A data recovery method, device and electronic equipment of a Docker container

Abstract

The embodiment of the present application provides a kind of data recovery method, device and electronic equipment of Docker container, which comprises: obtaining the disk image file related to Docker container, disk image file is segmented into multiple clusters, from the data in each cluster meets the first target cluster of the log file format of Docker container.Reorganization splicing is obtained to the second target cluster with predefined rule to the first target cluster.Replacement first data with second data and above steps are recycled until the log file of Docker container is recovered.Therefore, through the embodiment of the present application, when log file is misdeletion and metadata is unavailable, it can be based on the log file format of Docker container that the cluster meeting the log file format of Docker container is reorganized and spliced.To restore the log file of Docker container.Facilitate the running state of Docker container, application and the analysis of the abnormal problem that appears.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data recovery method, apparatus, and electronic device for Docker containers. Background Technology

[0002] Data recovery is the process of restoring data lost due to hardware defects or accidental data entry, enabling it to be used normally. Software-based data recovery techniques rely on file system metadata, which records the location of the data on the disk, directory structure, and file allocation table. This information in the metadata is used to recover deleted data. However, data recovery based on file system metadata has significant limitations when the file system metadata is missing or the corresponding disk area has been overwritten.

[0003] In some scenarios, container technology achieves lightweight virtualization by isolating processes and resources. Docker is an open-source application container engine, and container-based virtualization technology, represented by Docker containers, is currently a hot topic in virtualization technology. Using Docker containers, containers can be quickly created and started from the image containing the application. After the Docker container is created and running, the application deployment is complete. After the application is deployed using Docker containers, both the Docker container itself and the deployed application run. During the operation of the Docker container and the deployed application, a large amount of logs are generated. These logs are crucial for analyzing the running status of the Docker container and application, as well as any anomalies that occur. When these log files are deleted and the metadata is unavailable, how to recover the Docker container's log files is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to provide a data recovery method, apparatus, and electronic device for Docker containers to solve the problem of recovering logs from Docker containers.

[0005] To solve the above-mentioned technical problems, the embodiments of the present invention are implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a data recovery method for a Docker container, comprising:

[0007] Obtain the disk image file associated with the Docker container, the disk image file containing data blocks of the Docker container's log file to be recovered;

[0008] The disk image file is divided into multiple clusters, and a first target cluster is selected from each cluster whose data conforms to the log file format of the Docker container.

[0009] The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data in the reassembled and spliced ​​first target cluster. The second data conforms to the log file format of the Docker container.

[0010] Replace the first data in the first target cluster with the second data and repeat the above steps until the log file of the Docker container is restored.

[0011] Secondly, embodiments of the present invention provide a data recovery device for a Docker container, comprising:

[0012] The acquisition module is used to acquire the disk image file associated with the Docker container, wherein the disk image file contains data blocks of the log file to be recovered from the Docker container;

[0013] The selection module is used to divide the disk image file into multiple clusters and select a first target cluster from each cluster whose data conforms to the log file format of the Docker container;

[0014] The reassembly and splicing module is used to reassemble and splice the first target cluster according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data in the reassembly and splicing first target cluster. The second data conforms to the log file format of the Docker container.

[0015] The replacement module is used to replace the first data in the first target cluster with the second data and repeat the above steps until the log file of the Docker container is restored.

[0016] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the data recovery method steps of the Docker container as described in the first aspect.

[0017] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data recovery method steps of the Docker container as described in the first aspect.

[0018] As can be seen from the technical solutions provided by the above embodiments of the present invention, after obtaining the disk image file related to the Docker container, the disk image file is divided into multiple clusters, and a first target cluster whose data conforms to the log file format of the Docker container is selected from each cluster. The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data from the reassembled and spliced ​​first target cluster, and the second data conforms to the log file format of the Docker container. The first data in the first target cluster is updated with the second data, and the above steps are repeated until the log file of the Docker container is recovered. Therefore, through the embodiments of the present invention, when the log file is accidentally deleted and the metadata is unavailable, clusters conforming to the log file format of the Docker container can be reassembled and spliced ​​based on the log file format of the Docker container, and this process can be repeated to recover the log file of the Docker container. This facilitates the analysis of the running status of the Docker container and application, as well as any abnormal problems that occur. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the first process of the data recovery method for Docker containers provided in an embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of a second process for a Docker container data recovery method provided in an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the third process of the data recovery method for Docker containers provided in this embodiment of the invention;

[0023] Figure 4 This is a schematic diagram of the module composition of the data recovery device for Docker containers provided in an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0025] This invention provides a method, apparatus, and electronic device for data recovery of Docker containers, which solves the problem of recovering logs from Docker containers.

