Storage method, device and equipment of secure container root file system and storage medium

Abstract

The invention relates to the technical field of virtual machine security containers, and discloses a storage method, device and equipment of a security container root file system and a storage medium. Using the blank block device as a writable temporary storage space of a secure container root file system and mounting the blank block device to the micro virtual machine to obtain a first pmem disk; carrying out integrity protection on the block device in which the secure container mirror image layer is stored on the physical machine, and mounting the block device to the micro virtual machine to obtain a second pmem disk; and carrying out joint mounting on the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain the secure container root file system. According to the method, the page cache is effectively shared among different security containers, and the page cache is shared between the physical machine host and the virtual machine, so that data repetition is effectively avoided, the memory overhead is reduced, and the deployment density of the security containers is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual machine secure containers, and in particular to a storage method, device, equipment and storage medium for a secure container root file system. Background Art

[0002] Currently, there are the following problems when using devmapper (a file system based on a block device mapper) to build a root file system for a secure container:

[0003] 1) Since devmapper creates a corresponding logical block device for each container, the file system of each block device is independent, so page cache cannot be effectively shared between different containers;

[0004] 2) As shown in Figure 5(a), currently secure containers all use virtio-blk (virtio-blk is the driver for virtual machine disk devices in qemu) to mount block devices to virtual machines. The backend of virtio-blk reads the block device on the host and generates the host page cache of this block device. When the content of this block device is read again in the virtual machine, a page cache with the same content is also generated inside the virtual machine, forming a duplicate page cache. Summary of the invention

[0005] In view of this, the present invention provides a storage method, apparatus, device and storage medium for a secure container root file system to solve the problem of duplicate page cache when the secure container uses devmapper to build the secure container root file system.

[0006] In a first aspect, the present invention provides a method for storing a secure container root file system, the method comprising:

[0007] Create a blank block device in the secure container image layer of the physical machine, use the blank block device as the writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain the first pmem (Persistent Memory) disk;

[0008] On the physical machine, integrity protection is performed on the block device storing the secure container image layer and it is mounted to the micro virtual machine to obtain a second pmem disk.

[0009] The first pmem disk and the second pmem disk are jointly mounted in the micro virtual machine operating system to obtain a secure container root file system.

[0010] The storage method of the secure container root file system provided by the present invention creates a blank block device in the secure container image layer of a physical machine, uses the blank block device as a writable temporary storage space of the secure container root file system and mounts it to a micro virtual machine to obtain a first pmem disk; performs integrity protection on the block device storing the secure container image layer on the physical machine and mounts it to the micro virtual machine to obtain a second pmem disk; and jointly mounts the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system, thereby achieving effective sharing of page caches between different secure containers and sharing of page caches between a physical machine host and a virtual machine, thereby effectively avoiding data duplication, reducing memory overhead, and improving the deployment density of secure containers.

[0011] In an optional implementation, a blank block device is created in the secure container image layer of the physical machine, the blank block device is used as a writable temporary storage space of the secure container root file system and mounted to the micro virtual machine, and the first pmem disk is obtained, including:

[0012] Create a blank block device in the secure container image layer of the physical machine, use the blank block device as the writable temporary storage space of the secure container root file system, and use virtio-pmem (virtio Persistent Memory, persistent memory in a virtualized environment) to mount the writable temporary storage space to the micro virtual machine in a read-only manner to obtain the first pmem disk.

[0013] The storage method of the secure container root file system provided by the present invention creates a blank block device in the secure container image layer of a physical machine, uses the blank block device as a writable temporary storage space of the secure container root file system, uses virtio-pmem to mount the writable temporary storage space to a micro virtual machine in a read-only manner, and obtains a first pmem disk. Virtio-pmem allows bypassing the guest page cache and directly using the host page cache, effectively avoiding data duplication and reducing memory overhead. Using virtio-pmem allows applications to directly operate persistent memory without going through a traditional file system layer, which helps to reduce latency and improve efficiency.

[0014] In an optional implementation, before integrity protection is performed on a block device storing a secure container image layer on a physical machine and the block device is mounted to the micro virtual machine, the storage method of the secure container root file system further includes:

[0015] Check whether there is a block device on the physical machine that has stored the secure container image layer.

