Operation execution methods, apparatus and computer-readable storage media in a container

Abstract

This application discloses a method, apparatus, and computer-readable storage medium for executing operations in a container. Relating to the field of cloud computing, the method includes: receiving a target operation request; responding to the target operation request, determining a target operation layer corresponding to the target operation; determining a predetermined operation permission corresponding to the target operation layer; determining whether the permission corresponding to the target operation is included in the predetermined operation permissions; and, if the determination result indicates that the permission corresponding to the target operation is included in the predetermined operation permissions, executing the target operation in the target container. This application addresses the security risks that may arise when users execute operations in containers in related technologies.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a method, apparatus, and computer-readable storage medium for performing operations in a container. Background Technology

[0002] In related technologies, when users perform operations in a container, improper operations may lead to a series of security issues. For example, the processes run by the user may modify or delete system files, corrupt log files, or overwrite binary files, resulting in security problems in the container or system.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, and computer-readable storage medium for performing operations in a container, in order to solve the technical problem that security risks may exist when users perform operations in a container in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a method for executing an operation in a container is provided, comprising: receiving a target operation request, wherein the target operation request carries a target operation and a target permission account, the target operation request being used to request the execution of the target operation in a target container, the target permission account being a pre-configured account of a predetermined permission account in the operating system layer corresponding to the target container image, and the target container image being an image corresponding to the target container; responding to the target operation request, determining a target operation layer corresponding to the target operation, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer, the runtime environment layer being a layer for configuring the runtime environment, and the dependency... The installation layer is used to configure script files, and the application configuration layer is used to configure application files. A predetermined operation permission corresponding to the target operation layer is determined, wherein the predetermined operation permission includes a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured in the target container image by a predetermined permission account. The result of determining whether the permission corresponding to the target operation is included in the predetermined operation permission is then determined. If the result indicates that the permission corresponding to the target operation is included in the predetermined operation permission, the target operation is executed in the target container.

[0006] To achieve the above objectives, according to another aspect of this application, an operation execution apparatus in a container is provided. The apparatus includes: a receiving module, configured to receive an operation request, wherein the operation request carries a target operation and a target permission account, the operation request being used to request execution of the target operation in a target container, the target permission account being a pre-configured account of a predetermined permission account in the operating system layer corresponding to the target container image, and the target container image being an image corresponding to the target container; and a response module, configured to respond to the operation request by determining a target operation layer corresponding to the target operation, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer, the runtime environment layer being a layer for configuring the runtime environment, the dependency installation layer being a layer for configuring script files, and the application configuration layer being a layer for configuring script files. The system includes: a configuration application file layer; a first determining module for determining predetermined operation permissions corresponding to the target operation layer, wherein the predetermined operation permissions include a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer, wherein the first permission, the second permission, and the third permission are pre-configured by a predetermined permission account in the target container image; a second determining module for determining whether the permission corresponding to the target operation is included in the predetermined operation permissions; and an execution module for executing the target operation in the target container if the determination result indicates that the permission corresponding to the target operation is included in the predetermined operation permissions.

[0007] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, the device where the computer-readable storage medium is located controls the execution of the operation execution method in the container of any of the above.

[0008] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes an operation execution method in a container of any of the above-mentioned components during runtime.

[0009] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, the computer program product including computer instructions, which, when executed by a processor, implement the steps of the operation execution method in the container of any of the above.

[0010] In this embodiment, a target operation request is received, wherein the target operation request carries a target operation and a target permission account. The target operation request is used to request the execution of the target operation in the target container. The target permission account is a pre-configured account in the operating system layer corresponding to the target container image. The target container image is an image corresponding to the target container. In response to the target operation request, the target operation layer corresponding to the target operation is determined, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files. A pre-defined operation permission corresponding to the target operation layer is determined, wherein the pre-defined operation permission includes a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured by the pre-defined permission account in the target container image. The result of determining whether the permission corresponding to the target operation is included in the pre-defined operation permission is determined. If the result of determining that the permission corresponding to the target operation is included in the pre-defined operation permission, the target operation is executed in the target container. By identifying the target operation layer corresponding to the target operation, it is helpful to accurately locate and execute the operation subsequently, avoiding widespread interference with the internal structure of the container and improving the efficiency of the operation and the stability of the container environment. By pre-configuring the permissions corresponding to the pre-defined permission accounts at each layer of the target container image build, the permissions for the target permission accounts to execute specific operations are pre-configured. This achieves fine-grained control over operations at different levels, such as the container runtime environment, dependency installation, and application configuration. Through permission layering, operation permissions are bound to different layers, restricting the permission scope of the target permission account (such as a non-root user), achieving operation isolation, and thus improving the stability and security of operations executed within the container. Determining whether the permissions required for the target permission account to execute the target operation request are already included in the pre-defined operation permissions set for different operation layers helps ensure that the target operations executed by the target permission account within the container are performed within the pre-defined scope of pre-defined operation permissions. Only when the result confirms that the permissions corresponding to the target operation include the predefined operation permissions, is the target permission account allowed to execute the target operation in the target container. This ensures the compliance of operation execution, reduces security vulnerabilities, enhances the security of the entire container environment, and effectively solves the technical problem that users may face security risks when performing operations in containers. In this way, it improves the security and stability of operations performed in containers. Attached Figure Description

[0011] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0012] Figure 1 It is a hardware structure block diagram of a computer terminal (or mobile device) used to implement the operation execution methods in the container;

[0013] Figure 2 This is a flowchart of the operation execution method in the container according to Embodiment 1 of this application;

[0014] Figure 3 This is a schematic diagram of the layered structure of a cloud container image according to an embodiment of this application;

[0015] Figure 4 This is a flowchart illustrating the layer-by-layer permission configuration of a container image according to an embodiment of this application;

[0016] Figure 5 This is a schematic diagram of an operation execution device in a container according to an embodiment of this application;

[0017] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0021] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0022] Containers: Containers are operating system-level isolated runtime environments that contain the application and its dependencies' complete file systems. Container technology allows applications to run in the same way in any environment, improving application portability and isolation.

[0023] Container image: A container image is a template for a container, containing all the necessary components such as the application, library files, and configuration. Images are immutable and can be copied and distributed to create and run consistent container instances in different locations.

[0024] Example 1

[0025] According to an embodiment of this application, an embodiment of an operation execution method in a container is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0026] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 It is a hardware structure diagram of a computer terminal (or mobile device) used to implement the operation execution methods in a container. For example... Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0028] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the operation execution method in the container in the embodiments of this application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the operation execution method in the container described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0029] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0030] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0031] Under the aforementioned operating environment, this application provides the following: Figure 2 The operation execution method in the container shown. Figure 2 This is a flowchart of the operation execution method in the container according to Embodiment 1 of this application.

