A container control method, apparatus, equipment and medium

Abstract

This application relates to the field of data processing technology, and more particularly to a container control method, apparatus, device, and medium. In this embodiment, the target identifier of the currently logged-in account is obtained. Based on a pre-saved correspondence between identifiers of different accounts and debug images, a candidate debug image corresponding to the target identifier's account is determined. Furthermore, based on a pre-saved correspondence between identifiers of different accounts and user identities in the operating system, the target user identity of the target identifier's account is determined. The target user then accesses any image among the candidate debug images. Through the pre-saved correspondence, the system controls that an account can only access candidate debug images for which it has the necessary permissions, and accesses any image with the operating system user identity matching the account's identifier. This achieves access control and improves container security.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a container control method, apparatus, device and medium. Background Technology

[0002] Based on container technology, container cloud platforms provide a complete set of functions for containerized applications, including deployment and operation, resource scheduling, service discovery, and dynamic scaling, thereby improving the convenience of managing large-scale container clusters.

[0003] In production environments, to optimize image size and improve image security, few tools are installed within containers. While this enhances image security, it introduces several inconveniences, such as the inability to monitor processes and connections within the container, and difficulties in troubleshooting service issues. Furthermore, installing necessary tools only when required hinders timely and convenient operation.

[0004] To address these issues, the concept of ephemeral containers has been introduced in related technologies. Ephemeral containers allow for debugging without the need for third-party tools, such as through the kubectldebug command. However, the lack of account management for images using ephemeral containers significantly compromises container security.

[0005] Therefore, improving container security has become an urgent problem to be solved. Summary of the Invention

[0006] This application provides a container control method, apparatus, device, and medium to address the problem of low container safety in the prior art.

[0007] This application provides a container control method, the method comprising:

[0008] Get the target identifier of the currently logged-in account;

[0009] Based on the pre-saved correspondence between the identifiers of different accounts and debug images, the candidate debug image corresponding to the account of the target identifier is determined;

[0010] Based on the correspondence between the stored identifiers of different accounts and the user identities of the operating system, the target user identity of the account with the target identifier is determined.

[0011] Access any of the candidate debug images as the target user.

[0012] Further, accessing any one of the candidate debug images as the target user includes:

[0013] Display information about the candidate debug images;

[0014] Access the target debug image as the target user by selecting the target debug image from the candidate debug images based on the account.

[0015] Furthermore, the information displayed regarding the candidate debug image includes:

[0016] The candidate debug image last accessed by the account is identified as the recommended debug image;

[0017] The information of the recommended debug image is displayed in priority over the information of other candidate debug images.

[0018] Furthermore, the target debug image is loaded into a temporary container.

[0019] Furthermore, the method also includes:

[0020] If an exit command is received, the temporary container is destroyed.

[0021] Furthermore, the method also includes:

[0022] Receive and execute commands;

[0023] Determine whether the execution command is a target command that meets the permission requirements and has been pre-saved for the target user's identity;

[0024] If so, then execute the command.

[0025] Furthermore, if the execution command includes a call to a running tool; after determining that the execution command is a target command that meets the permission requirements and is pre-saved for the target user identity, before running the execution command, the method further includes:

[0026] Determine whether the running tool is a target tool that meets the permission requirements and has been pre-saved for the target user's identity;

[0027] If so, continue with the steps of running the execution command.

[0028] This application provides a container control device, the device comprising:

[0029] The acquisition module is used to obtain the target identifier of the currently logged-in account;

[0030] The determination module is used to determine the candidate debug image corresponding to the account of the target identifier based on the pre-saved correspondence between the identifiers of different accounts and debug images; and to determine the target user identity of the account of the target identifier based on the pre-saved correspondence between the identifiers of different accounts and the user identities of the operating system.

[0031] An access module is used to access any of the candidate debug images as the target user.

[0032] Furthermore, the access module is specifically used to display information about the candidate debug images; and to access the target debug image as the target user by selecting the target debug image from the candidate debug images according to the account.

[0033] Furthermore, the access module is specifically used to determine the candidate debug image last accessed by the account as the recommended debug image; and to display the information of the recommended debug image in priority over the information of other candidate debug images.

[0034] Furthermore, the target debug image is loaded into a temporary container.

[0035] Furthermore, the device also includes:

[0036] The destruction module is used to destroy the temporary container if an exit command is received.

