Container process management method and device, equipment, medium and product

Abstract

The invention provides a container process management method and device, equipment, a medium and a product. The method comprises the steps that a process starting event in at least one first container is detected; in response to the detected process starting event in the target container, obtaining information for generating a target container mirror image of the target container and execution information of a target process started in the target container; determining a white list process set of the target container mirror image according to the information of the target container mirror image; wherein the white list process set comprises information of processes which are allowed to run in at least one second container generated in a mirroring mode in the target container; determining a judgment result of the target process according to the execution information of the target process and the white list process set of the target container mirror image; and executing an operation corresponding to the judgment result for the target process. According to the method, normal operation of the host machine and other containers in the host machine is not affected by the process judgment mode based on the white list process set, and compatibility and stability are high.

Description

Technical Field

[0001] The present application relates to the field of virtualization technology, and in particular to a container process management method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software operating environments that package applications and their dependencies together and can run in any environment that supports containers, allowing applications to maintain a consistent operating state in different operating environments.

[0003] During the operation of the container, if the container is penetrated and attacked, an unsafe process can be started in the container, affecting the security of the virtualized environment. Therefore, it is particularly important to block the container process in the process. In the related art, the container process is usually managed by modifying the dynamic link library and blocking the process based on the security framework (linux security module, LSM). However, the above method has a great impact on the normal operation of the host machine and other containers in the host machine, and it is difficult to achieve stable container process management. Summary of the invention

[0004] The present application provides a container process management method. The method can achieve stable and highly compatible container process management without affecting the normal operation of the host machine and other containers in the host machine. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0005] In a first aspect, the present application provides a container process management method, the method comprising:

[0006] Detecting a process start event in at least one first container;

[0007] In response to detecting a process start event in a target container, obtaining information of a target container image for generating the target container and execution information of a target process started in the target container; wherein the target container is any container in the at least one first container;

[0008] Determine a whitelist process set of the target container image according to the information of the target container image; wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image;

[0009] Determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image; wherein the determination result indicates whether the target process is allowed to run;

[0010] For the target process, an operation corresponding to the determination result is performed.

[0011] In a second aspect, the present application provides a container process management device, the device comprising:

[0012] A detection module, configured to detect a process startup event in at least one first container;

[0013] an acquisition module, configured to acquire, in response to detecting a process start event in a target container, information of a target container image for generating the target container and execution information of a target process started in the target container; wherein the target container is any container in the at least one first container;

[0014] A first determination module is used to determine a whitelist process set of the target container image according to information of the target container image; wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image;

[0015] A second determination module is used to determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image; wherein the determination result indicates whether the target process is allowed to run;

[0016] The execution module is used to execute an operation corresponding to the determination result for the target process.

[0017] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory, so that the electronic device executes the container process management method in the first aspect or any implementation of the first aspect.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and the instructions instruct an electronic device to execute the container process management method described in the first aspect or any one of the implementations of the first aspect.

[0019] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the container process management method described in the first aspect or any one of the implementations of the first aspect.

[0020] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0021] It can be seen from the above technical solutions that this application has the following advantages:

[0022] The present application provides a container process management method, which first detects a process start event in at least one first container, and in response to detecting a process start event in a target container, obtains information of a target container image for generating a target container and execution information of a target process started in the target container, wherein the target container is any container in the at least one first container, and then, based on the information of the target container image, determines a whitelist process set of the target container image, wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image, determines a determination result of the target process based on the execution information of the target process and the whitelist process set of the target container image, the determination result represents whether the target process is allowed to run, and performs an operation corresponding to the determination result on the target process.

