Container monitoring method and host machine

Abstract

The invention discloses a container monitoring method and a host machine, a first container based on a client kernel, a second container based on a host machine kernel, a first agent program and a trusted module are deployed on the host machine, and the method comprises the steps that in response to starting of the host machine, the trusted module generates a plurality of first metric values according to a plurality of first starting objects of the host machine, the multiple first starting objects comprise a first agent program, and the first metric value is used for determining whether the starting process of the host machine is normal or not; in response to starting of the first container / the second container, the first agent program generates a plurality of second metric values / third metric values according to a plurality of second starting objects / third starting objects corresponding to the first container / the second container, and sends the second metric values / third metric values to the trusted module; the determination module is used for determining whether the starting process of the first container / second container is normal; the plurality of second starting objects comprise a second agent program which is based on the client kernel and is used for measuring the running object in the first container after the first container is started.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer virtualization technology, and more particularly, to a method for monitoring a container and a host machine. Background Art

[0002] Container technology is a lightweight operating system virtualization technology that is widely used in cloud computing environments. With the development of container technology, the types of containers have become diversified. Containers used in cloud computing environments can generally be divided into two categories: one is a container that runs based on the host operating system kernel, and the other is a container that runs based on an independent kernel outside the host operating system kernel. Current cloud computing environments often deploy these two types of containers in a mixed manner to better balance computing performance and security performance. However, the current monitoring solutions for container operation are usually only monitoring solutions for the operation of a single type of container, and there is still a lack of efficient monitoring solutions for mixed deployment containers. Therefore, a new monitoring method for mixed deployment containers is needed. Summary of the invention

[0003] The embodiments in this specification are intended to provide a method for monitoring containers and a host machine, which can monitor the entire life cycle of hybrid deployed host kernel-based containers and client kernel-based containers, so as to timely discover and handle potential security issues in the entire life cycle of hybrid deployed containers, thereby improving the security of hybrid deployed containers.

[0004] According to a first aspect, a method for monitoring a container is provided, wherein a first container based on a client kernel, a second container based on a host kernel, a first agent program, and a trusted module are deployed on a host machine of the container, and the method comprises:

[0005] In response to the startup of the host machine, the trusted module generates a plurality of corresponding first measurement values ​​according to a plurality of first startup objects corresponding to the host machine, wherein the plurality of first startup objects include a first agent program; the first measurement values ​​are used to determine whether the startup process of the host machine is normal;

[0006] In response to the startup of the first container, the first agent generates a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and sends the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent based on a client kernel for measuring a running object corresponding to the first container after the first container is started;

[0007] In response to the startup of the second container, the first agent generates corresponding multiple third measurement values ​​according to multiple third startup objects corresponding to the second container, and sends the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

[0008] In a possible implementation, the method further includes:

[0009] After the first container is started, the second agent generates a plurality of corresponding fourth metric values ​​according to the plurality of first running objects corresponding to the first container, and transmits the fourth metric values ​​to the trusted module through the host machine, so as to determine whether the running state of the first running object is normal;

[0010] After the second container is started, the first agent generates corresponding multiple fifth measurement values ​​according to the multiple second running objects corresponding to the second container, and transmits the fifth measurement values ​​to the trusted module through the host machine to determine whether the running status of the second running object is normal.

[0011] In a possible implementation, the method further includes: if it is determined that the startup process of the host machine is abnormal, terminating the startup of the host machine; if it is determined that the startup process of the first container or the second container is abnormal, terminating the startup process of the first container or the second container.

[0012] In a possible implementation, the multiple first startup objects also include a basic input and output system, a boot loader, and a host kernel; the multiple third startup objects include a runtime process that the second container depends on and an image file corresponding to the second container.

