Interception method and device for file access request of container based on virtual device

Abstract

The application provides an interception method for a file access request of a container based on a virtual device, which comprises the following steps: establishing a connection with the virtual device based on a preset protocol, and registering the virtual device as a virtual file system; mounting the virtual device registered as the virtual file system into a pre-prepared directory of a root file system of the container in a record virtual machine; receiving a file access request of the container by an application program in the container, and intercepting the file access request by the virtual device mounted into the pre-prepared directory. The file system interception module in the virtual device can intercept the container file, the file operation of the specific container can be captured in the application layer, and the file operation can be intercepted and blocked. The method can be used for only the container to be monitored, and does not affect the operating system, thereby effectively reducing the workload of the interception of the container file, and improving the stability of the operating system.

Description

Technical Field

[0001] This invention relates to the field of container technology, and in particular to a method and apparatus for intercepting file access requests to containers based on virtual devices. Background Technology

[0002] Containers are a lightweight virtualization technology that can quickly and efficiently create virtual systems. However, because containers are a virtualization technology based on the operating system kernel, their security has always been criticized, with issues such as escape occurring frequently. Therefore, when protecting containers, there is an urgent need for a method to securely protect files accessed within the container.

[0003] Traditional methods for monitoring container file systems require writing corresponding system drivers. However, drivers operate on the entire system, and monitoring a specific container necessitates intercepting access to all system files, which severely impacts the host system.

[0004] For example, firstly, normal access will be subject to security checks at the driver's interception point. Secondly, the driver lacks contextual information about containers, so it must work with other applications to obtain the correspondence between file access and specific containers. Finally, for the Linux operating system, each driver needs to be adapted to the kernel, which is a huge workload and results in poor driver adaptability. Summary of the Invention

[0005] This invention provides a method and apparatus for intercepting file access requests to containers based on virtual devices, which solves the shortcomings of existing technologies where writing corresponding system drivers requires a huge amount of kernel adaptation work for each driver and has poor driver adaptability. This invention can capture file operations of specific containers at the application layer and intercept and block them.

[0006] In a first aspect, embodiments of the present invention provide a method for intercepting file access requests to containers based on virtual devices, applied to virtual machines, comprising: establishing a connection with a virtual device based on a preset protocol and registering the virtual device as a virtual file system; mounting the virtual device registered as a virtual file system to a pre-prepared directory that records the root file system of containers in the virtual machine; receiving file access requests from applications in the container to the container, and intercepting the file access requests through the virtual device mounted in the pre-prepared directory.

[0007] Furthermore, before mounting the virtual device registered as a virtual file system to the prefabricated directory recording the root file system of the container in the virtual machine, the method further includes: writing the path of the container's real file system into a configuration file and synchronizing the configuration file to the virtual device; receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted in the prefabricated directory includes: receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted in the prefabricated directory based on the obtained configuration file.

[0008] Furthermore, the step of intercepting the file access request based on the obtained configuration file by using a virtual device mounted to the prefabricated directory includes: obtaining the actual access path of the container based on the configuration file by using a virtual device mounted to the prefabricated directory; and intercepting the file access request based on the actual access path of the container by using a file system interception module in the virtual device mounted to the prefabricated directory.

[0009] Furthermore, before mounting the virtual device to a prefabricated directory that records the root file system of the container in the virtual machine, the method further includes: starting the container and setting the root file system of the container to the prefabricated directory.

[0010] Furthermore, the preset protocol is the VIRTIO protocol, and the virtual device is designed based on the VIRTIO protocol.

[0011] Secondly, the present invention also provides a method for intercepting file access requests to containers based on virtual devices, applied to virtual devices, comprising: establishing a connection with a virtual machine based on a preset protocol; receiving an operation by which the virtual machine mounts a virtual device registered as a virtual file system to a pre-defined directory that records the root file system of the container in the virtual machine; receiving a file access request from an application in the container to the container; and intercepting the file access request.

[0012] Furthermore, before intercepting the file access request, the method further includes: reading a configuration file; obtaining the actual access path of the container based on the configuration file; and intercepting access to the container file includes: intercepting the file access request based on the actual access path of the container.

