A real-time container process isolation method

Abstract

The application belongs to the technical field of computer system software, and particularly relates to a real-time container process isolation method, wherein the same identification marks are added to processes in the same process namespace, which are used for the processes to be visible to each other in an operating system and to be accessible to each other; meanwhile, different identification marks are added to processes in different process namespaces, which are used for identifying that the processes are invisible to each other in the operating system and are not accessible to each other. The application can be adapted to the existing real-time container process without destroying the process access mechanism of the original real-time operating system, and can achieve the function of the same isolation degree as the industry. The application has great value for computer system real-time container process isolation, and can have certain reference significance in other fields under similar scenarios.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer system software, and particularly relates to a real-time container process isolation method. BACKGROUND

[0002] In a Linux operating system, a process is assigned a number for uniquely identifying the process in its process namespace, i.e., a process ID number. Linux identifies different process ID numbers for the same process in different namespaces. Processes in different process namespaces are invisible to each other, which achieves the function of process isolation. In an embedded real-time operating system, a process is identified by a process address, not a process ID. If process isolation is to be achieved, the mechanism of the process needs to be redesigned. SUMMARY

[0003] Therefore, the present application provides a real-time container process isolation method, which manages the names of processes in a real-time container process namespace to identify the uniqueness of real-time processes in the operating system. The same identification flag is added to processes in the same process namespace, which is used to identify that the processes are visible to each other in the operating system and can access each other. Different identification flags are added to processes in different process namespaces, which are used to identify that the processes are invisible to each other in the operating system and cannot access each other, thereby achieving the function of isolation.

[0004] The technical solution of the present application is as follows:

[0005] A real-time container process isolation method, which comprises the following steps:

[0006] The same identification flag is added to processes in the same process namespace, which is used to identify that the processes are visible to each other in the operating system and can access each other.

[0007] Different identification flags are added to processes in different process namespaces, which are used to identify that the processes are invisible to each other in the operating system and cannot access each other.

[0008] Further, the method of adding an identification flag is as follows:

[0009] In each process namespace, the name of each process is prefixed with the process namespace in which the process is located.

[0010] Further, when a container user views the processes, only the names of the processes are displayed.

[0011] Further, when the operating system accesses or operates the next real-time container, the operating system performs the following steps:

[0012] S101: The operating system acquires the real-time container process currently running, and then acquires the process namespace to which the real-time container process belongs;

[0013] S102: The operating system acquires the process namespace to which the real-time container process to be accessed belongs;

[0014] S103: It is judged whether the real-time container process to be accessed belongs to the current process namespace, if yes, the operating system performs access or operation on the real-time container process to be accessed, if not,

[0015] The operating system does not perform access or operation on the real-time container process to be accessed.

[0016] The beneficial effects of the present application are:

[0017] On the premise of not destroying the process access mechanism of the original real-time operating system, the existing real-time container process is adaptively modified and adapted, and the function of the same isolation degree as the industry can be achieved. The computer system real-time container process isolation has great value, and can have certain reference significance in other fields under similar scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor under the premise of the drawings.

[0019] Figure 1 The container setting diagram in the specific embodiment of the present application is shown;

[0020] Figure 2 The example flow in the specific embodiment of the present application is shown. DETAILED DESCRIPTION

[0021] The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0022] Following, the embodiments of the present disclosure are described through specific examples, and other advantages and effects of the present disclosure can be easily understood by those skilled in the art from the disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and various modifications or changes can be made to the details based on different views and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0023] It should be noted that various aspects of the embodiments described below are within the scope of the appended claims. It should be apparent that the aspects described herein can be embodied in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. Based on the teachings provided herein one skilled in the art will appreciate that one good aspect can be implemented independently of any other aspect and that two or more aspects can be combined in various ways. For example, an apparatus can be implemented and / or a method practiced using any number of the aspects set forth herein. In addition, such an apparatus can be implemented and / or such a method can be practiced using other structure and / or functionality in addition to or other than one or more of the aspects set forth herein.

[0024] It should also be noted that the drawings included in the following embodiments are only to illustrate the basic concept of the present disclosure in a schematic manner, and only the components related to the present disclosure are shown in the drawings, not drawn according to the number, shape and size of the components when actually implemented, and the shape, number and ratio of each component when actually implemented can be a random change, and the layout of the components can also be more complex.

[0025] In addition, in the following description, specific details are provided in order to facilitate a thorough understanding of examples. However, one skilled in the art will understand that the aspects described can be practiced without these specific details.