[0013] In a possible implementation, the client kernel runs in a first virtual machine, and the multiple second startup objects further include a runtime process on which the second container depends and an image file corresponding to the first virtual machine;

[0014] In a possible implementation manner, the trusted module includes a plurality of first reference values ​​corresponding to the plurality of first startup objects, a plurality of second reference values ​​corresponding to the plurality of second startup objects, and a plurality of third reference values ​​corresponding to the plurality of third startup objects;

[0015] Determining whether the startup process of the host machine is normal, comprising: determining whether each first startup object is started normally according to a first metric value and a first reference value corresponding to each first startup object; if any first startup object among the plurality of first startup objects is not started normally, determining that the startup process of the host machine is abnormal; if all first startup objects are started normally, determining that the startup process of the host machine is normal;

[0016] Determining whether the startup process of the first container is normal, comprising: determining whether each second startup object is started normally according to a second measurement value and a second reference value corresponding to each second startup object; if any second startup object among the plurality of second startup objects is not started normally, determining that the startup process of the first container is abnormal; if all second startup objects are started normally, determining that the startup process of the first container is normal;

[0017] Determining whether the startup process of the first container is normal includes: determining whether each third startup object is started normally according to a third measurement value and a third reference value corresponding to each third startup object; if any third startup object among the plurality of third startup objects is not started normally, determining that the startup process of the second container is abnormal; if all the third startup objects are started normally, determining that the startup process of the second container is normal.

[0018] In a possible implementation manner, the trusted module includes a plurality of fourth reference values ​​corresponding to the plurality of first operating objects respectively, and a plurality of fifth reference values ​​corresponding to the plurality of second operating objects respectively;

[0019] Determining whether the operation process of the first operation object is normal includes: determining whether the operation state of each first operation object is normal according to the fourth measurement value and the fourth reference value corresponding to each first operation object;

[0020] Determining whether the operation process of the second operation object is normal includes: determining whether the operation status of each second operation object is normal according to the fifth measurement value and the fifth reference value corresponding to each second operation object.

[0021] In a possible implementation, the method further includes:

[0022] If it is determined that the running state of any one of the first running objects is abnormal, the running state of the first container is determined to be abnormal; if it is determined that the running process of any one of the second running objects is abnormal, the running state of the two containers is determined to be abnormal.

[0023] In a possible implementation, the trusted module is a trusted platform control module or a trusted platform module configured in the host machine.

[0024] According to a second aspect, a host machine is provided, comprising a first container having a corresponding client kernel, a second container not having a corresponding client kernel, a first agent program and a trusted module, wherein:

[0025] a trusted module configured to, in response to the startup of the host machine, measure a plurality of first startup objects corresponding to the host machine and generate a plurality of corresponding first measurement values, wherein the plurality of objects include the first agent program; the first measurement values ​​are used to determine whether the startup process of the host machine is normal;

[0026] The first agent is configured to, in response to the startup of the first container, generate a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and send the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent based on a client kernel for measuring a running object corresponding to the first container after the first container is started;

[0027] The first agent program is further configured to, in response to the startup of the second container, generate corresponding multiple third measurement values ​​according to multiple third startup objects corresponding to the second container, and send the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

[0028] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0029] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0030] By utilizing one or more of the methods, host machines, computing devices, and storage media in each of the above aspects, the entire life cycle of hybrid deployed host kernel-based containers and client kernel-based containers can be monitored in real time, so that potential security issues in the entire life cycle of hybrid deployed containers can be discovered and handled in a timely manner, greatly improving the security of hybrid deployed containers throughout their entire life cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0032] Figure 1 A schematic diagram showing a scheme for monitoring a container;

[0033] Figure 2 A schematic diagram showing another approach to monitoring a container;

[0034] Figure 3 A schematic diagram showing a method for monitoring a container according to an embodiment of the present specification;

[0035] Figure 4 A flow chart showing a method for monitoring a container according to an embodiment of this specification;

[0036] Figure 5 A schematic diagram showing whether the host machine is started normally according to an embodiment of the present specification;

[0037] Figure 6 A structural diagram of a host machine according to an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0038] The solution provided in this invention book will be described below in conjunction with the accompanying drawings.

[0039] As mentioned above, container technology is a lightweight operating system virtualization technology that is widely used in cloud computing environments. With the development of container technology, the types of containers have become diversified. Containers used in cloud computing environments can be generally divided into two categories: one is a container that runs based on the host operating system kernel (Host Kernel, or simply the host kernel), and the other is a container that runs based on an independent kernel other than the host operating system kernel.