[0016] If so, the block device storing the secure container image layer is integrity protected on the physical machine and mounted to the micro virtual machine; if not, the secure container image layer is downloaded from the remote end, and a new block device is created in the secure container image layer to obtain a second pmem disk.

[0017] The storage method of the secure container root file system provided by the present invention enables the physical machine to better store the block device that has stored the secure container image layer by querying whether there is a block device that has stored the secure container image layer locally on the physical machine. If so, the block device that has stored the secure container image layer is integrity protected on the physical machine and mounted to the micro virtual machine operation; if not, the secure container image layer is downloaded from the remote end, and a new block device is created in the secure container image layer to obtain a second pmem disk, thereby providing conditions for subsequently obtaining the second pmem disk.

[0018] In an optional implementation, integrity protection is performed on a block device storing a secure container image layer on a physical machine and the block device is mounted to a micro virtual machine to obtain a second pmem disk, including:

[0019] On the physical machine, dm-verity (a technology used to ensure the integrity of file system data) is used to protect the integrity of the block device of the stored secure container image layer, and virtio-pmem is used to mount the block device of the stored secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

[0020] The storage method of the secure container root file system provided by the present invention uses dm-verity to perform integrity protection on the block device that has stored the secure container image layer on the physical machine, so that the files in the block device are complete and reliable, and uses virtio-pmem to mount the block device that has stored the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk. Virtio-pmem allows bypassing the guest page cache and directly using the host page cache, which effectively avoids data duplication and reduces memory overhead. Using virtio-pmem allows applications to directly operate persistent memory without going through a traditional file system layer, which helps to reduce latency and improve efficiency.

[0021] In an optional implementation, creating a new block device in the secure container image layer to obtain a second pmem disk includes:

[0022] Use the new block device as the bottom layer, store the first layer in the new block device, and generate a snapshot device corresponding to the first layer in the new block device;

[0023] Generate the snapshot device corresponding to the second layer based on the snapshot device corresponding to the first layer, until all layers have corresponding snapshot devices generated;

[0024] Use dm-verity to protect the integrity of the block device that stores the secure container image layer, and use virtio-pmem to mount the block device that stores the secure container image layer to the micro virtual machine in read-only mode to obtain the second pmem disk.

[0025] The storage method of the secure container root file system provided by the present invention ensures the integrity and reliability of files in the block device by generating a basic network and a corresponding snapshot device inside the block device, uses dm-verity to perform integrity protection on the block device that has stored the secure container image layer, and uses virtio-pmem to mount the block device that has stored the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk, thereby providing conditions for subsequent joint mounting.

[0026] In an optional implementation, the storage method of the secure container root file system further includes: when a block device is mounted to a virtual machine in a read-only manner using virtio-pmem, a page cache is shared between the micro virtual machine and the physical machine.

[0027] In an optional implementation, the storage method of the secure container root file system further includes: when the secure container root file systems of multiple micro virtual machines are obtained, the secure containers of the multiple micro virtual machines share a page cache.

[0028] The storage method of the secure container root file system provided by the present invention, when virtio-pmem is used to mount a block device to a virtual machine in a read-only manner, virtio-pmem is shared between a micro virtual machine and a physical machine, and when the secure container root file systems of multiple micro virtual machines are obtained, the page cache is shared between the secure containers of the multiple micro virtual machines, thereby effectively sharing the page cache (page cache) between different secure containers, and sharing the page cache (page cache) between the physical machine host and the virtual machine (page cache), effectively avoiding data duplication and reducing memory overhead.

[0029] In a second aspect, the present invention provides a storage device for a secure container root file system, the device comprising:

[0030] A first pmem disk acquisition module is used to create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain a first pmem disk;

[0031] The second pmem disk acquisition module is used to perform integrity protection on the block device storing the secure container image layer on the physical machine and mount it to the micro virtual machine to obtain the second pmem disk;

[0032] The joint mounting module is used to jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system.

