Container-based resource control method, device, computer equipment and storage medium

Abstract

The present application provides a container-based resource control method, device, computer equipment and storage medium, the method checks the container in an operational state through the docker sdk; obtains the container startup parameters corresponding to the container in the operational state, and configures the container in the operational state with the corresponding target network resource speed limit policy according to the container startup parameters; and controls the network resources of the container in the operational state according to the target network resource speed limit policy. Through the above manner, the present invention configures the target network resource speed limit policy for the container through the pre-configured container startup parameters, thereby limiting the speed of the network resources of the container, effectively isolating and reusing the network resources of the host machine, without the need for other cumbersome configuration operations, and does not affect the use of other non-speed-limited containers, thereby improving the user experience.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a container-based resource control method, device, computer equipment and storage medium. Background Art

[0002] In the scenario of providing containerized PAAS services, similar to the demand for virtual machines in the public cloud scenario, it is necessary to be able to limit the use of the network, disk, CPU, and memory by the container to avoid the situation where a container occupies too many resources and affects the use of other containers. At present, it is basically sufficient to directly use the control group cgroup native to the container docker to limit the use of disk, CPU, and memory resources. However, docker lacks restrictions on the use of the network, which requires users to implement it themselves. Containerized PAAS services must limit the broadband speed and broadband traffic of each business container running on the host. The host network has two types of single-port and multi-port access. The network of the container configured on the host also needs to support host and bridge modes, and the upstream and downstream speeds need to be limited. Docker does not provide an integrated solution for the needs of these scenarios, and cannot effectively isolate and reuse the network resources of the host. Therefore, how to effectively isolate and reuse the network resources of the host has become an urgent problem to be solved. Summary of the invention

[0003] The present application provides a container-based resource control method, apparatus, computer equipment, and storage medium to effectively isolate and reuse the network resources of a host machine.

[0004] In a first aspect, the present application provides a container-based resource control method, characterized in that the container-based resource control method includes:

[0005] Check the runnable container through docker sdk;

[0006] Obtaining container startup parameters corresponding to the container in the runnable state, and configuring the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters;

[0007] The network resources of the container in the runnable state are controlled according to the target network resource speed limit policy.

[0008] Furthermore, the container-based resource control method further includes:

[0009] Start a thread to loop monitor container events in the container;

[0010] When a creation event is monitored, it is determined whether a first container to be created has pre-configured startup parameters;

[0011] When the pre-configured startup parameter exists in the first container, a network speed limit policy is configured for the first container according to the pre-configured startup parameter.

[0012] Furthermore, after the startup thread cyclically monitors the container events in the container, it also includes:

[0013] When a destruction event is monitored, the network speed limit policy corresponding to the second container of the event to be destroyed is deleted.

[0014] Furthermore, configuring a network speed limit policy for the first container according to the preconfigured startup parameters includes:

[0015] When the network mode of the first container is the host mode, according to the speed limit parameters corresponding to each WAN network port in the pre-configured startup parameters, the speed limit configuration of the uplink bandwidth of each network port is performed;

[0016] The network traffic of the first container is configured with the ingress virtual device ifb interface, and a speed limit is configured for the downstream rate of the ifb interface to limit the downstream speed of the first container.

[0017] Furthermore, configuring a network speed limit policy for the first container according to the preconfigured startup parameters includes:

[0018] When the network mode of the first container is bridge mode, according to the speed limit parameter corresponding to the host veth in the pre-configured startup parameters, a TC speed limit policy is configured for the veth to limit the downlink speed of the first container;

[0019] Configure the traffic of the veth port to the ingress virtual device ifb interface, and configure the uplink rate of the ifb interface to limit the uplink speed.

[0020] Furthermore, clustering a plurality of users according to the historical behavior information to obtain user groups includes:

[0021] The up and down events of the network port are monitored through netlink. When a restart event of the network port is detected and the speed limit of each container associated with the network port needs to be read, the network speed limit policy of each container is reconfigured.

[0022] Furthermore, the container-based resource control method further includes:

[0023] After completing the configuration of the network resource rate limit policy, the traffic flowing through each rate limit policy is obtained as container traffic through the netlink interface exposed by TC, and the container traffic metric is exposed through prometheus.

[0024] In a second aspect, the present application further provides a container-based resource control device, the container-based resource control device comprising:

[0025] Run the container inspection module to check the runnable container through the docker sdk;

[0026] A speed limit policy configuration module, used to obtain container startup parameters corresponding to the container in the runnable state, and configure the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters;

[0027] The network resource control module is used to control the network resources of the container in the executable state according to the target network resource speed limit policy.

