A method, device, electronic device and storage medium for starting a secure container

Abstract

One or more embodiments of the present specification provide a method, device, electronic device and storage medium for starting a secure container. The method is applied to a container engine on a host machine; the method includes: in response to a container startup template creation request corresponding to a target micro virtual machine, creating a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system that supports large page storage; storing the general container startup template in the memory space of the target micro virtual machine in a memory-mapped manner; in response to a container startup request for a target secure container deployed on the target micro virtual machine, obtaining the general container startup template from the memory space of the target micro virtual machine, and starting the target secure container based on the obtained general container startup template.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of container technology, and in particular, to a method, device, electronic device, and machine-readable storage medium for starting a secure container. Background Art

[0002] With the advent of the cloud-native era, more and more users are starting to use containers; containers are a kernel virtualization technology of the Linux system that can be used to isolate processes.

[0003] Among them, traditional containers, such as runc containers, are based on operating system virtualization technology and can use the host's operating system and share the kernel with other programs on the host. Container isolation can be achieved through cgroups (control groups, Linux control groups) and Namespace mechanisms.

[0004] The secure container is based on hardware virtualization technology and can use the operating system of the microVM carried by the host machine; a microVM is a lightweight virtual machine that can be used as the operating environment for user workloads in the secure container. Since each microVM has an independent kernel, the secure container deployed in a microVM can use the kernel of the microVM, thus achieving container isolation through different microVMs carried by the host machine.

[0005] It can be seen that compared with traditional containers, secure containers have better isolation and are more secure, but secure containers start slower and have higher CPU and memory overhead. Summary of the invention

[0006] In view of this, one or more embodiments of the present specification provide a method, device, electronic device, and machine-readable storage medium for starting a secure container.

[0007] According to a first aspect of the present specification, a method for starting a secure container is provided, the method being applied to a container engine on a host machine; the host machine comprising a container engine for managing secure containers running on the host machine and at least one micro virtual machine; at least one secure container is deployed on the micro virtual machine; the method comprising:

[0008] In response to a container startup template creation request corresponding to a target micro virtual machine, creating a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage;

[0009] Storing the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner;

[0010] In response to a container startup request for a target secure container deployed on the target micro virtual machine, the general container startup template is obtained from the memory space of the target micro virtual machine, and the target secure container is started based on the obtained general container startup template.

[0011] Optionally, storing the universal container startup template in a memory space of the target micro virtual machine in a memory mapping manner includes:

[0012] In the memory space of the target micro virtual machine, memory mapping is performed on the template file in the file system for storing the universal container startup template, so as to map the template file to the target memory address space in the memory space of the target micro virtual machine;

[0013] The universal container startup template is written into the target memory address space.

[0014] Optionally, before memory mapping the template file for storing the universal container startup template in the file system in the memory space of the target micro virtual machine, the method further includes:

[0015] A template file for storing the general container startup template is created in a subdirectory of the entry directory of the file system.

[0016] Optionally, the memory mapping of the template file for storing the universal container startup template in the file system in the memory space of the target micro virtual machine to map the template file to a target memory address space in the memory space of the target micro virtual machine includes:

[0017] In the memory space of the target micro virtual machine, a template file in the file system for storing the universal container startup template is privately memory mapped to map the template file to a target private memory address space in the memory space of the target micro virtual machine.

[0018] Optionally, the acquiring the universal container startup template from the memory space of the target micro virtual machine includes:

[0019] Determining, in the file system, a template file for storing the general container startup template;

[0020] Determining the target memory address space to which the template file is mapped in the memory space of the target micro virtual machine;

[0021] The general container startup template is read from the target memory address space.

[0022] Optionally, the step of creating a general container startup template for starting the secure container deployed on the target micro virtual machine includes:

[0023] Cold-starting the target micro virtual machine to trigger the target micro virtual machine after the cold start to further start the agent program in its operating system for starting the secure container;

[0024] In response to detecting that the agent program is started, a snapshot of the runtime state of the target micro virtual machine is saved to generate the general container startup template.

[0025] Optionally, the general container startup template includes first startup information for starting any secure container deployed on the target micro virtual machine; the container startup request carries second startup information for starting the target secure container;

[0026] The starting the target secure container based on the acquired general container starting template includes:

[0027] Detecting whether the first startup information included in the acquired general container startup template is compatible with the second startup information carried by the container startup request;

[0028] If yes, start the target secure container according to the obtained general container startup template;

[0029] If not, the first startup information included in the general container startup template is updated according to the second startup information, and the target secure container is started according to the updated general container startup template.

