Software deployment method and system based on double-layer containerization and dynamic decoupling

Abstract

The invention provides a software deployment method and system based on double-layer containerization and dynamic decoupling, and the method comprises the steps: generating a main program executable file through Electron compiling, and packaging the executable file into a DEB installation package based on an Electron third-party library under a Ubuntu system; dynamic script resources are obtained and compressed into a compressed package, and the compressed package is nested and packaged into the DEB installation package; a first Ubuntu system command is sent to install the DEB installation package, and main program deployment is completed; a second Ubuntu system command is sent to start the main program, and the dynamic script resources are installed in a specified directory by decompressing the compressed package; and the main program sends a third Ubuntu system command to start the dynamic script resource, and websocket connection is established after the dynamic script resource is successfully started. According to the method, a double-layer containerized nested packaging mode is adopted, so that the main program or the dynamic script resource can be independently updated, and bandwidth waste is avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a software deployment method and system based on double-layer containerization and dynamic decoupling. Background Art

[0002] To effectively utilize resources and comply with increasingly stringent data privacy regulations, model training services are gradually migrating from the cloud to local edge devices. Currently, Ubuntu desktop deployments of model training applications generally use a single packaging solution, coupling business programs with model training programs, sharing all resources and permissions.

[0003] However, this solution has the following defects: when only the business program or model training program needs to be updated, all program files in the entire installation package need to be updated, wasting bandwidth and repeatedly installing the framework content. Summary of the Invention

[0004] In order to solve the above technical problems, this application proposes a software deployment method and system based on double-layer containerization and dynamic decoupling.

[0005] According to the first aspect of the present application, a software deployment method based on double-layer containerization and dynamic decoupling is proposed, comprising: Generate the main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library in Ubuntu system; Obtain dynamic script resources and compress them into a compressed package, and nest the compressed package into the DEB installation package; Send a first Ubuntu system command to install the DEB installation package to complete the main program deployment; Sending a second Ubuntu system command to start the main program, and installing the dynamic script resource to a specified directory by decompressing the compressed package; The main program sends a third Ubuntu system command to start the dynamic script resource, and establishes a websocket connection after successful startup.

[0006] Preferably, the method further comprises: Create a decompression script in the DEB installation package; The step of installing the dynamic script resource into a designated directory by decompressing the compressed package includes: The dynamic script resource in the compressed package is decompressed and installed into the designated directory by executing the decompression script.

[0007] Preferably, the method further comprises: Create a verification script in the DEB installation package; The verification script is executed to detect whether the dynamic script resource is successfully installed in the specified directory. If the detection fails, the decompression script is executed.

[0008] Preferably, the obtaining of dynamic script resources and compressing them into a compressed package includes: Acquire a dynamic script resource and create a metadata file, generate a SHA256 digest of the dynamic script resource and save it to the metadata file, and compress the dynamic script resource and the metadata file into a compressed package; The step of detecting whether the dynamic script resource is successfully installed in the designated directory by executing the verification script and executing the decompression script if the detection fails comprises the following steps: Step a): Check whether the metadata file exists in the specified directory. If not, the detection fails and the decompression script is executed; if so, step b is executed); Step b): Generate the SHA256 digest of the dynamic script resource in the specified directory again and compare it with the SHA256 digest in the metadata file. If the comparison is consistent, the test passes; if the comparison is inconsistent, the test fails and the installation is terminated.

[0009] Preferably, the step of nesting and packaging the compressed package into the DEB installation package includes: Configure the parameters of the dynamic script resource installation directory in the development configuration file; The compressed package is packaged into the DEB installation package in the form of expanded resources according to the development configuration file.

[0010] Preferably, the second Ubuntu system command carries a parameter for disabling the sandbox isolation mechanism of the main program, and the main program disables the sandbox isolation mechanism after startup; Before decompressing the dynamic script resource, the decompression script further includes: Create the specified directory for sandbox isolation; An ACL anti-tampering policy is deployed on the dynamic script resource.

[0011] Preferably, the main program sends a third Ubuntu system command to start the dynamic script resource, and establishes a websocket connection after successful startup, including: The main program sends an http request to the dynamic script resource according to a preset heartbeat interval sequence to detect whether the dynamic script resource is started; In response to a successful request, the main program establishes a websocket connection with the dynamic script resource.

