Container and external network communication method and device, electronic equipment and storage medium

Abstract

The invention provides a container and external network communication method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a first data packet sent by a container to an external network, the first data packet recording container information and external network information, the container information comprising a container address and a container port, the external network information comprises an external network address and an external network port; the container information is converted into public network information through a program used for network address translation and arranged in an operating system kernel, the public network information comprises a public network address and a public network port available on the public network address, and the mapping relation between the container information and the public network information is recorded; and sending the converted first data packet to an external network port on the external network address so as to receive a second data packet responding to the first data packet through the public network address and the public network port.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a method, device, electronic device and storage medium for communication between a container and an external network. Background Art

[0002] In recent years, the scale of the cloud computing market has maintained rapid growth. Containerization-related technologies are one of the most important links in the field of cloud computing technology. Container technology can achieve environmental isolation when the software is running. CDN (Content Delivery Network) services can redirect user requests to the service node closest to the user in real time based on comprehensive information such as network traffic and the connection and load status of each node, as well as the distance to the user and response time. CDN can use containerization technology to run each service in a separate container to efficiently implement major functions such as resource isolation and service pooling, thereby improving the flexibility and stability of CDN services. The network address assigned to the CDN container is a private address, which can only communicate within the CDN node. Therefore, it is necessary to convert the private address of the container into a public network address to realize the communication between the container and the external network. In a related technology, a centralized gateway is used to realize the communication between the container and the external network. The data packets sent and received by the container must pass through the centralized gateway, and the gateway processes the data packets. The centralized gateway increases the processing link of the data packets sent and received by the container, increases the transmission delay of the data packets, and integrates more functions that are not related to the container's external communication (for example, reverse proxy function, load balancing function, access control function, etc.), resulting in low data packet processing performance and waste of resources. Summary of the invention

[0003] The embodiments of the present application provide a method, device, electronic device and storage medium for communicating between a container and an external network to solve the problems existing in the related art.

[0004] In a first aspect, an embodiment of the present application provides a method for a container to communicate with an external network, comprising: obtaining a first data packet sent by a container to an external network, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port; converting the container information into public network information through a program for network address conversion set in an operating system kernel, wherein the public network information includes a public network address and a public network port available on the public network address, and recording a mapping relationship between the container information and the public network information; sending the converted first data packet to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

[0005] In a second aspect, an embodiment of the present application provides a method for communication between an external network and a container, comprising: obtaining a third data packet sent by the container, the third data packet recording public network information and external network information, the public network information being obtained by converting the container information through a program for network address conversion set in the operating system kernel of the container, the container information comprising a container address and a container port, the public network information comprising a public network address of the container and a public network port available on the public network address, and the external network information comprising an external network address and an external network port; sending a fourth data packet to the container in response to the third data packet, the fourth data packet recording the public network information and the external network information.

[0006] In a third aspect, an embodiment of the present application provides a device for a container to communicate with an external network, comprising: an acquisition unit, configured to acquire a first data packet sent by the container to the external network, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port; a processing unit, configured to convert the container information into public network information through a program for network address conversion set in an operating system kernel, wherein the public network information includes a public network address and a public network port available on the public network address, and record a mapping relationship between the container information and the public network information; a sending unit, configured to send the converted first data packet to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

[0007] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements any of the above methods when executing the computer program.

[0008] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the above is implemented.

[0009] Compared with the prior art, this application has the following advantages:

[0010] According to an embodiment of the present application, by deploying a program for network address translation on a single machine running a container, the container address and container port recorded in the data packet sent by the container are converted into a public network address and a public network port. After that, the converted data packet can be sent to an external network, and a data packet in response from the external network can be received based on the public network address and the public network port. The processing link of the data packet is shorter, the delay caused by the centralized gateway forwarding the data packet is saved, and the processing efficiency of the data packet is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments according to the present application and should not be regarded as limiting the scope of the present application.