[0026] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0027] In this embodiment, data recovery refers to the restoration of data lost due to hardware defects or misoperation, enabling its normal use. Data recovery techniques can be divided into two types: hardware-based data recovery and software-based data recovery. Hardware-based data recovery refers to any process involving hardware repair, recovering data lost due to hardware damage or failure. Recovery methods can include hardware replacement, firmware repair, and disk reading.

[0028] Software-based data recovery technology analyzes data from hardware-recovered data or data on normal storage devices to retrieve data lost or damaged due to accidental operations. It relies on file system metadata, which records the location of data on the disk, directory structure, and file allocation table. The information in the metadata is used to recover deleted data. The basic principle of software-based data recovery is that most file systems do not truly erase data from the disk when deleting it; they merely mark the storage area containing the deleted data as unallocated, allowing the file system to allocate this area to new files. However, file system metadata is often corrupted due to human error or overwriting of corresponding disk areas, making data recovery based on file system metadata highly limited.

[0029] To address the limitations of data recovery based on file system metadata, file sculpting technology emerged. File sculpting is a further development of traditional data recovery techniques. Without relying on file system metadata, it uses file system and operating system-specific information in a disk image to copy the byte sequences of all files belonging to the same file in an appropriate order to recover data. For example, it can recover deleted data using file system-specific logs, user operation logs, caches, and configuration information. Therefore, file sculpting can solve the problem of data recovery when metadata is unavailable. However, the sculpting method varies depending on the file type. When applying file sculpting for data recovery, it is essential to understand the type and internal structure of the data to be recovered. Sculpting methods include at least file structure-based sculpting, block content-based sculpting, statistical sculpting, semantic sculpting, and mapping function-based sculpting.

[0030] In some scenarios, container technology achieves lightweight virtualization by isolating processes and resources. Container-based virtualization technology, represented by Docker containers, is currently a hot topic in virtualization technology. Docker containers are an open-source application container engine that can virtualize the operating system, treating the physical operating system as multiple logical operating systems. Different operating systems have their own user spaces, achieving isolation between applications. Docker containers are created based on images. Using Docker containers, you can quickly create and start containers from the image containing the application. After the Docker container is created and running, the application deployment is complete. Multiple Docker containers can be deployed on a single physical machine, with each Docker container isolated from the others; this physical machine is called the host machine.

[0031] After an application is deployed using Docker containers, both the Docker container itself and the deployed application can run. During the operation of the Docker container and the deployed application, the Docker container creates a file on the host machine associated with that container and stores the generated logs in that file. These logs are crucial for analyzing the running status and anomalies of the Docker container and application. When these logs are deleted and the metadata becomes unavailable, how to recover the Docker container logs is a technical problem that needs to be solved by those skilled in the art.

[0032] Therefore, embodiments of the present invention provide a technical solution that can solve the above problems, as detailed below.

[0033] For example, the data recovery method for Docker containers provided in this embodiment of the invention can be used to recover log files of Docker containers driven by the json-file logging plugin. The log file of the Docker container driven by json-file consists of several log lines, each log line including a first identifier "{" and "}". Here, "{" indicates the start of the log line, and "}" indicates the end of the log line. Log lines are separated by newline characters. Each log line consists of several component objects, each component object having its corresponding second identifier.

[0034] For example, the log line contains the following components from left to right: log content (first component), log source (second component), log attributes (third component), and timestamp (fourth component).

[0035] The log content is stored in key-value pairs, with the key being "log" and the value being separated by a colon (:). The value is the string containing the log content.

[0036] Log sources are stored as key-value pairs, with the key "stream" separated from the value by a colon (:). The value is the string representing the log source. Log sources can include at least standard output (Standardoutput, stdout) and standard error (Standarderror, stderr).

[0037] The keyword for log attributes is "attrs", and the separator between the attribute and the value is a colon (:). The value consists of several key-value pairs, and the keyword and value of each key-value pair can be customized.

[0038] The timestamp is stored as a key-value pair. The key is "time", and the separator between the key and the value is ":". The value is the string of timestamps, in the format "year-month-dayT hour:minute:secondZ", which can be accurate to nanoseconds.

[0039] For example, the following provides log lines from a Docker container's log file driven by the json-file logging plugin: {\"log\":\" / #\u001b[6n\r / #\u001b[Jls\r\n",\"stream\":\"stdout"\",\"attrs\":{\"\tag\":\"123\"},\"time\":{"\2020-09-25T12:20:48.394177093Z\"},|$}.