[0012] Preferably, the preset heartbeat interval sequence is generated using an exponential backoff algorithm.

[0013] Preferably, the dynamic script resource further includes websocket connections with multiple programs other than the main program, and the generation process of the preset heartbeat interval sequence includes: generating a first heartbeat interval sequence based on an exponential backoff algorithm; A random number is added to the first heartbeat interval sequence to obtain the preset heartbeat interval sequence.

[0014] According to the second aspect of the present application, a software deployment system based on double-layer containerization and dynamic decoupling is proposed, including: A file packaging module is configured to generate a main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library in the Ubuntu system; A double-layer container nesting module is configured to obtain dynamic script resources and compress them into a compressed package, and then nest the compressed package into the DEB installation package; A main program installation module is configured to send a first Ubuntu system command to install the DEB installation package and complete the main program deployment; A script installation module is configured to send a second Ubuntu system command to start the main program and install the dynamic script resource to a specified directory by decompressing the compressed package; The communication module is configured to be used by the main program to send a third Ubuntu system command to start the dynamic script resource, and to establish a websocket connection after successful startup.

[0015] According to the third aspect of the present application, an electronic device is proposed, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device implements the software deployment method based on double-layer containerization and dynamic decoupling as provided in any embodiment of the first aspect above.

[0016] According to the fourth aspect of the present application, a computer-readable storage medium is proposed, on which a computer program is stored. When the program is executed by a processor, it implements the software deployment method based on double-layer containerization and dynamic decoupling provided in any embodiment of the first aspect above.

[0017] This application proposes a software deployment method and system based on double-layer containerization and dynamic decoupling. By adopting the nested packaging mode of DEB installation package + compressed package, double-layer containerization is realized. The main program can be automatically updated based on Electron's third-party library configuration, and the dynamic script resources can be directly updated by replacing the files in the specified directory. When the main program or dynamic script resources are updated, there is no need to update the entire program file, avoiding bandwidth consumption and repeated installation of framework content. The main program turns off the sandbox isolation mechanism, while the dynamic script resources turn on the sandbox isolation mechanism to achieve permission separation, and deploys ACL anti-tampering strategy and verification strategy for dynamic script resources to prevent dynamic script resources from being tampered with by attackers. The main program uses a heartbeat adaptive detection mechanism to detect the process startup of dynamic script resources to avoid seizing key computing resources, causing program crashes and system crashes. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present invention. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0019] Figure 1 This is a flow chart of a software deployment method based on double-layer containerization and dynamic decoupling according to a specific embodiment of the present application; Figure 2 This is a flow chart of verifying, decompressing, and installing dynamic script resources according to a specific embodiment of the present application; Figure 3 is a schematic diagram of a software deployment system based on double-layer containerization and dynamic decoupling according to an embodiment of the present application; Figure 4 is a schematic diagram of an electronic device according to a specific embodiment of the present application. DETAILED DESCRIPTION

[0020] The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the objects, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only configured to explain the present invention and are not configured to limit the present invention. For those skilled in the art, the present invention can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present invention by illustrating examples of the present invention.

[0021] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of additional identical elements in the process, method, article, or device comprising the elements.

[0022] This application proposes a software deployment method based on double-layer containerization and dynamic decoupling. Figure 1 A flowchart of a software deployment method based on double-layer containerization and dynamic decoupling according to a specific embodiment of the present application is shown. Figure 1 As shown, the method includes the above steps: Step S101: Generate a main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library in the Ubuntu system.

[0023] In a specific embodiment, the main program executable file is compiled through the Electron framework, and then the main program is packaged into a DEB installation package executable by the Ubuntu system based on the Electron third-party library under the Ubuntu system. The DEB installation package serves as the outer container.

[0024] In this embodiment, the third-party library of Electron used is electron-forge / maker-deb.

[0025] Step S102: obtaining dynamic script resources and compressing them into a compressed package, and nesting the compressed package into a DEB installation package.

[0026] In a specific embodiment, the dynamic script resource is an AI model training program compiled by python. When obtaining the dynamic script resource, a metadata file manifest.json is created, and the SHA256 digest of the dynamic script resource is generated using the SHA256 encryption algorithm. It is saved in the metadata file manifest.json as the digital signature of the dynamic script resource, and then the dynamic script resource and the metadata file are compressed into a ZIP compressed package. Then, in the development configuration file forge.config.ts, the parameter packagerConfig.extraResource of the specified directory where the dynamic script resource is to be installed is configured. According to the development configuration file, the entire ZIP compressed package is packaged into the DEB installation package in the form of extended resources. The ZIP compressed package serves as an inner container, so that the main program and the dynamic script resource form a double-layer containerized nested packaging mode.

