Secure container operation, image data download method, device and storage medium

Abstract

Embodiments of the present application provide a method, device, and storage medium for running a secure container and downloading image data. In this embodiment, the container image data required for the secure container is independently managed by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the physical machine can, on the one hand, create a secure isolation environment required for the operation of different container instances, and on the other hand, the container image data required to create the container instance is obtained from the corresponding sandbox, thereby achieving data isolation between different container instances. Thus, when multiple sandboxes on a physical machine run different container instances, data security risks caused by different container instances sharing image data can be avoided.

Description

Technical Field

[0001] The present application relates to the field of virtualization technology, and in particular to a method, device and storage medium for secure container operation and image data downloading. Background Art

[0002] Nowadays, container technology has been widely used as a lightweight virtualization technology. Containers are deployed on the kernel of a physical machine. When multiple containers are deployed on the same kernel of a physical machine, multiple containers will affect each other. At the same time, when untrusted code runs in a container, the physical machine is vulnerable to attacks. To improve container security, secure container instances can be run in a restricted security environment to ensure the security of the physical machine.

[0003] Currently, there is a secure container solution, namely Kata Containers (a technology that runs containers in an isolated environment to achieve secure containers). Kata Containers uses KVM (Kernel-based Virtual Machine) technology to run an independent kernel for each container instance on a physical machine to ensure the security and reliability of the container instance. However, this solution still cannot guarantee the security of container data. Therefore, a solution needs to be proposed. Summary of the invention

[0004] Multiple aspects of the present application provide a secure container operation, image data download method, device and storage medium to achieve data isolation between different container instances and further improve the security of container data.

[0005] An embodiment of the present application provides a secure container operation method, including: a container runtime component on a physical machine responds to a request to create a container, and sends an image data acquisition request to a sandbox corresponding to the container on the physical machine; receives container image data returned by the sandbox according to the image data acquisition request; generates startup data of a container instance according to the container image data and container operation parameters; and sends the startup data to the sandbox, so that the sandbox runs the container instance corresponding to the container according to the startup data.

[0006] An embodiment of the present application also provides a secure container operation method, including: a sandbox in a physical machine receives an image data acquisition request sent by a container runtime component in the physical machine; sends the managed container image data to the container runtime component; receives startup data of the container instance returned by the container runtime component based on the container image data; and starts running the container instance based on the startup data.

[0007] An embodiment of the present application also provides a secure container operation method, including: in response to a request to create a container, sending an image data acquisition request to a sandbox corresponding to the container through a container runtime component; returning the container image data corresponding to the container to the container runtime component through the sandbox; generating startup data of a container instance according to the container image data and container operation parameters through the container runtime component; sending the startup data to the sandbox through the container runtime component; and running the container instance corresponding to the container according to the startup data through the sandbox.

[0008] An embodiment of the present application also provides a method for downloading image data, which includes: receiving an image data download instruction through a container runtime component, the image data download instruction carrying a sandbox identifier and an image identifier; routing the image data download instruction to a sandbox corresponding to the sandbox identifier through the container runtime component; and through the sandbox, requesting a container repository to download and save the container image data corresponding to the image identifier according to the image data download instruction.

[0009] In the secure container operation method provided in the embodiment of the present application, the container image data required by the secure container is independently managed by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the physical machine can, on the one hand, create a secure isolation environment required for the operation of different container instances. On the other hand, the container image data required to create the container instance is obtained from the corresponding sandbox, thereby achieving data isolation between different container instances. Thereby, the data security risks caused by different container instances sharing image data when multiple sandboxes on the physical machine run different container instances can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0011] Figure 1 A schematic diagram of sharing container image data among multiple container instances in a secure container solution;

[0012] Figure 2 A flowchart of a secure container operation method provided for an exemplary embodiment of the present application;

[0013] Figure 3 A schematic diagram of isolating container image data provided by an exemplary embodiment of the present application;

[0014] Figure 4 A schematic diagram of a flow chart of a secure container operation method provided for another exemplary embodiment of the present application;

[0015] Figure 5 A schematic diagram of downloading, saving and managing container image data by different sandboxes provided in an exemplary embodiment of the present application;

[0016] Figure 6 A schematic diagram of a flow chart of a secure container operation method provided by an exemplary embodiment of the present application executed on the container runtime component side;

[0017] Figure 7 A schematic diagram of a flow chart of a secure container operation method provided by another exemplary embodiment of the present application executed on the container runtime component side;

[0018] Figure 8 A schematic diagram of a flow chart of a mirror data downloading method provided by an exemplary embodiment of the present application;

[0019] Fig. 9 A schematic diagram of the structure of a computer device provided for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] As a lightweight virtualization technology, container technology has been widely used. Containers are deployed on the kernel of a physical machine. When multiple containers are deployed on the same kernel of a physical machine, multiple containers will affect each other. At the same time, when untrusted code runs in a container, the physical machine is vulnerable to attacks. To improve container security, secure container instances can be run in a restricted security environment to ensure the security of the physical machine.