[0033] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method for storing a secure container root file system of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for storing a secure container root file system according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is a flowchart of a method for storing a secure container root file system according to an embodiment of the present invention;

[0037] Figure 2 is a flowchart of another secure container root file system storage method according to an embodiment of the present invention;

[0038] Figure 3 is a flowchart of another method for storing a secure container root file system according to an embodiment of the present invention;

[0039] Figure 4 is a flowchart of another secure container root file system storage method according to an embodiment of the present invention;

[0040] FIG5( a ) is a schematic diagram of a devmapper creating a corresponding logical block device for each container in the prior art;

[0041] FIG5( b) is a schematic diagram of a process of storing a secure container root file system according to another embodiment of the present invention;

[0042] Figure 6 is a structural block diagram of a storage device of a secure container root file system according to an embodiment of the present invention;

[0043] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0045] The secure container is developed to provide an additional layer of security. It is a container that uses micro-virtual machines for isolation. Each secure container is isolated with a separate micro-virtual machine. Ordinary containers share the resources and kernel of the host, so secure containers have better isolation and security than ordinary containers. When the existing secure container uses devmapper to build a secure container root file system, there is a problem of duplicate page cache. This embodiment provides a storage method for the secure container root file system, which can achieve the effect of effectively sharing page cache between different containers and sharing the secure container root directory of pagecache between host / guest.

[0046] According to an embodiment of the present invention, an embodiment of a storage method for a secure container root file system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0047] In this embodiment, a storage method of a secure container root file system is provided, which can be used in the above-mentioned computer terminal, such as a central processing unit, a server, etc. Figure 1 is a flowchart of a storage method for a secure container root file system according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0048] Step S101, create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain the first pmem disk.

[0049] Specifically, the secure container image layer refers to the layer in the container image used to store application data and configuration. These layers provide an isolation and protection mechanism when the container is running, ensuring that the application in the container does not directly access the host system resources, thereby improving security. The container image consists of multiple image layers, each of which is a read-only file system. These layers are stacked together in the form of pointers to form a unified file system. Block devices refer to devices that input / output data in units of data blocks, allowing random access. Block devices perform read and write operations through buffers and are suitable for sending large amounts of information.

[0050] MicroVM is a lightweight virtual machine technology that combines the security and isolation of hardware virtualization with the fast response and flexibility of containers. MicroVMs usually have their own microkernels and do not share the kernel with the host machine, thus providing hardware virtualization security similar to that of virtual machines, but at the same time more efficient, where the host machine is the physical machine.

[0051] The secure container root file system is used to provide an isolated execution environment for the container process. In container technology, the root file system (rootfs for short) is a file system mounted on the root directory of the container, which provides an independent file system environment for the processes in the container, isolating the applications in the container from the rest of its host machine.

[0052] For example, the physical machine system receives a request to create a secure container using a busybox container (a BusyBox container is a lightweight container based on the BusyBox operating system) image. Use the lvcreate command (a command used to create a logical volume in the Linux system) on the physical machine to create and allocate a blank block device A. The disk symbol of this block device on the physical machine is / dev / dm2, which is used as the writable temporary storage space of the rootfs of the secure container. The block device used as the writable temporary storage space is mounted to the micro virtual machine. The first pmem disk symbol of this block device in the micro virtual machine is / dev / pmem0p2, as shown in the following example: Figure 4 shown.

[0053] Step S102: Integrity protection is performed on the block device storing the secure container image layer on the physical machine and the device is mounted to the micro virtual machine to obtain a second pmem disk.

[0054] For example, integrity protection is performed on the block device storing the secure container image layer on the physical machine and mounted to the micro virtual machine. The second disk pmem symbol of the block device in the micro virtual machine is / dev / pmem0p1. Figure 4 shown.

[0055] Step S103, jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system.

[0056] Specifically, joint mounting is a technology that enables data sharing and communication in Docker containers (an open source application container engine). Through joint mounting, multiple secure containers can read and write data in the same directory, thereby achieving the purpose of data sharing and communication.

[0057] In the micro-virtual machine operating system, the first pmem disk / dev / pmem0p2 and the second pmem disk / dev / pmem0p1 are jointly mounted to obtain the secure container root file system.

[0058] The storage method of the secure container root file system provided in this embodiment creates a blank block device in the secure container image layer of the physical machine, uses the blank block device as the writable temporary storage space of the secure container root file system and mounts it to the micro virtual machine to obtain a first pmem disk; performs integrity protection on the block device that has stored the secure container image layer on the physical machine and mounts it to the micro virtual machine to obtain a second pmem disk; and jointly mounts the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system, thereby effectively sharing page caches between different secure containers and sharing page caches between the physical host and the virtual machine, effectively avoiding data duplication, reducing memory overhead, and improving the deployment density of secure containers.