[0037] Furthermore, the device also includes:

[0038] The receiving module is used to receive execution commands;

[0039] The execution module is used to determine whether the execution command is a target command that meets the permission requirements and is pre-saved for the target user's identity; if so, the execution command is executed.

[0040] Furthermore, if the execution command includes a call to a running tool, the execution module is also used to determine whether the running tool is a target tool that meets the permission requirements and has been pre-saved for the target user's identity; if so, the step of running the execution command continues.

[0041] This application also provides an electronic device, which includes a processor for executing a computer program stored in a memory to implement the steps of any of the container control methods described above.

[0042] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the container control methods described above.

[0043] This application also provides a computer program product, which includes computer program code that, when run on a computer, causes the computer to perform the steps of any of the container control methods described above.

[0044] In this embodiment, the target identifier of the currently logged-in account is obtained. Based on the pre-saved correspondence between the identifiers of different accounts and debug images, the candidate debug image corresponding to the target identifier's account is determined. Furthermore, based on the pre-saved correspondence between the identifiers of different accounts and the user identities of the operating system, the target user identity of the target identifier's account is determined. The target user then accesses any image among the candidate debug images. Through the pre-saved correspondence, the system controls that an account can only access candidate debug images for which it has the necessary permissions, and accesses any image with the operating system user identity matching the account's identifier. This achieves access control and improves container security. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A schematic diagram of a container control process provided in an embodiment of this application;

[0047] Figure 2 A schematic diagram illustrating the execution process of an execution command, provided as an embodiment of this application;

[0048] Figure 3 A schematic diagram of a container control process provided in an embodiment of this application;

[0049] Figure 4 This is a schematic diagram of a container control device provided in an embodiment of this application;

[0050] Figure 5 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0052] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0053] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0054] The acquisition, transmission, storage, and use of data in this application all comply with the requirements of relevant national laws and regulations.

[0055] To optimize container image size and improve image security, related technologies typically avoid installing numerous tools within containers. For example, curl, wget, dig, and commonly used net-tools are generally not installed. curl is a common command-line tool, wget is a free tool for automatically downloading files from the network, and dig is a tool for querying Domain Name System (DNS) information. While this improves image security, it also introduces some inconveniences. Related technologies have introduced the concept of temporary containers, but the diverse sources of temporary container images make them difficult to manage, and the tools contained within the images cannot be effectively categorized and managed. Therefore, this application provides a container control method, apparatus, device, and medium. In this embodiment, the target identifier of the currently logged-in account is obtained; based on the pre-saved correspondence between identifiers of different accounts and debug images, a candidate debug image corresponding to the target identifier's account is determined; based on the saved correspondence between identifiers of different accounts and user identities in the operating system, the target user identity of the target identifier's account is determined; and any image among the candidate debug images is accessed using this target user identity.

[0056] Example 1:

[0057] Figure 1 This is a schematic diagram of a container control process provided in an embodiment of this application, as shown below. Figure 1 As shown, the process includes the following steps:

[0058] S101: Obtain the target identifier of the currently logged-in account.

[0059] The container control method provided in this application is applied to an electronic device, which may be a server, PC, smart terminal, etc.

[0060] In this embodiment, to improve container security, container control can be achieved using a container cloud platform. In this embodiment, images for temporary debugging can be uniformly published on the container cloud platform, and accounts can choose to load debugging images when using debugging functions through the container cloud platform. Optionally, the container cloud platform can be Kubernetes, a leading distributed architecture solution based on container technology. Kubernetes is an open-source container cluster management system from Google. It should be noted that those skilled in the art can configure the container cloud platform as needed; that is, those skilled in the art can configure account login methods as needed, and this embodiment does not impose any limitations on this.

[0061] When debugging or maintenance of a container is required, an account can log in to the container cloud platform. When an electronic device detects an account logging in, it can obtain the target identifier of the currently logged-in account. This target identifier can uniquely identify a specific account; it can be a mobile phone number, ID card number, employee ID, account number, etc., and this application embodiment does not impose any limitations on this. Of course, the container control method provided in this application embodiment can be applied to any process requiring container control, not just debugging and maintenance.

[0062] S102: Based on the pre-saved correspondence between the identifiers of different accounts and the debug images, determine the candidate debug image corresponding to the account of the target identifier.