[0022] Currently, there is a secure container solution, namely Kata Containers (Kata Containers, a technology that uses a virtual kernel to run containers in an isolated environment to achieve secure containers). Kata Containers uses KVM (Kernel-based Virtual Machine) technology to run an independent kernel for each container instance on a physical machine to ensure the security and reliability of the container instance. Among them, KVM is a virtualization technology under Linux (an operating system) that can transform Linux into a virtual machine monitoring program, enabling the host computer to run multiple isolated virtual environments.

[0023] The Kata Containers solution focuses on computing security. The code in the container image runs in an independent kernel created by KVM, but the data of the container instance on the same physical machine is still in the kernel of the physical machine and is not isolated. That is, the container data (such as container image data, container data volume, etc.) is still in a shared state. This solution is suitable for private cloud scenarios, where the data on the physical machine kernel belongs to the same user, so the security risk is low. However, in public cloud scenarios, different container instances running on the same physical machine belong to different users. When the container data of different container instances is shared on the kernel of the physical machine, there is a certain data security risk.

[0024] Take container image data as an example. Container image data uses layering technology to package the files needed to create a container. Each layer of container image data is called a layer, and a container image consists of several layers. Each layer can be reused, and different container images can reference the same layer. In the public cloud scenario, there is a risk that one user's container image uses another user's container image.

[0025] For example, when the container runtime component containerd is connected to the container management platform Kubernetes through the CRI (Container Runtime Interface), CRI includes two modules, namely the imageService module and the runtimeService module. Among them, imageService is mainly used to implement operations related to container images, such as query, download, and delete operations of images. RuntimeService is mainly used to implement operations related to container runtime components, including the creation, deletion, query, operation and maintenance of container instances.

[0026] In the implementation of imageService, the images of all containers on the physical machine are stored in the same management space in containerd, which leads to the situation that different tenants share all container image layers in a multi-tenant situation. Figure 1 As shown, the container image storage space of containerd stores the image data of container image A and container image B: layer1, layer2, layer3, layer4. When creating a container instance for user 1, layer1, layer2, layer3 in containerd can be loaded into the memory of the first sandbox 1 by file mapping to obtain container image A. When creating a container instance for user 2, layer1, layer2, layer4 in containerd can be loaded into the memory of the second sandbox 2 by file mapping to obtain container image B. Among them, layer1 and layer2 are shared by user 1 and user 2, which poses certain security risks.

[0027] In view of the above technical problems, a solution is provided in some embodiments of the present application. The technical solutions provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0028] Figure 2 A flowchart of a secure container operation method provided by an exemplary embodiment of the present application is shown in FIG. Figure 2 As shown, including:

[0029] Step 201: In response to a request to create a container, a request for obtaining image data is sent to a sandbox corresponding to the container through a container runtime component.

[0030] Step 202: Return the container image data corresponding to the container to the container runtime component through the sandbox.

[0031] Step 203: Generate startup data of the container instance according to the container image data and container operation parameters through the container runtime component.

[0032] Step 204: Send the startup data to the sandbox through the container runtime component.

[0033] Step 205: Run the container instance corresponding to the container according to the startup data through the sandbox.

[0034] The execution subject of this embodiment can be any physical machine, such as a host or a server. If implemented as a server, the server can be implemented as a conventional server device or a cloud server device or an elastic cloud server instance. The kernel of the physical machine runs a container runtime component (containerd), which is used to create containers based on image data, run containers, and manage container instances.

[0035] To provide a secure container operating environment, one or more sandboxes (Sandbox), or sandbox, are running on the physical machine. The container runtime component can create, run and manage container instances through the sandbox. When multiple sandboxes are running on a physical machine, an independent container image management system can be deployed for each sandbox, and the container image management system can be located inside the sandbox. Among them, the container image management system includes at least: a storage management unit and an operation management unit. In this embodiment, the storage management unit in the sandbox is used to download, save and manage container image data (image), and the behavior management unit is used to run container instances based on container image data. For each sandbox, its corresponding container image data is managed by its corresponding storage management unit, which can achieve data isolation between different sandboxes and improve data security.

