Container control method, container control device, electronic device and storage medium

Abstract

The present disclosure provides a container control method that can be used in the field of computer technology, finance, or other fields. The method includes: in response to a user's startup instruction for a target container, determining a target system component required when the target container is started from one or more system components; obtaining a ciphertext of the configuration information of the target system component; decrypting the ciphertext of the configuration information through an intrusive script to obtain a plaintext of the configuration information of the target system component; filling the plaintext of the configuration information into a container startup script; and executing the container startup script to start the target container. In addition, the present disclosure also provides a container control device, an electronic device, a readable storage medium, and a computer program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of computer technology and finance, and more specifically, to a container control method, a container control device, an electronic device, a readable storage medium, and a computer program product. Background Art

[0002] As the scale of corporate business expands and market competition intensifies, many companies have begun to build container cloud platforms to realize containerization of business applications, allowing companies to focus on business logic development, shorten business iteration and launch cycles, optimize resource utilization, and improve service response efficiency.

[0003] In the process of implementing the concept of the present disclosure, the inventors discovered that there is a security risk of leakage of configuration information of system components related to containers in the related technology. Summary of the invention

[0004] In view of this, the present disclosure provides a container control method, a container control device, an electronic device, a readable storage medium and a computer program product.

[0005] One aspect of the present disclosure provides a container control method, including: in response to a user's startup instruction for a target container, determining a target system component required when the target container is started from one or more system components; obtaining ciphertext configuration information of the target system component; decrypting the ciphertext configuration information through an intrusive script to obtain plaintext configuration information of the target system component; filling the plaintext configuration information into a container startup script; and executing the container startup script to start the target container.

[0006] According to an embodiment of the present disclosure, the method further includes: verifying the management authority of the user based on a container authority association table, wherein the container authority association table records the relationship between the management authority of the container and the identity information of the user; and determining, from one or more system components, the target system component required when the target container is started when it is determined that the user has the management authority of the target container.

[0007] According to an embodiment of the present disclosure, the verifying the management authority of the user based on the container authority association table includes: determining the manageable container corresponding to the identity information of the user based on the container authority association table; judging whether the target container is included in the manageable container; and determining that the user has the management authority of the target container when it is determined that the target container is included in the manageable container.

[0008] According to an embodiment of the present disclosure, the above method also includes: obtaining the data length of the above configuration information ciphertext; comparing the data length of the above configuration information ciphertext with a preset length value to obtain a comparison result; and when the above comparison result shows that the data length of the above configuration information ciphertext is equal to the above preset length value, decrypting the above configuration information ciphertext through the above invasive script.

[0009] According to an embodiment of the present disclosure, the configuration information ciphertext of the above-mentioned system component is obtained by encrypting the configuration information of the above-mentioned system component through a preset encryption method; the above-mentioned method also includes: modifying the configuration information of the above-mentioned target system component according to a preset period.

[0010] According to an embodiment of the present disclosure, the system components include a database and an operating environment component; the configuration information of the system components includes an access username and password for the system components.

[0011] Another aspect of the present disclosure provides a container control device, including a first acquisition module, a second acquisition module, a first processing module, a second processing module, and a third processing module. The first acquisition module is used to determine the target system component required when the target container is started from one or more system components in response to a user's startup instruction for the target container; the second acquisition module is used to obtain the ciphertext configuration information of the target system component; the first processing module is used to decrypt the ciphertext configuration information through an intrusive script to obtain the plaintext configuration information of the target system component; the second processing module is used to fill the plaintext configuration information into the container startup script; and the third processing module is used to execute the container startup script to realize the startup of the target container.

[0012] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more instructions, wherein when the one or more instructions are executed by the one or more processors, the one or more processors implement the method as described above.

[0013] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0014] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and when the instructions are executed, are used to implement the method as described above.

