A container project isolation platform

Abstract

The present invention provides a container project isolation platform, which includes: a project acquisition module, which is used to acquire a target project and determine the resource group of the target project; a classification module, which is used to extract the resource type of the resource group and classify the resource group according to the resource type; a container generation module, which is used to generate a corresponding target container according to the classification result, and at the same time, the resource group is packaged and added to the target container to achieve isolation of the container project. By determining the resource group, classifying the resource group according to the resource type of the resource group, and then generating the target container, it is beneficial to achieve physical isolation of the resource group, thereby improving the operating efficiency of the target project.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a container project isolation platform. Background Art

[0002] Currently, the container has an independent file system. Because it uses system resources, there is no need for kernel-related code or tools in the independent file system. We only need to provide the binary files, configuration files, and dependencies required by the container. As long as the file set required for the container to run is available, the container can run.

[0003] However, in a computer operating environment, there may be multiple resource configurations for the same project. Since each container configuration has its own tasks and each resource configuration is not physically isolated, each resource configuration needs to be queued during the operation of the project, which leads to low project operation efficiency. Therefore, in order to improve the project operation efficiency and realize physical isolation of resource configuration, the present invention provides a container project isolation platform. Summary of the invention

[0004] The present invention provides a container project isolation platform, which is used to determine resource groups and classify resource groups according to resource types of the resource groups, and then generate target containers, which is conducive to achieving physical isolation of resource groups, thereby improving the operating efficiency of target projects.

[0005] A container project isolation platform, comprising:

[0006] A project acquisition module, used to acquire a target project and determine a resource group of the target project;

[0007] A classification module, used for extracting resource types of resource groups and classifying the resource groups according to the resource types;

[0008] The container generation module is used to generate a corresponding target container according to the classification result, and at the same time, package the resource group and add it to the target container to achieve isolation of the container project.

[0009] Preferably, in a container project isolation platform, the project acquisition module comprises:

[0010] An instruction acquisition unit, used for determining a project extraction instruction based on target requirements;

[0011] An instruction analysis unit, used to analyze the project extraction instruction and obtain instruction keywords;

[0012] A mapping unit, configured to establish a mapping relationship between the instruction keyword and a preset project library according to the instruction keyword, and determine a target project corresponding to the instruction keyword according to the mapping relationship;

[0013] An extraction unit is used to extract the target item based on the item extraction instruction.

[0014] Preferably, in a container project isolation platform, the project acquisition module further includes:

[0015] A target project reading unit, configured to read a project task of the target project and determine a task data set based on the project task;

[0016] A data processing unit, used to obtain the data dimension of the task data set, and determine the resource set of the target project based on the data dimension;

[0017] A resource set processing unit, configured to read the resource set, determine the resource content of the sub-resources in the resource set, and set a resource tag according to the resource content;

[0018] The resource group confirmation unit is used to combine the sub-resources with the same resource tags and generate a resource group.

[0019] Preferably, in a container project isolation platform, the container generation module further includes:

[0020] A security detection unit, configured to perform security detection on files in the target container according to security detection rules after the target container is generated;

[0021] A detection result determination unit, used to determine whether there is a sensitive file in the target container based on the security detection result;

[0022] Wherein, when there are files in the target container that do not comply with the security detection rule, it is determined that there are sensitive files in the target container;

[0023] Otherwise, determining that no sensitive file exists in the target container;

[0024] The cleaning unit is used to clean the sensitive files when there are any in the target container, and remove the sensitive files in the target container based on the processing result.

[0025] Preferably, in a container project isolation platform, the classification module comprises:

[0026] A resource reading unit, used to read N resource groups and obtain resource information of the N resource groups respectively;

[0027] a resource type acquisition unit, configured to input resource information of the N resource groups into a preset type model for training, and determine M resource types of the N resource groups based on the training result, wherein M is less than or equal to N;

[0028] The classification unit is used to extract the type identifiers of the M resource types respectively, and at the same time, obtain the information identifier of the resource information of the resource group, and classify the resource group according to the information identifier and the type identifier.

[0029] Preferably, in a container project isolation platform, the container generation module further includes:

[0030] A packaging unit, used to obtain a packaging format set by the container, and package the resource group based on the packaging format to obtain a resource package;

[0031] A transmission unit, configured to obtain a packet header of the resource packet, match a corresponding target container according to the packet header, determine the data transmission link according to the target container, and upload the resource packet to the target container according to the data transmission link;

[0032] A sorting unit, used to unpack the resource package in the target container, sort the unpacked resource group, determine the identity information of the resource group, and establish a target storage space according to the identity information of the resource group;

[0033] A storage unit is used to store the resource group in the target storage space.

