Container access method and device, electronic equipment and readable storage medium

Abstract

The present disclosure provides a container access method and device, electronic equipment and readable storage medium, and relates to the technical field of artificial intelligence such as cloud computing and big data. The container access method comprises: receiving an access request; determining an access permission and a target access container according to the access request; in the case of determining that the access permission is a read-only permission, creating a temporary access container according to the target access container, forwarding the access request to the temporary access container to complete the access, otherwise forwarding the access request to the target access container to complete the access. The present disclosure enables the container cluster to support accessing the container with read-only permission or with read-write permission at the same time, thereby improving the flexibility of container access and enhancing the running stability of the container cluster.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, in particular to the technical field of artificial intelligence such as cloud computing and big data. A container access method, device, electronic equipment and readable storage medium are provided. BACKGROUND

[0002] The prior art can only use the default permission to complete the access of the container when accessing the container. The default permission is set in advance when the container is created, and the default permission cannot be modified after the container is created, which has the technical problem of poor flexibility of container access. SUMMARY

[0003] According to a first aspect of the present disclosure, a container access method is provided, comprising: receiving an access request; determining an access permission and a target access container according to the access request; in a case where the access permission is determined to be a read-only permission, creating a temporary access container according to the target access container, forwarding the access request to the temporary access container to complete the access, otherwise forwarding the access request to the target access container to complete the access.

[0004] According to a second aspect of the present disclosure, a container access device is provided, comprising: a receiving unit configured to receive an access request; a determining unit configured to determine an access permission and a target access container according to the access request; and an access unit configured to, in a case where the access permission is determined to be a read-only permission, create a temporary access container according to the target access container, forward the access request to the temporary access container to complete the access, otherwise forward the access request to the target access container to complete the access.

[0005] According to a third aspect of the present disclosure, an electronic equipment is provided, comprising: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0006] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to perform the method as described above.

[0007] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method as described above.

[0008] It can be seen from the above technical solutions that the present disclosure realizes the separation of read-only permission and read-write permission when the container is accessed, so that the container cluster can support accessing the container with read-only permission or with read-write permission at the same time, thereby improving the flexibility of container access and enhancing the running stability of the container cluster.

[0009] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings are used to better understand the present scheme and do not constitute a limitation on the present disclosure. Among them:

[0011] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure;

[0012] Figure 2 is a schematic diagram according to the second embodiment of the present disclosure;

[0013] Figure 3 is a schematic diagram according to the third embodiment of the present disclosure;

[0014] Figure 4 is a block diagram of an electronic device for implementing the container access method according to the embodiments of the present disclosure. DETAILED DESCRIPTION

[0015] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to help understanding, and should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Also, in order to be clear and concise, descriptions of well-known functions and mechanisms are omitted in the following description.

[0016] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure. As Figure 1 shown, the container access method of the present embodiment specifically includes the following steps:

[0017] S101, receiving an access request;

[0018] S102, determining an access permission and a target access container according to the access request;

[0019] S103, in the case where the access permission is determined to be read-only permission, creating a temporary access container according to the target access container, forwarding the access request to the temporary access container to complete the access, otherwise forwarding the access request to the target access container to complete the access.

[0020] The execution subject of the container access method of the embodiment is a container cluster running on a container cloud platform. After receiving an access request, the container cluster first determines an access permission and a target access container according to the access request, and then forwards the access request to the target access container or a temporary access container according to the different access permissions, so as to complete the container access. The embodiment can separate the read-only permission and the read-write permission during the container access, and support accessing the container with the read-only permission or the read-write permission, thereby improving the flexibility of the container access and enhancing the running stability of the container cluster.

[0021] The container cluster running on the container cloud platform in the embodiment can be a Kubernetes (k8s) cluster, a k3s cluster, or other types of clusters.

[0022] The access request received by the container cluster of the embodiment in S101 contains identification information and container access information. The identification information corresponds to an input end that sends the access request, and can be at least one of an input end ID, an input end name, and an input end user group to which the input end belongs. The container access information corresponds to a target access container to be accessed by the input end, and can be an IP address of the container, a domain name of the container, or the like.

[0023] When the container cluster executes S101 to receive the access request, it can receive the access request sent directly by the input end, or receive the access request forwarded by the cluster agent. After receiving the access request sent by the input end, the cluster agent determines the container cluster to be accessed by the input end according to the container access information in the access request, and then forwards the access request to the determined container cluster.

