Container operation method and apparatus

Abstract

This invention discloses a container operation method and apparatus. The method includes: receiving communication information sent to a target application; based on the communication information, obtaining a target container in a container space corresponding to the target application from which the process running the target application is located; wherein the container space corresponding to the target application has a unique correspondence with a set range of container encoding values; and sending the communication information to the target container, enabling the process of the target application to receive the communication information. This invention solves the technical problem caused by potentially poor isolation between containers within a system.

Description

Technical Field

[0001] This invention relates to the fields of operating system security and network security technology, and more specifically, to a container operation method and apparatus. Background Technology

[0002] LXC (Linux Container) is a kernel virtualization technology that provides lightweight virtualization to isolate processes and resources without requiring instruction interpretation mechanisms or the other complexities of full virtualization. It's analogous to namespaces in C++. In Linux systems or Linux-based systems, containers effectively divide resources managed by a single operating system into isolated groups, better balancing conflicting resource usage demands among these groups.

[0003] Due to the superior characteristics of container technology, it is now being used in other Linux-based systems. With the development of terminal technology, more and more applications can be installed and used on terminals, which in turn puts forward higher requirements for the isolation performance between different containers.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a container operation method and apparatus to at least solve the technical problem caused by poor isolation of containers within a system.

[0006] According to one aspect of the present invention, a container operation method is provided, comprising:

[0007] Receive communication information sent to the target application;

[0008] Based on the communication information, the target container for the process running the target application is obtained in the container space corresponding to the target application; the container space corresponding to the target application has a unique correspondence with the set container encoding value range;

[0009] The communication information is sent to the target container so that the process of the target application can receive the communication information.

[0010] Optionally, the container operation methods also include:

[0011] Upon receiving a launch command for the target application, obtain the user identity identifier corresponding to the target application;

[0012] Based on the user identity identifier of the target application, determine the container space corresponding to the target application;

[0013] Within the container space, the target container is started according to the container code determined based on the user identity identifier;

[0014] The process of the target application runs within the target container.

[0015] Optionally, the container operation methods also include:

[0016] Upon receiving the creation instruction of the target application, obtain container space with unoccupied container code;

[0017] The container space with unoccupied container code is used as the corresponding container space for the target application;

[0018] The container code of the target container is determined based on the unoccupied container codes within the set container code value range of the corresponding container space of the target application.

[0019] The container code of the target container is used as the user identity identifier of the target application.

[0020] Optionally, obtaining container space with unoccupied container codes includes:

[0021] If no container space with unused container code exists in the current container system, create a new container space.

[0022] The new container space is used as the container space with the unoccupied container code.

[0023] Optionally, obtaining container space with unoccupied container codes includes:

[0024] If there are container spaces with remaining capacity in the current container system, the container spaces with remaining capacity are used as the container spaces with unoccupied container codes.

[0025] Optionally, the container operation methods also include:

[0026] Once the main system has finished booting, start the container system of the main system;

[0027] In the container system, start the created container space;

[0028] In each of the container spaces, launch the container space incubator;

[0029] In each container space, a container space system service is launched based on the container space incubator. The container space system service is used to store the correspondence information between the container code and the application in the container space.

[0030] According to another aspect of the present invention, a container operating device is also provided, comprising:

[0031] The receiving module is used to receive communication information sent to the target application;

[0032] The target container acquisition module is used to acquire the target container of the process running the target application in the container space corresponding to the target application based on the communication information; the container space corresponding to the target application has a unique correspondence with the set container code value range;

[0033] A sending module is used to send the communication information to the target container, so that the process of the target application can receive the communication information.

[0034] Optionally, the container operating device further includes:

[0035] The user identity identifier acquisition module is used to obtain the user identity identifier corresponding to the target application when the target application launch instruction is received.

[0036] The user identity identifier module is used to determine the container space corresponding to the target application based on the user identity identifier of the target application.

[0037] The target container startup module is used to start the target container in the container space based on the user identity identifier as the container code;

[0038] The runtime module is used to run the process of the target application within the target container.

[0039] Optionally, the container operating device further includes:

[0040] The container space acquisition module is used to acquire container space with unoccupied container code when the target application's creation instruction is received;

[0041] A container space processing module is used to use the container space with unoccupied container code as the corresponding container space of the target application.