[0036] On the basis of deploying an independent container image management system in the sandbox, after receiving a request to create a container, the container runtime component can send a request to obtain image data to the sandbox corresponding to the container. The request to create a container can be initiated by an upper-layer application of the container runtime component, which can include but is not limited to kubelet (the component responsible for creating and starting containers in the container management platform Kubernetes), docker (container engine), etc.

[0037] Among them, the request to create a container is used to instruct to create an instance of the container in a sandbox on the physical machine. In some embodiments, the request to create a container may carry the identifier of the sandbox corresponding to the container, so that the container runtime component obtains the data required to create the container instance from the sandbox corresponding to the container. In other embodiments, the container runtime component pre-stores the correspondence between the container and the sandbox. When receiving a request to create a container, the container runtime component can determine the sandbox corresponding to the container based on the correspondence, and send a request to obtain the image data to the sandbox. This embodiment includes but is not limited to this.

[0038] The image data acquisition request may be received by a storage management unit in the sandbox. The storage management unit may determine the container image data from pre-saved data and return the container image data to the container runtime component.

[0039] After receiving the container image data, the container runtime component can generate startup data of the container instance according to the container image data and the container operation parameters, and send the startup data to the sandbox. The container operation parameters may include: environment variables, command line parameters, privilege flags, etc. required to create the container, and this embodiment includes but is not limited to this.

[0040] After receiving the startup data, the sandbox can run the startup data through the operation management component to create a corresponding container instance. Among them, the container instance is a carrier formed by the computing, storage, network and other resources required for the container to run.

[0041] The following will provide further explanation with reference to specific examples.

[0042] like Figure 3 As shown, a first sandbox 1 and a second sandbox 2 are deployed on the physical machine. The container image storage of the first sandbox 1 stores container image data layer1, layer2, and layer3 of container image A; the container image storage of the second sandbox 2 stores container image data layer1, layer2, and layer4 of container image B. Image data layer1 and layer2 with the same data identifier are isolated and stored in different sandboxes. When containerd receives a request to create a container of user 1, it can send an image data acquisition request to the first sandbox 1. The first sandbox 1 can return container image data A to containerd according to the image data acquisition request. Containerd can generate startup data of the container instance of user 1 according to container image data A and container operation parameters, and send the startup data to the first sandbox 1. After receiving the startup data, the first sandbox 1 can create a container instance of user 1 according to the startup data. Similarly, when containerd receives an operation to create a container of user 2, it can send an image data acquisition request to the second sandbox 2. The second sandbox 2 may return the container image data B to containerd according to the image data acquisition request. Containerd may generate the startup data of the container instance of user 1 according to the container image data B and the container operation parameters, and send the startup data to the second sandbox 2. After receiving the startup data, the second sandbox 2 may create the container instance of user 2 according to the startup data.

[0043] In this embodiment, the container image data required for the secure container is independently managed by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the physical machine can, on the one hand, create a secure isolation environment required for the operation of different container instances. On the other hand, the container image data required to create a container instance is obtained from the corresponding sandbox, thereby achieving data isolation between different container instances. Thereby, the data security risks caused by different container instances sharing image data when multiple sandboxes on the physical machine run different container instances can be avoided.

[0044] In the above and following embodiments of the present application, each sandbox on the physical machine can run in an independent virtual core (virtual central processing unit, vcpu) on the physical machine, and the sandbox can be implemented based on Kata technology. When multiple sandboxes are deployed on a physical machine, the multiple sandboxes run on different virtual cores respectively, thereby further reducing the possibility of mutual interference between container instances running in different sandboxes and improving the security of the operating environment of the container instance.

[0045] Of course, in some other optional embodiments, the sandbox may also be directly run in the kernel of the physical machine. When multiple sandboxes are deployed on the physical machine, the multiple sandboxes may be simultaneously deployed on the same kernel of the physical machine, which is not limited in this embodiment.

[0046] Figure 4 A flowchart of a secure container operation method provided by another exemplary embodiment of the present application is shown in FIG. Figure 4 As shown, the method includes:

[0047] Step 401: Receive an image data download instruction through a container runtime component, where the image data download instruction carries a sandbox identifier and an image identifier.

[0048] Step 402: Routing the image data download instruction to the sandbox corresponding to the sandbox identifier through the container runtime component.

