容器镜像分发方法、装置、系统及其介质
CN116893834A (zh) * 2023-09-11 2023-10-17 中移(苏州)软件技术有限公司 负载更新方法、装置、系统、电子设备及可读存储介质
CN117353922A (zh) * 2023-12-06 2024-01-05 南京中孚信息技术有限公司 离线状态下的容器镜像签名验证方法、系统、设备及介质
CN117369953A (zh) * 2023-12-08 2024-01-09 中电云计算技术有限公司 镜像同步方法、装置、设备及存储介质
WO2024050315A1 (en) * 2022-08-31 2024-03-07 Confluent, Inc. Docker image registry synchronization service

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111654531B (zh) * 2020-05-22 2023-05-05 国云科技股份有限公司 一种基于容器的镜像更新发布方法及装置
CN112379903B (zh) * 2020-11-09 2023-04-18 杭州安恒信息技术股份有限公司 版本更新方法、装置、系统、电子装置和存储介质
CN113805858B (zh) * 2021-02-10 2024-04-05 京东科技控股股份有限公司 持续部署脚本语言开发的软件的方法和装置
CN112818403B (zh) * 2021-02-26 2023-03-03 上海德衡数据科技有限公司 容器数据中心运维系统
CN113282308A (zh) * 2021-06-17 2021-08-20 杭州华橙软件技术有限公司 一种镜像构建方法、装置、存储介质及电子装置
CN113505180B (zh) * 2021-09-10 2022-02-22 苏州浪潮智能科技有限公司 一种多云平台中镜像的同步方法、装置、设备及可读介质
CN114327754B (zh) * 2021-12-15 2022-10-04 中电信数智科技有限公司 一种基于容器分层技术的镜像导出与组装方法

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106528224A (zh) * 2016-11-03 2017-03-22 腾讯科技（深圳）有限公司 一种Docker容器的内容更新方法、服务器及系统
US20180146069A1 (en) * 2016-11-18 2018-05-24 Sap Se Efficient application build/deployment for distributed container cloud platform
CN108268308A (zh) * 2018-01-22 2018-07-10 广州欧赛斯信息科技有限公司 一种基于容器平台的持续集成方法、系统及装置
US20180302459A1 (en) * 2015-04-21 2018-10-18 Ubergrape Gmbh Systems and methods for integrating external resources from third-party services
CN110196728A (zh) * 2018-03-27 2019-09-03 腾讯科技（深圳）有限公司 镜像升级的容器处理方法和装置
US10528337B1 (en) * 2018-10-24 2020-01-07 International Business Machines Corporation Container image layer reordering
CN111654531A (zh) * 2020-05-22 2020-09-11 国云科技股份有限公司 一种基于容器的镜像更新发布方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107066310A (zh) * 2017-03-11 2017-08-18 郑州云海信息技术有限公司 一种搭建及使用安全Docker私有仓库的方法及装置
US10402213B2 (en) * 2017-05-26 2019-09-03 Sap Se Software appliance distribution with layer removal
US10528366B2 (en) * 2017-06-05 2020-01-07 International Business Machines Corporation Facilitating multi-inheritance within a single inheritance container-based environment
CN107248986A (zh) * 2017-06-08 2017-10-13 医惠科技有限公司 一种服务托管方法
CN111124596A (zh) * 2018-11-01 2020-05-08 千寻位置网络有限公司 基于容器的发布管理方法及其系统
CN109918911B (zh) * 2019-03-18 2020-11-03 北京升鑫网络科技有限公司 一种镜像安装包信息的扫描方法及设备
CN110336699A (zh) * 2019-07-09 2019-10-15 北京和利时智能技术有限公司 自动化部署网关系统的方法、装置及系统
CN110704156A (zh) * 2019-08-16 2020-01-17 北京奇艺世纪科技有限公司 一种Docker镜像构建方法及装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180302459A1 (en) * 2015-04-21 2018-10-18 Ubergrape Gmbh Systems and methods for integrating external resources from third-party services
CN106528224A (zh) * 2016-11-03 2017-03-22 腾讯科技（深圳）有限公司 一种Docker容器的内容更新方法、服务器及系统
US20180146069A1 (en) * 2016-11-18 2018-05-24 Sap Se Efficient application build/deployment for distributed container cloud platform
CN108268308A (zh) * 2018-01-22 2018-07-10 广州欧赛斯信息科技有限公司 一种基于容器平台的持续集成方法、系统及装置
CN110196728A (zh) * 2018-03-27 2019-09-03 腾讯科技（深圳）有限公司 镜像升级的容器处理方法和装置
US10528337B1 (en) * 2018-10-24 2020-01-07 International Business Machines Corporation Container image layer reordering
CN111654531A (zh) * 2020-05-22 2020-09-11 国云科技股份有限公司 一种基于容器的镜像更新发布方法及装置

