Method, system, electronic device, and storage medium for container network optimization

Abstract

The application discloses a container network optimization method, system, electronic equipment and storage medium, relates to the technical field of container network optimization, and the method comprises the steps of binding each container with a container bridge network; after a target container initiates an UPNP service request, running an UPNP proxy service in the container bridge network, so that a gateway device verifies the UPNP service request, if the verification is successful, the target container uses a target NAT type provided by the container bridge network, and accesses a server corresponding to the UPNP service request through the gateway device, wherein the target container is any container. The application can realize the function that a single device, i.e. a server, runs multiple business programs without affecting the target NAT type, improves the utilization rate of hardware resources and bandwidth resources, and enables the single device to obtain more business benefits.

Description

Technical Field

[0001] This invention relates to the field of container network optimization technology, and in particular to a method, system, electronic device, and storage medium for container network optimization. Background Technology

[0002] Currently, when each device runs only one business process, or when a device runs multiple business processes, because many business programs use fixed ports for some ports, only one business process can run whether installed on a host machine or in container host mode. If running in container bridge mode, multiple business programs can run, but the bridge mode adds an extra layer of container network NAT forwarding, making the network more difficult to penetrate. Summary of the Invention

[0003] The technical problem to be solved by this invention is to address the shortcomings of existing technologies, and specifically provides a method, system, electronic device, and storage medium for optimizing container networks, as detailed below:

[0004] 1) In a first aspect, the present invention provides a method for optimizing container networks, the specific technical solution of which is as follows:

[0005] Bind each container to the container bridge network;

[0006] When the target container initiates a UPNP service request, a UPNP proxy service is run in the container bridge network so that the gateway device can verify the UPNP service request. If the verification is successful, the target container uses the target NAT type provided by the container bridge network and accesses the server corresponding to the UPNP service request through the gateway device. The target container can be any container.

[0007] The beneficial effects of the container network optimization method provided by this invention are as follows:

[0008] Without affecting the target NAT type, the target container can utilize the target NAT type provided by the container bridge network and access the server corresponding to the UPNP service request through the gateway device. This enables a single device (i.e., the server) to run multiple business programs (specifically, when the target container sends a business processing request to the server, the server runs the business program to resolve the target container's business processing request), improving the utilization of hardware and bandwidth resources and enabling a single device to obtain more business benefits.

[0009] Based on the above scheme, the container network optimization method of the present invention can be further improved as follows.

[0010] Furthermore, it also includes:

[0011] When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request will access the target container through the exposed port of the gateway device.

[0012] The beneficial effects of adopting the above-mentioned further solutions are: it can effectively reduce the difficulty of network traversal between the target container and the server associated with the server corresponding to the UPNP service request, and improve business processing efficiency.

[0013] Furthermore, each container is created via an edge computing device.

[0014] Furthermore, the target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

[0015] 2) In a second aspect, the present invention also provides a system for optimizing container networks, the specific technical solution of which is as follows:

[0016] This includes binding modules and access modules;

[0017] The binding module is used to bind each container to the container bridge network;

[0018] The access module is used to: run a UPNP proxy service in the container bridge network after the target container initiates a UPNP service request, so that the gateway device can verify the UPNP service request. If the verification is successful, the target container can use the target NAT type provided by the container bridge network and access the server corresponding to the UPNP service request through the gateway device. The target container can be any container.

[0019] Based on the above solution, the container network optimization system of the present invention can be further improved as follows.

[0020] Furthermore, the access module is also used for:

[0021] When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request will access the target container through the exposed port of the gateway device.

[0022] Furthermore, each container is created via an edge computing device.

[0023] Furthermore, the target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

[0024] 3) In a third aspect, the present invention also provides an electronic device, the electronic device including a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to enable the electronic device to implement any of the above-described container network optimization methods.

[0025] 4) In a fourth aspect, the present invention also provides a computer-readable storage medium on which a computer program is stored, wherein the computer program, when executed by a processor, implements any of the above-described methods for container network optimization.

[0026] It should be noted that the beneficial effects of the technical solutions of the second to fourth aspects of the present invention and their corresponding possible implementations can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below:

[0028] Figure 1 This is one of the flowcharts illustrating a method for optimizing container networks according to an embodiment of the present invention;

[0029] Figure 2 This is a second schematic flowchart of a container network optimization method according to an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of the structure of a container network optimization system according to an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0032] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0033] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0034] like Figure 1 As shown, an embodiment of the present invention provides a method for optimizing container networks, comprising the following steps:

[0035] S1. Bind each container to the container bridge network;

[0036] Among them, the container bridge network is a virtual network within a single host (the edge computing device in this invention).

