Rootless container cross-machine communication method and device

Abstract

The present application discloses a rootless container cross-host communication method and device, which obtains a first data packet; sends the first data packet to a second server through a data transfer device, so that the second server sends a second data packet to the first server through the data transfer device; receives the second data packet sent by the data transfer device; and sends the second data packet to the source container. After the first server obtains the first data packet sent by the source container in the unprivileged network namespace, it sends it to the destination container on the second server through the data transfer device connected to the first server to obtain the second data packet returned by the destination container, thereby directly achieving efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the existing technology, the data transmission speed of the present invention is increased by more than two times, significantly improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a rootless container cross-machine communication method and device. Background Art

[0002] Currently, rootless containers are started as ordinary users, forming a new security layer that is more secure than traditional containers. However, rootless containers require an unprivileged network namespace to provide user-mode network support. Existing technologies use a three-layer network protocol to achieve network communication between the unprivileged network namespace and the rootless container's host. However, the three-layer network protocol can cause a certain loss in network performance. Furthermore, achieving cross-host communication for rootless containers requires the addition of an overlay network, which can also significantly reduce network performance, resulting in slow and inefficient data transmission. Therefore, improving the data transmission speed and efficiency of cross-host communication for rootless containers has become a technical problem that needs to be further addressed. Summary of the Invention

[0003] This application proposes a rootless container cross-host communication method and device to solve the problems of slow data transmission speed and low transmission efficiency of rootless container cross-host communication, and improve the data transmission speed and transmission efficiency of rootless container cross-host communication.

[0004] In a first aspect, an embodiment of the present application provides a rootless container cross-machine communication method, which is applied to a first server in a data processing system, the data processing system including the first server, a second server, and a data transfer device, the first server being communicatively connected to the data transfer device, and the second server being communicatively connected to the data transfer device, the method comprising:

[0005] Obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server;

[0006] Sending the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet;

[0007] receiving a second data packet sent by the data transfer device;

[0008] Send the second data packet to the source container.

[0009] In a second aspect, an embodiment of the present application provides a rootless container cross-machine communication device, which is applied to a first server in a data processing system, wherein the data processing system includes the first server, a second server, and a data transfer device, wherein the first server is communicatively connected to the data transfer device, and the second server is communicatively connected to the data transfer device, and the device includes:

[0010] a first receiving unit, configured to obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server;

[0011] The first processing unit is configured to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container.

[0012] In a third aspect, an embodiment of the present application provides a server comprising a processor, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the program comprises instructions for executing the steps in the method described in any one of the first aspects.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0014] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements part or all of the steps of the method described in any one of the first aspects of the embodiment of the present application.

[0015] It can be seen that in the present application, the first server obtains a first data packet, which is a data packet sent by the source container to the destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; the first data packet is sent to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, and the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; the second data packet sent by the data transfer device is received; and the second data packet is sent to the source container. After the first server obtains the first data packet sent by the source container in the unprivileged network namespace, it sends it to the destination container on the second server through the data transfer device that is in communication with the first server to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the prior art, the data transmission speed of the present invention is increased by more than two times, significantly improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0017] Figure 1 This is a structural diagram of a data processing system provided in an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of the structure of a server in a data processing system provided by an embodiment of the present application;

[0019] Figure 3 This is a schematic diagram of the structure of a server in another data processing system provided in an embodiment of the present application;

[0020] Figure 4 This is a flowchart of a rootless container cross-machine communication method provided by an embodiment of the present application;

[0021] Figure 5 This is a scenario diagram of a rootless container cross-machine communication method provided by an embodiment of the present application;

[0022] Figure 6 This is a block diagram of the functional units of a rootless container cross-machine communication device provided by an embodiment of the present application;

[0023] Figure 7 This is a block diagram of the functional units of another rootless container cross-machine communication device provided by an embodiment of the present application;

[0024] Figure 8 This is a structural block diagram of a first server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0027] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0028] In the embodiments of this application, "and / or" describes the relationship between associated objects and indicates that three relationships can exist. For example, "A and / or B" can represent the following three situations: A exists alone; A and B exist simultaneously; and B exists alone. A and B can be singular or plural.