[0040] Among them, containers running on the host operating system kernel usually share the host kernel. Applications in the container run on the existing kernel of the host, and there is no need to install and maintain a kernel for each container separately. Containers can achieve resource isolation and relative independence of the environment through namespaces and control groups provided by the kernel. For example, namespaces allow processes in different containers to see different network configurations, file system mount points, etc. However, since containers share the host kernel, for example, a malicious program in a container breaks through the isolation boundary of the container through a kernel vulnerability, it may affect the security of other containers or even the host.

[0041] Containers that run on independent kernels usually have independent guest kernels. Each container or the virtual machine where the container is located has an independent kernel configured. Because in addition to the isolation of the container itself, there is also additional isolation provided by the guest kernel, which makes the isolation between the container and the host and other containers more thorough and more secure. For example, even if there is a problem with the kernel of the container itself, it usually does not directly affect the host or containers in other virtual machines. However, independent kernels occupy more computing resources, and each guest kernel requires a certain amount of memory, disk and other resources.

[0042] Therefore, generally speaking, containers based on the client kernel are more secure, while containers based on the host kernel consume less computing resources and have higher operating performance. In order to better balance security and computing performance, current cloud computing environments often deploy these two types of containers in a mixed manner. For example, in a business system, the order processing subsystem requires high performance to quickly process a large number of orders, so a container based on the host kernel can be used; while the financial subsystem involves a large amount of confidential data and hopes to obtain better security, so a container based on the client kernel can be used.

[0043] However, current monitoring solutions for container operation are usually only for the operation of a single type of container, and there is still a lack of efficient monitoring solutions for mixed deployment of containers. Figure 1 A schematic diagram showing a solution for monitoring a container is shown. Figure 1 As shown, the process code corresponding to the application contained in the container running on the host can be measured by a measurement program running on the host operating system, and whether the operation of the application contained in the container is normal can be determined based on the measurement results. However, the problem with this solution is that, first, it is impossible to monitor the application process contained in the container running on an independent kernel other than the host operating system kernel. Second, it is also impossible to monitor the entire process from the start of the host and the start of the container to the operation of the application in the container, and there are monitoring vulnerabilities that can be attacked.

[0044] Figure 2 A schematic diagram showing another method for monitoring a container is shown. Figure 2As shown, after the container running on the operating system (on a physical machine or virtual machine) is started, the container's mounting path can be obtained. The mounting path refers to the establishment of an association relationship between a directory or a specific part of the file system on the physical machine or virtual machine running the container and the directory inside the container when the container is running, so that the directory inside the container can directly access and use the corresponding directory or file resources on the physical machine or virtual machine. Then, scan the files under the mounting path of the container, and determine whether the running status of the container is normal by measuring the scanned files. However, the problem with this solution is that, first, in the scenario of mixed container operation, it is impossible to distinguish which container the file belongs to, so it is difficult to use in the scenario of mixed containers. Second, this solution usually stores the measurement value of the file in the extended attributes of the file, and the measurement value stored in the extended attributes of the file is easy to be tampered by attackers, and the security is not high. Third, this solution cannot monitor the entire process from the host startup and the container startup to the application running in the container, and there is a monitoring loophole.

[0045] In order to solve the above technical problems, the embodiments of this specification provide a method for monitoring a container. Figure 3 A schematic diagram of a method for monitoring a container according to an embodiment of the present specification is shown. Figure 3 As shown, for example, a container A that depends on the operation of the host kernel and a container B with a client kernel can be deployed on the host machine. When the host machine starts, a plurality of startup objects in the host machine startup process can be measured by a trusted module installed on the host machine motherboard, for example, to obtain a plurality of measurement values. For example, the Basic Input Output System (BIOS), the boot loader, the host kernel, and the first agent that depends on the host kernel that are started in sequence can be measured to obtain their respective corresponding measurement values. The trusted module can determine whether the startup of the host machine is normal based on the respective corresponding reference values ​​of the basic input output system, the boot loader, and the host kernel that are saved in advance, and the respective corresponding measurement values. In one example, if it is determined that the startup of the host machine is abnormal, the startup of the host machine can be terminated.