[0015] According to an embodiment of the present disclosure, when starting a target container, the configuration information ciphertext of the target system component corresponding to the target container is obtained, the configuration information ciphertext is decrypted using an intrusive script, and the decrypted configuration information plaintext is filled into the container startup script, and then the container startup script is executed to start the target container. Through the above technical means, the direct contact between the operation and maintenance personnel and the configuration information of the system components and the direct storage of the configuration information of the system components by the container platform are avoided, at least partially overcoming the technical problem of the security risk of leakage of the configuration information of the system components in the related technology, effectively ensuring information security, and reducing the operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 An exemplary system architecture 100 to which a container control method according to an embodiment of the present disclosure may be applied is schematically shown.

[0018] Figure 2 The flowchart of the container control method according to the embodiment of the present disclosure is schematically shown.

[0019] Figure 3 A flow chart of a container control method according to another embodiment of the present disclosure is schematically shown.

[0020] Figure 4 A schematic diagram of a container control system according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 5 A block diagram of a container control device according to an embodiment of the present disclosure is schematically shown.

[0022] Figure 6 A block diagram of an electronic device suitable for implementing a container control method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0026] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] In related technologies, an enterprise-level PaaS (Platform as a Service) container needs to run in an environment and establish a database connection when it is started. The commonly used technical solution is for production and maintenance personnel to set up the database password and other configuration information required for container startup on the PaaS platform, which is then automatically filled into the configuration file by the PaaS platform to complete the startup of the PaaS container.

[0028] The above process involves security risks such as password leakage by production maintenance personnel, database password leakage after the PaaS platform is attacked, and leakage of other application security configuration information. The leakage of passwords of components such as databases and other security configuration information will cause great losses to the enterprise.

[0029] In view of this, the embodiments of the present disclosure provide a container control method to address the technical problem of the risk of configuration information leakage during the operation and maintenance of PaaS containers based on the liberty data source, which to a certain extent avoids attacks on applications based on the PaaS operation and maintenance platform, reduces the risk of security configuration information leakage of important system components, and improves the level of application automation based on PaaS container operation and maintenance.

[0030] Specifically, the embodiments of the present disclosure provide a container control method, a container control device, an electronic device, a readable storage medium, and a computer program product. The method includes responding to a user's startup instruction for a target container, determining a target system component required when the target container is started from one or more system components; obtaining a ciphertext of configuration information of the target system component; decrypting the ciphertext of the configuration information through an intrusive script to obtain a plaintext of the configuration information of the target system component; filling the plaintext of the configuration information into a container startup script; and executing the container startup script to start the target container.

[0031] It should be noted that the container control method and device determined in the embodiment of the present disclosure can be used in the field of computer technology or the financial field, for example, it can be applied to the back-end server of a bank. The container control method and device determined in the embodiment of the present disclosure can also be used in any field other than the field of computer technology and the financial field, and the application field of the container control method and device determined in the embodiment of the present disclosure is not limited.

[0032] In the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0033] Figure 1 The exemplary system architecture 100 to which the container control method according to the embodiment of the present disclosure can be applied is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0034] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101 , 102 , 103 , a network 104 and a server 105 .

[0035] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting data communication, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0036] The terminal devices 101, 102, 103 may be installed with any type of operating system, including but not limited to Windows, Unix, Lunix, Mac OS, etc.

[0037] Various client applications may be installed on the terminal devices 101 , 102 , and 103 , such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software.

[0038] The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links.

[0039] The server 105 may be a server that provides various services. For example, the server 105 may host a PaaS container cloud platform to store configuration information of the container.

[0040] When installing the client application on the terminal devices 101, 102, 103, the user can load the container configuration information stored in the server 105 through the network 104, load the source code of the client application into the container, and start the container using the container configuration information to install the client application.

[0041] It should be noted that the container control method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the container control device provided in the embodiment of the present disclosure can generally be set in the server 105. The container control method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105. Accordingly, the container control device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal device 101, 102, 103 and / or the server 105. Alternatively, the container control method provided in the embodiment of the present disclosure can also be executed by the terminal device 101, 102, or 103, or it can also be executed by other terminal devices different from the terminal device 101, 102, or 103. Accordingly, the container control device provided in the embodiment of the present disclosure can also be set in the terminal device 101, 102, or 103, or it can be set in other terminal devices different from the terminal device 101, 102, or 103.