[0029] In the embodiments of the present application, the symbol " / " can indicate that the preceding and following objects are in an "or" relationship. In addition, the symbol " / " can also represent a division sign, that is, performing a division operation. For example, A / B can mean A divided by B.

[0030] In the embodiments of the present application, "at least one item" or similar expressions refers to any combination of these items, including any combination of single items or plural items, and refers to one or more, and multiple refers to two or more. For example, at least one item (item) of a, b, or c can represent the following seven situations: a, b, c, a and b, a and c, b and c, a, b, and c. Among them, each of a, b, and c can be an element or a set containing one or more elements.

[0031] In the embodiments of this application, "equal to" can be used in conjunction with "greater than" and is applicable to the technical solution adopted when "greater than" is used, and can also be used in conjunction with "less than" and is applicable to the technical solution adopted when "less than" is used. When "equal to" is used in conjunction with "greater than", it should not be used in conjunction with "less than"; when "equal to" is used in conjunction with "less than", it should not be used in conjunction with "greater than".

[0032] In order to better understand the solutions of the embodiments of the present application, the terminal devices, related concepts and backgrounds that may be involved in the embodiments of the present application are first introduced below.

[0033] (1) Root privileges: Root privileges refer to the user rights with the highest authority in the system, which are usually used to perform system-level operations and management tasks.

[0034] (2) Root user: The root user refers to the user with the highest authority in the system.

[0035] (3) Rootless containers: Rootless containers are containers that can be created without root privileges. Unlike traditional containers, the rootless container daemon can be run by an unprivileged user, creating a new layer of security. If the container engine is attacked during runtime, the attacker will not gain root privileges on the host.

[0036] (4) Unprivileged network namespace: A network namespace created by an unprivileged ordinary user to provide network support for rootless containers.

[0037] (5)Tap device: A virtual network device used to simulate a physical network interface.

[0038] Currently, rootless containers are started as ordinary users, forming a new security layer that is more secure than traditional containers. However, rootless containers require an unprivileged network namespace to provide user-mode network support. Existing technologies use a three-layer network protocol to achieve network communication between the unprivileged network namespace and the rootless container's host. However, the three-layer network protocol can cause a certain loss in network performance. Furthermore, achieving cross-host communication for rootless containers requires the addition of an overlay network, which can also significantly reduce network performance, resulting in slow and inefficient data transmission. Therefore, improving the data transmission speed and efficiency of cross-host communication for rootless containers has become a technical problem that needs to be further addressed.

[0039] To solve the above problems, an embodiment of the present application provides a rootless container cross-machine communication method and device. In this method, after a first server obtains a first data packet sent by a source container in an unprivileged network namespace, it sends it to a destination container on a second server through a data transfer device connected to the first server to obtain a second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the existing technology, the data transmission speed of the present invention is more than doubled, significantly improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0040] See also Figure 1 , Figure 1 This is a structural diagram of a data processing system provided in an embodiment of the present application. Figure 1 As shown, the data processing system 100 includes a first server 110, a second server 120, and a data transfer device 130. The first server 110 and the data transfer device 130 are communicatively connected, and the second server 120 and the data transfer device 130 are communicatively connected. The first server 110 and the second server 120 can be a single server or a server cluster consisting of multiple servers. The data transfer device can be a switch, a router, a load balancing device, etc.

[0041] In daily use of the data processing system 100, the first server 110 obtains a first data packet, which is a data packet sent by a source container to a destination container. The source container is a rootless container created without root permissions. The source container is deployed in a first unprivileged network namespace. The first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server. The first data packet is sent to the second server through a data transfer device, so that the second server sends a second data packet to the first server through the data transfer device. The second data packet is a data packet sent by the destination container to the source container in response to the first data packet. The second data packet sent by the data transfer device is received. The second data packet is sent to the source container.