[0032] Step S202: Receive a target operation request, wherein the target operation request carries a target operation and a target permission account. The target operation request is used to request the execution of the target operation in the target container. The target permission account is a pre-configured account in the operating system layer corresponding to the target container image. The target container image is an image corresponding to the target container.

[0033] In step S202 of this application, a target operation request is received.

[0034] This involves a target operation request, which is initiated by the target authorized account and requests to perform a target operation within the target container. For example, this target operation request could be used to request changes to file permissions within the container, updates application configuration, or restarts the container.

[0035] This involves the target operation, which is a specific action initiated by the target authorized account and needs to be executed within the target container. For example, the target operation could be updating a configuration file within the container or starting the container itself.

[0036] This involves the target permission account, which is a pre-configured account in the operating system layer corresponding to the target container image, used to perform operations within its designated permissions within the target container. For example, the target permission account may have read and write file permissions, but not permissions to modify critical container configurations.

[0037] This involves the target container, which is a container instance created based on a target container image and used to perform operations. This target container can be an instance running a specific application.

[0038] This involves a pre-defined account, which is a user account pre-set in the container image and has the authority to manage all resources of the container image. This pre-defined account can be the default administrator user (i.e., the root user) in the container image.

[0039] This involves the target container image, which is a container image built from a base container image according to specific requirements. For example, the target container image could be a container image configured with the target user account's permissions.

[0040] This involves the operating system layer, which forms the underlying layer of the container image. This layer provides the underlying operating system environment required for container operation, including the kernel, core libraries, basic tools, and commands.

[0041] By receiving a target operation request initiated by a target authorized account, requesting the execution of a target operation within the target container, and knowing that the target authorized account is a pre-configured account within the operating system layer corresponding to the target container image, accurate data is provided for subsequent actions. This allows for permission determination before executing the target operation on the target authorized account based on this specific information. This helps to ensure the scope of operations is limited, guaranteeing that only authorized operations can be executed within the container, while restricting other potentially insecure operations. This enhances container security and helps to address the technical issue of security risks that may arise when users perform operations within containers.

[0042] It should be noted that there are no specific restrictions on the method for receiving target operation requests; you can customize the settings according to the actual application and scenario.

[0043] Step S204: In response to the target operation request, determine the target operation layer corresponding to the target operation. The target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files.

[0044] In step S204 of this application, a target operation request is responded to, and the target operation layer corresponding to the target operation is determined.

[0045] This involves the target operation layer, which is a specific layer that the container runtime depends on, including the runtime environment layer, dependency installation layer, application configuration layer, and runtime environment layer.

[0046] This includes the runtime environment layer, which is the layer of the runtime environment required for container runtime and can be used to configure development toolkits and middleware.

[0047] This involves the runtime environment, which is the environment configuration required for an application to run in a container, including development toolkits, middleware settings, etc.

[0048] This involves a dependency installation layer, which is a layer within the container used to install and configure specific dependencies provided by the cloud computing service platform, such as scripts, tools, or service endpoints. For example, the dependency installation layer might contain log collection scripts and network proxy configurations provided by the cloud computing service platform.

[0049] This involves script files, which are text files used to automate tasks or processes and contain a series of execution commands.

[0050] This involves the application configuration layer, which is a layer in the container used to store and configure application-specific settings, and houses the container's infrequently changing toolkit.

[0051] This involves application files, which are the files that the container directly depends on to implement its specific application functions, including executable files, library files, configuration files, and data files.

[0052] By responding to the target operation request and identifying the target operation layer, it is helpful to accurately locate and execute the operation subsequently, avoiding widespread interference with the internal structure of the container and improving operational efficiency and container environment stability. Determining which layer the target operation should be executed at helps to clarify the permissions corresponding to the target operation layer, ensuring accurate request processing and the application of correct permissions and configurations at the appropriate layer. This avoids uniformly using predefined permission accounts to adjust permissions across the entire scope, reducing resource waste and security vulnerabilities. Furthermore, it helps to improve the security of the container environment through layered permission control while ensuring the flexibility and efficiency of operations within the container, avoiding security risks and resource waste caused by improper permissions or overly broad operation scopes.

[0053] It should be noted that there are no specific restrictions on the method for determining the target operation layer corresponding to the target operation in response to the target operation request. It can be customized according to the actual application and scenario.

[0054] Step S206: Determine the predetermined operation permissions corresponding to the target operation layer. The predetermined operation permissions include the first permission corresponding to the runtime environment layer, the second permission corresponding to the dependency installation layer, and the third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured by the predetermined permission account in the target container image.

[0055] In step S206 of this application, a predetermined operation permission corresponding to the target operation layer is determined.

[0056] This involves predefined operation permissions, which are permissions configured for a target account at a specific operation layer during the container image building process, based on the permissions associated with the predefined permission account. These predefined operation permissions are customized according to the functional and security requirements of each layer to ensure that the target account can only perform specific operations within the predefined operation permissions.

[0057] This involves the concept of "first permission," which is a pre-configured permission within the runtime environment layer of the target container image, corresponding to the permissions of a predefined permission account. This first permission allows the target permission account to perform specific operations, defining the scope of its operations within the runtime environment layer. For example, the target permission account might have permissions to install development toolkits and middleware, manage middleware configuration, and start and stop middleware services.

[0058] This involves a second permission, which is a pre-configured permission in the target container image dependency installation layer based on the permissions of a pre-defined permission account. This second permission allows the target permission account to perform specific operations, thus defining the scope of operations for the target permission account within the dependency installation layer. For example, by modifying the permissions of the startup dependencies of a cloud computing service platform, the target permission account can gain the ability to read and execute these scripts.

[0059] This involves third-party permissions, which are pre-configured in the application configuration layer of the target container image based on the permissions of a pre-defined account. These third-party permissions allow the target account to perform specific operations, defining the scope of its operations within the application configuration layer. For example, modifying the ownership of application files within the container grants the target account permission to access those files.

[0060] By pre-configuring the permissions corresponding to pre-defined accounts at each layer of the target container image build process, specific permissions for those accounts to perform operations are achieved. This enables fine-grained control over operations at different levels, such as the container runtime environment, dependency installation, and application configuration. It ensures that the operation permissions at each layer match the functional and security requirements of that layer, while avoiding permission adjustments across the entire image. This effectively controls the problem of excessively large images caused by using pre-defined accounts in related technologies, thereby enhancing container security and operational efficiency. Through permission layering, operation permissions are bound to different layers, limiting the permission scope of target accounts (such as non-root users), achieving operation isolation, and thus improving the stability and security of operations performed within the container.

