Container operation method, device, electronic device and storage medium

Abstract

The present invention discloses a method, apparatus, electronic device, and storage medium for container operation. The method includes: when using the container operation tool to operate the container, intercepting, by a first component, a first request from each of at least one application running in the container; the first request is used to request a call to an interface to obtain resources required for the application to operate; and based on the intercepted first request, calling the interface by the first component to provide corresponding resources to each of the at least one application.

Description

Technical Field

[0001] The present invention relates to the field of virtual machine technology, and in particular to a container operation method, device, electronic device, and storage medium. Background Art

[0002] Currently, when running applications in containers, in order to meet the resource requirements of the applications running in the containers, system resources need to be scheduled to the corresponding containers. When the number of running containers increases, the performance of the containers decreases and the speed at which the containers run is reduced. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a container operation method, apparatus, electronic device, and storage medium to at least address the problems of reduced container performance and reduced container operation rate encountered in related technologies.

[0004] The technical solution of the embodiment of the present invention is achieved as follows:

[0005] An embodiment of the present invention provides a container operation method, wherein a container operation tool includes a first component, and the method includes:

[0006] When the container is run using the container running tool, intercepting a first request of each application in at least one application running in the container by the first component; the first request is used to request to call an interface to obtain resources required for the application to run by calling the interface;

[0007] Based on the intercepted first request, the interface is called by the first component to provide corresponding resources to each application in the at least one application.

[0008] In the above solution, the container operation tool further includes a second component, and the method further includes:

[0009] intercepting, by the second component, a second request of each application in the at least one application, wherein the second request is used to request network communication;

[0010] Based on the intercepted second request, each of the at least one application program performs network communication through the network communication protocol set in the second component.

[0011] In the above solution, when each of the at least one application program performs network communication through the network communication protocol set in the second component, the method further includes:

[0012] Detecting the traffic generated by the application using the second component to obtain a first detection result;

[0013] Based on the first detection result, illegal traffic is intercepted; the illegal traffic represents traffic generated when an application performs unauthorized access.

[0014] In the above solution, the method further includes:

[0015] detecting, by the second component, a behavior triggered by a process corresponding to each application in the at least one application, to obtain a second detection result; the second detection result represents a working state of the application;

[0016] According to the second detection result, the behavior triggered by the process corresponding to the application in the abnormal working state is intercepted.

[0017] In the above solution, the method further includes:

[0018] The first component controls the running state of the process corresponding to each application in the at least one application and the running state of the container.

[0019] In the above solution, the method further includes:

[0020] Before using the container running tool to run the container, detecting user permissions of the container by the container running tool to obtain a third detection result;

[0021] When the third detection result indicates that the user authority is a super user authority, the user authority is set to a common user authority.

[0022] In the above solution, the method further includes:

[0023] Generate an image file required for the at least one application to run when the user authority is a normal user authority;

[0024] Setting the file permission of the image file to a first permission; wherein the first permission indicates that the container is allowed to perform file operations on the image file;

[0025] The image file is loaded into the container by the container running tool.

[0026] An embodiment of the present invention further provides a container operation device, including:

[0027] a first interception unit configured to intercept, through the first component, a first request of each of at least one application running in the container when the container is run using the container running tool; the first request being used to request a call to an interface to obtain resources required for the application to run by calling the interface; the container running tool including the first component;

[0028] The first response unit is configured to call the interface through the first component based on the intercepted first request, and provide corresponding resources to each application in the at least one application.

[0029] An embodiment of the present invention further provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor,

[0030] The processor is configured to execute the steps of any of the above methods when running the computer program.

[0031] An embodiment of the present invention further provides a storage medium storing a computer program, which implements the steps of any of the above methods when executed by a processor.