[0037] Each container is created using an edge computing device.

[0038] Specifically, the container can be: a container for business processing, a container for online games, a container for video conferencing, a container for data requests, a container for communication requests, or a container for permission granting, which can be configured according to the actual situation.

[0039] The process of building the container is as follows:

[0040] ① Download and install the container (Docker, Lxc, etc.) engine on the edge computing device, and configure the daemon process of the container (Docker, Lxc, etc.) engine.

[0041] ② Select suitable images from Docker Hub or other container image repositories based on business processing needs, online game needs, video conferencing needs, data request needs, communication request needs, or permission granting needs.

[0042] ③ Use container creation commands (Docker run, Lxc create, etc.) to create containers, specify the container name, the command to run, port mapping, environment variables and other configurations, and allocate necessary resources for each container, such as CPU, memory, disk space, etc.

[0043] Alternatively, you can use a data volume or a bind mount to persistently store container data.

[0044] The process of binding a container to a container bridge network is as follows:

[0045] A virtual bridge is created on the edge computing device, and an IP address is assigned to it by default. When the edge computing device creates a container, a virtual network interface is assigned to each container, and a unique IP address is assigned to each container. One end of this virtual network interface is connected to the container's network namespace, and the other end is connected to the virtual bridge, thus binding the container to the container bridge network.

[0046] Optionally, it also includes: communication between different containers via a virtual bridge, using an IP forwarding mechanism to forward data packets from one container to another.

[0047] Optionally, the container can access the external network (the server corresponding to the UPNP service request in this invention and the server associated with the server corresponding to the UPNP service request). Specifically, Network Address Translation (NAT) technology can be used to map the container's private IP address to a public IP address to enable communication between the container and the external network.

[0048] S2. When the target container initiates a UPNP service request, a UPNP proxy service is run in the container bridge network so that the gateway device can verify the UPNP service request. If the verification is successful, the target container uses the target NAT type provided by the container bridge network and accesses the server corresponding to the UPNP service request through the gateway device. The target container can be any container.

[0049] Among them, UPNP service refers to Universal Plug and Play service, which is a set of network protocols designed to automatically discover, configure and connect containers, gateway devices, servers corresponding to UPNP service requests, and servers associated with servers corresponding to UPNP service requests in container bridge networks. Specifically, UPNP service supports dynamic port mapping, allowing applications (such as online games, video conferencing, or business processing) to access internal network resources from outside the Internet.

[0050] Specifically, UPNP service requests can be: UPNP service requests related to business processing, UPNP service requests related to online games, UPNP service requests related to video conferencing, UPNP service requests related to data requests, UPNP service requests related to communication requests, or UPNP service requests related to permission granting, which can be set according to the actual situation.

[0051] When a target container initiates a UPNP service request, the UPNP proxy service running in the container bridge network detects the UPNP service request and constructs a UPNP mapping request based on the information in the UPNP service request. This information is then sent to the gateway device. The UPNP service request includes the target container's authentication information, the business processing information associated with the UPNP service request, data request information, or communication request information. The gateway device verifies the legitimacy of the UPNP service request based on the target container's authentication information and the associated business processing information, data request information, or communication request information contained in the UPNP mapping request. If the verification is successful, the target container utilizes the target NAT type provided by the container bridge network and accesses the server corresponding to the UPNP service request through the gateway device.

[0052] The UPNP proxy service constructs a UPNP mapping request based on the information in the UPNP service request. The specific implementation process is as follows:

[0053] The UPNP proxy service probes gateway devices by sending broadcast messages. Upon detection, the gateway device returns information (a response message) to the UPNP proxy service. Based on this response, the UPNP proxy service obtains the gateway device's IP address and the data format for the UPNP service. Then, it converts the information in the UPNP service request according to the data format in the response message, resulting in a UPNP mapping request that the gateway device can recognize.

[0054] The target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

[0055] Specifically, the target container utilizes the target NAT type provided by the container bridge network and accesses the server corresponding to the UPNP service request through the gateway device. The specific implementation process is as follows:

[0056] Load the kernel module of the target NAT type, modify the NAT rules in the container bridge network to the target NAT type according to the target NAT type, and the target container accesses the gateway device through the kernel module of the target NAT type, and then accesses the corresponding server through the gateway device to request UPNP services.

[0057] Among them, the target NAT type kernel module mainly refers to the module that implements the target NAT type NAT function in the kernel (such as the Linux kernel). The kernel module allows the host to communicate with the external network in the private network without a public IP address. When the target container transmits data packets from the gateway device, the target NAT type kernel module will perform address translation on the data packets according to the defined NAT rules.