[0040] For example, regarding the log files of the Docker container using the json-file logging plugin mentioned above, such as... Figure 1 As shown, this embodiment of the invention provides a data recovery method for Docker containers. The execution subject of this method can be a server, which can be an independent server or a server cluster composed of multiple servers. Moreover, the server can be a server capable of performing data recovery for Docker containers.

[0041] The data recovery method may specifically include the following steps:

[0042] In S101, a disk image file associated with the Docker container is obtained, the disk image file containing data blocks of the log file to be recovered from the Docker container.

[0043] Specifically, when creating a Docker container, the host machine creates the Docker container based on the Docker container's folder mount parameters and the corresponding application image. The folder mount parameters include the Docker container's identifier. During the Docker container creation process, a folder corresponding to the Docker container's root directory is created. On the host machine, a host root directory and a corresponding target address are created, and the folder corresponding to the Docker container's root directory is mounted to the target address corresponding to the host root directory. The target address contains the Docker container's identifier. This identifier can uniquely identify the Docker container. Thus, based on the Docker container's identifier, the root directory of the corresponding target address is located, and the folders contained in that root directory are copied as a disk image file.

[0044] The disk image file contains byte sequences of the log file to be recovered. These byte sequences can be used as data blocks of the log file to be recovered as the basis for recovering the log file.

[0045] In S102, the disk image file is divided into multiple clusters, and the first target cluster is selected from each cluster whose data conforms to the log file format of the Docker container.

[0046] Specifically, the disk image file described above can be processed into a byte stream, and then the byte stream can be divided into multiple clusters, each cluster being the same size. The cluster size can be a predefined fixed value, such as 512 bytes, but other values ​​can also be defined; this embodiment of the invention does not impose any limitations on this. Then, the byte streams contained within each cluster are converted into strings for recognition.

[0047] For example, after the byte stream within each cluster is converted into a recognizable string, the strings within each cluster are analyzed to identify the cluster corresponding to the string that conforms to the log file format of the log line.

[0048] Furthermore, data conforming to the log file format includes at least data conforming to the log line structure and data conforming to the structure of at least one of the constituent objects in the log line.

[0049] For example, data conforming to the log line structure includes: the data carrying a first identifier { and}. Here, {log content, log source, log attribute, timestamp} can be considered as a log line. A log line may include at least one word and / or at least one sentence.

[0050] For example, data conforming to a log line includes: the data carrying a second identifier of the constituent objects of the log line.

[0051] Specifically, when the data carries the first component object (log content) of a log line, the second identifier can be at least \"log\":\".+?\" (?=, |$) (e.g., \"log\":\" / #\u001b[6n\r / #\u001b[Jls\r\n"). Here, \"log\":\" serves as the beginning of the first component object, followed by a string of at least one character length, and ends with \" as the end of the string, with a single character immediately following \" to mark the end of the cluster.

[0052] When the data carries the second component object (log source) of the log line, the second identifier can be at least \"stream\":\"(stdout|stderr)\" (?=,|$) (e.g., \"stream\":\"stdout"\"). Here, \"stream\":\" serves as the beginning, followed by a string that can only be either stdout or stderr, and ends with \" . Furthermore, this ending must be followed by a cluster terminator.

[0053] When the data carries the third component object (log attributes) of the log line, the second identifier can be at least \"attrs\":{(?:\"\w+\":\".+?\",) The expression `\w+":\".+?\"}(?=,|$)` (e.g., `\attrs":{\"\tag":\"123\"}`) begins with `\attrs":{` followed by one or more identical strings matching `\w+":\".+?\"`. It consists of two strings of at least one length enclosed in quotation marks (e.g., `\w+` and `.+?` above) and separated by a colon (`:`). If multiple strings match the pattern `\w+":\".+?\"`, they are separated by commas and end with a `}` followed by a semicolon (``) to mark the end of the cluster.

[0054] When the data carries the fourth component object (timestamp) of the log line, the second identifier can be at least \"time\":{"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{1,9}Z\"(?=},|$) (e.g., \"time\":{"\2020-09-25T12:20:48.394177093Z\"},|$). Here, \"time\":{ serves as the beginning, and the following \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{1,9}Z represents the date and time string. The time is accurate to at most nanoseconds, i.e., 9 decimal places. The date and time are separated by a T. Finally, it ends with Z} (e.g., Z\"(?=}), and this ending must be followed by one as the end of the cluster.

[0055] Furthermore, such as Figure 2 As shown, there are many different implementations of S102. Here is another set of optional implementations, see S1020-S1027 for details.

[0056] In S1020, a cluster is read and the data within the cluster is identified.