[0032] In an embodiment of the present invention, the container operation includes a first component. When a container is run using a container running tool, the first request of each application in at least one application running in the container is intercepted by the first component. The first request is used to request a call interface to obtain the resources required for the application to run by calling the interface. Based on the intercepted first request, the interface is called by the first component to provide corresponding resources to each application in the at least one application. Therefore, when the number of running containers increases, the rate of resource scheduling can be increased, thereby ensuring the orderly operation of the container and improving the performance of the container. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the implementation flow of a container operation method provided in one embodiment of the present invention;

[0034] Figure 2 A schematic diagram of a process flow for implementing a container operation method according to another embodiment of the present invention;

[0035] Figure 3 A schematic diagram of a process flow for implementing a container operation method according to another embodiment of the present invention;

[0036] Figure 4 A schematic diagram of a process flow for implementing a container operation method according to another embodiment of the present invention;

[0037] Figure 5 A schematic diagram of a process flow for implementing a container operation method according to another embodiment of the present invention;

[0038] Figure 6 A schematic diagram of a process flow for implementing a container operation method according to another embodiment of the present invention;

[0039] Figure 7 A schematic diagram of the structural framework of a container operation method provided in an application embodiment of the present invention;

[0040] Figure 8 A schematic diagram of the structure of a container operating device provided in an embodiment of the present invention;

[0041] Figure 9 Schematic diagram of the hardware structure of the electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0043] In the following description, specific details such as particular system structures and techniques are provided for purposes of illustration, not limitation, to facilitate a thorough understanding of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail.

[0044] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0045] In addition, in the embodiments of the present invention, “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0046] The embodiment of the present invention provides a container operation method. Figure 1 This is a flow chart of a container operation method according to an embodiment of the present invention. Figure 1 As shown, the container running tool includes a first component, and the method includes:

[0047] S101: When the container is run using the container running tool, the first component intercepts the first request of each application in at least one application running in the container; the first request is used to request to call an interface to obtain resources required for the application to run by calling the interface.

[0048] Here, the container running tool is responsible for running the container. When the container is running, each of the at least one application running in the container will issue a first request. The first component can intercept the first request, wherein the first request is used to request to call an interface to obtain the resources required for the application to run through the called interface. In actual applications, the container running tool is runc in the application container engine Docker architecture. Runc is a command line tool terminal that can create and run containers based on the standards of the Open Container Initiative (OCI). When running at least one application in the container, it is necessary to allocate operating system resources to different containers by calling interfaces to ensure the normal operation of the application. Since the container running tool uses runc in the Docker architecture, it can realize the operation of the container on the existing Docker architecture, reducing the workload of the transformation while improving the compatibility of the container. In actual applications, the first component is bc-bypass. When the application needs to obtain system resources, the application itself will initiate a first request to obtain the corresponding system resources. bc-bypass can intercept the first request of the application through a kernel-based virtual machine, avoiding the application directly obtaining the corresponding resources through system calls.

[0049] S102: Based on the intercepted first request, the interface is called by the first component to provide corresponding resources to each application in the at least one application.

[0050] Here, the first component performs system call processing based on the intercepted first request, and provides corresponding resources to each application in at least one application by calling the corresponding interface, so that the first component uniformly performs system call processing for different applications, and can perform system calls while ensuring system security. In actual applications, the first component implements system scheduling based on the Rush language, which can provide better memory security while ensuring performance. The first component provides different system resources for applications by calling different interfaces such as file operation interfaces, event interfaces, message interfaces, process interfaces, memory interfaces, and network interfaces. For example, when the first request indicates that the application needs to operate on a file, the first component enables the application to perform different file operations such as reading and writing files by calling the file operation interface. In actual applications, the resources of the applications running in the container are provided by the host kernel, and the resources provided by the host kernel are limited. By performing system call processing on different applications running in the container by the first component, effective resources can be reasonably allocated, improving the utilization of system resources.

[0051] In the above embodiment, the container running tool includes a first component. When the container is run using the container running tool, the first request of each application in at least one application running in the container is intercepted by the first component. The first request is used to request to call an interface to obtain the resources required for the application to run by calling the interface. Based on the intercepted first request, the interface is called by the first component to provide corresponding resources to each application in the at least one application. The system call can be completed through the first component, so that system resources can be reasonably allocated to different applications, thereby enhancing the efficiency of resource scheduling and improving the utilization of system resources, thereby improving the performance of the container and ensuring the normal operation of the container.

[0052] In one embodiment, if Figure 2 As shown, the container running tool further includes a second component, and the method further includes:

[0053] S201: intercepting a second request of each application in the at least one application by the second component; the second request is used to request network communication.

[0054] Here, a second component intercepts a second request from each application in at least one application, where the second request is for network communication. In actual applications, the second component is a sidecar. When an application sends a second request to the system for network communication, the sidecar intercepts the second request and processes it, preventing the application from directly communicating with the host kernel to obtain network communication capabilities.