[0024] It can be understood that when the input end sends an access request to the container cluster or the cluster agent (for example, the input end sends an access request through a Web page or a command line terminal environment), the input end can first authenticate the input end by using secondary authentication or other authentication methods to obtain identification information, and then add the obtained identification information to the access request for sending.

[0025] In addition to the identification information and the container access information, the access request received by the container cluster of the embodiment in S101 can further contain an expected permission. The expected permission is a permission input or selected by the input end when sending the access request through a Web page or a command line terminal environment.

[0026] After the container cluster of the embodiment executes S101 to receive the access request, it executes S102 to determine an access permission and a target access container according to the access request. The access permission determined by the container cluster of the embodiment is one of a read-only permission and a read-write permission.

[0027] The container cluster of the embodiment can employ an optional implementation manner when determining the access permission according to the access request in S102, which is: obtaining the identification information from the access request; taking the preset permission corresponding to the obtained identification information as the access permission; wherein the container cluster of the embodiment can determine the preset permission corresponding to the identification information according to a preset relationship table, which contains the corresponding relationship between different identification information and different preset permissions.

[0028] That is to say, compared with the manner that the container cluster in the prior art takes the default permission as the access permission after receiving the access request, the container cluster of the embodiment can obtain different access permissions according to different received access requests, thereby supporting access with read-only permission or access with read-write permission at the same time, improving the accuracy of the determined access permission and enhancing the comprehensiveness of container access.

[0029] It can be understood that the container cluster of the embodiment can also update the preset relationship table periodically, specifically, update the identification information and / or the preset permission corresponding to the identification information contained in the preset relationship table at a preset time interval.

[0030] The container cluster of the embodiment can also contain the following content when taking the preset permission corresponding to the obtained identification information as the access permission in S102: obtaining the expected permission from the access request; in the case where the expected permission is determined to be the same as the preset permission, taking the expected permission as the access permission, otherwise taking the preset permission as the access permission.

[0031] That is to say, the container cluster of the embodiment can also determine the access permission in combination with the expected permission in the access request, thereby improving the accuracy and rationality of the determined access permission.

[0032] The container cluster of the embodiment can employ an optional implementation manner when determining the target access container according to the access request in S102, which is: obtaining the container access information from the access request; taking the container corresponding to the obtained container access information as the target access container.

[0033] In addition, since the target access container is located in a certain pod in a certain node of the container cluster, the container cluster of the embodiment can further determine the node and / or the pod where the target access container is located according to the container access information after obtaining the container access information in S102.

[0034] The container cluster of the embodiment executes S103, and in a case where the access permission is read-only permission, creates a temporary access container according to the target access container, forwards the access request to the temporary access container to complete the access, or forwards the access request to the target access container to complete the access in a case where the access permission is not read-only permission.

[0035] That is, the container cluster of the embodiment forwards the access request to the temporary access container or the target access container according to different access permissions, realizes the purpose of separating read-only permission and read-write permission during container access, avoids the problem that only the default permission of the container can be used to access the container in the prior art, and thus expands the function of container access.

[0036] Specifically, when the container cluster of the embodiment executes S103 to create the temporary access container according to the target access container, an optional implementation manner that can be adopted is as follows: determining a target container group according to the target access container; creating a temporary container in the determined target container group; obtaining a target namespace and a target root directory of the target access container; adding the target namespace to the created temporary container and mounting the target root directory to obtain the temporary access container.

[0037] That is, the temporary access container created in the target container group of the container cluster of the embodiment is added with the target namespace of the target access container and mounted with the target root directory of the target access container, so that the input end can view the same content in the temporary access container as in the target access container, thereby realizing the purpose of the input end accessing the container with read-only permission.

[0038] In addition, when the container cluster of the embodiment executes S103 to obtain the temporary access container, the identification information contained in the access request can also be added to the temporary access container, so that it is more clear to display which input end is currently accessing the temporary access container.

[0039] When the container cluster of the embodiment executes S103 to determine the target container group according to the target access container, an optional implementation manner that can be adopted is as follows: taking a node where the target access container is located as a target node; and taking a container group in the target node that meets a preset requirement as the target container group.

[0040] When the container cluster of the embodiment executes S103 to take the container group in the target node that meets the preset requirement as the target container group, the container group in the target node where the target access container is located can be taken as the target container group, or the container group with the lowest load in the target node can be taken as the target container group.

[0041] The container cluster of this embodiment can further assign preset computing resources (e.g., preset CPU, preset memory, etc.) to the created temporary container when creating the temporary container in the determined target container group in S103, thereby improving the accuracy of computing resource allocation and avoiding waste of computing resources.