[0030] Optionally, the first startup information includes: micro virtual machine configuration information for starting the target micro virtual machine, and container configuration information for starting any secure container deployed on the target micro virtual machine;

[0031] The starting the target secure container according to the acquired general container startup template or the updated general container startup template includes:

[0032] Starting the target micro virtual machine according to the micro virtual machine configuration information included in the acquired general container startup template or the updated general container startup template;

[0033] Switching the target micro virtual machine to the runtime state after the agent program saved in the universal container startup template is run, so that the target micro virtual machine runs the agent program in the runtime state;

[0034] The target secure container deployed on the target micro virtual machine is started according to the container configuration information included in the acquired general container startup template or the updated general container startup template.

[0035] Optionally, the file system supporting large page storage is a Linux Hugetlbfs file system.

[0036] According to a second aspect of the present specification, a secure container startup device is provided, the device being applied to a container engine on a host machine; the host machine comprising a container engine and at least one micro virtual machine for managing secure containers running on the host machine; at least one secure container is deployed on the micro virtual machine; the device comprising:

[0037] A template creation unit, configured to respond to a container startup template creation request corresponding to a target micro virtual machine and create a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage;

[0038] A memory mapping unit, used to store the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner;

[0039] A container startup unit is used to respond to a container startup request for a target secure container deployed on the target micro virtual machine, obtain the general container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the acquired general container startup template.

[0040] According to a third aspect of this specification, there is provided an electronic device, comprising a communication interface, a processor, a memory and a bus, wherein the communication interface, the processor and the memory are interconnected via the bus;

[0041] The memory stores machine-readable instructions, and the processor executes the above method by calling the machine-readable instructions.

[0042] According to a fourth aspect of the present specification, a machine-readable storage medium is provided, wherein the machine-readable storage medium stores machine-readable instructions, and when the machine-readable instructions are called and executed by a processor, the above method is implemented.

[0043] In the above embodiments, by means of memory mapping, the universal container startup template created in the file system supporting large page storage can be first stored in the memory space of the target micro virtual machine, and then the universal container startup template can be obtained from the memory space of the target micro virtual machine to start the target security container deployed on the target micro virtual machine; thereby overcoming the problem in the related technology that the file system supporting large page storage does not support read / write system calls, and realizing the startup of the target security container based on the universal container startup template created in the file system supporting large page storage.

[0044] Compared with the THP-based template startup solution, starting a secure container based on a universal container startup template created in a file system that supports large page storage can, on the one hand, speed up the startup of the secure container because there is no need to hot-plug a larger memory; on the other hand, since the universal container startup template used to start the target secure container is created in a file system that supports large page storage, it can ensure that the memory allocated to the target secure container fully uses large page memory, reducing problems such as table entry missing (TLB miss) and page fault interrupts, thereby improving container performance; on another hand, the universal container startup template can be shared by at least one micro virtual machine included in the host machine, that is, it can be shared by secure containers deployed in different micro virtual machines, thereby saving memory overhead in the file system for storing the universal container startup template. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of a method for starting a secure container shown in an exemplary embodiment;

[0046] Figure 2 It is a schematic structural diagram of an electronic device in which a starting device of a safety container is located, shown in an exemplary embodiment;

[0047] Figure 3 It is a block diagram of a startup device of a security container shown in an exemplary embodiment. DETAILED DESCRIPTION

[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0049] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0050] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of this specification, the relevant technologies of the safety container involved in the embodiments of this specification are briefly described below.

[0051] With the advent of the cloud-native era, more and more users are starting to use containers; containers are a kernel virtualization technology of the Linux system that can be used to isolate processes.

[0052] Among them, traditional containers, such as runc containers, are based on operating system virtualization technology and can use the host's operating system and share the kernel with other programs on the host. Container isolation can be achieved through cgroups (control groups, Linux control groups) and Namespace mechanisms.

[0053] The secure container is based on hardware virtualization technology and can use the operating system of the microVM carried by the host machine; a microVM is a lightweight virtual machine that can be used as the operating environment for user workloads in the secure container. Since each microVM has an independent kernel, the secure container deployed in a microVM can use the kernel of the microVM, so the container isolation is achieved through different microVMs carried by the host machine, which is more isolated and more secure.

[0054] In actual applications, compared with traditional containers, secure containers start slower and have higher CPU and memory overhead. In order to increase the startup speed of secure containers and reduce CPU and memory overhead, a template startup solution can be used, that is, to start secure containers based on the created container template. Furthermore, in order to improve runtime performance, secure containers need to use huge pages in the host machine.