[0042] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of a first server in a data processing system provided by an embodiment of the present application. Figure 2 As shown, the first server 110 includes a first unprivileged network namespace 210 and a first host network space 220. The first unprivileged network namespace 210 includes a source container 211, a first virtual network card 212, a first virtual bridge 213, and a first virtual device 214. The source container 211 is communicatively connected to the first virtual network card 212, and the first virtual bridge 213 is communicatively connected to the first virtual device 214. The first host network space 220 also includes a second virtual bridge 221 and a second virtual device 222, and the second virtual bridge 221 is communicatively connected to the second virtual device 222. The first server 110 also includes a first physical network card 223, the second virtual bridge 221 is communicatively connected to the first physical network card 223, and the first physical network card 223 is communicatively connected to the data transfer device.

[0043] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of the first server in another data processing system provided by an embodiment of the present application. Figure 3 As shown, the first server 110 includes a processor 310 and a memory 320, and the processor 310 is communicatively connected to the memory 320. One or more programs are stored in the memory 320, and the one or more programs are configured to be executed by the processor 310. The function of the one or more programs is to obtain a first data packet, which is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container.

[0044] The following describes a rootless container cross-machine communication method provided by an embodiment of the present application.

[0045] See also Figure 4 , Figure 4 This is a flowchart of a rootless container cross-machine communication method provided by an embodiment of the present application, which is applied to Figure 1The first server 110 in the data processing system 100 shown in FIG. 1 includes a first server 110, a second server 120, and a data transfer device 130. The first server 110 is communicatively connected to the data transfer device 130, and the second server 120 is communicatively connected to the data transfer device 130. Figure 4 As shown, the method includes the following steps:

[0046] Step S401: Acquire a first data packet.

[0047] The first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server.

[0048] The destination container may be a rootless container or a common container.

[0049] In a possible embodiment, obtaining the first data packet includes: when detecting that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace; transmitting the first data packet from the first unprivileged network namespace to the first host network space.

[0050] Here, when it is detected that the source container sends the first data packet, the first data packet is transmitted to the first unprivileged network namespace. Specifically, it can be: when the first unprivileged network namespace detects that the source container sends the first data packet, the first unprivileged network namespace obtains the first data packet.

[0051] The transmitting of the first data packet from the first unprivileged network namespace to the first host network space may specifically be: the first unprivileged network namespace sends the first data packet to the first host network space; and the first host network space receives the first data packet.

[0052] The first data packet includes the address information of the source container and the identification information of the destination container.

[0053] The first host network space is used to provide network support for the first server.

[0054] It can be seen that in this example, when it is detected that the source container sends a first data packet, the first data packet is transmitted to the first unprivileged network namespace, and then the first data packet is transmitted to the first host network space, and then sent to the destination container on the second server through the data transfer device connected to the first server to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0055] In a possible embodiment, the first unprivileged network namespace further includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and when it is detected that the source container sends the first data packet, transmitting the first data packet to the first unprivileged network namespace includes: transmitting the first data packet from the source container to the first virtual network card; transmitting the first data packet from the first virtual network card to the first virtual bridge; transmitting the first data packet from the first virtual bridge to the first virtual device.

[0056] The transmitting the first data packet from the source container to the first virtual network card may specifically include: the source container sending the first data packet to the first virtual network card; and the first virtual network card receiving the first data packet.

[0057] The transmitting the first data packet from the first virtual network card to the first virtual network bridge may specifically include: the first virtual network card sends the first data packet to the first virtual network bridge; and the first virtual network bridge receives the first data packet.

[0058] The transmitting the first data packet from the first virtual network bridge to the first virtual device may specifically be: the first virtual network bridge sends the first data packet to the first virtual device; and the first virtual device receives the first data packet.

[0059] The first virtual device may specifically be a tap device.