[0027] In a specific embodiment, a verification script (postinst) and a decompression script (preinst) are created within the DEB installation package. The verification script (postinst) is used to verify the digital signature of the dynamic script resource to detect whether the dynamic script resource has been successfully installed in the specified directory. The decompression script (preinst) is used to decompress the ZIP archive according to the development configuration file (forge.config.ts) to install the dynamic script resource in the specified directory.

[0028] In a specific embodiment, in order to achieve dynamic decoupling and isolation between the main program and dynamic script resources during installation, the core content of the decompression script preinst includes: 1. Create a sandbox to isolate the designated directory where dynamic script resources are installed to achieve permission separation and prevent script intrusion; 2. Deploy ACL (access control list) anti-tampering policies for dynamic script resources to explicitly prohibit specific users / processes from writing to designated directories; 3. Safely decompress dynamic script resources.

[0029] Step S103: Install the DEB installation package through the first Ubuntu system command to complete the main program deployment.

[0030] In a specific embodiment, the first Ubuntu system command sudo dpkg -i xxx.deb is executed in the Ubuntu system terminal to install the DEB installation package.

[0031] Step S104: Start the main program and install the dynamic script resource into the designated directory by decompressing the compressed package.

[0032] In a specific embodiment, the main program is started by sending a second Ubuntu system command xxx --no-sandbox, and the second Ubuntu system command xxx --no-sandbox carries the parameter no-sandbox for disabling the sandbox isolation mechanism of the main program. The sandbox isolation mechanism is disabled after the main program is started.

[0033] In a specific embodiment, the dynamic script resource is installed into a specified directory by decompressing the compressed package, including: By executing the verification script, the dynamic script resource is tested to see if it is successfully installed in the specified directory. If the test passes, the next step is executed normally; if the test fails, the decompression script is executed; Decompress the dynamic script resources in the compressed package and install them in the specified directory by executing the decompression script.

[0034] The verification script detection specifically includes: Step a): Check whether the metadata file exists in the specified directory. If not, the test fails and the decompression script is executed; if so, step b is executed); Step b): Generate the SHA256 digest of the dynamic script resource in the specified directory again and compare it with the SHA256 digest in the metadata file. If the comparison is consistent, the test passes; if the comparison is inconsistent, the test fails and the installation is terminated.

[0035] Figure 2 The following is a flowchart of verifying, decompressing and installing dynamic script resources according to a specific embodiment of the present application. Figure 2 As shown, the complete process of verifying, decompressing and installing dynamic script resources is as follows: 1) Start the main program; 2) Execute the verification script; 2-1) Check whether the metadata file exists in the specified directory. If so, go to step 2-2); if not, go to step 3); 2-2) Generate the SHA256 digest of the dynamic script resource in the specified directory again and compare it with the SHA256 digest in the metadata file. If the comparison is consistent, execute step 2-3; if the comparison is inconsistent, execute step 2-4); 2-3) If the test passes, proceed to the next step normally; 2-4) If the test fails, the installation is terminated.

[0036] 3) Execute the decompression script; 3-1) Create a designated directory for installing sandbox isolation dynamic script resources; 3-2) Deploy ACL anti-tampering policy for dynamic script resources; 3-3) Safely decompress the dynamic script resource and proceed to step 2).

[0037] Through this method, the main program disables the sandbox isolation mechanism, while the dynamic script resource enables the sandbox isolation mechanism, achieving permission separation and preventing script intrusion. Furthermore, the dynamic script resource is further deployed with a verification strategy and ACL anti-tampering strategy to prevent dynamic script resource tampering.

[0038] Step S105: The main program sends a third Ubuntu system command to start the dynamic script resource, and establishes a websocket connection after the startup is successful.

[0039] Specifically, after the dynamic script resource is decompressed, installed, and verified, it's launched by the main program, with reduced permissions. However, after the third Ubuntu system command is sent, the actual launch time of the dynamic script resource is uncertain and subject to delay. Therefore, the WebSocket connection must be established only after the dynamic script resource has successfully launched.