[0061] It should be noted that there are no specific restrictions on the method for determining the predefined operation permissions corresponding to the target operation layer. Custom settings can be made according to the actual application and scenario.

[0062] Step S208: Determine whether the permission corresponding to the target operation is included in the determination result of the predetermined operation permissions;

[0063] In step S208 of this application, the determination result is obtained as to whether the permission corresponding to the target operation is included in the predetermined operation permissions.

[0064] This involves determining the outcome, which, after analyzing the target operation request, determines whether the permissions required for the target authorized account to execute the target operation request have been included in the pre-defined permissions (i.e., pre-defined operation permissions) set for different operation layers. This determination is used to verify whether the target operation is within the safe and expected permission scope, avoiding the over-granting of permissions, thereby ensuring the legitimacy and security of the target authorized account executing the target operation in the target container.

[0065] By analyzing the target operation request and determining whether the permissions required for the target account to execute the target operation request have been included in the predefined operation permissions set for different operation layers, it helps to ensure that the target operations executed by the target account in the container are within the scope of the predefined operation permissions. This ensures that the target operation does not exceed the functional boundaries of the target operation layer or infringe on the permissions of other layers, thus ensuring the compliance of the target operations executed by the target account in the container and improving the security of container operation.

[0066] It should be noted that there are no specific restrictions on the method for determining whether the permissions corresponding to the target operation are included in the predetermined operation permissions. Custom settings can be made according to the actual application and scenario.

[0067] Step S210: If the result indicates that the permissions corresponding to the target operation include the predetermined operation permissions, execute the target operation in the target container.

[0068] In step S210 provided in this application, it is explained that if the result is that the permission corresponding to the target operation includes the predetermined operation permission, the target operation is executed in the target container.

[0069] When the result confirms that the permissions corresponding to the target operation are included in the predefined operation permissions, that is, the target operation is allowed to be executed in the target container only after the permission check is passed before the target permission account is executed. This ensures the compliance of the operation execution and ensures that the operations that the target permission account is allowed to execute in the target container are within the scope of the predefined predefined operation permissions. This reduces security vulnerabilities, enhances the security of the entire container environment, and effectively solves the technical problem that users are prone to security risks when performing operations in containers in related technologies.

[0070] It should be noted that there are no specific restrictions on the method of executing the target operation in the target container when the result is determined to be within the scope of the target operation's permissions, which include the predefined operation permissions. Custom settings can be made according to the actual application and scenario.

[0071] Optionally, in the operation execution method in the container provided in the embodiments of this application, before determining the target operation layer corresponding to the target operation, the method includes: receiving a permission configuration request, wherein the permission configuration request is initiated by a predetermined permission account; in response to the permission configuration request, retrieving the base container image; creating a target permission account in the operating system layer corresponding to the base container image; configuring the predetermined operation permissions corresponding to the target permission account in the target operation layer corresponding to the base container image, thereby obtaining the target container image.

[0072] This embodiment describes the specific steps before determining the target operation layer corresponding to the target operation.

[0073] This involves permission configuration requests, which are initiated by a predefined permission account (usually an account with administrative privileges, such as the root user) to configure specific permissions for a target permission account in the container image. These permission configuration requests can include information about the target operational layer, the definition of the target permission account, and a detailed description of the required permissions.

[0074] This involves the base container image, which is the underlying and foundational image used when building the target container image.

[0075] In the steps involved in this embodiment, firstly, a permission configuration request initiated by a predetermined permission account (which can be an account with administrative privileges, such as the root user) is received. After responding to the permission configuration request, the base container image is invoked; this image is the basis for building the target container image. Next, after invoking the base container image, the target permission account is created in the operating system layer corresponding to the base container image using the permissions corresponding to the predetermined permission account. In the target operation layer corresponding to the base container image, the predetermined operation permissions corresponding to the target permission account are configured. Finally, the target container image used to create the target container is obtained.

[0076] By using the permissions of a predefined permission account after calling the base container image, creating a target permission account in the operating system layer corresponding to the base container image, and configuring the predefined operation permissions of the target permission account in the target operation layer corresponding to the base container image, the permission scope of the target permission account (such as a non-root user) is effectively restricted, and operation isolation is achieved. This improves the stability and security of operations performed in the container, and helps to solve the technical problem that users may face security risks when performing operations in containers.

[0077] Optionally, in the operation execution method in the container provided in the embodiments of this application, in the target operation layer corresponding to the base container image, the predetermined operation permissions corresponding to the target permission account are configured to obtain the target container image, including: configuring the first permission of the target permission account in the runtime environment layer of the base container image; configuring the second permission of the target permission account in the dependency installation layer of the base container image; configuring the third permission of the target permission account in the application configuration layer of the base container image; and configuring the predetermined operation permissions corresponding to the target permission account according to the first permission, the second permission, and the third permission to obtain the target container image.

[0078] This embodiment describes the specific steps for configuring the predetermined operation permissions corresponding to the target permission account in the target operation layer corresponding to the base container image to obtain the target container image.

[0079] In the steps involved in this embodiment, firstly, at the runtime environment layer, the target permission account's first permissions are configured, such as permissions to install and manage development toolkits, middleware, etc., while restricting its direct access to core resources to reduce security risks. Next, at the dependency installation layer, the target permission account's second permissions are configured, such as modifying the ownership of scripts that the cloud computing service platform requires to start, granting the target permission account the ability to read and execute these scripts, while restricting the target permission account's access to the underlying operating system and upper-layer application configurations to prevent operations that fall outside the target permission account's scope. Then, at the application configuration layer, the target permission account's third permissions are configured, such as modifying the ownership of application files within the container, granting the target permission account access to application files, but prohibiting it from modifying files in the underlying dependency installation layer and runtime environment layer, protecting the stability and security of the underlying environment. Finally, by combining the first, second, and third permissions, the predetermined operation permissions of the target permission account are obtained, ultimately resulting in the target container image.

[0080] By integrating first, second, and third permissions, the predefined operation permissions of the target permission account are configured, ultimately resulting in the target container image. This clearly defines the permission scope of the target permission account, ensuring that it can perform specific and necessary operations at different layers of the container image, while preventing unauthorized access to other layers. By controlling the permissions of the target permission account layer by layer, permission stratification is achieved at the runtime environment layer, dependency installation layer, and application configuration layer. This ensures that the permissions at each layer match the functional and security requirements of that layer, thereby avoiding permission adjustments across the entire image, reducing image size, and optimizing resource usage. These permission configurations will ultimately be integrated into the target container image, forming a secure container runtime environment with fine-grained permission control.