[0042] The container code determination module is used to determine the container code of the target container based on the unoccupied container codes within the set container code value range of the corresponding container space of the target application.

[0043] The container encoding processing module is used to use the container encoding of the target container as the user identity identifier of the target application.

[0044] Optionally, the container space acquisition module includes:

[0045] Create a unit to create a new container space if no container space with unused container code exists in the current container system;

[0046] The first operation unit is used to treat the new container space as the container space with the unoccupied container code.

[0047] Optionally, the container space acquisition module includes:

[0048] The second operation unit is used to, when there is a container space with remaining capacity in the current container system, use the container space with remaining capacity as the container space with unoccupied container code.

[0049] Optionally, the container operating device further includes:

[0050] The first startup module is used to start the container system of the main system after the main system has finished starting.

[0051] The second startup module is used to start the created container space in the container system;

[0052] The third startup module is used to start the container space incubator in each of the container spaces;

[0053] The fourth startup module is used to start the container space system service in each container space based on the container space incubator. The container space system service is used to store the correspondence information between the container code and the application in the container space.

[0054] According to another aspect of the present invention, a storage medium is also provided, the storage medium including a stored program, wherein, when the program is executed, the device where the storage medium is located is controlled to perform the container operation method provided in any embodiment of the present invention.

[0055] According to another aspect of the present invention, a processor is also provided, characterized in that the processor is used to run a program, wherein the program executes the container operation method provided in any embodiment of the present invention during runtime.

[0056] In this embodiment of the invention, by setting a unique container code range for each container space, the degree of container isolation is improved by avoiding the duplication of container codes, thereby achieving the technical effect of improving system security and solving the technical problem caused by poor isolation of containers in the system. Attached Figure Description

[0057] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0058] Figure 1 This is a schematic diagram of a container operation method according to an embodiment of the present invention;

[0059] Figure 2 This is a schematic diagram of an optional container operation method according to an embodiment of the present invention;

[0060] Figure 3 This is a schematic diagram of an optional container operation method according to an embodiment of the present invention;

[0061] Figure 4 This is a schematic diagram of an optional container operation method according to an embodiment of the present invention;

[0062] Figure 5 This is a schematic diagram of an optional container operation method according to an embodiment of the present invention;

[0063] Figure 6 This is a schematic diagram of a system startup according to an embodiment of the present invention;

[0064] Figure 7 This is a schematic diagram of a container operating device according to an embodiment of the prior art;

[0065] Figure 8 This is a schematic diagram of an optional container operating device according to an embodiment of the present invention;

[0066] Figure 9 This is a schematic diagram of an optional container operating device according to an embodiment of the present invention;

[0067] Figure 10 This is a schematic diagram of an optional container operating device according to an embodiment of the present invention;

[0068] Figure 11 This is a schematic diagram of an optional container operating device according to an embodiment of the present invention;

[0069] Figure 12 This is a schematic diagram of an optional container operating device according to an embodiment of the present invention. Detailed Implementation

[0070] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0071] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0072] According to an embodiment of the present invention, a container operation method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0073] The container-based operation method of this invention can be applied to devices with a central processing unit (CPU). For example, when deployed on a terminal, server, or other processing device, the device can perform system startup, container creation, container system creation, container system startup, application execution, and so on. The terminal can be a user equipment (UE), mobile device, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, in-vehicle device, wearable device, etc. In some possible implementations, the method can also be implemented by the processor calling computer-readable instructions stored in memory.

[0074] Figure 1 This is a container operation method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0075] Step S11: Receive communication information sent to the target application;

[0076] Step S12: Based on the communication information, obtain the target container of the process running the target application in the container space corresponding to the target application; the container space corresponding to the target application has a unique correspondence with the set container encoding value range;

[0077] Step S13: Send the communication information to the target container so that the process of the target application can receive the communication information.

[0078] In this embodiment, the target application can be any application that can be installed on a computer terminal. The process of the target application can be a process that, after the target application is started, is used to process the relevant data of the target application and communicate with other modules or devices when necessary.

