Real-time container process isolation method

Abstract

The invention belongs to the technical field of computer system software, and particularly relates to a real-time container process isolation method, which comprises the following steps of: adding the same identification mark to processes in the same process namespace, so that the processes can be mutually visible in an operating system, and the processes can be mutually accessed; meanwhile, different identifiers are added to the processes of different process namespaces and used for identifying that the processes are invisible and inaccessible to each other in an operating system. On the premise that a process access mechanism of an original real-time operating system is not damaged, adaptive transformation and adaptation are carried out on an existing real-time container process, and the function of the same isolation degree capacity as the industry can be achieved. The method has great value for isolating the real-time container process of a computer system, and has certain reference significance in other fields under similar scenes.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer system software, and in particular relates to a real-time container process isolation method. Background Art

[0002] In the Linux operating system, a process is assigned a number to uniquely identify the process in its process namespace, namely the process ID number. Linux will identify the same process in different process namespaces with different process ID numbers. Processes in different process namespaces are invisible to each other, which is used to achieve the function of process isolation. In an embedded real-time operating system, a process is identified by its process address, not by its process ID. To achieve process isolation, the process mechanism needs to be redesigned. Summary of the invention

[0003] In view of this, the present invention provides a real-time container process isolation method, which manages the names of processes under the real-time container process namespace to identify the uniqueness of the real-time process in the operating system. By adding the same identification flag to processes in the same process namespace, it can be used to identify that such processes are mutually visible and accessible in the operating system. By adding different identification flags to processes in different process namespaces, it can be used to identify that such processes are mutually invisible and inaccessible in the operating system, thereby achieving the isolation function.

[0004] The technical solution of the present invention is:

[0005] A real-time container process isolation method, the real-time container process isolation method comprising:

[0006] Adding the same identification flag to processes in the same process namespace so that the processes are mutually visible in the operating system and the processes can access each other;

[0007] Different identification flags are added to processes in different process namespaces to indicate that such processes are invisible to and inaccessible to each other in the operating system.

[0008] Furthermore, the method of adding the identification mark is:

[0009] In each process namespace, add the prefix of the process namespace to the names of all processes.

[0010] Furthermore, when a container user views the process, only the name of the process is displayed.

[0011] Further, when the operating system accesses or operates the next real-time container, the operating system performs the following steps:

[0012] S101: The operating system obtains the currently running real-time container process, and then obtains the process namespace to which the real-time container process belongs;

[0013] S102: The operating system obtains the process namespace to which the real-time container process to be accessed belongs;

[0014] S103: Determine whether the real-time container process to be accessed belongs to the current process namespace. If so, the operating system performs access or operation on the real-time container process to be accessed. If not,

[0015] The operating system does not perform access or operations on real-time container processes that require access.

[0016] Beneficial effects of the present invention:

[0017] Without destroying the original real-time operating system's process access mechanism, the existing real-time container process can be adaptively modified and adapted to achieve the same isolation level as the industry. It is of great value to isolate the real-time container process of computer systems, and can be used as a reference in other fields in similar scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 This is a schematic diagram of container arrangement in a specific embodiment of the present invention;

[0020] Figure 2 This is an exemplary process in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0021] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0022] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0023] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0024] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0025] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0026] In one embodiment of the present invention, a real-time container process isolation method is proposed, and the real-time container process isolation method includes:

[0027] like Figure 1 As shown, the same identification flag is added to the processes in the same process namespace, so that the processes are mutually visible in the operating system and the processes can access each other;

[0028] At the same time, different identification flags are added to processes in different process namespaces to indicate that such processes are invisible to and inaccessible to each other in the operating system.

[0029] In this embodiment, in each process namespace, a prefix of the process namespace is added to the names of all processes.

[0030] In this embodiment, when a container user views the process, only the name of the process is displayed.

[0031] This embodiment is used to ensure the isolation of process data, and can uniquely identify the real-time container process in the real-time operating system and determine the process namespace to which the real-time container process belongs. It can also determine the visibility of different real-time container processes of the real-time operating system to other container real-time processes, as well as the specific processing flow of accessing the real-time container process.