[0013] Furthermore, the interception of access to the container file based on the container's actual access path includes: intercepting access to the container file through the file system interception module in the virtual device based on the container's actual access path.

[0014] Thirdly, the present invention also provides an interception device for file access requests from virtual devices to containers, applied to virtual machines, comprising: a connection registration module for establishing a connection with the virtual device based on a preset protocol and registering the virtual device as a virtual file system; a mounting module for mounting the virtual device registered as a virtual file system to a pre-prepared directory that records the root file system of the container in the virtual machine; and an interception module for receiving file access requests from applications in the container to the container and intercepting the file access requests through the virtual device mounted in the pre-prepared directory.

[0015] Fourthly, the present invention also provides a method for intercepting file access requests from virtual devices to containers, applied to virtual devices, comprising: a connection module, used to establish a connection with a virtual machine based on a preset protocol, and to receive the operation of the virtual machine mounting a virtual device registered as a virtual file system to a pre-made directory recording the root file system of the container in the virtual machine; and an interception module, used to receive file access requests from applications in the container to the container, and to intercept the file access requests.

[0016] Fifthly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the method for intercepting file access requests to a container based on a virtual device as described in the first aspect, applied to a virtual machine, or the steps of the method for intercepting file access requests to a container based on a virtual device as described in the second aspect, applied to a virtual device.

[0017] In a sixth aspect, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the steps of the method for intercepting file access requests to a container based on a virtual device as described in the first aspect, applied to a virtual machine, or the steps of the method for intercepting file access requests to a container based on a virtual device as described in the second aspect, applied to a virtual device.

[0018] In a seventh aspect, embodiments of the present invention also provide a computer program product having executable instructions stored thereon, which, when executed by a processor, cause the processor to implement the steps of the method for intercepting file access requests to a container based on a virtual device as described in the first aspect, applied to a virtual machine, or the steps of the method for intercepting file access requests to a container based on a virtual device as described in the second aspect, applied to a virtual device.

[0019] The present invention provides a method and apparatus for intercepting file access requests to containers based on virtual devices. This method establishes a connection with the virtual device based on a preset protocol and registers the virtual device as a virtual file system. The registered virtual file system is then mounted to a pre-defined directory containing the root file system of the container within the virtual machine. File access requests from applications within the container are received and intercepted via the virtual device mounted in the pre-defined directory. By intercepting container files through a file system interception module within the virtual device, file operations of specific containers can be captured at the application layer and blocked. This method can target only the containers that need monitoring without affecting the operating system, effectively reducing the workload of intercepting container files and improving the stability of the operating system. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an embodiment of a method for intercepting file access requests to containers based on virtual devices, provided by the present invention.

[0022] Figure 2 A flowchart illustrating an embodiment of another method for intercepting file access requests to containers based on virtual devices provided by the present invention;

[0023] Figure 3 This invention provides a schematic diagram of a process for intercepting file access requests to containers based on virtual devices.

[0024] Figure 4 A schematic diagram illustrating the structural composition of an embodiment of a file access request interception device based on a virtual device for a container provided by the present invention;

[0025] Figure 5 A schematic diagram illustrating the structural composition of another embodiment of the interception device for file access requests to containers based on virtual devices provided by the present invention;

[0026] Figure 6 A schematic diagram illustrating the structural composition of an embodiment of a file access request interception system based on a virtual device to a container provided by the present invention;

[0027] Figure 7 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] Figure 1 This is a flowchart illustrating an embodiment of a method for intercepting file access requests to containers based on virtual devices, provided by the present invention. Figure 1 As shown, this method for intercepting file access requests to containers based on virtual devices, applied to virtual machines, may include the following steps:

[0030] S101 establishes a connection with the virtual device based on a preset protocol and registers the virtual device as a virtual file system.

[0031] In step S101, a virtual machine (VM) refers to a special type of software that creates an environment between a computer platform and the end user, allowing the end user to operate the software within that environment. In computer science, a virtual machine is a software implementation of a computer that can run programs like a real machine.