[0057] In S1021, it is determined whether the data within the cluster conforms to the log file format. If yes, proceed to S1022; otherwise, proceed to S1023.

[0058] In S1022, it is determined whether the data within the cluster is a plain text cluster containing only log content. If yes, proceed to S1024; otherwise, proceed to S1025.

[0059] In S1023, this cluster is abandoned.

[0060] In S1024, check if there are consecutive plain text clusters. If yes, proceed to S1026; otherwise, proceed to S1027.

[0061] In S1025, save the cluster.

[0062] In S1026, a predetermined number of plain text clusters are retained.

[0063] In S1027, the plain text cluster is retained.

[0064] Specifically, within the first target cluster conforming to the log file format, the first target cluster carrying the log content can be called a plain text cluster. For several plain text clusters carrying log content, there can be individual plain text clusters and related clusters. Related clusters and individual plain text clusters can be determined based on chronological order or the identifier of the Docker container carried by the cluster. The identifier of the Docker container can be the Docker container ID number or the address of the folder storing the Docker container's log files, etc.

[0065] For example, to determine whether the current plain text cluster has associated clusters, all first target clusters are first sorted in ascending or descending order by timestamp. Alternatively, the first target clusters can be categorized according to whether they carry container identifiers for Docker containers, grouping clusters carrying Docker container identifiers into one category. Then, the first target clusters within each category are further sorted in ascending or descending order by timestamp. This serves as the basis for subsequently selecting adjacent clusters.

[0066] For the current plain text cluster, if it contains only the latter half of the log content conforming to the log content format (the part closest to the log source, i.e., only containing the end marker of the log source (such as \")), then starting from the current plain text cluster, a predetermined number of consecutive plain text clusters preceding the current plain text cluster are selected as associated clusters in chronological order. If there is only one adjacent consecutive plain text cluster preceding the current plain text cluster, the predetermined number is 1, meaning only the plain text cluster preceding the current plain text cluster is selected as an associated cluster. If there is no adjacent consecutive plain text cluster preceding the current plain text cluster, then the current plain text cluster is treated as a separate plain text cluster. If there are n adjacent consecutive plain text clusters preceding the current plain text cluster, the predetermined number can be at least N. Here, N = maximum log content length / predetermined cluster size. When n is less than N, the predetermined number is n; when n is greater than N, the predetermined number is N. The maximum log content length and predetermined cluster size are customizable; for example, the maximum log content length can be 5. If the cluster size is 512B and the predetermined cluster size is 512B, then N is 5. Selected plain text clusters that are contiguous with the current plain text cluster are considered as a group of associated clusters.

[0067] For the current plain text cluster, if it contains only the first half of the log content conforming to the log content format (i.e., only the beginning marker of the log content, such as "log":"), then starting from the current plain text cluster, a predetermined number of consecutive plain text clusters following the current plain text cluster are selected as associated clusters in chronological order. If there is only one adjacent consecutive plain text cluster following the current plain text cluster, the predetermined number is 1, meaning only the plain text cluster following the current plain text cluster is selected as an associated cluster. If there is no adjacent consecutive plain text cluster following the current plain text cluster, then the current plain text cluster is treated as a separate plain text cluster. If there are n adjacent consecutive plain text clusters following the current plain text cluster, the predetermined number can be at least N. Here, N = maximum log content length / predetermined cluster size. When n is less than N, the predetermined number is n; when n is greater than N, the predetermined number is N. The maximum log content length and predetermined cluster size are customizable; for example, the maximum log content length can be 5. If the cluster size is 512B and the predetermined cluster size is 512B, then N is 5. Selected plain text clusters that are contiguous with the current plain text cluster are considered as a group of associated clusters.

[0068] For example, log content may include at least one of words and sentences, wherein a sentence may include multiple words, and a log line may include multiple sentences and multiple words.

[0069] After arranging the first target clusters in chronological order, each first target cluster has its own adjacent target clusters.

[0070] In S103, the first target cluster is recombined and spliced ​​according to predefined rules to obtain the second target cluster.

[0071] Specifically, the second target cluster contains each of the first data clusters within the first target cluster that are being reassembled and spliced.

[0072] The second data generated subsequently also conforms to the log file format of the Docker container.

[0073] When recombining the first target cluster, any two first target clusters can be selected for recombination, resulting in...

[0074] The recombined clusters are then selected. Finally, a second target cluster that meets the requirements is chosen from these recombined clusters.

[0075] In S104, the first data in the first target cluster is replaced with the second data, and the above steps are repeated until the log files of the Docker container are restored.

