A way to isolate the network under a docker swarm cluster

Abstract

The invention discloses a method for isolating a network under a docker swarm cluster, and relates to the technical fields of container technology, network technology and proxy principle. By binding an agent to each application container that needs to be monitored, the network requests of the container are forced to be forwarded through the agent. By establishing a dedicated network for the application and binding the agent program, all the requests of the application can be forwarded through the agent route, so that the agent can Record all the actions of the application; and we can control the agent program to control access rights. By setting the application's exclusive network, it ensures that all activities of the application are limited to the exclusive network, and all operations on the public network are forwarded through the agent program. , which effectively controls the security of the application and avoids some uncontrollable phenomena. Record all operations of each application on the public network. Later, you can analyze the dependence of each application on the public network and its impact on the public network through big data.

Description

technical field [0001] The invention relates to the fields of containers, algorithms and network agents, in particular to a method for isolating a network under a docker swarm cluster. Background technique [0002] In the current swarm cluster, in general, all applications are in a network, and some applications that we need to do special control (such as network calls, permission control, intelligent routing) cannot be effectively controlled. In the case of relying on many additional components, some of the above-mentioned functions can be implemented, but for the application itself, too many dependent components will increase its own burden, and many components will invade the code, which is not friendly. The present invention achieves the effect of monitoring by binding the corresponding agent to run in the exclusive network together with the agent during the process of installing the application, and the agent controls the application. SUMMARY OF THE INVENTION [0003...

AI Technical Summary

Problems solved by technology

[0002] In the current swarm cluster, under normal circumstances, all applications are in the same network, and some applications that we need to do special control (such as network calls, permission control, intelligent routing) cannot be effectively controlled

In the case of relying on many additional components, some of the functions mentioned above can be realized, but for the application itself, relying on too many components will increase its own burden, and many components will invade the code, which is extremely unfriendly

Images