[0023] In this method, a whitelist process set is constructed based on the container image as a unit. By detecting the process startup event, it is determined whether the target process belongs to the whitelist process set according to the execution information of the started target process, and then the target process is allowed or not to run in the container. In this way, during the operation of the container, the processes generated in the container are judged in real time to achieve container process management. At the same time, the process judgment method based on the whitelist process set does not affect the normal operation of the host machine and other containers in the host machine, and has strong compatibility and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0025] Figure 1 A schematic diagram of the architecture of a container process management system provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of a container process management process provided in an embodiment of the present application;

[0027] Figure 3 A flowchart of a container process management method provided in an embodiment of the present application;

[0028] Figure 4 A flowchart of a container process learner provided in an embodiment of the present application;

[0029] Figure 5A schematic diagram of a process flow of a container process determiner provided in an embodiment of the present application;

[0030] Figure 6 A schematic diagram of a process flow of a container process executor provided in an embodiment of the present application;

[0031] Figure 7 A schematic diagram of the structure of a container process management device provided in an embodiment of the present application;

[0032] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0034] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0035] With the continuous development of computer technology, especially virtualization technology, containers have emerged. Containers are lightweight, portable software operating environments that package applications and their dependencies together and can run in any environment that supports containers, allowing applications to maintain a consistent operating state in different operating environments.

[0036] At the same time, with the continuous development of cloud computing technology, more and more users (such as organizations, enterprises, etc.) adopt micro services architecture to deploy business applications. In the micro services architecture, business applications are decomposed into multiple small, independent services, each of which implements a specific business function.

[0037] Combining microservice architecture with container technology can achieve flexible deployment, expansion and management of applications. Specifically, each service of a business application can be packaged into different containers, which include the dependencies and configurations required to run each service. Containerization provides isolation, ensures environmental consistency between different services, and thus improves the maintainability, scalability and reliability of business applications.

[0038] During the operation of business applications, if the container is penetrated and attacked, unsafe processes can be started in the container, affecting the security of the virtualized environment and the safe operation of business applications. Therefore, in the field of intrusion prevention, it is particularly important to block container processes in the process.

[0039] In the related technology, container process management is usually performed by modifying the dynamic link library and blocking the process based on the security framework (Linux Security Module, LSM). Among them, in the method of modifying the dynamic link library, by modifying the dynamic link library of LD_PRELOAD, when the process starts, the new link library interface can be called first, and then the process management is performed in the new link library interface. In the process blocking method based on LSM, intervention and control of the process is implemented in the host kernel.

[0040] However, the above method has a great impact on the normal operation of the host machine and other containers in the host machine. Specifically, since each container has an independent LD_PRELOAD dependency, in the method of modifying the dynamic link library, the container needs to be restarted to reload LD_PRELOAD, which is invasive to business applications and affects the normal operation of services running in other containers in business applications. The LSM-based process blocking method needs to be implemented through the kernel (kernelobject, KO) module of the host machine, and there are significant adjustments to the stability and compatibility of the KO module itself. In addition, once an operation error occurs, it will cause the host kernel to restart, affecting the normal operation of the host machine, and it is difficult to achieve stable container process management.

[0041] In view of this, the present application provides a container process management method, which first detects a process start event in at least one first container, and in response to detecting a process start event in a target container, obtains information about a target container image for generating a target container and execution information of a target process started in the target container, wherein the target container is any container in the at least one first container, and then, based on the information about the target container image, determines a whitelist process set of the target container image, wherein the whitelist process set includes: information about processes allowed to run in at least one second container generated by the target container image, determines a determination result of the target process based on the execution information of the target process and the whitelist process set of the target container image, the determination result represents whether the target process is allowed to run, and performs an operation corresponding to the determination result on the target process.

[0042] In this method, a whitelist process set is constructed based on the container image as a unit. By detecting the process startup event, it is determined whether the target process belongs to the whitelist process set according to the execution information of the started target process, and then the target process is allowed or not to run in the container. In this way, during the operation of the container, the processes generated in the container are judged in real time to achieve container process management. At the same time, the process judgment method based on the whitelist process set does not affect the normal operation of the host machine and other containers in the host machine, and has strong compatibility and stability.

[0043] To facilitate understanding of the technical solution provided by the embodiments of the present application, it will be described below with reference to the accompanying drawings.

[0044] See also Figure 1 The architecture diagram of a container process management system shown in the figure, the container platform 20 can be understood as a software system that provides the tools and environment required to create, deploy, run and manage business applications. The container platform 20 generally includes multiple components such as a container engine, a container orchestration tool, and a container image repository.

[0045] In the embodiment of the present application, the container platform 20 can create multiple containers in the host machine 10. Among them, the container process management system 11 can run in a container created by the container platform 20, and multiple services of the business application system based on the microservice architecture can run in containers 12 to 1N created by the container platform 20.