[0060] It can be seen that in this example, when it is detected that the source container sends a first data packet, the first data packet is transmitted to the first virtual network card, and then the first data packet is transmitted to the first virtual bridge, and then the first data packet is transmitted to the first virtual device, and then the first data packet is transmitted to the first host network space, and then sent to the destination container on the second server through the data transfer device connected to the first server to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0061] In a possible embodiment, the first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, and the first virtual device is communicatively connected to the second virtual device, and the transmitting of the first data packet from the first unprivileged network namespace to the first host network space includes: transmitting the first data packet from the first virtual device to the second virtual device; transmitting the first data packet from the second virtual device to the second virtual bridge.

[0062] The transmitting the first data packet from the first virtual device to the second virtual device may specifically be: the first virtual device sends the first data packet to the second virtual device; and the second virtual device receives the first data packet.

[0063] The transmitting the first data packet from the second virtual device to the second virtual network bridge may specifically be: the second virtual device sends the first data packet to the second virtual network bridge; and the second virtual network bridge receives the first data packet.

[0064] The second virtual device may specifically be a tap device.

[0065] It can be seen that in this example, a first data packet is sent to a second virtual device in the first host network space through a first virtual device in the first unprivileged network namespace. After receiving the first data packet, the second virtual device sends the first data packet to the second virtual bridge, and then sends it to the destination container on the second server through a data transfer device connected to the first server to obtain a second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, thereby improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0066] Step S402: Send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device.

[0067] The second data packet is a data packet sent by the destination container to the source container in response to the first data packet.

[0068] Among them, the sending of the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device can be specifically: the first host network space sends the first data packet to the data transfer device; the data transfer device sends the first data packet to the second server to obtain the second data packet; the data transfer device sends the second data packet to the first host network space.

[0069] In a possible embodiment, the first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, the second physical network card is communicatively connected to the data transfer device, and sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device includes: transmitting the first data packet from the second virtual network bridge to the first physical network card; transmitting the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0070] The transmitting the first data packet from the second virtual network bridge to the first physical network card may specifically be: the second virtual network bridge sends the first data packet to the first physical network card; and the first physical network card receives the first data packet.

[0071] Among them, the transmitting of the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card can specifically be: the first physical network card sends the first data packet to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0072] It can be seen that in this example, the first data packet is sent to the first physical network card through the second virtual bridge in the network space of the first host machine. After receiving the first data packet, the first physical network card sends the first data packet to the data transfer device, which is then sent to the destination container on the second server through the data transfer device to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0073] Step S403: Receive a second data packet sent by the data transfer device.

[0074] The receiving of the second data packet sent by the data transfer device may specifically include: the first host network space receiving the second data packet.

[0075] In a possible embodiment, the receiving of the second data packet sent by the data transfer device includes: when detecting that the data transfer device sends the second data packet, transmitting the second data packet to the first physical network card; transmitting the second data packet from the first physical network card to the second virtual bridge; transmitting the second data packet from the second virtual bridge to the second virtual device.

[0076] When it is detected that the data transfer device sends the second data packet, the second data packet is transmitted to the first physical network card. Specifically, it can be: the data transfer device sends the second data packet to the first physical network card; the first physical network card receives the second data packet.

[0077] The transmitting the second data packet from the first physical network card to the second virtual network bridge may specifically be: the first physical network card sends the second data packet to the second virtual network bridge; and the second virtual network bridge receives the second data packet.

[0078] The transmitting the second data packet from the second virtual network bridge to the second virtual device may specifically be: the second virtual network bridge sends the second data packet to the second virtual device; and the second virtual device receives the second data packet.

[0079] It can be seen that in this example, the second data packet sent by the data transfer device is received by the first physical network card in the first server, and then the first physical network card sends the second data packet to the second virtual bridge, and then the second data packet is sent to the second virtual device through the second virtual bridge, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, thereby improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0080] Step S404: Send the second data packet to the source container.