[0063] After obtaining the target identifier, in order to determine the images that the account associated with that target identifier can access, in this embodiment of the application, the candidate debug images corresponding to the account associated with the target identifier can be determined based on the pre-saved correspondence between the identifiers of different accounts and debug images. These candidate debug images can be understood as the images that the account associated with the target identifier can access. In other words, by determining which image(s) the account associated with the target identifier has permission to access, the images that can be accessed are identified as candidate debug images.

[0064] For example, since different accounts can select different candidate debug images based on their permissions, different permissions can be pre-configured, granting different accounts access to different candidate debug images. These different candidate debug images may differ only in version. The pre-configured permissions can be admin, maintainer, developer, and guest permissions. admin has the highest permissions, and so on, with guest having the lowest. Specifically, admin has administrative privileges over the entire system; maintainer has administrative privileges over all deployment space resources within its system, primarily including CRUD (Create, Read, Update, Delete) permissions; developer has administrative privileges over all deployment space resources within its system, excluding deletion; and guest has read-only permissions over all deployment space resources within its system. Of course, each permission can be flexibly configured as needed.

[0065] After obtaining the target identifier, the permission type of the account can be determined based on the target identifier, and then the candidate debug image corresponding to the account can be determined based on the permission type.

[0066] It should be noted that different accounts with the same permission type may have completely different or not completely the same candidate debug images. Those skilled in the art can configure them as needed.

[0067] S103: Based on the saved correspondence between different account identifiers and operating system user identities, determine the target user identity of the account with the target identifier, and access any image among the candidate debug images using the target user identity. After accessing the image, the account can use the tools it has the permission to use as the target user. That is, the account can use some or all of the tools deployed in the image it accesses; the specific tools that can be used are determined by the target user identity of the account, i.e., the permissions that the account possesses.

[0068] Since accounts with different permissions have different privileges when accessing corresponding images, in this embodiment, after determining the candidate debug image corresponding to an account, it can be determined which operating system identity the account should use to access the candidate debug image. In this embodiment, the target user identity of the account with the target identifier can be determined based on the saved correspondence between the identifiers of different accounts and the user identities of the operating systems. Then, any image in the candidate debug images is accessed using this target user identity. That is, after entering any image, operations are performed using the determined target user identity. For example, the pre-saved operating system user identities may include root, maintainer, and guest. The root user identity has higher permissions than the maintainer user identity, and the maintainer user identity has higher permissions than the guest user identity. It should be noted that those skilled in the art can configure the pre-saved operating system user identities as needed.

[0069] In this embodiment, the target identifier of the currently logged-in account is obtained. Based on the pre-saved correspondence between the identifiers of different accounts and debug images, the candidate debug image corresponding to the target identifier's account is determined. Furthermore, based on the pre-saved correspondence between the identifiers of different accounts and the user identities of the operating system, the target user identity of the target identifier's account is determined. The target user then accesses any image among the candidate debug images. Through the pre-saved correspondence, the system controls that an account can only access candidate debug images for which it has the necessary permissions, and accesses any image with the operating system user identity matching the account's identifier. This achieves access control and improves container security.

[0070] Example 2:

[0071] To enhance the user experience, based on the above embodiments, in this embodiment, accessing any image among the candidate debug images as the target user includes:

[0072] Display information about the candidate debug images;

[0073] Access the target debug image as the target user by selecting the target debug image from the candidate debug images based on the account.

[0074] To enhance the user experience, after identifying the candidate debug images corresponding to the target account, information about the identified candidate debug images can be displayed. This information may include one or more of the following: the candidate debug image's name, detailed information, and last login time. Of course, the candidate debug image information can also include more information, and those skilled in the art can configure it as needed; this application embodiment does not impose any limitations on this. In other words, different accounts may see different candidate debug images after logging in.

[0075] After viewing the displayed candidate debug images, the account can select the target debug image to access based on that information. Once the electronic device receives the selected target debug image, it can access that target debug image as the designated user.

[0076] In this embodiment, a categorized management system for debug images is implemented. Candidate debug images with different capabilities are provided to accounts with different permission types. Each account can only see candidate debug images corresponding to its permissions on the container cloud platform, and accounts can select different target debug images as needed.

[0077] In this embodiment, the target debug image can be loaded into a temporary container. Based on the characteristics of the temporary container, it can be destroyed upon receiving an exit command. This exit command can be an instruction issued by the user when logging out of their account.