[0046] The container process management system 11 can be used to execute the container process management method, and the container process management system 11 includes a container process learner 111, a container process determiner 112, and a container process executor 113. The container process learner 111 is used to collect and learn process information of different containers, and send the container information and process information of different containers to the container process determiner 112.

[0047] On the one hand, the container process determiner 112 is used to generate a whitelist process set based on a container image. Specifically, the container process determiner 112 can receive the container information and process information sent by the container process learner 111 to form a whitelist process set based on a container, and then integrate the whitelist process sets of containers generated by the same container image to generate a whitelist process set based on a container image.

[0048] On the other hand, the container process determiner 112 is used to determine the processes started in the containers 12 to 1N in combination with the whitelist process set, and determine whether to allow or not to allow the processes started in the containers 12 to 1N to run. Specifically, the container process determiner 112 can receive the process start event of the target container (for example, any container in the containers 12 to 1N) sent by the container process executor 113, determine the whitelist process set of the target container image that generates the target container, and then determine the determination result of the target process, and send the determination result of the target process to the container process executor 113.

[0049] The container process executor 113 is used, on the one hand, to detect the process start events of the container 12 to the container 1N, and send the detected process start events of the target process to the container process determiner 112. On the other hand, it is used to receive the determination result of the target process sent by the container process executor 113, and perform operations corresponding to the determination result. Specifically, the container process executor 113 can be based on the kernel-level mechanism for notifying file system changes (filesystem wide access notification, fanotify) technology, by switching the namespace to the namespace corresponding to the container 12 to the container 1N, and configuring the process start notification group in the namespace corresponding to the container 12 to the container 1N, to achieve detection of process start events for the container 12 to the container 1N. Similarly, the container process executor 113 can also allow the execution of the target process or refuse to execute the target process in the target container based on the fanotify technology to achieve container process management.

[0050] Based on the above content, it can be seen that the embodiment of the present application involves the process of generating a whitelist process set and the process of detecting the container process. Therefore, when describing the embodiment of the present application in terms of time dimension, it can be divided into a learning period and a detection period. Figure 2 The schematic diagram of a container process management process shown in the figure, the learning period is usually located before the detection period, in other words, after the whitelist process set is generated, the container process is detected. During the learning period, the container process learner 111 collects the container information and process information of different containers, and sends the container information and process information of different containers to the container process determiner 112. The container process determiner 112 generates a whitelist process set based on the container information and process information of different containers, taking the container image as a unit. During the detection period, the container process executor 113 detects the process start events of different containers by configuring the process start notification group in different containers, and sends the detected process start events to the container process determiner 112. The container process determiner 112 reads the whitelist process set, determines the determination result of the started process, and returns the determination result to the container process executor 113, so that the container process executor 113 performs the operation corresponding to the determination result to realize the container process management.

[0051] Based on the architectural diagram of the container scanner provided above, the present application embodiment also provides a container process management method. Figure 3 The flowchart of a container process management method provided by an embodiment of the present application is shown, and the method specifically includes:

[0052] S301: Detect a process start event in at least one first container.

[0053] The at least one first container may be understood as at least one container having a container process management requirement. For example, the at least one first container may be at least one container running in a host machine.

[0054] In some possible implementations, at least one first container can be determined by calling an interface. Specifically, a container detection interface provided by a container platform is called to determine at least one first container. After calling the container detection interface, the container detection interface can pass in container information, such as a container name (cname), a container identifier (identity, ID), a container image name, a container image ID, a process identifier (process identifier, PID) of the container main process, etc., and the container information passed in through the container detection interface is used to determine at least one first container for which container process management requirements exist.

[0055] The process start event in at least one first container can be understood as an event of starting a new process in at least one first container. In an embodiment of the present application, it is supported to detect process start events in different ways. In some embodiments, based on the extended Berkeley packet filter (eBPF) technology, an eBPF program for detecting process start events can be written in the user state of the host machine, the eBPF program can be loaded, and the eBPF program can be connected to the sys_exec function of the host machine, and the process start event in at least one first container can be detected using the eBPF program. In this way, the system event collection capability of ebpf is used to detect process start events.