[0081] In practical applications, it can also be combined with other security mechanisms (such as network policies and access control lists) to form a multi-dimensional security protection system, providing comprehensive security guarantees for operations executed within containers. For example, the network policies of a container orchestration platform can restrict network communication between containers, further enhancing the security isolation of containers. Through this integrated security management, a container runtime environment that is both efficient and secure can be built.

[0082] Optionally, in the operation execution method in the container provided in the embodiments of this application, before determining the target operation layer corresponding to the target operation, the method includes: creating and starting the target container based on the target container image.

[0083] This embodiment describes the specific steps before determining the target operation layer corresponding to the target operation.

[0084] In the steps involved in this embodiment, before determining the target operation layer corresponding to the target operation, a specific container instance, namely the target container, is created and started based on the constructed target container image.

[0085] By creating a target container based on the target container image, it is ensured that the operation of starting the target container is based on the permissions corresponding to the target permission account with pre-configured pre-defined operation permissions. Furthermore, the permissions for subsequent operations performed by the target permission account within the target container are all limited to the pre-configured pre-defined operation permissions. This solves the problems of insecure permission management and uncontrollable operations in containers, prevents potential privilege escalation attacks, and reduces security risks. This helps to address the technical problem in related technologies where containers on the host machine share the same kernel, making it easy for users to perform operations within the container.

[0086] Optionally, in the operation execution method in the container provided in the embodiments of this application, after creating the target container based on the target container image, the method includes: updating the target container image to obtain an updated container image; creating and running the updated container based on the updated container image; transferring the operation request in the target container to the updated container to obtain a transfer result; and stopping the running of the target container if the transfer result is that the operation request in the target container has been transferred to the updated container.

[0087] This embodiment describes the specific steps after creating the target container based on the target container image.

[0088] This involves updating container images. An updated container image is a new container image generated based on an existing target container image by adding, modifying, or deleting certain components, files, or configurations to adapt to new functional requirements, security requirements, or performance optimization needs. This updated container image can contain updated application code, dependency libraries, configuration files, and the latest permission settings for the target user account.

[0089] This involves update containers, which are created using update container images and are used to replace the original target containers to achieve application updates, security patch deployments, or performance optimizations.

[0090] This involves the transfer result, which is the transfer of operation requests from the target container to the updated container after the updated container is created and running. For example, the container orchestration platform's service object redirects operation requests from the old container (the original target container) to the updated container. This process allows the old and new containers to run in parallel until all containers have been updated. Once the updated container can begin processing operation requests normally, the container orchestration platform stops the old container.

[0091] In the steps involved in this embodiment, firstly, based on changes in application requirements or security policies, the target container image is updated to generate an updated container image. The update may include adding new security patches, modifying configuration files, and adjusting permissions for the target user account. Next, an updated container is created and run using the updated container image. After the updated container is running, operation requests from the target container are transferred to the updated container, and the transfer result is determined. Finally, if the transfer result indicates that operation requests from the target container have been transferred to the updated container, the target container is stopped, its occupied resources are released, and the entire container update process is completed.

[0092] By creating and running an update container based on an updated container image, and after the update container is running, transferring operation requests from the target container to the update container, and determining the transfer result, the target container is stopped if the transfer result confirms that the operation requests from the target container have been transferred to the update container. This solves the problem of updating and migrating containers during runtime, especially when applications require frequent updates or security policies need to be adjusted. It addresses the challenge of securely updating containers without affecting application service continuity. By creating update containers and transferring operation requests, container updates and replacements can be completed without interrupting application services, ensuring service continuity and avoiding the risks associated with directly updating running containers, such as service interruption, data loss, or permission conflicts.

[0093] In practical applications, the process of transferring operation requests involves various technologies, such as load balancer reconfiguration, service discovery mechanism updates, and application state synchronization. For example, when an operation request in the target container is transferred to the update container, the container orchestration platform's ingress controller or service mesh can dynamically adjust traffic routing to redirect network requests to the update container. Simultaneously, the application's session state and persistent data need to be synchronized between the target and update containers to ensure data consistency and service state continuity.

[0094] This process can also be integrated with container health check mechanisms. For example, after the updated container is running stably and the operation request has been successfully transferred, the target container can be automatically stopped, avoiding the need for manual intervention and improving the automation level of container operations. In addition, the processes of generating updated container images and creating updated containers can be automated, enabling rapid deployment of application updates and dynamic adjustment of the container environment through continuous integration / continuous deployment (CI / CD) pipelines.

[0095] Optionally, in the operation execution method in the container provided in the embodiments of this application, after stopping the operation of the target container when the transfer result is that the operation request in the target container is transferred to the update container, the method includes: determining the running status of the update container; running the target container when the running status is abnormal; and sending a rollback control instruction to the update container, wherein the rollback control instruction is used to transfer the operation request that has been transferred to the update container back to the target container.

[0096] This embodiment describes the specific steps after stopping the target container when the transfer result is that the operation request in the target container is transferred to the update container.

[0097] This includes the runtime status, which updates the current running status of the container and can include normal and abnormal states. This runtime status can be determined by checking various metrics of the updated container (such as application running status, container health checks, system resource usage, etc.) to determine whether the container is running normally.

[0098] This involves abnormal states, which are unusual conditions that occur during the operation of the update container, including application crashes and network connection interruptions. Such abnormal states mean that the update container can no longer provide stable service and require remedial measures.

[0099] This involves a rollback control instruction, which is used to redirect operation requests that have been transferred from the target container to the update container back to the target container for execution when the update container encounters an abnormal state. This rollback control instruction can be triggered automatically or manually, with the aim of ensuring that the continuity and stability of the service are not affected by update container anomalies.

[0100] In the steps involved in this embodiment, the running status of the update container is monitored in real time. If the running status of the update container is detected to be abnormal, in order to ensure the continuity and stability of the service, the target container is rerun. At the same time, a rollback control instruction is sent to the update container to transfer the operation request that was transferred from the target container to the update container back to the target container for execution.

[0101] By determining the running status of the update container and, in the event of an abnormal running status, running the target container and sending a rollback control command to the update container, the operation requests that have been transferred to the update container are transferred back to the target container. This ensures that even if the update container encounters problems during the container update process, it can be immediately restored to the target container, maintaining service continuity. This effectively avoids security risks that may be caused by container anomalies, such as data leakage or service unavailability, and reduces the risk of service interruption.

[0102] In practical applications, this mechanism can also involve the automation capabilities of container orchestration platforms, as well as the traffic management and state synchronization functions of service meshes. For example, when the system detects an anomaly in the running status of an updated container, it can automatically trigger the service mesh to reroute network traffic to the target container. Simultaneously, the container group lifecycle management function of the container orchestration platform ensures that the target container can quickly start and take over the service. Furthermore, anomaly detection and analysis functions can be configured to automatically collect logs and system metrics when a container malfunctions, helping to quickly locate the cause of the problem for repair or optimization, thereby providing a more stable and secure operating environment for containers.