[0079] The communication information sent to the target application can be any communication information sent to the target application by any module or device that can invoke or communicate with the target application. Simultaneously, the communication information sent to the target application can be initiated by other applications, modules, or devices, or it can be communication information sent by other applications, modules, or devices in response to the target application.

[0080] In this embodiment, before receiving communication information sent to the target application, the process may further include sending communication information about the target application's process to the recipient. The recipient can be any party used to communicate with the target application, such as a server, or other modules or applications installed on the target application's terminal. Any module or device that interacts with the target application during its operation can serve as the recipient in this embodiment.

[0081] In one possible implementation, the communication information sent to the target application may carry an encoding or identifier for identifying the target application, thereby enabling the determination of the container space number corresponding to the target application or the container encoding of the process running the target application through the encoding or identifier.

[0082] In this embodiment, the container space can be a space where a series of containers run, or it can be a space within the container system of the terminal system used to house containers. The container system can be created based on the terminal system, which can be a system such as Linux or Android.

[0083] In this embodiment, the terminal system can refer to an Android multi-container system based on LXC technology, utilizing the namespace and CGroup features in the Linux Kernel, and based on the Android system environment.

[0084] In some possible implementations, when a large number of applications are installed on the terminal, the terminal can create and start multiple container spaces. After the terminal creates and starts the container system, it can start all created container spaces, or start a container space when the application corresponding to the container code within that container space starts. After a container space starts, it can start the containers already created within that container space, or it can start the corresponding container after the application corresponding to the container code has started.

[0085] In one possible implementation, the target container that runs the process of the target application can be a container used to house and run the process of the target application. There can be a one-to-one correspondence between an application and its container, and the target container can be one of multiple containers running in the container space.

[0086] In this embodiment, the container can be an LXC (Linux Container) container. LXC in this embodiment can be a kernel virtualization technology that provides lightweight virtualization to isolate processes and resources, without requiring instruction interpretation mechanisms or other complex operations of full virtualization. Each container space provides a range of encodings for the container; the encoding of containers created or run within a container space can be any value within that range. Container and container space technologies can effectively divide resources managed by a single operating system into isolated groups, better balancing conflicting resource usage demands among these isolated groups.

[0087] In one possible implementation, a process may also include threads.

[0088] In one possible implementation, a container space can contain a set number of containers. Furthermore, a container system can have multiple container spaces, and the number of containers that can exist in each container space can be the same or different. For example, each container space can be set to contain N containers, where N can be any integer greater than 1. Each container space uniquely corresponds to a set range of container encoding values.

[0089] For example, for the Xth container space in the container system, its uniquely set container code value range is [Y, Z), where Y and Z are any integers greater than or equal to 1, and Z > Y. Then, in the Xth container space, the container code X0 of each container must satisfy Y ≤ X0 < Z.

[0090] Since each container space uniquely corresponds to a set range of container code values, the ranges of container code values ​​for different container spaces are different and do not overlap. The number of container codes within a container code value range can be equal to the number of containers that can exist in the container space.

[0091] In another possible implementation, the container encoding can also be a decimal, binary, octal, etc. When the container encoding can be a decimal, binary, or octal number, the range of values ​​for the container encoding corresponding to the container space can be a decimal range, a binary range, an octal range, etc.

[0092] For example, for the Xth container space in a container system, the container code value range is set A; for the Mth (M≠X)th container space in a container system, the container code value range is set B.

[0093] In the container space corresponding to the target application, the target container of the process running the target application is obtained. This can be done by determining the target container of the process running the target application based on communication information, and may include determining the container code of the target container.

[0094] Sending communication information to the target container can be done by sending the communication information to the target container based on the container code of the target container.

[0095] In this embodiment, the container space and the set container code value range have a unique correspondence, so that the container codes of containers in different container spaces will not be repeated or the same, which improves the distinguishability of each container in the container space and thus improves the degree of isolation between different containers.

[0096] In one implementation, such as Figure 2 As shown, the container operation methods also include:

[0097] Step S21: Upon receiving the target application launch command, obtain the user identity identifier (UID, User ID) corresponding to the target application;

[0098] Step S22: Determine the container space corresponding to the target application based on the user identity identifier of the target application;

[0099] Step S23: In the container space, start the target container according to the container code determined based on the user identity identifier;

[0100] Step S24: Run the process of the target application in the target container.