[0059] In this embodiment, a storage method of a secure container root file system is provided, which can be used in the above-mentioned computer terminal, such as a central processing unit, a server, etc. Figure 2 is a flowchart of a storage method for a secure container root file system according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201, create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain the first pmem (Persistent Memory, persistent memory storage device) disk.

[0061] Specifically, the above step S202 includes:

[0062] Step a. Create a blank block device in the secure container image layer of the physical machine, use the blank block device as the writable temporary storage space of the secure container root file system, use virtio-pmem to mount the writable temporary storage space to the micro virtual machine in read-only mode, and obtain the first pmem disk.

[0063] For example, Figure 4 As shown in the figure, the physical machine system receives a request to create a secure container using a busybox container (a BusyBox container is a lightweight container based on the BusyBox operating system) image. Create and allocate a blank block device A on the physical machine. The disk symbol of this block device on the physical machine is / dev / dm2, which is used as the writable temporary storage space of the rootfs of the secure container. Use virtio-pmem to mount the block device as the writable temporary storage space to the micro virtual machine in read-only mode. The first pmem disk symbol of this block device in the micro virtual machine is / dev / pmem0p2.

[0064] Step S202, query on the physical machine whether there is a block device that has stored the secure container image layer locally; if so, perform integrity protection on the block device that has stored the secure container image layer on the physical machine and mount it to the micro virtual machine; if not, download the secure container image layer from the remote end, and create a new block device in the secure container image layer to obtain a second pmem disk.

[0065] For example, if there is a stored busybox container image layer locally on the physical machine, the block device storing the secure container image layer is integrity protected and mounted to the micro virtual machine. The second disk pmem symbol of the block device in the micro virtual machine is / dev / pmem0p1.

[0066] In the above step S202, downloading the secure container image layer from the remote end and creating a new block device in the secure container image layer to obtain the second pmem disk includes:

[0067] Step a1: Use the new block device as the bottom layer, store the first layer in the new block device, and generate a snapshot device corresponding to the first layer in the new block device.

[0068] Specifically, the first layer refers to the first layer of the network, which can also be called the basic blockchain. Layer is the 0th layer, that is, the bottom layer, which belongs to an Internet bottom layer protocol. The first layer is the parent layer network, that is, the parent layer.

[0069] A snapshot device is a collection of all states of a device at a certain point in time, usually called a current snapshot. The new block device is used as the bottom layer, and the first layer is stored in the new block device. A snapshot device (also a block device) corresponding to the first layer is generated in the new block device. Figure 4 As shown in Figure 5(b).

[0070] Step a2: Generate a snapshot device corresponding to the second layer based on the snapshot device corresponding to the first layer, until all layers have corresponding snapshot devices generated.

[0071] Specifically, the number of layers is set according to actual needs, and subsequent layers will use the snapshot device corresponding to the parent layer to create a new snapshot device until all layers generate corresponding snapshot devices.

[0072] Step a3: Use dm-verity to perform integrity protection on the block device storing the secure container image layer, and use virtio-pmem to mount the block device storing the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

[0073] Specifically, dm-verity is used to protect the integrity of the block device that stores the secure container image layer, and the block device is mounted to the micro virtual machine in read-only mode through virtio-pmem. The disk symbol of the block device in the micro virtual machine is / dev / pmem0p1, such as Figure 4 shown.

[0074] Figure 4 As shown in Figure 5(b), VM1 and VM2 both represent micro virtual machines, Containers represent secure containers, Containers Image represents secure container image layers, layer tar.gz represents the compressed file of the layer, sha256 / fbe1a72f5, sha256 / f92346e0c, and sha256 / e7d88de73 are the names of the compressed files of the layer. unpack represents the open action, snapshort device represents the snapshot device, thin device represents the virtualized device, empty thindevice represents the empty virtualized device, / dev / dm1, / dev / dm2, and / dev / dm3 represent the disk symbols on the physical machine of the block device, and Ivm thin pool represents the virtualized device pool.