[0081] The sending of the second data packet to the source container may specifically include: the first host network space sending the second data packet to the first unprivileged network namespace; and the first unprivileged network namespace sending the second data packet to the source container.

[0082] In a possible embodiment, sending the second data packet to the source container includes: transmitting the second data packet from the second virtual device to the first virtual device; transmitting the second data packet from the first virtual device to the first virtual bridge; transmitting the second data packet from the first virtual bridge to the first virtual network card; and transmitting the second data packet from the first virtual network card to the source container.

[0083] Among them, the transmitting of the second data packet from the second virtual device to the first virtual device can specifically be: the second virtual device sends the second data packet to the first virtual device; the first virtual device receives the second data packet; the first virtual device sends the second data packet to the first virtual bridge; the first virtual bridge receives the second data packet; the first virtual bridge sends the second data packet to the first virtual network card; the second virtual network card receives the second data packet; the second virtual network card sends the second data packet to the source container.

[0084] In which, when the destination container is a rootless container, the second server may include a second host network space and a second unprivileged network namespace, the second unprivileged network namespace includes a destination container, a second virtual network card, a third virtual bridge and a third virtual device, the destination container is communicatively connected to the second virtual network card, the third virtual bridge is communicatively connected to the third virtual device, the second host network space includes a fourth virtual bridge and a fourth virtual device, the fourth virtual bridge is communicatively connected to the fourth virtual device, the second server includes a second physical network card, the fourth virtual bridge is communicatively connected to the second physical network card, and the second physical network card is communicatively connected to the data transfer device.

[0085] Wherein, the second server performs the following steps: the second physical network card receives the first data packet sent by the data transfer device; the second physical network card sends the first data packet to the fourth virtual network bridge; the fourth virtual network bridge receives the first data packet; the fourth virtual network bridge sends the first data packet to the fourth virtual device; the fourth virtual device receives the first data packet; the fourth virtual device sends the first data packet to the third virtual device; the third virtual device receives the first data packet; the third virtual device sends the first data packet to the third virtual network bridge; the third virtual network bridge receives the first data packet; the third virtual bridge sends the first data packet to the second virtual network card; the second virtual network card receives the first data packet; the second virtual network card sends the first data packet to the destination container; the first destination container receives the first data packet; the destination container generates the first data packet according to the first data packet. the second data packet; the destination container sends the second data packet to the second virtual network card; the second virtual network card receives the second data packet; the second virtual network card sends the second data packet to the third virtual bridge; the third virtual bridge receives the second data packet; the third virtual bridge sends the second data packet to the third virtual device; the third virtual device receives the second data packet; the third virtual device sends the second data packet to the fourth virtual device; the fourth virtual device receives the second data packet; the fourth virtual device sends the second data packet to the fourth virtual bridge; the fourth virtual bridge receives the second data packet; the fourth virtual bridge sends the second data packet to the second physical network card; the second physical network card receives the second data packet; the second physical network card sends the second data packet to the data transit device, so that the data transit device sends the second data packet to the first server.

[0086] Among them, see Figure 5 , Figure 5 This is a scenario diagram of another rootless container cross-machine communication method provided by an embodiment of the present application. Figure 5 As shown, Figure 5The arrow in the figure represents the transmission path of the first data packet. When the destination container 511 is a rootless container, in the first server 110, the first data packet starts from the source container 211 in the first unprivileged network namespace 210, reaches the first virtual network card 212; then reaches the first virtual bridge 213; then reaches the first virtual device 214; then reaches the second virtual device 222 in the first host network space 220; then reaches the second virtual bridge 221; then reaches the first physical network card 223; then reaches the data transfer device 130; then reaches the second server 120. The second physical network card 523; then, reaches the fourth virtual bridge 521 in the second host network space 520 in the second server 120; then, reaches the fourth virtual device 522 in the second host network space 520; then, reaches the third virtual device 514 in the second unprivileged network namespace 510 in the second server 120; then, reaches the third virtual bridge 513 in the second unprivileged network namespace 510; then, reaches the second virtual network card 512 in the second unprivileged network namespace 510; then, reaches the destination container 511 in the second unprivileged network namespace 510.