[0049] Step 403: Through the sandbox, according to the image data download instruction, request to download and save the container image data corresponding to the image identifier from the container repository.

[0050] Step 404: In response to the request to create a container, a request to obtain image data is sent to the sandbox through the container runtime component.

[0051] Step 405: Return the container image data corresponding to the container to the container runtime component through the sandbox.

[0052] Step 406: Generate startup data of the container instance according to the container image data and container operation parameters through the container runtime component.

[0053] Step 407: Send the startup data to the sandbox through the container runtime component.

[0054] Step 408: Run the container instance corresponding to the container according to the startup data through the sandbox.

[0055] In this embodiment, the optional implementation methods of steps 404 to 408 can refer to the description of the previous embodiment and are not described in detail here.

[0056] In step 401, when a container instance needs to be created according to user needs or functional requirements, the container management and control platform can send an image data download instruction to the physical machine. The physical machine can receive the image data download instruction through the container runtime component, and the image data download instruction carries the sandbox identifier and the image identifier. Among them, the sandbox identifier can be the name, number, label or other ID (Identity) information of the sandbox specified for use. The image identifier can be the name of the image data required to create the container or the image ID.

[0057] Among them, at least one sandbox can be deployed on the physical machine. When deploying the sandbox, the container runtime component can obtain the correspondence between the at least one sandbox and the corresponding sandbox identifier. After receiving the image data download instruction, the container runtime can determine the sandbox used to execute the image download instruction according to the sandbox identifier and the aforementioned correspondence, and route the image data download instruction to the corresponding sandbox.

[0058] After receiving the image data download instruction, the sandbox can specify to request to download the container image data of the container instance from the container repository (e.g., Registry). Among them, Registry is a container repository that exposes the metadata and files of the image for download through HTTP (Hyper Text Transfer Protocol). After downloading the container image data, the sandbox can save the downloaded container image data in the storage space within the sandbox to achieve secure isolation from other data outside the sandbox.

[0059] Based on the records of the aforementioned embodiments, it can be known that an independent container image management system is deployed in the sandbox, and the container image management system includes at least: a storage management unit and an operation management unit. In this embodiment, the sandbox can receive the image data download instruction routed by the container runtime component based on the storage management unit, and perform the image data download operation according to the image data download instruction. After downloading the image data, the storage management unit can save, manage, query and other operations on the image data. When the container runtime component sends an image data acquisition request to the storage management unit, the storage management unit can return the container image data to the container runtime component for generating the startup data of the container instance.

[0060] The following will provide an illustrative description with reference to specific examples.

[0061] like Figure 5 As shown, a first sandbox 1 and a second sandbox 2 are deployed on the physical machine. The first sandbox 1 corresponds to the container instance of user 1, and the second sandbox 2 corresponds to the container instance of user 2. Assume that there are user 1 and user 2 in a shared cloud environment.

[0062] When there is a need to create a container for user 1, the container management and control platform can send an image data download instruction to containerd on the physical machine. Containerd receives the image data download instruction, which carries the sandbox identifier ID1 and the image identifier ID2. Sandbox identifier ID1 is used to identify the first sandbox 1, and containerd can route the image data download instruction to the first sandbox 1. After receiving the image data download instruction, the first sandbox 1 can request the container repository to download the container image data A corresponding to the image identifier ID2 through the storage management unit in the first sandbox 1, and save the container image data A.

[0063] After downloading the image data, the container management and control platform can send a container creation request to containerd. After receiving the container creation request, containerd can send an image data acquisition request to the first sandbox 1. The first sandbox 1 can return container image data A to containerd according to the image data acquisition request. Containerd can generate startup data for the container instance of user 1 according to the container image data A and the container operation parameters, and send the startup data to the first sandbox 1. After receiving the startup data, the first sandbox 1 can create a container instance of user 1 according to the startup data.

[0064] Similarly, when there is a need to create a container for user 2, the container management and control platform can send an image data download instruction to containerd on the physical machine. Containerd receives the image data download instruction, which carries the sandbox identifier ID3 and the image identifier ID4. Sandbox identifier ID3 is used to identify the second sandbox 2, and containerd can route the image data download instruction to the second sandbox 2. After receiving the image data download instruction, the second sandbox 2 can request the container repository to download the container image data B corresponding to the image identifier ID4 through the storage management unit in the second sandbox 2, and save the container image data B.

