Method and apparatus for restarting target container

Abstract

The application provides a target container restart method and device, the method comprising: in response to a target container restart instruction, obtaining an execution parameter of a target program at a preset start node of the target program in the target container, wherein the target program is used to save confidential information online, the preset start node is a node that starts to unseal the target program in the process of restarting the target program, the execution parameter is used to indicate a target storage location of an unsealing program of the target program, and the target storage location is located in a data storage unit of a container cluster where the target container is located; obtaining the unsealing program at the target storage location according to the execution parameter, the unsealing program is used to release a locked state of the target program; running the unsealing program to obtain unsealing information of the target program; and unsealing the target program according to the unsealing information to restart the target container. The application realizes automatic unsealing of the target program, shortens the unsealing time, and thus improves the processing efficiency of the target container restart.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for restarting a target container. Background Technology

[0002] To ensure information security, it is crucial to safeguard confidential online information such as database passwords, certificates, Application Programming Interface (API) keys, and system general account passwords. Common online confidential information can be stored using security tools.

[0003] In related technologies, when deploying confidential tools, multiple physical machines can serve as nodes for multiple confidential tools, with one serving as the primary node and the others as backup nodes. The primary node can synchronize data to the backup nodes. When the primary node fails, the system can switch to a backup node to continue providing service.

[0004] However, in order to ensure the security of confidential information in the confidential tool program, when the confidential tool program malfunctions and needs to be restarted, the confidential tool program in each node will be locked and needs to be manually unlocked, which is time-consuming and labor-intensive, resulting in low availability. Summary of the Invention

[0005] This application provides a method and apparatus for restarting a target container, which realizes automatic unsealing of the target program, shortens the unsealing time of the target program, and thus improves the processing efficiency of restarting the target container.

[0006] In a first aspect, embodiments of this application provide a method for restarting a target container, the method comprising:

[0007] In response to a restart command from the target container, the execution parameters of the target program are obtained at a preset startup node in the target program within the target container. The target program is used to save confidential information online. The preset startup node is the node that begins to unpack the target program during the restart process. The execution parameters are used to indicate the target storage location of the unpacking program of the target program. The target storage location is located in the data storage unit of the container cluster where the target container is located.

[0008] According to the execution parameters, the unblocking program is obtained from the target storage location, and the unblocking program is used to unlock the target program.

[0009] Run the unblocking program to obtain the unblocking information of the target program;

[0010] The target program is unblocked based on the unblocking information to restart the target container.

[0011] Secondly, embodiments of this application provide a restart device for a target container, the device comprising:

[0012] The acquisition module is configured to, in response to a restart command from the target container, acquire execution parameters of the target program from a preset startup node within the target container, wherein the target program is used to store confidential information online, the preset startup node is a node that begins unsealing the target program during the restart process, the execution parameters are used to indicate the target storage location of the unsealing program, the target storage location being located in the data storage unit of the container cluster where the target container resides; and to acquire the unsealing program from the target storage location according to the execution parameters, the unsealing program being used to unlock the target program.

[0013] The running module is used to run the unblocking program to obtain the unblocking information of the target program;

[0014] The unsealing module is used to unseale the target program according to the unsealing information in order to restart the target container.

[0015] Thirdly, embodiments of this application provide a computer device, including: at least one processor and a memory;

[0016] The memory stores computer-executed instructions;

[0017] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to execute the restart method for the target container designed as described in the first aspect above.

[0018] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the target container restart method designed in the first aspect above.

[0019] Fifthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the method for restarting the target container as designed in the first aspect above.

[0020] By using the above-described method and apparatus for restarting the target container, since the unsealing program of the target program is stored in the target storage location of the data storage unit corresponding to the container cluster, the target program in any container of the container cluster can directly obtain the unsealing program from the target storage location of the data storage unit by indicating the execution parameters of the target storage location when restarting. The unsealing program is then executed by callback to obtain the unsealing information of the target program, thereby unsealing the target program and restarting it. This achieves automatic unsealing of the target program, shortens the unsealing time of the target program, and allows the target container to be restarted immediately after unsealing the target program, thus improving the processing efficiency of target container restart. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A schematic diagram illustrating a deployment method for a confidentiality tool program provided in an embodiment of this application;

[0023] Figure 2 A schematic diagram illustrating another deployment method of a confidentiality tool program provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating a method for restarting a target container provided in an embodiment of this application;

[0025] Figure 4 A schematic diagram of a container cluster provided in an embodiment of this application;

[0026] Figure 5 A flowchart illustrating another method for restarting a target container provided in an embodiment of this application;

[0027] Figure 6 A flowchart illustrating another method for restarting a target container provided in an embodiment of this application;

[0028] Figure 7 A structural block diagram of a target container restart device provided in an embodiment of this application;

[0029] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0030] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0031] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0032] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0033] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0034] To ensure information security, it is crucial to safeguard confidential online information such as database passwords, certificates, Application Programming Interface (API) keys, and system general account passwords. Common methods for storing confidential online information can be implemented using security tools (such as Vault).