[0042] For example, the container configuration information may be originally stored in any one of the terminal devices 101, 102, or 103 (for example, the terminal device 101, but not limited thereto), or stored in an external storage device and may be imported into the terminal device 101. Then, the terminal device 101 may locally execute the container control method provided in the embodiment of the present disclosure, or send the container configuration information to other terminal devices, servers, or server clusters, and the other terminal devices, servers, or server clusters that receive the container configuration information may execute the container control method provided in the embodiment of the present disclosure.

[0043] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0044] Figure 2 The flowchart of the container control method according to the embodiment of the present disclosure is schematically shown.

[0045] like Figure 2 As shown, the method includes operations S201 to S205.

[0046] In operation S201 , in response to a user's start instruction for a target container, a target system component required for starting the target container is determined from one or more system components.

[0047] In operation S202, the configuration information ciphertext of the target system component is obtained.

[0048] In operation S203, the configuration information ciphertext is decrypted by an intrusive script to obtain the configuration information plaintext of the target system component.

[0049] In operation S204, the configuration information is plain text filled into the container startup script.

[0050] In operation S205 , the container startup script is executed to start the target container.

[0051] According to an embodiment of the present disclosure, a container may include an environment for the application program to run in addition to the application program itself. Therefore, when the container is started, the container needs to establish a connection with the system components to build a necessary operating environment.

[0052] According to an embodiment of the present disclosure, the configuration information ciphertext of the system component may be obtained by encrypting the configuration information using an encryption algorithm, and the encryption algorithm may be any encryption algorithm, such as SM4, MD5, SHA256, etc.

[0053] According to the embodiments of the present disclosure, by using an intrusive script, the functions that can be realized by the intrusive script can be added to the system without modifying the original system structure framework.

[0054] According to an embodiment of the present disclosure, the intrusive script may include a bash script.

[0055] According to an embodiment of the present disclosure, the container startup script may be any script containing batch processing instructions, such as a bat script, a shell script, and the like.

[0056] According to an embodiment of the present disclosure, the execution order of the invasive script and the container startup script may be specified in a Dockerfile.

[0057] According to an embodiment of the present disclosure, after executing the container startup script, the configuration information of the target system component can be used to pass the verification of the target system component to load the target system component, thereby completing the construction of the operating environment and realizing the startup of the target container.

[0058] According to an embodiment of the present disclosure, when starting a target container, the configuration information ciphertext of the target system component corresponding to the target container is obtained, the configuration information ciphertext is decrypted using an intrusive script, and the decrypted configuration information plaintext is filled into the container startup script, and then the container startup script is executed to start the target container. Through the above technical means, the direct contact between the operation and maintenance personnel and the configuration information of the system components and the direct storage of the configuration information of the system components by the container platform are avoided, at least partially overcoming the technical problem of the security risk of leakage of the configuration information of the system components in the related technology, effectively ensuring information security, and reducing the operation and maintenance costs.

[0059] Figure 3 A flow chart of a container control method according to another embodiment of the present disclosure is schematically shown.

[0060] like Figure 3 As shown, the method includes operations S301 to S309.

[0061] It should be noted that, unless it is explicitly stated that there is a sequence of execution between different operations shown in the flowchart in the embodiments of the present disclosure, or there is a sequence of execution between different operations in technical implementation, otherwise, the execution order of multiple operations may not be prioritized, and multiple operations may also be executed simultaneously.

[0062] In operation S301, a start instruction from a user for a target container is received.

[0063] In operation S302, it is determined whether the user has management authority over the target container. If it is determined that the user does not have management authority over the target container, operation S303 is performed; if it is determined that the user has management authority over the target container, operation S304 is performed.

[0064] In operation S303, the start instruction of the user for the target container is rejected.

[0065] In operation S304, a ciphertext of configuration information of a target system component related to starting the target container is obtained.

[0066] In operation S305, it is determined whether the data format of the configuration information ciphertext is correct. If it is determined that the data format of the configuration information ciphertext is incorrect, operation S306 is performed; if it is determined that the data format of the configuration information ciphertext is correct, operation S307 is performed.

