Root-free container cross-machine communication method and device

Abstract

The invention discloses a root-free container cross-machine communication method and device. The method comprises the following steps: acquiring a first data packet; sending the first data packet to a second server through the data relay device, so that the second server sends a second data packet to the first server through the data relay device; receiving a second data packet sent by the data relay device; and sending the second data packet to the source container. After a first server obtains a first data packet sent by a source container in an unprivileged network namespace, the first data packet is sent to a target container on a second server through data transfer equipment in communication connection with the first server, so that a second data packet returned by the target container is obtained; therefore, efficient communication between the rootless containers deployed on different hosts is directly achieved through the underlay network, compared with the prior art, the data transmission speed is increased by more than two times, and the data transmission speed and transmission efficiency of cross-host communication of the rootless containers are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a rootless container cross-machine communication method and device. Background Art

[0002] Currently, rootless containers are started by ordinary users to form a new security layer, which is more secure than traditional containers. Rootless containers require unprivileged network namespaces to provide user mode network support. In the prior art, network communication between unprivileged network namespaces and the host of rootless containers is achieved through three-layer network protocols, which will cause certain losses to network performance. In addition, cross-host communication of rootless containers requires the addition of overlay networks, which will also cause great losses to network performance, resulting in slow data transmission and low efficiency. Therefore, how to improve the data transmission speed and transmission efficiency of cross-host communication of rootless containers has become a technical problem that needs to be further solved. Summary of the invention

[0003] The present application proposes a rootless container cross-host communication method and device to solve the problems of slow data transmission speed and low transmission efficiency in cross-host communication of rootless containers, and improve the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0004] In a first aspect, an embodiment of the present application provides a rootless container cross-machine communication method, which is applied to a first server in a data processing system, wherein the data processing system includes the first server, a second server, and a data transfer device, wherein the first server is communicatively connected to the data transfer device, and the second server is communicatively connected to the data transfer device, and the method includes:

[0005] Obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without using root authority, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server;

[0006] Sending the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet;

[0007] receiving a second data packet sent by the data transfer device;

[0008] The second data packet is sent to the source container.

[0009] In a second aspect, an embodiment of the present application provides a rootless container cross-machine communication device, which is applied to a first server in a data processing system, wherein the data processing system includes the first server, the second server, and a data transfer device, wherein the first server is communicatively connected to the data transfer device, and the second server is communicatively connected to the data transfer device, and the device includes:

[0010] a first receiving unit, configured to obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without using root authority, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server;

[0011] The first processing unit is configured to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container.

[0012] In a third aspect, an embodiment of the present application provides a server, comprising a processor, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the program includes instructions for executing the steps in the method described in any one of the first aspects.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements part or all of the steps of the method described in any one of the first aspects of the embodiments of the present application.

[0015] It can be seen that in the present application, the first server obtains a first data packet, the first data packet is a data packet sent by the source container to the destination container, the source container is a rootless container created without using root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; the first data packet is sent to the second server through a data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, and the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; the second data packet sent by the data transfer device is received; and the second data packet is sent to the source container. After the first server obtains the first data packet sent by the source container in the unprivileged network namespace, it sends it to the destination container on the second server through the data transfer device that is connected to the first server in communication, so as to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the prior art, the data transmission speed of the present invention is increased by more than two times, which significantly improves the data transmission speed and transmission efficiency of cross-host communication of rootless containers. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a structural diagram of a data processing system provided in an embodiment of the present application;

[0018] Figure 2 It is a structural diagram of a server in a data processing system provided in an embodiment of the present application;

[0019] Figure 3 is a schematic diagram of the structure of a server in another data processing system provided in an embodiment of the present application;

[0020] Figure 4 It is a flowchart of a rootless container cross-machine communication method provided by an embodiment of the present application;

[0021] Figure 5 This is a scenario diagram of a rootless container cross-machine communication method provided by an embodiment of the present application;

[0022] Figure 6 This is a block diagram of the functional units of a rootless container cross-machine communication device provided by an embodiment of the present application;

[0023] Figure 7 This is a block diagram of the functional units of another rootless container cross-machine communication device provided by an embodiment of the present application;

[0024] Figure 8 This is a structural block diagram of a first server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0027] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0028] In the embodiments of the present application, "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent the following three situations: A exists alone; A and B exist at the same time; B exists alone. Among them, A and B can be singular or plural.