[0055] For example, a template startup solution based on THP (Transparent Huge pages) can be adopted; specifically, the secure container can be started based on a container template created in a storage medium such as a disk and stored in small pages, and then a larger memory can be hot-plugged after startup (hot-plug small page memory or large page memory on demand).

[0056] In a paged virtual memory, both the virtual storage space and the physical storage space are usually divided into several fixed-size pages, and storage space is allocated to each thread in units of pages. The size of the "small page" can usually be set to 4K; the size of the "large page" can usually be set to 2MB, 1GB, or even larger.

[0057] It can be seen that in the embodiments shown above, when the THP-based template startup solution is adopted, on the one hand, the startup speed of the secure container is slowed down due to the need to hot-plug a larger memory; on the other hand, it cannot be guaranteed that the memory allocated to the secure container fully uses large page memory, and the performance cannot be maximized; on the other hand, the container template created in the form of small page storage may not be shared by secure containers deployed in different virtual machines, thereby increasing memory overhead.

[0058] In view of this, this specification aims to propose a technical solution for starting a secure container based on a general container startup template created in a file system that supports large page storage.

[0059] During implementation, the host machine may include: a container engine for managing the secure container running on the host machine and at least one micro virtual machine; wherein at least one secure container can be deployed on each micro virtual machine; the container engine can respond to a container startup template creation request corresponding to the target micro virtual machine, and create a general container startup template for starting the secure container deployed on the target micro virtual machine in a file system that supports large page storage; further, the container engine can store the general container startup template in the memory space of the target micro virtual machine in a memory-mapped manner; further, the container engine can respond to a container startup request for a target secure container deployed on the target micro virtual machine, obtain the general container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the obtained general container startup template.

[0060] It can be seen that in the technical solution in this specification, through memory mapping, the universal container startup template created in the file system supporting large page storage can be first stored in the memory space of the target micro virtual machine, and then the universal container startup template can be obtained from the memory space of the target micro virtual machine to start the target security container deployed on the target micro virtual machine; thereby overcoming the problem in the related technology that the file system supporting large page storage does not support read / write system calls, and realizing the startup of the target security container based on the universal container startup template created in the file system supporting large page storage.

[0061] Compared with the THP-based template startup solution, starting a secure container based on a universal container startup template created in a file system that supports large page storage can, on the one hand, speed up the startup of the secure container because there is no need to hot-plug a larger memory; on the other hand, since the universal container startup template used to start the target secure container is created in a file system that supports large page storage, it can ensure that the memory allocated to the target secure container fully uses large page memory, reducing problems such as table entry missing (TLB miss) and page fault interrupts, thereby improving container performance; on another hand, the universal container startup template can be shared by at least one micro virtual machine included in the host machine, that is, it can be shared by secure containers deployed in different micro virtual machines, thereby saving memory overhead in the file system for storing the universal container startup template.

[0062] The present application is described below through specific embodiments and in combination with specific application scenarios.

[0063] See also Figure 1 , Figure 1 This is a flowchart of a method for starting a secure container shown in an exemplary embodiment of this specification. The method can be applied to a container engine on a host machine; the host machine may include a container engine for managing secure containers running on the host machine and at least one micro virtual machine; at least one secure container may be deployed on the micro virtual machine. The method may perform the following steps:

[0064] Step 102: In response to a container startup template creation request corresponding to a target micro virtual machine, create a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage;

[0065] Step 104: storing the general container startup template in the memory space of the target micro virtual machine in a memory mapping manner;

[0066] Step 106: In response to a container startup request for a target secure container deployed on the target micro virtual machine, obtain the general container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the acquired general container startup template.

[0067] In this specification, the target micro virtual machine can be any micro virtual machine included in the host machine for deploying the target secure container; the target secure container can be any secure container to be started that is deployed on the target micro virtual machine.

[0068] For example, the container startup template creation request and / or container startup request received by the container engine may carry the micro virtual machine identifier of the target micro virtual machine and / or the container identifier of the target secure container; in response to receiving the container startup template creation request and / or container startup request, the micro virtual machine indicated by the micro virtual machine identifier carried therein may be used as the target micro virtual machine, and / or the micro virtual machine indicated by the container identifier carried therein may be used as the target micro virtual machine.

[0069] In this specification, in response to a container startup template creation request corresponding to the target micro virtual machine, a general container startup template for starting a secure container deployed on the target micro virtual machine can be created in a file system supporting large page storage.