[0076] As can be seen from the technical solutions provided by the above embodiments of the present invention, after obtaining the disk image file related to the Docker container, the disk image file is divided into multiple clusters, and a first target cluster whose data conforms to the log file format of the Docker container is selected from each cluster. The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster, wherein the second target cluster contains second data formed by splicing the first data in the reassembled and spliced ​​first target cluster, and the second data conforms to the log file format of the Docker container. The first data in the first target cluster is updated with the second data, and the above steps are repeated until the log file of the Docker container is restored.

[0077] Therefore, through this embodiment of the invention, when log files are accidentally deleted and metadata is unavailable, clusters conforming to the Docker container's log file format can be reassembled and concatenated based on the Docker container's log file format. By repeating this process, the Docker container's log files can be recovered. This facilitates the analysis of the Docker container, application's running status, and any abnormal issues that occur.

[0078] Furthermore, such as Figure 3 As shown, there are many different ways to process S103. Here is another optional implementation method. For details, please refer to the processing of S1031-S1034 below.

[0079] In S1031, each of the first target clusters is recombined and spliced ​​in pairs to obtain multiple recombined clusters.

[0080] In S1032, all conflicting recombination clusters are extracted from each of the recombination clusters.

[0081] Specifically, the specific implementation of step S1032 may include:

[0082] Calculate the probability that the recombined data in the resulting recombined cluster conforms to the log file format after pairwise recombination and splicing of the first target clusters.

[0083] For example, if the seam between the two first target clusters being reassembled is a log line or log content within a log line, the probability is the set of similarities between the new log content or log line generated at the seam and the existing log content or log line (as the second value). If the seam between the two first target clusters being reassembled is the log source, log attribute, and timestamp of a log line, the probability is 1 (as the second value). If the seam is other data, the probability is 0 (as the first value).

[0084] Furthermore, similarity is calculated as the ratio of the edit distance to the maximum length value of the data in the compared objects. For example, if the compared objects are a new word and existing words, where the maximum length of the new word is 512 bytes and the edit distance between the new word and the existing words is 300, then the similarity is 58%.

[0085] The first target cluster to be reassembled and spliced, and the probability are linked together.

[0086] For example, the structure of the link can be (data in the first target cluster 1, data in the first target cluster 2, the probability that the recombined data in the recombined cluster after the first target cluster 1 and the first target cluster 2 are concatenated conforms to the log file format).

[0087] Find the first target link with a probability of a first value from each of the links, and save the first target cluster in the first target link as the identified log data block.

[0088] For example, the first value can be 0.

[0089] Find a second target link with a probability of the second value from each of the links, and compare whether the first target cluster contained in any two second links is repeated.

[0090] For example, the second value can be 1, and the third value can be a set of similarity scores.

[0091] If there is a duplicate, the two sets of links are considered conflicting links, and the recombinant clusters corresponding to the conflicting links are considered conflicting recombinant clusters.

[0092] For example, if there is a conflict between two links (a, b, p1) and (c, d, p2) where (a == c) or (b == d) exists (where a, b, c, d represent data in the first target cluster, and p1 and p2 represent the probabilities that the data in the new cluster formed after the recombination and splicing of a and b or c and d conforms to the log file format), or if a0 == bn and an == b0 occurs in two sets of links (a0, a1, p1), ..., (am-1, am, pm) and (b0, b1, q1), ..., (bn-1, bn, qn), then it indicates that there is a conflict between the two links.

[0093] Specifically, as an optional implementation of step S1032, S1032 includes:

[0094] Calculate the probability that the recombined data in the resulting recombined cluster conforms to the log file format after pairwise recombination and splicing of the first target clusters. The probability includes multiple category values.

[0095] The first target cluster to be reassembled and spliced ​​is a set of links composed of probabilities.

[0096] Based on the probability-based category value, compare whether the first target cluster contained in any two sets of links is repeated. If they are repeated, the two sets of links are conflicting links, and the recombined clusters corresponding to the conflicting links are regarded as conflicting recombined clusters.

[0097] For example, after recombining two first target clusters, the data within each of the two first target clusters are recombined and spliced ​​together to obtain new data content as the recombined data. Such as new words, new sentences, and new log lines.

[0098] In S1033, conflict elimination is performed on recombinant clusters that have conflicts.

[0099] Specifically, as an optional implementation of S1033, S1033 specifically includes:

[0100] Conflict elimination is performed on recombinant clusters with conflicting class values ​​based on probability.