[0012] Figure 1 is a flowchart showing a method for communicating between a container and an external network according to an embodiment of the present application;

[0013] Figure 2 is a schematic diagram showing a flow chart of a program for network address translation processing a data packet according to an embodiment of the present application;

[0014] Figure 3 is a schematic diagram showing a process of selecting a public network address to map all container addresses according to an embodiment of the present application;

[0015] Figure 4 is a schematic diagram showing a mapping relationship between storage container information and public network information and a process of searching for the mapping relationship according to an embodiment of the present application;

[0016] Figure 5 is a structural block diagram showing an apparatus for communicating between a container and an external network according to an embodiment of the present application; and

[0017] Figure 6 is a block diagram showing an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the concept or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary in nature and not restrictive.

[0019] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies of the embodiments of the present application. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0020] An embodiment of the present application provides a method 100 for communicating between a container and an external network. The method is applied to an electronic device running a container, such as a physical machine of a CDN node running a CDN container, or a server running other containers. The present application does not limit this. Figure 1 A method 100 for communicating between a container and an external network of the present application is described. Figure 1FIG. 1 is a flow chart showing a method for communicating between a container and an external network according to an embodiment of the present application. Figure 1 As shown, the method 100 for communicating between a container and an external network includes the following steps S101 to S103. Steps S101 to S103 will be described in detail below in conjunction with a specific embodiment.

[0021] First, proceed to step S101. In step S101, a first data packet sent by a container to an external network is obtained, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port.

[0022] The first data packet sent by the container to the external network records the container information and the external network information. The container information is the source information of the first data packet, including the container address (i.e., source address) and the container port (i.e., source port). The external network information is the destination information of the first data packet, including the external network address (i.e., destination address) and the external network port (i.e., destination port). The network address is divided into private addresses and public network addresses, each using an independent address space. The private address can be used in the private network, and the public network address can be used on the Internet. The private address includes multiple network segments, and the range of private addresses includes 10.0.0.0~10.255.255.255, 172.16.0.0~172.31.255.255, etc. The public network address also includes multiple network segments, and the range of public network addresses includes 1.0.0.0~9.255.255.255, 11.0.0.0~126.255.255.255, etc. The container address is a private address, and the external network address is a public address. The private address and the public network address cannot communicate with each other. Therefore, the container address needs to be converted into a public network address before the first data packet can be sent to the external network so that the container can communicate with the external network.

[0023] Next, proceed to step S102. In step S102, the container information is converted into public network information by a program for network address translation set in the operating system kernel, the public network information includes a public network address and a public network port available on the public network address, and a mapping relationship between the container information and the public network information is recorded.

[0024] In one embodiment, the method 100 further includes: injecting the program for network address translation into a hook point in a traffic control module of a kernel of an operating system.

[0025] In one embodiment, the operating system is a Linux operating system.

[0026] In one embodiment, the program for network address translation is an extended Berkeley Packet Filter (eBPF) program.

[0027] The kernel is the core of an operating system. It is the first layer of software expansion based on hardware. It provides the most basic functions of the operating system and is the basis for the operation of the operating system. The kernel is responsible for managing the system's processes, memory, device drivers, files, and network systems. To add new functions to the kernel (for example, the function of network address translation), it is usually necessary to modify the kernel source code and recompile or load kernel modules to implement it. The extended Berkeley Packet Filter (eBPF) program allows the program to run without modifying the kernel source code or adding additional kernel modules, providing a certain expansion capability for the kernel. That is, the eBPF program is a user-written program that can run in the Linux kernel.