[0046] After the host machine is started, when container A is started, the first agent program can measure multiple startup objects in the startup process of container A, obtain corresponding multiple measurement values ​​and send them to the trusted module. Multiple startup objects can be objects that the startup process of container A depends on, accesses, loads, calls or executes. Thus, the dependency library files of container A, the daemon or management process of container A, the image file of container A and the configuration file of container A can be measured to obtain their respective corresponding measurement values. The trusted module can determine whether the startup of container A is normal based on the pre-saved corresponding benchmark values ​​of the dependency library files, daemon or management processes, image files and configuration files of container A, and their respective corresponding measurement values. After container A is started, the first agent program can measure the application (running object) in container A, and send the obtained measurement value to the trusted module to determine whether the application in container A is running normally, and then determine whether the operation of container A is normal.

[0047] After the host machine is started, when container B is started, the first agent can measure multiple startup objects in the startup process of container B, obtain corresponding multiple measurement values ​​and send them to the trusted module. The multiple startup objects may include the dependency library file of container B, the daemon or management process of container B, the image file of the virtual machine that loads the client kernel, and the second agent. Thus, these startup objects can be measured separately to obtain their respective corresponding measurement values. The trusted module can determine whether the startup of container B is normal based on the pre-saved benchmark values ​​corresponding to each of these startup objects and their respective corresponding measurement values. After container B is started, the second agent can measure the application (running object) in container B and send the obtained measurement value to the trusted module to determine whether the application in container B is running normally, and then determine whether the operation of container B is normal.

[0048] The advantages of this method are: first, it provides a monitoring solution for containers deployed in a mixed manner on a host machine. It can monitor the entire life cycle of mixed-deployment containers, from the host machine startup process, to the startup process of containers based on the host kernel and containers based on the client kernel, to the running status of containers based on the host kernel and containers based on the client kernel after startup, thereby forming a monitoring of the entire life cycle of mixed-deployment containers. Thus, potential security issues existing in the entire life cycle of container operation can be monitored, and potential security issues can be dealt with in a timely manner, greatly improving the security of mixed-deployment containers in the entire life cycle. Second, based on trusted computing, the host machine startup process, to the startup process of containers based on the host kernel and containers based on the client kernel, to the running status of containers based on the host kernel and containers based on the client kernel after startup are measured, thereby improving the security and reliability of the process of determining potential security issues based on the measurement results.

[0049] Figure 4 A flowchart of a method for monitoring a container according to an embodiment of the present specification is shown. A first container based on a client kernel, a second container based on a host kernel, a first agent program, and a trusted module are deployed on the host machine of the container. Figure 4 As shown, the method comprises at least the following steps:

[0050] Step S401, in response to the startup of the host machine, the trusted module generates corresponding multiple first metric values ​​according to multiple first startup objects corresponding to the host machine, wherein the multiple first startup objects include a first agent program; the first metric values ​​are used to determine whether the startup process of the host machine is normal;

[0051] Step S403, in response to the startup of the first container, the first agent generates a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and sends the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent based on the client kernel for measuring the running object corresponding to the first container after the first container is started;

[0052] Step S405, in response to the startup of the second container, the first agent generates corresponding multiple third measurement values ​​according to the multiple third startup objects corresponding to the second container, and sends the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

[0053] First, in step S401, in response to the startup of the host machine, the trusted module generates corresponding multiple first metric values ​​according to multiple first startup objects corresponding to the host machine. The multiple first startup objects may include a first agent program, and the first metric values ​​may be used to determine whether the startup process of the host machine is normal.

[0054] The host is usually a computer with physical resources (such as CPU, memory, disk space, network interface, etc.) for running containers. In different embodiments, the host can be a physical computer or a logical computer allocated with physical resources. A trusted module is a module that can be used for trusted computing. Trusted computing is mainly achieved by building a root of trust (RoT) on a computer hardware platform and establishing a trusted environment for a computer system based on the root of trust, so that each component in the system (including hardware and software) can be verified for its trustworthiness. In different embodiments, the specific implementation form of the trusted module may be different. In one embodiment, the trusted module may be, for example, a trusted platform control module (TPCM) or a trusted platform module (TPM) configured in the host. In another embodiment, the trusted module may also be a trusted execution environment (TEE) configured on the host.