[0034] Preferably, in a container project isolation platform, the container generation module comprises:

[0035] An identifier acquisition unit, used to acquire an identifier number of the target container;

[0036] A naming unit, configured to name the target container based on the identifier number, and obtain a container name of the target container;

[0037] A detection unit, used for placing the container name in a preset name library for screening and detection, and obtaining an output result, wherein the preset name library contains all the container names that have been set;

[0038] a judgment unit, configured to determine whether the container name of the target container is a questionable name according to the output result;

[0039] Wherein, when the output result is No, the container name of the target container is not a questionable name;

[0040] When the output result is YES, the container name of the target container is a questionable name;

[0041] The naming unit is further configured to rename the target container when the container name of the target container is a questionable name, until the container name of the target container is no longer a questionable name;

[0042] The naming unit is further used to configure a host name for the target container after confirming the container name of the target container;

[0043] The container distinguishing unit is used to distinguish the target container based on the container name of the target container and the host name of the target container.

[0044] Preferably, a container project isolation platform, a container generation module, further includes:

[0045] A resource group processing unit, configured to obtain domain name information of the resource group, establish a resource index of the resource group based on the domain name information of the resource group, and match a resource cache node in a preset database according to the resource index;

[0046] A cache area construction unit, used to construct a resource cache area based on the resource cache node;

[0047] A resource reading unit, configured to read a resource data type of the resource group in the resource cache area, and generate a resource cache request in the resource cache area based on the resource data type and the resource index;

[0048] A request reading unit, used to read the resource cache request, obtain the request logic, and at the same time, match the request logic with the prescribed logic to determine whether the resource cache request complies with the request security rules;

[0049] Wherein, when the request logic matches the prescribed logic, it is determined that the resource cache request complies with the request security rule;

[0050] Otherwise, determining that the resource cache request does not comply with the request security rule;

[0051] Wherein, when the resource cache request does not comply with the request security rule, the resource group cannot be cached;

[0052] The resource reading unit is further used to read the memory occupied by the resource group according to the resource cache request that complies with the request security rule, and determine the cache threshold of the resource cache area;

[0053] A data comparison unit, configured to compare the memory occupied by the resource group with the cache threshold, and generate a corresponding control instruction according to the comparison result;

[0054] Wherein, when the memory occupied by the resource group is equal to or greater than the cache threshold, a first control instruction is generated in combination with the resource cache request;

[0055] otherwise, generating a second control instruction in combination with the resource cache request;

[0056] A cache unit is used to cache the resource group in the resource cache area according to the first control instruction or the second control instruction, and complete the caching of the resource group based on the cache result.

[0057] Preferably, in a container project isolation platform, the cache unit further comprises:

[0058] A first instruction execution unit, configured to perform ring processing on the cache area according to the first control instruction to generate a ring cache area, and control the resource group to perform resource caching in the ring cache area according to the first control instruction;

[0059] The second instruction execution unit is configured to directly cache resources of the resource group in the cache area according to the second control instruction.

[0060] Preferably, in a container project isolation platform, the container generation module further includes:

[0061] a parameter acquisition unit, configured to configure a first permission parameter and a second permission parameter for the target container, and to set a first access level according to the first permission parameter and a second access level according to the second permission parameter;

[0062] a permission setting unit, configured to set a primary access permission and a secondary access permission to the target container according to the first access level and the second access level;

[0063] a container receiving unit, configured to read the target resource and determine a resource level of the target resource when a target resource is transmitted to the target container, wherein the resource level includes a first level and a second level, and the first level corresponds to the first level access permission, and the second level corresponds to the second level access permission;

[0064] The container receiving unit is further configured to, when the resource level of the target resource is the first level, determine whether the target resource complies with the first-level access permission, and upload the target resource to the target container when the target resource complies with the first-level access permission, otherwise, not upload;

[0065] When the resource level of the target resource is the second level, determining whether the target resource complies with the second-level access permission, and when the target resource complies with the second-level access permission, uploading the target resource to the target container, otherwise, not uploading;

[0066] A detection unit, configured to perform content detection on the target resource after being uploaded, obtain the information segment of the target resource, and detect the information segment of the target resource with a preset information model, and determine whether there is an error in the information segment of the target resource based on the detection result;

[0067] a storage unit, configured to store the target resource in the target container when there is no error in the information segment of the target resource;