[0028] The eBPF program is an event-driven model. The Linux kernel provides various hook points to inject the eBPF program into these hook points. The flow control module of the Linux kernel has two hook points, namely, the ingress hook point and the egress hook point. When the eBPF program is injected into the ingress hook point and the egress hook point, when data packets pass through these two hook points, the eBPF program can process the data packets sent by the container when accessing the external network and the data packets received by the container from the external network. In order to inject the eBPF program into the hook points in the flow control module of the Linux kernel, you first need to create a clsact type qdisc (Linux queueing discipline) on the network card interface. The clsact type qdisc provides two hook points (i.e., the ingress hook point and the egress hook point). These two hook points are located on the key sending and receiving paths of the data path. Each data packet sent and received by the container will pass through these two hook points. Then, classifiers (filters) are created at the ingresshook point and the egress hook point, and the eBPF program is injected. Before the eBPF program is executed, it is verified by the verifier in the kernel to ensure that the program will not crash the operating system. The verifier creates a directed acyclic graph for the instructions to be executed in the eBPF program to ensure that the program does not contain unreachable instructions; then the execution process of the instructions is simulated to ensure that invalid instructions are not executed, which can ensure security.

[0029] According to the embodiments of the present application, network address translation is implemented by using an eBPF program set in the Linux operating system kernel, so that the kernel's data packet processing capabilities can be safely and flexibly expanded without modifying the kernel source code.

[0030] After the program for network address translation is injected into the operating system kernel, the program for network address translation can be used to convert the container information recorded in the first data packet sent by the container to the external network into public network information, that is, to convert the container address into a public network address, and to convert the container port into a public network port available on the public network address, and record the mapping relationship between the container information and the public network information.

[0031] In one embodiment, the first data packet is a data packet processed by the network layer in the kernel network protocol stack, and sending the converted first data packet to the external network port on the external network address includes: sending the converted first data packet to the external network port on the external network address through the device layer in the kernel network protocol stack.

[0032] After the program for network address translation converts the container information in the first data packet processed by the network layer in the kernel network protocol stack into public network information, the converted first data packet is sent to the external network port on the external network address through the device layer in the kernel network protocol stack. Figure 2 Describe the flow of data packet processing by the program used for network address translation, Figure 2 FIG. 1 is a flow chart showing the processing of data packets by a program for network address translation according to an embodiment of the present application. Figure 2 As shown, the program for network address translation is set in the flow control module of the kernel, and the flow control module is located at the link layer of the kernel network protocol stack. In the packet sending direction, after the first data packet sent by the container is processed by other layers and the network layer in the kernel network protocol stack, the program for network address translation will process the first data packet and submit the processed first data packet to the device layer in the kernel network protocol stack, so as to send the processed first data packet to the external network port on the external network address. In the packet receiving direction, after the device layer in the kernel network protocol stack receives the second data packet sent by the external network in response to the first data packet, the program for network address translation will process the second data packet and submit the processed second data packet to the network layer and other layers in the kernel network protocol stack for processing, so as to send the processed second data packet to the container.

[0033] In one embodiment, the public network address is selected from a public network address pool.

[0034] The program for network address translation maintains a public address pool, and multiple public addresses in the public address pool can be used to replace the container address to enable communication between the container and the external network. The program for network address translation converts the container address to any public address selected from the public address pool. For example, the container address in the first data packet is 10.0.0.1, the container port is 1024, the external network address is 61.144.249.229, and the external network port is 80. The addresses in the public network address pool are 219.134.180.11 to 219.134.180.20. The program for network address translation selects the first available public network address 219.134.180.11 from the public network address pool, replaces the container address with this public network address, and finds an available port of this public network address, for example, 2001, and replaces the container port with this port. The source address and source port of the first data packet after conversion are 219.134.180.11:2001, and the destination address and port remain unchanged. After the conversion, it is necessary to record the mapping relationship between the container information and the public network information so that when a data packet is received in response to the external network, the data packet can be sent to the corresponding container. For example, the container address and container port 10.0.0.1:1024 are converted to the public network address and public network port 219.134.180.11:2001. It is necessary to record the mapping relationship between 10.0.0.1:1024 and 219.134.180.11:2001.