[0067] In operation S306, feedback information of configuration information format error is sent to the user. After operation S306 is completed, operation S304 is continued.

[0068] In operation S307, the configuration information ciphertext is decrypted by an intrusive script to obtain the configuration information plaintext.

[0069] In operation S308, the configuration information is plain text filled into the container startup script.

[0070] In operation S309, the container startup script is executed.

[0071] According to an embodiment of the present disclosure, the user may be an operation and maintenance personnel. There may be multiple operation and maintenance personnel in the operation and maintenance business, each of which is responsible for managing different containers.

[0072] According to an embodiment of the present disclosure, the management authority of a container may be determined by the user's identity information and a container authority association table, wherein the container authority association table may record the relationship between the management authority of the container and the user's identity information.

[0073] For example, after obtaining the user's startup instruction for the target container, the identity information of the account used by the user when issuing the instruction can be obtained; based on the identity information, the manageable container corresponding to the identity information can be determined from the container permission association table, and the manageable container can be one or more containers; then, based on the judgment of whether the target container is included in the manageable container, it can be determined whether the user has the management permission of the target container.

[0074] According to an embodiment of the present disclosure, the target system components related to the start of the target container can be determined by a container association table, wherein the container association table can record the system components required when the container is started.

[0075] According to an embodiment of the present disclosure, the system components may include a database, an operating environment component (FTP), and the like.

[0076] According to an embodiment of the present disclosure, the configuration information ciphertext may be generated by the configuration information through an encryption algorithm.

[0077] According to an embodiment of the present disclosure, the configuration information may include a user name and password required when accessing or using the system component.

[0078] According to an embodiment of the present disclosure, the configuration information may be modified according to a preset period. For example, the configuration information stored in the database may be modified once every 90 days.

[0079] According to an embodiment of the present disclosure, the configuration information ciphertext generated by the encryption algorithm may have a fixed number of data bits.

[0080] According to an embodiment of the present disclosure, determining the data format of the configuration information ciphertext may be achieved by determining the number of data bits of the configuration information ciphertext.

[0081] For example, if the encryption algorithm used is the 32-bit MD5 algorithm, the generated configuration information ciphertext should be a 32-bit string. If the ciphertext of the configuration information is greater than or less than 32 bits, it can be considered that the configuration information ciphertext is incorrect or the encryption algorithm used to generate the configuration information ciphertext is incorrect. At this time, the method of operation S304 can be executed again to regain the configuration information ciphertext.

[0082] According to an embodiment of the present disclosure, operations S307 to S309 may be implemented by the method of operations S203 to S205, which will not be described in detail herein.

[0083] Figure 4 A schematic diagram of a container control system according to an embodiment of the present disclosure is schematically shown.

[0084] like Figure 4 As shown, the container control system may include a resource management module 410, a configuration module 420 and a control module 430. The functions of the container control system may be implemented through the method of operations S201-S205 or operations S301-S309.

[0085] According to an embodiment of the present disclosure, the resource management module 410 can manage the configuration information of system components 411 such as database and FTP, and can automatically update the configuration information of the system components 411 such as user names and passwords regularly according to the component configuration information management strategy.

[0086] According to an embodiment of the present disclosure, the resource management module 410 may record the system components 411 required for starting the container 431, thereby forming a container association table.

[0087] According to an embodiment of the present disclosure, based on the container association table, the resource management module 410 can also identify a list of system components that are not under management, and provide feedback to the user to remind the user to include the system components in the list into the resource management module 410 for management.

[0088] According to an embodiment of the present disclosure, the resource management module 410 may also dynamically adjust the management authority of the operation and maintenance personnel and record it as a container authority association table.

[0089] According to an embodiment of the present disclosure, based on the container permission association table, the resource management module 410 can verify the identity information of the user to prevent the container 431 from being maliciously started.

[0090] According to an embodiment of the present disclosure, the configuration module 420 can receive an HTTP request for obtaining configuration information of the system component 411, and in response to the request, obtain the configuration information of the system component 411 from the resource management module 410, encrypt the configuration information into a configuration information ciphertext through an encryption algorithm, and push the configuration information ciphertext to the control module.