[0028] In a third aspect, the present application also provides a computer device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and implement the container-based resource control method as described above when executing the computer program.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the container-based resource control method as described above.

[0030] The present application discloses a container-based resource control method, device, computer equipment and storage medium, the method checks the container in an operational state through the docker sdk; obtains the container startup parameters corresponding to the container in the operational state, and configures the container in the operational state with the corresponding target network resource speed limit policy according to the container startup parameters; controls the network resources of the container in the operational state according to the target network resource speed limit policy. Through the above manner, the present invention configures the target network resource speed limit policy for the container through the pre-configured container startup parameters, thereby limiting the speed of the network resources of the container, effectively isolating and reusing the network resources of the host machine, without the need for other cumbersome configuration operations, and does not affect the use of other non-speed-limited containers, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 is a schematic flow chart of a container-based resource control method provided by an embodiment of the present application;

[0033] Figure 2 It is a schematic diagram of the container speed limiting effect provided by the embodiment of the present application;

[0034] Figure 3 is a schematic block diagram of a container-based resource control device provided by an embodiment of the present application;

[0035] Figure 4 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0038] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0039] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0040] The embodiments of the present application provide a container-based resource control method, apparatus, computer equipment, and storage medium. The container-based resource control method can be applied to a server. The server can be an independent server or a server cluster.

[0041] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0042] See also Figure 1 , Figure 1 The embodiment of the present application provides a schematic flow chart of a container-based resource control method. The container-based resource control method can be applied to a server.

[0043] like Figure 1 As shown, the container-based resource control method specifically includes steps S101 to S103.

[0044] S101. Check the container in the runnable state through docker sdk;

[0045] S102: Obtain container startup parameters corresponding to the container in the runnable state, and configure the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters;

[0046] S103: Control network resources of the container in the executable state according to the target network resource rate limiting policy.

[0047] In this embodiment, after the program is started, the docker sdk is first used to check all containers in the running state, and the preset container startup parameters, that is, the preset label -- label "com.docker-tc.enabled=1" are used to determine whether to configure the speed limit policy for the corresponding container. If the container has set the corresponding container startup parameters, the target network resource speed limit policy is configured for the container, and the network resources of the container are controlled according to the target network resource speed limit policy.

[0048] The present application discloses a container-based resource control method, device, computer equipment and storage medium, the method checks the container in an operational state through the docker sdk; obtains the container startup parameters corresponding to the container in the operational state, and configures the container in the operational state with the corresponding target network resource speed limit policy according to the container startup parameters; controls the network resources of the container in the operational state according to the target network resource speed limit policy. Through the above manner, the present invention configures the target network resource speed limit policy for the container through the pre-configured container startup parameters, thereby limiting the speed of the network resources of the container, effectively isolating and reusing the network resources of the host machine, without the need for other cumbersome configuration operations, and does not affect the use of other non-speed-limited containers, thereby improving the user experience.

[0049] Furthermore, the container-based resource control method further includes:

[0050] Start a thread to loop monitor container events in the container;

[0051] When a creation event is monitored, it is determined whether a first container to be created has pre-configured startup parameters;

[0052] When the pre-configured startup parameter exists in the first container, a network speed limit policy is configured for the first container according to the pre-configured startup parameter.

[0053] Furthermore, after the startup thread cyclically monitors the container events in the container, it also includes:

[0054] When a destruction event is monitored, the network speed limit policy corresponding to the second container of the event to be destroyed is deleted.

[0055] In this embodiment, a thread is started to cyclically monitor the events of the container. For the creation event create event, the speed limit policy needs to be applied to the container; for the destruction event die event, the speed limit policy of the container needs to be deleted. By monitoring dockerevent, the creation and destruction events of the docker container are obtained in real time. If it is a container creation event, read whether the container is configured with the startup parameters to enable bandwidth speed limit, read the cgroupid and speed limit bandwidth and other parameters of the network speed limit, apply TC's HTB speed limit policy to configure the speed limit, and for the container destruction event, the speed limit policy of the corresponding container needs to be deleted. This system supports upstream and downstream speed limits, and supports multi-port speed limits. Users only need to configure the corresponding --label "com.docker-tc.enabled=1" startup parameter in the container that needs speed limit. Supports two network modes of NetworkMode host and bridge; supports the configuration of the basic rate rate and the maximum rate ceil of the speed limit; supports traffic collection for containers configured with speed limits.