[0103] Optionally, in the operation execution method in the container provided in the embodiments of this application, determining whether the permission corresponding to the target operation is included in the predetermined operation permissions includes: if the determination result is that the permission corresponding to the target operation is not included in the predetermined operation permissions, generating instruction information to refuse to execute the target operation; and sending the instruction information to the target permission account, wherein the instruction information includes the determination result.

[0104] This embodiment describes the specific steps for determining whether the permission corresponding to the target operation is included in the predetermined operation permissions.

[0105] This involves instruction information, which is a control command used to inform the target account of its current permission status for performing a target operation. This instruction information can be fed back to the target account through system logs, application programming interface responses, or direct control signals. For example, when the permission corresponding to the target operation is not within the predetermined operation permission range, the instruction information may include a command to refuse to execute the target operation and a reason explanation.

[0106] In the steps involved in this embodiment, if the determination result is that the permission corresponding to the target operation is not included in the predetermined operation permission, an instruction message to refuse to execute the target operation is generated, wherein the instruction message includes the determination result, and the instruction message is sent to the target permission account.

[0107] By generating a command message to refuse execution of the target operation when the determination result indicates that the permission corresponding to the target operation is not included in the predetermined operation permissions, and sending the command message to the target permission account, the execution of unauthorized operations is promptly prevented. This ensures that all operations performed by the target permission account on the target container are performed within the preset permission scope, avoiding system anomalies caused by unauthorized operations and improving the stability of container operation. Thus, by strictly controlling permissions, the security of the target permission account's operations in the container is enhanced, reducing the risk of attack or abuse. This helps to solve the technical problem in related technologies where containers on the host machine share the same kernel, and users are prone to security risks when performing operations in the container.

[0108] The container operation execution method provided in this application embodiment receives a target operation request, wherein the target operation request carries a target operation and a target permission account. The target operation request is used to request the execution of the target operation in a target container. The target permission account is a pre-configured account in the operating system layer corresponding to the target container image. The target container image is an image corresponding to the target container. In response to the target operation request, the method determines the target operation layer corresponding to the target operation, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files. The method determines the pre-defined operation permissions corresponding to the target operation layer, wherein the pre-defined operation permissions include a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured by the pre-configured account in the target container image. The method determines whether the permission corresponding to the target operation is included in the pre-defined operation permissions. If the determination result is that the permission corresponding to the target operation is included in the pre-defined operation permissions, the method executes the target operation in the target container. By identifying the target operation layer corresponding to the target operation, it is helpful to accurately locate and execute the operation subsequently, avoiding widespread interference with the internal structure of the container and improving the efficiency of the operation and the stability of the container environment. By pre-configuring the permissions corresponding to the pre-defined permission accounts at each layer of the target container image build, the permissions for the target permission accounts to execute specific operations are pre-configured. This achieves fine-grained control over operations at different levels, such as the container runtime environment, dependency installation, and application configuration. Through permission layering, operation permissions are bound to different layers, restricting the permission scope of the target permission account (such as a non-root user), achieving operation isolation, and thus improving the stability and security of operations executed within the container. Determining whether the permissions required for the target permission account to execute the target operation request are already included in the pre-defined operation permissions set for different operation layers helps ensure that the target operations executed by the target permission account within the container are performed within the pre-defined scope of pre-defined operation permissions. Only when the result confirms that the permissions corresponding to the target operation are included in the predetermined operation permissions, is the target permission account allowed to execute the target operation in the target container. This ensures the compliance of operation execution, reduces security vulnerabilities, enhances the security of the entire container environment, and effectively solves the technical problem that users may face security risks when performing operations in containers.

[0109] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0110] Based on the above embodiments and optional embodiments, an optional implementation method is provided, which is described in detail below.

[0111] In related technologies, when users perform operations in a container, improper operations may lead to a series of security issues. For example, the processes run by the user may modify or delete system files, corrupt log files, or overwrite binary files, resulting in security problems in the container or system.

[0112] In view of this, the optional embodiments of the present invention provide an operation execution method in a container, which can also be called a multi-layer image collaborative modification method for container users. It can effectively solve the technical problem in related technologies that when users perform operations in containers on the host machine, since the container and the host machine share the same kernel, there are potential security risks.

[0113] Figure 3 This is a schematic diagram of the layered structure of a cloud container image according to an embodiment of this application. Figure 4 This is a flowchart illustrating the hierarchical permission configuration of a container image according to an embodiment of this application. Figure 5 This is a schematic diagram of an operation execution device in a container according to an embodiment of this application, such as... Figure 3 , Figure 4 ,as well as Figure 5 As shown below, a detailed description will be provided.

[0114] S1, Receive permission configuration request, wherein the permission configuration request is initiated by a predefined permission account;

[0115] S2, in response to permission configuration requests, retrieves the base container image;

[0116] Application container images (similar to the target container images mentioned above) are built upon a base image, which only provides the default root user (similar to the predefined permission account mentioned above). Currently, most application images use the default root user.

[0117] The base image (same as the base container image above) can be divided into four layers: operating system layer (same as the operating system layer above), middleware / SDK layer (same as the runtime environment layer above), cloud computing service platform layer (same as the dependency installation layer above), and application customization layer (same as the application configuration layer above). The operating system layer provides the operating system, library files, dependencies, etc. required by the application container. The middleware / SDK layer will install different middleware and development kits through the root user. The cloud computing service platform layer installs the scripts that the container depends on when it starts up, which are distributed by the cloud computing service platform, and exposes the container port, registers the ledger system, etc. The application customization layer is generally created by the application and contains the toolkits that the application uses and that do not change frequently.

[0118] In actual operation, most application containers (similar to the target container mentioned above) use the default root user to start processes. Starting application containers with the root user poses security risks such as tampering and corruption. The following vulnerabilities may occur:

[0119] (1) Privilege escalation attack: The process in the container runs as the root user. If a vulnerability is exploited, the attacker may gain root privileges and thus control the entire container. If the host machine's kernel has a vulnerability, the attacker may go further outside the container and gain root privileges on the host machine.

[0120] (2) Damage and tampering: Processes running as the root user in the container can modify or delete system files, damage log files, overwrite binary files, or perform other tampering operations, thereby hiding traces of malicious activity or carrying out persistent attacks.

[0121] (3) Security isolation failure: The original design of containers is to provide lightweight process isolation, but the high privileges of the root user in the container may break this isolation, such as accessing the host file system or even performing certain management operations on the host.