[0065] After downloading the image data, the container management and control platform can send a container creation request to containerd. After receiving the container creation request, containerd can send an image data acquisition request to the second sandbox 2. The second sandbox 2 can return the container image data B to containerd according to the image data acquisition request. Containerd can generate the startup data of the container instance of user 2 according to the container image data B and the container operation parameters, and send the startup data to the second sandbox 2. After receiving the startup data, the second sandbox 2 can create a container instance of user 2 according to the startup data.

[0066] In this embodiment, when the container runtime component receives an image data download instruction, it does not directly download the container image data from the container repository, but routes the image data download instruction to the corresponding sandbox, so that the sandbox can download, save and manage the container image data. Based on this implementation method, the container image data of different container instances can be avoided from being in a shared state, which can reduce the security risk of the container image data. At the same time, in this solution, the isolation of the container operating environment and the isolation of the container image data are achieved based on the sandbox, which solves the multi-tenant data security problem in the public cloud environment.

[0067] In some optional embodiments, after the sandbox requests the container repository to download the container image data of the container instance, it can also generate management metadata for the container image data and save the management metadata in a designated storage space in the sandbox. The management metadata is used to record information such as the content, identification, and quantity of the image data. Storing the management metadata of the image data in the sandbox achieves secure isolation of the management metadata, further improves data security between different container instances, and is conducive to meeting multi-tenant data security requirements in public cloud scenarios.

[0068] Figure 6 A flowchart of a secure container operation method provided by an exemplary embodiment of the present application executed on the container runtime component side is shown in FIG. Figure 6As shown, when the method is executed on the container runtime component side, it mainly includes the following steps:

[0069] Step 601: A container runtime component on a physical machine responds to a request to create a container and sends a request to obtain image data to a sandbox corresponding to the container on the physical machine.

[0070] Step 602: The container runtime component receives the container image data returned by the sandbox according to the image data acquisition request.

[0071] Step 603: The container runtime component generates startup data for the container instance according to the container image data and the container operation parameters.

[0072] Step 604: The container runtime component sends the startup data to the sandbox, so that the sandbox runs the container instance corresponding to the container according to the startup data.

[0073] Further optionally, before sending a request for obtaining image data to the sandbox corresponding to the container on the physical machine, the method also includes: the container runtime component receiving an image data download instruction, the image data download instruction carrying a sandbox identifier and an image identifier; routing the image data download instruction to the sandbox corresponding to the sandbox identifier, so that the sandbox downloads and saves the container image data corresponding to the image identifier.

[0074] In this embodiment, the container image data required for the secure container is independently managed by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the physical machine can, on the one hand, create a secure isolation environment required for the operation of different container instances. On the other hand, the container image data required to create a container instance is obtained from the corresponding sandbox, thereby achieving data isolation between different container instances. Thereby, the data security risks caused by different container instances sharing image data when multiple sandboxes on the physical machine run different container instances can be avoided.

[0075] Figure 7 A schematic diagram of a flow chart of a secure container operation method provided by an exemplary embodiment of the present application executed on the sandbox side, as shown in FIG. Figure 7 As shown, when the method is executed on the sandbox side, it mainly includes the following steps:

[0076] Step 701: A sandbox in a physical machine receives an image data acquisition request sent by a container runtime component in the physical machine.

[0077] Step 702: The sandbox sends the managed container image data to the container runtime component.

[0078] Step 703: The sandbox receives startup data of the container instance returned by the container runtime component according to the container image data.

[0079] Step 704: The sandbox starts running the container instance according to the startup data.

[0080] Among them, the sandbox is deployed on a physical machine. When multiple sandboxes are deployed on the physical machine, the multiple sandboxes correspond to independent container image management systems respectively. The various steps performed by the sandbox in this embodiment can be implemented based on the container image management system corresponding to the sandbox. For example, the sandbox can receive the image data acquisition request sent by the container runtime component in the physical machine through the corresponding container image management system. The sandbox can send the managed container image data to the container runtime component through the corresponding container image management system; the sandbox can receive the startup data of the container instance returned by the container runtime component according to the container image data through the corresponding container image management system.

[0081] Further optionally, before sending the managed container image data to the container runtime component, it also includes: the sandbox receives the image data download instruction sent by the container runtime component; the image data download instruction carries the image identifier; requests the container repository to download the container image data corresponding to the image identifier; and saves the container image data in the designated storage space in the sandbox. In some optional embodiments, the sandbox can receive the image data download instruction sent by the container runtime component through the corresponding container image management system; the image data download instruction carries the image identifier. The sandbox can request the container repository to download the container image data corresponding to the image identifier through the corresponding container image management system; the sandbox can save the container image data in the designated storage space in the sandbox through the corresponding container image management system.