[0087] It can be seen that in this example, after the first server receives the second data packet sent by the data transfer device, it sends the second data packet to the first virtual device through the second virtual device, and then the first virtual device sends the second data packet to the first virtual bridge, and then the first virtual bridge sends the first data packet to the first virtual network card, and then the first virtual network card sends the second data packet to the source container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network, and improving the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0088] It can be seen that in the present application, the first server obtains a first data packet, which is a data packet sent by the source container to the destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; the first data packet is sent to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, and the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; the second data packet sent by the data transfer device is received; and the second data packet is sent to the source container. Since the first server obtains the first data packet sent by the source container in the unprivileged network namespace, it sends it to the destination container on the second server through the data transfer device that is connected to the first server in communication, so as to obtain the second data packet returned by the destination container, thereby directly realizing efficient connectivity between rootless containers deployed on different hosts through the underlay network. Compared with the prior art, the data transmission speed of the present invention is increased by more than two times, which significantly improves the data transmission speed and transmission efficiency of cross-host communication of rootless containers.

[0089] The above mainly introduces the solution of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that, in order to realize the above functions, the controller includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0090] In accordance with the above-mentioned embodiment, please refer to Figure 6 , Figure 6 This is a block diagram of the functional units of a rootless container cross-machine communication device provided by an embodiment of the present application, such as Figure 6As shown, the rootless container cross-machine communication device 600 includes: a first receiving unit 601, used to obtain a first data packet, where the first data packet is a data packet sent by a source container to a destination container, the source container is a rootless container created without root permissions, the source container is deployed in a first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; a first processing unit 602, used to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container.

[0091] In a possible embodiment, in terms of obtaining the first data packet, the first receiving unit 601 is specifically used to: when detecting that the source container sends the first data packet, transmit the first data packet to the first unprivileged network namespace; and transmit the first data packet from the first unprivileged network namespace to the first host network space.

[0092] In a possible embodiment, the first unprivileged network namespace further includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and in terms of transmitting the first data packet to the first unprivileged network namespace when it is detected that the source container has sent the first data packet, the first receiving unit 601 is specifically used to: transmit the first data packet from the source container to the first virtual network card; transmit the first data packet from the first virtual network card to the first virtual bridge; transmit the first data packet from the first virtual bridge to the first virtual device.

[0093] In a possible embodiment, the first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, and the first virtual device is communicatively connected to the second virtual device. In terms of transmitting the first data packet from the first unprivileged network namespace to the first host network space, the first receiving unit 601 is specifically used to: transmit the first data packet from the first virtual device to the second virtual device; and transmit the first data packet from the second virtual device to the second virtual bridge.

[0094] In a possible embodiment, the first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, and the second physical network card is communicatively connected to the data transfer device. In terms of sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device, the first processing unit 602 is specifically used to: transmit the first data packet from the second virtual network bridge to the first physical network card; transmit the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

[0095] In a possible embodiment, in terms of receiving the second data packet sent by the data transfer device, the first processing unit 602 is specifically used to: when detecting that the data transfer device sends the second data packet, transmit the second data packet to the first physical network card; transmit the second data packet from the first physical network card to the second virtual bridge; transmit the second data packet from the second virtual bridge to the second virtual device.

[0096] In a possible embodiment, in terms of sending the second data packet to the source container, the first processing unit 602 is specifically configured to: transmit the second data packet from the second virtual device to the first virtual device; transmit the second data packet from the first virtual device to the first virtual network bridge; transmit the second data packet from the first virtual network bridge to the first virtual network card; and transmit the second data packet from the first virtual network card to the source container.