[0078] To further enhance the user experience, based on the above embodiments, in this embodiment, the display of information about the candidate debug image includes:

[0079] The candidate debug image last accessed by the account is identified as the recommended debug image;

[0080] The information of the recommended debug image is displayed in priority over the information of other candidate debug images.

[0081] Since some accounts may have higher privileges and access more candidate debug images, to further improve the user experience, in this embodiment, when displaying candidate debug image information, the candidate debug image corresponding to the information can be determined based on the image information previously accessed by the user, and the previously accessed candidate debug image is designated as the recommended debug image. Because the debug image previously accessed by the account may have been returned by mistake or the operation was not yet completed, in this embodiment, the information of the recommended debug image can be displayed before the information of other candidate debug images, so that the account can quickly locate the recommended debug image among many candidate debug images.

[0082] Specifically, assuming there are candidate debug images A, B, C, D, E, and F, where candidate debug image E is the recommended debug image, the information for the candidate debug images can be displayed in the order of E, A, B, C, D, and F.

[0083] In this embodiment of the application, when displaying information about candidate debug images, an identifier can also be added to the information of recommended debug images. This identifier is used to identify the corresponding image as a recommended debug image. For example, the words "[Recommended]" can be added after the information of the recommended debug image.

[0084] Example 3:

[0085] To further enhance the safety of the container, based on the above embodiments, the method in this application embodiment further includes:

[0086] Receive and execute commands;

[0087] Determine whether the execution command is a target command that meets the permission requirements and has been pre-saved for the target user's identity;

[0088] If so, then execute the command.

[0089] Since different operating system user identities have different operation permissions, in this embodiment, the correspondence between different user identities and executable commands can be pre-stored. That is, the commands that accounts with different user identities can operate are pre-configured. After an account accesses any image as the target user, if an execution command is received, it can be determined whether the execution command is a target command that meets the permission requirements and is pre-stored for that target user identity. This execution command can be a command to perform operations such as adding, deleting, modifying, or running certain data.

[0090] If the execution command is a qualified target command, it means that the account has not exceeded its privileges and can run the execution command.

[0091] If the executed command is not a valid target command, it indicates that the account has engaged in unauthorized operation, and an unauthorized operation warning message can be output.

[0092] Example 4:

[0093] To further enhance container security, based on the above embodiments, in this embodiment, if the execution command includes a call to a running tool; after determining that the execution command is a target command that meets the permission requirements and is pre-saved for the target user identity, before running the execution command, the method further includes:

[0094] Determine whether the running tool is a target tool that meets the permission requirements and has been pre-saved for the target user's identity;

[0095] If so, continue with the steps of running the execution command.

[0096] Since some tools deployed in the image may also be available to accounts with higher privileges, in this embodiment of the application, the correspondence between different user identities and runnable tools can be pre-configured.

[0097] If the received execution command includes a call to a running tool, after determining that the execution command is a target command that meets the permission requirements, before running the execution command, it can also be determined whether the running tool that the execution command expects to call is a target tool that meets the permission requirements and has been saved in advance for the target user's identity.

[0098] If it is determined that the tool being run is a target tool that meets the permission requirements, it means that the account has not exceeded its privileges in using the tool, and the subsequent steps of running and executing commands can continue.

[0099] If it is determined that the tool being used is not a target tool that meets the permission requirements, it means that the account is using the tool without authorization. A prompt message confirming the use of the tool can be output, and the subsequent steps to execute the command will not be executed.

[0100] Specifically, assume user A has the permissions to view, modify, and delete data in tool A. The pre-saved permission mapping can be: user A has the permissions to view, modify, and delete, and user A also has the permission to operate tool A. When the target user identity of account A is user A, and account A accesses the image as user A, if account A issues an execution command expecting to delete data in tool B, then upon receiving the execution command, it can be determined that the deletion operation is within the permissions of user A. Since the execution command includes a call to tool B, it is necessary to further determine whether tool B is a tool that user A can run. Because the pre-configured user A value has the permission to operate tool A, it can be determined that user A has unauthorized access to the tool, and an unauthorized access warning message can be output.

[0101] The process of executing commands will be described below with reference to a specific embodiment. Figure 2 This is a schematic diagram illustrating the execution process of an execution command, as provided in an embodiment of this application. Figure 2 As shown, the process includes the following steps:

[0102] S201: Receive execution command.