[0040] Therefore, in a specific embodiment, the main program sends an HTTP request to the dynamic script resource according to a preset heartbeat interval sequence to detect whether the dynamic script resource is started. When the request is successful, the main program will establish a WebSocket connection with the dynamic script resource. In this embodiment, the preset heartbeat interval sequence can use a fixed counting interval.

[0041] In another specific embodiment, the preset heartbeat interval sequence is generated using an exponential backoff algorithm, specifically a binary exponential backoff algorithm. Using the exponential backoff algorithm to generate the heartbeat interval sequence for heartbeat detection can reduce the number of invalid HTTP request retries sent by the main program, thereby avoiding the preemption of critical computing resources and the resulting program or system crashes.

[0042] In another specific embodiment, the dynamic script resource may also include websocket connections with multiple programs other than the main program. If the dynamic script resource needs to simultaneously feed back information to multiple programs that establish communication connections, this may cause periodic information congestion. Therefore, the process of generating the preset heartbeat interval sequence may include: generating a first heartbeat interval sequence based on an exponential backoff algorithm; A random number is added to the first heartbeat interval sequence to obtain a preset heartbeat interval sequence.

[0043] By adding random phase jitter to the exponential backoff algorithm, dynamic load adjustment and adaptive activity detection are achieved to avoid dynamic script resource collapse and system crash.

[0044] In summary, the software deployment method based on double-layer containerization and dynamic decoupling provided by this application achieves the following beneficial effects: By adopting a nested packaging model of DEB installation packages and compressed packages, a two-layer containerization is achieved. The main program can automatically update based on Electron's third-party library configuration, while dynamic script resources can be updated directly by replacing files in a specified directory. When the main program or dynamic script resources are updated, there is no need to update the entire program file, avoiding bandwidth consumption and duplicate installation of framework content. The main program disables the sandbox isolation mechanism, while the dynamic script resources enable it to achieve privilege separation. ACL anti-tampering policies and verification policies are deployed on dynamic script resources to prevent tampering by attackers. The main program uses a heartbeat adaptive liveness detection mechanism to detect the start of dynamic script resource processes, avoiding the preemption of critical computing resources and the resulting program and system crashes.

[0045] According to the above-mentioned software deployment method based on double-layer containerization and dynamic decoupling, based on the same inventive concept, this application also proposes a software deployment system based on double-layer containerization and dynamic decoupling. Figure 3 A schematic diagram of a software deployment system based on double-layer containerization and dynamic decoupling according to an embodiment of the present application is shown. Figure 3 As shown, the system includes: The file packaging module 201 is configured to generate a main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library under the Ubuntu system.

[0046] The double-layer container nesting module 202 is configured to obtain dynamic script resources and compress them into a compressed package, and then nest the compressed package into a DEB installation package; The main program installation module 203 is configured to send a first Ubuntu system command to install the DEB installation package and complete the main program deployment; The script installation module 204 is configured to send a second Ubuntu system command to start the main program and install the dynamic script resource to a specified directory by decompressing the compressed package; The communication module 205 is configured to allow the main program to send a third Ubuntu system command to start the dynamic script resource, and to establish a websocket connection after the startup is successful.

[0047] According to the above-mentioned software deployment method based on double-layer containerization and dynamic decoupling, based on the same inventive concept, the present application also proposes an electronic device.

[0048] Figure 4 A schematic diagram of an electronic device according to a specific embodiment of the present application is shown. Figure 4As shown, the electronic device includes: one or more processors 301, memory 302, a bus 303, and a communication interface 304. The one or more processors 301, memory 302, and communication interface 304 are connected via bus 303. Memory 302 is used to store one or more programs. When the one or more programs are executed by the one or more processors 301, the electronic device implements the software deployment method based on dual-layer containerization and dynamic decoupling provided in any of the above embodiments.

[0049] According to the above-mentioned software deployment method based on double-layer containerization and dynamic decoupling, based on the same inventive concept, the present application also proposes a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the software deployment method based on double-layer containerization and dynamic decoupling provided by any of the above-mentioned embodiments.