[0058] NAT rules are a set of instructions configured on the gateway device to guide the device on how to perform address translation on passing data packets. These rules work based on information such as the source address, destination address, source port, and destination port of the data packet, as well as predefined translation logic.

[0059] Optionally, the above technical solution also includes:

[0060] S3. When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request is made to access the target container through the exposed port of the gateway device.

[0061] In this context, "exposed ports of a gateway device" refers to those ports on the gateway device that can be accessed by the external network (in this invention, the ports on the gateway device that interact with the target container). Exposed ports are typically used to provide access to specific network services or applications.

[0062] The server associated with the server corresponding to the UPNP service request refers to a server that has information exchange with the server corresponding to the UPNP service request and has passed security verification.

[0063] like Figure 2 As shown, the present invention will be described through another embodiment, which specifically includes the following steps:

[0064] S101. The edge computing device creates multiple N containers and binds them to the container bridge network. The N containers are denoted as: container 1 to container N.

[0065] S102. Run the UPNP agent service on the container bridge network, specifically:

[0066] ① The UPNP proxy service detects gateway devices by sending broadcast messages. Once a gateway device is detected, it returns information (response message) to the UPNP proxy service. Based on the response message returned by the gateway device, the UPNP proxy service obtains the gateway device's IP address and data format related to the UPNP service.

[0067] ②The UPNP proxy service converts the information in the UPNP service request according to the data format of the UPNP service in the response message, and obtains a UPNP mapping request that the gateway device can recognize.

[0068] ③ The gateway device verifies the legitimacy of the source of the UPNP service request based on the authentication information of the target container contained in the UPNP mapping request, as well as the business processing information, data request information, or communication request information associated with the UPNP service request. If the verification is successful (verification passed), the next step is executed; if the verification fails (verification not passed), the subsequent steps are stopped.

[0069] ④ Load the kernel module of the target NAT type, modify the NAT rules in the container bridge network to the target NAT type according to the target NAT type, and the target container accesses the gateway device through the kernel module of the target NAT type, and then accesses the UPNP service request corresponding server (first server) through the gateway device.

[0070] ⑤ When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request (the second server) accesses the target container through the exposed port of the gateway device. Specifically, it can be accessed through the UPNP proxy service or the kernel module of the target NAT type.

[0071] In the above embodiments, although the steps are numbered S1, S2, etc., they are only specific embodiments given by the present invention. Those skilled in the art can adjust the execution order of S1, S2, etc. according to the actual situation, which is also within the protection scope of the present invention. It can be understood that in some embodiments, some or all of the above embodiments may be included.

[0072] like Figure 3 As shown, a container network optimization system 200 according to an embodiment of the present invention includes a binding module 201 and an access module 202;

[0073] Binding module 201 is used to: bind each container to the container bridge network;

[0074] Access module 202 is used to: run a UPNP proxy service in the container bridge network after the target container initiates a UPNP service request, so that the gateway device can verify the UPNP service request. If the verification is successful, the target container can use the target NAT type provided by the container bridge network and access the server corresponding to the UPNP service request through the gateway device. The target container can be any container.

[0075] Optionally, in the above technical solution, the access module 202 is further used for:

[0076] When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request will access the target container through the exposed port of the gateway device.

[0077] Alternatively, in the above technical solution, each container is created via an edge computing device.

[0078] Optionally, in the above technical solutions, the target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

[0079] It should be noted that the beneficial effects of the container network optimization system 200 provided in the above embodiments are the same as those of the container network optimization method described above, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0080] The container network optimization system of the present invention can be a computer program (including program code) running on a computer device. For example, the container network optimization system of the present invention is an application software that can be used to execute the corresponding steps in the container network optimization method of the present invention.

[0081] In some embodiments, the container network optimization system of the present invention can be implemented in a combination of hardware and software. As an example, the container network optimization system of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the container network optimization method of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0082] The modules described in the embodiments of this invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0083] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-described container network optimization methods. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the container network optimization method shown in any embodiment of the present invention by calling the computer program.

[0084] In one alternative embodiment, an electronic device is provided, such as Figure 4 As shown, Figure 4 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0085] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0086] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0087] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0088] The memory 4003 stores the application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0089] Among them, electronic devices can also be terminal devices, which can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0090] It should be noted that, Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0091] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described container network optimization methods.

[0092] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0093] In an exemplary embodiment, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform any of the container network optimization methods described above.