[0042] When forwarding the access request to the temporary access container or the target access container in S103, the container cluster of this embodiment can first establish a communication connection (e.g., a communication connection based on the Websocket protocol) with the temporary access container or the target access container, and then forward the access request to the temporary access container or the target access container through the established communication connection.

[0043] To avoid waste of computing resources, the container cluster of this embodiment can further include the following content after forwarding the access request to the temporary access container in S103: deleting the temporary access container in a case where it is determined that the container access has been completed; wherein the container cluster of this embodiment can determine that the container access has been completed in a case where the temporary access container exits at the input end, or can determine that the container access has been completed in a case where the creation duration of the temporary access container exceeds a duration threshold.

[0044] Figure 2 is a schematic diagram according to the second embodiment of the present disclosure. Figure 2A flowchart of the container access in the Kubernetes cluster of the embodiment is shown: the input initiates a container access operation at the web end or command line, obtains the identification information of the input after secondary authentication; the input sends an access request containing the identification information and container access information to the cluster agent; the cluster agent determines the Kubernetes cluster where the target container is located according to the container access information, and then forwards the access request to the k8s-APIServer in the Kubernetes cluster; the k8s-APIServer determines the access permission according to the access request, and then forwards the determined access permission and the access request to the Exec-Server (which is an API server additionally extended in the Kubernetes cluster); the Exec-Server sends the access request to the Execd-Agent (resident single machine, used to replace the Kubelet service in the node to respond to the access request) of the node where the target access container is located in the case of determining that the access permission is read-only permission, and sends the access request to the node where the target access container is located in the case of determining that the access permission is read-write permission, so that the node calls the Kubelet service to directly forward the access request to the target access container; the Execd-Agent creates a temporary access container (Exec Container) in the target container group (TargetPod) according to the target access container (Target Container), and can allocate designed computing resources to the temporary access container according to the Cgroups mechanism.

[0045] Figure 3 is a schematic diagram according to the third embodiment of the present disclosure. As shown in Figure 3 the container access device 300 of the embodiment is located in a container cluster and includes:

[0046] a receiving unit 301, configured to receive an access request;

[0047] a determining unit 302, configured to determine an access permission and a target access container according to the access request;

[0048] an access unit 303, configured to create a temporary access container according to the target access container in the case of determining that the access permission is read-only permission, and forward the access request to the temporary access container to complete the access, or forward the access request to the target access container to complete the access.

[0049] The container cluster running in the container cloud platform in the embodiment can be a Kubernetes (k8s) cluster, a k3s cluster, or other types of clusters.

[0050] The access request received by the receiving unit 301 contains identification information and container access information; the identification information corresponds to the input end that sends the access request, and can be at least one of an input end ID, an input end name, and an input end user group to which the input end belongs; the container access information corresponds to a target access container to be accessed by the input end, and can be an IP address of the container, a domain name of the container, or the like.

[0051] When receiving the access request, the receiving unit 301 can receive the access request sent directly by the input end, or receive the access request forwarded by the cluster agent; after receiving the access request sent by the input end, the cluster agent determines the container cluster to be accessed by the input end according to the container access information in the access request, and then forwards the access request to the receiving unit 301 in the determined container cluster.

[0052] It can be understood that when the input end in the embodiment sends an access request to the container cluster or the cluster agent, the input end can first use a secondary authentication or other authentication method to authenticate the input end to obtain identification information, and then add the obtained identification information to the access request for sending.

[0053] In addition to the identification information and the container access information, the access request received by the receiving unit 301 can further contain expected permissions; the expected permissions are permissions input or selected by the input end when sending the access request in a Web page or a command line terminal environment.

[0054] After the container cluster in the embodiment receives the access request by the receiving unit 301, the determining unit 302 determines the access permission and the target access container according to the access request; the access permission determined by the determining unit 302 is one of a read-only permission and a read-write permission.

[0055] The optional implementation of the determining unit 302 when determining the access permission according to the access request is: obtaining the identification information from the access request; taking a preset permission corresponding to the obtained identification information as the access permission; the determining unit 302 can determine the preset permission corresponding to the identification information according to a preset relationship table, which contains the correspondence between different identification information and different preset permissions.

[0056] That is, compared with the way in which the container cluster in the prior art takes a default permission as the access permission after receiving the access request, the embodiment can obtain different access permissions according to different received access requests, thereby supporting access with a read-only permission or access with a read-write permission at the same time, improving the accuracy of the determined access permission, and enhancing the comprehensiveness of container access.