[0070] Among them, the general container startup template can be understood as a container startup template that can be shared by different micro virtual machines. Since the general container startup template stored in a file system that supports large page storage can be stored in the memory space of different micro virtual machines in a memory mapping manner, one or more security containers deployed on the micro virtual machine can be started based on the general container startup template stored in the memory space of different micro virtual machines, so the general container template can be shared by different micro virtual machines. In addition, since the general container startup template is created in a file system that supports large page storage and fully uses large page memory, the target security container is started based on the general container template, and the memory allocated to the target security container can fully use large page memory.

[0071] For example, the file system supporting large page storage can be a Linux Hugetlbfs file system; the container engine can receive a container startup template creation request corresponding to the target micro virtual machine; in response to the container startup template creation request, a general container startup template can be created in the Linux Hugetlbfs file system, and the general container startup template can be used to start one or more secure containers deployed on the target micro virtual machine.

[0072] In one embodiment shown, the snapshot technology can be used to generate the general container startup template, and the general container startup template can be stored in a file system that supports large page storage. In implementation, the process of creating a general container startup template for starting the secure container deployed on the target micro virtual machine can specifically include: cold starting the target micro virtual machine to trigger the target micro virtual machine after the cold start to further start the agent program in its operating system for starting the secure container; in response to detecting the start of the agent program, taking a snapshot of the runtime state of the target micro virtual machine to generate the general container startup template.

[0073] For example, in response to a container startup template creation request corresponding to a target micro virtual machine, the micro virtual machine configuration information of the target micro virtual machine to be started can be determined based on the current container configuration information, and the current container configuration information may include the resources on which the target micro virtual machine depends under the current operating environment, such as storage resources, network resources, etc.; wherein the storage resources may include the back-end file path of the simulated device in the target micro virtual machine, the file name of the storage file, etc., and the network resources may include network ports, etc.; further, based on the determined micro virtual machine configuration information of the target micro virtual machine to be started, the target micro virtual machine can be cold started to trigger the target micro virtual machine after the cold start to further start the agent program in its operating system for starting the secure container; in response to detecting that the agent program is started, the runtime state (runtime state) of the target micro virtual machine can be snapshot and saved to generate the general container startup template.

[0074] Among them, the process of detecting whether the agent program is started may specifically include: after cold starting the target micro virtual machine, using a polling mechanism to periodically attempt to connect to the agent program, and if the connection is successful, it is determined that the agent program is started; or, in response to receiving a notification message actively sent to the container engine by the agent program after starting, it is determined that the agent program is started.

[0075] The general container startup template may include first startup information for starting any secure container deployed on the target micro virtual machine; the first startup information may specifically include: micro virtual machine configuration information for starting the target micro virtual machine, and container configuration information for starting any secure container deployed on the target micro virtual machine; the general container startup template may also be used to save the runtime state of the target micro virtual machine after the agent program is started. The container configuration information may specifically include but is not limited to container specifications, user address information corresponding to the application in the container, timestamp of container startup, container ID, etc.

[0076] It should be noted that, in the implementation shown above, after the agent program in the operating system of the target micro virtual machine is successfully started, the runtime state of the target micro virtual machine can be snapshotted and saved to obtain the general container startup template; since the startup process of the operating system and agent program of the client virtual machine of each secure container instance is similar, when starting the secure container based on the general container startup template, there is no need to restart the operating system and agent program of the client virtual machine. The target micro virtual machine can be switched to the runtime state after the agent program is run and saved in the general container startup template, so that the target micro virtual machine runs the agent program in the runtime state, thereby speeding up the startup speed of the secure container and saving CPU overhead when starting the secure container.

[0077] In this specification, after the general container startup template is created in a file system supporting large page storage, the general container startup template can be stored in the memory space of the target micro virtual machine in a memory mapping manner.

[0078] For example, after the general container startup template is created in the Linux Hugetlbfs file system, the general container startup template can be stored in the memory space of the target micro virtual machine in a memory mapping manner.

[0079] It should be noted that in the related art, the file system supporting large page storage usually does not support read / write system calls, that is, the container engine cannot directly access the file system through read / write system calls. Based on this, in the technical solution of this specification, the universal container startup template created in the file system supporting large page storage can be first stored in the memory space of the target micro virtual machine through memory mapping, and then the universal container startup template can be obtained from the memory space of the target micro virtual machine, so that the container engine can obtain the universal container startup template created in the file system.

[0080] In one embodiment shown, before storing the universal container startup template in the memory space of the target micro virtual machine in a memory-mapped manner, the method may further include: creating a template file for storing the universal container startup template in a subdirectory of the entry directory of the file system.

