Container mirror image acquisition method and device, equipment, medium and program product

Abstract

The invention provides a container mirror image acquisition method which can be applied to the technical field of cloud computing. The container mirror image acquisition method comprises the following steps: in response to a cluster task creation instruction, acquiring target mirror image information required for creating a task; traversing a first node according to the target mirror image information to obtain a target mirror image; if it is determined that the target mirror image does not exist in the first node, a second node with the target mirror image is determined through a node mirror image warehouse daemon process service, and the node mirror image warehouse daemon process service is used for synchronization of container mirror images between cluster nodes; the first node is a local node, the second node is one or more nodes with the same node label as the first node, and the password-free login protocol is configured between the nodes with the same node label in advance. The invention further provides a container mirror image acquisition device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of cloud computing, specifically to the field of image synchronization technology, and more specifically to a container image acquisition method, device, equipment, medium and program product. Background Art

[0002] In a cluster, when creating a task, if the image required to start the container does not exist on the node in the cluster, the cluster component will initiate a request to pull the image from the image repository. However, when too many tasks are created at the same time, if all nodes in the cluster that need to run tasks simultaneously initiate a request to pull the image from the image repository, the image repository will form a performance bottleneck, resulting in a long time for the nodes in the cluster to pull the image, and a longer task startup time.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a container image acquisition method, apparatus, device, medium and program product for improving the efficiency of container image acquisition.

[0005] According to a first aspect of the present disclosure, there is provided a method for obtaining a container image, comprising: in response to a cluster task creation instruction, obtaining target image information required for creating a task;

[0006] Traversing the first node according to the target image information to obtain the target image;

[0007] If it is determined that the target image does not exist on the first node, determine a second node that has the target image through a node image repository daemon service, where the node image repository daemon service is used for synchronizing container images between cluster nodes; and

[0008] Mirror synchronization is performed from the second node through a password-free login protocol.

[0009] The first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein a password-free login protocol is pre-configured between the nodes having the same node label.

[0010] According to an embodiment of the present disclosure, the node image repository daemon service includes a client and a server, the client is deployed on any node, the server is deployed in a cluster, and determining the second node where the target image exists through the node image repository daemon service includes:

[0011] Query the server to determine whether a second node of the target image exists; and

[0012] Receive the node address and image layer path information returned by the server.

[0013] According to an embodiment of the present disclosure, performing mirror synchronization from the second node through a password-free login protocol includes:

[0014] Establishing secure communication with the second node according to the node address based on a password-free login protocol; and

[0015] The mirror layer directory is copied to the directory corresponding to the first node according to the mirror layer path information.

[0016] According to an embodiment of the present disclosure, traversing the first node according to the target image information to obtain the target image includes:

[0017] Parsing the target image information to determine the image name, label, and image layer information; and

[0018] The target image is searched in the first node according to the image name, label and image layer information.

[0019] According to an embodiment of the present disclosure, the method further includes:

[0020] If it is determined that the target image exists on the first node, analyzing the image layer structure to determine the storage path of each image layer; and

[0021] Upload the image layer storage path information of the target image to the server of the node image repository daemon service.

[0022] According to an embodiment of the present disclosure, the method further includes:

[0023] If it is determined that the target image does not exist on the second node, the node agent process is started to pull the image from the image repository.

[0024] According to an embodiment of the present disclosure, the method further includes:

[0025] When a node joins a cluster, a label is set for the node through the cluster's label system;

[0026] generating a secure shell protocol key pair for each node; and

[0027] Distribute and configure the Secure Shell protocol public key based on the node label.

[0028] A second aspect of the present disclosure provides a container image acquisition device, comprising: a first acquisition module, configured to acquire target image information required for creating a task in response to a cluster task creation instruction;

[0029] A second acquisition module, configured to traverse the first node according to the target image information to acquire the target image;

[0030] A first determination module is configured to, if it is determined that the target image does not exist on the first node, determine a second node that has the target image through a node image repository daemon service, wherein the node image repository daemon service is used for synchronizing container images between cluster nodes; and

[0031] A mirror synchronization module, used to perform mirror synchronization from the second node through a password-free login protocol,

[0032] The first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein a password-free login protocol is pre-configured between the nodes having the same node label.