[0035] Commonly used confidentiality tools and programs have the following characteristics:

[0036] First, any confidential information, such as key / value pairs, can be stored in a confidentiality tool. This tool encrypts the confidential information before writing it to persistent storage, which can include disks, data clusters (like Consul), etc. This encryption before storage requires appropriate permissions to access the confidential information, thus enhancing its security.

[0037] Secondly, the confidentiality tool can generate secrets on demand for certain systems, such as different types of databases. For example, when an application needs to access a bucket corresponding to a different type of database, it can request credentials from the confidentiality tool, which will then generate a key pair with valid permissions as needed. It should be noted that the confidentiality tool will automatically revoke the dynamic confidentiality information it creates upon lease expiration.

[0038] Furthermore, confidentiality tools can encrypt and decrypt data without storing it. Based on this, security teams can define encryption parameters and store them in locations such as databases, without needing to redesign the corresponding encryption methods.

[0039] Furthermore, all confidential information within the confidential tools program has an associated lease. The confidential tools program automatically revokes the confidential information when the lease expires. Users can renew the lease via the built-in Application Programming Interface (API).

[0040] Finally, the confidentiality tool has built-in support for the revocation of confidential information. The confidentiality tool can revoke not only individual pieces of confidential information, but also entire confidential trees. For example, all confidential information that can be read by a specific user, or all confidential information of a specific type. Revocation facilitates key rolling and system locking in the event of an intrusion.

[0041] Regarding the aforementioned confidential tools and programs, several common deployment methods are described below.

[0042] Figure 1 This is a schematic diagram illustrating a deployment method for a confidential tool program provided in an embodiment of this application. For example... Figure 1 As shown, multiple physical machines (e.g., three) can be used as nodes for multiple confidential tool programs, with one serving as the master node and the others as slave nodes.

[0043] A primary node and all standby nodes can form a high-availability cluster (HA). This HA cluster is a server cluster designed to minimize service downtime. The primary node in a HA cluster can run confidential utility programs and send the resulting data to applications and synchronize it with the standby nodes. When the primary node fails, the HA cluster can switch over in real-time to the standby nodes to run the confidential utility programs. Because the primary node has already synchronized the data with the standby nodes, service downtime during primary node failures is minimized.

[0044] However, Figure 1The deployment method of the confidential tools program shown may have the following problems.

[0045] First, there may be a delay when the master node synchronizes data to the standby node. Consequently, data loss may occur during master-slave failover. Second, before a master-slave failover, the standby node cannot provide read / write services, nor can it provide load balancing across multiple nodes. Third, after each master-slave failover, the data synchronization strategy needs to be reconfigured to avoid data inconsistency caused by the inability to achieve subsequent data synchronization. Finally, after a failure requiring a master-slave failover or restart, the confidential software program needs to be manually unblocked before it can provide normal access.

[0046] Figure 2 This is a schematic diagram illustrating another deployment method for a confidentiality tool program provided in an embodiment of this application. For example... Figure 2 As shown, multiple instances are deployed as nodes of the confidential utility program in a container between the application and the database. The data storage corresponding to the confidential utility program is stored using additional middleware, so that each node can provide read and write services.

[0047] However, Figure 2 The deployment method of the confidential tools shown requires additional resource costs to build middleware or database clusters. Furthermore, the containers cannot be automatically unsealed after a restart, requiring manual unsealing, resulting in low availability.

[0048] It should be noted that after a failure and restart, the confidential tool program will be locked to ensure the security of confidential information. The service can only be unlocked and accessed by the key generated during initialization.

[0049] Furthermore, the unblocking methods for confidential tools after a restart, apart from manual unblocking, all require external services, which can be achieved by replacing permission attributes or using a different confidential tool engine. This makes the unblocking process cumbersome, time-consuming, labor-intensive, and increases resource costs, resulting in low availability of confidential tools.