[0029] In the embodiment of the present application, the symbol " / " can indicate that the objects associated with each other are in an "or" relationship. In addition, the symbol " / " can also indicate a division sign, that is, performing a division operation. For example, A / B can indicate A divided by B.

[0030] In the embodiments of the present application, "at least one item" or similar expressions refer to any combination of these items, including any combination of single items or plural items, and refer to one or more, and multiple refers to two or more. For example, at least one item of a, b, or c can represent the following seven situations: a, b, c, a and b, a and c, b and c, a, b, and c. Among them, each of a, b, and c can be an element or a set containing one or more elements.

[0031] In the embodiments of the present application, "equal to" can be used in conjunction with greater than, and is applicable to the technical solution adopted when greater than, and can also be used in conjunction with less than, and is applicable to the technical solution adopted when less than. When equal to is used in conjunction with greater than, it is not used in conjunction with less than; when equal to is used in conjunction with less than, it is not used in conjunction with greater than.

[0032] In order to better understand the solutions of the embodiments of the present application, the terminal devices, related concepts and backgrounds that may be involved in the embodiments of the present application are first introduced below.

[0033] (1) Root privileges: Root privileges refer to the user rights with the highest permissions in the system, which are usually used to perform system-level operations and management tasks.

[0034] (2) Root user: The root user refers to the user with the highest authority in the system.

[0035] (3) Rootless containers: Rootless containers are containers that can be formed without root privileges. Unlike traditional containers, the rootless container daemon can be run by an ordinary user without privileges, forming a new security layer. If the container engine is attacked during operation, the attacker will not obtain root privileges on the host.

[0036] (4) Unprivileged network namespace: A network namespace created by an ordinary user without privileges to provide network support for rootless containers.

[0037] (5)Tap device: A virtual network device used to simulate a physical network interface.

[0038] Currently, rootless containers are started by ordinary users to form a new security layer, which is more secure than traditional containers. Rootless containers require unprivileged network namespaces to provide user mode network support. In the prior art, network communication between unprivileged network namespaces and the host of rootless containers is achieved through three-layer network protocols, which will cause certain losses to network performance. In addition, cross-host communication of rootless containers requires the addition of overlay networks, which will also cause great losses to network performance, resulting in slow data transmission and low efficiency. Therefore, how to improve the data transmission speed and transmission efficiency of cross-host communication of rootless containers has become a technical problem that needs to be further solved.

[0039] To solve the above problems, an embodiment of the present application provides a rootless container cross-machine communication method and device. In this method, after obtaining a first data packet sent by a source container in an unprivileged network namespace, the first server sends it to a destination container on a second server through a data transfer device connected to the first server in communication, so as to obtain a second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the prior art, the data transmission speed of the present invention is more than doubled, significantly improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0040] See also Figure 1 , Figure 1 Schematic diagram of a data processing system provided in an embodiment of the present application. Figure 1 As shown, the data processing system 100 includes a first server 110, a second server 120 and a data transfer device 130. The first server 110 is connected to the data transfer device 130 in communication, and the second server 120 is connected to the data transfer device 130 in communication. The first server 110 and the second server 120 can be a server or a server group composed of multiple servers. The data transfer device can be a switch, a router, a load balancing device, etc.

[0041] In daily use of the data processing system 100, the first server 110 obtains a first data packet, the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; the first data packet is sent to the second server through a data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; the second data packet sent by the data transfer device is received; and the second data packet is sent to the source container.

[0042] See also Figure 2 , Figure 2 Schematic diagram of the structure of a first server in a data processing system provided in an embodiment of the present application. Figure 2 As shown, the first server 110 includes a first unprivileged network namespace 210 and a first host network space 220, the first unprivileged network namespace 210 includes a source container 211, a first virtual network card 212, a first virtual network bridge 213 and a first virtual device 214, the source container 211 is communicatively connected to the first virtual network card 212, the first virtual network bridge 213 is communicatively connected to the first virtual device 214, the first host network space 220 also includes a second virtual network bridge 221 and a second virtual device 222, the second virtual network bridge 221 is communicatively connected to the second virtual device 222. The first server 110 also includes a first physical network card 223, the second virtual network bridge 221 is communicatively connected to the first physical network card 223, and the first physical network card 223 is communicatively connected to the data transfer device.