[0056] Furthermore, configuring a network speed limit policy for the first container according to the preconfigured startup parameters includes:

[0057] When the network mode of the first container is the host mode, according to the speed limit parameters corresponding to each WAN network port in the pre-configured startup parameters, the speed limit configuration of the uplink bandwidth of each network port is performed;

[0058] The network traffic of the first container is configured with the ingress virtual device ifb interface, and a speed limit is configured for the downstream rate of the ifb interface to limit the downstream speed of the first container.

[0059] Furthermore, configuring a network speed limit policy for the first container according to the preconfigured startup parameters includes:

[0060] When the network mode of the first container is bridge mode, according to the speed limit parameter corresponding to the host veth in the pre-configured startup parameters, a TC speed limit policy is configured for the veth to limit the downlink speed of the first container;

[0061] Configure the traffic of the veth port to the ingress virtual device ifb interface, and configure the uplink rate of the ifb interface to limit the uplink speed.

[0062] In this embodiment, the speed limit of the container needs to distinguish the network mode. The network mode of the first container can be the host mode or the bridge mode, that is, net=host and net=bridge, and the corresponding speed limit method is used to implement it. The configuration of the speed limit policy uses the netlink method to configure the TC policy. For the host mode, it is necessary to configure the speed limit policy on the WAN network port. If there are multiple network ports, it is necessary to configure the speed limit policy for each network port separately. Since the speed limit policy of TC is used to limit the upstream bandwidth, if the downstream bandwidth needs to be limited, the traffic of the network port needs to be ingressed to the ifb interface, and then the ifb interface is speed-limited, so as to achieve the limitation of the downstream rate. For the bridge mode, the speed limit can be directly performed on the veth port corresponding to the container. Since the upstream and downstream traffic of the veth port on the bridge mode host machine is swapped with the upstream and downstream of the container side, the tc speed limit policy for the host machine veth actually limits the downstream traffic of the container. If the upstream traffic of the container is to be limited, the veth port needs to be ingressed to the ifb interface, and then the ifb interface is speed-limited.

[0063] Furthermore, clustering a plurality of users according to the historical behavior information to obtain user groups includes:

[0064] The up and down events of the network port are monitored through netlink. When a restart event of the network port is detected and the speed limit of each container associated with the network port needs to be read, the network speed limit policy of each container is reconfigured.

[0065] In this embodiment, since the speed limit configuration of TC is a non-persistent configuration, if the corresponding network port restarts, all speed limit policies on the network port will become invalid. Netlink is needed to monitor the up and down events of the network port. When a restart event of the network port is detected, the speed limit of each container associated with the network port needs to be read and the speed limit policy of each container needs to be reconfigured.

[0066] The speed limit policy of the container and TC is associated through cgroupid. After the container is started, you need to configure cgroupid in the file corresponding to the Virtual File System of the container cgroup. There are two main cgroup drivers: cgroupfs and systemd. The configuration paths of different cgroup drivers are different. The cgroupid corresponds to the TC policy of classid, which associates the container with the speed limit policy.

[0067] In order to configure the downstream speed limit, an ingress mirror is configured for the corresponding network port. For example, the traffic of eth0 is mirrored to ifbeth0. If ifbeth0 is deleted directly, the network of eth0 will be unavailable. A thread is required to regularly clean up the ingress policy of the network port with netlink.U32.RedirIndex==0 in the filter.

[0068] Furthermore, the container-based resource control method further includes:

[0069] After completing the configuration of the network resource rate limit policy, the traffic flowing through each rate limit policy is obtained as container traffic through the netlink interface exposed by TC, and the container traffic metric is exposed through prometheus.

[0070] In this embodiment, after using TC for traffic speed limiting, the netlink interface exposed by TC is used to obtain the traffic flowing through each speed limit policy, which can be used as container traffic. The upstream and downstream traffic of each container is exposed using prometheus to expose the traffic metric.