[0050] To address the aforementioned issues, this application provides a method and apparatus for restarting a target container. Since the unsealing program for the target program is stored in the target storage location within the data storage unit of the container cluster, any container in the cluster can directly retrieve the unsealing program from the target storage location in the data storage unit by specifying the execution parameters at the target parameter location during restart. The unsealing program is then executed via callback to obtain the unsealing information of the target program, thereby unsealing the target program and restarting it. This achieves automatic unsealing of the target program and improves the processing efficiency of restarting the target container.

[0051] It should be understood that the container involved in the embodiments of this application can be a standard software package that bundles application configuration files, libraries, runtime environment and other related data together for seamless deployment of applications across environments.

[0052] The following describes the application scenarios of the target container restart method provided in this disclosure.

[0053] In some embodiments, the target container restart method provided in this application can be applied to application scenarios of confidential tools such as Vault. When a confidential tool fails, the decryption program of the confidential tool can be obtained from the target storage location in the data storage unit of the container cluster where the target container resides. The decryption information can then be determined through the decryption program, and the confidential tool can be decrypted.

[0054] It should be noted that the above application scenarios do not constitute a limitation on this application. The method for restarting the target container provided in this application can be applied to any scenario where a program is unpacked.

[0055] It is understood that the above-described method for restarting the target container can be implemented using the target container restarting device provided in the embodiments of this application. The target container restarting device may include part or all of the computer equipment.

[0056] The technical solutions of the embodiments of this application will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0057] refer to Figure 3 , Figure 3 This is a flowchart illustrating a method for restarting a target container provided in an embodiment of this application. The execution entity of this embodiment may include a computer device, and this embodiment relates to the process of restarting a target container. The method for restarting the target container includes:

[0058] S201: In response to the restart command of the target container, obtain the execution parameters of the target program from the preset startup node of the target program in the target container.

[0059] The target program is used to store confidential information online. The default startup node is the node that starts unsealing the target program during the restart process. The execution parameters are used to indicate the target storage location of the unsealing program. The target storage location is located in the data storage unit of the container cluster where the target container is located.

[0060] In this application, when a target program in a target container within a container cluster fails, a restart command can be used to instruct the target container to restart. During the restart process, the target program needs to be unsealed first. Correspondingly, when the computer device receives the restart command from the target container and restarts, it can preset the startup node, obtain the execution parameters of the target program, and thus obtain the unsealed program.

[0061] The container clusters involved in the embodiments of this application will be described below.

[0062] Figure 4 This is a schematic diagram of a container cluster provided in an embodiment of this application. For example... Figure 4 As shown, the container cluster includes a data storage unit and multiple image containers. Each image container stores a target program. The runtime data generated by the target program in each image container is stored in the data storage unit. This runtime data includes data corresponding to the unpacking procedure of the target program. The target container can be any image container in the container cluster. The target program can be a confidential utility program.

[0063] Because the programs in the containers of this container cluster are all images of the target program, applications can access the target program in any target container in this container cluster. When the target program in one container fails, the target program in another container can be used to provide services.

[0064] Continue to refer to Figure 4 In this container cluster, all containers are mounted on the same data storage unit. This data storage unit can serve as a shared storage unit for multiple image containers. The runtime data generated by the target program in each image container can be stored on this data storage unit, allowing the target program in the switched image container to still query the runtime data of the target program in the previous image container after a container switch, thus achieving seamless switching between image containers. Correspondingly, the unpacking program involved in this embodiment can also be stored in the target storage location on the data storage unit for each container to access during unpacking.

[0065] It should be understood that the embodiments of this application do not limit the target storage location, and can be set according to the actual situation, which only needs to be on the data storage unit.

[0066] This application avoids data loss when containers in a container cluster share the same data storage unit, thus preventing data loss when the target program fails and needs to be switched between image containers. Furthermore, by storing the unpacking program in the target storage location within the data storage unit, the target program can quickly retrieve the unpacking program during unpacking, improving the unpacking speed of the target program.

[0067] This application does not limit the triggering method of the restart command. In some embodiments, the restart command can be triggered manually by the user or automatically when the target program fails. In some embodiments, the restart command can instruct the target program in the failed target container to restart. In other embodiments, if the target program is deployed in multiple image containers, when the target program fails, the image container of the container where the failed target program is located can also be used as the target container, and the target program in it can be restarted by the restart command.

[0068] It should be understood that the embodiments of this application do not limit the above-described target program. In some embodiments, the above-described target program can be a confidential tool program, such as Vault.

[0069] It should be noted that the default startup node of the target program can be the callback execution node of the target container. In some embodiments, by adding a callback execution command for the pre-startup lifecycle to the deployment information of the target container, the target program can automatically obtain the execution parameters of the target program at the callback execution node upon restart, thereby obtaining the unpacking program.