[0055] S202: Based on the intercepted second request, each application program in the at least one application program performs network communication through the network communication protocol set in the second component.

[0056] Here, the second component sets a network communication protocol. Based on the intercepted second request, each of the at least one application program communicates over the network using the set network communication protocol. In practical applications, the network communication protocol set in the second component is the TCP / IP protocol, so that the at least one application program running in the container communicates over the network using the TCP / IP protocol stack of the host machine.

[0057] In the above embodiment, the container running tool also includes a second component, which intercepts the second request of each application in at least one application through the second component, and the second request is used to request network communication. Based on the intercepted second request, each application in at least one application performs network communication through the network communication protocol set in the second component, which enables the container to use the same network protocol for network communication, ensures the normal operation of the container, and improves the performance of the container.

[0058] In one embodiment, if Figure 3 As shown, when each of the at least one application program performs network communication through the network communication protocol set in the second component, the method further includes:

[0059] S301: Detect the traffic generated by the application through the second component to obtain a first detection result:.

[0060] Here, when each of the at least one application running within the container communicates based on network communication resources provided by the second component, the second component detects traffic generated by the application during the communication process to obtain a first detection result. In actual applications, the second component may employ an eBPF algorithm to detect the traffic generated by the application and obtain a corresponding detection result, wherein the detection result can characterize the state of the traffic, for example, determining whether the traffic generated by the application is illegal or legal.

[0061] S302: Based on the first detection result, intercept illegal traffic; the illegal traffic represents traffic generated when an application performs unauthorized access.

[0062] Here, based on the first detection result, when the detection result indicates that the traffic generated by the application is illegal traffic, the illegal traffic is intercepted, where the illegal traffic indicates traffic generated when the application performs unauthorized access. In actual applications, the user permissions of the container define the access scope of each application in at least one application running in the container. When the application access content falls within the access scope defined by the user permissions, it indicates that the application performs authorized access. When the application access content falls outside the access scope defined by the user permissions, it indicates that the user program performs unauthorized access. The traffic generated during the unauthorized access process is illegal traffic. Because the access scope of the application running in the container is limited by the user permissions, the link corresponding to the traffic within the access scope is also fixed. In actual applications, the first detection result can be obtained by monitoring the traffic of other links of the link corresponding to the traffic within the access scope. For example, when traffic is detected on other links of the link corresponding to the traffic within the access scope, the traffic can be determined to be illegal traffic. Based on the first detection result, the type of traffic generated by the application access can be determined, and the illegal traffic can be filtered to prevent the inflow and outflow of illegal traffic.

[0063] In the above embodiment, the traffic generated by the application is detected by the second component to obtain a first detection result. Based on the first detection result, illegal traffic is intercepted. The illegal traffic represents the traffic generated when the application performs unauthorized access, thereby being able to identify illegal traffic, filter illegal traffic, and isolate the traffic for network communication during the operation of the container, which is beneficial to improving the security of the container operation.

[0064] In one embodiment, if Figure 4 As shown, the method further includes:

[0065] S401: Detecting, by the second component, the behavior triggered by the process corresponding to each application in the at least one application to obtain a second detection result; the second detection result represents the working status of the application.

[0066] Here, the second component can also detect the behavior triggered by the process corresponding to each application in at least one application to obtain a second detection result, and the second detection result represents the working state of the application, wherein the working state of the application includes the application being in a normal working state and the application being in an abnormal working state. The application being in a normal working state represents that the behavior triggered by the process corresponding to the application can legally obtain the resources of the host machine, and the application being in an abnormal working state represents that the behavior triggered by the process corresponding to the application will cause abnormal use of the host machine resources, for example, the process corresponding to the application performs abnormal file reading, the process corresponding to the application generates illegal traffic, etc. In actual application, the process corresponding to the application is monitored by a process monitoring system, which is divided into monitored processes and monitoring processes in the process monitoring system. The monitored process can be the process corresponding to each application in at least one application running in the container. The monitored process actively initiates a signal, and the monitoring process responds differently according to different signals initiated by the monitored process. When the monitored process is in a dead loop state or other abnormal phenomena occur, it will cause communication blockage, the monitored process cannot initiate a signal, and the monitoring process cannot respond according to the signal initiated by the monitored process, so that it can be determined that the monitored process is abnormal.