[0043] See also Figure 3 , Figure 3 is a schematic diagram of the structure of a first server in another data processing system provided in an embodiment of the present application. Figure 3 As shown, the first server 110 includes a processor 310 and a memory 320, and the processor 310 is communicatively connected to the memory 320. Among them, one or more programs are stored in the memory 320, and the one or more programs are configured to be executed by the processor 310. The function of the one or more programs is to obtain a first data packet, the first data packet is a data packet sent by the source container to the destination container, the source container is a rootless container created without root authority, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, and the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; send the second data packet to the source container.

[0044] The following describes a rootless container cross-machine communication method provided by an embodiment of the present application.

[0045] See also Figure 4 , Figure 4 is a flowchart of a rootless container cross-machine communication method provided by an embodiment of the present application, which is applied to Figure 1The first server 110 in the data processing system 100 shown in the figure, the data processing system 100 includes the first server 110, the second server 120 and the data transfer device 130, the first server 110 and the data transfer device 130 are communicatively connected, and the second server 120 and the data transfer device 130 are communicatively connected; Figure 4 As shown, the method comprises the following steps:

[0046] Step S401, obtaining a first data packet.

[0047] The first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server.

[0048] The destination container may be a rootless container or a common container.

[0049] In a possible embodiment, obtaining the first data packet includes: when detecting that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace; transmitting the first data packet from the first unprivileged network namespace to the first host network space.

[0050] The transmitting the first data packet to the first unprivileged network namespace when it is detected that the source container sends the first data packet may specifically be: when the first unprivileged network namespace detects that the source container sends the first data packet, the first unprivileged network namespace obtains the first data packet.

[0051] The transmitting the first data packet from the first unprivileged network namespace to the first host network space may specifically be: the first unprivileged network namespace sends the first data packet to the first host network space; and the first host network space receives the first data packet.

[0052] The first data packet includes address information of the source container and identification information of the destination container.

[0053] The first host network space is used to provide network support for the first server.

[0054] It can be seen that in this example, when it is detected that the source container sends a first data packet, the first data packet is transmitted to the first unprivileged network namespace, and then the first data packet is transmitted to the first host network space, and then sent to the destination container on the second server through the data transfer device connected to the first server to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, thereby improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0055] In a possible embodiment, the first unprivileged network namespace also includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and when it is detected that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace includes: transmitting the first data packet from the source container to the first virtual network card; transmitting the first data packet from the first virtual network card to the first virtual bridge; transmitting the first data packet from the first virtual bridge to the first virtual device.

[0056] The transmitting the first data packet from the source container to the first virtual network card may specifically include: the source container sending the first data packet to the first virtual network card; and the first virtual network card receiving the first data packet.

[0057] The transmitting the first data packet from the first virtual network card to the first virtual network bridge may specifically include: the first virtual network card sends the first data packet to the first virtual network bridge; and the first virtual network bridge receives the first data packet.

[0058] The transmitting the first data packet from the first virtual network bridge to the first virtual device may specifically include: the first virtual network bridge sends the first data packet to the first virtual device; and the first virtual device receives the first data packet.

[0059] The first virtual device may specifically be a tap device.

[0060] It can be seen that in this example, when it is detected that the source container sends a first data packet, the first data packet is transmitted to the first virtual network card, and then the first data packet is transmitted to the first virtual bridge, and then the first data packet is transmitted to the first virtual device, and then the first data packet is transmitted to the first host network space, and then sent to the destination container on the second server through the data transfer device connected to the first server for communication, so as to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0061] In a possible embodiment, the first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, the first virtual device is communicatively connected to the second virtual device, and the transmitting the first data packet from the first unprivileged network namespace to the first host network space includes: transmitting the first data packet from the first virtual device to the second virtual device; transmitting the first data packet from the second virtual device to the second virtual bridge.