[0056] In other embodiments, considering that eBPF technology often requires an advanced kernel version and needs to enable kernel configuration, which involves a host machine restart operation, the process start event can be detected based on fanotify technology. In specific implementation, switch to the namespace of at least one first container, configure a process start notification group in the namespace of at least one first container, wherein the process start notification group is used to detect the process start event.

[0057] That is, by switching the namespace to at least one first container, using the PID of the main process of at least one first container, and configuring the process start notification group, a process start event generated in at least one first container can be detected.

[0058] The following is a specific explanation with reference to the code. By executing setns(mnt_fd,0), the setns operation is used to switch the mount namespace to the mount namespace of at least one first container respectively. By executing fa notify_init(FAN_CLOEXEC|FAN_CLASS_CONTENT,O_RDONLY|O_CLOEXEC|O_LARG EFILE|O_NOATIME), fanotify_init is called to initialize fanotify. By executing fanotify_mark(fa_fd,FAN_MARK_ADD|FAN_MARK_MOUNT,FAN_OPEN_EXEC,AT_FDCWD,hostfs), the process startup notification group is configured. Then the setns operation is used to switch the mount namespace from the mount namespace of at least one first container back to the mount namespace of the container process management system 11.

[0059] In this way, by utilizing the ability of detecting file system changes provided by fanotify, process startup events can be detected without requiring an advanced kernel version or restarting the host machine.

[0060] In some possible implementations, a process start event can be determined from events generated in at least one first container according to an event type or event information. For example, for a host machine with a kernel version of 5.0 or higher, when the event type includes FAN_OPEN_EXEC, the event can be considered a process start event. For another example, for a host machine with a kernel version of 5.0 or lower, when the event information indicates that the PID involved in the event is the same as the file involved in the event, the event can be considered a process start event.

[0061] S302: In response to detecting a process start event in a target container, obtaining information of a target container image for generating a target container and execution information of a target process started in the target container.

[0062] The target container is any container in the at least one first container. In other words, the target container can be understood as a container in the at least one first container that generates a process start event.

[0063] The information of the target container image can be understood as attribute information related to the target container image. That is, the target container is generated by the target container image, and the target container is a container instance running in the target container image. In some embodiments, the information of the target container image may include the container image name of the target container image, the container image ID of the target container image, etc.

[0064] The execution information of the target process can be understood as attribute information related to the target process. That is, the process start event in the target container is an event for starting the target process in the target container. In some embodiments, the execution information of the target process started in the target container may include the execution file of the target process and / or the execution path of the target process.

[0065] S303: Determine a whitelist process set of the target container image according to the information of the target container image.

[0066] The whitelist process set includes: information about processes that are allowed to run in at least one second container generated by the target container image. That is, in the embodiment of the present application, the container generated by the target container image is referred to as a second container, and at least one second container is a container instance running in the target container.

[0067] In an embodiment of the present application, a whitelist process set of different container images is generated based on the container image. The whitelist process set of the target container image includes process information related to the process allowed to run in at least one second container, that is, the whitelist process set of the target container image is used to describe the whitelist process allowed to run in at least one second container.

[0068] In specific implementation, the information of processes allowed to run in at least one second container can be collected separately, and then the process information of the container generated by the same container image can be integrated to form a whitelist process set based on the container image. In this way, on the one hand, the singleness of the container is first utilized to form a whitelist process set for a single container, so as to ensure the particularity of each container and achieve process management at the container level. On the other hand, the whitelist process sets of each container are integrated into a whitelist process set of the container image. Since the process information (such as process name, executable file, and execution path) of the container generated by the same container image is the same, the whitelist process set based on the container image can fully cover the processes allowed to run in the container generated by the container image, avoiding omissions when constructing the whitelist process set of the container.

[0069] In some possible implementations, the set of whitelist processes of the target container image is determined based on information about processes running in at least one second container within a first set time period after the at least one second container is started. That is, by collecting information about processes running in at least one second container within a first set time period after the at least one second container is started, the processes running in at least one second container within the first set time period are determined as whitelist processes.

[0070] The first set time period may be determined based on actual container process management requirements. For example, the first set time period may be 10 days.