[0082] Further optionally, after the sandbox requests the container repository to download the container image data corresponding to the image identifier, it also includes: generating management metadata for the container image data; and storing the management metadata in the designated storage space in the sandbox. In some embodiments, the operation of generating management metadata for the container image data can be implemented by the container image management system corresponding to the sandbox. After the container image management system obtains the management metadata for the container image data, it can store the management metadata in the designated storage space in the sandbox, which will not be described in detail.

[0083] Further optionally, the sandbox runs in the kernel of the physical machine; or, the sandbox runs in an independent virtual kernel on the physical machine.

[0084] In this embodiment, the container image data required for the secure container is independently managed by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the physical machine can, on the one hand, create a secure isolation environment required for the operation of different container instances. On the other hand, the container image data required to create a container instance is obtained from the corresponding sandbox, thereby achieving data isolation between different container instances. Thereby, the data security risks caused by different container instances sharing image data when multiple sandboxes on the physical machine run different container instances can be avoided.

[0085] In addition to the secure container operation method provided in the aforementioned embodiment, the embodiment of the present application also provides a method for downloading image data. Figure 8 A flowchart of a mirror data download method provided by an exemplary embodiment of the present application is shown in FIG. Figure 6 As shown, the method includes:

[0086] Step 801: Receive an image data download instruction through a container runtime component, where the image data download instruction carries a sandbox identifier and an image identifier.

[0087] Step 802: Routing the image data download instruction to the sandbox corresponding to the sandbox identifier through the container runtime component.

[0088] Step 803: Through the sandbox, according to the image data download instruction, request to download and save the container image data corresponding to the image identifier from the container repository.

[0089] Among them, the sandbox is deployed on a physical machine. When multiple sandboxes are deployed on a physical machine, the multiple sandboxes correspond to independent container image management systems.

[0090] Based on this, in some embodiments, through the sandbox, according to the image data download instruction, when requesting to download and save the container image data corresponding to the image identifier from the container repository, the container image management system in the sandbox can be used to request to download and save the container image data corresponding to the image identifier from the container repository according to the image data download instruction.

[0091] Further optionally, after the sandbox requests the container repository to download the container image data corresponding to the image identifier, it also includes: generating management metadata for the container image data; and storing the management metadata in the designated storage space in the sandbox. In some embodiments, the operation of generating management metadata for the container image data can be implemented by the container image management system corresponding to the sandbox. After the container image management system obtains the management metadata for the container image data, it can store the management metadata in the designated storage space in the sandbox, which will not be described in detail.

[0092] In this embodiment, when the container runtime component receives an image data download instruction, it does not directly download the container image data from the container repository, but routes the image data download instruction to the corresponding sandbox, so that the sandbox can download, save and manage the container image data. Based on this implementation method, the container image data of different container instances can be avoided from being in a shared state, which can reduce the security risk of the container image data. At the same time, in this solution, the isolation of the container operating environment and the isolation of the container image data are achieved based on the sandbox, which solves the multi-tenant data security problem in the public cloud environment.

[0093] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 301 to 304 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on.

[0094] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations appearing in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel, and the sequence numbers of the operations, such as 301, 302, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel.

[0095] It should be noted that the descriptions such as “first” and “second” in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit “first” and “second” to different types.

[0096] Fig. 9 The schematic diagram of the structure of a computer device provided by an exemplary embodiment of the present application is illustrated, and the computer device can be used to execute the container operation method and the image data download method provided by the aforementioned embodiment. In different application scenarios, the time limit form of the computer device is different. For example, the computer device can be implemented as a conventional server or a cloud server, which is not limited in this embodiment.

[0097] like Fig. 9 As shown, the computer device includes: a memory 901 , a processor 902 , and a communication component 903 .

[0098] The memory 901 is used to store computer programs and can be configured to store various other data to support operations on the computer device. Examples of such data include instructions for any application or method operating on the computer device, contact data, phone book data, messages, pictures, videos, etc.

[0099] Among them, the memory 901 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0100] The processor 902 is coupled to the memory 901 and is used to execute the computer program in the memory 901 to perform the specified method steps.

[0101] In some embodiments, the processor 902 may execute the following steps in a secure container operation method: responding to a request to create a container through a container runtime component in a computer, sending an image data acquisition request to a sandbox corresponding to the container on the computer; receiving container image data returned by the sandbox according to the image data acquisition request; generating startup data for a container instance based on the container image data and container operation parameters; and sending the startup data to the sandbox so that the sandbox runs the container instance corresponding to the container according to the startup data.