[0070] It should be understood that the embodiments of this application do not limit the above execution parameters. In some embodiments, the execution parameters can be parameters of the callback execution command, which are set by the user when deploying the target container. Through the execution parameters, the routing information of the target storage location can be indicated.

[0071] For example, if the execution parameter is "sh / home / vault / data / unseal.sh", the target storage location is determined by this execution parameter in order to obtain the unsealing procedure.

[0072] S202: Based on the execution parameters, retrieve the unsealing program from the target storage location. The unsealing program is used to unlock the target program.

[0073] In this step, when the computer device obtains the execution parameters of the target program at the preset startup node of the target program, since the execution parameters can indicate the target storage location of the unsealing program in the data storage unit of the container cluster, the computer device can obtain the unsealing program at the target storage location through the execution parameters, so as to unseale the target program.

[0074] In some embodiments, the execution parameters can be parameters of the callback execution command, used to indicate the routing information of the target storage location. The routing information of the target storage location can be determined by the execution parameters, thereby obtaining the unsealing program at the target storage location in the data storage unit of the container cluster.

[0075] S203: Run the unblocking procedure to obtain unblocking information for the target program.

[0076] In this step, after the computer device obtains the unsealing program from the target storage location, it can run the unsealing program to obtain the unsealing information of the target program.

[0077] It should be understood that the embodiments of this application do not limit the type of unblocking program, which can be an executable script. In some embodiments, the unblocking program may include at least one unblocking instruction, which may be pre-written with corresponding unblocking information. By executing the unblocking instruction, the computer device can obtain the corresponding unblocking information.

[0078] In other embodiments, the unblocking procedure may include other instructions before executing the unblocking instruction. For example, these may include query instructions, judgment instructions, detection instructions, etc. Query instructions are used to query the process of the target program, detection instructions are used to detect the usage status of the target program, and judgment instructions are used to determine whether the process of the target program has started, or to determine whether the usage status of the target program is unblocked.

[0079] It should be understood that when the unblocking process contains multiple instructions such as unblocking instructions and query instructions, each instruction can be triggered at different running nodes of the unblocking process to obtain the unblocking information of the target program.

[0080] For example, the unblocking procedure may include an unblocking command, a first query command, and a second unblocking command. The unblocking command is used to obtain unblocking information, the first query command is used to query the restart status of the target program, and the second query command is used to query the usage status of the target program. Accordingly, during runtime, the unblocking procedure can trigger the unblocking command at a first running node, the first query command at a second running node, and the second query command at a third running node. The third running node is located after the second running node and before the first running node.

[0081] For example, when running the unblocking procedure, the computer device can first trigger a first query instruction at the second running node to query the restart status of the target program. Subsequently, a second query instruction is triggered at the third running node to query the usage status of the target program. If the target program is in a restart state and its usage status is locked, an unblocking instruction is triggered at the first running node to extract unblocking information from the unblocking procedure. If the target program is not in a restart state or its usage status is not locked, the unblocking procedure terminates, and no further unblocking instructions are triggered.

[0082] It should be noted that the embodiments of this application do not limit the type of unsealing information. In some embodiments, the unsealing information includes the unsealing key of the target program.

[0083] It should be understood that the target program can contain multiple unsealing keys. Each unsealing key can generate a corresponding unsealing instruction in the unsealing program. By executing a preset number of unsealing instructions, a preset number of unsealing keys can be obtained to unseale the target program. The preset number can be set according to the actual situation. For example, if there are five unsealing keys, the preset number can be set to three.

[0084] It should be understood that the embodiments of this application do not limit how to obtain the unsealing information. In some embodiments, the unsealing information of the target program can be obtained by initializing the target program of any image container in the container cluster, and then the unsealing program can be generated based on the unsealing information.

[0085] Initializing the target program of any image container in the container cluster can be achieved by restoring the target program's settings to their initial values. After the target program's initialization is complete, the unsealing information generated by the target program after initialization can be obtained. This unsealing information contains the key to unlock the target program.

[0086] For example, if the target program is a confidential utility (e.g., Vault), by initializing the target program, the decryption information of the target program can be reset and generated, for example, generating five decryption keys K1, k2, k3, k4, and k5. Subsequently, a preset program template can be obtained. This program template contains preset query instructions, judgment instructions, detection instructions, and decryption instructions containing the positions to be filled. By filling the decryption information into the filling positions of the decryption instructions, the decryption program can be generated.