[0057] It can be understood that the determination unit 302 can also periodically update the preset relationship table, specifically, update the identification information and / or the preset permission corresponding to the identification information in the preset relationship table at a preset time interval.

[0058] When the determination unit 302 determines the preset permission corresponding to the obtained identification information as the access permission, the following content can also be included: obtaining an expected permission from the access request; in a case where it is determined that the expected permission is the same as the preset permission, taking the expected permission as the access permission, otherwise taking the preset permission as the access permission.

[0059] That is, the determination unit 302 can also determine the access permission in combination with the expected permission in the access request, thereby improving the accuracy and rationality of the determined access permission.

[0060] The optional implementation manner that the determination unit 302 can adopt when determining the target access container according to the access request is: obtaining container access information from the access request; taking a container corresponding to the obtained container access information as the target access container.

[0061] In addition, since the target access container is located in a certain pod in a certain node in the container cluster, after obtaining the container access information, the determination unit 302 can further determine the node and / or the pod where the target access container is located according to the container access information.

[0062] After the container cluster of the embodiment determines the access permission and the target access container by the determination unit 302, the access unit 303 creates a temporary access container according to the target access container in a case where the access permission is a read-only permission, forwards the access request to the temporary access container to complete the access, or forwards the access request to the target access container to complete the access in a case where the access permission is not a read-only permission.

[0063] That is, the access unit 303 forwards the access request to the temporary access container or the target access container according to the different access permissions, realizes the purpose of separating the read-only permission and the read-write permission during container access, avoids the problem that only the default permission of the container can be used to access the container in the prior art, and thereby expands the function of container access.

[0064] Specifically, the optional implementation manner that the access unit 303 can adopt when creating the temporary access container according to the target access container is: determining a target pod according to the target access container; creating a temporary container in the determined target pod; obtaining a target namespace and a target root directory of the target access container; adding the target namespace to the created temporary container and mounting the target root directory to obtain the temporary access container.

[0065] That is, the temporary access container created by the access unit 303 in the target container group, because it adds the target namespace of the target access container and mounts the target root directory of the target access container, enables the input end to view the same content in the temporary access container as the target access container, so as to achieve the purpose of the input end accessing the container with read-only permission.

[0066] In addition, the access unit 303 can also add the identification information contained in the access request to the temporary access container when obtaining the temporary access container, so as to more clearly show which input end is currently accessing the temporary access container.

[0067] The optional implementation of the access unit 303 when determining the target container group according to the target access container is that the node where the target access container is located is taken as the target node, and the container group in the target node that meets the preset requirement is taken as the target container group.

[0068] The access unit 303 can take the container group where the target access container is located in the target node as the target container group, or take the container group with the lowest load in the target node as the target container group when taking the container group in the target node that meets the preset requirement as the target container group.

[0069] The access unit 303 can also allocate preset computing resources (such as preset CPU, preset memory, etc.) to the created temporary container when creating the temporary container in the determined target container group, so as to improve the allocation accuracy of computing resources and avoid waste of computing resources.

[0070] The access unit 303 can first establish a communication connection with the temporary access container or the target access container when forwarding the access request to the temporary access container or the target access container, and then forwards the access request to the temporary access container or the target access container through the established communication connection.

[0071] The container access device 300 of the embodiment can also include a deletion unit 304 for executing the following content: deleting the temporary access container in the case of determining that the container access has been completed; wherein the deletion unit 304 can determine that the container access has been completed in the case that the input end exits the temporary access container, or can determine that the container access has been completed in the case that the creation duration of the temporary access container exceeds the duration threshold.

[0072] In the technical solution of the present disclosure, the acquisition, storage and application of user personal information comply with relevant laws and regulations and do not violate public order and good customs.

[0073] According to the embodiments of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium and a computer program product.

[0074] As Figure 4 shown, is a block diagram of an electronic device for a container access method according to embodiments of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0075] As Figure 4 shown, the device 400 includes a computing unit 401 that can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded into a random access memory (RAM) 403 from a storage unit 408. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0076] Various components in the device 400 are connected to the I / O interface 405, including an input unit 406, such as a keyboard, a mouse, etc., an output unit 407, such as various types of displays, speakers, etc., a storage unit 408, such as a magnetic disk, an optical disk, etc., and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0077] The computing unit 401 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 401 performs various methods and processes described above, such as the container access method. For example, in some embodiments, the container access method can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 408.