[0071] The embodiments of the present application support generating a whitelist process set of a target container image in different ways. In some embodiments, within a first set time period after at least one second container is started, information about a process that has been running in at least one second container is obtained from the container platform, an association relationship between the container information of at least one second container and the information about a process that has been running in at least one second container is established, and a whitelist process set of the target container image is generated based on the association relationship.

[0072] That is to say, for the generated containers, the running asset information (including container information and process information) is obtained through the container platform, the container information and process information are associated, and the whitelist process sets of different containers are generated. Then, the whitelist process sets of the containers generated by the same container image are integrated together to form the whitelist process set of the container image.

[0073] In the specific implementation, obtain the container name, container ID, container image name, container image ID, container main process PID and other container information of at least one second container from the container platform, and then obtain the inode (that is, the absolute ID of the container) of the container cgroup from the / sys / fs / cgroup / <any> / <any> / <containercid> / directory under cgroupfs. Then, since each process has an independent directory in procfs ( / proc / <pid>), the files in this directory store process information, so from / proc / <pid> / status to obtain process information such as process PID, parent process PID, process name, etc. from / proc / <pid> / exe obtains the process information such as the execution file and execution path of the process, and obtains the process information from / proc / <pid> / root / sys / fs / cgroup / cpu obtains the inode of the cgroup (that is, the absolute ID of the container). In this way, based on the inode, the container information and process information are associated, and the processes running in the same container are associated with the container, and then the whitelist process set of multiple containers generated by the same container image is formed to form the whitelist process set of the container image.

[0074] In other embodiments, a container startup event in a target container image is detected, and in response to detecting the container startup event, container information of at least one second container is obtained. Within a first set time period after the at least one second container is started, a process startup event in the at least one second container is continuously detected. In response to detecting the process startup event in the at least one second container, information of a process running in the at least one second container is obtained, an association relationship between the container information of the at least one second container and the information of the process running in the at least one second container is established, and based on the association relationship, a whitelist process set of the target container image is generated.

[0075] That is to say, during the operation of the container image, the container startup event is detected in real time. When the target container image generates a new second container, the container information of the second container is obtained, and the process startup event of the second container is detected, and the process information running in the second container is obtained, and then the container information and process information are associated to generate a whitelist process set of different containers, and then the whitelist process set of the container generated by the same container image is integrated together to form a whitelist process set of the container image.

[0076] In specific implementation, the container startup event and process startup event can be detected by eBPF technology. For example, an eBPF program for detecting container startup events is written in the user state of the host machine, the eBPF program is loaded, and the eBPF program is connected to the cgroup_mkdir function of the host machine. For example, the connection of the eBPF program is realized by executing the following code: echo "p:kprobe / sys_execve_sys_execve"> / sys / kernel / debug / tracing / kprobe_events. Whenever the target container image starts a new container, the eBPF program is called, and the container information of the newly started second container can be obtained.

[0077] In some possible implementations, the container ID carried in the container startup event is used to obtain container information such as the container name, container ID, container image name, container image ID, and container main process PID from the container platform according to the container ID. For example, the container information is obtained by executing the following code:

[0078] cli,err=client.NewClient("unix: / / / var / run / docker.sock","v1.24",nil,defaultHeaders)

[0079] info,err:=cli.ContainerInspect(context.Background(),containerID)

[0080] Similarly, an eBPF program for detecting process start events is written in the user state of the host machine, the eBPF program is loaded, and the eBPF program is connected to the sys_exec function of the host machine. Whenever the second container starts a new process, the eBPF program is called, and the eBPF program can obtain process information. Similarly, the process start event can also be detected based on the fanotify technology to obtain the process information of the second container. The specific process is similar to the previous article and will not be repeated here.

[0081] In the embodiment of the present application, based on the single characteristic of the container, within the first set time period, the process information running in the container is collected to learn the whitelist process set of the container. Then, by integrating the whitelist process set of the container generated by the same container image, a whitelist set at the container image level is formed.

[0082] In this way, when a process start event is generated in the target container, the whitelist process set of the target container image is determined based on the target container image that generates the target container, so that it can be subsequently determined based on the whitelist process set of the target container image whether the target process started in the target container generated by the target container image is allowed to run.

[0083] S304: Determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image.

