Process control method, device, equipment and readable storage medium in container

Abstract

The present application discloses a process control method, device, equipment and readable storage medium in a container, wherein the process control method in a container comprises: obtaining the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs, generating the real path information corresponding to the target control process according to the first execution file path information and the absolute path information of the root directory corresponding to the path root directory, and controlling the target control process according to the real path information. The present application solves the technical problem of poor process control effect of the operating system under the container technology in the prior art.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a method, device, equipment and readable storage medium for controlling processes within a container. Background Art

[0002] With the continuous concentration of computer resources and application services, in order to meet the needs of ultra-large capacity, ultra-high concurrency and ultra-fast speed, the field of cloud computing technology is constantly upgrading. Among them, virtualization technology, as the foundation of cloud computing technology, has also made great progress. In particular, container technology represented by Docker has become a server resource sharing method recognized by the public due to its ultra-high resource utilization and low cost brought by dividing the resources of a single operating system into isolated groups. At the same time, the process control of the operating system under container technology has also become an urgent problem to be solved. At present, manufacturers usually control the process of the operating system under the container by modifying the system call. Since container technology usually deploys multiple containers on the same host machine and shares the kernel of the operating system with the process outside the container to achieve isolation of the resources occupied by the process, the isolation between the host machine and each container is high, and the host machine cannot accurately locate the executable file used by the process started in the container, which leads to the inability to effectively control the process of the operating system under the container technology. The process control effect of the operating system under the container technology is poor. Summary of the invention

[0003] The main purpose of this application is to provide a method, device, equipment and readable storage medium for process control in a container, aiming to solve the technical problem of poor process control effect of an operating system under container technology in the prior art.

[0004] To achieve the above objectives, the present application provides a method for controlling a process in a container, wherein the method comprises:

[0005] Obtain the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs;

[0006] Generate the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory;

[0007] The target control process is controlled according to the real path information.

[0008] Optionally, the step of generating the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory includes:

[0009] Obtaining a file index node corresponding to the path root directory, and transferring the file index node and the first execution file path information from the kernel space to the user space;

[0010] According to a preset mapping table, querying the root directory absolute path information corresponding to the file index node in the user space;

[0011] The first execution file path information and the root directory absolute path information are concatenated to obtain the real path information corresponding to the target control process.

[0012] Optionally, before the step of querying the absolute path information of the root directory corresponding to the file index node in the user space according to the preset mapping table, the method for controlling the process in the container further includes:

[0013] Scan the path root directory corresponding to each preset container to obtain the file index node corresponding to each path root directory and the corresponding root directory absolute path information;

[0014] The preset mapping table is established according to the one-to-one correspondence between each of the file index nodes and each of the root directory absolute path information.

[0015] Optionally, the step of obtaining the first execution file path information of the target control process includes:

[0016] Determine the target control process by detecting whether there is a process creation request in the container;

[0017] The relative path information of the target execution file corresponding to the target control process is queried to obtain the first execution file path information.

[0018] Optionally, the step of controlling the target control process according to the real path information includes:

[0019] Calculating the information characteristic value of the target executable file according to the real path information;

[0020] The target control process is controlled by querying whether the information feature value exists in a preset information feature database.

[0021] Optionally, the step of controlling the target control process by querying whether the information feature value exists in a preset information feature database includes:

[0022] Determine whether there is a standard information feature value consistent with the information feature value in the preset information feature database;

[0023] If yes, the target control process is allowed to execute;

[0024] If not, the target control process is prevented from executing.

[0025] Optionally, before the step of controlling the target control process by querying whether the information feature value exists in a preset information feature database, the method for controlling the process in the container further includes:

[0026] Scan the absolute path information corresponding to the executable file in the host machine;

[0027] Calculating a standard information characteristic value of the executable file according to the absolute path information;

[0028] The standard information feature value is saved in the preset information feature database.