[0035] In one embodiment, when multiple containers communicate with an external network, a public network address is selected from the public network address pool to map all container addresses. In order to save the available public network addresses in the public network address pool, the same public network address can be selected to map all container addresses, and different ports can be used to distinguish different containers. Figure 3 Describes the process of selecting a public network address to map all container addresses. Figure 3 1 is a schematic diagram showing a process of selecting a public network address to map all container addresses according to an embodiment of the present application. Figure 3 As shown, there are multiple containers communicating with the external network. The program used for network address translation selects the same public network address to map all container addresses and uses different ports to distinguish different containers.

[0036] In another embodiment, when multiple containers communicate with an external network, multiple public network addresses are selected from a public network address pool to map all container addresses.

[0037] In one embodiment, recording the mapping relationship between the container information and the public network information includes: querying a first value corresponding to the container information and the external network information through a first hash table; and storing the first value and the mapping relationship in a dictionary in the form of a key-value pair.

[0038] The following will refer to Figure 4 Describe the processing process of the mapping relationship between storage container information and public network information. Figure 4 1 is a schematic diagram showing the mapping relationship between storage container information and public network information and the process of searching for the mapping relationship according to an embodiment of the present application. Figure 4 As shown, the first hash table is a hash table in the direction of the container sending data packets. The hash table is a data structure that directly accesses the storage location in the memory according to the key. In other words, the hash table accesses the record by mapping the required query data to a position in the table by calculating a function of a key value. The container information and the external network information as a whole are input into the first hash table as a key, and the first value corresponding to the key can be obtained. Then, the mapping relationship between the first value and the container information and the public network information can be stored in the dictionary. The key input into the first hash table is the container information and the external network information as a whole, that is, the container address, the container port, the external network address and the external network port. For example, the container information includes the container address 10.0.0.1 and the container port 1024, the external network information includes the external network address 61.144.249.229 and the external network port 80, the container address and the container port 10.0.0.1:1024 are converted to the public network address and the public network port 219.134.180.11:2001, then the key input to the first hash table is 10.0.0.1+1024+61.144.249.229+80, and the first value corresponding to the key can be obtained by searching the first hash table with the key. The first value can be 4, for example, with 4 as the key, and the mapping relationship between the container information and the public network information (i.e. 10.0.0.1:1024->219.134.180.11:2001) as the value, which is stored in the dictionary. A dictionary is a data structure that stores data in the form of key-value pairs. According to the above example description, in the dictionary, when the key is 4, the corresponding value is 10.0.0.1:1024—>219.134.180.11:2001.

[0039] Next, the process proceeds to step S103. In step S103, the converted first data packet is sent to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

[0040] After converting the source information in the first data packet from container information to public network information, the first data packet can be sent to the external network port on the external network address so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

[0041] In one embodiment, the method 100 for communicating between the container and the external network further includes: acquiring the second data packet received by the container, the second data packet recording the external network information and the public network information; querying the mapping relationship in the dictionary through the program for network address translation, and converting the public network address into the container address based on the mapping relationship, and converting the public network port into the container port; and sending the converted second data packet to the container port at the container address.

[0042] The second data packet is a data packet sent by the external network to the container in response to the first data packet. The second data packet records the external network information and the public network information. The external network information is the source information of the second data packet, and the public network information is the destination information of the second data packet. After receiving the second data packet, the public network information needs to be converted into container information through the program used for network address translation, and the second data packet is sent to the container port on the container address.

[0043] In one embodiment, querying the mapping relationship in the dictionary includes: querying the second value corresponding to the external network information and the public network information through a second hash table, the second value is equal to the first value; using the second value as a key to query the mapping relationship in the dictionary.