[0087] In some embodiments, after generating the unblocking program, it can be saved in a target storage location, and its permissions can be set accordingly. For example, the unblocking program can be configured so that administrators have modification and viewing permissions, while other users have execution permissions, thereby ensuring the security of the unblocking information.

[0088] S204: Unblock the target program based on the unblocking information to restart the target container.

[0089] It should be understood that the embodiments of this application do not limit how the target program is unblocked based on the unblocking information. In some embodiments, by inputting unblocking information into the target program, the locked state of the target program can be unlocked, thereby allowing the user to access the target program normally.

[0090] It should be understood that in the embodiments of this application, restarting the target container is equivalent to restarting the target program in the target container, and unsealing the target program is equivalent to restarting the target program, because the target program will automatically restart after unsealing.

[0091] The target container restart method provided in this application first responds to a restart command of the target container by obtaining execution parameters of the target program from a preset startup node in the target program within the target container. The target program is used to store confidential information online, and the preset startup node is the node that begins unsealing the target program during the restart process. The execution parameters indicate the target storage location of the unsealing program, which is located in the data storage unit of the container cluster where the target container resides. Second, based on the execution parameters, the unsealing program is obtained from the target storage location. The unsealing program is used to unlock the target program. Third, the unsealing program is run to obtain the unsealing information of the target program. Finally, the target program is unsealed based on the unsealing information to restart the target container. Through the above-described target container restart method and apparatus, since the unsealing program of the target program is stored in the target storage location in the data storage unit of the container cluster, any target program in the container cluster can directly obtain the unsealing program from the target storage location in the data storage unit upon restart. By executing the unsealing program via callback, the unsealing information of the target program is obtained, thereby unsealing the target program and restarting it. Automatic unpacking of the target program was achieved, improving its usability.

[0092] Based on the above embodiments, the following explains how to generate the unblocking procedure. Figure 5 A flowchart illustrating another method for restarting a target container provided in this application embodiment. The method for restarting the target container includes:

[0093] S301: Obtain the application package of the target program.

[0094] In this application, when it is necessary to deploy the target program, the computer device may first obtain the application of the target program.

[0095] The target program is used to store confidential information online. This application does not limit the target application. In some embodiments, the target application can be a confidential tool program, such as Vault.

[0096] It should be understood that the embodiments of this application do not limit how the application package of the target program is obtained. In some embodiments, the computer device may send a request to the database and obtain the application package of the target program by means of the identifier of the target program contained in the request. In other embodiments, the application package of the target program may be directly input by the user.

[0097] S302: Use the application package to generate multiple image containers to obtain a container cluster composed of multiple image containers.

[0098] The container cluster can contain multiple image containers, such as two or three. In this embodiment, an image container can be a container that contains the same image program.

[0099] It should be understood that the embodiments of this application do not limit the type of container cluster, and can be specifically set according to the actual situation. In some embodiments, the container cluster can be a K8S container cluster.

[0100] In this application, by setting up multiple image containers in the container cluster, the target container in other image containers can be restarted as a backup when the target program fails, thereby improving the availability and stability of the target program.

[0101] It should be understood that the embodiments of this application do not limit how application packages are used to generate multiple image containers. In some embodiments, the computer device may first obtain the routing information of the data storage unit. Secondly, based on the routing information of the data storage unit, the storage parameters in the application package are modified. Thirdly, based on the modified storage parameters and preset image mounting configuration information, multiple image packages of the target program are generated. Finally, multiple image containers are created using the multiple image packages.

[0102] The data storage unit can be a shared data storage location for image containers. By setting up the data storage unit, the running data of the target program in different image containers can be stored in the data storage unit, so that no data loss will occur when switching containers.

[0103] It should be understood that when deploying the target application, the storage parameters in the application package of the target application need to be modified. These storage parameters indicate the data storage method of the target application. For example, when deploying the target application, the storage parameters can be modified to local storage. Accordingly, if the target storage location is " / home / vault / data", then the storage target for the runtime data of the target application in the image container can be set to " / home / vault / data".

[0104] In some embodiments, after the storage parameters in the target application package are modified, the modified application package can be placed into a preset image package, and preset image mount configuration information can be added to generate image mount configuration information. This image mount configuration information is used to indicate the shared storage resources (i.e., data storage units) mounted by the image container. Subsequently, according to the preset number of image containers to be generated, multiple image containers are created using the image package.

[0105] It should be noted that, in this embodiment of the application, after the creation of the image container is completed, the data storage locations of multiple image containers can be set as data storage units, so that the target programs in different image containers can share data storage.