[0068] an early warning unit, configured to, when an error exists in the information segment of the target resource, determine a sub-information segment having an error according to the detection result, wherein the sub-information segment belongs to the information segment, isolate the sub-information segment, and issue an early warning instruction;

[0069] A time recording unit, used to determine the isolation time period of the sub-information segment according to the warning instruction, and at the same time, set an upper threshold of the isolation time;

[0070] A manual operation unit, configured to operate the sub-information segment according to a target operation instruction input by a user when the isolation time period is less than or equal to the isolation time upper limit threshold, wherein the target operation instruction includes: adding trust to the sub-information segment or deleting the sub-information segment;

[0071] The automatic operation unit is used to automatically delete the sub-information segment when the isolation time period is greater than the isolation time upper limit threshold.

[0072] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0073] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0075] Figure 1 A system diagram of a container project isolation platform in an embodiment of the present invention;

[0076] Figure 2 This is a first structural diagram of a project acquisition module in a container project isolation platform in an embodiment of the present invention;

[0077] Figure 3 This is a second structural diagram of a project acquisition module in a container project isolation platform in an embodiment of the present invention. DETAILED DESCRIPTION

[0078] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0079] Embodiment 1:

[0080] This embodiment provides a container project isolation platform, such as Figure 1 As shown, including:

[0081] A project acquisition module, used to acquire a target project and determine a resource group of the target project;

[0082] A classification module, used for extracting resource types of resource groups and classifying the resource groups according to the resource types;

[0083] The container generation module is used to generate a corresponding target container according to the classification result, and at the same time, package the resource group and add it to the target container to achieve isolation of the container project.

[0084] In this embodiment, the target project may be a project running in a computer environment, wherein the target project includes multiple resource groups.

[0085] In this embodiment, the resource type may be the type of work completed by the resource group. For example, a project includes n parts, where each department represents a resource type.

[0086] In this embodiment, the target container may be formed by combining resource groups with consistent resource types. For example, one department is one container, and one staff member in the department is one resource group.

[0087] The beneficial effect of the above technical solution is: by determining the resource group and classifying the resource group according to the resource type of the resource group, and then generating the target container, it is beneficial to achieve physical isolation of the resource group, thereby improving the operating efficiency of the target project.

[0088] Embodiment 2:

[0089] Based on Example 1, this example provides a container project isolation platform, such as Figure 2As shown, the project acquisition module includes:

[0090] An instruction acquisition unit, used for determining a project extraction instruction based on target requirements;

[0091] An instruction analysis unit, used to analyze the project extraction instruction and obtain instruction keywords;

[0092] A mapping unit, configured to establish a mapping relationship between the instruction keyword and a preset project library according to the instruction keyword, and determine a target project corresponding to the instruction keyword according to the mapping relationship;

[0093] An extraction unit is used to extract the target item based on the item extraction instruction.

[0094] In this embodiment, the target requirement may be a requirement for determining a target project, and the project extraction instruction is determined based on the target requirement.

[0095] In this embodiment, the instruction keyword may be the core content of the project extraction instruction determined after analyzing the project extraction instruction, wherein the core content is the instruction keyword.

[0096] In this embodiment, the preset project library may be pre-stored in the computer, wherein there are multiple projects in the preset project library, and the target project can be obtained according to the keywords of the project extraction instruction.

[0097] In this embodiment, the project extraction instruction is used to extract the target project.

[0098] The beneficial effect of the above technical solution is that by determining the target requirements, it is helpful to accurately determine the project extraction instructions, thereby realizing the extraction of the target project, greatly improving the accuracy of obtaining the target project, and thus providing a basis for the subsequent isolation of the container.

[0099] Embodiment 3:

[0100] Based on Example 1, this example provides a container project isolation platform, such as Figure 3 As shown, the project acquisition module further includes:

[0101] A target project reading unit, configured to read a project task of the target project and determine a task data set based on the project task;

[0102] A data processing unit, used to obtain the data dimension of the task data set, and determine the resource set of the target project based on the data dimension;

[0103] A resource set processing unit, configured to read the resource set, determine the resource content of the sub-resources in the resource set, and set a resource tag according to the resource content;

[0104] The resource group confirmation unit is used to combine the sub-resources with the same resource tags and generate a resource group.

[0105] In this embodiment, the project task may be work that needs to be performed for the target project.

[0106] In this embodiment, the task data set may be data to be executed by the project task.

[0107] In this embodiment, the data dimension of the task data set may be obtained by classifying the task data set, thereby determining the data dimension of the task data set according to the classification result, and the data dimension is determined in order to obtain the resource set.