[0081] For example, the container engine can create a template file for storing the general container startup template in a subdirectory of the entry directory (i.e., the mount point) of the Linux Hugetlbfs file system, and can also use system calls such as truncate / ftruncate to set the file length of the template file to be consistent with the guest memory size.

[0082] In this case, the process of storing the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner may specifically include: in the memory space of the target micro virtual machine, memory mapping the template file in the file system for storing the universal container startup template to map the template file to the target memory address space in the memory space of the target micro virtual machine; writing the universal container startup template to the target memory address space.

[0083] For example, the universal container startup template created in the Linux Hugetlbfs file system can be stored in a corresponding template file; the target memory address space can be applied for in the memory space of the target micro virtual machine, and a corresponding relationship between the template file and the target memory address space can be established, and memory mapping can be performed to map the template file to the target memory address space in the memory space of the target micro virtual machine; further, the universal container startup template can be written to the target memory address space through the memcpy() function.

[0084] It should be noted that since the universal container startup template is created in a file system that supports large page storage and fully utilizes large page memory, in the memory space of the target micro virtual machine, large page memory is also allocated to the target memory address space for storing the universal container startup template.

[0085] In one possible embodiment, in order to further save memory in the target micro virtual machine for storing the universal container startup template, the universal container startup template can be stored in the memory space of the target micro virtual machine in the form of private memory mapping, and then multiple secure containers deployed on the target micro virtual machine can be started based on the same universal container startup template stored in the memory space of the target micro virtual machine.

[0086] During implementation, the process of performing memory mapping on the template file in the file system for storing the universal container startup template in the memory space of the target micro virtual machine to map the template file to the target memory address space in the memory space of the target micro virtual machine may specifically include: performing private memory mapping on the template file in the file system for storing the universal container startup template in the memory space of the target micro virtual machine to map the template file to the target private memory address space in the memory space of the target micro virtual machine.

[0087] For example, in the memory space of the target micro-virtual machine, the MAP_PRIVATE flag can be used to perform private memory mapping on the template file used to store the general container startup template in the file system, so as to map the template file to the target private memory address space in the memory space of the target micro-virtual machine. It should be noted that through private memory mapping, when each micro-virtual machine modifies the template file in the target private memory address space mapped to its memory space, it will not cause the data source (that is, the general container startup template stored in the file system) to change, nor will the modified content be synchronized to the memory of other secure container instances, thereby avoiding errors in all secure container instances started based on the general container startup template.

[0088] In this specification, since the file system does not support read / write system calls, the container engine cannot directly obtain the universal container startup template from the file system to start the target container. Therefore, in response to a container startup request for a target secure container deployed on the target micro virtual machine, the container engine can obtain the universal container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the obtained universal container startup template.

[0089] For example, after creating the universal container startup template in a file system that supports large page storage and storing the universal container startup template in the memory space of the target micro virtual machine in a memory-mapped manner, in response to receiving a container startup request for a target secure container deployed on the target micro virtual machine, the container engine can obtain the universal container startup template from the memory space of the target micro virtual machine and start the target secure container based on the obtained universal container startup template.

[0090] In one embodiment shown, after mapping the template file in the file system for storing the universal container startup template to the target memory address space in the memory space of the target micro virtual machine, and writing the universal container startup template to the target memory address space, the process of obtaining the universal container startup template from the memory space of the target micro virtual machine may specifically include: determining the template file for storing the universal container startup template in the file system; determining the target memory address space to which the template file is mapped in the memory space of the target micro virtual machine; and reading the universal container startup template from the target memory address space.

[0091] For example, after mapping the template file used to store the universal container startup template in the Linux Hugetlbfs file system to the target memory address space in the memory space of the target micro virtual machine, and writing the universal container startup template to the target memory address space, in response to a container startup request for a target secure container deployed on the target micro virtual machine, the template file used to store the universal container startup template can be determined in the Linux Hugetlbfs file system; further, the target memory address space to which the template file is mapped can be determined in the memory space of the target micro virtual machine, and the universal container startup template can be read from the target memory address space; further, the target secure container can be started based on the acquired universal container startup template.

[0092] In actual applications, the startup information for starting the target secure container carried in the container startup request is not necessarily completely compatible with the startup information included in the general container startup template acquired by the container engine; if the two are compatible, the target secure container can be started directly based on the startup information included in the general container startup template; if the two are not compatible, the startup information included in the general container startup template can be updated.