[0062] The transmitting the first data packet from the first virtual device to the second virtual device may specifically be: the first virtual device sends the first data packet to the second virtual device; and the second virtual device receives the first data packet.

[0063] The transmitting the first data packet from the second virtual device to the second virtual bridge may specifically include: the second virtual device sends the first data packet to the second virtual bridge; and the second virtual bridge receives the first data packet.

[0064] The second virtual device may specifically be a tap device.

[0065] It can be seen that in this example, a first data packet is sent to a second virtual device in the first host network space through a first virtual device in the first unprivileged network namespace, and after receiving the first data packet, the second virtual device sends the first data packet to the second virtual bridge, and then sends it to the destination container on the second server through a data transit device connected to the first server for communication, so as to obtain a second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and efficiency of cross-host communication of rootless containers.

[0066] Step S402: sending the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device.

[0067] The second data packet is a data packet sent by the destination container to the source container in response to the first data packet.

[0068] Among them, sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device can specifically be: the first host network space sends the first data packet to the data transfer device; the data transfer device sends the first data packet to the second server to obtain the second data packet; the data transfer device sends the second data packet to the first host network space.

[0069] In a possible embodiment, the first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, the second physical network card is communicatively connected to the data transfer device, and sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device includes: transmitting the first data packet from the second virtual network bridge to the first physical network card; transmitting the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0070] The transmitting the first data packet from the second virtual network bridge to the first physical network card may specifically be: the second virtual network bridge sends the first data packet to the first physical network card; and the first physical network card receives the first data packet.

[0071] Among them, transmitting the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card can specifically be: the first physical network card sends the first data packet to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0072] It can be seen that in this example, a first data packet is sent to the first physical network card through the second virtual bridge in the network space of the first host machine. After receiving the first data packet, the first physical network card sends the first data packet to the data transfer device, which is then sent to the destination container on the second server through the data transfer device to obtain a second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, thereby improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0073] Step S403: receiving a second data packet sent by the data transfer device.

[0074] The receiving of the second data packet sent by the data transfer device may specifically include: the first host network space receives the second data packet.

[0075] In a possible embodiment, the receiving of the second data packet sent by the data transfer device includes: when it is detected that the data transfer device sends the second data packet, transmitting the second data packet to the first physical network card; transmitting the second data packet from the first physical network card to the second virtual bridge; transmitting the second data packet from the second virtual bridge to the second virtual device.

[0076] When it is detected that the data transfer device sends the second data packet, the second data packet is transmitted to the first physical network card. Specifically, the data transfer device sends the second data packet to the first physical network card; and the first physical network card receives the second data packet.

[0077] The transmitting the second data packet from the first physical network card to the second virtual network bridge may specifically be: the first physical network card sends the second data packet to the second virtual network bridge; and the second virtual network bridge receives the second data packet.

[0078] The transmitting the second data packet from the second virtual network bridge to the second virtual device may specifically be: the second virtual network bridge sends the second data packet to the second virtual device; and the second virtual device receives the second data packet.

[0079] It can be seen that in this example, the second data packet sent by the data transfer device is received by the first physical network card in the first server, and then the first physical network card sends the second data packet to the second virtual bridge, and then the second data packet is sent to the second virtual device through the second virtual bridge, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, thereby improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0080] Step S404: Send the second data packet to the source container.

[0081] The sending of the second data packet to the source container may specifically include: the first host network space sending the second data packet to the first unprivileged network namespace; and the first unprivileged network namespace sending the second data packet to the source container.

[0082] In a possible embodiment, sending the second data packet to the source container includes: transmitting the second data packet from the second virtual device to the first virtual device; transmitting the second data packet from the first virtual device to the first virtual network bridge; transmitting the second data packet from the first virtual network bridge to the first virtual network card; transmitting the second data packet from the first virtual network card to the source container.

[0083] Among them, the transmitting of the second data packet from the second virtual device to the first virtual device may specifically be: the second virtual device sends the second data packet to the first virtual device; the first virtual device receives the second data packet; the first virtual device sends the second data packet to the first virtual bridge; the first virtual bridge receives the second data packet; the first virtual bridge sends the second data packet to the first virtual network card; the second virtual network card receives the second data packet; the second virtual network card sends the second data packet to the source container.