[0084] The determination result indicates whether the target process is allowed to run. That is, the determination result may be to allow the target process to run or not to allow (i.e., refuse) the target process to run.

[0085] Since the whitelist process set of the target container image describes the processes that are allowed to run in the second container (including the target container) generated by the target container image, the target process can be judged by comparing the process information of the target process with the information of the processes included in the whitelist process set of the target container image.

[0086] In a specific implementation, in response to the execution information of the target process being the same as the execution information of the first process in the whitelist process set of the target container image, a determination result indicating that the target process is allowed to run is determined; otherwise, a determination result indicating that the target process is not allowed to run is determined.

[0087] Among them, the first process can be understood as a process in the whitelist process set of the target container image. That is to say, when the execution information of the target process is the same as the execution information of a process (i.e., the first process) in the whitelist process set of the target container image, it indicates that the target process is a whitelist process in the whitelist process set of the target container image. Therefore, the judgment result is that the target process is allowed to run in the target container. When the execution information of the target process is different from the execution information of any process in the whitelist process set of the target container image, it indicates that the target process is not a whitelist process in the whitelist process set of the target container image. Therefore, the judgment result is that the target process is not allowed to run in the target container. In this way, during the operation of the target container, the target process generated in real time in the target container is judged.

[0088] In some possible implementations, the determination result may be determined by generating a response. For example, when the determination result indicates that the target process is allowed to run, a FAN_ALLOW response is generated. For another example, when the determination result indicates that the target process is not allowed to run, a FAN_ALLOW response is generated.

[0089] Furthermore, the embodiment of the present application also provides a fallback strategy. Specifically, in response to the determination result of the target process not being determined within the second set time period, the target process is allowed to run. In other words, if the determination result of the target process is still not determined after the second set time period, the target process is allowed to run by default to avoid affecting the normal operation of the target container and the business application.

[0090] The second set time period may be determined based on actual container process management requirements. For example, the second set time period may be 30 milliseconds.

[0091] S305: Execute an operation corresponding to the determination result for the target process.

[0092] After determining the determination result of the target process, a corresponding operation may be performed on the target process. For example, when the determination result indicates that the target process is allowed to run, the target process is allowed to run in the target container. For another example, when the determination result indicates that the target process is not allowed to run, the target process is denied to run in the target container.

[0093] When setting fanotify to detect process start events, you can also use fanotify to execute operations that allow the target process to run or to disallow the target process to run. In this way, container process management is implemented without affecting the host and other containers in the host, and the impact is limited to a specific container.

[0094] In this method, a whitelist process set is constructed based on the container image as a unit. By detecting the process startup event, it is determined whether the target process belongs to the whitelist process set according to the execution information of the started target process, and then the target process is allowed or not to run in the container. In this way, during the container operation, the processes generated in the container are judged in real time to achieve container process management. At the same time, the process judgment method based on the whitelist process set does not affect the normal operation of the host machine and other containers in the host machine, and has strong compatibility and stability.

[0095] The foregoing describes the container process management method provided in the present application. The following describes the container process management system 11 from the perspective of the container process learner 111, the container process determiner 112 and the container process executor 113.

[0096] See also Figure 4 A flow chart of a container process learner is shown, and the container process learner 111 performs two steps: asset synchronization and asset increment synchronization. Specifically, the asset synchronization step can be understood as the container process learner 111 obtaining the currently running asset information (including container information and process information) from the container platform, and the asset increment synchronization step can be understood as the container process learner 111 detecting the container startup event in the container image through the eBPF program, and then obtaining the newly started container information from the container platform through the container ID carried by the container startup event, and the container process learner 111 detects the process startup event in the newly started container through the eBPF program, and then obtains the newly started process information. When the first set time period is reached, the container assets are formed and sent to the container process determiner 112.

[0097] See also Figure 5 A flow chart of a container process determiner is shown, in which the container process determiner 112 uses different threads to respectively receive information sent by the container process executor 113 and information sent by the container process learner 111. Specifically, the container process determiner 112 starts the whitelist generation interface in one thread, receives the container assets sent by the container process learner 111, forms a whitelist process set based on the container image, and writes the whitelist process set based on the container image to the local disk of the host machine for data persistence. In another thread, the container process determiner 112 starts the process determination interface, receives the information of the target container image and the execution information of the target process sent by the container process executor 113, determines the whitelist process set of the target container image through the information of the target container image, and then determines the execution information of the target process in combination with the whitelist process set of the target container image, determines the determination result, and sends the determination result to the container process executor 113.