[0091] According to an embodiment of the present disclosure, the control module 430 can read the configuration information ciphertext set by the configuration module 420 by requesting openapi, and then complete the decryption and security verification of the configuration information ciphertext before the container 431 is started through an invasive script, and automatically fill the decrypted configuration information plaintext into the container configuration file to achieve secure startup of the container 431.

[0092] In other embodiments of the present disclosure, the resource management module 410 may also encrypt the configuration information of the managed system component 411 using a key. When the container 431 is started, the configuration module 420 will encrypt the configuration information for a second time. The key used for the first encryption and the algorithm used for the second encryption are deployed in the intrusive script.

[0093] According to an embodiment of the present disclosure, the resource management module 410, the configuration module 420 and the control module 430 may be arranged in different electronic devices, and communication connections are established between the different electronic devices.

[0094] Figure 5 A block diagram of a container control device according to an embodiment of the present disclosure is schematically shown.

[0095] like Figure 5 As shown, the container control device includes a first acquisition module 510 , a second acquisition module 520 , a first processing module 530 , a second processing module 540 and a third processing module 550 .

[0096] The first acquisition module 510 is configured to determine, in response to a user's startup instruction for a target container, a target system component required when the target container is started from one or more system components.

[0097] The second acquisition module 520 is used to acquire the configuration information ciphertext of the target system component.

[0098] The first processing module 530 is used to decrypt the configuration information ciphertext through an intrusive script to obtain the configuration information plaintext of the target system component.

[0099] The second processing module 540 is used to fill the configuration information in plain text into the container startup script.

[0100] The third processing module 550 is used to execute the container startup script to start the target container.

[0101] According to an embodiment of the present disclosure, when starting a target container, the configuration information ciphertext of the target system component corresponding to the target container is obtained, the configuration information ciphertext is decrypted using an intrusive script, and the decrypted configuration information plaintext is filled into the container startup script, and then the container startup script is executed to start the target container. Through the above technical means, the direct contact between the operation and maintenance personnel and the configuration information of the system components and the direct storage of the configuration information of the system components by the container platform are avoided, at least partially overcoming the technical problem of the security risk of leakage of the configuration information of the system components in the related technology, effectively ensuring information security, and reducing the operation and maintenance costs.

[0102] According to an embodiment of the present disclosure, the device further includes a first verification module. The first verification module includes a first verification unit and a second verification unit.

[0103] The first verification unit is used to verify the management authority of the user based on the container authority association table, wherein the container authority association table records the relationship between the management authority of the container and the identity information of the user.

[0104] The second verification unit is used to determine, when it is determined that the user has management authority over the target container, a target system component required when the target container is started from one or more system components.

[0105] According to an embodiment of the present disclosure, the first verification unit includes a first verification subunit, a second verification subunit and a third verification subunit.

[0106] The first verification subunit is used to determine the manageable container corresponding to the user's identity information based on the container permission association table.

[0107] The second verification subunit is used to determine whether the target container is included in the manageable container.

[0108] The third verification subunit is used to determine whether the user has management authority over the target container when it is determined that the target container is included in the manageable container.

[0109] According to an embodiment of the present disclosure, the device further includes a second verification module. The second verification module includes a third verification unit, a fourth verification unit and a fifth verification unit.

[0110] The third verification unit is used to obtain the data length of the configuration information ciphertext.

[0111] The fourth verification unit is used to compare the data length of the configuration information ciphertext with a preset length value to obtain a comparison result.

[0112] The fifth verification unit is used to decrypt the configuration information ciphertext by using an intrusive script when the comparison result shows that the data length of the configuration information ciphertext is equal to a preset length value.

[0113] According to an embodiment of the present disclosure, the ciphertext of the configuration information of the system component is obtained by encrypting the configuration information of the system component using a preset encryption method.

[0114] According to an embodiment of the present disclosure, the device further includes an adjustment module.

[0115] The adjustment module is used to modify the configuration information of the target system components according to a preset period.