[0101] In one possible implementation, the UID corresponding to the target application can be determined when the target application is installed or created on the terminal. After the UID of the target application is determined, the container code of the target container in which the process of the target application runs can also be uniquely determined.

[0102] Since the container space and container code have a unique value range in this embodiment of the invention, each container code also has a unique correspondence with a container space. The container code of the target container can be determined through the UID corresponding to the target application, and thus the container space uniquely corresponding to the target application can be determined through the container code.

[0103] In this embodiment, starting a target container in the container space based on the user's identity identifier as the container code may include: determining the target container in the container space based on the container code, and starting or creating the target container.

[0104] The process of the target application runs within the target container, which may include the process of launching the target application within the target container.

[0105] In this embodiment, the target container can be determined based on the unique UID of the target application, and the process of the target application can be run in the target container. This enables the execution process of the target application to be well isolated, ensuring the security and stability of the target application.

[0106] In one implementation, such as Figure 3 As shown, the container operation methods also include:

[0107] Step S31: Upon receiving the creation instruction of the target application, obtain container space with unoccupied container code;

[0108] Step S32: Use the container space with unoccupied container code as the corresponding container space for the target application;

[0109] Step S33: Determine the container code of the target container based on the unoccupied container codes within the set container code value range of the target application's corresponding container space;

[0110] Step S34: Use the container code of the target container as the user identity identifier of the target application.

[0111] In one implementation, different container spaces can have the same or different container encoding rules. For example, when creating a new container for an application, the new application can be assigned a container encoding based on the specific encoding rules within the container space.

[0112] For example, in a container space, the container codes of new containers are incremented one by one, that is, the container code of the first container is Y, the container code of the second container is Y+1, the container code of the third container is Y+2, and so on.

[0113] For example, in a certain container space, the container code of a new container is calculated based on some attribute information of the application.

[0114] In this embodiment, the creation instruction for the target application can be the installation instruction for the target application. A container space with unoccupied container codes can refer to obtaining a container space with remaining container codes. If all container codes in a container space are occupied, then that container space does not meet the condition of having remaining container codes.

[0115] In this embodiment, the container code of the target container is determined based on the unoccupied container codes within the set range of container codes corresponding to the target application's container space. Specifically, if the set range of container codes for a container space is 0-99, and codes 0-98 are all occupied when other applications are created, then container code 99 can be selected as the container code of the target container. Similarly, if the set range of container codes for a container space is 0-999, and codes 0-98 are all occupied when other applications are created, then any one of container codes 99-999 can be selected as the container code of the target container.

[0116] In this embodiment, when the target application is created, the container code of the target container is determined, so that the target container has a unique corresponding container code, avoiding the duplication of container codes for different applications.

[0117] In one implementation, such as Figure 4 As shown, obtaining container space with unoccupied container code includes:

[0118] Step S41: If there is no container space with unoccupied container code in the current container system, create a new container space;

[0119] Step S42: Use the new container space as a container space with unoccupied container code.

[0120] In this embodiment, if there are 3 container spaces in the container system, and all container codes in the 3 container spaces have established a correspondence with the application, then a 4th container space can be created when the target application is created, and the target container can be created in the 4th container space.

[0121] As a specific implementation method, container spaces in a container system can be created in a certain numbered order.

[0122] In this embodiment, multiple container spaces can be created in the container system, and each container space corresponds to a range of non-overlapping container codes, thereby ensuring the uniqueness of the container code of each container and ensuring the degree of isolation between different containers.

[0123] In one implementation, acquiring container space with unoccupied container code includes:

[0124] If there are container spaces with remaining capacity in the current container system, those container spaces with remaining capacity will be used as container spaces with unoccupied container codes.

[0125] In this embodiment, if there are unoccupied container codes in the created container space of the container system, the container code corresponding to the newly created target application can be set as the container code in the created container space, thereby improving the utilization rate of each container space.

[0126] In one implementation, such as Figure 5 As shown, the container operation methods also include:

[0127] Step S51: With the main system having completed startup, start the container system of the main system;

[0128] Step S52: In the container system, start the created container space;

[0129] Step S53: In each container space, start the container space incubator;

[0130] Step S54: In each container space, based on the container space incubator, start the container space system service. The container space system service is used to store the correspondence information between the container code and the application in the container space.