[0055] In this step, after the host machine is started, the trusted module can generate corresponding multiple first metric values ​​according to the multiple first startup objects corresponding to the host machine. The multiple first startup objects can be multiple software, hardware or software and hardware combinations that the host machine starts in sequence during the startup process. In different embodiments, according to the specific configuration of the host machine, the specific objects included in the multiple first startup objects can be different. For example, in one embodiment, the multiple first startup objects can also include a basic input and output system (BIOS), a boot loader (BootLoader), and a host kernel (Host Kerne l). In an embodiment, the conventional startup process of the host machine, for example, may include the startup of the basic input and output system, the startup of the boot loader, the startup of the host kernel, and the startup of the first agent. In different embodiments, according to the multiple first startup objects, the specific manner of generating the corresponding multiple first metric values ​​can be different. In one embodiment, for example, a corresponding hash value can be generated for each first startup object as the first metric value corresponding to each startup object.

[0056] The first measurement value can be used to determine whether the startup process of the host machine is normal. In different embodiments, the specific method of determining whether the startup process of the host machine is normal may be different according to the first measurement value. In one embodiment, the trusted module may also include multiple first reference values ​​corresponding to the multiple first startup objects. Thus, it can be determined whether each first startup object is started normally based on the first measurement value and the first reference value corresponding to each first startup object. Specifically, if any first startup object among the multiple first startup objects is not started normally, it can be determined that the startup process of the host machine is abnormal; if all first startup objects are started normally, it can be determined that the startup process of the host machine is normal.

[0057] After determining that the host machine startup process is abnormal, corresponding processing can be applied to the host machine startup process. In different embodiments, the processing methods applied can be different. In one embodiment, if it is determined that the host machine startup process is abnormal, the host machine startup can be terminated, such as Figure 5 shown.

[0058] After the host machine is started, in step S403, in response to the start of the first container, the first agent program can generate corresponding multiple second measurement values ​​according to multiple second startup objects corresponding to the first container, wherein the multiple second startup objects at least include a second agent program based on the client kernel for measuring the running object corresponding to the first container after the first container is started. And the second measurement value is sent to the trusted module for determining whether the startup process of the first container is normal.

[0059] In this step, after the host machine is started, the first container that depends on the guest kernel (Guest Kernel) can be started. In different embodiments, the first container can be a container of different specific types that depend on the guest kernel to run, and this specification does not limit this. The first agent program that has been started during the startup process of the host machine can generate corresponding multiple second metric values ​​according to the multiple second startup objects corresponding to the first container.

[0060] The second startup object may be an object that the startup process of the first container depends on, accesses, loads, calls or executes. In different embodiments, the multiple second startup objects corresponding to the first container may be different. In one embodiment, the client kernel may be a client kernel running in a specific virtual machine (e.g., the first virtual machine). The multiple second startup objects corresponding to the first container may include a runtime (Runtime) process (e.g., a daemon or management process of a container) that the second container depends on, an image file corresponding to the first virtual machine, a container process corresponding to the second container, and a second agent. The second agent may run based on the client kernel and is used to measure objects running in the first container after the first container is started.

[0061] The first agent program that has been started during the startup process of the host machine can generate corresponding multiple second measurement values ​​according to multiple second startup objects in this step and send them to the trusted module. Similar to generating the first measurement value, in different embodiments, the specific manner of generating the corresponding multiple second measurement values ​​according to the multiple second startup objects can be different. In one embodiment, for example, a corresponding hash value can be generated for each second startup object as the second measurement value corresponding to each second startup object.