[0116] According to an embodiment of the present disclosure, the system component includes a database and an operating environment component; the configuration information of the system component includes an access username and password of the system component.

[0117] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0118] For example, any of the first acquisition module 510, the second acquisition module 520, the first processing module 530, the second processing module 540, and the third processing module 550 can be combined in one module / unit / sub-unit for implementation, or any of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the first acquisition module 510, the second acquisition module 520, the first processing module 530, the second processing module 540, and the third processing module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware, and firmware, or by a suitable combination of any of them. Alternatively, at least one of the first acquisition module 510, the second acquisition module 520, the first processing module 530, the second processing module 540 and the third processing module 550 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0119] It should be noted that the container control device part in the embodiment of the present disclosure corresponds to the container control method part in the embodiment of the present disclosure. The description of the container control device part specifically refers to the container control method part, which will not be repeated here.

[0120] Figure 6 A block diagram of an electronic device suitable for implementing a container control method according to an embodiment of the present disclosure is schematically shown. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0121] like Figure 6As shown, the computer electronic device 600 according to the embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 602 or the program loaded from the storage part 608 to the random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0122] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0123] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0124] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0125] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0126] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0127] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or the RAM 603 described above and / or one or more memories other than the ROM 602 and the RAM 603 .

[0128] The embodiments of the present disclosure also include a computer program product, which includes a computer program, and the computer program contains a program code for executing the method provided by the embodiments of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the container control method provided by the embodiments of the present disclosure.

[0129] When the computer program is executed by the processor 601, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0130] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0131] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments and / or claims of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0133] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A container control method, comprising: In response to a user's startup instruction for a target container, determining a target system component required for startup of the target container from one or more system components; Obtaining the configuration information ciphertext of the target system component; Decrypting the configuration information ciphertext by using an intrusive script to obtain the configuration information plaintext of the target system component; Fill the configuration information in plain text into the container startup script; as well as Execute the container startup script to start the target container; Wherein, the system components include database and operating environment components; The configuration information of the system component includes an access user name and password for the system component.

2. The method according to claim 1, further comprising: Verifying the management authority of the user based on a container authority association table, wherein the container authority association table records the relationship between the management authority of the container and the identity information of the user; and In the case where it is determined that the user has management authority over the target container, a target system component required when the target container is started is determined from one or more system components.

3. The method according to claim 2, wherein: The verifying the management authority of the user based on the container authority association table includes: Determine, based on the container permission association table, a manageable container corresponding to the identity information of the user; determining whether the target container is included in the manageable container; and When it is determined that the target container is included in the manageable container, it is determined that the user has management authority for the target container.

4. The method according to claim 1, further comprising: Obtaining the data length of the configuration information ciphertext; Compare the data length of the configuration information ciphertext with a preset length value to obtain a comparison result; as well as When the comparison result shows that the data length of the configuration information ciphertext is equal to the preset length value, the configuration information ciphertext is decrypted by the intrusive script.

5. The method according to claim 1, wherein: The ciphertext of the configuration information of the system component is obtained by encrypting the configuration information of the system component through a preset encryption method; The method further comprises: The configuration information of the target system component is modified according to a preset period.

6. A container control device, comprising: A first acquisition module, configured to determine, in response to a user's startup instruction for a target container, a target system component required when the target container is started from one or more system components; A second acquisition module, used to acquire the configuration information ciphertext of the target system component; A first processing module, configured to decrypt the configuration information ciphertext by using an intrusive script to obtain the configuration information plaintext of the target system component; A second processing module is used to fill the configuration information in plain text into the container startup script; as well as A third processing module is used to execute the container startup script to start the target container; Wherein, the system components include database and operating environment components; The configuration information of the system component includes an access user name and password for the system component.

7. An electronic device comprising: one or more processors; a memory for storing one or more instructions, Wherein, when the one or more instructions are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, wherein when the executable instructions are executed by a processor, the processor is enabled to implement the method according to any one of claims 1 to 5.

9. A computer program product, comprising computer executable instructions, wherein the computer executable instructions are used to implement the method according to any one of claims 1 to 5 when executed.

Images