[0102] Further optionally, when receiving the container image data returned by the sandbox according to the image data acquisition request, the processor 902 may be specifically configured to: receive the container image data returned by the container image management system corresponding to the sandbox according to the image data acquisition request.

[0103] Further optionally, before sending an image data acquisition request to the sandbox corresponding to the container on the computer, the processor 902 is also used to: receive an image data download instruction through the container runtime component, the image data download instruction carrying a sandbox identifier and an image identifier; route the image data download instruction to the sandbox corresponding to the sandbox identifier, so that the sandbox downloads and saves the container image data corresponding to the image identifier.

[0104] In other embodiments, the processor 902 may execute the following steps in the secure container operation method: receiving an image data acquisition request sent by a container runtime component in the computer through a sandbox in the computer; sending the managed container image data to the container runtime component; receiving startup data of the container instance returned by the container runtime component based on the container image data; and starting and running the container instance based on the startup data.

[0105] Further optionally, before sending the managed container image data to the container runtime component, the processor 902 is also used for: the sandbox receives the image data download instruction sent by the container runtime component; the image data download instruction carries the image identifier; requests the container repository to download the container image data corresponding to the image identifier; and saves the container image data in the designated storage space in the sandbox.

[0106] Further optionally, after requesting to download the container image data corresponding to the image identifier from the container repository, the processor 902 is further configured to: generate management metadata for the container image data; and store the management metadata in the designated storage space in the sandbox.

[0107] Further optionally, the sandbox runs in the kernel of the computer; or, the sandbox runs in an independent virtual kernel on the computer.

[0108] In some further embodiments, the processor 902 may execute the following steps in the secure container operation method: in response to a request to create a container, sending an image data acquisition request to a sandbox corresponding to the container through a container runtime component; returning the container image data corresponding to the container to the container runtime component through the sandbox; generating startup data of a container instance according to the container image data and container operation parameters through the container runtime component; sending the startup data to the sandbox through the container runtime component; and running the container instance corresponding to the container according to the startup data through the sandbox.

[0109] Further optionally, before returning the container image data corresponding to the container to the container runtime component through the sandbox, the processor 902 is also used to: receive an image data download instruction through the container runtime component, the image data download instruction carrying a sandbox identifier and an image identifier; route the image data download instruction to the sandbox corresponding to the sandbox identifier through the container runtime component; and request the container repository to download and save the container image data corresponding to the image identifier through the sandbox according to the image data download instruction.

[0110] In this embodiment, the container image data required for the secure container is managed independently by the sandbox where the secure container is located. When there is a need to create a container instance, the container runtime component can obtain the container image data from the sandbox and generate the startup data of the container instance based on the container image data. After sending the startup data to the sandbox, the sandbox can create a container based on the startup data. In this embodiment, the sandbox deployed on the computer can, on the one hand, create a secure isolation environment required for the operation of different container instances. On the other hand, the container image data required to create a container instance is obtained from the corresponding sandbox, thereby isolating different container instances from each other in terms of data. Thereby, the data security risks caused by different container instances sharing image data when multiple sandboxes on the computer run different container instances can be avoided.

[0111] In some further embodiments, the processor 902 may execute the following steps in the image data downloading method: receiving an image data download instruction through a container runtime component, the image data download instruction carrying a sandbox identifier and an image identifier; routing the image data download instruction to a sandbox corresponding to the sandbox identifier through the container runtime component; and through the sandbox, requesting a container repository to download and save the container image data corresponding to the image identifier according to the image data download instruction.

[0112] Further optionally, when the processor 902 requests the container repository to download and save the container image data corresponding to the image identifier through the sandbox according to the image data download instruction, it is specifically used to: request the container repository to download and save the container image data corresponding to the image identifier through the container image management system in the sandbox according to the image data download instruction.

[0113] In this embodiment, when the container runtime component receives an image data download instruction, it does not directly download the container image data from the container repository, but routes the image data download instruction to the corresponding sandbox, so that the sandbox can download, save and manage the container image data. Based on this implementation method, the container image data of different container instances can be avoided from being in a shared state, which can reduce the security risk of the container image data. At the same time, in this solution, the isolation of the container operating environment and the isolation of the container image data are achieved based on the sandbox, which solves the multi-tenant data security problem in the public cloud environment.