[0106] S303: Initialize the target program of any image container in the container cluster and obtain the unpacking information of the target program.

[0107] It should be understood that since the unpacking information of the target program is only generated when the target program is initialized, after the deployment of the target program is completed, the target program of any image container can be initialized to obtain the unpacking information of the target program.

[0108] For example, the target program can be initialized by restoring its settings to their initial values. Subsequently, the unsealing information generated by the target program after initialization can be obtained, which contains the key to unlock the target program.

[0109] S304: Generate the unsealing procedure based on the unsealing information.

[0110] It should be understood that the embodiments of this application do not limit how the unblocking program is generated. In some embodiments, the unblocking information can be filled into the target position in a preset program template to generate the unblocking program.

[0111] The program template contains a first data unit, and the target location is located in the first data unit. The first data unit is used to trigger an unsealing instruction to obtain unsealing information at the first running node of the unsealing program.

[0112] It should be noted that the first data unit in the program template lacks crucial unsealing information at the target location. By filling in the unsealing information at a specific location, a complete unsealing command can be formed. Subsequently, during the execution of the unsealing program, the unsealing information can be retrieved by triggering the unsealing command, thereby completing the unsealing of the target program.

[0113] In some embodiments, the program template further includes a second data unit and a third data unit. The second data unit is used to trigger a first query instruction of the target program at the second running node of the unblocking program, the first query instruction being used to query the restart status of the target program. The third data unit is used to trigger a second query instruction of the target program at the third running node of the unblocking program, the second query instruction being used to query the usage status of the target program. The third running node is located after the second running node and before the first running node.

[0114] Correspondingly, when unblocking a target program, the first query command can be used to query the target program's process, thereby determining whether the target program has restarted. The second query command can be used to detect the target program's usage status. If the usage status is locked, an unblocking command can be generated based on the unblocking information, and the target program can be unblocked by executing the unblocking command.

[0115] It should be understood that the embodiments of this application do not limit how the unblocking command is executed to unblock the target program. In some embodiments, the unblocking command can input unblocking information into the target program. When the unblocking information input into the target program is correct and the quantity exceeds a preset quantity, the target program can complete the unblocking.

[0116] The preset data can be set according to the actual situation. For example, it can be 60% or 40% of the number of unsealing information. For example, if the unsealing information contains 5 unsealing keys K1, k2, k3, k4 and k5, and the preset number is 3, then the target program will be unsealed when the input target program's unsealing key is correct and the number is greater than or equal to 3.

[0117] The target container restart method provided in this application improves application throughput, read / write capabilities, and portability by deploying multiple image containers. Each image container, acting as a node, can provide read / write capabilities, achieving load balancing. Furthermore, the automatic unblocking process during target program restart eliminates the need for manual unblocking, thus achieving high availability of the target program.

[0118] Based on the above embodiments, the following explains how to perform the unblocking procedure. Figure 6 A flowchart illustrating another method for restarting a target container provided in this application embodiment. The method for restarting the target container includes:

[0119] S401: Locate the process of the target program based on the first query instruction triggered by the unblocking procedure.

[0120] S402: Determine whether the target program should be restarted based on its progress.

[0121] It should be understood that if the process of the target program is found, it can be determined that the target program has restarted. If the process of the target program is not found, it can be determined that the target program has not restarted.

[0122] If yes, proceed to step S404; otherwise, proceed to step S403.

[0123] S403: Wait for the first preset time.

[0124] The first preset duration can be set according to the actual situation, such as 2 seconds or 3 seconds.

[0125] After step S403, step S401 is executed.

[0126] S404: Detect the usage status of the target program based on the second query instruction triggered by the unblocking procedure.

[0127] The usage status can be either unblocked or locked.

[0128] S405: Determine whether the target program is in a locked state.

[0129] If not, proceed to step S407; if yes, proceed to step S406.

[0130] S406: Obtain unsealing information based on the unsealing instruction triggered by the unsealing procedure, in order to unseale the target program.

[0131] After step S406, step S407 is executed.

[0132] S407: Run the target program.

[0133] In this embodiment of the application, the target program is automatically unblocked through the unblocking procedure, thereby avoiding the problem of being unable to provide services after restarting and the problem of the target program becoming unusable due to untimely manual intervention, thus improving the availability of the target program.

[0134] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0135] Corresponding to the speech recognition method in the above embodiments, Figure 7 This is a structural block diagram of a target container restart device provided in an embodiment of this application. The target container restart device can be, for example, the computer device described above. For ease of explanation, only the parts relevant to the embodiment of this application are shown. (Refer to...) Figure 7 The restart device 500 for the target container includes: an acquisition module 501, a running module 502, and an unsealing module 503.