[0108] In this embodiment, the resource tag may be determined by the resource content, and is used to identify each sub-resource.

[0109] The beneficial effects of the above technical solution are: by reading the target project to determine the project task, and then determine the resource set, by marking the content of each sub-resource, the sub-resources are classified, and then a resource group is formed. The above method greatly improves the accuracy of the formation of resource groups, thereby ensuring the accuracy of the container generated by isolating the resource group.

[0110] Embodiment 4:

[0111] Based on Example 1, this embodiment provides a container project isolation platform, wherein the container generation module further includes:

[0112] A security detection unit, configured to perform security detection on files in the target container according to security detection rules after the target container is generated;

[0113] A detection result determination unit, used to determine whether there is a sensitive file in the target container based on the security detection result;

[0114] Wherein, when there are files in the target container that do not comply with the security detection rule, it is determined that there are sensitive files in the target container;

[0115] Otherwise, determining that no sensitive file exists in the target container;

[0116] The cleaning unit is used to clean the sensitive files when there are any in the target container, and remove the sensitive files in the target container based on the processing result.

[0117] In this embodiment, the security detection rule may be a rule set for performing security detection on the target container in order to improve the security of the target container.

[0118] In this embodiment, the sensitive file may be a file that poses a security risk to the target container, such as a malicious file.

[0119] The beneficial effect of the above technical solution is: the files in the target container are detected through security detection rules, and when sensitive files exist in the files, cleaning and removal operations are performed, which greatly improves the security of the target container, thereby facilitating improving the operation efficiency of the project.

[0120] Embodiment 5:

[0121] Based on Example 1, this embodiment provides a classification module of a container project isolation platform, including:

[0122] A resource reading unit, used to read N resource groups and obtain resource information of the N resource groups respectively;

[0123] a resource type acquisition unit, configured to input resource information of the N resource groups into a preset type model for training, and determine M resource types of the N resource groups based on the training result, wherein M is less than or equal to N;

[0124] The classification unit is used to extract the type identifiers of the M resource types respectively, and at the same time, obtain the information identifier of the resource information of the resource group, and classify the resource group according to the information identifier and the type identifier.

[0125] In this embodiment, the resource information may be part of the information of the resource group during the operation of the target project.

[0126] In this embodiment, the type model may be a model generated through training in the system, and is used to obtain the type of the resource group.

[0127] In this embodiment, the type identifier may represent a type of resource.

[0128] The beneficial effect of the above technical solution is: by determining the resource information of the resource group and inputting the resource information into a pre-set type model for training, it is helpful to determine the resource type of the resource group, and then classify the resource group by resource identification, which is helpful to improve the accuracy of resource classification, thereby indirectly improving the accuracy of container generation and improving the efficiency of physical isolation of resource groups.

[0129] Embodiment 6:

[0130] Based on Example 1, this embodiment provides a container project isolation platform, wherein the container generation module further includes:

[0131] A packaging unit, used to obtain a packaging format set by the container, and package the resource group based on the packaging format to obtain a resource package;

[0132] A transmission unit, configured to obtain a packet header of the resource packet, match a corresponding target container according to the packet header, determine the data transmission link according to the target container, and upload the resource packet to the target container according to the data transmission link;

[0133] A sorting unit, used to unpack the resource package in the target container, sort the unpacked resource group, determine the identity information of the resource group, and establish a target storage space according to the identity information of the resource group;

[0134] A storage unit is used to store the resource group in the target storage space.

[0135] In this embodiment, the packaging format may be pre-set in order to achieve a unified format when uploading the resource group.

[0136] In this embodiment, the identity information of the resource group may be the identity represented by each resource group.

[0137] The beneficial effect of the above technical solution is: the resource group is packaged and encapsulated according to the set packaging format, which is conducive to achieving the unification of the upload format of the resource group. By establishing a storage space, it is conducive to the reasonable storage of each resource and improves the management of the resource group.

[0138] Embodiment 7:

[0139] Based on Example 1, this embodiment provides a container project isolation platform, wherein the container generation module includes:

[0140] An identifier acquisition unit, used to acquire an identifier number of the target container;

[0141] A naming unit, configured to name the target container based on the identifier number, and obtain a container name of the target container;

[0142] A detection unit, used for placing the container name in a preset name library for screening and detection, and obtaining an output result, wherein the preset name library contains all the container names that have been set;

[0143] a judgment unit, configured to determine whether the container name of the target container is a questionable name according to the output result;

[0144] Wherein, when the output result is No, the container name of the target container is not a questionable name;

[0145] When the output result is YES, the container name of the target container is a questionable name;

[0146] The naming unit is further configured to rename the target container when the container name of the target container is a questionable name, until the container name of the target container is no longer a questionable name;

[0147] The naming unit is further used to configure a host name for the target container after confirming the container name of the target container;

[0148] The container distinguishing unit is used to distinguish the target container based on the container name of the target container and the host name of the target container.