[0044] The following will refer to Figure 4 This section describes the process of finding the mapping relationship between container information and public network information. Figure 4As shown, the second hash table is a hash table in the direction of receiving data packets by the container. The external network information and the public network information as a whole are input into the second hash table as a key, and the second value corresponding to the key can be obtained, and the second value is equal to the first value. The first value and the mapping relationship are stored in the dictionary as a key-value pair. Therefore, the mapping relationship can be found by searching the dictionary for the value corresponding to the second value. The key input into the second hash table is the external network information and the public network information as a whole, that is, the external network address, the external network port, the public network address and the public network port. For example, the first value is 4, the mapping relationship between the container information and the public network information is 10.0.0.1:1024->219.134.180.11:2001, the external network information includes the external network address 61.144.249.229 and the external network port 80, and the public network information includes the public network address 219.134.180.11 and the public network port 2001. The key input to the second hash table is 61.144.249.229+80+219.134.180.11+2001, and the second value corresponding to the key can be obtained by searching the second hash table with the key. Since the second value is equal to the first value, the second value is also 4. Using 4 as the key, the corresponding value can be found in the dictionary (i.e., 10.0.0.1:1024->219.134.180.11:2001). Then, according to the mapping relationship, the container address and container port corresponding to the public network address and public network port in the second data packet can be obtained as 10.0.0.1:1024.

[0045] After obtaining the mapping relationship between the public network information and the container information, the public network address can be converted into a container address and the public network port can be converted into a container port according to the mapping relationship, and the converted data packet can be sent to the container port of the container address.

[0046] According to an embodiment of the present application, the first value output by the first hash table based on the container information and the external network information is equal to the second value output by the second hash table based on the external network information and the public network information, and the mapping relationship between the corresponding container information and the public network information can be quickly found based on the second value.

[0047] In one embodiment, the method 100 for communicating between a container and an external network further includes: determining, by the program for network address translation, that the container address is in a container address whitelist and that the external network address is in an external network address whitelist.

[0048] The container address whitelist is a list of container addresses that can access external networks, and the external network address whitelist is a list of external network addresses that can be accessed by containers. The container address whitelist and the external network address whitelist are dynamically set by the control layer of the container network. The program used for network address translation updates the container address whitelist and the external network address whitelist according to the settings of the control layer. According to the nature of the services running in the container, some containers do not have service requirements for accessing external networks, and network address translation is not required for these containers. Therefore, before performing network address translation, it is necessary to ensure that the container address is in the container address whitelist. Due to network security risks in external networks, the communication between containers and external networks with network security risks may be subject to network attacks. Therefore, before performing network address translation, it is also necessary to ensure that the external network address is in the external network address whitelist. Network address translation can only be performed when the container address is in the container address whitelist and the external network address is in the external network address whitelist.

[0049] According to the embodiment of the present application, determining that the container address is in the container address whitelist and determining that the external network address is in the external network address whitelist can effectively ensure the security of communication between the container and the external network.

[0050] In one embodiment, the value of the dictionary also includes communication protocol information and network card information.

[0051] In addition to the mapping relationship between container information and public network information, the dictionary value may also include communication protocol information and network card information when the first data packet flows to the external network. The communication protocol information can be used to determine which communication protocol (for example, TCP protocol, UDP protocol, or ICMP protocol, etc.) is used when the first data packet flows to the external network. Different communication protocols have different implementation methods. The network card information is used to identify which network card or virtual network card the first data packet passes through when flowing to the external network. The program used for network address translation needs to be mounted on a network card or virtual network card to implement the above-mentioned network address translation function.

[0052] An embodiment of the present application also provides a method for communication between an external network and a container, the method is applied to an electronic device running an external network, the method comprising: obtaining a third data packet sent by the container, the third data packet recording public network information and external network information, the public network information being obtained by converting the container information through a program for network address conversion set in the operating system kernel of the container, the container information comprising a container address and a container port, the public network information comprising the public network address of the container and a public network port available on the public network address, and the external network information comprising an external network address and an external network port; and sending a fourth data packet to the container in response to the third data packet, the fourth data packet recording the public network information and the external network information.