[0131] In this embodiment, the main system can be a computer system running on the terminal, specifically a Linux system, an Android system, a Windows system, etc. In addition to the container system, the main system may also include necessary modules or systems such as an incubator running outside the container system.

[0132] In this embodiment, the created container space can be a container space that corresponds to an already created application. The container space in the container system can include one or more containers. In each container space, multiple containers can be created and run, and each container has a unique container code. The container code corresponds to the application, and the container is used to contain the application process or thread during the application's operation.

[0133] A container space incubator can be a child process or child thread within a container space, and can be used to create containers or other processes within a container space.

[0134] In this embodiment, the container space system service can be used to manage container code. Each container space can have a corresponding container space incubator, and different container space incubators run independently of each other. Consequently, the container space system service or other sub-processes started within each container space also run independently of the container space system services and sub-processes of other container spaces.

[0135] In this embodiment, a container space can be started in the container system, and a corresponding container space incubator can be started in each container space. Then, the services and subprocesses necessary for container operation and management can be started, thereby ensuring that the container runs normally in the container space.

[0136] In one specific example of the present invention, the containers of each application may have the various isolation functions shown in Table 1, or by setting, one or more isolation functions may be selected as the isolation functions of all containers in the system.

[0137]

[0138]

[0139] Table 1

[0140] In a specific example of the present invention, the startup of the terminal system is as follows: Figure 6 As shown. After the terminal kernel (Kernel) 61 starts, the terminal host system (Init_host) is started, that is, the terminal is started. Figure 6 The terminal host system 62 is used in this example. In this example, the terminal host system 62 can be a Linux system or an Android system. After the terminal host system 62 completes startup, it starts the main system incubator (Zygote host) 63. The main system incubator 63 can further start the main system's system service (System_serverhost) 64. Additionally, the terminal host system 62 can start the container system daemon (celld host) 65. Within the container system daemon 65, each container space is started. For example, if there are two container spaces in the container system, the first container space (init cell1) 66 and the second container space (init cell2) 67 are started. Within each container space, the incubator (zygote cell1) 68 of the first container space and the incubator (zygote cell2) 69 of the second container space are started respectively. Through the incubator 68 of the first container space and the incubator 69 of the second container space, the system service (system_server cell1) of the first container space and the system service (system_server cell2) of the second container space are started respectively.

[0141] In this example, UID allocation rules and application installation logic can be stored in the system service processes within the container space. These system services are part of the Android system framework, and they also include Package Manager Service and WindowManagerService. Figure 6It can be seen that system services are isolated from each other between different container spaces, and between the inside and outside of the container system. Figure 6 In the tree structure, the top node represents the parent process, and the bottom node represents the child process. The child process below is created by the parent process above.

[0142] In this embodiment of the invention, different container systems share the kernel space and resources of the main system. In the kernel space of the main system, the isolation between containers can also be based on namespace and CGroup features, that is, isolation based on process and data structure dimensions, which is a lightweight isolation at the software level.

[0143] In this embodiment of the invention, considering that the number of applications installed in a terminal system is usually less than 500, each container space can be allocated a maximum of 1000 (or 500, 1500, 2000, or other numbers) applications, and the container coding range is divided according to different starting points, so that the containers in each container space can be assigned a code according to the container coding range, avoiding the situation that containers created when installing applications in different container spaces have the same container code.

[0144] In one implementation, the specific partitioning rules may include:

[0145] The container encoding in the main system space starts from 10000 (FIRST_APPLICATION_UID, the UID of the first application in the main system space) and ends at FIRST_APPLICATION_UID+1000, meaning the container encoding range in the main system space is [10000, 11000]. The container encoding in the main system space is primarily used to initially create containers for the application during application creation. After creating containers in the main system space, the created containers can be transferred to the specific container space corresponding to the application.

[0146] For the first container space in the main system, the container encoding starts from FIRST_APPLICATION_UID+1000 and ends at FIRST_APPLICATION_UID+2000, that is, the container encoding range of the first container space is [11000, 12000).