[0071] Understandably, the process of deploying and starting the service is as follows:

[0072] Deploy the service on each server that needs to limit the container speed. You can use systemd to start the service, or use docker to deploy the service. If you use docker to deploy the service, the startup script is as follows:

[0073] docker run -d\

[0074] --name docker-tc\

[0075] --network host\

[0076] --privileged\

[0077] --pid=host\

[0078] --restart always\

[0079] -v / var / run / docker.sock: / var / run / docker.sock\

[0080] -v / var / docker-tc: / var / docker-tc\

[0081] -v / opt / docker-tc / config: / docker-tc / config\

[0082] -v / sys / fs / cgroup / net_cls: / sys / fs / cgroup / net_cls\

[0083] -v / etc / sysconfig / network-scripts: / etc / sysconfig / network-scripts\

[0084] docker-tc

[0085] Since docker-tc needs to operate the network interface, you need to configure --network host and --cap-add NET_ADMIN. In addition, docker-tc needs to listen to docker events, so you need to configure -v / var / run / docker.sock: / var / run / docker.sock.

[0086] The configuration process of the rate limit container is as follows:

[0087] If you need to limit the speed of a container, you need to configure the corresponding label parameters. The label parameters related to docker-tc are as follows:

[0088] When com.docker-tc.enabled is configured with the value 1, the rate limit policy is applied. If it is set to other values ​​or if the label value is not configured, the rate limit policy is not applied.

[0089] com.docker-tc.down.rate is the base rate of the downlink speed limit. The bandwidth in this rate range will not be shared with the speed limit of other containers. However, when the sum of the technical rates of all speed limit policies on an interface exceeds the total rate of the interface, it cannot be guaranteed that the container can reach this rate. The rate unit refers to the tc rate unit as follows:

[0090] In bit: bit, kbit, mbit, gbit, tbit;

[0091] In bit rate: bps, kbps, mbps, gbps, tbps;

[0092] com.docker-tc.down.ceil The maximum rate of the downstream speed limit.

[0093] com.docker-tc.up.rate is the base rate of the upstream speed limit. The bandwidth in this rate range will not be shared with the speed limit of other containers. However, when the sum of the technical rates of all speed limit policies on an interface exceeds the total rate of the interface, there is no guarantee that the container can reach this rate.

[0094] com.docker-tc.up.ceil The maximum rate of the upstream speed limit.

[0095] com.docker-tc.up.cgroup cgroup id, used to associate the rate limit policy;

[0096] com.docker-tc.biz is the business ID of the container. This label is used when exposing traffic collection metrics.

[0097] For example, to start a rate-limited container:

[0098] docker run-it --name xxxx\

[0099] --label"com.docker-tc.enabled=1"\

[0100] --label"com.docker-tc.cgroup=65552"\

[0101] --label"com.docker-tc.down.rate=40mbit"\

[0102] --label"com.docker-tc.down.ceil=40mbit"\

[0103] --label"com.docker-tc.up.rate=20mbit"\

[0104] --label"com.docker-tc.up.ceil=30mbit"\

[0105] --label"com.docker-tc.biz=test"\

[0106] --label"com.docker-tc.bizid=910005"\

[0107] nettool-centos7 bash.

[0108] In a specific embodiment, you can use docker exec to enter the container and use wget or iperf to test whether the speed limit policy is effective.

[0109] like Figure 2 The container speed limit effect shown in the test uses a 100M broadband. Without container speed limit, the download rate fluctuates between 80M and 100M. When starting the container, add the container speed limit parameter to limit the downlink rate to 40M. You can see that the download rate is stable at around 40M, and the rate fluctuation does not exceed 2%. If multiple containers have ceil parameters set and ceil is greater than rate, if the total ceil is greater than the host network port bandwidth, the speed limit policy will ensure that the bandwidth exceeding rate is allocated to the container in proportion.

[0110] See also Figure 3 , Figure 3 The embodiment of the present application provides a schematic block diagram of a container-based resource control device, which is used to execute the aforementioned container-based resource control method. The container-based resource control device can be configured on a server.

[0111] like Figure 3 As shown, the container-based resource control device 300 includes:

[0112] A container inspection module 310 is run to inspect containers in an executable state through the Docker SDK.

[0113] The speed limit policy configuration module 320 is used to obtain the container startup parameters corresponding to the container in the runnable state, and configure the corresponding target network resource speed limit policy for the container in the runnable state according to the container startup parameters;

[0114] The network resource control module 330 is used to control the network resources of the container in the executable state according to the target network resource rate limit policy.

[0115] Furthermore, the container-based resource control device 300 further includes:

[0116] The monitoring module is used to start a thread and perform loop monitoring on container events in the container;

[0117] A judgment module, used for judging whether a first container to create an event has pre-configured startup parameters when a creation event is monitored;

[0118] A creation module is used to configure a network speed limit policy for the first container according to the pre-configured startup parameters when the first container has the pre-configured startup parameters.