[0029] The present application also provides a process control device in a container, wherein the process control device in a container is a virtual device, and the process control device in a container is applied to a process control device in a container, and the process control device in a container includes:

[0030] An extraction module is used to obtain the first execution file path information of the target control process under the container to which it belongs and the path root directory corresponding to the container to which it belongs;

[0031] A generation module, used to generate real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory;

[0032] A control module is used to control the target control process according to the real path information.

[0033] The present application also provides a process control device within a container, which is a physical device. The process control device within a container includes: a memory, a processor, and a program of the process control method within a container stored on the memory and executable on the processor. When the program of the process control method within a container is executed by the processor, the steps of the process control method within a container as described above can be implemented.

[0034] The present application also provides a readable storage medium, which is a computer-readable storage medium. The computer-readable storage medium stores a program for implementing a method for controlling a process in a container. When the program for the method for controlling a process in a container is executed by a processor, the steps of the method for controlling a process in a container as described above are implemented.

[0035] The present application provides a method, apparatus, device, readable storage medium and computer program product for process control in a container. Compared with the technical means in the prior art for controlling the startup process in an operating system under container technology by modifying system calls, the present application first obtains the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs, and then generates the real path information corresponding to the target control process based on the first execution file path information and the root directory absolute path information corresponding to the path root directory. Since the root directory absolute information represents the real location of the container in the host machine, and the first execution file path information represents the real location of the executable file of the target control process in the container, The real path information can reflect the association relationship between the host machine and the container, and then control the target control process based on the real path information. Due to the high isolation between the host machine and each container, the host machine can only obtain the relative position of the executable file of the target control process in the container, and the relative position of the executable file cannot accurately reflect the real position of the executable file in the host machine, which makes the target control process difficult to control. Since the real path information can accurately locate the real position of the executable file in the host machine, the host machine can control the process in the container. Therefore, the technical defect of the prior art that the process in the operating system under the container technology cannot be effectively controlled is overcome, and the process control effect of the operating system under the container technology is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 This is a flowchart of the first embodiment of the process control method in the container of the present application;

[0039] Figure 2 This is a flow chart of the second embodiment of the process control method in a container of the present application;

[0040] Figure 3 This is a flowchart of the third embodiment of the process control method in a container of the present application;

[0041] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0042] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0043] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] First of all, it should be understood that when the start of a process in the operating system is detected, the started process will be controlled to ensure the security of the operating system. When controlling the process of the operating system, it is usually necessary to obtain the location information of the executable file in the process, and then control it through the location information of the executable file. However, due to the high isolation between the host machine and the processes in each container under container technology, the host machine can only obtain the location of the executable file of the process in the container relative to the host machine, and the host machine cannot accurately locate the actual location of the executable file used by the process in the container, making it impossible for the operating system in the host machine to control the process running in the container scenario, resulting in poor control effect of the operating system under container technology.

[0045] The present application embodiment provides a method for controlling a process in a container. In the first embodiment of the method for controlling a process in a container of the present application, refer to Figure 1 , the process control method in the container includes:

[0046] Step S10, obtaining the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs;

[0047] In this embodiment, it should be noted that the process method in the container is executed in the application management program, and the application management program is deployed on the host machine to which the container belongs. The container is a standardized software unit, specifically including an application packaged using container technology and all dependencies, other binary files and configuration files required by the application, which are used to achieve isolation of resources occupied by processes in the operating system. The host machine is a physical host that executes the application. The target management process is the application process created in the target container. The target container is deployed on the host machine, and specifically can be one or more containers specified by the user that need to be process controlled. The first executable file path information is the executable file path of the executable file of the target management process under the container to which it belongs, and the path root directory is the root directory mounted in the host machine.

[0048] In an practicable manner, the operating system of the host machine is Linux, and the container technology is to use Namespace, Control groups and chroot (change to root) to achieve isolation of the process in the container from the outside world. Specifically, Namespace is used to provide corresponding pid (Process Identifier, process name) and Control groups for different containers to limit resources of different containers, so that different containers can be run under different virtual root directories through chroot (change to root). The first executable file path information is the executable file path corresponding to the Namespace of the container to which it belongs, and the path root directory is the virtual root directory mounted in the host machine, which can be quickly located by the docker inspect command. For example, assuming that the name corresponding to the host machine root directory is: x1, and the folder corresponding to the path root directory of the created Docker container is: x2, then the path root directory is / x1 / x2.