[0075] The storage method of the secure container root file system provided in this embodiment ensures the integrity and reliability of files in the block device by generating a basic network and a corresponding snapshot device inside the block device, uses dm-verity to perform integrity protection on the block device that has stored the secure container image layer, and uses virtio-pmem to mount the block device that has stored the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk, thereby providing conditions for subsequent joint mounting.

[0076] Step S203: Integrity protection is performed on the block device storing the secure container image layer on the physical machine and the block device is mounted to the micro virtual machine to obtain a second pmem disk. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0077] Step S204: Jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system. Figure 1 Step S103 of the illustrated embodiment will not be described in detail here.

[0078] The storage method of the secure container root file system provided in this embodiment creates a blank block device in the secure container image layer of the physical machine, uses the blank block device as the writable temporary storage space of the secure container root file system, uses virtio-pmem to mount the writable temporary storage space to the micro virtual machine in a read-only manner, and obtains the first pmem disk. Virtio-pmem allows bypassing the guest page cache and directly using the host page cache, effectively avoiding data duplication and reducing memory overhead. Using virtio-pmem allows applications to directly operate persistent memory without going through the traditional file system layer, which helps to reduce latency and improve efficiency. By querying whether there is a block device with a secure container image layer stored locally on the physical machine, the physical machine can better store the block device with the secure container image layer stored. If so, the block device with the secure container image layer stored on the physical machine is protected for integrity and mounted to the micro virtual machine; if not, the secure container image layer is downloaded from the remote end, and a new block device is created in the secure container image layer to obtain the second pmem disk, which provides conditions for obtaining the second pmem disk later.

[0079] In this embodiment, a storage method of a secure container root file system is provided, which can be used in the above-mentioned mobile terminals, such as mobile phones, tablet computers, etc. Figure 3 is a flowchart of a storage method for a secure container root file system according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0080] Step S301, create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain the first pmem disk.

[0081] Step S302: Perform integrity protection on the block device storing the secure container image layer on the physical machine and mount it to the micro virtual machine to obtain a second pmem disk.

[0082] Specifically, the above step S302 includes:

[0083] Step b. Use dm-verity (a technology used to ensure the integrity of file system data) to protect the integrity of the block device of the stored secure container image layer on the physical machine, and use virtio-pmem to mount the block device of the stored secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

[0084] For example, dm-verity is used on the physical machine to perform integrity protection on the block device that has stored the secure container image layer, and is mounted to the micro virtual machine in a read-only manner through virtio-pmem. The second disk pmem symbol of the block device in the micro virtual machine is / dev / pmem0p1, as shown in Figure 4 shown.

[0085] The storage method of the secure container root file system provided in this embodiment uses dm-verity to perform integrity protection on the block device that has stored the secure container image layer on the physical machine, so that the files in the block device are complete and reliable, and uses virtio-pmem to mount the block device that has stored the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk. Virtio-pmem allows bypassing the guest page cache and directly using the host page cache, which effectively avoids data duplication and reduces memory overhead. Using virtio-pmem allows applications to directly operate persistent memory without going through the traditional file system layer, which helps to reduce latency and improve efficiency.

[0086] Step S303: Jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system. Figure 2 Step S204 of the illustrated embodiment will not be described in detail here.

[0087] Step S304: When the block device is mounted to the virtual machine in a read-only manner using virtio-pmem, the page cache is shared between the micro virtual machine and the physical machine.

[0088] Specifically, virtio-pmem allows bypassing the guest page cache and directly using the host page cache, so that the page cache is shared between the micro virtual machine and the physical machine, such as Figure 4 shown.

[0089] Step S305, when the secure container root file systems of multiple micro virtual machines are obtained, the secure containers of the multiple micro virtual machines share the page cache.

[0090] Specifically, as shown in Figures 5(a) and 5(b), compared with the existing solution of using devmapper to build a container root file system storage solution (Figure 5(a)), the solution of this embodiment (Figure 5(b)) can achieve effective sharing of page cache between different security containers.

[0091] The storage method of the secure container root file system provided in this embodiment, when virtio-pmem is used to mount a block device to a virtual machine in a read-only manner, virtio-pmem is shared between the micro virtual machine and the physical machine, and when the secure container root file systems of multiple micro virtual machines are obtained, the page cache is shared between the secure containers of the multiple micro virtual machines, thereby effectively sharing the page cache (page cache) between different secure containers, and sharing the page cache (page cache) between the physical machine host and the virtual machine (page cache), effectively avoiding data duplication and reducing memory overhead.