[0119] Furthermore, the container-based resource control device 300 further includes:

[0120] The destroy module is used to delete the network speed limit policy corresponding to the second container of the event to be destroyed when a destroy event is monitored.

[0121] Furthermore, the creation module also includes:

[0122] A first uplink bandwidth configuration unit, configured to, when the network mode of the first container is the host mode, perform uplink bandwidth speed limit configuration on each network port according to the speed limit parameter corresponding to each WAN network port in the pre-configured startup parameters;

[0123] The first downstream bandwidth configuration unit is used to configure the traffic of the network of the first container to the ingress virtual device ifb interface, and to perform a speed limit configuration on the downstream rate of the ifb interface to limit the downstream speed of the first container.

[0124] Furthermore, the creation module includes:

[0125] a second downlink bandwidth configuration unit, configured to configure a TC speed limit policy for the veth according to a speed limit parameter corresponding to the host veth in the pre-configured startup parameters when the network mode of the first container is a bridge mode, so as to limit the downlink speed of the first container;

[0126] The second uplink bandwidth configuration unit is used to configure the traffic of the veth port to the ingress virtual device ifb interface, and to perform a speed limit configuration on the uplink rate of the ifb interface to limit the uplink speed.

[0127] Furthermore, the container-based resource control device 300 further includes:

[0128] The policy reconfiguration module is used to monitor the up event and down event of the network port through netlink, and reconfigure the network speed limit policy of each container when a restart event of the network port is detected and the speed limit of each container associated with the network port needs to be read.

[0129] Furthermore, the container-based resource control device 300 further includes:

[0130] The traffic statistics module is used to obtain the traffic flowing through each speed limit policy as container traffic through the netlink interface exposed by TC after completing the configuration of the network resource speed limit policy, and expose the container traffic metric through prometheus.

[0131] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0132] The above-mentioned device can be implemented in the form of a computer program. Figure 4 Runs on the computer device shown.

[0133] See also Figure 4 , Figure 4 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.

[0134] See also Figure 4 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0135] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any container-based resource control method.

[0136] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0137] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any container-based resource control method.

[0138] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0139] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0140] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0141] Check the runnable container through docker sdk;

[0142] Obtaining container startup parameters corresponding to the container in the runnable state, and configuring the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters;

[0143] The network resources of the container in the runnable state are controlled according to the target network resource speed limit policy.

[0144] In one embodiment, when implementing the container-based resource control method, the processor is used to implement:

[0145] Start a thread to loop monitor container events in the container;

[0146] When a creation event is monitored, it is determined whether a first container to be created has pre-configured startup parameters;

[0147] When the pre-configured startup parameter exists in the first container, a network speed limit policy is configured for the first container according to the pre-configured startup parameter.

[0148] In one embodiment, after implementing the startup thread and loop-monitoring container events in the container, the processor is further configured to implement:

[0149] When a destruction event is monitored, the network speed limit policy corresponding to the second container of the event to be destroyed is deleted.

[0150] In one embodiment, the processor configures the network speed limit policy for the first container according to the pre-configured startup parameters to implement:

[0151] When the network mode of the first container is the host mode, according to the speed limit parameters corresponding to each WAN network port in the pre-configured startup parameters, the speed limit configuration of the uplink bandwidth of each network port is performed;

[0152] The network traffic of the first container is configured with the ingress virtual device ifb interface, and a speed limit is configured for the downstream rate of the ifb interface to limit the downstream speed of the first container.

[0153] In one embodiment, the processor, while implementing the configuration of the network speed limit policy for the first container according to the pre-configured startup parameters, is further configured to implement:

[0154] When the network mode of the first container is bridge mode, according to the speed limit parameter corresponding to the host veth in the pre-configured startup parameters, a TC speed limit policy is configured for the veth to limit the downlink speed of the first container;

[0155] Configure the traffic of the veth port to the ingress virtual device ifb interface, and configure the uplink rate of the ifb interface to limit the uplink speed.

[0156] In one embodiment, the processor, while implementing the container-based resource control method, is further configured to implement:

[0157] The up and down events of the network port are monitored through netlink. When a restart event of the network port is detected and the speed limit of each container associated with the network port needs to be read, the network speed limit policy of each container is reconfigured.