[0049] Exemplarily, step S10 includes: obtaining an executable file path of an executable file of a target control process in a corresponding container, and obtaining a root directory corresponding to the corresponding container mounted in a host machine.

[0050] Further, in step S10, the step of obtaining the first execution file path information of the target control process includes:

[0051] Step S11: determining the target control process by detecting whether there is a process creation request in the container;

[0052] Step S12: query the relative path information of the target execution file corresponding to the target control process to obtain the first execution file path information.

[0053] In this embodiment, it should be noted that the detection is detection in the kernel of the host machine, the process creation request is a process execution creation action, the target executable file is the executable file required to start the target process, and the relative path information is the relative path of the executable file in the host machine. In an implementable manner, the operating system of the host machine is Linux, then the method for obtaining the process creation request can be based on the Linux kernel hook (intercepting) system calls related to process execution to monitor whether the process in the container is started.

[0054] Exemplarily, step S11 includes: if the process in the container is detected in the kernel of the host machine to execute a creation action, then the process corresponding to the creation action is used as the target control process; if the process in the container is not detected in the kernel of the host machine to execute a creation action, then there is no target control process; further, step S12 includes: querying the target execution file corresponding to the target control process, and then obtaining the relative path of the target execution file in the host machine, and using the relative path as the first execution file path information.

[0055] Step S20, generating real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory;

[0056] Step S30: Control the target control process according to the real path information.

[0057] In this embodiment, it should be noted that the root directory absolute path information is the absolute path of the path root directory in the host machine, and the real path information is the absolute path of the executable file corresponding to the target control process in the host machine. In an implementable manner, the operating system of the host machine is Linux, and a command can be used to specify a directory of the host machine to bind the container when creating a container. The bound directory is the path root directory, and the root directory absolute path information is the absolute path of the virtual root directory mounted in the host machine in the host machine.

[0058] Exemplarily, step S20 includes: generating the absolute path of the executable file corresponding to the target control process in the host machine based on the executable file path of the target control process in the container to which it belongs and the absolute path of the path root directory in the host machine. Further, step S30 includes: controlling the target control process based on the real path of the executable file of the target control process.

[0059] The embodiments of the present application provide a method, apparatus, device-readable storage medium and computer program product for controlling processes in a container. Compared with the technical means in the prior art for controlling processes started by an operating system under container technology by modifying system calls, the present application first obtains the first executable file path information of the target controlled process under the container to which it belongs and the path root directory corresponding to the container to which it belongs, and then generates the real path information corresponding to the target controlled process based on the first executable file path information and the root directory absolute path information corresponding to the path root directory. Since the isolation between the host machine and each container is high, the host machine can only obtain the relative position of the executable file of the process in the container, and the relative position of the executable file cannot accurately locate the real position of the executable file in the host machine, which makes it difficult to control the process in the container. Since the real path information can accurately reflect the real position of the executable file in the host machine, the process in the container can be controlled. Therefore, the technical defect of the prior art that the process in the operating system under the container technology cannot be effectively controlled is overcome, and the control effect of the operating system under the container technology is improved.

[0060] Further, refer to Figure 2 Based on the first embodiment of the present application, in another embodiment of the present application, the step of generating the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory includes:

[0061] Step A10, obtaining a file index node corresponding to the path root directory, and transferring the file index node and the first execution file path information from the kernel space to the user space;

[0062] Step A20, querying the root directory absolute path information corresponding to the file index node in the user space according to the preset mapping table;

[0063] In this embodiment, it should be noted that the file index node is a file location identifier, which is used to locate each file in the operating system of the host machine, specifically including file type, permission, UID (User Identification) and GID (User Identification). The user space is the space where user programs in the operating system of the host machine run, and is used to perform simple operations. The kernel space is the space where kernel programs in the operating system of the host machine run, and is used for file reading and writing, process and thread management, and calling system resources. The preset mapping table is used to establish a one-to-one mapping relationship between file index nodes and root directory absolute paths. For example, assuming that two containers A and B are deployed in the host machine, the file index node corresponding to container A is x, and the corresponding root directory absolute path is y, the file index node corresponding to container B is z, and the corresponding root directory absolute path is v, then the mapping relationship in the preset mapping table is "xy, zv".

