Container-based isolation processing method and relevant equipment

Abstract

The embodiment of the invention discloses a container-based isolation processing method and relevant equipment. The method in the embodiment comprises the steps that an operation instruction for isolation is received, wherein the operation instruction contains identifiers of target containers, and the target containers are at least one of multiple containers; target container instances of the target containers are determined according to the identifiers of the target containers; a checkpoint file of the target container instances is acquired; an execution engine used for running the target container instances is switched from a container execution engine to a virtual container execution engine; and state data of the target container instances is migrated to virtual containers according tothe checkpoint file to obtain target virtual container instances, and the target virtual container instances are run in the virtual container execution engine. The embodiment of the invention furthermore provides host equipment used for dynamically improving the isolation capability of the containers in the running process of the container instances.

Description

technical field [0001] The present application relates to the computer field, and in particular to a container-based isolation processing method and related equipment. Background technique [0002] Container technology is a technology that packages applications into separate containers for encapsulation. Container technology isolates each application and breaks the dependencies and connections between programs. That is to say, a huge service system With the support of container technology, it can be composed of containers in which many different applications reside. Container technology effectively divides the resources managed by a single operating system into isolated groups to better balance conflicting resource usage requirements between isolated groups. It is an operating system-level virtualization technology, due to its lightweight properties are widely used. However, since the container technology adopts the operating system isolation technology, such as Namespace,...

AI Technical Summary

Problems solved by technology

CGroup is Control Groups. The goal of CGroups is to manage system resources. With the support of Namespace, programs can be isolated into different containers, or application groups, and CGroups can be used to manage these containers. The CPU, memory, IO and other resources used are controlled. Through CGroup, real computer resources in the physical host can be accurately configured for each container isolated by Namespace. However, isolation through Namespace and CGroups is static isolation. That is to say, the application is isolated before the application is running. If the user's demand changes and the isolation of the application needs to be enhanced, it cannot be achieved. For example, container A fails in the same host device , during the running of container B, the user hopes to enhance the isolation of the application program (container instance) in the container to enhance the protection of the application program in container B. In this case, it cannot be realized through the existing container technology. How to dynamically improve the isolation capability of containers needs to be solved urgently

Images