[0147] For the second container space in the main system, the container encoding starts from FIRST_APPLICATION_UID+2000 and ends at FIRST_APPLICATION_UID+3000, meaning the container encoding range for the first container space is [12000, 13000].

[0148] For the first container space in the main system, the container encoding starts from FIRST_APPLICATION_UID+3000 and ends at FIRST_APPLICATION_UID+4000, that is, the container encoding range of the first container space is [13000, 14000).

[0149] And so on.

[0150] In other examples, the range of UIDs or container codes within each container space can also be any value other than 1000. This allows for partitioning from the native range of 9999 common application UIDs (container codes) based on the number of containers and specific needs.

[0151] In general, all security isolation in Linux systems is implemented based on namespaces and CGroups. However, terminal systems are complex and feature-rich, and some functions require active API calls to enable (enable) them to take effect, such as memory and network control. Furthermore, there are many solutions for building secure systems using LXC containers based on Android. The details of container creation and operation can be implemented by various providers according to their own technical capabilities, without a unified standard. This makes it easy to overlook aspects when enabling security isolation features, leading to security issues.

[0152] Meanwhile, in security systems built using LXC containers based on Android, services are sometimes shared among applications. For example, some hardware-dependent and exclusive services (such as audio) may share hardware resources. Due to product design requirements, multiple containers may also share the same service and effect.

[0153] Security issues arising from shared services typically manifest in situations where different applications within different container spaces share the same container code. Processes within different containers with the same container code may interfere with each other, leading to security and functional problems. Furthermore, because multi-container systems inherently involve incomplete isolation and shared services, and container code is the fundamental unit of application isolation in Android, duplicate container code can cause very serious security issues.

[0154] The container operation method provided in this invention can limit the range of unique container codes for each container space, thereby avoiding duplicate or identical container codes in different containers, thus improving the isolation between containers and enhancing container security.

[0155] This invention also provides a container operating device, such as... Figure 7 As shown, it includes:

[0156] The receiving module 71 is used to receive communication information sent to the target application;

[0157] The target container acquisition module 72 is used to acquire the target container of the process running the target application in the container space corresponding to the target application based on the communication information; the container space corresponding to the target application has a unique correspondence with the set container code value range;

[0158] The sending module 73 is used to send communication information to the target container so that the process of the target application can receive the communication information.

[0159] In one implementation, such as Figure 8 As shown, the container operating device also includes:

[0160] User identity acquisition module 81 is used to acquire the user identity corresponding to the target application when a target application startup command is received.

[0161] The user identity identifier module 82 is used to determine the container space corresponding to the target application based on the user identity identifier of the target application.

[0162] The target container startup module 83 is used to start the target container in the container space according to the container code determined based on the user identity identifier;

[0163] Run module 84 is used to run the process of the target application in the target container.

[0164] In one implementation, such as Figure 9 As shown, the container operating device also includes:

[0165] The container space acquisition module 91 is used to acquire container space with unoccupied container code when a creation instruction is received from the target application.

[0166] Container space processing module 92 is used to use container space with unoccupied container code as the corresponding container space of the target application;

[0167] The container code determination module 93 is used to determine the container code of the target container based on the unoccupied container codes within the set container code value range of the corresponding container space of the target application.

[0168] The container encoding processing module 94 is used to use the container encoding of the target container as the user identity identifier of the target application.

[0169] In one implementation, such as Figure 10 As shown, the container space acquisition module includes:

[0170] Creation unit 101 is used to create a new container space when there is no container space with an unoccupied container code in the current container system;

[0171] The first operation unit 102 is used to treat the new container space as a container space with an unoccupied container code.

[0172] In one implementation, such as Figure 11 As shown, the container space acquisition module includes:

[0173] The second operation unit 111 is used to, when there is a container space with remaining capacity in the current container system, use the container space with remaining capacity as a container space with unoccupied container code.

[0174] In one implementation, such as Figure 12 As shown, the container operating device also includes:

[0175] The first startup module 121 is used to start the container system of the main system after the main system has finished starting.

[0176] The second startup module 122 is used to start the created container space in the container system;

[0177] The third startup module 123 is used to start the container space incubator in each container space;

[0178] The fourth startup module 124 is used to start the container space system service in each container space based on the container space incubator. The container space system service is used to store the correspondence information between the container code and the application in the container space.