[0032] Virtualization technology allows a single dedicated device to be virtualized into multiple logical devices for simultaneous use by multiple processes. Such virtualized devices are typically called virtual devices. Containers and virtual devices reside within virtual machines; one container corresponds to one virtual device.

[0033] The default protocol can be the virtio protocol. The virtio protocol is a transport protocol used only in para-virtualization. The virtio transport protocol simplifies the handling of guest virtual machines, thus improving IO efficiency; the same transport mechanism can be used in different virtualization platforms, reducing the amount of code development required for each platform.

[0034] A file system is a mechanism for organizing data and metadata on a storage device. This mechanism facilitates interaction between users and the operating system.

[0035] S102, mount the virtual device registered as a virtual file system to the prefab directory of the root file system of the container in the virtual machine.

[0036] In step S102, mounting refers to the process by which the operating system makes computer files and directories on a storage device (such as a hard drive, CD-ROM, or shared resource) accessible to users through the computer's file system. In the Linux operating system, mounting is a very important and frequently used function. It refers to attaching a device (usually a storage device) to an existing directory. (This directory can be non-empty, but after mounting, the previous contents of this directory will be unavailable.) It's important to understand that the Linux operating system treats all devices as files, integrating all the computer's resources into a large file directory. To access files on a storage device, the partition containing the files on the storage device must be mounted to an existing directory, and then the storage device is accessed by accessing this directory. Virtual machines mount virtual devices to pre-defined directories, granting the virtual devices access to these directories.

[0037] The root file system is the first file system mounted when the kernel starts. The kernel code image file is stored in the root file system, and the system boot program loads some basic initialization scripts and services from the root file system into memory to run after the root file system is mounted.

[0038] S103, receives file access requests from applications in the container and intercepts the file access requests by using virtual devices mounted in the prefabricated directory.

[0039] In step S103, the application in the container sends a file access request to the container. The virtual machine receives the file access request, and the virtual device mounted to the prefab directory also receives the file access request and intercepts it.

[0040] The present invention provides a method for intercepting file access requests to containers based on virtual devices. This method establishes a connection with the virtual device based on a preset protocol and registers the virtual device as a virtual file system. The registered virtual file system is then mounted to a pre-defined directory containing the root file system of the container within the virtual machine. File access requests from applications within the container are received and intercepted using the virtual device mounted in the pre-defined directory. By intercepting container files through the file system interception module within the virtual device, file operations of specific containers can be captured at the application layer and blocked. This method can target only the containers that need monitoring without affecting the operating system, effectively reducing the workload of intercepting container files and improving the stability of the operating system.

[0041] In some optional embodiments, before mounting the virtual device registered as a virtual file system to a prefabricated directory that records the root file system of the container in the virtual machine, the method may further include: writing the path of the container's real file system to a configuration file and synchronizing the configuration file to the virtual device; correspondingly, receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted to the prefabricated directory may include: receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted to the prefabricated directory based on the obtained configuration file.

[0042] Specifically, intercepting file access requests by using virtual devices mounted in the prefab directory based on the obtained configuration file can include: obtaining the container's actual access path based on the configuration file using virtual devices mounted in the prefab directory; and intercepting file access requests based on the container's actual access path using the file system interception module in the virtual devices mounted in the prefab directory.

[0043] The process of obtaining the container's actual access path can be as follows: A configuration file is generated based on the container's root file system. This configuration file may include the location of the container's root directory; however, this embodiment of the invention does not limit this. The virtual device reads the configuration file and can obtain the container's actual access path based on the information in the configuration file, such as the location of the container's root directory.

[0044] In some alternative embodiments, before mounting the virtual device to a prefab directory of the root file system of the container in the virtual machine, the method may further include: starting the container and setting the root file system of the container to the prefab directory.

[0045] The embodiments provided by this invention facilitate the mounting of virtual devices by setting up a pre-made directory.

[0046] Figure 2 This is a flowchart illustrating an embodiment of another method for intercepting file access requests to containers based on virtual devices, provided by the present invention. Figure 2 As shown, this method for intercepting file access requests to containers based on virtual devices, applied to virtual devices, may include the following steps:

[0047] S201, establishes a connection with the virtual machine based on a preset protocol, and receives the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the container in the virtual machine.