[0053] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides a device 500 for communicating between a container and an external network. The device is deployed on an electronic device running a container, for example, a physical machine of a CDN node running a CDN container, or a server running other containers. The present application does not limit this. Figure 5 The device 500 for communicating between a container and an external network of the present application is described. Figure 5 1 is a block diagram showing a device for communicating between a container and an external network according to an embodiment of the present application. Figure 5 As shown, the device 500 for communicating between a container and an external network may include: an acquiring unit 501 , a processing unit 502 , and a sending unit 503 .

[0054] The acquisition unit 501 is configured to acquire a first data packet sent by the container to an external network, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port.

[0055] The acquisition unit 501 may be a component in the electronic device running the container, and the electronic device running the container acquires the first data packet sent by the container to the external network through the component.

[0056] The processing unit 502 is configured to convert the container information into public network information through a program for network address translation set in the operating system kernel, wherein the public network information includes a public network address and a public network port available on the public network address, and record a mapping relationship between the container information and the public network information.

[0057] The processing unit 502 may be a component in an electronic device running a container, and the electronic device running a container converts the container information into public network information through a program for network address conversion set in an operating system kernel through the component.

[0058] The sending unit 503 is configured to send the converted first data packet to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

[0059] The sending unit 503 may be a component in the electronic device running the container, and the electronic device running the container sends the first data packet to the external network port on the external network address through the component.

[0060] In one embodiment, the first data packet is a data packet processed by the network layer in the kernel network protocol stack, and the sending unit 503 is further configured to send the converted first data packet to the external network port on the external network address through the device layer in the kernel network protocol stack.

[0061] In one embodiment, the apparatus 500 for communicating between a container and an external network further includes an injection unit configured to inject the program for network address translation at a hook point in a traffic control module of a kernel of an operating system.

[0062] In one embodiment, the processing unit 502 is further configured to query the first value corresponding to the container information and the external network information through a first hash table; and store the first value and the mapping relationship in a dictionary in a key-value pair manner.

[0063] In one embodiment, the device 500 for communicating between a container and an external network further includes a second data packet processing unit. The second data packet processing unit is configured to obtain the second data packet received by the container, the second data packet recording the external network information and the public network information; query the mapping relationship in the dictionary through the program for network address translation, and convert the public network address to the container address based on the mapping relationship, and convert the public network port to the container port; and send the converted second data packet to the container port on the container address.

[0064] In one embodiment, the second data packet processing unit is further configured to query the second value corresponding to the external network information and the public network information through a second hash table, and the second value is equal to the first value; use the second value as a key to query the mapping relationship in the dictionary.

[0065] In one embodiment, the apparatus 500 for communicating between a container and an external network further comprises a determining unit configured to determine, through the program for network address translation, that the container address is in a container address whitelist and that the external network address is in an external network address whitelist.

[0066] In one embodiment, the public network address is selected from a public network address pool.

[0067] In one embodiment, the value of the dictionary also includes communication protocol information and network card information.

[0068] According to an embodiment of the present application, by deploying a program for network address translation on a single machine running a container, the container address and container port recorded in the data packet sent by the container are converted into a public network address and a public network port. The converted data packet can be sent to an external network, and a data packet responded by the external network can be received based on the public network address and the public network port. The processing link of the data packet is shorter, the delay of gateway forwarding is saved, and the processing efficiency of the data packet is improved.

[0069] According to the embodiments of the present application, network address translation is implemented by using an eBPF program set in the Linux operating system kernel, so that the kernel's data packet processing capabilities can be safely and flexibly expanded without modifying the kernel source code.

[0070] According to an embodiment of the present application, the first value output by the first hash table based on the container information and the external network information is equal to the second value output by the second hash table based on the external network information and the public network information, and the mapping relationship between the corresponding container information and the public network information can be quickly found based on the second value.

[0071] According to the embodiment of the present application, determining that the container address is in the container address whitelist and determining that the external network address is in the external network address whitelist can effectively ensure the security of communication between the container and the external network.