[0179] This invention also provides a storage medium, characterized in that the storage medium includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the container operation method provided in any embodiment of this invention.

[0180] This invention also provides a processor, characterized in that the processor is used to run a program, wherein the program executes the container operation method provided in any embodiment of this invention during runtime.

[0181] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0182] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0183] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0184] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

Claims

1. A method for operating a container, characterized in that, include: Receive communication information sent to the target application; Based on the communication information, the target container for the process running the target application is obtained in the container space corresponding to the target application; the container space corresponding to the target application has a unique correspondence with the set container code value range, wherein the container code value ranges of different container spaces do not overlap; The communication information is sent to the target container so that the process of the target application can receive the communication information; The method further includes: Upon receiving a launch command for the target application, obtain the user identity identifier corresponding to the target application; Based on the user identity identifier, determine the container space corresponding to the target application; Within the container space, the target container is started according to the container code determined based on the user identity identifier; The process of the target application runs within the target container.

2. The method according to claim 1, characterized in that, The method further includes: Upon receiving the creation instruction of the target application, obtain container space with unoccupied container code; The container space with unoccupied container code is used as the corresponding container space for the target application; The container code of the target container is determined based on the unoccupied container codes within the set container code value range of the corresponding container space of the target application. The container code of the target container is used as the user identity identifier of the target application.

3. The method according to claim 2, characterized in that, The step of obtaining container space with unoccupied container code includes: If no container space with unused container code exists in the current container system, create a new container space. The new container space is used as the container space with the unoccupied container code.

4. The method according to claim 2, characterized in that, The step of obtaining container space with unoccupied container code includes: If there are container spaces with remaining capacity in the current container system, the container spaces with remaining capacity are used as the container spaces with unoccupied container codes.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: Once the main system has finished booting, start the container system of the main system; In the container system, start the created container space; In each of the container spaces, launch the container space incubator; In each container space, a container space system service is launched based on the container space incubator. The container space system service is used to store the correspondence information between the container code and the application in the container space.

6. A container operating device, characterized in that, include: The receiving module is used to receive communication information sent to the target application; The target container acquisition module is used to acquire the target container of the process running the target application in the container space corresponding to the target application according to the communication information; the container space corresponding to the target application has a unique correspondence with the set container code value range, wherein the container code value ranges of different container spaces do not overlap; A sending module is used to send the communication information to the target container, so that the process of the target application can receive the communication information; The device further includes: The user identity identifier acquisition module is used to obtain the user identity identifier corresponding to the target application when the target application launch instruction is received. The user identity identifier module is used to determine the container space corresponding to the target application based on the user identity identifier of the target application. A target container startup module is used to start the target container in the container space according to the container code determined based on the user identity identifier; The runtime module is used to run the process of the target application within the target container.

7. The apparatus according to claim 6, characterized in that, The device further includes: The container space acquisition module is used to acquire container space with unoccupied container code when the target application's creation instruction is received; A container space processing module is used to use the container space with unoccupied container code as the corresponding container space of the target application. The container code determination module is used to determine the container code of the target container based on the unoccupied container codes within the set container code value range of the corresponding container space of the target application. The container encoding processing module is used to use the container encoding of the target container as the user identity identifier of the target application.

8. The apparatus according to claim 7, characterized in that, The container space acquisition module includes: Create a unit to create a new container space if no container space with unused container code exists in the current container system; The first operation unit is used to treat the new container space as the container space with the unoccupied container code.

9. The apparatus according to claim 7, characterized in that, The container space acquisition module includes: The second operation unit is used to, when there is a container space with remaining capacity in the current container system, use the container space with remaining capacity as the container space with unoccupied container code.

10. The apparatus according to any one of claims 6-9, characterized in that, The device further includes: The first startup module is used to start the container system of the main system after the main system has finished starting. The second startup module is used to start the created container space in the container system; The third startup module is used to start the container space incubator in each of the container spaces; The fourth startup module is used to start the container space system service in each container space based on the container space incubator. The container space system service is used to store the correspondence information between the container code and the application in the container space.

Images