[0098] See also Figure 6 In the flowchart of a container process executor shown in the figure, the container process executor 113 determines at least one first container with container process management requirements by calling the container detection interface, and sets a process start notification group in the namespace of at least one first container based on the fanotify technology to detect the process start event of at least one first container. In response to detecting the process start event of the target container, the information of the target container image and the execution information of the target process are sent to the container process determiner 112, and the determination result returned by the container process determiner 112 is received. The container process executor 113 then performs the operation corresponding to the determination result. In this way, the blocking capability of the fanotify technology is utilized to block the target process that is not allowed to run in real time, thereby ensuring the security of the container in the host machine, and further ensuring the operation security of the business application.

[0099] Combination of the above Figures 1 to 6 The container process management method provided in the embodiment of the present application is introduced in detail. The apparatus and device provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0100] See also Figure 7 The schematic diagram of the structure of the container process management device shown in FIG. 70 includes:

[0101] A detection module 701 is used to detect a process startup event in at least one first container;

[0102] An acquisition module 702 is configured to acquire, in response to detecting a process start event in a target container, information of a target container image for generating the target container and execution information of a target process started in the target container; wherein the target container is any container in the at least one first container;

[0103] A first determination module 703 is used to determine a whitelist process set of the target container image according to the information of the target container image; wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image;

[0104] A second determination module 704 is used to determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image; wherein the determination result indicates whether the target process is allowed to run;

[0105] The execution module 705 is used to execute an operation corresponding to the determination result for the target process.

[0106] In some possible implementations, the whitelist process set of the target container image is determined based on information about processes running in the at least one second container within a first set time period after the at least one second container is started.

[0107] In some possible implementations, the whitelist process set of the target container image is determined by the following steps:

[0108] Within a first set time period after the at least one second container is started, obtaining information about a process that has been running in the at least one second container from the container platform;

[0109] Establishing an association relationship between container information of the at least one second container and information of a process running in the at least one second container;

[0110] According to the association relationship, a whitelist process set of the target container image is generated.

[0111] In some possible implementations, the whitelist process set of the target container image is determined by the following steps:

[0112] Detecting a container startup event in the target container image;

[0113] In response to detecting a container startup event, acquiring container information of the at least one second container;

[0114] within a first set time period after the at least one second container is started, continuously detecting a process start event in the at least one second container, and in response to detecting the process start event in the at least one second container, acquiring information about a process running in the at least one second container;

[0115] Establishing an association relationship between container information of the at least one second container and information of a process running in the at least one second container;

[0116] According to the association relationship, a whitelist process set of the target container image is generated.

[0117] In some possible implementations, the second determining module 704 is specifically configured to:

[0118] In response to the execution information of the target process being the same as the execution information of the first process in the whitelist process set of the target container image, determining a determination result indicating that the target process is allowed to run;

[0119] Otherwise, a determination result indicating that the target process is not allowed to run is determined.

[0120] In some possible implementations, the execution information of the target process started in the target container includes an execution file of the target process and / or an execution path of the target process.

[0121] In some possible implementations, the detection module 701 is specifically used to:

[0122] Calling a container detection interface provided by the container platform to determine at least one first container;

[0123] Switch to the namespace of at least one first container, and configure a process start notification group in the namespace of the at least one first container, where the process start notification group is used to detect a process start event.

[0124] In some possible implementations, the execution module 705 is further configured to:

[0125] In response to the determination result of the target process not being determined within a second set time period, the target process is allowed to be executed.

[0126] The container process management device 70 according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the container process management device 70 are respectively to implement Figure 3 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0127] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 7 The functions of the container process management device 70 in the illustrated embodiment.

[0128] Figure 8 A schematic diagram of the structure of an electronic device 800 is provided. Figure 8 As shown, the electronic device 800 includes a bus 801, a processor 802, a communication interface 803 and a memory 804. The processor 802, the memory 804 and the communication interface 803 communicate with each other via the bus 801.