[0050] In the embodiments of the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device / system / method embodiments described above are merely schematic. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0051] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0052] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0053] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0054] Obviously, those skilled in the art can make various modifications and changes to the embodiments of the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and changes are within the scope of the claims of the present invention and their equivalents, the present invention is also intended to cover these modifications and changes. The word "comprising" does not exclude the presence of other elements or steps not listed in the claims. The simple fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. Any reference signs in the claims should not be considered as limiting the scope.

Claims

1. A software deployment method based on double-layer containerization and dynamic decoupling, characterized in that: include: Generate the main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library in Ubuntu system; Obtain dynamic script resources and compress them into a compressed package, and nest the compressed package into the DEB installation package; Send a first Ubuntu system command to install the DEB installation package to complete the main program deployment; Sending a second Ubuntu system command to start the main program, and installing the dynamic script resource to a specified directory by decompressing the compressed package; The main program sends a third Ubuntu system command to start the dynamic script resource, and establishes a websocket connection after successful startup.

2. The method according to claim 1, characterized in that The method further comprises: Create a decompression script in the DEB installation package; The step of installing the dynamic script resource into a designated directory by decompressing the compressed package includes: The dynamic script resource in the compressed package is decompressed and installed into the designated directory by executing the decompression script.

3. The method according to claim 2, characterized in that The method further comprises: Create a verification script in the DEB installation package; The verification script is executed to detect whether the dynamic script resource is successfully installed in the specified directory. If the detection fails, the decompression script is executed.

4. The method according to claim 3, characterized in that The step of obtaining dynamic script resources and compressing them into a compressed package includes: Acquire a dynamic script resource and create a metadata file, generate a SHA256 digest of the dynamic script resource and save it to the metadata file, and compress the dynamic script resource and the metadata file into a compressed package; The step of detecting whether the dynamic script resource is successfully installed in the designated directory by executing the verification script and executing the decompression script if the detection fails comprises the following steps: Step a): Check whether the metadata file exists in the specified directory. If not, the detection fails and the decompression script is executed; if so, step b is executed); Step b): Generate the SHA256 digest of the dynamic script resource in the specified directory again and compare it with the SHA256 digest in the metadata file. If the comparison is consistent, the test passes; if the comparison is inconsistent, the test fails and the installation is terminated.

5. The method according to claim 1, wherein The step of nesting and packaging the compressed package into the DEB installation package includes: Configure the parameters of the dynamic script resource installation directory in the development configuration file; The compressed package is packaged into the DEB installation package in the form of expanded resources according to the development configuration file.

6. The method according to claim 2, characterized in that The second Ubuntu system command carries a parameter for disabling the sandbox isolation mechanism of the main program, and the main program disables the sandbox isolation mechanism after startup; Before decompressing the dynamic script resource, the decompression script further includes: Create the specified directory for sandbox isolation; An ACL anti-tampering policy is deployed on the dynamic script resource.

7. The method according to claim 1, characterized in that The main program sends a third Ubuntu system command to start the dynamic script resource, and establishes a websocket connection after successful startup, including: The main program sends an http request to the dynamic script resource according to a preset heartbeat interval sequence to detect whether the dynamic script resource is started; In response to a successful request, the main program establishes a websocket connection with the dynamic script resource.

8. The method according to claim 7, characterized in that The preset heartbeat interval sequence is generated using an exponential backoff algorithm.

9. The method according to claim 8, characterized in that The dynamic script resource also includes websocket connections with multiple programs other than the main program. The generation process of the preset heartbeat interval sequence includes: generating a first heartbeat interval sequence based on an exponential backoff algorithm; A random number is added to the first heartbeat interval sequence to obtain the preset heartbeat interval sequence.

10. A software deployment system based on double-layer containerization and dynamic decoupling, characterized in that: include: A file packaging module is configured to generate a main program executable file through Electron compilation, and package the executable file into a DEB installation package based on Electron's third-party library in the Ubuntu system; A double-layer container nesting module is configured to obtain dynamic script resources and compress them into a compressed package, and then nest the compressed package into the DEB installation package; A main program installation module is configured to send a first Ubuntu system command to install the DEB installation package and complete the main program deployment; A script installation module is configured to send a second Ubuntu system command to start the main program and install the dynamic script resource to a specified directory by decompressing the compressed package; The communication module is configured to be used by the main program to send a third Ubuntu system command to start the dynamic script resource, and to establish a websocket connection after successful startup.

11. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images