[0064] In one possible implementation, the operating system of the host machine is Linux, the file index node is an inode (index node), the inode (index node) is used to store metadata of the file, the path root directory is the root directory file mounted in the host machine, and the file index node is the inode (index node) corresponding to the virtual root directory file mounted in the host machine.

[0065] Exemplarily, step A10 includes: obtaining the file location identifier of the root directory mounted in the host machine corresponding to the container, and passing the file location identifier and the executable file path of the executable file of the target control process under the container from the kernel space to the user space, wherein the transfer can be carried out by using one of the methods such as Netlink, system call and / proc file system, and further, step A20 includes: according to a preset mapping table, querying the absolute path of the root directory corresponding to the file location identifier in the user space.

[0066] Furthermore, before the step of querying the absolute path information of the root directory corresponding to the file index node in the user space according to the preset mapping table, the method for controlling the process in the container further includes:

[0067] Step A21, scanning the path root directory corresponding to each preset container, and obtaining the file index node corresponding to each path root directory and the corresponding root directory absolute path information;

[0068] Step A22: establishing the preset mapping table according to the one-to-one correspondence between each of the file index nodes and each of the root directory absolute path information.

[0069] In this embodiment, it should be noted that the preset container is a container specified by the user for establishing a mapping relationship between a file index node and a root directory absolute path.

[0070] Exemplarily, step A21 includes: scanning the root directory of each preset container mounted in the host machine to obtain the absolute path of the root directory in the host machine, and querying the corresponding file location identifier based on the absolute path of the root directory in the host machine. Further, step A22 includes: establishing the preset mapping table and saving it to the database based on the one-to-one correspondence between the file location identifier corresponding to each preset container and the corresponding absolute path of the root directory in the host machine, wherein the establishment can be established by using a shared primary key method or a unique foreign key method.

[0071] Step A30, concatenate the first execution file path information and the root directory absolute path information to obtain the real path information corresponding to the target management and control process.

[0072] Exemplarily, step A30 includes: splicing the executable file path of the target control process in the container to which it belongs with the absolute path of the path root directory in the host machine to generate the absolute path of the executable file of the target control process in the host machine, wherein the splicing is spliced ​​in a front-to-back splicing manner. For example, assuming that the executable file path of the executable file in the container to which it belongs is / C / D, and the absolute path of the path root directory in the host machine is / A / B, then the absolute path of the executable file in the host machine generated by the front-to-back splicing manner is / A / B / C / D.

[0073] An embodiment of the present application provides a method for generating a real path of a process in a container, that is, first obtaining a file index node corresponding to the path root directory, and passing the file index node and the first execution file path information from the kernel space to the user space, thereby achieving the purpose of simultaneously obtaining the file index node and the first execution file path information in the user space, and then querying the root directory absolute path information corresponding to the file index node in the user space according to a preset mapping table, and then splicing the first execution file path information and the root directory absolute path information to obtain the real path information corresponding to the target control process, thereby achieving the purpose of generating the real path of the executable file of the process in the container in the user space, and since the real path can accurately reflect the real path of the executable file of the target control process in the host machine, it lays a foundation for the control of the process in the container.

[0074] Further, refer to Figure 3 Based on the first embodiment of the present application, in another embodiment of the present application, the step of controlling the target control process according to the real path information includes:

[0075] Step B10: Calculating the information characteristic value of the target executable file according to the real path information;

[0076] Step B20: Control the target control process by querying whether the information feature value exists in a preset information feature database.