[0084] Among them, when the destination container is a rootless container, the second server may include a second host network space and a second unprivileged network namespace, the second unprivileged network namespace includes a destination container, a second virtual network card, a third virtual bridge and a third virtual device, the destination container is communicatively connected to the second virtual network card, the third virtual bridge is communicatively connected to the third virtual device, the second host network space includes a fourth virtual bridge and a fourth virtual device, the fourth virtual bridge is communicatively connected to the fourth virtual device, the second server includes a second physical network card, the fourth virtual bridge is communicatively connected to the second physical network card, and the second physical network card is communicatively connected to the data transfer device.

[0085] Wherein, the second server performs the following steps: the second physical network card receives the first data packet sent by the data transfer device; the second physical network card sends the first data packet to the fourth virtual network bridge; the fourth virtual network bridge receives the first data packet; the fourth virtual network bridge sends the first data packet to the fourth virtual device; the fourth virtual device receives the first data packet; the fourth virtual device sends the first data packet to the third virtual device; the third virtual device receives the first data packet; the third virtual device sends the first data packet to the third virtual network bridge; the third virtual network bridge receives the first data packet; the third virtual network bridge sends the first data packet to the second virtual network card; the second virtual network card receives the first data packet; the second virtual network card sends the first data packet to the destination container; the first destination container receives the first data packet; the destination container generates the first data packet according to the first data packet the second data packet; the destination container sends the second data packet to the second virtual network card; the second virtual network card receives the second data packet; the second virtual network card sends the second data packet to the third virtual bridge; the third virtual bridge receives the second data packet; the third virtual bridge sends the second data packet to the third virtual device; the third virtual device receives the second data packet; the third virtual device sends the second data packet to the fourth virtual device; the fourth virtual device receives the second data packet; the fourth virtual device sends the second data packet to the fourth virtual bridge; the fourth virtual bridge receives the second data packet; the fourth virtual bridge sends the second data packet to the second physical network card; the second physical network card receives the second data packet; the second physical network card sends the second data packet to the data transit device, so that the data transit device sends the second data packet to the first server.

[0086] Among them, see Figure 5 , Figure 5 FIG. 1 is a schematic diagram of another scenario of a rootless container cross-machine communication method provided by an embodiment of the present application. Figure 5 As shown, Figure 5The arrow in is the transmission path of the first data packet. When the destination container 511 is a rootless container, in the first server 110, the first data packet starts from the source container 211 in the first unprivileged network namespace 210, reaches the first virtual network card 212; then, reaches the first virtual bridge 213; then, reaches the first virtual device 214; then, reaches the second virtual device 222 in the first host network space 220; then, reaches the second virtual bridge 221; then, reaches the first physical network card 223; then, reaches the data transfer device 130; then, reaches the second server 120. The second physical network card 523; then, reaches the fourth virtual bridge 521 in the second host network space 520 in the second server 120; then, reaches the fourth virtual device 522 in the second host network space 520; then, reaches the third virtual device 514 in the second unprivileged network namespace 510 in the second server 120; then, reaches the third virtual bridge 513 in the second unprivileged network namespace 510; then, reaches the second virtual network card 512 in the second unprivileged network namespace 510; then, reaches the destination container 511 in the second unprivileged network namespace 510.

[0087] It can be seen that in this example, after the first server receives the second data packet sent by the data transfer device, the second data packet is sent to the first virtual device through the second virtual device, and then the first virtual device sends the second data packet to the first virtual bridge, and then the first virtual bridge sends the first data packet to the first virtual network card, and then the first virtual network card sends the second data packet to the source container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0088] It can be seen that in the present application, the first server obtains a first data packet, the first data packet is a data packet sent by the source container to the destination container, the source container is a rootless container created without using root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; the first data packet is sent to the second server through a data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, and the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; the second data packet sent by the data transfer device is received; and the second data packet is sent to the source container. After the first server obtains the first data packet sent by the source container in the unprivileged network namespace, it sends it to the destination container on the second server through the data transfer device that is connected to the first server in communication, so as to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the prior art, the data transmission speed of the present invention is increased by more than two times, which significantly improves the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0089] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that, in order to realize the above functions, the controller includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0090] In accordance with the above-mentioned embodiments, please refer to Figure 6 , Figure 6 is a functional unit block diagram of a rootless container cross-machine communication device provided by an embodiment of the present application, such as Figure 6As shown, the rootless container cross-machine communication device 600 includes: a first receiving unit 601, used to obtain a first data packet, the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; a first processing unit 602, used to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; send the second data packet to the source container.