[0149] In this embodiment, the identifier number is a label used to mark the target container, and different target containers can be quickly and accurately distinguished by the identifier number.

[0150] In this embodiment, the preset name library is set in advance, and multiple container names are stored therein. The multiple container names are used to verify the set container name to determine whether the set container name is compliant.

[0151] In this embodiment, the questionable name refers to whether there are illegal characters in the set container name and whether the set container name is repeated with an existing name in the preset name library.

[0152] The beneficial effect of the above technical solution is: by naming different target containers and verifying the set names, it is ensured that the name of each target container is legal and compliant and there is no duplication, thereby accurately achieving clear and effective isolation of different categories of resources within the project, thereby improving the operating efficiency of the target project.

[0153] Embodiment 8:

[0154] Based on the above embodiment 1, this embodiment provides a container project isolation platform, a container generation module, and further includes:

[0155] A resource group processing unit, configured to obtain domain name information of the resource group, establish a resource index of the resource group based on the domain name information of the resource group, and match a resource cache node in a preset database according to the resource index;

[0156] A cache area construction unit, used to construct a resource cache area based on the resource cache node;

[0157] A resource reading unit, configured to read a resource data type of the resource group in the resource cache area, and generate a resource cache request in the resource cache area based on the resource data type and the resource index;

[0158] A request reading unit, used to read the resource cache request, obtain the request logic, and at the same time, match the request logic with the prescribed logic to determine whether the resource cache request complies with the request security rules;

[0159] Wherein, when the request logic matches the prescribed logic, it is determined that the resource cache request complies with the request security rule;

[0160] Otherwise, determining that the resource cache request does not comply with the request security rule;

[0161] Wherein, when the resource cache request does not comply with the request security rule, the resource group cannot be cached;

[0162] The resource reading unit is further used to read the memory occupied by the resource group according to the resource cache request that complies with the request security rule, and determine the cache threshold of the resource cache area;

[0163] A data comparison unit, configured to compare the memory occupied by the resource group with the cache threshold, and generate a corresponding control instruction according to the comparison result;

[0164] Wherein, when the memory occupied by the resource group is equal to or greater than the cache threshold, a first control instruction is generated in combination with the resource cache request;

[0165] otherwise, generating a second control instruction in combination with the resource cache request;

[0166] A cache unit is used to cache the resource group in the resource cache area according to the first control instruction or the second control instruction, and complete the caching of the resource group based on the cache result.

[0167] In this embodiment, the domain name information refers to the name and location of the area cached by the resource group.

[0168] In this embodiment, the resource index refers to a search directory created according to the parameters of the resource group.

[0169] In this embodiment, the preset database is set in advance and has multiple resource cache nodes stored internally.

[0170] In this embodiment, the resource cache node is used to store resource information.

[0171] In this embodiment, the resource cache request refers to a resource cache request instruction sent to the resource cache area. The resource cache area parses the resource cache request to determine whether the resource can be cached.

[0172] In this embodiment, the prescribed logic is set in advance and is used to verify the request logic and determine whether the request sequence and request rules in the request logic meet the requirements.

[0173] In this embodiment, the cache threshold is used to represent the quantity of resources that can be cached in the resource cache area.

[0174] In this embodiment, the first control instruction performs circular processing on the cache area to generate a circular cache area, and controls the resource group to cache resources in the circular cache area according to the first control instruction, wherein the circular cache area expands the resource cache area on the basis of the resource cache area to increase the cache threshold of the resource cache area.

[0175] In this embodiment, the second control instruction directly caches the resources of the resource group in the cache area.

[0176] The beneficial effect of the above technical solution is: by determining the resource information within the project and creating a resource cache area based on the resource information, effective management of resources is achieved, which makes it easy to quickly and effectively place the corresponding resources into the corresponding target container when isolating the resources within the project, which is conducive to achieving physical isolation of the resource group, thereby improving the operating efficiency of the target project.