[0067] S402: According to the second detection result, intercept the behavior triggered by the process corresponding to the application in the abnormal working state.

[0068] Here, according to the second detection result, when the second detection result indicates that each of the at least one application running in the container is in an abnormal working state, the behavior triggered by the process corresponding to the application is intercepted; when the second detection result indicates that each of the at least one application running in the container is in a normal working state, the behavior triggered by the process corresponding to the application is responded to.

[0069] In the above embodiment, the second component detects the behavior triggered by the process corresponding to each application in at least one application to obtain a second detection result. The second detection result represents the working status of the application. According to the second detection result, the behavior triggered by the process corresponding to the application in the abnormal working status is intercepted, so that abnormal applications can be identified and the behavior of abnormal applications can be intercepted, thereby improving the security of the container.

[0070] In one embodiment, the method further comprises:

[0071] The first component controls the running state of the process corresponding to each application in the at least one application and the running state of the container.

[0072] Here, the first component can also control the running status of the process corresponding to each application in at least one application running in the container and the running status of the container. In actual applications, multiple processes can be run in a container, and the processes in the container are all processes corresponding to each application in at least one application running in the container. The first component can manage the processes in the container. In Docker, each container is a child process, and each container has a different PID namespace. Under the namespace of a container, different PIDs can be configured for the processes of different applications in the container, thereby achieving process isolation between containers. The first component controls the running status of the process corresponding to the application, including checking the response information of the process and opening or closing the process. In actual applications, the first component can also control the running status of the container, wherein the control of the running status of the container is mainly to control the life cycle of the container, including any one of creating a container, running a container, pausing a container, and deleting a container.

[0073] In the above embodiment, the running state of the process corresponding to each application in at least one application and the running state of the container are controlled through the first component, so that different processes and containers can be managed in an orderly manner, thereby improving the performance of the container.

[0074] In one embodiment, if Figure 5 As shown, the method further includes:

[0075] S501: Before using the container running tool to run the container, use the container running tool to detect user permissions of the container to obtain a third detection result.

[0076] Here, before using the container running tool to run the container, the container running tool detects the user permissions of the container to be run, obtaining a third detection result. The third detection result can characterize the type of user permissions of the container, and the third detection result can include ordinary user permissions and superuser permissions. In actual applications, both ordinary user permissions and superuser permissions can start and run containers. The control scope granted by superuser permissions is greater than that of ordinary user permissions. For example, ordinary users cannot perform corresponding file operations on files with superuser permissions.

[0077] S502: When the third detection result indicates that the user authority is a super user authority, the user authority is set to a normal user authority.

[0078] Here, when the third detection result indicates that the user permissions are superuser permissions, the permissions of the container are forcibly corrected and the user permissions are set to normal user permissions, so that the container runs under normal user permissions. In actual applications, the user permissions of the container are controlled by the user identification (UID) and group identification (Group Identification) to control the user's operation permissions on the directory. When the user permissions of the container are superuser permissions, the user permissions of the container are converted from superuser permissions to normal user permissions by modifying the UID and GID. When the user permissions of the container are normal user permissions, the corresponding permission range is determined according to the permission restrictions of the corresponding UID on the host machine.

[0079] In the above embodiment, before using the container running tool to run the container, the user permissions of the container are detected by the container running tool to obtain a third detection result. When the third detection result indicates that the user permissions are super user permissions, the user permissions are set to ordinary user permissions. By limiting the user permissions of the container, the container's access to the host system resources is restricted, the attack surface is reduced, and the security of the container is improved.

[0080] In one implementation, if Figure 6 As shown, the method further includes:

[0081] S601: Generate an image file required by at least one application when the user authority is a common user authority.

[0082] Here, after setting the user permissions of the container to ordinary user permissions, at least one image file required for the application to run is generated based on the user permissions of the container. The image file is a file generated under ordinary user permissions, which can reduce the attack surface of the container, thereby ensuring the security of the container and the host machine.

[0083] S602: Set the file permission of the image file to a first permission; the first permission indicates that the container is allowed to perform file operations on the image file.

[0084] Here, the file permission of the image file is set to the first permission. The first permission limits the scope of file operations on the image file. The first permission indicates that the container is allowed to perform file operations on the image file, including allowing the container to read, modify, move, and other file operations on the image file, while the host machine cannot perform file operations on the image file, thereby isolating the host machine's file system from the container's files.