[0077] In this embodiment, it should be noted that the target executable file is an executable file corresponding to the target control process, the information characteristic value is a characteristic value calculated by using an information digest algorithm, the characteristic value is a unique identifier of the executable file, and the information digest algorithm can be one of information digest algorithms such as MD (Message Digest), SHA-1 (Secure Hash Algorithm), MAC (Message Authentication Code), and Whirlpool, wherein the MD (Message Digest) information digest algorithm includes MD2 (Message-Digest Algorithm 2), MD4 (Message-Digest Algorithm 4), and MD5 (Message-Digest Algorithm 5). For example, assuming that the information characteristic value is an MD5 value calculated by using the MD5 (Message-Digest Algorithm 5) information digest algorithm, the MD5 value is the unique identifier of the executable file, and the calculation can be performed by using a Linux command line, a shell (computer shell), Python, and PHP (Hypertext Preprocessor, hypertext preprocessor) to perform calculations.

[0078] Exemplarily, step B10 includes: according to the absolute path of the executable file corresponding to the target control process in the host machine, using the information summary algorithm to calculate the characteristic value of the executable file; further, step B20 includes: if the characteristic value of the executable file exists in the preset information feature database, the kernel controls the target control process; if the characteristic value of the executable file does not exist in the preset information feature database, the kernel does not control the target control process.

[0079] Further, in step B20, the step of controlling the target control process by querying whether the information feature value exists in a preset information feature database includes:

[0080] Step B21, determining whether there is a standard information feature value consistent with the information feature value in the preset information feature database;

[0081] Step B22: If yes, then allow the target control process to execute;

[0082] Step B23: if not, prevent the target control process from executing.

[0083] In this embodiment, it should be noted that the standard information feature value is the standard feature value of the executable file in the host machine, and the preset information feature database is used to store the standard feature values ​​of all executable files in the host machine. In an implementable manner, if the information digest algorithm is the MD5 (Message-Digest Algorithm 5) information digest algorithm, all executable files in the root directory of the host machine can be recursively traversed, and the absolute paths of all executable files are stored in the same list, and then the MD5 standard feature values ​​of all executable files can be calculated using the hashlib.md5 function.

[0084] Exemplarily, step B21 includes: comparing the feature value of the executable file corresponding to the target control process with each standard feature value stored in the preset information feature database one by one, and determining whether there is a standard feature value consistent with the feature value in the preset information feature database. Further, step B22 includes: if there is a standard feature value in the preset information feature database that is consistent with the feature value of the executable file corresponding to the target control process, the kernel allows the target control process to be executed. Further, step B23 includes: if there is no standard feature value in the preset information feature database that is consistent with the feature value of the executable file corresponding to the target control process, the kernel prevents the target control process from being executed, wherein the standard feature value that is consistent with the feature value of the executable file corresponding to the target control process does not exist in the preset information feature database means that there is no standard feature value in the preset information feature database for comparison with the feature value of the executable file corresponding to the target control process, or the standard feature value of the executable file in the preset information feature database is inconsistent with the feature value corresponding to the target control process.

[0085] Furthermore, before the step of controlling the target control process by querying whether the information feature value exists in the preset information feature database, the process control method in the container further includes:

[0086] Step Z10, scanning the absolute path information corresponding to the executable file in the host machine;

[0087] Step Z20, calculating the standard information characteristic value of the executable file according to the absolute path information;

[0088] Step Z30, saving the standard information feature value to the preset information feature database.

[0089] Exemplarily, step Z10 includes: scanning the absolute path information of the executable file in the host machine, wherein the absolute path information is an absolute path; further, step Z20 includes: calculating the standard feature value of the executable file based on the absolute path information, wherein the standard information feature information value is a standard feature value; further, step Z30 includes: saving the standard feature value of the executable file to the preset information feature database, wherein the saving can be stored in the structure of a dictionary variable ("absolute path of the file": "standard feature value of the file").