[0101] Specifically, conflict resolution for conflicting recombination clusters based on probability-based class values ​​includes:

[0102] If the probabilities of both sides in a conflict are the first value and / or the second value, and the probabilities are different, the recombined cluster with the higher probability is saved; if the probabilities are the same, the recombined clusters of both sides in a conflict are discarded.

[0103] For example, the probability category values ​​can be divided into a first value (which can be 0), a second value (which can be a set), and a third value (which can be 1). For recombination clusters with probability values ​​of 0 and 1, the recombination cluster with a probability value of 1 is selected as the retained recombination cluster, and the recombination cluster with a probability value of 0 is discarded. For recombination clusters with probability values ​​of both 0 and 1, both recombination clusters are discarded.

[0104] When the probability of one of the conflicting parties is the third value, the conflicting parties are grouped and voted on according to the data category distribution. The voting results of each group are then voted on again. If the number of votes differs, the recombined cluster with the larger number of votes is retained; if the number of votes is the same, both recombined clusters of the conflicting parties are discarded.

[0105] For example, when the probability of one of the conflicting parties is a set, voting is conducted on both parties based on words, sentences, and log lines. For instance, the voting results for the conflicting parties are words and sentences, respectively. For these word and sentence votes, another vote is conducted, with three possible outcomes: for, against, and a draw. Each vote adds one vote to one party and subtracts one vote from the other. For example, if the first party casts one vote, its vote count increases by 1, and the other party's vote count decreases by 1. If the first party casts another vote, its vote count increases by 1 again, and the other party's vote count decreases by 1. If the first party's vote count is higher than the second party's, the first party is retained, and the second party is discarded. If the first and second parties have 0 or equal vote counts, both are discarded.

[0106] It is evident that conflict resolution for conflicting clusters improves the success rate of recovering Docker container log files.

[0107] In S1034, the recombined cluster after conflict elimination and the recombined cluster without conflict are taken as the second target cluster.

[0108] As an optional embodiment of the present invention, in order to accelerate the search speed of the first target cluster and the second target cluster, the first target cluster and the second target cluster can be stored using a VP tree. A VP tree is a binary tree that can classify and store the first target cluster and the second target cluster. Thus, when searching for a cluster, it is only necessary to search within the corresponding category, without traversing all the data, thereby accelerating the efficiency of data searching.

[0109] For example, the first or second target cluster with Docker container identifiers can be saved as one category, and the first or second target cluster without Docker container identifiers can be saved as another category. Alternatively, the first or second target cluster with timestamps can be saved as one category. Of course, the classification method for the first and second target clusters can also be other types, and this embodiment of the invention is not limited thereto.

[0110] As can be seen from the technical solutions provided by the above embodiments of the present invention, after obtaining the disk image file related to the Docker container, the embodiments of the present invention divide the disk image file into multiple clusters, and select a first target cluster from each cluster whose data conforms to the log file format of the Docker container. The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster, wherein the second target cluster contains second data formed by splicing the first data from the reassembled and spliced ​​first target cluster, and the second data conforms to the log file format of the Docker container. The first data in the first target cluster is updated with the second data, and the above steps are repeated until the log file of the Docker container is recovered. Therefore, through the embodiments of the present invention, when the log file is accidentally deleted and the metadata is unavailable, clusters conforming to the log file format of the Docker container can be reassembled and spliced ​​based on the log file format of the Docker container, and this process can be repeated to recover the log file of the Docker container. This facilitates the analysis of the running status of the Docker container and application, as well as any abnormal problems that occur.

[0111] Based on the same technical concept, and corresponding to the Docker container data recovery method provided in the above embodiments, this invention also provides a Docker container data recovery device. Figure 4 This is a schematic diagram of the module composition of a Docker container data recovery device provided in an embodiment of the present invention. The Docker container data recovery device is used to execute... Figures 1 to 3 The described data recovery method for Docker containers, such as Figure 4 As shown, the data recovery device for the Docker container includes: an acquisition module 401, a selection module 402, a reassembly and splicing module 403, and a replacement module 404.

[0112] The acquisition module 401 is used to acquire a disk image file related to the Docker container, wherein the disk image file contains data blocks of the log file to be recovered of the Docker container;

[0113] The selection module 402 is used to divide the disk image file into multiple clusters and select a first target cluster from each cluster whose data conforms to the log file format of the Docker container;

[0114] The reassembly and splicing module 403 is used to reassemble and splice the first target cluster according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data in the reassembly and splicing first target cluster. The second data conforms to the log file format of the Docker container.

[0115] Replacement module 404 is used to replace the first data in the first target cluster with the second data and repeat the above steps until the log file of the Docker container is restored.