[0093] In one embodiment shown, the general container startup template includes first startup information for starting any secure container deployed on the target micro-virtual machine; the container startup request carries second startup information for starting the target secure container; the process of starting the target secure container based on the acquired general container startup template may specifically include: detecting whether the first startup information included in the acquired general container startup template is compatible with the second startup information carried by the container startup request; if so, starting the target secure container according to the acquired general container startup template; if not, updating the first startup information included in the general container startup template according to the second startup information, and starting the target secure container according to the updated general container startup template.

[0094] For example, in response to a container startup request for a target secure container deployed on the target micro virtual machine, the container engine can obtain the general container startup template from the memory space of the target micro virtual machine; further, the container engine can detect whether the first startup information included in the obtained general container startup template is compatible with the second startup information carried by the container startup request; if so, the target secure container is started according to the obtained general container startup template; if not, the first startup information included in the general container startup template is updated according to the second startup information, and the target secure container is started according to the updated general container startup template.

[0095] Among them, the process of detecting whether the first startup information and the second startup information are compatible can specifically include: determining whether the micro virtual machine configuration information included in the first startup information is consistent with the micro virtual machine configuration information included in the second startup information; and determining whether the container configuration information included in the first startup information is consistent with the container configuration information included in the second startup information; if both of the above are consistent, the first startup information and the second startup information are compatible; if at least one of the above is inconsistent, the first startup information and the second startup information are not compatible, and the first startup information is updated according to the second startup information.

[0096] The specific implementation method of starting the target secure container based on the general container startup template is as follows:

[0097] In a possible embodiment, the process of starting the target secure container based on the acquired general container startup template may specifically include: starting the target micro virtual machine based on the micro virtual machine configuration information included in the acquired general container startup template; switching the target micro virtual machine to the runtime state after the agent program saved in the general container startup template is run, so that the target micro virtual machine runs the agent program in the runtime state; starting the target secure container deployed on the target micro virtual machine based on the container configuration information included in the acquired general container startup template.

[0098] In another possible embodiment, the process of starting the target secure container according to the updated universal container startup template may specifically include: starting the target micro virtual machine according to the micro virtual machine configuration information included in the updated universal container startup template; switching the target micro virtual machine to the runtime state after the agent program saved in the universal container startup template is run, so that the target micro virtual machine runs the agent program in the runtime state; starting the target secure container deployed on the target micro virtual machine according to the container configuration information included in the updated universal container startup template.

[0099] In one embodiment shown, multiple general container startup templates can be created in the file system, and the multiple general container startup templates can be stored in the memory space of the target micro virtual machine in a memory-mapped manner; in response to a container startup request for a target secure container deployed on the target micro virtual machine, the container engine can parse the container configuration information of the secure container instance (that is, the container configuration information carried in the second startup information) through the secure container process, and the container configuration information of the secure container instance may include the container specification, network configuration information, etc. of the secure container instance; further, the container engine can obtain a general container startup template that meets the container specification of the secure container instance from the multiple general container startup templates in the memory space of the target micro virtual machine according to the container specification of the secure container instance indicated by the container startup request, and start the target secure container based on the obtained general container startup template.

[0100] It should be noted that, in the implementation shown above, a general container startup template is obtained according to the container specification corresponding to the container startup request, and the target secure container can be started preferentially based on the general container startup template consistent with the container specification; since the general container startup template contains a complete and successfully started micro virtual machine, and the container specification corresponding to the micro virtual machine is consistent with the container specification of the target secure container requested to be started by the user, after starting the target secure container based on the general container startup template, there is no need to adjust the container rules of the target secure container, thereby further improving the startup efficiency of the secure container. If there is currently no general container startup template that is consistent with the container specification of the target secure container requested to be started by the user, a general container startup template with the smallest difference between the container specification and the requested container specification can also be selected, so that after the target secure container is quickly started based on the general container startup template, the container specification requested by the user can be quickly achieved through fine-tuning.

[0101] Furthermore, after starting the target secure container, the container engine can also use the agent program to create a user's workload in the target secure container to implement the user's application.

[0102] It can be seen from the above technical solution that, through memory mapping, the universal container startup template created in the file system supporting large page storage can be first stored in the memory space of the target micro virtual machine, and then the universal container startup template can be obtained from the memory space of the target micro virtual machine to start the target security container deployed on the target micro virtual machine; thereby overcoming the problem in the related technology that the file system supporting large page storage does not support read / write system calls, and realizing the startup of the target security container based on the universal container startup template created in the file system supporting large page storage.