[0177] Embodiment 9:

[0178] Based on the above embodiment 1, this embodiment provides a container project isolation platform, wherein the container generation module further includes:

[0179] a parameter acquisition unit, configured to configure a first permission parameter and a second permission parameter for the target container, and to set a first access level according to the first permission parameter and a second access level according to the second permission parameter;

[0180] a permission setting unit, configured to set a primary access permission and a secondary access permission to the target container according to the first access level and the second access level;

[0181] a container receiving unit, configured to read the target resource and determine a resource level of the target resource when a target resource is transmitted to the target container, wherein the resource level includes a first level and a second level, and the first level corresponds to the first level access permission, and the second level corresponds to the second level access permission;

[0182] The container receiving unit is further configured to, when the resource level of the target resource is the first level, determine whether the target resource complies with the first-level access permission, and upload the target resource to the target container when the target resource complies with the first-level access permission, otherwise, not upload;

[0183] When the resource level of the target resource is the second level, determining whether the target resource complies with the second-level access permission, and when the target resource complies with the second-level access permission, uploading the target resource to the target container, otherwise, not uploading;

[0184] A detection unit, configured to perform content detection on the target resource after being uploaded, obtain the information segment of the target resource, and detect the information segment of the target resource with a preset information model, and determine whether there is an error in the information segment of the target resource based on the detection result;

[0185] a storage unit, configured to store the target resource in the target container when there is no error in the information segment of the target resource;

[0186] an early warning unit, configured to, when an error exists in the information segment of the target resource, determine a sub-information segment having an error according to the detection result, wherein the sub-information segment belongs to the information segment, isolate the sub-information segment, and issue an early warning instruction;

[0187] A time recording unit, used to determine the isolation time period of the sub-information segment according to the warning instruction, and at the same time, set an upper threshold of the isolation time;

[0188] A manual operation unit, configured to operate the sub-information segment according to a target operation instruction input by a user when the isolation time period is less than or equal to the isolation time upper limit threshold, wherein the target operation instruction includes: adding trust to the sub-information segment or deleting the sub-information segment;

[0189] The automatic operation unit is used to automatically delete the sub-information segment when the isolation time period is greater than the isolation time upper limit threshold.

[0190] In this embodiment, the first permission parameter and the second permission parameter refer to permission parameter data used to describe the target container when receiving user access.

[0191] In this embodiment, the first access level and the second access level refer to the strictness of the target container when receiving user access.

[0192] In this embodiment, the first-level access permission and the second-level access permission refer to the access permissions set for the user. For example, the access permission of user A is the first-level access permission, which means that he can access the resources inside the S target container as well as the resources inside the W target container. The access permission of user B is the second-level access permission, which means that he can only access the resources inside the S target container, where S and W represent the names of the target containers.

[0193] In this embodiment, the target resource refers to the resource that needs to be uploaded to the target container.

[0194] In this embodiment, the information segment of the target resource refers to key data information in the target resource that can represent the target resource, for example, it may be the data type representing the target resource, the function realized by the target resource, etc., and there are no less than two information segments.

[0195] In this embodiment, the preset information model is built in advance and is used to detect whether there is error information in the target resource.

[0196] In this embodiment, the sub-information segment refers to an information segment in which an error occurs in the target resource information segment, and is a part of the target resource information segment.

[0197] In this embodiment, the target operation instruction is sent by the user and is used to perform corresponding processing on the sub-information segment, including adding trust to the sub-information segment or deleting the sub-information segment.

[0198] The beneficial effects of the above technical solution are: by setting permissions for the internal resources of the target container, the security and strictness of the internal resources of the target container are ensured, and at the same time, error detection is performed on the internal resources of the target container to ensure the correctness of the internal resources of the target container. At the same time, when erroneous data appears in the target container, the erroneous data in the container is deleted or repaired in time, thereby improving the operating efficiency of the target project.

[0199] Embodiment 10:

[0200] On the basis of Example 1, it also includes:

[0201] A data acquisition unit, used to acquire a container index value of each container in the target project;

[0202] A first calculation unit, configured to calculate an operation entropy value of the target container according to a container index value of each container in the target project;

[0203]

[0204] Wherein, δ represents the running entropy value of the target container; k represents the total number of the target containers in the target project; g1 represents the container index value of the first container in the target project; g2 represents the container index value of the second container in the target project; g k represents the container index value of the kth container in the target project; max(g1,g2,...g k ) represents the maximum value of the container index value in the target project; min(g1,g2,...g k) represents the minimum value of the container index in the target project; a represents a constant, which is generally 1, and k is greater than or equal to 3;

[0205] The data acquisition unit is further used to acquire the total number of containers of the target project and the response ratio of the target containers in the target project;

[0206] A first calculation unit, configured to calculate the importance of each container in the target project based on the response ratio of the target container in the target project, the total number of containers in the target project, and the running entropy value of the target container;

[0207]

[0208] in, represents the importance of the j-th container in the target project; δ represents the running entropy value of the target project; j represents the current target container; T j represents the response time of the jth container; represents the total response time of the target project; Indicates the response ratio of the target container in the target project; m j represents the number of connections of the j-th target container in the target project; Indicates the total number of connections of the target project;

[0209] The project management and control unit is used to sort the containers in descending order of importance according to the importance of the containers in the target project, and complete the management and control of the target project based on the sorting result.