[0062] The trusted module may determine whether the startup process of the first container is normal based on the received multiple second measurement values. In different embodiments, the specific manner of determining whether the startup of the first container is normal may be different. For example, in one embodiment, the trusted module may include multiple second reference values ​​corresponding to the multiple second startup objects. Furthermore, it may be determined whether each second startup object is started normally based on the second measurement value and the second reference value corresponding to each second startup object; if any second startup object among the multiple second startup objects is not started normally, it is determined that the startup process of the first container is abnormal; if all second startup objects are started normally, it is determined that the startup process of the first container is normal.

[0063] If it is determined that the startup of the first container is abnormal, a process may be applied to the startup process of the first container. In different embodiments, the specific processing methods applied may be different. For example, in one embodiment, if it is determined that the startup process of the first container is abnormal, the startup process of the first container may be terminated.

[0064] After the host machine is started, in step 405, in response to the startup of the second container, the first agent program can generate corresponding multiple third measurement values ​​according to the multiple third startup objects corresponding to the second container, and send the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

[0065] In this step, after the host machine is started, the second container that depends on the host kernel (Host Kernel) can be started. In different embodiments, the second container can be a container of different specific types that depend on the host kernel to run, and this specification does not limit this. The first agent program that has been started during the startup process of the host machine can generate corresponding multiple third metric values ​​according to the multiple third startup objects corresponding to the second container.

[0066] The third startup object may be an object that the startup process of the second container depends on, accesses, loads, calls or executes. In different embodiments, the multiple third startup objects corresponding to the second container may be different. In one embodiment, the client kernel may be a client kernel running in a specific virtual machine (e.g., the first virtual machine). The multiple second startup objects corresponding to the second container may include a runtime process that the second container depends on and an image file corresponding to the second container.

[0067] The first agent program that has been started during the startup process of the host machine can generate corresponding multiple third measurement values ​​according to multiple third startup objects in this step and send them to the trusted module. Similar to generating the first measurement value, in different embodiments, the specific manner of generating corresponding multiple third measurement values ​​according to multiple third startup objects can be different. In one embodiment, for example, a corresponding hash value can be generated for each third startup object as the third measurement value corresponding to each third startup object.

[0068] The trusted module can determine whether the startup process of the first container is normal based on the received multiple second measurement values. In different embodiments, the specific method of determining whether the startup of the first container is normal may be different. For example, in one embodiment, the trusted module may include multiple third reference values ​​corresponding to the multiple third startup objects respectively; in one embodiment, it can be determined whether each third startup object is started normally based on the third measurement value and the third reference value corresponding to each third startup object; if any third startup object among the multiple third startup objects is not started normally, it is determined that the startup process of the second container is abnormal; if all third startup objects are started normally, it is determined that the startup process of the second container is normal.

[0069] If it is determined that the startup of the second container is abnormal, a process may be applied to the startup process of the second container. In different embodiments, the specific processing methods applied may be different. For example, in one embodiment, if it is determined that the startup process of the second container is abnormal, the startup process of the second container may be terminated.

[0070] It should be noted that step S403 and step S405 are not limited to being performed sequentially. In different embodiments, step S403 and step S405 can be performed in any order or in parallel.

[0071] After the first container is started, in order to detect whether the running state of the first container is safe, in one embodiment, after the first container is started, the second agent can generate corresponding multiple fourth measurement values ​​according to multiple first running objects corresponding to the first container, and transmit the fourth measurement values ​​to the trusted module through the host machine to determine whether the running process of the first running object is normal. Furthermore, if it is determined that the running state of any one of the first running objects is abnormal, the running state of the first container is determined to be abnormal.

[0072] In different embodiments, the first running object corresponding to the first container may be different. For example, it may be multiple applications running in the first container. In one embodiment, the trusted module may include multiple fourth reference values ​​corresponding to the multiple first running objects. Furthermore, it may be determined whether the running process of the first running object is normal based on the fourth measurement value and the fourth reference value corresponding to the first running object.

[0073] After the second container is started, in order to detect whether the running state of the second container is safe, in one embodiment, after the second container is started, the first agent can generate corresponding multiple fifth metric values ​​according to multiple second running objects corresponding to the second container, and transmit the fifth metric values ​​to the trusted module through the host machine to determine whether the running process of the second running object is normal. If it is determined that the running state of any second running object is abnormal, then the running state of the second container is determined to be abnormal.