[0033] According to an embodiment of the present disclosure, the node image repository daemon service includes a client and a server, the client is deployed on any node, the server is deployed in a cluster, and the first determination module includes a query submodule and a receiving submodule.

[0034] A query submodule, used to query the server to determine the second node where the target image exists; and

[0035] The receiving submodule is used to receive the node address and image layer path information returned by the server.

[0036] According to an embodiment of the present disclosure, the mirror synchronization module includes a communication submodule and a synchronization submodule.

[0037] a communication submodule, configured to establish secure communication with the second node according to the node address based on a password-free login protocol; and

[0038] The synchronization submodule is used to copy the mirror layer directory to the directory corresponding to the first node according to the mirror layer path information.

[0039] According to an embodiment of the present disclosure, the second acquisition module includes: a parsing submodule and a searching submodule.

[0040] A parsing submodule, used to parse the target image information to determine the image name, label and image layer information; and

[0041] The search submodule is used to search for the target image in the first node according to the image name, label and image layer information.

[0042] According to an embodiment of the present disclosure, the device further includes:

[0043] A second determination module is configured to analyze the image layer structure to determine the storage path of each image layer if it is determined that the target image exists on the first node; and

[0044] The image status update module is used to upload the image layer storage path information of the target image to the server of the node image repository daemon service.

[0045] According to an embodiment of the present disclosure, the device further includes:

[0046] The image pulling module is used to start the node agent process to pull the image from the image repository if it is determined that the target image does not exist on the second node.

[0047] According to an embodiment of the present disclosure, the device further includes:

[0048] The label setting module is used to set labels for nodes through the cluster's label system when the node joins the cluster;

[0049] A key generation module, configured to generate a secure shell protocol key pair for each node; and

[0050] The key distribution module is used to distribute and configure the secure shell protocol public key according to the node label.

[0051] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0052] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0053] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0054] The container image acquisition method provided by the embodiment of the present disclosure introduces the node image repository daemon service, and realizes the management and distribution of image information through the collaboration of the server and the client; and realizes the rapid synchronization of images by using the password-free login protocol between nodes. Through the mutual synchronization between nodes, the exponential efficiency growth of image distribution is achieved, and the deployment process of large-scale tasks is optimized. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0056] Figure 1 The application scenario diagram of the container image acquisition method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0057] Figure 2 A flowchart of a method for obtaining a container image according to an embodiment of the present disclosure is schematically shown;

[0058] Figure 3 A flowchart of a method for obtaining a container image according to another embodiment of the present disclosure is schematically shown;

[0059] Figure 4 A flowchart of a method for obtaining a container image according to another embodiment of the present disclosure is schematically shown;

[0060] Figure 5 A flowchart of a method for obtaining a container image according to another embodiment of the present disclosure is schematically shown;

[0061] Figure 6 A structural block diagram of a container image acquisition device according to an embodiment of the present disclosure is schematically shown; and

[0062] Figure 7 A block diagram of an electronic device suitable for implementing a container image acquisition method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0063] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0064] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0065] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0066] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0067] First, the terms that appear in the embodiments of the present disclosure are explained:

[0068] Kubernetes: An open source container orchestration platform for automating the deployment, scaling, and management of containerized applications.

[0069] POD: In Kubernetes, Pod is the most basic deployment unit. It is a logical host that can contain one or more containers (such as Docker containers). Containers in a Pod share network and storage resources and run in the same context, which means they share the same network namespace, IP address, and storage volume.

[0070] Key features of Pods include:

[0071] Shared Network: All containers within a Pod can communicate using localhost, and ports can be shared between them.

[0072] Storage sharing: Containers in a Pod can access the same storage volumes, which allows them to share data.

[0073] Independent operation: Each Pod is an independent process with its own process ID number space.

[0074] Simple management: The Kubernetes API uses Pod as the unit of operation and management, and can start, stop, and delete Pods.

[0075] Resource guarantees: Pods can request specific computing resources (CPU and memory), and Kubernetes will try its best to guarantee the resource requirements of Pods.

[0076] Restart policy: A Pod has a defined restart policy. If a container in a Pod fails, Kubernetes can automatically restart the container according to the configured policy.

[0077] Lifecycle management: Pod supports defining lifecycle hooks for containers, allowing specific operations to be performed before the container is started or shut down.