[0210] In this embodiment, for When the value of a is 1, the value of k is 3; g1 = 1; g2 = 2; g k =g3=3, then the value of δ is 2.1.

[0211] In this embodiment, for When j = 2, k = 3, δ = 2.1, T1 = 2, T2 = 3, T3 = 5; and m1 = 1, m2 = 2, m3 = 4, then The value of Therefore, it can be known from the calculation results that the importance of the second container in the total project is 0.18.

[0212] The beneficial effect of the above technical solution is that by obtaining the container index value of each container in the target project, it is helpful to accurately calculate the operating entropy value of the target container, and then calculate the importance of each container in the target project through the operating entropy value of the target container, and sort the containers according to the importance, so as to realize the management and control of each container in the target project, which is conducive to improving the operating efficiency of the target project.

[0213] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A container project isolation platform, characterized in that: include: A project acquisition module, used to acquire a target project and determine a resource group of the target project; A classification module, used for extracting resource types of resource groups and classifying the resource groups according to the resource types; A container generation module, used to generate a corresponding target container according to the classification result, and at the same time, package the resource group and add it to the target container to achieve isolation of the container project; The container generation module further includes: a parameter acquisition unit, configured to configure a first permission parameter and a second permission parameter for the target container, and to set a first access level according to the first permission parameter and a second access level according to the second permission parameter; a permission setting unit, configured to set a primary access permission and a secondary access permission to the target container according to the first access level and the second access level; a container receiving unit, configured to read the target resource and determine a resource level of the target resource when a target resource is transmitted to the target container, wherein the resource level includes a first level and a second level, and the first level corresponds to the first level access permission, and the second level corresponds to the second level access permission; The container receiving unit is further configured to, when the resource level of the target resource is the first level, determine whether the target resource complies with the first-level access permission, and upload the target resource to the target container when the target resource complies with the first-level access permission, otherwise, not upload; When the resource level of the target resource is the second level, determining whether the target resource complies with the second-level access permission, and when the target resource complies with the second-level access permission, uploading the target resource to the target container, otherwise, not uploading; A detection unit, configured to perform content detection on the target resource after being uploaded, obtain the information segment of the target resource, and detect the information segment of the target resource with a preset information model, and determine whether there is an error in the information segment of the target resource based on the detection result; a storage unit, configured to store the target resource in the target container when there is no error in the information segment of the target resource; an early warning unit, configured to, when an error exists in the information segment of the target resource, determine a sub-information segment having an error according to the detection result, wherein the sub-information segment belongs to the information segment, isolate the sub-information segment, and issue an early warning instruction; A time recording unit, used to determine the isolation time period of the sub-information segment according to the warning instruction, and at the same time, set an upper threshold of the isolation time; A manual operation unit, configured to operate the sub-information segment according to a target operation instruction input by a user when the isolation time period is less than or equal to the isolation time upper limit threshold, wherein the target operation instruction includes: adding trust to the sub-information segment or deleting the sub-information segment; The automatic operation unit is used to automatically delete the sub-information segment when the isolation time period is greater than the isolation time upper limit threshold.

2. A container project isolation platform according to claim 1, characterized in that: The project acquisition module includes: An instruction acquisition unit, used for determining a project extraction instruction based on target requirements; An instruction analysis unit, used to analyze the project extraction instruction and obtain instruction keywords; A mapping unit, configured to establish a mapping relationship between the instruction keyword and a preset project library according to the instruction keyword, and determine a target project corresponding to the instruction keyword according to the mapping relationship; An extraction unit is used to extract the target item based on the item extraction instruction.

3. A container project isolation platform according to claim 1, characterized in that: The project acquisition module further includes: A target project reading unit, configured to read a project task of the target project and determine a task data set based on the project task; A data processing unit, used to obtain the data dimension of the task data set, and determine the resource set of the target project based on the data dimension; A resource set processing unit, configured to read the resource set, determine the resource content of the sub-resources in the resource set, and set a resource tag according to the resource content; The resource group confirmation unit is used to combine the sub-resources with the same resource tags and generate a resource group.