[0094] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0095] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0096] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EEPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0097] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0098] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0099] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0100] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0101] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method of container network optimization, the method comprising: include: Bind each container to the container bridge network; When the target container initiates a UPNP service request, a UPNP proxy service is run in the container bridge network so that the gateway device can verify the UPNP service request. If the verification is successful, the target container uses the target NAT type provided by the container bridge network and accesses the server corresponding to the UPNP service request through the gateway device. The target container can be any container. The process of binding a container to a container bridge network includes: A virtual bridge is created on the edge computing device, and an IP address is assigned to the virtual bridge by default. When the edge computing device creates a container, a virtual network interface is assigned to each container, and a unique IP address is assigned to each container. One end of this virtual network interface is connected to the container's network namespace, and the other end is connected to the virtual bridge, realizing the binding between the container and the container bridge network. It also includes: communication between different containers via virtual bridges, using IP forwarding mechanisms to forward data packets from one container to another; Also includes: When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request accesses the target container through the exposed port of the gateway device. Edge computing devices create multiple containers and bind them to a container bridge network; running UPNP agent services on the container bridge network includes: The UPNP proxy service detects gateway devices by sending broadcast messages. Once a gateway device is detected, it returns a response message to the UPNP proxy service. Based on the response message returned by the gateway device, the UPNP proxy service obtains the IP address of the gateway device and the data format related to the UPNP service. The UPNP proxy service converts the information in the UPNP service request according to the data format of the UPNP service in the response message to obtain a UPNP mapping request that the gateway device can recognize. The gateway device verifies the legitimacy of the source of the UPNP service request based on the authentication information of the target container contained in the UPNP mapping request and the business processing information, data request information or communication request information associated with the UPNP service request. If the verification is successful, the next step is executed; if the verification fails, the subsequent steps are stopped. Load the kernel module of the target NAT type, modify the NAT rules in the container bridge network to the target NAT type according to the target NAT type, and the target container accesses the gateway device through the kernel module of the target NAT type, and then accesses the corresponding server through the gateway device to request UPNP services. When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request will access the target container through the exposed port of the gateway device. The target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

2. The method of container network optimization of claim 1, wherein, Each container is created via an edge computing device.

3. A system for container network optimization, characterized by, This includes binding modules and access modules; The binding module is used to bind each container to the container bridge network; The access module is used to: when the target container initiates a UPNP service request, run a UPNP proxy service in the container bridge network so that the gateway device can verify the UPNP service request. If the verification is successful, the target container can use the target NAT type provided by the container bridge network and access the server corresponding to the UPNP service request through the gateway device. The target container can be any container. The process of binding a container to a container bridge network includes: Create a virtual bridge on the edge computing device and assign an IP address to the virtual bridge by default. When the edge computing device creates a container, assign a virtual network interface to each container and assign a unique IP address inside each container. One end of this virtual network interface is connected to the container's network namespace and the other end is connected to the virtual bridge, realizing the binding between the container and the container bridge network. It also includes: communication between different containers via virtual bridges, using IP forwarding mechanisms to forward data packets from one container to another; The access module is also used for: When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request accesses the target container through the exposed port of the gateway device. Edge computing devices create multiple containers and bind them to a container bridge network; running UPNP agent services on the container bridge network includes: The UPNP proxy service detects gateway devices by sending broadcast messages. Once a gateway device is detected, it returns a response message to the UPNP proxy service. Based on the response message returned by the gateway device, the UPNP proxy service obtains the IP address of the gateway device and the data format related to the UPNP service. The UPNP proxy service converts the information in the UPNP service request according to the data format of the UPNP service in the response message to obtain a UPNP mapping request that the gateway device can recognize. The gateway device verifies the legitimacy of the source of the UPNP service request based on the authentication information of the target container contained in the UPNP mapping request and the business processing information, data request information or communication request information associated with the UPNP service request. If the verification is successful, the next step is executed; if the verification fails, the subsequent steps are stopped. Load the kernel module of the target NAT type, modify the NAT rules in the container bridge network to the target NAT type according to the target NAT type, and the target container accesses the gateway device through the kernel module of the target NAT type, and then accesses the corresponding server through the gateway device to request UPNP services. When the target container accesses the server corresponding to the UPNP service request, the server associated with the server corresponding to the UPNP service request will access the target container through the exposed port of the gateway device. The target NAT type is: full cone NAT, restricted cone NAT, port restricted cone NAT, or symmetric NAT.

4. The system for container network optimization of claim 3, wherein, Each container is created via an edge computing device.

5. An electronic device, comprising: The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements a method for optimizing a container network as described in any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements a container network optimization method according to any one of claims 1 to 2.

Images