[0078] Health Check: Pod can be configured with Liveness and Readiness Probes to determine whether the container is healthy and ready to accept traffic. The design of Pod makes it very suitable as a unit for running a single application instance while maintaining a high degree of flexibility and manageability. In a Kubernetes cluster, Pod is usually the starting point for creating, scaling, and managing applications.

[0079] Kubelet: A component in the Kubernetes cluster that is responsible for starting containers and monitoring the status of containers.

[0080] DeamonSet: A type of resource in Kubernetes that ensures that an instance of a Pod is running on all (or some) nodes.

[0081] Deployment: A resource type in Kubernetes that describes the desired state of an application and can be used to create, update, and scale applications.

[0082] API-server: The control center of the Kubernetes cluster, responsible for receiving and processing requests from users and components.

[0083] SSH: Secure Shell Protocol, used to provide a secure data communication channel over an insecure network.

[0084] Harbor: An open source container image repository for storing and distributing Docker images.

[0085] In a cluster, when creating a task, if the image required to start the container is not on the local node, the cluster component will initiate a request to pull the image from the image repository. When too many tasks are created at the same time, there may be a large number of nodes simultaneously initiating requests to pull images from the image repository, which will form a performance bottleneck in the image repository, resulting in a long time for nodes in the cluster to pull images, and a longer task startup time.

[0086] Based on the above technical problems, an embodiment of the present disclosure provides a container image acquisition method, the method comprising: in response to a cluster task creation instruction, obtaining target image information required for creating the task; traversing the first node according to the target image information to obtain the target image; if it is determined that the target image does not exist on the first node, determining a second node where the target image exists through a node image repository daemon service, the node image repository daemon service is used for synchronizing container images between cluster nodes; and synchronizing the image from the second node through a secret-free login protocol, wherein the first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein the secret-free login protocol is pre-configured between nodes having the same node label.

[0087] Figure 1 The application scenario diagram of the container image acquisition method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0088] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a large-scale server installation scenario. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0089] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0090] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0091] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0092] It should be noted that the container image acquisition method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the container image acquisition device provided in the embodiment of the present disclosure can generally be set in the server 105. The container image acquisition method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the container image acquisition device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0093] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements. Figure 1 The application scenarios shown are only examples of application scenarios and system architectures to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. It should be noted that the container image acquisition method and device determined in the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The application field of the container image acquisition method and device determined in the present disclosure is not limited.

[0094] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The container image acquisition method of the disclosed embodiment is described in detail.

[0095] Figure 2 The flowchart of the container image acquisition method according to an embodiment of the present disclosure is schematically shown.

[0096] like Figure 2 As shown, the container image acquisition method of this embodiment includes operations S210 to S240, and the transaction processing method can be executed by a server or other computing devices.

[0097] In operation S210 , in response to a cluster task creation instruction, target image information required for creating a task is acquired.

[0098] In operation S220, the first node is traversed according to the target image information to obtain the target image.

[0099] In operation S230, if it is determined that the target image does not exist on the first node, a second node that has the target image is determined through a node image repository daemon service.

[0100] In operation S240, mirror synchronization is performed from the second node through a password-free login protocol.

[0101] According to an embodiment of the present disclosure, the node image repository daemon service is used for synchronizing container images between cluster nodes.

[0102] According to an embodiment of the present disclosure, the first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein a password-free login protocol is pre-configured between the nodes having the same node label.

[0103] In one example, in order to achieve synchronization of container images between nodes, the embodiment of the present disclosure creates a service for synchronizing images between nodes in a cluster, namely, the NCRD node image repository daemon service, which is used for synchronizing container images between cluster nodes. The API interface of the node image repository daemon service is defined, including image information acquisition, inter-node communication, and image synchronization. The NCRD service is divided into a server and a client: the client runs on each node in the cluster with the resource type of Deamonset in the Kubernetes cluster; the server is deployed in the cluster with the resource type of Deployment, where the server maintains the container image information of the cluster nodes, and the client maintains the local container image information of the nodes. By introducing the node image repository daemon service (NCRD service), the effective management and distribution of image information can be achieved through the collaboration of the server and the client.

[0104] In one example, when the cluster creates a task, the client running on the node will obtain the target image information required to create the task through the cluster's API-server, such as the image name, label, and related layer information. First, the client will check whether the image required to run the task already exists on the node where it is located. In this step, it is determined whether the required image already exists on the local node. For example, the client checks whether the specified image exists in the local Docker or container runtime environment. Based on the check results, the existence of the local image is reported to the server.