[0091] In a possible embodiment, in terms of obtaining the first data packet, the first receiving unit 601 is specifically used to: when detecting that the source container sends the first data packet, transmit the first data packet to the first unprivileged network namespace; and transmit the first data packet from the first unprivileged network namespace to the first host network space.

[0092] In a possible embodiment, the first unprivileged network namespace also includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and in terms of transmitting the first data packet to the first unprivileged network namespace when it is detected that the source container sends the first data packet, the first receiving unit 601 is specifically used to: transmit the first data packet from the source container to the first virtual network card; transmit the first data packet from the first virtual network card to the first virtual bridge; transmit the first data packet from the first virtual bridge to the first virtual device.

[0093] In a possible embodiment, the first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, the first virtual device is communicatively connected to the second virtual device, and in terms of transmitting the first data packet from the first unprivileged network namespace to the first host network space, the first receiving unit 601 is specifically used to: transmit the first data packet from the first virtual device to the second virtual device; transmit the first data packet from the second virtual device to the second virtual bridge.

[0094] In a possible embodiment, the first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, the second physical network card is communicatively connected to the data transfer device, and in terms of sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device, the first processing unit 602 is specifically used to: transmit the first data packet from the second virtual network bridge to the first physical network card; transmit the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0095] In a possible embodiment, in terms of receiving the second data packet sent by the data transfer device, the first processing unit 602 is specifically used to: when detecting that the data transfer device sends the second data packet, transmit the second data packet to the first physical network card; transmit the second data packet from the first physical network card to the second virtual bridge; transmit the second data packet from the second virtual bridge to the second virtual device.

[0096] In a possible embodiment, in terms of sending the second data packet to the source container, the first processing unit 602 is specifically used to: transmit the second data packet from the second virtual device to the first virtual device; transmit the second data packet from the first virtual device to the first virtual bridge; transmit the second data packet from the first virtual bridge to the first virtual network card; transmit the second data packet from the first virtual network card to the source container.

[0097] It can be understood that since the method embodiment and the device embodiment are different presentation forms of the same technical concept, the content of the method embodiment part in this application should be synchronously adapted to the device embodiment part and will not be repeated here.

[0098] In the case of integrated units, such as Figure 7 As shown, Figure 7 This is a functional unit block diagram of another rootless container cross-machine communication device provided by an embodiment of the present application. Figure 7In the embodiment, the rootless container cross-machine communication device 600 includes: a processing module 712 and a communication module 711. The processing module 712 is used to control and manage the actions of the rootless container cross-machine communication device 600, for example, to execute the steps of the first receiving unit 601 and the first processing unit 602, and / or other processes for executing the technology described herein. The communication module 711 is used to support the interaction between the rootless container cross-machine communication device 600 and other devices. Figure 7 As shown, the rootless container inter-machine communication apparatus 600 may further include a storage module 713 , and the storage module 713 is used to store program codes and data of the rootless container inter-machine communication apparatus 600 .

[0099] Among them, the processing module 712 can be a processor or a controller, for example, a central processing unit (CPU), a general processor, a digital signal processor (DSP), an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 711 can be a transceiver, an RF circuit or a communication interface, and the like. The storage module 713 can be a memory.

[0100] Among them, all relevant contents of each scenario involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here. Figure 4 The rootless container cross-machine communication method shown.

[0101] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0102] Figure 8 is a structural block diagram of a first server provided in an embodiment of the present application. Figure 8 As shown, the first server 110 may include one or more of the following components: a processor 310, and a memory 320 coupled to the processor 310, wherein the memory 320 may store one or more computer programs 321, and the one or more computer programs 321 may be configured to implement the methods described in the above embodiments when executed by one or more processors 310.