[0085] S603: Load the image file into the container through the container running tool.

[0086] Here, when the container running tool runs the container, the container running tool loads the image file into the container, thereby enabling at least one application to be run according to the image file through the container.

[0087] In the above embodiment, an image file corresponding to the ordinary user permissions required for the operation of at least one application is generated, and the file permissions of the image file are set to the first permissions. The first permissions represent that the container is allowed to perform file operations on the image file. The image file is loaded into the container through the container running tool, so that the files required for the container operation are isolated from the host machine's file system, thereby improving the security of the container and enhancing the performance of the container.

[0088] The embodiment of the present invention also provides an application embodiment, such as Figure 7 As shown, Figure 7 This diagram shows the structural framework of the container operation method. When running a container using the container operation tool, the image registry implements three functions: searching for image files, downloading image files, and uploading image files. The image files required for runtime are loaded into the container to ensure normal operation of the container. During the container operation process, the first component implements system calls. By calling the corresponding interface, it obtains the corresponding system resources from the host kernel and provides system resources for the application running in the container. The second component implements network communication, allowing the application running in the container to communicate through the host's TCP / IP network protocol, thus ensuring the normal operation of the application in the container.

[0089] In order to implement the container operation method of the embodiment of the present invention, the embodiment of the present invention also provides a container operation device, such as Figure 8 As shown, the container operation device includes:

[0090] A first interception unit 801 is configured to intercept, through the first component, a first request of each application program in at least one application program running in the container when the container running tool is used to run the container; the first request is configured to request to call an interface to obtain resources required for the application program to run by calling the interface; the container running tool includes the first component;

[0091] The first responding unit 802 is configured to call the interface through the first component based on the intercepted first request, and provide corresponding resources to each application in the at least one application.

[0092] In one embodiment, the container running tool further includes a second component, and the container running device further includes:

[0093] a second interception unit, configured to intercept, through the second component, a second request of each application in the at least one application, wherein the second request is used to request network communication;

[0094] The second response unit is configured to enable each application in the at least one application to perform network communication through the network communication protocol set in the second component based on the intercepted second request.

[0095] In one embodiment, when each of the at least one application program performs network communication using the network communication protocol set in the second component, the apparatus further comprises:

[0096] a first detection unit, configured to detect traffic generated by the application program through the second component and obtain a first detection result;

[0097] The first interception unit is used to intercept illegal traffic based on the first detection result; the illegal traffic represents the traffic generated when the application performs unauthorized access.

[0098] In one embodiment, the apparatus further comprises:

[0099] a second detection unit, configured to detect, through the second component, a behavior triggered by a process corresponding to each application in the at least one application, and obtain a second detection result; wherein the second detection result represents a working state of the application;

[0100] The second interception unit is used to intercept the behavior triggered by the process corresponding to the application in the abnormal working state according to the second detection result.

[0101] In one embodiment, the apparatus further comprises:

[0102] A control unit is configured to control, through the first component, the running state of a process corresponding to each application in the at least one application and the running state of the container.

[0103] In one embodiment, the apparatus further comprises:

[0104] A third detection unit is configured to detect user permissions of the container by using the container running tool before running the container using the container running tool to obtain a third detection result;

[0105] The first setting unit is configured to set the user authority to a common user authority when the third detection result indicates that the user authority is a super user authority.

[0106] In one embodiment, the apparatus further comprises:

[0107] A generating unit, configured to generate an image file required by the at least one application when the user authority is a common user authority;

[0108] A second setting unit is configured to set the file permission of the image file to a first permission; the first permission indicates that the container is allowed to perform file operations on the image file;

[0109] A loading unit is used to load the image file into the container through the container running tool.

[0110] In actual application, the first interception unit 801 and the first response unit 802 can be implemented by a processor in the container operation device. Of course, the processor needs to run the program stored in the memory to implement the functions of the above program modules.

[0111] It should be noted that the above Figure 8 The container operation device provided in the embodiments only uses the aforementioned division of program modules as an example to illustrate the container operation. In actual applications, the aforementioned processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the aforementioned processing. In addition, the container operation device provided in the above embodiments and the container operation method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0112] Based on the hardware implementation of the above program modules and in order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides an electronic device. Figure 9 FIG. 1 is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Figure 9 As shown, the electronic equipment includes:

[0113] Communication interface 1, capable of exchanging information with other devices such as network devices;

[0114] The processor 2 is connected to the communication interface 1 to implement information exchange with other devices and is used to execute the container operation method provided by one or more of the above technical solutions when running a computer program. The computer program is stored in the memory 3.