[0105] In one example, if the client checks and determines that the first node does not have the image required to run the task, the client will request the server to determine the second node that has the target image. The second node is a node with the same label as the first node, and nodes with the same label can log in to SSH without password. If the server determines that there is a second node with the target image, it will return the information to the client, and the first node will log in to the second node according to the returned information to synchronize the image.

[0106] The container image acquisition method provided by the embodiment of the present disclosure introduces the node image repository daemon service, and realizes the management and distribution of image information through the collaboration of the server and the client; and realizes the rapid synchronization of images by using the password-free login protocol between nodes. Through the mutual synchronization between nodes, the exponential efficiency growth of image distribution is achieved, and the deployment process of large-scale tasks is optimized.

[0107] Figure 3 The following schematically shows a flow chart of a method for obtaining a container image according to another embodiment of the present disclosure.

[0108] In operation S310 , when a node joins a cluster, a label is set for the node through a label system of the cluster.

[0109] In operation S320, a secure shell protocol key pair is generated for each node.

[0110] In operation S330, the secure shell protocol public key is distributed and configured according to the node label.

[0111] In one example, in order to achieve mutual trust login between nodes, when the nodes in the cluster join the cluster, the nodes with the same node label can be accessed through the SSH protocol without secrets through the initialization operation. Specifically, in this step, the nodes with the same node label are allowed to communicate without secrets through SSH to facilitate subsequent image synchronization operations. Exemplarily, the specific implementation steps of this step may include setting labels for the nodes through the Kubernetes label system when the nodes join the cluster, such as env=production; generating an SSH key pair for each node, and adding the public key to the authorized_keys file of the corresponding node, so that the node can log in through SSH without a password. Write an automated script to automatically perform key distribution and configuration when a new node joins. Use the SSH protocol between nodes to achieve rapid synchronization of container images, reduce dependence on the central image repository, and avoid the image repository becoming a bottleneck.

[0112] Figure 4 The following schematically shows a flowchart of a method for obtaining a container image according to another embodiment of the present disclosure.

[0113] In operation S410 , in response to a cluster task creation instruction, target image information required for creating a task is acquired.

[0114] In operation S420, the target image information is parsed to determine the image name, label, and image layer information.

[0115] In operation S430, a target image is searched in the first node according to the image name, label, and image layer information.

[0116] In operation S440, if it is determined that the target image exists on the first node, the image layer structure is analyzed to determine a storage path of each image layer.

[0117] In operation S450, the image layer storage path information of the target image is uploaded to the server of the node image repository daemon service.

[0118] In an example, when a cluster creates a task, the client running on the node obtains the image information required to create the task through the cluster's API-server. The specific implementation steps may include: API-server communication: The client obtains the image list required for the task through the Kubernetes API-server. The image information is parsed to determine the image name, label, and related layer information.

[0119] In one example, if the client checks that the first node has the image required to run the task, the client will analyze all the layers of the image and store them in the specific directory of the node, and report this information to the server; specifically, analyze the layer structure of the image and determine the storage path of each layer. Send the local path information of the image layer to the server. The server of the node image warehouse daemon service maintains it uniformly. The server dynamically manages the synchronization relationship between nodes, optimizes the synchronization path, and reduces transmission delays.

[0120] Figure 5 The following schematically shows a flowchart of a method for obtaining a container image according to another embodiment of the present disclosure.

[0121] If it is determined that the target image does not exist on the first node, determine the second node where the target image exists through the node image repository daemon service. Specifically: in operation S510, query the server to determine the second node where the target image exists; and in operation S520, receive the node address and image layer path information returned by the server. In operation S530, establish secure communication with the second node based on the node address based on the password-free login protocol. In operation S540, copy the image layer directory to the directory corresponding to the first node according to the image layer path information.

[0122] In operation S550, if it is determined that the target image does not exist on the second node, a node agent process is started to pull the image from the image repository.

[0123] In an example, if the local node does not have an image, the client requests the server to find images on other nodes in the cluster. Specifically, the client requests the server to query which nodes in the cluster already have the required image. If the server returns that other nodes already have the image, the client synchronizes the image based on the returned node IP address and layer path information. If it is determined that the image does not exist on other nodes, the client will wait for the kubelet to pull the image from the image repository, that is, start the node agent process to obtain the image from the image repository.