[0074] In different embodiments, the second running object corresponding to the second container may be different. For example, it may be multiple applications running in the second container. In one embodiment, the trusted module may also include multiple fifth reference values ​​corresponding to the multiple second running objects. Furthermore, it may be determined whether the running process of the second running object is normal based on the fifth measurement value and the fifth reference value corresponding to the second running object.

[0075] In one embodiment, after the first container / the second container is started, the first agent program may also generate corresponding metric values ​​according to the objects on which the first container / the second container itself depends, such as one or more of the container runtime process, virtual machine process, executable and linkable format (elf) file, shared object (SO) file, and kernel object (KO) file on which the first container / the second container depends. And according to the obtained metric values, it is determined whether the running state of the first container / the second container is normal.

[0076] After determining that the operation process of the first container / the second container is abnormal, the first container / the second container may be processed. In different embodiments, the specific manner of processing the first container / the second container may be different, for example, the operation of the first container / the second container may be terminated, or a warning message may be issued for its operation status. In different specific embodiments, the format of the warning message or the specific content used for the warning may be different, and this specification does not limit this.

[0077] In addition, in one embodiment, after the host machine is started, the first agent program may also measure the application running in the host machine, and determine whether the running status of the application running in the host machine is normal based on the obtained measurement value. For example, it is possible to determine whether the application running in the host machine is normal based on the reference value and measurement value corresponding to the application running in the host machine, and it is also possible to determine whether the application running in the host machine is normal and whether the operation of the host machine is normal. In one embodiment, after determining that the operation process of the host machine is abnormal, the operation process of the host machine may be processed, for example, the operation of the host machine may be terminated or a warning message may be issued for its operation status.

[0078] The above describes a method for monitoring a container provided by an embodiment of the present specification. Another embodiment of the present specification also provides a host machine. Figure 6 FIG. 2 shows a structural diagram of a host machine according to an embodiment of this specification. Figure 6 As shown, the host machine 600 may include a first container 61 based on a client kernel, a second container 62 based on a host kernel, a first agent program 63, and a trusted module 64.

[0079] The trusted module 64 is configured to generate a plurality of first metric values ​​corresponding to the host machine in response to the startup of the host machine, according to a plurality of first startup objects corresponding to the host machine, wherein the plurality of first startup objects include a first agent program; the first metric values ​​are used to determine whether the startup process of the host machine is normal;

[0080] The first agent program 63 is configured to, in response to the startup of the first container, generate a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and send the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent program based on a client kernel for measuring the running object corresponding to the first container after the first container is started;

[0081] The first agent program 63 is further configured to, in response to the startup of the second container, generate corresponding multiple third measurement values ​​according to multiple third startup objects corresponding to the second container, and send the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

[0082] On another aspect, the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the above methods.

[0083] On another aspect, the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, any one of the above methods is implemented.

[0084] It should be understood that the descriptions such as “first” and “second” in this article are only used to distinguish similar concepts for the sake of simplicity of description and do not have any other limiting effect.

[0085] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0086] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for monitoring a container, wherein a first container based on a client kernel, a second container based on a host kernel, a first agent program, and a trusted module are deployed on a host machine of the container, the method comprising: In response to the startup of the host machine, the trusted module generates a plurality of corresponding first measurement values ​​according to a plurality of first startup objects corresponding to the host machine, wherein the plurality of first startup objects include a first agent program; the first measurement values ​​are used to determine whether the startup process of the host machine is normal; In response to the startup of the first container, the first agent generates a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and sends the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent based on a client kernel for measuring a running object corresponding to the first container after the first container is started; In response to the startup of the second container, the first agent generates corresponding multiple third measurement values ​​according to multiple third startup objects corresponding to the second container, and sends the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

2. The method according to claim 1, further comprising: After the first container is started, the second agent generates a plurality of corresponding fourth metric values ​​according to the plurality of first running objects corresponding to the first container, and transmits the fourth metric values ​​to the trusted module through the host machine, so as to determine whether the running state of the first running object is normal; After the second container is started, the first agent generates corresponding multiple fifth measurement values ​​according to the multiple second running objects corresponding to the second container, and transmits the fifth measurement values ​​to the trusted module through the host machine to determine whether the running status of the second running object is normal.