[0097] It can be understood that since the method embodiment and the device embodiment are different presentation forms of the same technical concept, the content of the method embodiment part in this application should be synchronously adapted to the device embodiment part and will not be repeated here.

[0098] In the case of integrated units, such as Figure 7 As shown, Figure 7 This is a functional unit block diagram of another rootless container cross-machine communication device provided by an embodiment of the present application. Figure 7In the embodiment, the rootless container cross-machine communication device 600 includes: a processing module 712 and a communication module 711. The processing module 712 is used to control and manage the actions of the rootless container cross-machine communication device 600, for example, executing the steps of the first receiving unit 601 and the first processing unit 602, and / or other processes for executing the technology described herein. The communication module 711 is used to support the interaction between the rootless container cross-machine communication device 600 and other devices. Figure 7 As shown, the rootless container inter-machine communication apparatus 600 may further include a storage module 713 , and the storage module 713 is used to store program codes and data of the rootless container inter-machine communication apparatus 600 .

[0099] The processing module 712 may be a processor or controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an ASIC, an FPGA, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 711 may be a transceiver, an RF circuit, or a communication interface, and the like. The storage module 713 may be a memory.

[0100] Among them, all relevant contents of each scenario involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here. Figure 4 The rootless container cross-machine communication method shown.

[0101] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0102] Figure 8 This is a structural block diagram of a first server provided in an embodiment of the present application. Figure 8 As shown, the first server 110 may include one or more of the following components: a processor 310, a memory 320 coupled to the processor 310, wherein the memory 320 may store one or more computer programs 321, and the one or more computer programs 321 may be configured to implement the methods described in the above embodiments when executed by one or more processors 310.

[0103] The processor 310 may include one or more processing cores. The processor 310 utilizes various interfaces and circuits to connect various components within the first server 110. It executes instructions, programs, code sets, or instruction sets stored in the memory 320, as well as accesses data stored in the memory 320, to perform various functions and process data on the first server 110. Optionally, the processor 310 may be implemented using at least one of the following hardware forms: a digital signal processing (DSP), a field-programmable gate array (FPGA), or a programmable logic array (PLA). The processor 310 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem handles wireless communications. It is understood that the modem may not be integrated into the processor 310 and may be implemented separately via a communications chip.

[0104] The memory 320 may include a random access memory (RAM) or a read-only memory (ROM). The memory 320 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 320 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the first server 110 during use.

[0105] It is understandable that the first server 110 may include more or fewer structural elements than those in the above structural block diagram, and this is not limited here. An embodiment of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the method described in any possible embodiment.

[0106] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed methods, devices, and systems can be implemented in other ways. For example, the device embodiments described above are merely schematic; for example, the division of the unit is merely a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0108] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0109] In addition, the functional units in various embodiments of the present invention may be integrated into a single processing unit, each unit may be physically included separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional units.

[0110] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a volatile memory or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM), among other media that can store program code.

[0111] Although the present invention is disclosed above, it is not limited thereto. Any person skilled in the art may readily conceive of variations or substitutions, and may make various modifications and alterations without departing from the spirit and scope of the present invention. Combinations of the above-described functions and implementation steps, including software and hardware implementations, are all within the scope of protection of the present invention.

Claims

1. A rootless container cross-machine communication method, characterized in that: The method is applied to a first server in a data processing system, the data processing system comprising the first server, a second server, and a data transfer device, the first server being communicatively connected to the data transfer device, and the second server being communicatively connected to the data transfer device, the method comprising: When detecting that a source container sends a first data packet, transmitting the first data packet to a first unprivileged network namespace, where the first data packet is a data packet sent by the source container to the destination container, the source container is a rootless container created without root permissions, the source container is deployed in the first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; transmitting the first data packet from the first unprivileged network namespace to a first host network space, where the first host network space is deployed in the first server; Sending the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receiving a second data packet sent by the data transfer device; Sending the second data packet to the source container; The first unprivileged network namespace further includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and when detecting that the source container sends a first data packet, transmitting the first data packet to the first unprivileged network namespace includes: transmitting the first data packet from the source container to the first virtual network card; transmitting the first data packet from the first virtual network card to the first virtual bridge; transmitting the first data packet from the first virtual bridge to the first virtual device; The first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, and the first virtual device is communicatively connected to the second virtual device, and the transmitting the first data packet from the first unprivileged network namespace to the first host network space includes: transmitting the first data packet from the first virtual device to the second virtual device; transmitting the first data packet from the second virtual device to the second virtual bridge; The first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, the second physical network card is communicatively connected to the data transfer device, and sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device includes: transmitting the first data packet from the second virtual network bridge to the first physical network card; transmitting the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