[0124] In an example, if the server finds that an image exists on another node in the cluster, the client will copy the layer directory from the node where the image exists to the corresponding local directory based on the SSH protocol. After the copy is completed, the client will report its own IP information and the current container image information to the server.

[0125] In one example, the missing image layer is synchronized from other nodes through the SSH protocol. Specifically, it includes: Node communication: Use the SSH protocol to establish secure communication with the node that has the image. Image transfer: Copy the image layer from the remote node to the local node through SCP (Secure Copy Protocol) or other SSH-based file transfer methods. Status update: After the transfer is completed, the client updates the local image status and reports its own IP information to the server.

[0126] In one example, if the server fails to find the image on other nodes in the cluster, it will remain silent for a while, waiting for the kubelet process on the node to download the image from the image repository. In this step, if no node in the cluster has the required image, wait for kubelet to pull it from the image repository. For example, the client implements the waiting logic and periodically checks whether the local image has started downloading. Monitor the download progress of kubelet to ensure that the image is downloaded successfully.

[0127] Based on the above container image acquisition method, the present disclosure also provides a container image acquisition device. Figure 6 The device is described in detail.

[0128] Figure 6 The structural block diagram of the container image acquisition device according to an embodiment of the present disclosure is schematically shown.

[0129] like Figure 6As shown, the container image acquisition device 600 of this embodiment includes a first acquisition module 610 , a second acquisition module 620 , a first determination module 630 and an image synchronization module 640 .

[0130] The first acquisition module 610 is used to respond to the cluster task creation instruction and acquire the target image information required for creating the task. In one embodiment, the first acquisition module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0131] The second acquisition module 620 is used to traverse the first node according to the target image information to acquire the target image. In one embodiment, the second acquisition module 620 can be used to perform the operation S220 described above, which will not be described in detail here.

[0132] The first determination module 630 is used to determine the second node where the target image exists through the node image repository daemon service if it is determined that the target image does not exist on the first node, and the node image repository daemon service is used to synchronize container images between cluster nodes. In one embodiment, the first determination module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0133] The mirror synchronization module 640 is used to perform mirror synchronization from the second node through a password-free login protocol. In one embodiment, the mirror synchronization module 640 can be used to perform the operation S240 described above, which will not be described in detail here.

[0134] According to an embodiment of the present disclosure, the node image repository daemon service includes a client and a server, the client is deployed on any node, the server is deployed in a cluster, and the first determination module includes a query submodule and a receiving submodule.

[0135] The query submodule is used to query the server to determine whether there is a second node of the target image; in one embodiment, the query submodule can be used to perform the operation S510 described above, which will not be repeated here.

[0136] The receiving submodule is used to receive the node address and image layer path information returned by the server. In one embodiment, the receiving submodule can be used to perform the operation S520 described above, which will not be repeated here.

[0137] According to an embodiment of the present disclosure, the mirror synchronization module includes a communication submodule and a synchronization submodule.

[0138] The communication submodule is used to establish secure communication with the second node according to the node address based on the password-free login protocol; in one embodiment, the communication submodule can be used to perform the operation S530 described above, which will not be repeated here.

[0139] The synchronization submodule is used to copy the mirror layer directory to the directory corresponding to the first node according to the mirror layer path information. In one embodiment, the synchronization submodule can be used to perform the operation S540 described above, which will not be repeated here.

[0140] According to an embodiment of the present disclosure, the second acquisition module includes: a parsing submodule and a searching submodule.

[0141] The parsing submodule is used to parse the target image information to determine the image name, label and image layer information. In one embodiment, the parsing submodule can be used to perform the operation S420 described above, which will not be repeated here.

[0142] The search submodule is used to search the target image in the first node according to the image name, label and image layer information. In one embodiment, the search submodule can be used to perform the operation S430 described above, which will not be repeated here.

[0143] According to an embodiment of the present disclosure, the device further includes:

[0144] The second determination module is used to analyze the image layer structure to determine the storage path of each image layer if it is determined that the first node has the target image. In one embodiment, the second determination module can be used to perform the operation S440 described above, which will not be repeated here.