[0103] S202: Determine whether the command to be executed is a target command that meets the permission requirements. If not, execute S203; if yes, execute S204.

[0104] S203: Output a message indicating an unauthorized operation.

[0105] S204: Determine whether the execution command includes a call to the running tool. If yes, execute S205; otherwise, execute S206.

[0106] S205: Determine whether the running tool is a target tool that meets the permission requirements. If yes, execute S206; otherwise, execute S207.

[0107] S206: Run the command.

[0108] S207: Output a message indicating unauthorized use of the tool.

[0109] For ease of understanding, the operation permissions of different accounts are explained below with reference to Table 1. It should be noted that the content shown in Table 1 is for illustrative purposes only; those skilled in the art can configure the permission mappings as needed.

[0110] Table 1

[0111]

[0112]

[0113] As shown in Table 1, if the account's permission type on the container cloud platform is determined to be "guest" based on the target identifier, its corresponding candidate debug images can be different versions of debug-guest. Access to any candidate debug image can be performed as a "guest" user. During access, the account has only read-only permissions and is provided with commands limited to viewing, such as ping, dig, telnet, and strace, but not high-risk commands like su and sudo. The ping command is commonly used to diagnose network faults. The telnet command opens a terminal or command prompt window. The strace command is used to trace system calls and received signals during process execution.

[0114] If the target identifier determines that the account's permission type on the container cloud platform is either maintainer or developer, the corresponding candidate debug images can be different versions of debug-maintainer. When accessing any candidate debug image, the user can access it as maintainer. During access, the account has viewing and operation permissions, including tools and commands for analyzing application processes, such as JVM analysis tools.

[0115] If the target identifier determines that the account's permission type on the container cloud platform is admin, its corresponding candidate debug images can be different versions of debug-admin. When accessing any candidate debug image, the user can access it as root. During access, this account has the highest privileges and can troubleshoot application problems using pre-installed tools, including tcpdump, dd, etc. It also comes pre-installed with services such as sshd, which can be started by the root user. tcpdump is a packet capture tool running on the command line. The dd command is a powerful disk operation tool used for low-level data transformation and copying operations in Linux and other UNIX-like operating systems.

[0116] Example 5:

[0117] The container control process is described below with reference to a specific embodiment. Figure 3 This is a schematic diagram of a container control process provided in an embodiment of this application, such as... Figure 3 As shown, after logging into the container cloud platform, when selecting candidate debug images in the temporary console, different debug images can be displayed based on different permission types. Specifically, based on the pre-saved correspondence between different account identifiers and debug images, different versions of candidate debug images with specific names can be displayed.

[0118] When logging in with the guest account, the debug console will display different versions of the debug-guest image. Assuming the account selects the debug image "debug-guest:v1.2", the user can access the debug image as the guest.

[0119] When the maintainer account logs in, the debug console will display different versions of the debug-maintainer image. Assuming the account selects the debug image "debug-maintainer:v2.1", the maintainer user can access the debug image.

[0120] When the admin account logs in, the debug console will display different versions of the debug-admin image. Assuming the account selects the debug image "debug-admin:v1", the user can access the debug image as root.

[0121] When accessing different debug images with different accounts, the corresponding user is already built into the debug image, so the username will be visible after starting the temporary container. For example, after logging in with the admin account and loading the debug image, the user identity will be root, allowing you to debug and troubleshoot issues as the root user.

[0122] When an account logs out of the container cloud platform, the temporary container can be destroyed.

[0123] In this embodiment, the capabilities of temporary containers are released externally through a container cloud platform, allowing both underlying operations and maintenance personnel and general developers to use them. Debugging images for temporary containers are provided and managed uniformly, ensuring that image versions and content are risk-controlled and preventing the introduction of tools or commands with execution risks. Debugging images are categorized and managed, with different categories corresponding to different permissions and personnel, preventing risks arising from misoperation due to excessive permissions. In summary, the permission management based on the container cloud platform and the categorized management of debugging images can meet the control requirements of the operations and maintenance system, effectively providing fine-grained control over the operational permissions of different accounts to improve existing operations and maintenance capabilities.