[0090] The embodiment of the present application provides a method for controlling a process in a container based on an information characteristic value, that is, firstly, according to the real path information, the information characteristic value of the target executable file is calculated, the information characteristic value of the target executable file is determined, and then the target control process is controlled by querying whether the information characteristic value exists in a preset information characteristic database, thereby achieving the purpose of querying the information characteristic value of the target executable file in the information characteristic value of the executable file of the host machine, and then controlling the target control process based on the information characteristic value of the target executable file. Since the information characteristic value can accurately reflect the file information of the executable file of the target control process, it provides a basis for determining the absolute path of the executable file of the process in the container, and then can achieve the purpose of controlling the executable file of the target control process, thus laying a foundation for controlling the process in the container.

[0091] Reference Figure 4 , Figure 4 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0092] like Figure 4 As shown, the process control device in the container may include: a processor 1001, such as a CPU, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between the processor 1001 and the memory 1005. The memory 1005 can be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0093] Optionally, the process control device in the container may also include a rectangular user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, a hard disk circuit, a WiFi module, etc. The rectangular user interface may include a display screen (Display), an input submodule such as a keyboard (Keyboard), and the optional rectangular user interface may also include a standard wired interface and a wireless interface. The network interface may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0094] Those skilled in the art will understand that Figure 4 The structure of the process control device in the container shown in the figure does not constitute a limitation of the process control device in the container, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0095] like Figure 4 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, and a process control program in a container. The operating system is a program that manages and controls the hardware and software resources of the process control device in the container, and supports the operation of the process control program in the container and other software and / or programs. The network communication module is used to realize communication between the components inside the memory 1005, and communication with other hardware and software in the process control system in the container.

[0096] exist Figure 4 In the container process control device shown, the processor 1001 is used to execute the container process control program stored in the memory 1005 to implement the steps of the container process control method described in any one of the above items.

[0097] The specific implementation methods of the process control device in the container of the present application are basically the same as the embodiments of the process control method in the container described above, and will not be repeated here.

[0098] The embodiment of the present application further provides a process control device in a container, the process control device in a container is applied to a process control device in a container, and the process control device in a container includes:

[0099] An extraction module is used to obtain the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs;

[0100] A generation module, used to generate real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory;

[0101] A control module is used to control the target control process according to the real path information.

[0102] Optionally, the extraction module is further used for:

[0103] Determine the target control process by detecting whether there is a process creation request in the container;

[0104] The relative path information of the target execution file corresponding to the target control process is queried to obtain the first execution file path information.

[0105] Optionally, the generating module is further used for:

[0106] Obtaining a file index node corresponding to the path root directory, and transferring the file index node and the first execution file path information from the kernel space to the user space;

[0107] According to a preset mapping table, querying the root directory absolute path information corresponding to the file index node in the user space;

[0108] The first execution file path information and the root directory absolute path information are concatenated to obtain the real path information corresponding to the target control process.

[0109] Optionally, the generating module is further used for:

[0110] Scan the path root directory corresponding to each preset container to obtain the file index node corresponding to each path root directory and the corresponding root directory absolute path information;

[0111] The preset mapping table is established according to the one-to-one correspondence between each of the file index nodes and each of the root directory absolute path information.

[0112] Optionally, the control module is further used to:

[0113] Calculating the information characteristic value of the target executable file according to the real path information;

[0114] The target control process is controlled by querying whether the information feature value exists in a preset information feature database.

[0115] Optionally, the control module is further used to:

[0116] Determine whether there is a standard information feature value consistent with the information feature value in the preset information feature database;

[0117] If yes, the target control process is allowed to execute;

[0118] If not, the target control process is prevented from executing.

[0119] Optionally, the control module is further used to:

[0120] Scan the absolute path information corresponding to the executable file in the host machine;

[0121] Calculating a standard information characteristic value of the executable file according to the absolute path information;

[0122] The standard information feature value is saved in the preset information feature database.

[0123] The specific implementation of the process control device in the container of the present application is basically the same as the embodiments of the process control method in the container described above, and will not be repeated here.