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114047938B (zh) * 2022-01-11 2023-05-26 北京向量栈科技有限公司 一种构建镜像的方法、装置、设备及可读存储介质
CN114047938A (zh) * 2022-01-11 2022-02-15 北京云歌科技有限责任公司 一种构建镜像的方法、装置、设备及可读存储介质
CN114466028A (zh) * 2022-02-16 2022-05-10 京东科技信息技术有限公司 镜像同步方法、装置、设备及存储介质
CN114466028B (zh) * 2022-02-16 2024-05-17 京东科技信息技术有限公司 镜像同步方法、装置、设备及存储介质
CN115063146A (zh) * 2022-06-29 2022-09-16 支付宝(杭州)信息技术有限公司 保护数据隐私的风险评估方法、系统及装置
CN115292265A (zh) * 2022-07-05 2022-11-04 深圳市连用科技有限公司 跨网络的容器镜像文件自动导入的方法、设备及存储介质
WO2024050315A1 (en) * 2022-08-31 2024-03-07 Confluent, Inc. Docker image registry synchronization service
CN115766739A (zh) * 2022-10-14 2023-03-07 济南浪潮数据技术有限公司 一种容器镜像分发方法、装置、系统及其介质
CN116893834A (zh) * 2023-09-11 2023-10-17 中移(苏州)软件技术有限公司 负载更新方法、装置、系统、电子设备及可读存储介质
CN116893834B (zh) * 2023-09-11 2023-12-12 中移(苏州)软件技术有限公司 负载更新方法、装置、系统、电子设备及可读存储介质
CN117353922A (zh) * 2023-12-06 2024-01-05 南京中孚信息技术有限公司 离线状态下的容器镜像签名验证方法、系统、设备及介质
CN117353922B (zh) * 2023-12-06 2024-03-22 南京中孚信息技术有限公司 离线状态下的容器镜像签名验证方法、系统、设备及介质
CN117369953A (zh) * 2023-12-08 2024-01-09 中电云计算技术有限公司 镜像同步方法、装置、设备及存储介质
CN117369953B (zh) * 2023-12-08 2024-03-15 中电云计算技术有限公司 镜像同步方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN111654531A (zh) 2020-09-11
CN111654531B (zh) 2023-05-05

Similar Documents

Publication Publication Date Title
WO2021232845A1 (zh) 一种基于容器的镜像更新发布方法及装置
US20200371990A1 (en) Virtual file server
US10445517B1 (en) Protecting data in insecure cloud storage
JP5746312B2 (ja) 複製されたデータインスタンスのプロビジョニングおよび管理
US10887279B2 (en) Scalable cloud hosted metadata service
US20240179212A1 (en) Hosted file sync with stateless sync nodes
JP5716134B2 (ja) 実行中のプロセスをリモートに更新するための方法および装置
EP2479697B1 (en) System and method for netbackup data decryption in a high latency low bandwidth environment
WO2017166513A1 (zh) 基于容器技术的应用服务无缝迁移方法和系统
US10142417B2 (en) System and method for managing heterogeneous data for cloud computing applications
US20190266276A1 (en) Instance data replication
CA2923068A1 (en) Method and system for metadata synchronization
CN105677507B (zh) 一种企业数据云备份系统及方法
KR101008554B1 (ko) 클라우드 방식의 파일 복사 및 광역 통신망을 통한 디스크 복제 시스템 및 그 방법
JP2015512071A (ja) クラウド・ベースの分散型データ・システム
US20140317061A1 (en) System and method for distributed interaction media storage and retrieval
Baron et al. AWS certified solutions architect official study guide: associate exam
WO2023103190A1 (zh) 一种多级联动人工智能平台样本模型透明共享装置
US20180189862A1 (en) Digital data commerce system and methods with digital media object to cloud redirection
WO2019045837A1 (en) REMOTE APPLICATION CONFIGURATION ON A NETWORK STORAGE SERVER
US20200329012A1 (en) System and method for dedicated storage, through a secure internet connection, in a remote location
CN106649744B (zh) 日志记录方法及装置
US10713121B1 (en) Dynamic migration of a cloud based distributed file system metadata server
JP6435616B2 (ja) ストレージ装置、ストレージシステム、ストレージシステムの制御方法および制御プログラム
Moss et al. Integrating cloud computing and mobile applications: a comparative study based on icloud and sanscode

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21809457

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21809457

Country of ref document: EP

Kind code of ref document: A1