[0124] Example 6:

[0125] Based on the same inventive concept, embodiments of this application provide a container control device. Figure 4 Please refer to the schematic diagram of a container control device provided in this application embodiment. Figure 4 The device includes:

[0126] Module 401 is used to obtain the target identifier of the currently logged-in account;

[0127] The determination module 402 is used to determine the candidate debug image corresponding to the account of the target identifier based on the pre-saved correspondence between the identifiers of different accounts and debug images; and to determine the target user identity of the account of the target identifier based on the pre-saved correspondence between the identifiers of different accounts and the user identity of the operating system.

[0128] Access module 403 is used to access any of the candidate debug images as the target user.

[0129] In one possible implementation, the access module 403 is specifically used to display information about the candidate debug images; and to access the target debug image as the target user based on the target debug image selected by the account from the candidate debug images.

[0130] In one possible implementation, the access module 403 is specifically used to determine the candidate debug image last accessed by the account as the recommended debug image; and to display the information of the recommended debug image in priority over the information of other candidate debug images.

[0131] In one possible implementation, the target debug image is loaded into a temporary container.

[0132] In one possible implementation, the device further includes:

[0133] The destruction module 404 is used to destroy the temporary container if an exit command is received.

[0134] In one possible implementation, the device further includes:

[0135] Receiver module 405 is used to receive execution commands;

[0136] The execution module 406 is used to determine whether the execution command is a target command that meets the permission requirements and is pre-saved for the target user's identity; if so, the execution command is executed.

[0137] In one possible implementation, if the execution command includes a call to a running tool, the execution module 406 is further configured to determine whether the running tool is a target tool that meets the permission requirements and has been pre-saved for the target user's identity; if so, the step of running the execution command continues.

[0138] Example 7:

[0139] Based on the same inventive concept, embodiments of this application provide an electronic device that can implement the steps of the container control method described above. Figure 5 This application provides a schematic diagram of an electronic device structure, such as... Figure 5 As shown, it includes: processor 501, communication interface 502, memory 503 and communication bus 504, wherein processor 501, communication interface 502 and memory 503 communicate with each other through communication bus 504.

[0140] The memory 503 stores a computer program. When the program is executed by the processor 501, the processor 501 performs the following steps:

[0141] Get the target identifier of the currently logged-in account;

[0142] Based on the pre-saved correspondence between the identifiers of different accounts and debug images, the candidate debug image corresponding to the account of the target identifier is determined;

[0143] Based on the correspondence between the stored identifiers of different accounts and the user identities of the operating system, the target user identity of the account with the target identifier is determined.

[0144] Access any of the candidate debug images as the target user.

[0145] In one possible implementation, accessing any of the candidate debug images as the target user includes:

[0146] Display information about the candidate debug images;

[0147] Access the target debug image as the target user by selecting the target debug image from the candidate debug images based on the account.

[0148] In one possible implementation, the information displayed regarding the candidate debug image includes:

[0149] The candidate debug image last accessed by the account is identified as the recommended debug image;

[0150] The information of the recommended debug image is displayed in priority over the information of other candidate debug images.

[0151] In one possible implementation, the target debug image is loaded into a temporary container.

[0152] In one possible implementation, the method further includes:

[0153] If an exit command is received, the temporary container is destroyed.

[0154] In one possible implementation, the method further includes:

[0155] Receive and execute commands;

[0156] Determine whether the execution command is a target command that meets the permission requirements and has been pre-saved for the target user's identity;

[0157] If so, then execute the command.

[0158] In one possible implementation, if the execution command includes a call to a running tool; after determining that the execution command is a target command that meets the permission requirements and is pre-saved for the target user identity, before running the execution command, the method further includes:

[0159] Determine whether the running tool is a target tool that meets the permission requirements and has been pre-saved for the target user's identity;

[0160] If so, continue with the steps of running the execution command.

[0161] Since the principle of the above-mentioned electronic device in solving the problem is similar to that of the container control method, the implementation of the above-mentioned electronic device can be found in the embodiments of the method, and repeated details will not be repeated.

[0162] The communication bus mentioned in the above-mentioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. Communication interface 502 is used for communication between the above-mentioned electronic device and other devices. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0163] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0164] Example 8:

[0165] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, it causes the processor to execute any of the container control methods discussed above. Since the principle by which the computer-readable storage medium solves the problem is similar to that of the container control method, the implementation of the computer-readable storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0166] Example 9:

[0167] Based on the same inventive concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the container control methods discussed above. Since the principle by which the above-described computer program product solves the problem is similar to that of the container control method, the implementation of the above-described computer program product can be referred to the implementation of the method, and repeated details will not be described again.