[0122] (4) Resource abuse: The root user process running in the container can consume a lot of resources on the host machine (such as CPU, memory, storage), which will affect the services on other containers or the host machine.

[0123] (5) Excessively large image: If the application needs to start the container using a user with a custom configuration, since the directory configuration and dependencies within the base image are unknown, it is necessary to modify the permissions of all directories within the container (RUN chown / chmod) to ensure that the application process can start successfully and report permission errors. This method will result in an excessively large application image size, affecting the speed of image transfer and the efficiency of container startup.

[0124] S3 creates the target permission account in the operating system layer corresponding to the base container image;

[0125] For example, a unified container user (similar to the target permission account mentioned above) can be provided at the base image layer (similar to the operating system layer, runtime environment layer, and dependency installation layer mentioned above). A dedicated container user (e.g., containeruser, which can be customized) can be created (similar to the target permission account mentioned above), and the container user's identity code (uid) and group code (gid) can be unified, making the container user a separate user and user group, distinct from the root user. This user addition is completed at the operating system layer.

[0126] S4. In the target operation layer corresponding to the base container image, configure the predefined operation permissions corresponding to the target permission account to obtain the target container image.

[0127] Specifically, S4 includes:

[0128] S41, in the runtime environment layer of the base container image, configure the first permissions of the target permission account;

[0129] For example, restrict the access scope of containeruser to ensure that it can install development toolkits and middleware, and start the development toolkit and middleware processes.

[0130] S42, in the dependency installation layer of the base container image, configure the second permissions for the target permission account;

[0131] For example, modify the permissions of files such as scripts that the cloud computing service platform depends on to restrict the access scope of containeruser, and ensure that the application container (same as the target container mentioned above) can use containeruser to be distributed on the cloud computing service platform and started on the host machine.

[0132] S43, in the application configuration layer of the base container image, configure the third permission of the target permission account;

[0133] For example, since the application image layer (similar to the application configuration layer mentioned above) needs to read and write other directories within the container, each layer of the base image must ensure that the final user is still the root user.

[0134] The code example is as follows:

[0135] ENV PATH$PATH:$APPSTARTUP_INS_DIR

[0136] WORKDIR$APPSTARTUP_INS_DIR

[0137] USER root

[0138] Starting the application container using a non-root user (same as the target permission account mentioned above) requires modifying file permissions (same as the application files mentioned above) and the container user.

[0139] First, modify the application file permissions. Use the `RUN chown / chmod` command in the container build file to modify the container file (same as the application file mentioned above) permissions, restrict the access scope of containeruser, and ensure that the application can start smoothly.

[0140] Next, to modify the container startup user, add the command `USER containeruser` after all keywords such as `COPY` and before the `CMD / ENTRYPOINT` keyword in the container build file to switch the container startup user. Furthermore, for containers that cannot be modified to run as non-root users, implement a manifest-based, strong control management approach.

[0141] The code example is as follows:

[0142] #Change the container user to containeruser

[0143] USER containeruser

[0144] CMD[". / appstartup.sh","run"]

[0145] S44 configures the predefined operation permissions corresponding to the target permission account based on the first permission, second permission, and third permission to obtain the target container image.

[0146] S5 creates and starts the target container based on the target container image.

[0147] S6, Receive target operation request, wherein the target operation request carries the target operation and the target permission account. The target operation request is used to request to execute the target operation in the target container. The target permission account is the account pre-configured in the operating system layer corresponding to the target container image. The target container image is the image corresponding to the target container.

[0148] S7, in response to the target operation request, determine the target operation layer corresponding to the target operation, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files.

[0149] S8, determine the pre-defined operation permissions corresponding to the target operation layer, wherein the pre-defined operation permissions include the first permission corresponding to the runtime environment layer, the second permission corresponding to the dependency installation layer, and the third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured in the target container image by the pre-defined permission account.

[0150] S9, Determine whether the permissions corresponding to the target operation are included in the predetermined operation permissions;

[0151] S10: If the result indicates that the permissions corresponding to the target operation are included in the predefined operation permissions, execute the target operation in the target container. If the result indicates that the permissions corresponding to the target operation are not included in the predefined operation permissions, generate an instruction message to refuse to execute the target operation; send the instruction message to the target permission account, wherein the instruction message includes the determination result.

[0152] Specifically, it also includes the process of updating the container:

[0153] A1, update the target container image to obtain the updated container image;

[0154] A2 creates and runs an updated container based on the updated container image;

[0155] A3, transfer the operation request in the target container to the update container, and obtain the transfer result;

[0156] A4. If the transfer result is that the operation request in the target container is transferred to the update container, stop running the target container.

[0157] A5, determine the running status of the updated container;

[0158] A6, Run the target container when the running state is abnormal;

[0159] A7 sends a rollback control instruction to the update container. The rollback control instruction is used to transfer operation requests that have been transferred to the update container back to the target container.

[0160] The above optional implementation methods can achieve at least the following beneficial effects:

[0161] (1) Compared with related technologies, this invention, by determining the target operation layer corresponding to the target operation, helps to accurately locate and execute operations subsequently, avoids widespread interference with the internal structure of the container, and improves the efficiency of operations and the stability of the container environment. By pre-configuring the permissions corresponding to the pre-defined permission accounts, the permissions corresponding to specific operations of the target permission accounts are pre-configured at each layer of the target container image construction, realizing fine-grained control over operations at different levels such as container runtime environment, dependency installation, and application configuration. Through permission layering, operation permissions are bound to different layers, restricting the permission scope of the target permission account (such as a non-root user), realizing operation isolation, and thus improving the stability and security of operations executed in the container.

[0162] (2) Compared with related technologies, this invention helps ensure that the target operation performed by the target account in the container is within the scope of the predefined predefined operation permissions by determining whether the permissions required for the target account to execute the target operation request are already included in the predefined operation permissions set for different operation layers. Only when the determination result is that the permissions corresponding to the target operation are included in the predefined operation permissions is the target account allowed to execute the target operation in the target container, which ensures the compliance of operation execution, reduces security vulnerabilities, enhances the security of the entire container environment, and effectively solves the technical problem in related technologies where containers on the host machine share the same kernel, and users are prone to security risks when performing operations in the container, thereby achieving the effect of improving the security and stability of operations performed in the container.

[0163] (3) Compared to related technologies, this invention configures the predetermined operation permissions of the target permission account by integrating the first, second, and third permissions, ultimately obtaining the target container image. This clearly defines the permission scope of the target permission account, ensuring that it can perform specific and necessary operations at different layers of the container image, while avoiding unauthorized access to other layers. By controlling the permissions of the target permission account layer by layer, permission layering is achieved at the runtime environment layer, dependency installation layer, and application configuration layer, ensuring that the permissions of each layer match the functional and security requirements of that layer. This avoids permission adjustments across the entire image, reduces image size, and optimizes resource usage. These permission configurations will ultimately be integrated into the target container image to form a secure container runtime environment with fine-grained permission control.