[0048] For a detailed explanation of step S201, please refer to step S102, which will not be repeated here.

[0049] S202, Receive file access requests from applications in the container to access the container, and intercept the file access requests.

[0050] For a detailed explanation of step S202, please refer to step S103, which will not be repeated here.

[0051] This invention provides a method for intercepting file access requests from virtual devices to containers. Applied to virtual devices, it establishes a connection with a virtual machine based on a preset protocol, receives operations where the virtual machine mounts a virtual device (registered as a virtual file system) to a pre-defined directory recording the root file system of the container within the virtual machine, and receives file access requests from applications within the container, intercepting these requests. By intercepting container files through a file system interception module within the virtual device, file operations of specific containers can be captured at the application layer and blocked. This method can target only the containers that need monitoring without affecting the operating system, effectively reducing the workload of intercepting container files and improving operating system stability.

[0052] In some optional embodiments, before intercepting file access requests, the process may further include: reading a configuration file; obtaining the actual access path of the container based on the configuration file; correspondingly, intercepting access to container files may include: intercepting file access requests based on the actual access path of the container.

[0053] For a detailed description of the embodiments of the present invention, please refer to the first optional embodiment, which will not be repeated here.

[0054] In some optional embodiments, before intercepting file access requests, the process may include: reading a configuration file; obtaining the container's actual access path based on the configuration file; and correspondingly, intercepting access to container files may include: intercepting file access requests based on the container's actual access path.

[0055] Intercepting access to container files based on the container's actual access path can include: intercepting access to container files through a file system interception module in a virtual device based on the container's actual access path.

[0056] For a detailed description of the embodiments of the present invention, please refer to the second optional embodiment, which will not be repeated here.

[0057] Figure 3 This is a schematic diagram illustrating a process for intercepting file access requests to containers based on virtual devices, as provided by the present invention. Figure 3 As shown, the process of intercepting file access requests to a container based on a virtual device can include the following steps:

[0058] Outside the virtual machine, a configuration file is generated based on the prepared container root file system, and the container root file system is saved in the appropriate location. The virtual machine is started, and the kernel of the operating system running the virtual machine starts and searches for virtual devices. After the operating system kernel discovers a virtual device, the virtual machine connects to the discovered virtual device based on the virio protocol, and the virtual device is recognized as a virtual file system. The virtual machine mounts the virtual device recognized as a virtual file system to a pre-built directory, so that when a file access request accesses the container, the virtual device mounted to the pre-built directory will also accept the file access request. The container is started, and the container root file system points to the pre-built directory. The virtual device obtains the container's real address based on the configuration file. The virtual machine intercepts container files based on the obtained container real address using the file system interception module in the virtual device.

[0059] Figure 4 This is a schematic diagram illustrating the structural composition of an embodiment of a file access request interception device based on a virtual device for a container, provided by the present invention. (See diagram below.) Figure 4 As shown, this interception device for file access requests to containers based on virtual devices, applied to virtual machines, includes:

[0060] The connection registration module 401 is used to establish a connection with the virtual device based on a preset protocol and register the virtual device as a virtual file system.

[0061] Mount module 402 is used to mount virtual devices registered as virtual file systems to a prefabricated directory of the root file system of containers in virtual machines;

[0062] The interception module 403 is used to receive file access requests from applications in the container and intercept the file access requests by using virtual devices mounted in the prefab directory.

[0063] Optionally, the interception device for file access requests to containers based on virtual devices further includes:

[0064] The write synchronization module is used to write the path of the container's real file system to the configuration file and synchronize the configuration file to the virtual device;

[0065] The interception module 403 is also used to receive file access requests from applications in the container to the container, and to intercept the file access requests based on the obtained configuration file by using a virtual device mounted to the prefab directory.

[0066] Optionally, the interception module 403 includes:

[0067] The acquisition unit is used to obtain the actual access path of the container based on the configuration file by using a virtual device mounted to the prefabricated directory;

[0068] The interception unit is used to intercept file access requests based on the container's actual access path by using a file system interception module in a virtual device mounted in a prefabricated directory.