2. The method according to claim 1, characterized in that The receiving a second data packet sent by the data transfer device includes: When detecting that the data transfer device sends the second data packet, transmitting the second data packet to the first physical network card; transmitting the second data packet from the first physical network card to the second virtual network bridge; The second data packet is transmitted from the second virtual bridge to the second virtual device.

3. The method according to claim 2, characterized in that The sending the second data packet to the source container includes: transmitting the second data packet from the second virtual device to the first virtual device; transmitting the second data packet from the first virtual device to the first virtual bridge; transmitting the second data packet from the first virtual network bridge to the first virtual network card; The second data packet is transmitted from the first virtual network card to the source container.

4. A rootless container cross-machine communication device, characterized in that: A device is applied to a first server in a data processing system, the data processing system comprising the first server, a second server, and a data transfer device, the first server being communicatively connected to the data transfer device, the second server being communicatively connected to the data transfer device, the device comprising: a first receiving unit, configured to, upon detecting that a source container sends a first data packet, transmit the first data packet to a first unprivileged network namespace, where the first data packet is a data packet sent by the source container to the destination container, the source container is a rootless container created without root permissions, the source container is deployed in the first unprivileged network namespace, the first unprivileged network namespace is deployed in the first server, and the destination container is deployed in the second server; and transmit the first data packet from the first unprivileged network namespace to a first host network space, where the first host network space is deployed in the first server; a first processing unit, configured to send the first data packet to the second server through the data transfer device, so that the second server sends a second data packet to the first server through the data transfer device, where the second data packet is a data packet sent by the destination container to the source container in response to the first data packet; receive the second data packet sent by the data transfer device; and send the second data packet to the source container; The first unprivileged network namespace further includes a first virtual bridge and a first virtual device, the first virtual bridge is communicatively connected to the first virtual device, the first virtual bridge includes a first virtual network card, the source container is communicatively connected to the first virtual network card, and when detecting that the source container sends a first data packet, transmitting the first data packet to the first unprivileged network namespace includes: transmitting the first data packet from the source container to the first virtual network card; transmitting the first data packet from the first virtual network card to the first virtual bridge; transmitting the first data packet from the first virtual bridge to the first virtual device; The first host network space includes a second virtual bridge and a second virtual device, the second virtual bridge is communicatively connected to the second virtual device, and the first virtual device is communicatively connected to the second virtual device, and the transmitting the first data packet from the first unprivileged network namespace to the first host network space includes: transmitting the first data packet from the first virtual device to the second virtual device; transmitting the first data packet from the second virtual device to the second virtual bridge; The first server includes a first physical network card, the second virtual network bridge is communicatively connected to the first physical network card, the first physical network card is communicatively connected to the data transfer device, the second server includes a second physical network card, the second physical network card is communicatively connected to the data transfer device, and sending the first data packet to the second server through the data transfer device so that the second server sends the second data packet to the first server through the data transfer device includes: transmitting the first data packet from the second virtual network bridge to the first physical network card; transmitting the first data packet from the first physical network card to the data transfer device so that the data transfer device sends the first data packet to the second physical network card.

5. A server, characterized in that: The method comprises a processor, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the programs include instructions for executing the steps in the method according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images