[0164] (4) Compared to related technologies, this invention creates and runs an update container based on the update container image. After the update container is running, operation requests from the target container are transferred to the update container, and the transfer result is determined. If the transfer result is that the operation requests from the target container have been transferred to the update container, the target container is stopped. This solves the problem of updating and migrating containers during operation, especially in cases where applications need frequent updates or security policies need to be adjusted, and addresses the issue of how to safely update containers without affecting the continuity of application services. By creating an update container and transferring operation requests, container updates and replacements can be completed without interrupting application services, ensuring service continuity and avoiding the risks that may arise from directly updating running containers, such as service interruption, data loss, or permission conflicts.

[0165] (5) Compared with related technologies, the present invention strengthens cloud security and reduces security risks such as tampering and damage by creating target permission accounts and controlling permissions of target permission accounts layer by layer. On the other hand, by directly using target permission accounts to install middleware and controlling the scope of file ownership changes layer by layer, the present invention effectively controls the problem of excessively large images caused by using predetermined permission accounts (such as root users) to perform operations in related technologies.

[0166] Example 2

[0167] This application also provides an operation execution device in a container. It should be noted that the operation execution device in a container according to this application can be used to execute the operation execution method for a container provided in this application. The operation execution device in a container provided in this application will be described below.

[0168] According to embodiments of this application, an apparatus for implementing the above-described operation execution method in a container is also provided, such as... Figure 5 As shown, the device includes:

[0169] Receiving module 502 is used to receive an operation request, wherein the operation request carries a target operation and a target permission account. The operation request is used to request the execution of the target operation in the target container. The target permission account is a pre-configured account in the operating system layer corresponding to the target container image. The target container image is an image corresponding to the target container. Response module 504, connected to the receiving module 502, is used to respond to the operation request and determine the target operation layer corresponding to the target operation. The target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files. First determining module 5 06, connected to the response module 504, is used to determine the predetermined operation permissions corresponding to the target operation layer. The predetermined operation permissions include a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer. The first permission, the second permission, and the third permission are pre-configured by the predetermined permission account in the target container image. The second determination module 508, connected to the first determination module 506, is used to determine whether the permission corresponding to the target operation is included in the predetermined operation permissions. The execution module 510, connected to the second determination module 508, is used to execute the target operation in the target container if the determination result is that the permission corresponding to the target operation is included in the predetermined operation permissions.

[0170] Optionally, the apparatus provided in this application embodiment further includes a retrieval module, configured to receive a permission configuration request, wherein the permission configuration request is initiated by a predetermined permission account; in response to the permission configuration request, retrieve the base container image; create a target permission account in the operating system layer corresponding to the base container image; configure the predetermined operation permissions corresponding to the target permission account in the target operation layer corresponding to the base container image, thereby obtaining the target container image.

[0171] Optionally, the apparatus provided in this application embodiment further includes a configuration module, configured to configure the first permission of the target permission account in the runtime environment layer of the base container image; configure the second permission of the target permission account in the dependency installation layer of the base container image; configure the third permission of the target permission account in the application configuration layer of the base container image; and configure the predetermined operation permissions corresponding to the target permission account according to the first permission, the second permission, and the third permission to obtain the target container image.

[0172] Optionally, the apparatus provided in this application embodiment further includes a creation module for creating and starting a target container based on the target container image.

[0173] Optionally, the apparatus provided in this application embodiment further includes an update module, used to update the target container image to obtain an updated container image; create and run an updated container based on the updated container image; transfer operation requests in the target container to the updated container to obtain a transfer result; and stop running the target container if the transfer result is that the operation requests in the target container have been transferred to the updated container.

[0174] Optionally, the apparatus provided in this application embodiment further includes a monitoring module, used to determine the running status of the update container; run the target container when the running status is abnormal; and send a rollback control instruction to the update container, wherein the rollback control instruction is used to transfer the operation request that has been transferred to the update container back to the target container.

[0175] Optionally, the apparatus provided in this application embodiment further includes a feedback module, which is used to generate instruction information to refuse to execute the target operation when the determination result is that the permission corresponding to the target operation is not included in the predetermined operation permission; and to send the instruction information to the target permission account, wherein the instruction information includes the determination result.

[0176] The container operation execution device provided in this application, through a receiving module 502, a response module 504, a first determining module 506, a second determining module 508, and an execution module 510, solves the technical problem in related technologies where, because containers on a host machine share the same kernel, users are prone to security risks when performing operations within the container. This thereby improves the security and stability of operations performed within containers.

[0177] It should be noted that the receiving module 502, the response module 504, the first determining module 506, the second determining module 508, and the execution module 510 correspond to steps S202 to S210 in Embodiment 1. Each module and its corresponding step implement the same instance and application scenario, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the modules or units described above can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These modules can also run as part of a device in the computer terminal 10 provided in Embodiment 1.

[0178] Example 3

[0179] Embodiments of this application may provide an electronic device. Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 Only one is shown in the diagram. The processor, memory, memory controller, and peripheral interface are connected to the radio frequency module, audio module, and display.

[0180] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0181] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: receiving a target operation request, wherein the target operation request carries a target operation and a target permission account, the target operation request is used to request the execution of the target operation in a target container, the target permission account is a pre-configured account in the operating system layer corresponding to the target container image, and the target container image is an image corresponding to the target container; responding to the target operation request, determining the target operation layer corresponding to the target operation, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer, the runtime environment layer is a layer used to configure the runtime environment, the dependency installation layer is a layer used to configure script files, and the application configuration layer is a layer used to configure application files; determining the pre-defined operation permissions corresponding to the target operation layer, wherein the pre-defined operation permissions include a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer, the first permission, the second permission, and the third permission are pre-configured in the target container image by the pre-configured account; determining whether the permission corresponding to the target operation is included in the pre-defined operation permissions; if the determination result is that the permission corresponding to the target operation is included in the pre-defined operation permissions, executing the target operation in the target container.

[0182] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: receiving a permission configuration request, wherein the permission configuration request is initiated by a predetermined permission account; in response to the permission configuration request, retrieving the base container image; creating a target permission account in the operating system layer corresponding to the base container image; configuring the predetermined operation permissions corresponding to the target permission account in the target operation layer corresponding to the base container image, thereby obtaining the target container image.