[0136] The acquisition module 501 is used to, in response to the restart command of the target container, acquire the execution parameters of the target program from the preset startup node of the target program in the target container. The target program is used to store confidential information online. The preset startup node is the node that starts decrypting the target program during the restart process. The execution parameters are used to indicate the target storage location of the decryption program of the target program. The target storage location is located in the data storage unit of the container cluster where the target container is located. The module 501 is also used to acquire the decryption program from the target storage location according to the execution parameters. The decryption program is used to unlock the target program.

[0137] The execution module 502 is used to run the unsealing program to obtain the unsealing information of the target program;

[0138] The unsealing module 503 is used to unseale the target program based on the unsealing information in order to restart the target container.

[0139] In some optional implementations, the container cluster includes a data storage unit and multiple image containers; each image container stores a target program, and the runtime data generated by the target program in each image container is stored in the data storage unit. The runtime data includes the data corresponding to the unpacking program of the target program, and the target container can be any image container in the container cluster.

[0140] In some optional implementations, the execution module 502 is further configured to obtain the application package of the target program; use the application package to generate multiple image containers to obtain a container cluster composed of multiple image containers; initialize the target program of any image container in the container cluster, obtain the unsealing information of the target program; and generate an unsealing program based on the unsealing information.

[0141] In some optional implementations, the running module 502 is specifically used to initialize the target program of any image container in the container cluster by restoring the setting parameters of the target program to the initial setting value; and to obtain the unsealing information generated by the target program after the initialization is completed, wherein the unsealing information generated after initialization contains a key to unlock the target program.

[0142] In some optional implementations, the execution module 502 is specifically used to obtain the routing information of the data storage unit; modify the storage parameters in the application package according to the routing information of the data storage unit; generate multiple image packages of the target program according to the modified storage parameters and the preset image mounting configuration information; and create multiple image containers using the multiple image packages.

[0143] In some optional implementations, the running module 502 is further configured to receive user input operation instructions for the target program; run the target program in any image container in the container cluster according to the operation instructions, generate the target program's running data, and store the target program's running data in the data storage unit.

[0144] In some optional implementations, the running module 502 is specifically used to fill the unsealing information into the target position in the preset program template to generate an unsealing program; wherein, the program template contains a first data unit, the target position is located in the first data unit, and the first data unit is used to trigger an unsealing instruction for obtaining unsealing information at the first running node of the unsealing program.

[0145] In some optional implementations, the program template further includes a second data unit and a third data unit; the second data unit is used to trigger a first query instruction of the target program at the second running node of the unblocking program, the first query instruction being used to query the restart status of the target program; the third data unit is used to trigger a second query instruction of the target program at the third running node of the unblocking program, the second query instruction being used to query the usage status of the target program; wherein, the third running node is after the second running node and before the first running node.

[0146] In some optional implementations, the running module 502 is specifically used to trigger a first query instruction at the second running node to query the restart status of the target program; trigger a second query instruction at the third running node to query the usage status of the target program; if the target program is in a restart state and the usage status of the target program is locked, then trigger an unblocking instruction at the first running node to extract unblocking information from the unblocking program.

[0147] The target container restart device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and will not be described again in this embodiment.

[0148] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown, the computer device 600 may include: multiple processors 601 and memory 602. Figure 8 This refers to a computer device with a single processor as an example.

[0149] The memory 602 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions.

[0150] The memory 602 may include high-speed RAM memory, and may also include non-volatile memory, such as multiple disk drives.

[0151] The processor 601 is used to execute computer execution instructions stored in the memory 602 to implement the above-described method for restarting the target container.

[0152] The processor 601 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0153] Optionally, in specific implementations, if the communication interface, memory 602, and processor 601 are implemented independently, they can be interconnected via a bus to complete communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not imply that there is only one bus or one type of bus.

[0154] Optionally, in a specific implementation, if the communication interface, memory 602, and processor 601 are integrated on a single chip, then the communication interface, memory 602, and processor 601 can communicate through an internal interface.

[0155] This application also provides a chip, including a processor and an interface. The interface is used to input and output data or instructions processed by the processor. The processor is used to execute the target container restart method provided in the above method embodiments.

[0156] This application also provides a computer-readable storage medium, which may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a disk, or an optical disk. Specifically, the computer-readable storage medium stores program information, which is used for the restart method of the aforementioned target container.