[0078] In some embodiments, portions or all of the computer program can be loaded onto the apparatus 400 via the ROM 402 and / or the communications unit 409. When the computer program is loaded onto the RAM 403 and executed by the computer unit 401, one or more steps of the container access method described above can be performed. Alternatively, in other embodiments, the computer unit 401 can be configured, by any suitable means (for example, by means of firmware), to perform the container access method.

[0079] Various implementations of the systems and techniques described here can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0080] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general or special purpose computer, special purpose computer, or other programmable computing apparatus to produce a machine, such that the program code, when executed by the processor or controller, implements the functions / operations specified in the flowcharts and / or block diagrams. The program code can execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

[0081] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0082] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0083] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0084] The computer system can include clients and servers. This relationship can be. remote, where each server is stored on a remote computer from a client. The clients and the servers can be connected through a communication network. The relationship can be a client-server relationship over a network. Servers can be cloud servers, also known as cloud computing servers or cloud hosts, which are a host product in the cloud computing service system to solve the defects of large management difficulty and weak business scalability in traditional physical hosts and VPS services (Virtual Private Server, or VPS for short). The server can also be a server of a distributed system or a server combined with a blockchain.

[0085] It should be understood that the various forms of flow shown above can be reordered, steps added or deleted. For example, the steps described in the present disclosure can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, which are not limited herein.

[0086] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A container access method, comprising: receiving an access request; determining an access permission and a target access container according to the access request; in a case where the access permission is determined to be a read-only permission, creating a temporary access container according to the target access container, forwarding the access request to the temporary access container to complete the access, or forwarding the access request to the target access container to complete the access; wherein the creating of the temporary access container according to the target access container comprises: determining a target container group according to the target access container; creating a temporary container in the target container group; obtaining a target namespace and a target root directory of the target access container; adding the target namespace to the temporary container and mounting the target root directory to obtain the temporary access container.

2. The method of claim 1, wherein, The determining of the access permission according to the access request comprises: obtaining identification information from the access request; determining a preset permission corresponding to the identification information as the access permission.

3. The method of claim 2, wherein, The determining of the preset permission corresponding to the identification information as the access permission comprises: obtaining an expected permission from the access request; in a case where the expected permission is determined to be the same as the preset permission, determining the expected permission as the access permission, or determining the preset permission as the access permission.

4. The method of claim 1, wherein, The determining of the target container group according to the target access container comprises: determining a target node in which the target access container is located as a target node; determining a container group in the target node that meets a preset requirement as the target container group.

5. The method according to any one of claims 1-4, further comprising: in a case where it is determined that the container access has been completed, deleting the temporary access container.

6. A container access apparatus, comprising: a receiving unit configured to receive an access request; a determining unit configured to determine an access permission and a target access container according to the access request; an access unit configured to, in a case where the access permission is determined to be a read-only permission, create a temporary access container according to the target access container, forward the access request to the temporary access container to complete the access, or forward the access request to the target access container to complete the access; wherein the access unit, when creating the temporary access container according to the target access container, specifically performs: determining a target container group according to the target access container; creating a temporary container in the target container group; obtaining a target namespace and a target root directory of the target access container; adding the target namespace to the temporary container and mounting the target root directory to obtain the temporary access container.

7. The apparatus of claim 6, wherein, The determining unit, when determining the access permission according to the access request, specifically performs: obtaining identification information from the access request; determining a preset permission corresponding to the identification information as the access permission.

8. The apparatus of claim 7, wherein, The determining unit, when determining the preset permission corresponding to the identification information as the access permission, specifically performs: obtaining an expected permission from the access request; in a case where the expected permission is determined to be the same as the preset permission, determining the expected permission as the access permission, or determining the preset permission as the access permission. In a case where it is determined that the expected permission is the same as the preset permission, the expected permission is taken as the access permission, otherwise the preset permission is taken as the access permission.

9. The apparatus of claim 6, wherein, The access unit specifically performs the following in determining the target container group according to the target access container: Taking a node where the target access container is located as a target node; Taking a container group in the target node that meets a preset requirement as the target container group.

10. The apparatus according to any one of claims 6-9, further comprising a deletion unit configured to perform the following: In a case where it is determined that the container access has been completed, deleting the temporary access container.

11. An electronic device, comprising: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

12. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-5.

13. A computer program product comprising a computer program which, when executed by a processor, implements the method of any one of claims 1-5.

Images