[0103] Compared with the THP-based template startup solution, starting a secure container based on a universal container startup template created in a file system that supports large page storage can, on the one hand, speed up the startup of the secure container because there is no need to hot-plug a larger memory; on the other hand, since the universal container startup template used to start the target secure container is created in a file system that supports large page storage, it can ensure that the memory allocated to the target secure container fully uses large page memory, reducing problems such as table entry missing (TLB miss) and page fault interrupts, thereby improving container performance; on another hand, the universal container startup template can be shared by at least one micro virtual machine included in the host machine, that is, it can be shared by secure containers deployed in different micro virtual machines, thereby saving memory overhead in the file system for storing the universal container startup template.

[0104] Corresponding to the above-mentioned embodiment of the method for starting a safety container, this specification also provides an embodiment of a device for starting a safety container.

[0105] See also Figure 2 , Figure 2 It is a schematic diagram of the structure of an electronic device where a startup device of a secure container is located, as shown in an exemplary embodiment of this specification. At the hardware level, the device includes a processor 202, an internal bus 204, a network interface 206, a memory 208, and a non-volatile memory 210, and of course may also include hardware required for other applications. One or more embodiments of this specification can be implemented based on software, such as the processor 202 reading the corresponding computer program from the non-volatile memory 210 into the memory 208 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0106] See also Figure 3 , Figure 3 FIG. 1 is a block diagram of a secure container startup device shown in an exemplary embodiment of the present specification. The secure container startup device can be applied to Figure 2 In the electronic device shown, the technical solution of this specification is implemented.

[0107] Wherein, the starting device of the safety container may include:

[0108] The template creation unit 302 is used to create a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage in response to a container startup template creation request corresponding to the target micro virtual machine;

[0109] A memory mapping unit 304 is used to store the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner;

[0110] The container startup unit 306 is used to respond to a container startup request for a target secure container deployed on the target micro virtual machine, obtain the general container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the acquired general container startup template.

[0111] In this embodiment, the memory mapping unit 304 is specifically used for:

[0112] In the memory space of the target micro virtual machine, memory mapping is performed on the template file in the file system for storing the universal container startup template, so as to map the template file to the target memory address space in the memory space of the target micro virtual machine;

[0113] The universal container startup template is written into the target memory address space.

[0114] In this embodiment, the template creation unit 302 is specifically used to:

[0115] A template file for storing the general container startup template is created in a subdirectory of the entry directory of the file system.

[0116] In this embodiment, the memory mapping unit 304 is specifically used for:

[0117] In the memory space of the target micro virtual machine, a template file in the file system for storing the universal container startup template is privately memory mapped to map the template file to a target private memory address space in the memory space of the target micro virtual machine.

[0118] In this embodiment, the container startup unit 306 is specifically used to:

[0119] Determining, in the file system, a template file for storing the general container startup template;

[0120] Determining the target memory address space to which the template file is mapped in the memory space of the target micro virtual machine;

[0121] The general container startup template is read from the target memory address space.

[0122] In this embodiment, the template creation unit 302 is specifically used to:

[0123] Cold-starting the target micro virtual machine to trigger the target micro virtual machine after the cold start to further start the agent program in its operating system for starting the secure container;

[0124] In response to detecting that the agent program is started, a snapshot of the runtime state of the target micro virtual machine is saved to generate the general container startup template.

[0125] In this embodiment, the general container startup template includes first startup information for starting any secure container deployed on the target micro virtual machine; the container startup request carries second startup information for starting the target secure container;

[0126] The container startup unit 306 is specifically used to:

[0127] Detecting whether the first startup information included in the acquired general container startup template is compatible with the second startup information carried by the container startup request;

[0128] If yes, start the target secure container according to the obtained general container startup template;

[0129] If not, the first startup information included in the general container startup template is updated according to the second startup information, and the target secure container is started according to the updated general container startup template.

[0130] In this embodiment, the first startup information includes: micro virtual machine configuration information for starting the target micro virtual machine, and container configuration information for starting any secure container deployed on the target micro virtual machine;

[0131] The container startup unit 306 is specifically used to:

[0132] Starting the target micro virtual machine according to the micro virtual machine configuration information included in the acquired general container startup template or the updated general container startup template;

[0133] Switching the target micro virtual machine to the runtime state after the agent program saved in the universal container startup template is run, so that the target micro virtual machine runs the agent program in the runtime state;

[0134] The target secure container deployed on the target micro virtual machine is started according to the container configuration information included in the acquired general container startup template or the updated general container startup template.

[0135] In this embodiment, the file system supporting large page storage is the Linux Hugetlbfs file system.