[0129] The bus 801 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0130] The processor 802 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0131] The communication interface 803 is used for communicating with the outside. For example, the communication interface 803 can be used for communicating with a terminal.

[0132] The memory 804 may include a volatile memory, such as a random access memory (RAM). The memory 804 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0133] The memory 804 stores executable code, and the processor 802 executes the executable code to perform the aforementioned container process management method.

[0134] Specifically, in implementing Figure 7 In the case of the embodiment shown, and Figure 7 When each module or unit of the container process management device 70 described in the embodiment is implemented by software, the execution Figure 7 The software or program code required for the functions of each module / unit in the process may be partially or completely stored in the memory 804. The processor 802 executes the program code corresponding to each unit stored in the memory 804 to execute the aforementioned container process management method.

[0135] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the container process management method applied to the container process management device 70.

[0136] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0137] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0138] When the computer program product is executed by a computer, the computer executes any of the aforementioned container process management methods. The computer program product may be a software installation package, and when any of the aforementioned container process management methods is needed, the computer program product may be downloaded and executed on a computer.

[0139] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0141] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0142] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0143] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0144] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0145] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0146] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0147] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.< / pid> < / pid> < / pid> < / pid>

Claims

1. A container process management method, characterized in that: The method comprises: Detecting a process start event in at least one first container; In response to detecting a process start event in a target container, obtaining information of a target container image for generating the target container and execution information of a target process started in the target container; wherein the target container is any container in the at least one first container; Determine a whitelist process set of the target container image according to the information of the target container image; wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image; Determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image; wherein the determination result indicates whether the target process is allowed to run; For the target process, an operation corresponding to the determination result is performed.

2. The method according to claim 1, characterized in that The whitelist process set of the target container image is determined based on information about processes running in the at least one second container within a first set time period after the at least one second container is started.

3. The method according to claim 2, characterized in that The whitelist process set of the target container image is determined by the following steps: Within a first set time period after the at least one second container is started, obtaining information about a process that has been running in the at least one second container from the container platform; Establishing an association relationship between container information of the at least one second container and information of a process running in the at least one second container; According to the association relationship, a whitelist process set of the target container image is generated.

4. The method according to claim 2, characterized in that: The whitelist process set of the target container image is determined by the following steps: Detecting a container startup event in the target container image; In response to detecting a container startup event, acquiring container information of the at least one second container; within a first set time period after the at least one second container is started, continuously detecting a process start event in the at least one second container, and in response to detecting the process start event in the at least one second container, acquiring information about a process running in the at least one second container; Establishing an association relationship between container information of the at least one second container and information of a process running in the at least one second container; According to the association relationship, a whitelist process set of the target container image is generated.

5. The method according to claim 1, characterized in that The determining a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image includes: In response to the execution information of the target process being the same as the execution information of the first process in the whitelist process set of the target container image, determining a determination result indicating that the target process is allowed to run; Otherwise, a determination result indicating that the target process is not allowed to run is determined.

6. The method according to claim 1, characterized in that The execution information of the target process started in the target container includes an execution file of the target process and / or an execution path of the target process.

7. The method according to claim 1, characterized in that The detecting a process start event in at least one first container includes: Calling a container detection interface provided by the container platform to determine at least one first container; Switch to the namespace of at least one first container, and configure a process start notification group in the namespace of the at least one first container, where the process start notification group is used to detect a process start event.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: In response to the determination result of the target process not being determined within a second set time period, the target process is allowed to be executed.

9. A container process management device, characterized in that: The device comprises: A detection module, configured to detect a process startup event in at least one first container; an acquisition module, configured to acquire, in response to detecting a process start event in a target container, information of a target container image for generating the target container and execution information of a target process started in the target container; wherein the target container is any container in the at least one first container; A first determination module is used to determine a whitelist process set of the target container image according to information of the target container image; wherein the whitelist process set includes: information of processes allowed to run in at least one second container generated by the target container image; A second determination module is used to determine a determination result of the target process according to the execution information of the target process and the whitelist process set of the target container image; wherein the determination result indicates whether the target process is allowed to run; The execution module is used to execute an operation corresponding to the determination result for the target process.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 8.

Images