[0157] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method for restarting the target container as described above.

[0158] This application also provides a computer program that causes a computer to execute the above-described method for restarting the target container.

[0159] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for restarting a target container, characterized in that, The method includes: In response to a restart command from the target container, the execution parameters of the target program are obtained at a preset startup node within the target program in the target container. The target program is used to store confidential information online. The preset startup node is the node that begins unpacking the target program during the restart process. The execution parameters indicate the target storage location of the unpacking program of the target program. The target storage location is located in the data storage unit of the container cluster where the target container resides. The container cluster includes a data storage unit and multiple image containers. Each of the multiple image containers stores the target program. The runtime data generated by the target program in each image container is stored in the data storage unit. The runtime data includes data corresponding to the unpacking program of the target program. The target container can be any image container in the container cluster. According to the execution parameters, the unblocking program is obtained from the target storage location, and the unblocking program is used to unlock the target program. Run the unblocking program to obtain the unblocking information of the target program; The target program is unblocked based on the unblocking information to restart the target container.

2. The method according to claim 1, characterized in that, Before obtaining the execution parameters of the target program from the preset startup node of the target program in the target container in response to the restart command of the target container, the method further includes: Obtain the application package of the target program; The application package is used to generate the multiple image containers to obtain the container cluster composed of the multiple image containers; Initialize the target program of any image container in the container cluster and obtain the unpacking information of the target program; The unsealing procedure is generated based on the unsealing information.

3. The method according to claim 2, characterized in that, The initialization of the target program in any image container of the container cluster, and the acquisition of the unpacking information of the target program, include: The target program is initialized by restoring its settings parameters to their initial values. Obtain the unsealing information generated by the target program after initialization, wherein the unsealing information generated after initialization contains a key to unlock the target program.

4. The method according to claim 2, characterized in that, The process of generating the multiple image containers using the application package includes: Obtain the routing information of the data storage unit; Based on the routing information of the data storage unit, modify the storage parameters in the application package; Based on the modified storage parameters and preset image mounting configuration information, multiple image packages of the target program are generated; The multiple image packages are used to create the multiple image containers.

5. The method according to claim 3, characterized in that, After generating the multiple image containers using the application package to obtain the container cluster composed of the multiple image containers, the method further includes: Receive user input of operation instructions for the target program; In any image container in the container cluster, the target program is run according to the operation instructions to generate the runtime data of the target program; The runtime data of the target program is stored in the data storage unit.

6. The method according to claim 3, characterized in that, The step of generating the unsealing procedure based on the unsealing information includes: The unsealing information is filled into the target position in the preset program template to generate the unsealing program; The program template includes a first data unit, and the target location is located in the first data unit. The first data unit is used to trigger an unsealing instruction to obtain the unsealing information at the first running node of the unsealing program.

7. The method according to claim 6, characterized in that, The program template also includes a second data unit and a third data unit; The second data unit is used to trigger a first query instruction of the target program at the second running node of the unblocking program, the first query instruction being used to query the restart status of the target program; The third data unit is used to trigger a second query instruction of the target program at the third running node of the unsealing process, and the second query instruction is used to query the usage status of the target program; The third running node is located after the second running node and before the first running node.

8. The method according to claim 7, characterized in that, Running the unblocking procedure to obtain the unblocking information of the target program includes: The first query instruction is triggered at the second running node to query the restart status of the target program; The second query instruction is triggered at the third running node to query the usage status of the target program; If the target program is in the restart state and the target program is in the locked state, then the unblocking instruction is triggered at the first running node, and the unblocking information is extracted from the unblocking program.

9. A restart device for a target container, characterized in that, The device includes: An acquisition module is configured to, in response to a restart command from a target container, acquire execution parameters of the target program from a preset startup node within the target container. The target program is used to store confidential information online. The preset startup node is the node that begins unsealing the target program during the restart process. The execution parameters indicate the target storage location of the unsealing program, which is located in the data storage unit of the container cluster where the target container resides. The module is also configured to acquire the unsealing program from the target storage location based on the execution parameters. The unsealing program is used to unlock the target program. The container cluster includes a data storage unit and multiple image containers. Each image container stores the target program, and the runtime data generated by the target program in each image container is stored in the data storage unit. The runtime data includes data corresponding to the unsealing program of the target program. The target container can be any image container in the container cluster. The running module is used to run the unblocking program to obtain the unblocking information of the target program; The unsealing module is used to unseale the target program according to the unsealing information in order to restart the target container.

10. A computer device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 1 to 8.

Images