[0092] As one or more specific application embodiments of the embodiments of the present invention, the storage method of the secure container root file system provided by the present invention is further described in detail in combination with the specific embodiments, as follows:

[0093] Step 1) The physical machine system receives a request to create a secure container using the busybox container image.

[0094] Step 2) On the physical machine, use the lvcreate command to create and allocate a blank block device A. The disk symbol of this block device on the physical machine is / dev / dm2, which serves as the writable temporary storage space of the secure container rootfs. It is mounted to the micro-virtual machine in read-only mode through virtio-pmem. The disk symbol of this block device in the micro-virtual machine is / dev / pmem0p2.

[0095] Step 3) Check whether the busybox secure container image is stored locally on the physical machine. If not, download the busybox container image from the remote end, create a new block device as the bottom layer, and then store the first layer (parentlayer) to the new block device, and then generate a snapshot device (also a block device). Subsequent layers will use the snapshot device corresponding to the parent layer to create a new snapshot device. Finally, use dm-verity to protect the integrity of the block device storing the secure container image layer, and mount the block device to the micro virtual machine in read-only mode through virtio-pmem. The disk symbol of the block device in the micro virtual machine is / dev / pmem0p1.

[0096] Step 4) Jointly mount the two pmem disks / dev / pmem0p1 and / dev / pmem0p2 in the micro virtual machine operating system to obtain the secure container root file system.

[0097] The storage method of the secure container root file system provided in this embodiment uses different secure containers of the same image to share the block device of the storage image layer in a read-only manner. Each secure container occupies an empty block device as a writable temporary storage layer of the root file system, and uses virtio-pmem to mount these two block devices into the micro virtual machine. Virtio-pmem allows bypassing the guest page cache and directly using the host page cache. Then, the two pmem disks are jointly mounted in the micro virtual machine system to obtain the secure container root file system, and dm-verity is used to protect the integrity of the block device of the storage image layer. Effective sharing of page cache between different secure containers and sharing of page cache between the physical host and the virtual machine are achieved, which effectively avoids data duplication and reduces memory overhead.

[0098] In this embodiment, a storage device for a secure container root file system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0099] This embodiment provides a storage device for a secure container root file system, such as Figure 6 As shown, including:

[0100] The first pmem disk acquisition module 601 is used to create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain the first pmem disk.

[0101] The second pmem disk obtaining module 602 is used to perform integrity protection on the block device storing the secure container image layer on the physical machine and mount it to the micro virtual machine to obtain the second pmem disk.

[0102] The joint mounting module 603 is used to jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system.

[0103] In some optional implementations, the first pmem disk obtaining module 601 includes:

[0104] The creation and mounting unit is used to create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system, and use virtio-pmem to mount the writable temporary storage space to the micro virtual machine in a read-only manner to obtain the first pmem disk.

[0105] In some optional implementations, the second pmem disk obtaining module 602 includes:

[0106] The protection and mounting unit is used to use dm-verity (a technology used to ensure the integrity of file system data) to perform integrity protection on the block device of the stored secure container image layer on the physical machine, and use virtio-pmem to mount the block device of the stored secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

[0107] In some optional implementations, the storage of the secure container root file system further includes:

[0108] The query judgment module is used to query whether there is a block device that has stored the secure container image layer locally on the physical machine.

[0109] In some optional implementations, the query determination module includes:

[0110] The first execution unit is used to perform an operation of performing integrity protection on a block device storing a secure container image layer on a physical machine and mounting the block device to a micro virtual machine.

[0111] The second execution unit is used to download the secure container image layer from a remote end and create a new block device in the secure container image layer to obtain a second pmem disk.

[0112] In some optional implementations, the second execution unit includes:

[0113] The first snapshot device generating subunit is used to use the new block device as the bottom layer, store the first layer layer in the new block device, and generate a snapshot device corresponding to the first layer layer in the new block device.

[0114] The second snapshot device generating subunit is used to generate a snapshot device corresponding to a second layer based on the snapshot device corresponding to the first layer, until all layers generate corresponding snapshot devices.