[0103] The processor 310 may include one or more processing cores. The processor 310 uses various interfaces and lines to connect various parts within the entire first server 110, and executes various functions and processes data of the first server 110 by running or executing instructions, programs, code sets or instruction sets stored in the memory 320, and calling data stored in the memory 320. Optionally, the processor 310 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 310 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 310, but may be implemented separately through a communication chip.

[0104] The memory 320 may include a random access memory (RAM) or a read-only memory (ROM). The memory 320 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 320 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the first server 110 during use, etc.

[0105] It is understandable that the first server 110 may include more or fewer structural elements than those in the above structural block diagram, which is not limited here. The present application embodiment provides a computer-readable storage medium on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of the method described in any possible embodiment are implemented.

[0106] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0107] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and systems can be implemented in other ways. For example, the device embodiments described above are merely schematic; for example, the division of the unit is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0108] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0110] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a volatile memory or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM) and direct RAM bus random access memory (DR RAM), among other media that can store program code.

[0111] Although the present invention is disclosed as above, the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions without departing from the spirit and scope of the present invention, and can make various changes and modifications, including the combination of the above-mentioned different functions and implementation steps, including software and hardware implementation methods, all of which are within the scope of protection of the present invention.

Claims

1. A rootless container cross-machine communication method, characterized in that: The method is applied to a first server in a data processing system, wherein the data processing system includes the first server, a second server and a data transfer device, wherein the first server is communicatively connected to the data transfer device, and the second server is communicatively connected to the data transfer device, and the method includes: Obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without using root authority, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; Sending the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receiving a second data packet sent by the data transfer device; The second data packet is sent to the source container.

2. The method according to claim 1, characterized in that The obtaining of the first data packet comprises: When detecting that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace; The first data packet is transmitted from the first unprivileged network namespace to a first host network space, where the first host network space is deployed in the first server.

3. The method according to claim 2, characterized in that The first unprivileged network namespace further includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and when detecting that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace includes: Transmitting the first data packet from the source container to the first virtual network card; Transmitting the first data packet from the first virtual network card to the first virtual network bridge; The first data packet is transmitted from the first virtual bridge to the first virtual device.

4. The method according to claim 3, characterized in that The first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is in communication connection with the second virtual device, the first virtual device is in communication connection with the second virtual device, and the transmitting the first data packet from the first unprivileged network namespace to the first host network space includes: transmitting the first data packet from the first virtual device to the second virtual device; The first data packet is transmitted from the second virtual device to the second virtual bridge.

5. The method according to claim 4, characterized in that The first server includes a first physical network card, the second virtual network bridge is in communication with the first physical network card, the first physical network card is in communication with the data transfer device, the second server includes a second physical network card, the second physical network card is in communication with the data transfer device, and the sending of the first data packet to the second server through the data transfer device so that the second server sends a second data packet to the first server through the data transfer device includes: transmitting the first data packet from the second virtual network bridge to the first physical network card; The first data packet is transmitted from the first physical network card to the data transfer device, so that the data transfer device sends the first data packet to the second physical network card.

6. The method according to claim 5, characterized in that The receiving a second data packet sent by the data transfer device includes: When detecting that the data transfer device sends the second data packet, transmitting the second data packet to the first physical network card; transmitting the second data packet from the first physical network card to the second virtual network bridge; The second data packet is transmitted from the second virtual bridge to the second virtual device.

7. The method according to claim 6, characterized in that The sending the second data packet to the source container includes: transmitting the second data packet from the second virtual device to the first virtual device; transmitting the second data packet from the first virtual device to the first virtual bridge; transmitting the second data packet from the first virtual network bridge to the first virtual network card; The second data packet is transmitted from the first virtual network card to the source container.

8. A rootless container cross-machine communication device, characterized in that: A first server in a data processing system, the data processing system comprising the first server, a second server and a data transfer device, the first server being communicatively connected to the data transfer device, the second server being communicatively connected to the data transfer device, the device comprising: a first receiving unit, configured to obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without using root authority, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; The first processing unit is configured to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container.

9. A server, characterized in that: The method comprises a processor, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the programs include instructions for executing the steps in the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images