[0168] In this embodiment, the target identifier of the currently logged-in account is obtained. Based on the pre-saved correspondence between identifiers of different accounts and debug images, a candidate debug image corresponding to the account with the target identifier is determined. Based on the pre-saved correspondence between identifiers of different accounts and user identities in the operating system, the target user identity of the account with the target identifier is determined. The target user then accesses any image among the candidate debug images. By using the pre-saved correspondence, the system controls that an account can only access candidate debug images for which it has the necessary permissions, and accesses any image with the operating system user identity matching the account identifier. This achieves access control and improves container security.

[0169] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0170] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0171] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0172] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of user-operated steps to be executed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0173] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A container control method characterized by, The method comprises: obtaining a target identifier of a currently logged-in account; determining a candidate debugging image corresponding to the account of the target identifier according to a pre-stored correspondence between identifiers of different accounts and debugging images; determining a target user identity of the account of the target identifier according to a pre-stored correspondence between identifiers of different accounts and user identities of operating systems; accessing any one of the candidate debugging images in the target user identity; The method further comprises: receiving an execution command; determining whether the execution command is a target command meeting a permission requirement pre-stored for the target user identity; if yes, running the execution command.

2. The method of claim 1, wherein, The accessing any one of the candidate debugging images in the target user identity comprises: displaying information of the candidate debugging images; accessing a target debugging image selected by the account from the candidate debugging images in the target user identity.

3. The method of claim 2, wherein, The displaying information of the candidate debugging images comprises: determining a candidate debugging image last accessed by the account as a recommended debugging image; displaying information of the recommended debugging image preferentially to information of other candidate debugging images.

4. The method of claim 2, wherein, The target debugging image is loaded in a temporary container.

5. The method of claim 4, wherein, The method further comprises: if an exit instruction is received, destroying the temporary container.

6. The method of claim 1, wherein, If the execution command includes a call to a running tool, after determining that the execution command is the target command meeting the permission requirement pre-stored for the target user identity, before running the execution command, the method further comprises: determining whether the running tool is a target tool meeting the permission requirement pre-stored for the target user identity; if yes, continuing to execute the step of running the execution command.

7. A container control device characterized by comprising: The device comprises: an obtaining module, configured to obtain a target identifier of a currently logged-in account; a determining module, configured to determine a candidate debugging image corresponding to the account of the target identifier according to a pre-stored correspondence between identifiers of different accounts and debugging images, and determine a target user identity of the account of the target identifier according to a pre-stored correspondence between identifiers of different accounts and user identities of operating systems; an accessing module, configured to access any one of the candidate debugging images in the target user identity; a receiving module, configured to receive an execution command; an executing module, configured to determine whether the execution command is a target command meeting a permission requirement pre-stored for the target user identity, and if yes, run the execution command.

8. The apparatus of claim 7, wherein, The accessing module is specifically configured to display information of the candidate debugging images, and access a target debugging image selected by the account from the candidate debugging images in the target user identity.

9. The apparatus of claim 8, wherein, The accessing module is specifically configured to determine a candidate debugging image last accessed by the account as a recommended debugging image, and display information of the recommended debugging image preferentially to information of other candidate debugging images.

10. The apparatus of claim 8, wherein, The target debugging image is loaded in a temporary container.

11. The apparatus of claim 10, wherein, The device further comprises: a destroying module, configured to destroy the temporary container if an exit instruction is received.

12. The apparatus of claim 7, wherein, If the execution command includes a call to a running tool, the execution module is further configured to determine whether the running tool is a target tool that meets the permission requirement and is saved in advance for the target user identity; and if so, continue to execute the step of running the execution command.

13. An electronic device, comprising: The electronic device comprises a processor configured to implement the steps of the container control method of any one of claims 1-6 when executing a computer program stored in a memory.

14. A computer-readable storage medium, characterized in that, The computer program product comprises a computer program code, which, when executed on a computer, causes the computer to perform the steps of the container control method of any one of claims 1-6.

15. A computer program product, characterised in that, The computer program product comprises a computer program code, which, when executed on a computer, causes the computer to perform the steps of the container control method of any one of claims 1-6.

Images