[0032] Figure 1 The method for the operating system to identify the real-time container process in this embodiment is described. Figure 1 The process namespace 1 in contains two processes, namely process 1 and process 2. Process namespace 1 adds the prefix of process namespace 1 to the names of process 1 and process 2, that is, the names of process 1 and process 2 become process namespace 1+process 1 and process namespace 1+process 2 after adding the prefix. Figure 1 The process namespace 2 in contains three processes, namely process 1, process 2 and process 3. The process namespace 2 adds the prefix of process namespace 2 to the names of process 1, process 2 and process 3 respectively, that is, the names of process 1, process 2 and process 3 are changed to process namespace 2+process 1, process namespace 2+process 2 and process namespace 2+process 3 after adding the prefix.

[0033] In general operating systems, processes are globally unique. In container real-time operating systems, however, it is required that processes with the same name can exist in different process namespaces. If the above method is not used to identify processes, if process 1 exists in the first process namespace, the creation of process 1 with the same name in the second process namespace will fail, and processes with the same name cannot exist in different process namespaces. However, by using the above method to identify process 1, the names of processes 1 with the same name in the first process namespace and the second process namespace are process namespace 1+process 1 and process namespace 2+process 1 in their respective process namespaces, respectively. In this way, processes with the same name can exist in different process namespaces. The process namespace name + process name is the kernel layer name, which is globally unique. From the perspective of the container user, the process name does not contain the process namespace name prefix. For example, if the kernel layer name is process namespace 1+process 1, the process name from the perspective of the container user is process 1.

[0034] Figure 2 This article describes the example process of the operating system accessing a real-time container process. When the operating system accesses or operates another real-time container process, the operating system will first obtain the currently running real-time container process and then obtain the process namespace to which the real-time container process belongs. The second step is to obtain the process namespace to which the accessed real-time container process belongs. The third step is to obtain the real-time container process namespace. Figure 2 As described in "Determining whether the process belongs to the current process namespace", the process namespace to which the current real-time container process belongs is compared with the process namespace to which the accessed real-time container process belongs. If the process namespace to which the current real-time container process belongs is the same as the process namespace to which the accessed real-time container process belongs, it indicates that the current real-time container process and the accessed real-time container process belong to the same process namespace, the accessed process namespace and the current real-time container process are visible to each other, the operating system can operate the accessed real-time container process, and the access to the real-time container process is successful; if the process namespace to which the current real-time container process belongs is different from the process namespace to which the accessed real-time container process belongs, it indicates that the current real-time container process and the accessed real-time container process do not belong to the same process namespace, the accessed process namespace and the current real-time container process are not visible to each other, the operating system cannot operate the accessed real-time container process, and the access to the real-time container process fails.

[0035] This embodiment, without destroying the original real-time operating system process access mechanism, adaptively transforms and adapts the existing real-time container process, and can achieve the same isolation capability as the industry. It has great value for the isolation of computer system real-time container processes, and can have certain reference significance in other fields in similar scenarios.

[0036] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A real-time container process isolation method, characterized in that: The real-time container process isolation method comprises: Adding the same identification flag to processes in the same process namespace so that the processes are mutually visible in the operating system and the processes can access each other; Different identification flags are added to processes in different process namespaces to indicate that such processes are invisible to and inaccessible to each other in the operating system.

2. The real-time container process isolation method according to claim 1 is characterized in that: To add a logo mark: In each process namespace, add the prefix of the process namespace to the names of all processes.

3. The real-time container process isolation method according to claim 2 is characterized in that: When a container user views the process, only the name of the process is displayed.

4. The real-time container process isolation method according to claim 3 is characterized in that: When the operating system accesses or operates a live container, the operating system performs the following steps: S101: The operating system obtains the currently running real-time container process, and then obtains the process namespace to which the real-time container process belongs; S102: The operating system obtains the process namespace to which the real-time container process to be accessed belongs; S103: Determine whether the real-time container process to be accessed belongs to the current process namespace. If so, the operating system performs access or operation on the real-time container process to be accessed. If not, The operating system does not perform access or operations on real-time container processes that require access.

Images