[0072] The functions of each module in each device in the embodiments of the present application can be found in the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0073] Figure 6 FIG. 1 is a block diagram of an electronic device used to implement an embodiment of the present application. Figure 6 As shown, the electronic device includes: a memory 601 and a processor 602. The memory 601 stores a computer program that can be run on the processor 602. When the processor 602 executes the computer program, the method in the above embodiment is implemented. The number of the memory 601 and the processor 602 can be one or more.

[0074] The electronic device also includes:

[0075] The communication interface 603 is used to communicate with external devices and perform data exchange transmission.

[0076] If the memory 601, the processor 602 and the communication interface 603 are implemented independently, the memory 601, the processor 602 and the communication interface 603 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0077] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.

[0078] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0079] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0080] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0081] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the Advanced RISC Machines (ARM) architecture.

[0082] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting description, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM).

[0083] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0084] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0085] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0086] Any process or method described in the flow chart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0087] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or used in combination with these instruction execution systems, devices or apparatuses.

[0088] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0089] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0090] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope recorded in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for a container to communicate with an external network, comprising: Obtain a first data packet sent by the container to an external network, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port; The container information is converted into public network information by a program for network address translation set in the operating system kernel, wherein the public network information includes a public network address and a public network port available on the public network address, and a mapping relationship between the container information and the public network information is recorded; The converted first data packet is sent to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

2. The method according to claim 1, wherein: The first data packet is a data packet processed by the network layer in the kernel network protocol stack, and sending the converted first data packet to the external network port on the external network address includes: sending the converted first data packet to the external network port on the external network address through the device layer in the kernel network protocol stack.

3. The method according to claim 1 or 2, further comprising: The program for network address translation is injected into the hook point in the flow control module of the kernel of the operating system.

4. The method according to claim 3, wherein: The recording of the mapping relationship between the container information and the public network information includes: Querying a first value corresponding to the container information and the external network information through a first hash table; The first value and the mapping relationship are stored in a dictionary in the form of key-value pairs.

5. The method according to claim 4, further comprising: Acquire the second data packet received by the container, where the second data packet records the external network information and the public network information; By using the program for network address translation, the mapping relationship is searched in the dictionary, and based on the mapping relationship, the public network address is converted into the container address, and the public network port is converted into the container port; The converted second data packet is sent to the container port at the container address.

6. The method according to claim 5, wherein: The querying the mapping relationship in the dictionary includes: Querying a second value corresponding to the external network information and the public network information through a second hash table, where the second value is equal to the first value; The mapping relationship is searched in the dictionary using the second value as a key.

7. The method according to claim 3, further comprising: By means of the program for network address translation, it is determined that the container address is in a container address whitelist and that the external network address is in an external network address whitelist.

8. The method according to claim 4, wherein: The dictionary value also includes communication protocol information and network card information.

9. A method for communicating between an external network and a container, comprising: Obtain a third data packet sent by the container, wherein the third data packet records public network information and external network information, wherein the public network information is obtained by converting the container information through a program for network address conversion set in the operating system kernel of the container, wherein the container information includes a container address and a container port, the public network information includes a public network address of the container and a public network port available on the public network address, and the external network information includes an external network address and an external network port; A fourth data packet is sent to the container in response to the third data packet, wherein the fourth data packet records the public network information and the external network information.

10. A device for communicating between a container and an external network, comprising: an acquiring unit configured to acquire a first data packet sent by the container to an external network, wherein the first data packet records container information and external network information, wherein the container information includes a container address and a container port, and the external network information includes an external network address and an external network port; a processing unit configured to convert the container information into public network information through a program for network address translation set in an operating system kernel, the public network information including a public network address and a public network port available on the public network address, and record a mapping relationship between the container information and the public network information; The sending unit is configured to send the converted first data packet to the external network port on the external network address, so as to receive a second data packet in response to the first data packet through the public network address and the public network port.

11. An electronic device comprising a memory, a processor and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 8 when executing the computer program.

12. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images