[0115] Of course, in actual application, the various components in the electronic device are coupled together through the bus system 4. It can be understood that the bus system 4 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 9 Various buses are labeled as bus system 4.

[0116] The memory 3 in the embodiment of the present invention is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0117] It is understood that the memory 3 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a magnetic disk memory or a magnetic tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 3 described in the embodiments of the present invention is intended to include but is not limited to these and any other suitable types of memories.

[0118] The method disclosed in the above embodiment of the present invention can be applied to processor 2 or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the hardware integrated logic circuit in processor 2 or by instructions in software form. The above processor 2 can be a general-purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. Processor 2 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present invention. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the above method in combination with its hardware.

[0119] When the processor 2 executes the program, the corresponding processes in the various methods of the embodiments of the present invention are implemented, which will not be described here for the sake of brevity.

[0120] In an exemplary embodiment, the present invention further provides a storage medium, namely, a computer storage medium, specifically, a computer-readable storage medium, such as a memory 3 storing a computer program. The computer program can be executed by a processor 2 to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface mount storage, optical disk, or CD-ROM.

[0121] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, terminals and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0122] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0124] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0125] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0126] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A container operation method, characterized in that: The container operation tool includes a first component, and the method includes: When the container is run using the container running tool, intercepting a first request of each application in at least one application running in the container by the first component; the first request is used to request to call an interface to obtain resources required for the application to run by calling the interface; Based on the intercepted first request, calling the interface through the first component to provide corresponding resources to each of the at least one application; The method further comprises: Before using the container running tool to run the container, detecting user permissions of the container by the container running tool to obtain a third detection result; When the third detection result indicates that the user authority is a super user authority, setting the user authority to a normal user authority; The method further comprises: Generate an image file required for the at least one application to run when the user authority is a normal user authority; Setting the file permission of the image file to a first permission; wherein the first permission indicates that the container is allowed to perform file operations on the image file; The image file is loaded into the container by the container running tool.

2. The container operation method according to claim 1, characterized in that: The container operation tool further includes a second component, and the method further includes: intercepting, by the second component, a second request of each application in the at least one application, wherein the second request is used to request network communication; Based on the intercepted second request, each of the at least one application program performs network communication through the network communication protocol set in the second component.

3. The container operation method according to claim 2, characterized in that: When each of the at least one application program performs network communication through the network communication protocol set in the second component, the method further includes: Detecting the traffic generated by the application using the second component to obtain a first detection result; Based on the first detection result, illegal traffic is intercepted; the illegal traffic represents traffic generated when an application performs unauthorized access.

4. The container operation method according to claim 2, characterized in that: The method further comprises: detecting, by the second component, a behavior triggered by a process corresponding to each application in the at least one application, to obtain a second detection result; the second detection result represents a working state of the application; According to the second detection result, the behavior triggered by the process corresponding to the application in the abnormal working state is intercepted.

5. The container operation method according to claim 1, characterized in that: The method further comprises: The first component controls the running state of the process corresponding to each application in the at least one application and the running state of the container.

6. A container operation device, characterized in that: The container runtime tool includes the following components: a first interception unit configured to intercept, through the first component, a first request of each of at least one application running in the container when the container is run using the container running tool; the first request being used to request a call to an interface to obtain resources required for the application to run by calling the interface; the container running tool including the first component; a first response unit, configured to call the interface through the first component based on the intercepted first request and provide corresponding resources to each of the at least one application; Wherein, the device further includes: A third detection unit is configured to detect user permissions of the container by using the container running tool before running the container using the container running tool to obtain a third detection result; a first setting unit, configured to set the user authority to a normal user authority when the third detection result indicates that the user authority is a super user authority; The device further comprises: A generating unit, configured to generate an image file required by the at least one application when the user authority is a common user authority; A second setting unit is configured to set the file permission of the image file to a first permission; the first permission indicates that the container is allowed to perform file operations on the image file; A loading unit is used to load the image file into the container through the container running tool.

7. An electronic device, characterized in that: include: a processor and a memory for storing a computer program capable of being executed on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method according to any one of claims 1 to 5.

8. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images