[0114] Further, if Fig. 9 As shown, the computer device also includes: a power supply component 904 and other components. Fig. 9 Only some components are shown schematically, and it does not mean that the computer equipment only includes Fig. 9 Components shown.

[0115] Among them, the communication component 903 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G or 5G, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can be implemented based on near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0116] The power supply component 904 provides power to various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply component is located.

[0117] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be executed by the server in the above method embodiment.

[0118] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0124] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0126] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A secure container operation method, applied to a container runtime component in a physical machine, wherein: include: The container runtime component on the physical machine responds to the request to create a container and sends a request to obtain image data to the sandbox corresponding to the container on the physical machine; Receiving container image data returned by the sandbox according to the image data acquisition request, wherein the container image data is downloaded by the sandbox from a container repository according to an image data download instruction, and the image data download instruction is routed to the sandbox by the container runtime component; Generate startup data of the container instance according to the container image data and the container running parameters; The startup data is sent to the sandbox, so that the sandbox runs the container instance corresponding to the container according to the startup data.

2. The method according to claim 1, wherein: Before sending the image data acquisition request to the sandbox corresponding to the container on the physical machine, the method further includes: The container runtime component receives an image data download instruction, where the image data download instruction carries a sandbox identifier and an image identifier; The image data download instruction is routed to the sandbox corresponding to the sandbox identifier, so that the sandbox downloads and saves the container image data corresponding to the image identifier.

3. The method according to claim 1, wherein: Receiving the container image data returned by the sandbox according to the image data acquisition request includes: Receive the container image data returned by the container image management system corresponding to the sandbox according to the image data acquisition request.

4. A secure container operation method, applied to a sandbox in a physical machine, wherein: include: The sandbox in the physical machine receives an image data acquisition request sent by a container runtime component in the physical machine; Sending managed container image data to the container runtime component, the container image data is downloaded by the sandbox from the container repository according to the image data download instruction, and the image data download instruction is routed by the container runtime component to the sandbox; Receive startup data of the container instance returned by the container runtime component according to the container image data; The container instance is started and run according to the startup data.

5. The method according to claim 4, wherein: Before sending the managed container image data to the container runtime component, it also includes: The sandbox receives an image data download instruction sent by the container runtime component; the image data download instruction carries an image identifier; Requesting a container repository to download the container image data corresponding to the image identifier; The container image data is stored in a designated storage space in the sandbox.

6. The method according to claim 5, wherein: After requesting to download the container image data corresponding to the image identifier from the container repository, the method further includes: Generate management metadata for the container image data; The management metadata is stored in the designated storage space in the sandbox.

7. The method according to any one of claims 4 to 6, wherein: The sandbox runs in the kernel of the physical machine; or, the sandbox runs in an independent virtual kernel on the physical machine.

8. A secure container operation method, wherein: include: In response to a request to create a container, a request to obtain image data is sent to a sandbox corresponding to the container through a container runtime component; Returning the container image data corresponding to the container to the container runtime component through the sandbox, the container image data being downloaded by the sandbox from the container repository according to the image data download instruction, and the image data download instruction being routed by the container runtime component to the sandbox; Generate startup data of a container instance according to the container image data and container operation parameters through the container runtime component; Sending the startup data to the sandbox via the container runtime component; The container instance corresponding to the container is run through the sandbox according to the startup data.

9. The method according to claim 8, wherein: Before returning the container image data corresponding to the container to the container runtime component through the sandbox, the method further includes: Receiving, through the container runtime component, an image data download instruction, wherein the image data download instruction carries a sandbox identifier and an image identifier; Routing the image data download instruction to the sandbox corresponding to the sandbox identifier through the container runtime component; Through the sandbox, according to the image data download instruction, a request is made to a container repository to download and save the container image data corresponding to the image identifier.

10. The method according to claim 9, wherein: By means of the sandbox, according to the image data download instruction, requesting the container repository to download and save the container image data corresponding to the image identifier, including: Through the container image management system in the sandbox, according to the image data download instruction, a request is made to the container repository to download and save the container image data corresponding to the image identifier.

11. A computer device, wherein: include: Memory and processor; The memory is used to store one or more computer instructions; The processor is configured to execute the one or more computer instructions to: perform the steps in the method according to any one of claims 1-10.

12. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, the steps in the method described in any one of claims 1 to 10 can be implemented.

13. A computer program product comprising a computer program / instructions, wherein: When the computer program is executed by a processor, the processor is caused to implement the steps in the method according to any one of claims 1 to 10.

Images