[0069] Optionally, the interception device for file access requests to containers based on virtual devices further includes:

[0070] The setup unit is used to start the container and set the container's root file system to a pre-built directory.

[0071] Figure 5 This is a schematic diagram illustrating the structural composition of another embodiment of the interception device for file access requests to containers based on virtual devices provided by the present invention. Figure 5 As shown, this interception device for file access requests from virtual devices to containers, applied to virtual devices, includes:

[0072] The connection module 501 is used to establish a connection with the virtual machine based on a preset protocol and to receive the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the container in the virtual machine.

[0073] The interception module 502 is used to receive file access requests from applications in the container and intercept the file access requests.

[0074] Figure 6 This is a schematic diagram illustrating the structural composition of an embodiment of a file access request interception system based on a virtual device for a container, provided by the present invention. Figure 6 As shown, this system for intercepting file access requests to containers based on virtual devices can include: an operating system and a virtual machine.

[0075] The operating system can be a Linux operating system, including the operating system kernel, container daemons, applications, and the container root file system. The applications include the OCI interface. OCI stands for Open Container Initiative. The Linux Foundation established the OCI (Open Container Initiative) organization in June 2015 to develop an open industrial standard for container formats and runtimes. Currently, there are two main standard documents: the container runtime standard (runtime spec) and the container image standard (image spec). The goal of developing container format standards is to avoid being bound to upper-layer structures, such as specific clients or orchestration stacks, and also to specific vendors or projects; that is, it is not limited to a specific operating system, hardware, CPU architecture, or public cloud. The OCI interface can be used to call the container. The actual access path of the container can be obtained from the container's root file system.

[0076] Virtual machines can include containers, a Linux kernel that supports namespaces, and virtual file system devices, also known as virtual devices. The Linux Namespaces mechanism provides a resource isolation scheme. System resources such as PIDs, IPCs, and Networks are no longer global but belong to a specific namespace. Resources under each namespace are transparent and invisible to resources under other namespaces. Therefore, at the operating system level, multiple processes with the same PID can appear. Two processes with process IDs 0, 1, and 2 can coexist in the system; because they belong to different namespaces, they do not conflict. At the user level, only resources belonging to the user's own namespace are visible. Containers contain applications, and virtual file system devices contain file access interception modules. These modules intercept file access requests from the container through the container's root file system.

[0077] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include: a processor 701, a communications interface 702, a memory 703, and a communication bus 704. The processor 701, communications interface 702, and memory 703 communicate with each other via the communication bus 704. The processor 701 can call logical instructions in the memory 703 to execute the following methods: establishing a connection with a virtual device based on a preset protocol and registering the virtual device as a virtual file system; mounting the virtual device registered as a virtual file system to a pre-built directory of the root file system of the container in the virtual machine; receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted in the pre-built directory.

[0078] It establishes a connection with the virtual machine based on a preset protocol, receives the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the container in the virtual machine, receives file access requests from applications in the container, and intercepts the file access requests.

[0079] Furthermore, the logical instructions in the aforementioned memory 703 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0080] On the other hand, embodiments of the present invention also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, and when the program instructions are executed by a computer, the computer can execute the interception method for file access requests to containers based on virtual devices provided in the above embodiments, applied to a virtual machine, or execute the interception method for file access requests to containers based on virtual devices, applied to a virtual device. For example, it includes:

[0081] A connection is established with the virtual device based on a preset protocol, and the virtual device is registered as a virtual file system; the virtual device registered as a virtual file system is mounted to a pre-made directory that records the root file system of the container in the virtual machine; file access requests from applications in the container are received, and the file access requests are intercepted through the virtual device mounted in the pre-made directory.

[0082] It establishes a connection with the virtual machine based on a preset protocol, receives the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the container in the virtual machine, receives file access requests from applications in the container, and intercepts the file access requests.