[0116] As can be seen from the technical solutions provided by the above embodiments of the present invention, after obtaining the disk image file related to the Docker container, the disk image file is divided into multiple clusters, and a first target cluster whose data conforms to the log file format of the Docker container is selected from each cluster. The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data from the reassembled and spliced ​​first target cluster, and the second data conforms to the log file format of the Docker container. The first data in the first target cluster is updated with the second data, and the above steps are repeated until the log file of the Docker container is recovered. Therefore, through the embodiments of the present invention, when the log file is accidentally deleted and the metadata is unavailable, clusters conforming to the log file format of the Docker container can be reassembled and spliced ​​based on the log file format of the Docker container, and this process can be repeated to recover the log file of the Docker container. This facilitates the analysis of the running status of the Docker container and application, as well as any abnormal problems that occur.

[0117] Optionally, the data recovery device described above includes at least a storage unit (not shown in the figure) for storing the first target cluster and the second target cluster using a VP tree.

[0118] Optionally, the selection module 402 includes a selection unit. The log file includes at least a number of log lines, and each log line includes a number of component objects. The selection unit is used to select a first target cluster whose data carries a first identifier of the log line and whose data carries a second identifier of at least one component object, as conforming to the log file format of the Docker container.

[0119] Optionally, the first target cluster selected by the selection unit includes at least several clusters that contain the first constituent object in the log line;

[0120] Several clusters containing the first component objects in the log lines are multiple sets of associated clusters, and each set of associated clusters is determined based on the time order or the identifier of the Docker container carried by the cluster;

[0121] The first component is the log content within the log line.

[0122] Optionally, the reassembly and splicing module 403 includes at least a reassembly and splicing unit, an extraction unit, and a conflict resolution unit.

[0123] The recombination and splicing unit is used to recombine and splice each first target cluster in pairs to obtain multiple recombined clusters.

[0124] The extraction unit is used to extract all conflicting recombination clusters from each recombination cluster.

[0125] The conflict resolution unit is used to resolve conflicts in recombined clusters. The recombined clusters after conflict resolution, as well as the recombined clusters without conflicts, are used as the second target clusters.

[0126] Optionally, the extraction unit includes: a calculation subunit, a composition subunit, and a comparison subunit.

[0127] The computational subunit is used to calculate the probability that the recombined data in the resulting recombined cluster conforms to the log file format after pairwise recombination and splicing of the first target clusters. The probability includes multiple category values.

[0128] The constituent subunit is used to link the first target cluster and the probability to be reassembled and spliced.

[0129] The comparison subunit is used to compare the first target clusters contained in any two sets of links based on probability-based category values. If they are repeated, the two sets of links are not in conflict and the recombinant clusters corresponding to the conflicting links are regarded as the conflicting recombinant clusters.

[0130] The Docker container data recovery device provided in this embodiment of the invention can realize the various processes in the embodiments corresponding to the above-described Docker container data recovery method. To avoid repetition, these processes will not be described again here.

[0131] It should be noted that the Docker container data recovery device provided in this embodiment of the invention and the Docker container data recovery method provided in this embodiment of the invention are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned Docker container data recovery method, and the repeated parts will not be described again.

[0132] Corresponding to the Docker container data recovery method provided in the above embodiments, based on the same technical concept, this embodiment of the invention also provides an electronic device for executing the above-described Docker container data recovery method. Figure 5 To illustrate the structure of an electronic device according to various embodiments of the present invention, as shown in the schematic diagram... Figure 5As shown. Electronic devices can vary considerably due to differences in configuration or performance, and may include one or more processors 501 and memory 502. Memory 502 may store one or more application programs or data. Memory 502 may be temporary or persistent storage. The application programs stored in memory 502 may include one or more modules (not shown), each module may include a series of computer-executable instructions for the electronic device. Furthermore, processor 501 may be configured to communicate with memory 502 and execute the series of computer-executable instructions in memory 502 on the electronic device. The electronic device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input / output interfaces 505, and one or more keyboards 506.

[0133] Specifically, in this embodiment, the electronic device includes a processor, a communication interface, a memory, and a communication bus; wherein, the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the following method steps:

[0134] Obtain the disk image file associated with the Docker container, which contains data blocks of the Docker container's log file to be restored;

[0135] The disk image file is divided into multiple clusters, and the first target cluster whose data within each cluster conforms to the log file format of the Docker container is selected from each cluster.

[0136] The first target cluster is reassembled and spliced ​​according to predefined rules to obtain the second target cluster. The second target cluster contains the second data formed by splicing the first data in the reassembled and spliced ​​first target cluster. The second data conforms to the log file format of Docker container.