[0183] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: in the runtime environment layer of the base container image, configure the first permission of the target permission account; in the dependency installation layer of the base container image, configure the second permission of the target permission account; in the application configuration layer of the base container image, configure the third permission of the target permission account; based on the first permission, the second permission, and the third permission, configure the predetermined operation permissions corresponding to the target permission account to obtain the target container image.

[0184] The processor can also access information and applications stored in memory via a transmission device to perform the following steps: create and start the target container based on the target container image.

[0185] The processor can also access information and applications stored in memory via a transmission device to perform the following steps: update the target container image to obtain an updated container image; create and run an updated container based on the updated container image; transfer operation requests from the target container to the updated container to obtain a transfer result; and stop running the target container if the transfer result is that the operation requests from the target container have been transferred to the updated container.

[0186] The processor can also access information and applications stored in memory via a transmission device to perform the following steps: determine the running status of the update container; run the target container if the running status is abnormal; and send a rollback control instruction to the update container, wherein the rollback control instruction is used to transfer operation requests that have been transferred to the update container back to the target container.

[0187] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the determination result is that the permission corresponding to the target operation is not included in the predetermined operation permission, generate instruction information to refuse to execute the target operation; send the instruction information to the target permission account, wherein the instruction information includes the determination result.

[0188] An electronic device is provided using embodiments of this application. Through one or more of the electronic devices ( Figure 6 The diagram shows only one component: a processor, a memory, a memory controller, and a peripheral interface. The peripheral interface is connected to a radio frequency module, an audio module, and a display. The processor can also access information and applications stored in the memory via a transmission device to execute steps S202 to S210 in Embodiment 1. This addresses the technical problem in related technologies where, because containers and the host machine share the same kernel, users performing operations within containers are prone to security risks. Therefore, it improves the security and stability of operations performed within containers.

[0189] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0190] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0191] Example 4

[0192] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the operation execution method in the container provided in Embodiment 1.

[0193] Optionally, in this embodiment, it may be a computer-readable storage medium, which includes a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to execute the operation execution method in the container described in any of the above.

[0194] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0195] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing operation execution method steps in a container.

[0196] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0197] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0198] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0199] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0200] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0201] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0202] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for performing operations in a container, characterized in that, include: Receive a target operation request, wherein the target operation request carries a target operation and a target permission account, the target operation request is used to request the execution of the target operation in the target container, the target permission account is a pre-configured account in the operating system layer corresponding to the target container image, and the target container image is an image corresponding to the target container; In response to the target operation request, a target operation layer corresponding to the target operation is determined, wherein the target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is a layer for configuring the runtime environment, the dependency installation layer is a layer for configuring script files, and the application configuration layer is a layer for configuring application files. Determine the predetermined operation permissions corresponding to the target operation layer, wherein the predetermined operation permissions include a first permission corresponding to the runtime environment layer, a second permission corresponding to the dependency installation layer, and a third permission corresponding to the application configuration layer, wherein the first permission, the second permission, and the third permission are pre-configured in the target container image by the predetermined permission account; Determine whether the permission corresponding to the target operation is included in the predetermined operation permissions; If the determination result indicates that the permissions corresponding to the target operation include the predetermined operation permissions, the target operation is executed in the target container.

2. The method according to claim 1, characterized in that, Before determining the target operation layer corresponding to the target operation, the following steps are included: Receive a permission configuration request, wherein the permission configuration request is initiated by the predefined permission account; In response to the permission configuration request, retrieve the base container image; Create the target permission account in the operating system layer corresponding to the base container image; In the target operation layer corresponding to the base container image, the predetermined operation permissions corresponding to the target permission account are configured to obtain the target container image.

3. The method according to claim 2, characterized in that, The step of configuring the predetermined operation permissions corresponding to the target permission account in the target operation layer corresponding to the base container image to obtain the target container image includes: Configure the first permissions of the target permission account in the runtime environment layer of the base container image; In the dependency installation layer of the base container image, configure the second permission of the target permission account; In the application configuration layer of the base container image, configure the third permission of the target permission account; Based on the first permission, the second permission, and the third permission, the predetermined operation permissions corresponding to the target permission account are configured to obtain the target container image.

4. The method according to claim 1, characterized in that, Before determining the target operation layer corresponding to the target operation, the following steps are included: Based on the target container image, create and start the target container.

5. The method according to claim 4, characterized in that, After creating the target container based on the target container image, the process includes: Update the target container image to obtain the updated container image; Based on the updated container image, create and run the updated container; The operation request in the target container is transferred to the update container to obtain the transfer result; If the transfer result is that the operation request in the target container is transferred to the update container, the target container is stopped from running.

6. The method according to claim 5, characterized in that, When the transfer result is that the operation request in the target container is transferred to the update container, after stopping the target container, the process includes: Determine the running status of the update container; If the running state is abnormal, run the target container; Send a rollback control instruction to the update container, wherein the rollback control instruction is used to transfer the operation request that has been transferred to the update container back to the target container.

7. The method according to any one of claims 1 to 6, characterized in that, The determination result of whether the permission corresponding to the target operation is included in the predetermined operation permissions includes: If the determination result is that the permission corresponding to the target operation does not include the predetermined operation permission, an instruction message is generated to refuse to execute the target operation; The instruction information is sent to the target authorized account, wherein the instruction information includes the determination result.

8. An operation execution device in a container, characterized in that, include: A receiving module is used to receive an operation request, wherein the operation request carries a target operation and a target permission account, the operation request is used to request the execution of the target operation in the target container, the target permission account is a pre-configured account in the operating system layer corresponding to the target container image, and the target container image is an image corresponding to the target container; A response module is used to respond to the operation request and determine the target operation layer corresponding to the target operation. The target operation layer includes a runtime environment layer, a dependency installation layer, and an application configuration layer. The runtime environment layer is used to configure the runtime environment, the dependency installation layer is used to configure script files, and the application configuration layer is used to configure application files. The first determining module is used to determine the predetermined operation permissions corresponding to the target operation layer, wherein the predetermined operation permissions include the first permission corresponding to the runtime environment layer, the second permission corresponding to the dependency installation layer, and the third permission corresponding to the application configuration layer, wherein the first permission, the second permission, and the third permission are pre-configured by the predetermined permission account in the target container image; The second determining module is used to determine whether the permission corresponding to the target operation is included in the determination result of the predetermined operation permissions; An execution module is configured to execute the target operation in the target container if the determination result indicates that the permissions corresponding to the target operation include the predetermined operation permissions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device containing the computer-readable storage medium to perform the operation execution method in the container of any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running a program, wherein the program, when running, executes the operation execution method in the container of any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that, The steps of the operation execution method in the container of any one of claims 1 to 7 are implemented when the computer instructions are executed by the processor.

Images