[0115] The protection and mounting subunit is used to use dm-verity to perform integrity protection on the block device of the stored secure container image layer, and use virtio-pmem to mount the block device of the stored secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

[0116] In some optional implementations, the storage of the secure container root file system further includes:

[0117] The first shared page cache module is used to share the page cache between the micro virtual machine and the physical machine when the block device is mounted to the virtual machine in a read-only manner using virtio-pmem.

[0118] The second shared page cache module is used to share the page cache between the secure containers of the multiple micro virtual machines when the secure container root file systems of the multiple micro virtual machines are obtained.

[0119] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0120] The storage device of the secure container root file system in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0121] The embodiment of the present invention also provides a computer device having the above Figure 6 A storage device for a secure container root file system is shown.

[0122] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0123] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0124] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0125] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0126] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0127] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0128] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0129] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0130] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0131] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A storage method for a secure container root file system, characterized in that: The method comprises: Create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain a first pmem disk; On the physical machine, integrity protection is performed on the block device storing the secure container image layer and it is mounted to the micro virtual machine to obtain a second pmem disk. The first pmem disk and the second pmem disk are jointly mounted in the micro virtual machine operating system to obtain a secure container root file system.

2. The method according to claim 1, characterized in that The step of creating a blank block device in the secure container image layer of the physical machine, using the blank block device as a writable temporary storage space of the secure container root file system and mounting it to the micro virtual machine, and obtaining the first pmem disk includes: Create a blank block device in the secure container image layer of the physical machine, use the blank block device as the writable temporary storage space of the secure container root file system, use virtio-pmem to mount the writable temporary storage space to the micro virtual machine in a read-only manner, and obtain the first pmem disk.

3. The method according to claim 1, characterized in that Before integrity protection is performed on a block device storing a secure container image layer on a physical machine and the block device is mounted to the micro virtual machine, the method further includes: Check whether there is a block device on the physical machine that has stored the secure container image layer. If so, the block device storing the secure container image layer is integrity protected on the physical machine and mounted to the micro virtual machine; if not, the secure container image layer is downloaded from the remote end, and a new block device is created in the secure container image layer to obtain a second pmem disk.

4. The method according to claim 3, characterized in that The step of performing integrity protection on a block device storing a secure container image layer on a physical machine and mounting the block device to a micro virtual machine to obtain a second pmem disk includes: On the physical machine, dm-verity is used to perform integrity protection on the block device of the secure container image layer that has been stored, and virtio-pmem is used to mount the block device of the secure container image layer that has been stored to the micro virtual machine in a read-only manner to obtain a second pmem disk.

5. The method according to claim 3, characterized in that: Creating a new block device in the secure container image layer to obtain a second pmem disk includes: The new block device is used as the bottom layer, and the first layer layer is stored in the new block device, and a snapshot device corresponding to the first layer layer is generated in the new block device; Generate a snapshot device corresponding to the second layer based on the snapshot device corresponding to the first layer, until all layers have corresponding snapshot devices generated; Use dm-verity to perform integrity protection on the block device that has stored the secure container image layer, and use virtio-pmem to mount the block device that has stored the secure container image layer to the micro virtual machine in a read-only manner to obtain a second pmem disk.

6. The method according to any one of claims 1 to 4, characterized in that The method further includes: when virtio-pmem is used to mount the block device to the virtual machine in a read-only manner, virtio-pmem is shared between the micro virtual machine and the physical machine.

7. The method according to claim 1, characterized in that The method also includes: when obtaining the secure container root file systems of multiple micro virtual machines, sharing a page cache between the secure containers of the multiple micro virtual machines.

8. A storage device for a secure container root file system, characterized in that: The device comprises: A first pmem disk acquisition module is used to create a blank block device in the secure container image layer of the physical machine, use the blank block device as a writable temporary storage space of the secure container root file system and mount it to the micro virtual machine to obtain a first pmem disk; The second pmem disk acquisition module is used to perform integrity protection on the block device storing the secure container image layer on the physical machine and mount it to the micro virtual machine to obtain the second pmem disk; The joint mounting module is used to jointly mount the first pmem disk and the second pmem disk in the micro virtual machine operating system to obtain a secure container root file system.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the storage method of the secure container root file system according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the storage method of the secure container root file system according to any one of claims 1 to 7.

Images