[0124] An embodiment of the present application provides a readable storage medium, and the readable storage medium stores one or more programs, and the one or more programs can also be executed by one or more processors to implement the steps of any of the above-mentioned methods for controlling processes in a container.

[0125] The specific implementation methods of the readable storage medium of the present application are basically the same as the embodiments of the above-mentioned in-container process control method, and will not be repeated here.

[0126] An embodiment of the present application provides a computer program product, and the computer program product includes one or more computer programs, and the one or more computer programs can also be executed by one or more processors to implement the steps of any of the above-mentioned methods for controlling processes in a container.

[0127] The specific implementation methods of the computer program product of the present application are basically the same as the embodiments of the above-mentioned process control method in the container, and will not be repeated here.

[0128] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A method for controlling processes in a container, characterized in that: The method for controlling processes in a container includes: Obtain the first execution file path information of the target control process in the container to which it belongs and the path root directory corresponding to the container to which it belongs; Generate the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory; Controlling the target control process according to the real path information; The step of generating the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory includes: Obtaining a file index node corresponding to the path root directory, and transferring the file index node and the first execution file path information from the kernel space to the user space; According to a preset mapping table, querying the root directory absolute path information corresponding to the file index node in the user space; The first execution file path information and the root directory absolute path information are concatenated to obtain the real path information corresponding to the target control process.

2. The process control method in a container according to claim 1, characterized in that: Before the step of querying the absolute path information of the root directory corresponding to the file index node in the user space according to the preset mapping table, the method for controlling the process in the container further includes: Scan the path root directory corresponding to each preset container to obtain the file index node corresponding to each path root directory and the corresponding root directory absolute path information; The preset mapping table is established according to the one-to-one correspondence between each of the file index nodes and each of the root directory absolute path information.

3. The process control method in a container according to claim 1, characterized in that: The step of obtaining the first execution file path information of the target control process includes: Determine the target control process by detecting whether there is a process creation request in the container; The relative path information of the target execution file corresponding to the target control process is queried to obtain the first execution file path information.

4. The process control method in a container according to claim 1, characterized in that: The step of controlling the target control process according to the real path information includes: Calculate the information characteristic value of the target executable file according to the real path information; The target control process is controlled by querying whether the information feature value exists in a preset information feature database.

5. The process control method in a container according to claim 4, characterized in that: The step of controlling the target control process by querying whether the information feature value exists in a preset information feature database comprises: Determine whether there is a standard information feature value consistent with the information feature value in the preset information feature database; If yes, the target control process is allowed to execute; If not, the target control process is prevented from executing.

6. The process control method in a container according to claim 4, characterized in that: Before the step of controlling the target control process by querying whether the information feature value exists in the preset information feature database, the process control method in the container further includes: Scan the absolute path information corresponding to the executable file in the host machine; Calculating a standard information characteristic value of the executable file according to the absolute path information; The standard information feature value is saved in the preset information feature database.

7. A process control device in a container, characterized in that: The process control device in the container includes: An extraction module is used to obtain the first execution file path information of the target control process under the container to which it belongs and the path root directory corresponding to the container to which it belongs; A generation module is used to generate the real path information corresponding to the target control process according to the first execution file path information and the root directory absolute path information corresponding to the path root directory; the generation module is also used to obtain the file index node corresponding to the path root directory, and transfer the file index node and the first execution file path information from the kernel space to the user space; according to the preset mapping table, query the root directory absolute path information corresponding to the file index node in the user space; splice the first execution file path information and the root directory absolute path information to obtain the real path information corresponding to the target control process; A control module is used to control the target control process according to the real path information.

8. A process control device in a container, characterized in that: The in-container process control device includes: a memory, a processor, and a program stored in the memory for implementing the in-container process control method. The memory is used to store a program for implementing a method for controlling a process in a container; The processor is used to execute a program for implementing the method for controlling a process in a container, so as to implement the steps of the method for controlling a process in a container as described in any one of claims 1 to 6.

9. A computer-readable storage medium for storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for controlling a process in a container as described in any one of claims 1 to 6 are implemented.

Images