3. The method according to claim 1, further comprising: If it is determined that the startup process of the host machine is abnormal, terminating the startup of the host machine; If it is determined that the startup process of the first container or the second container is abnormal, the startup process of the first container or the second container is terminated.

4. The method according to claim 1, wherein: The multiple first startup objects also include a basic input and output system, a boot loader, and a host kernel; the multiple third startup objects include a runtime process that the second container depends on and an image file corresponding to the second container.

5. The method according to claim 1, wherein: The client kernel runs in the first virtual machine, and the multiple second startup objects also include a runtime process on which the second container depends and an image file corresponding to the first virtual machine.

6. The method according to claim 1, wherein: The trusted module includes a plurality of first reference values ​​corresponding to the plurality of first startup objects, a plurality of second reference values ​​corresponding to the plurality of second startup objects, and a plurality of third reference values ​​corresponding to the plurality of third startup objects; Determining whether the startup process of the host machine is normal, comprising: determining whether each first startup object is started normally according to a first metric value and a first reference value corresponding to each first startup object; if any first startup object among the plurality of first startup objects is not started normally, determining that the startup process of the host machine is abnormal; if all first startup objects are started normally, determining that the startup process of the host machine is normal; Determining whether the startup process of the first container is normal, comprising: determining whether each second startup object is started normally according to a second measurement value and a second reference value corresponding to each second startup object; if any second startup object among the plurality of second startup objects is not started normally, determining that the startup process of the first container is abnormal; if all second startup objects are started normally, determining that the startup process of the first container is normal; Determining whether the startup process of the first container is normal includes: determining whether each third startup object is started normally according to a third measurement value and a third reference value corresponding to each third startup object; if any third startup object among the plurality of third startup objects is not started normally, determining that the startup process of the second container is abnormal; if all the third startup objects are started normally, determining that the startup process of the second container is normal.

7. The method according to claim 2, wherein: The trusted module includes a plurality of fourth reference values ​​corresponding to the plurality of first operation objects respectively, and a plurality of fifth reference values ​​corresponding to the plurality of second operation objects respectively; Determining whether the operation process of the first operation object is normal includes: determining whether the operation state of each first operation object is normal according to the fourth measurement value and the fourth reference value corresponding to each first operation object; Determining whether the operation process of the second operation object is normal includes: determining whether the operation status of each second operation object is normal according to the fifth measurement value and the fifth reference value corresponding to each second operation object.

8. The method according to claim 2, further comprising: If it is determined that the operating state of any one of the first operating objects is abnormal, then determining that the operating state of the first container is abnormal; If it is determined that the operation process of any one of the second operation objects is abnormal, then it is determined that the operation states of the two containers are abnormal.

9. The method according to claim 1, wherein: The trusted module is a trusted platform control module or a trusted platform module configured in the host machine.

10. A host machine, on which a first container based on a client kernel, a second container based on a host kernel, a first agent program and a trusted module are deployed, wherein: The trusted module is configured to, in response to the startup of the host machine, generate a plurality of corresponding first metric values ​​according to a plurality of first startup objects corresponding to the host machine, wherein the plurality of first startup objects include a first agent program; the first metric values ​​are used to determine whether the startup process of the host machine is normal; The first agent is configured to, in response to the startup of the first container, generate a plurality of corresponding second measurement values ​​according to a plurality of second startup objects corresponding to the first container, and send the second measurement values ​​to the trusted module for determining whether the startup process of the first container is normal; the plurality of second startup objects at least include a second agent based on a client kernel for measuring a running object corresponding to the first container after the first container is started; The first agent program is further configured to, in response to the startup of the second container, generate corresponding multiple third measurement values ​​according to multiple third startup objects corresponding to the second container, and send the third measurement values ​​to the trusted module to determine whether the startup process of the second container is normal.

11. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 9.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images