4. A container project isolation platform according to claim 1, characterized in that: The container generation module further includes: A security detection unit, configured to perform security detection on files in the target container according to security detection rules after the target container is generated; A detection result determination unit, used to determine whether there is a sensitive file in the target container based on the security detection result; Wherein, when there are files in the target container that do not comply with the security detection rule, it is determined that there are sensitive files in the target container; Otherwise, determining that no sensitive file exists in the target container; The cleaning unit is used to clean the sensitive files when there are any in the target container, and remove the sensitive files in the target container based on the processing result.

5. A container project isolation platform according to claim 1, characterized in that: The classification module comprises: A resource reading unit, used to read N resource groups and obtain resource information of the N resource groups respectively; a resource type acquisition unit, configured to input resource information of the N resource groups into a preset type model for training, and determine M resource types of the N resource groups based on the training result, wherein M is less than or equal to N; The classification unit is used to extract the type identifiers of the M resource types respectively, and at the same time, obtain the information identifier of the resource information of the resource group, and classify the resource group according to the information identifier and the type identifier.

6. A container project isolation platform according to claim 1, characterized in that: The container generation module further includes: A packaging unit, used to obtain a packaging format set by the container, and package the resource group based on the packaging format to obtain a resource package; A transmission unit, configured to obtain a packet header of the resource packet, match a corresponding target container according to the packet header, determine a data transmission link according to the target container, and upload the resource packet to the target container according to the data transmission link; A sorting unit, used to unpack the resource package in the target container, sort the unpacked resource group, determine the identity information of the resource group, and establish a target storage space according to the identity information of the resource group; A storage unit is used to store the resource group in the target storage space.

7. A container item isolation platform according to claim 1, characterized in that: The container generation module includes: An identifier acquisition unit, used to acquire an identifier number of the target container; A naming unit, configured to name the target container based on the identifier number, and obtain a container name of the target container; A detection unit, used for placing the container name in a preset name library for screening and detection, and obtaining an output result, wherein the preset name library contains all the container names that have been set; a judgment unit, configured to determine whether the container name of the target container is a questionable name according to the output result; Wherein, when the output result is No, the container name of the target container is not a questionable name; When the output result is YES, the container name of the target container is a questionable name; The naming unit is further configured to rename the target container when the container name of the target container is a questionable name, until the container name of the target container is no longer a questionable name; The naming unit is further used to configure a host name for the target container after confirming the container name of the target container; The container distinguishing unit is used to distinguish the target container based on the container name of the target container and the host name of the target container.

8. A container item isolation platform according to claim 1, characterized in that: The container generation module also includes: A resource group processing unit, configured to obtain domain name information of the resource group, establish a resource index of the resource group based on the domain name information of the resource group, and match a resource cache node in a preset database according to the resource index; A cache area construction unit, used to construct a resource cache area based on the resource cache node; A resource reading unit, configured to read a resource data type of the resource group in the resource cache area, and generate a resource cache request in the resource cache area based on the resource data type and the resource index; A request reading unit, used to read the resource cache request, obtain the request logic, and at the same time, match the request logic with the prescribed logic to determine whether the resource cache request complies with the request security rules; Wherein, when the request logic matches the prescribed logic, it is determined that the resource cache request complies with the request security rule; Otherwise, determining that the resource cache request does not comply with the request security rule; Wherein, when the resource cache request does not comply with the request security rule, the resource group cannot be cached; The resource reading unit is further used to read the memory occupied by the resource group according to the resource cache request that complies with the request security rule, and determine the cache threshold of the resource cache area; A data comparison unit, configured to compare the memory occupied by the resource group with the cache threshold, and generate a corresponding control instruction according to the comparison result; Wherein, when the memory occupied by the resource group is equal to or greater than the cache threshold, a first control instruction is generated in combination with the resource cache request; otherwise, generating a second control instruction in combination with the resource cache request; A cache unit is used to cache the resource group in the resource cache area according to the first control instruction or the second control instruction, and complete the caching of the resource group based on the cache result.

9. A container item isolation platform according to claim 8, characterized in that: The cache unit further includes: A first instruction execution unit, configured to perform ring processing on the cache area according to the first control instruction to generate a ring cache area, and control the resource group to perform resource caching in the ring cache area according to the first control instruction; The second instruction execution unit is configured to directly cache resources of the resource group in the cache area according to the second control instruction.

Images