[0145] The image state update module is used to upload the image layer storage path information of the target image to the server of the node image repository daemon service. In one embodiment, the image state update module can be used to perform the operation S450 described above, which will not be repeated here.

[0146] According to an embodiment of the present disclosure, the device further includes:

[0147] The image pulling module is used to start the node agent process to pull the image from the image repository if it is determined that the target image does not exist on the second node. In one embodiment, the image pulling module can be used to perform the operation S550 described above, which will not be repeated here.

[0148] According to an embodiment of the present disclosure, the device further includes:

[0149] The label setting module is used to set a label for the node through the label system of the cluster when the node joins the cluster. In one embodiment, the label setting module can be used to perform the operation S310 described above, which will not be repeated here.

[0150] The key generation module is used to generate a secure shell protocol key pair for each node. In one embodiment, the key generation module can be used to perform the operation S320 described above, which will not be repeated here.

[0151] The key distribution module is used to distribute and configure the secure shell protocol public key according to the node label. In one embodiment, the key distribution module can be used to perform the operation S330 described above, which will not be repeated here.

[0152] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 610, the second acquisition module 620, the first determination module 630 and the mirror synchronization module 640 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 610, the second acquisition module 620, the first determination module 630 and the mirror synchronization module 640 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the first acquisition module 610 , the second acquisition module 620 , the first determination module 630 , and the mirror synchronization module 640 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0153] Figure 7 A block diagram of an electronic device suitable for implementing a container image acquisition method according to an embodiment of the present disclosure is schematically shown.

[0154] like Figure 7 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 to a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0155] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0156] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0157] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the container image acquisition method according to the embodiment of the present disclosure is implemented.

[0158] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0159] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the container image acquisition method provided by the embodiment of the present disclosure.

[0160] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0161] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0162] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0163] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0164] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0165] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0166] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for obtaining a container image, characterized in that: The method comprises: In response to a cluster task creation instruction, obtain target image information required to create the task; Traversing the first node according to the target image information to obtain the target image; If it is determined that the target image does not exist on the first node, determine a second node that has the target image through a node image repository daemon service, where the node image repository daemon service is used for synchronizing container images between cluster nodes; and Mirror synchronization is performed from the second node through a password-free login protocol. The first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein a password-free login protocol is pre-configured between the nodes having the same node label.

2. The method according to claim 1, characterized in that The node image repository daemon service includes a client and a server, the client is deployed on any node, the server is deployed in a cluster, and the second node where the target image is determined by the node image repository daemon service includes: Query the server to determine whether a second node of the target image exists; and Receive the node address and image layer path information returned by the server.

3. The method according to claim 2, characterized in that The mirror synchronization from the second node through the password-free login protocol includes: Establishing secure communication with the second node according to the node address based on a password-free login protocol; and The mirror layer directory is copied to the directory corresponding to the first node according to the mirror layer path information.

4. The method according to claim 2, characterized in that: The traversing the first node according to the target image information to obtain the target image includes: Parsing the target image information to determine the image name, label, and image layer information; and The target image is searched in the first node according to the image name, label and image layer information.

5. The method according to claim 2, characterized in that: The method further comprises: If it is determined that the target image exists on the first node, analyzing the image layer structure to determine the storage path of each image layer; and Upload the image layer storage path information of the target image to the server of the node image repository daemon service.

6. The method according to claim 1, characterized in that The method further comprises: If it is determined that the target image does not exist on the second node, the node agent process is started to pull the image from the image repository.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: When a node joins a cluster, a label is set for the node through the cluster's label system; generating a secure shell protocol key pair for each node; and Distribute and configure the Secure Shell protocol public key based on the node label.

8. A container image acquisition device, characterized in that: The device comprises: A first acquisition module, used to respond to a cluster task creation instruction and acquire target image information required for creating a task; A second acquisition module, configured to traverse the first node according to the target image information to acquire the target image; A first determination module is configured to, if it is determined that the target image does not exist on the first node, determine a second node that has the target image through a node image repository daemon service, wherein the node image repository daemon service is used for synchronizing container images between cluster nodes; and A mirror synchronization module, used to perform mirror synchronization from the second node through a password-free login protocol, The first node is a local node, and the second node is one or more nodes having the same node label as the first node, wherein a password-free login protocol is pre-configured between the nodes having the same node label.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images