[0136] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0137] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0138] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0139] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0140] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0141] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0142] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0143] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for starting a secure container, the method being applied to a container engine on a host machine; the host machine comprises a container engine and at least one micro virtual machine for managing the secure container running on the host machine; At least one secure container is deployed on the micro virtual machine; the method comprises: In response to a container startup template creation request corresponding to a target micro virtual machine, creating a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage; Storing the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner; In response to a container startup request for a target secure container deployed on the target micro virtual machine, the general container startup template is obtained from the memory space of the target micro virtual machine, and the target secure container is started based on the obtained general container startup template.

2. According to the method of claim 1, storing the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner comprises: In the memory space of the target micro virtual machine, memory mapping is performed on the template file in the file system for storing the universal container startup template, so as to map the template file to the target memory address space in the memory space of the target micro virtual machine; The universal container startup template is written into the target memory address space.

3. According to the method of claim 2, before memory mapping the template file for storing the universal container startup template in the file system in the memory space of the target micro virtual machine, the method further comprises: A template file for storing the general container startup template is created in a subdirectory of the entry directory of the file system.

4. The method according to claim 2, wherein in the memory space of the target micro virtual machine, memory mapping is performed on the template file in the file system for storing the universal container startup template to map the template file to the target memory address space in the memory space of the target micro virtual machine, comprising: In the memory space of the target micro virtual machine, a template file in the file system for storing the universal container startup template is privately memory mapped to map the template file to a target private memory address space in the memory space of the target micro virtual machine.

5. According to the method of claim 2, the obtaining the universal container startup template from the memory space of the target micro virtual machine comprises: Determining, in the file system, a template file for storing the general container startup template; Determining the target memory address space to which the template file is mapped in the memory space of the target micro virtual machine; The general container startup template is read from the target memory address space.

6. According to the method of claim 1, the step of creating a universal container startup template for starting the secure container deployed on the target micro virtual machine comprises: Cold-starting the target micro virtual machine to trigger the target micro virtual machine after the cold start to further start the agent program in its operating system for starting the secure container; In response to detecting that the agent program is started, a snapshot of the runtime state of the target micro virtual machine is saved to generate the general container startup template.

7. According to the method of claim 6, the general container startup template includes first startup information for starting any secure container deployed on the target micro virtual machine; the container startup request carries second startup information for starting the target secure container; The starting the target secure container based on the acquired general container starting template includes: Detecting whether the first startup information included in the acquired general container startup template is compatible with the second startup information carried by the container startup request; If yes, start the target secure container according to the obtained general container startup template; If not, the first startup information included in the general container startup template is updated according to the second startup information, and the target secure container is started according to the updated general container startup template.

8. The method according to claim 7, wherein the first startup information comprises: Micro virtual machine configuration information for starting the target micro virtual machine, and container configuration information for starting any secure container deployed on the target micro virtual machine; The starting the target secure container according to the acquired general container startup template or the updated general container startup template includes: Starting the target micro virtual machine according to the micro virtual machine configuration information included in the acquired general container startup template or the updated general container startup template; Switching the target micro virtual machine to the runtime state after the agent program saved in the universal container startup template is run, so that the target micro virtual machine runs the agent program in the runtime state; The target secure container deployed on the target micro virtual machine is started according to the container configuration information included in the acquired general container startup template or the updated general container startup template.

9. The method according to claim 1, wherein the file system supporting large page storage is a Linux Hugetlbfs file system.

10. A secure container startup device, the device being applied to a container engine on a host machine; the host machine comprising a container engine and at least one micro virtual machine for managing the secure container running on the host machine; At least one secure container is deployed on the micro virtual machine; The device comprises: A template creation unit, configured to respond to a container startup template creation request corresponding to a target micro virtual machine and create a general container startup template for starting a secure container deployed on the target micro virtual machine in a file system supporting large page storage; A memory mapping unit, used to store the universal container startup template in the memory space of the target micro virtual machine in a memory mapping manner; A container startup unit is used to respond to a container startup request for a target secure container deployed on the target micro virtual machine, obtain the general container startup template from the memory space of the target micro virtual machine, and start the target secure container based on the acquired general container startup template.

11. An electronic device, comprising a communication interface, a processor, a memory and a bus, wherein the communication interface, the processor and the memory are interconnected via the bus; The memory stores machine-readable instructions, and the processor executes the method according to any one of claims 1 to 9 by calling the machine-readable instructions.

12. A machine-readable storage medium storing machine-readable instructions, wherein the machine-readable instructions, when called and executed by a processor, implement the method according to any one of claims 1 to 9.

Images