[0026] In one embodiment of the present disclosure, a real-time container process isolation method is provided, the real-time container process isolation method comprising:

[0027] As shown in Figure 1 The same identification flag is added to the processes in the same process namespace, which is used for the processes to be visible to each other in the operating system, and the processes can access each other;

[0028] Meanwhile, different identification marks are added to the processes in different process namespaces, which are used to identify that the processes in the operating system are invisible to each other and inaccessible to each other.

[0029] In the embodiment, in each process namespace, the names of all processes are prefixed with the process namespace in which the processes are located.

[0030] In the embodiment, when the container user views the processes, only the names of the processes are displayed.

[0031] The embodiment is used to ensure the isolation of process data, and can uniquely identify real-time container processes in a real-time operating system and determine the process namespaces to which the real-time container processes belong. The visibility of different real-time container processes of the real-time operating system to other container real-time processes can be determined, and a specific process flow of accessing the real-time container processes can be determined.

[0032] Figure 1 The method for identifying real-time container processes by the operating system in the embodiment is described. Figure 1 The process namespace 1 in the container 1 contains two processes, process 1 and process 2. The process namespace 1 prefixes the names of the process 1 and the process 2 with the prefix of the process namespace 1, that is, the names of the process 1 and the process 2 become process namespace 1+process 1 and process namespace 1+process 2 after the prefix is added. Figure 1 The process namespace 2 in the container 2 contains three processes, process 1, process 2, and process 3. The process namespace 2 prefixes the names of the process 1, the process 2, and the process 3 with the prefix of the process namespace 2, that is, the names of the process 1, the process 2, and the process 3 become process namespace 2+process 1, process namespace 2+process 2, and process namespace 2+process 3 after the prefix is added.

[0033] In a general operating system, a process is globally unique. In a container real-time operating system, it is required that different process namespaces can exist with processes of the same name. If the processes are not identified by the above method, if the first process namespace contains a process 1, the second process namespace cannot create a process 1 with the same name, and different process namespaces cannot exist with processes of the same name. However, by identifying the process 1 by the above method, the same-named processes 1 in the first process namespace and the second process namespace have the names process namespace 1+process 1 and process namespace 2+process 1 in the respective process namespaces, so that the processes with the same name can exist in different process namespaces. The process namespace name+process name is a kernel layer name, which is globally unique. In the perspective of a container user, the process name does not contain the prefix of the process namespace name, for example, if the kernel layer name is process namespace 1+process 1, the process name in the perspective of the container user is process 1.

[0034] Figure 2 This describes the instance flow of the operating system accessing a live container process. When the operating system accesses or manipulates another live container process, the first step is for the operating system to obtain the currently running live container process and then obtain the process namespace to which that live container process belongs. The second step is for the operating system to obtain the process namespace to which the accessed live container process belongs. The third step is for the operating system to... Figure 2 As described in "Determining whether the process belongs to the current process namespace," the process namespace of the current real-time container process is compared with the process namespace of the accessed real-time container process. If the process namespaces of the current and accessed real-time container processes are the same, it indicates that they belong to the same process namespace, and the accessed process namespace and the current real-time container process are mutually visible. The operating system can then operate on the accessed real-time container process, and the access to the real-time container process is successful. If the process namespaces of the current and accessed real-time container processes are different, it indicates that they do not belong to the same process namespace, and the accessed process namespace and the current real-time container process are mutually invisible. The operating system cannot then operate on the accessed real-time container process, and the access to the real-time container process fails.

[0035] This embodiment, without disrupting the process access mechanism of the original real-time operating system, adaptively modifies and adapts existing real-time container processes to achieve the same level of isolation capability as industry standards. It is of great value for real-time container process isolation in computer systems and can serve as a reference in similar scenarios in other fields.

[0036] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A real-time container process isolation method, characterized in that, The real-time container process isolation method includes: Add the same identifier to processes in the same process namespace so that the processes are visible to each other in the operating system and can access each other; Different identifiers are added to processes in different process namespaces to indicate that these processes are not visible to each other in the operating system and cannot be accessed by each other. The method for adding identifiers is as follows: In each process namespace, add the prefix of the process namespace to the name of each process. When the operating system accesses or operates the next live container, the operating system performs the following steps: S101: The operating system obtains the currently running real-time container process, and then obtains the process namespace to which the real-time container process belongs; S102: The operating system obtains the process namespace of the real-time container process that needs to be accessed; S103: Determine whether the real-time container process to be accessed belongs to the current process's namespace. If yes, the operating system performs the access or operation on the real-time container process to be accessed; otherwise, The operating system does not perform access to or operations on the live container processes that require access.

2. The real-time container process isolation method according to claim 1, characterized in that, When a container user views the process, only the name of the process is displayed.

Images