[0158] In one embodiment, the processor, while implementing the container-based resource control method, is further configured to implement:

[0159] After completing the configuration of the network resource rate limit policy, the traffic flowing through each rate limit policy is obtained as container traffic through the netlink interface exposed by TC, and the container traffic metric is exposed through prometheus.

[0160] A computer-readable storage medium is also provided in an embodiment of the present application. The computer-readable storage medium stores a computer program. The computer program includes program instructions. The processor executes the program instructions to implement any container-based resource control method provided in the embodiment of the present application.

[0161] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0162] The above description is only a specific implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed in the present application, and these modifications or substitutions should be included in the protection scope of the present application.

[0163] Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A container-based resource control method, characterized in that: The container-based resource control method includes: Check the runnable container through docker sdk; Obtaining container startup parameters corresponding to the container in the runnable state, and configuring the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters; According to the target network resource speed limit policy, the network resources of the container in the runnable state are controlled; the method also includes: Start a thread to loop monitor container events in the container; When a creation event is monitored, it is determined whether a first container to be created has pre-configured startup parameters; When the first container has the pre-configured startup parameters, configuring a network speed limit policy for the first container according to the pre-configured startup parameters; Further, configuring a network speed limit policy for the first container according to the pre-configured startup parameters includes: When the network mode of the first container is the host mode, according to the speed limit parameters corresponding to each WAN network port in the pre-configured startup parameters, the speed limit configuration of the uplink bandwidth of each network port is performed; Configure the network traffic of the first container with the ingress virtual device ifb interface, and configure a speed limit on the downlink rate of the ifb interface to limit the downlink speed of the first container; When the network mode of the first container is bridge mode, according to the speed limit parameter corresponding to the host veth in the pre-configured startup parameters, a TC speed limit policy is configured for the veth to limit the downlink speed of the first container; Configure the traffic of the veth port to the ingress virtual device ifb interface, and configure the uplink rate of the ifb interface to limit the uplink speed.

2. The container-based resource control method according to claim 1, characterized in that: After the startup thread cyclically monitors the container events in the container, the startup thread further includes: When a destruction event is monitored, the network speed limit policy corresponding to the second container of the event to be destroyed is deleted.

3. The container-based resource control method according to claim 1, characterized in that: The container-based resource control method further includes: The up and down events of the network port are monitored through netlink. When a restart event of the network port is detected and the speed limit of each container associated with the network port needs to be read, the network speed limit policy of each container is reconfigured.

4. The container-based resource control method according to any one of claims 1 to 3, characterized in that: The container-based resource control method further includes: After completing the configuration of the network resource rate limit policy, the traffic flowing through each rate limit policy is obtained as container traffic through the netlink interface exposed by TC, and the container traffic metric is exposed through prometheus.

5. A container-based resource control device, characterized in that: The container-based resource control device comprises: Run the container inspection module to check the runnable container through the docker sdk; A speed limit policy configuration module, used to obtain container startup parameters corresponding to the container in the runnable state, and configure the container in the runnable state with a corresponding target network resource speed limit policy according to the container startup parameters; A network resource control module, configured to control network resources of the container in the executable state according to the target network resource speed limit policy; the device further comprises: The monitoring module is used to start a thread and perform loop monitoring on container events in the container; A judgment module, used for judging whether a first container to create an event has pre-configured startup parameters when a creation event is monitored; A creation module is used to configure a network speed limit policy for the first container according to the pre-configured startup parameters when the first container has the pre-configured startup parameters; Furthermore, the creation module also includes: A first uplink bandwidth configuration unit, configured to, when the network mode of the first container is the host mode, perform uplink bandwidth speed limit configuration on each network port according to the speed limit parameter corresponding to each WAN network port in the pre-configured startup parameters; A first downstream bandwidth configuration unit, configured to configure the ingress virtual device ifb interface for the network traffic of the first container, and to limit the downstream rate of the ifb interface to limit the downstream speed of the first container; Furthermore, the creation module includes: a second downlink bandwidth configuration unit, configured to configure a TC speed limit policy for the veth according to a speed limit parameter corresponding to the host veth in the pre-configured startup parameters when the network mode of the first container is a bridge mode, so as to limit the downlink speed of the first container; The second uplink bandwidth configuration unit is used to configure the traffic of the veth port to the ingress virtual device ifb interface, and to perform a speed limit configuration on the uplink rate of the ifb interface to limit the uplink speed.

6. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program and implement the container-based resource control method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements the container-based resource control method according to any one of claims 1 to 4.

Images