[0137] Replace the first data in the first target cluster with the second data and repeat the above steps until the Docker container's log file is restored.

[0138] This embodiment also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the following steps:

[0139] Obtain the disk image file associated with the Docker container, which contains data blocks of the Docker container's log file to be restored;

[0140] The disk image file is divided into multiple clusters, and the first target cluster whose data within each cluster conforms to the log file format of the Docker container is selected from each cluster.

[0141] The first target cluster is reassembled and spliced ​​according to predefined rules to obtain the second target cluster. The second target cluster contains the second data formed by splicing the first data in the reassembled and spliced ​​first target cluster. The second data conforms to the log file format of Docker container.

[0142] Replace the first data in the first target cluster with the second data and repeat the above steps until the Docker container's log file is restored.

[0143] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0148] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0149] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0150] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0151] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0152] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for data recovery of a Docker container, characterized in that, The method includes: Obtain the disk image file associated with the Docker container, wherein the disk image file contains data blocks of the log file to be recovered from the Docker container; The disk image file is divided into multiple clusters, and a first target cluster is selected from each cluster whose data conforms to the log file format of the Docker container. The first target cluster is reassembled and spliced ​​according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data in the reassembled and spliced ​​first target cluster. The second data conforms to the log file format of the Docker container. Replace the first data in the first target cluster with the second data and repeat the above steps until the log file of the Docker container is restored; The step of recombining and splicing the first target cluster according to predefined rules to obtain the second target cluster includes: Each of the first target clusters is recombined and spliced ​​in pairs to obtain multiple recombined clusters; Extract all conflicting recombination clusters from each of the aforementioned recombination clusters; Conflict elimination is performed on recombinant clusters that have conflicts; The recombined clusters after conflict resolution and the recombined clusters without conflicts are used as the second target clusters.

2. The method according to claim 1, characterized in that, The method for saving the first target cluster and the second target cluster includes using a VP tree to save the first target cluster and the second target cluster.

3. The method according to claim 1, characterized in that, The log file of the Docker container includes at least several log lines, and each log line includes several component objects; The first target cluster is selected from the clusters whose data carries the first identifier of the log line and whose data carries the second identifier of at least one of the constituent objects.

4. The method according to claim 3, characterized in that, The first target cluster includes at least several clusters that contain the first component object in the log line; Several clusters containing the first component objects in the log lines are multiple sets of associated clusters, and each set of associated clusters is determined based on the time order or the identifier of the Docker container carried by the cluster; The first component is the log content within the log line.

5. The method according to claim 1, characterized in that, The step of extracting all conflicting recombination clusters from each of the recombination clusters includes: Calculate the probability that the recombined data in the resulting recombined cluster conforms to the log file format after recombining and splicing the first target clusters in pairs. The probability includes multiple category values. The first target cluster to be reassembled and spliced, and the probability, are linked together. Based on the category value of the probability, compare whether the first target cluster contained in any two sets of links is repeated. If they are repeated, the two sets of links are conflicting links, and the recombinant clusters corresponding to the conflicting links are regarded as conflicting recombinant clusters.

6. The method according to claim 5, characterized in that, The conflict elimination of the recombinant clusters with conflicts includes: Conflict elimination is performed on recombinant clusters that have conflicts based on the category value of the probability.

7. A detection device for a cloud security system, characterized in that, The device includes: The acquisition module is used to acquire disk image files related to Docker containers, wherein the disk image files contain data blocks of the log files to be recovered from the Docker containers; The selection module is used to divide the disk image file into multiple clusters and select a first target cluster from each cluster whose data conforms to the log file format of the Docker container; The reassembly and splicing module is used to reassemble and splice the first target cluster according to predefined rules to obtain a second target cluster. The second target cluster contains second data formed by splicing the first data in the reassembly and splicing first target cluster. The second data conforms to the log file format of the Docker container. The replacement module is used to replace the first data in the first target cluster with the second data and repeat the above steps until the log file of the Docker container is restored; The reconstruction and splicing module includes a reconstruction and splicing unit, an extraction unit, and a conflict resolution unit. The recombination and splicing unit is used to recombine and splice each of the first target clusters in pairs to obtain multiple recombination clusters; The extraction unit is used to extract all conflicting recombination clusters from each of the recombination clusters; The conflict elimination unit is used to eliminate conflicts in recombinant clusters that have conflicts; The recombined clusters after conflict resolution and the recombined clusters without conflicts are used as the second target clusters.

8. An electronic device, characterized in that, The device includes a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the data recovery method steps of the Docker container as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the data recovery method for a Docker container as described in any one of claims 1-6.

Images