[0083] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the method for intercepting file access requests to containers based on virtual devices, as provided in the above embodiments, and is applied to a virtual machine or to a virtual device. For example, it includes: establishing a connection with the virtual device based on a preset protocol and registering the virtual device as a virtual file system; mounting the virtual device registered as a virtual file system to a pre-defined directory that records the root file system of the container in the virtual machine; receiving file access requests from applications in the container and intercepting the file access requests through the virtual device mounted in the pre-defined directory.

[0084] It establishes a connection with the virtual machine based on a preset protocol, receives the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the container in the virtual machine, receives file access requests from applications in the container, and intercepts the file access requests.

[0085] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intercepting file access requests to containers based on virtual devices, applied to virtual machines, characterized in that, include: A connection is established with the virtual device based on a preset protocol, and the virtual device is registered as a virtual file system; Mount the virtual device registered as a virtual file system to a prefabricated directory that records the root file system of the containers in the virtual machine; Write the path of the container's real file system to the configuration file, and synchronize the configuration file to the virtual device; The system receives file access requests from applications within the container, obtains the container's actual access path based on the configuration file using a virtual device mounted in the pre-built directory, and intercepts the file access requests using a file system interception module in the virtual device mounted in the pre-built directory based on the container's actual access path.

2. The method for intercepting file access requests to containers based on virtual devices according to claim 1, characterized in that, Before mounting the virtual device registered as a virtual file system to the prefab directory of the root file system of the container in the virtual machine, the process also includes: Start the container and set its root file system to a prefabricated directory.

3. The method for intercepting file access requests to containers based on virtual devices according to claim 1, characterized in that, The preset protocol is the VIRTIO protocol, and the virtual device is designed based on the VIRTIO protocol.

4. A method for intercepting file access requests to containers based on virtual devices, applied to virtual devices, characterized in that, include: Establish a connection with the virtual machine based on a preset protocol, and receive the operation of the virtual machine mounting the virtual device registered as a virtual file system to the prefabricated directory of the root file system of the container in the virtual machine; The system receives file access requests from applications within the container and reads the configuration file. Based on the configuration file, it obtains the actual access path of the container. Based on the actual access path of the container, it intercepts access to the container files through the file system interception module in the virtual device.

5. A device for intercepting file access requests from virtual devices to containers, applied to virtual machines, characterized in that, include: The connection registration module is used to establish a connection with the virtual device based on a preset protocol and register the virtual device as a virtual file system; The mount module is used to mount virtual devices registered as virtual file systems to a prefabricated directory of the root file system of the containers in the virtual machine. The interception module is used to write the path of the container's real file system to the configuration file and synchronize the configuration file to the virtual device; The system receives file access requests from applications within the container, obtains the container's actual access path based on the configuration file using a virtual device mounted in the pre-built directory, and intercepts the file access requests using a file system interception module in the virtual device mounted in the pre-built directory based on the container's actual access path.

6. A device for intercepting file access requests from virtual devices to containers, applied to virtual devices, characterized in that, include: The connection module is used to establish a connection with the virtual machine based on a preset protocol and to receive the operation of the virtual machine mounting virtual devices registered as virtual file systems to a prefabricated directory that records the root file system of the containers in the virtual machine. The interception module is used to receive file access requests from applications in the container to the container and read configuration files; Based on the configuration file, the actual access path of the container is obtained; based on the actual access path of the container, access to the container files is intercepted by the file system interception module in the virtual device.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the step of the method for intercepting file access requests to containers based on virtual devices as described in any one of claims 1 to 3, applied to a virtual machine, or the step of the method for intercepting file access requests to containers based on virtual devices as described in claim 4, applied to a virtual device.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the step of the method for intercepting file access requests to containers based on virtual devices as described in any one of claims 1 to 3, applied to a virtual machine, or the step of the method for intercepting file access requests to containers based on virtual devices as described in claim 4, applied to a virtual device.

9. A computer program product having executable instructions stored thereon, characterized in that, When executed by the processor, this instruction causes the processor to implement the method for intercepting file access requests to containers based on virtual devices as described in any one of claims 1 to 3, applied to a virtual machine, or the method for intercepting file access requests to containers based on virtual devices as described in claim 4, applied to a virtual device.

Images