Operation and maintenance management method and device for containerized environment, equipment and medium

Abstract

The invention discloses an operation and maintenance management method and device for a containerized environment, equipment and a medium, and relates to the technical field of container management, and the method comprises the steps: obtaining a target container environment isolation instruction, and determining a target container and a target preset isolation mode based on the target container environment isolation instruction; obtaining container information of the target container through a preset container information obtaining mode, and creating a corresponding temporary isolation directory for the target container based on the container information; loading a namespace combination template according to a target preset isolation mode, and initializing a corresponding temporary isolation namespace by using the namespace combination template; and binding the temporary isolation namespace with the temporary isolation directory, and mounting a directory of a host machine tool corresponding to the target container to a read-only path of the temporary isolation directory to obtain a target temporary isolation namespace so as to start an interactive shell script in the target temporary isolation namespace. And performing operation and maintenance management on the target container through the interactive shell script.

Description

Technical Field

[0001] The present invention relates to the field of container management technology, and in particular to an operation and maintenance management method, device, equipment and medium for a containerized environment. Background Art

[0002] Container technology, as a lightweight virtualization technology, achieves efficient resource utilization and rapid application deployment by isolating application runtime environments. It has become the foundation of cloud computing and microservices architectures. When a container experiences an anomaly, operations and maintenance personnel often need to access the container for operational analysis. Currently, to address troubleshooting and management issues in container environments, Docker exec or the nsenter tool are commonly used. The Docker exec solution enables container access and maintenance by invoking commands during runtime. This relies entirely on existing container tools and requires the container's operational requirements to be met. This approach is ineffective when container and tool system failures occur. Furthermore, when containers are built using minimalist principles, the lack of commonly used tools prevents direct execution of necessary diagnostic commands, significantly reducing troubleshooting efficiency. The nsenter tool allows access to the namespace of a specified process to execute commands within the namespace for container access and maintenance. However, this requires manual specification of the target process and the namespace type to be entered, and requires additional commands to locate the corresponding process identifier for the container. Furthermore, it lacks environmental preparation and configuration features, requiring manual configuration. This increases the number of steps required, raises the barrier to use, and is prone to errors.

[0003] To sum up, how to resolve the contradiction between environmental isolation and tool environment, which leads to inefficient container operation and maintenance management, is a technical problem that needs to be solved urgently. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, apparatus, device, and medium for the operation and maintenance management of a containerized environment, which can solve the problem of low efficiency in container operation and maintenance management caused by the contradiction between environmental isolation and tool environment. The specific solution is as follows: In a first aspect, the present application provides an operation and maintenance management method for a containerized environment, including: Obtain a target container environment isolation instruction, and determine a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction; the target preset isolation mode is a mode for isolation based on a combination of namespaces according to operation and maintenance requirements; the namespaces include a network namespace, a process namespace, and a file system namespace; Acquire container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; Loading a corresponding namespace combination template according to the target preset isolation mode, and initializing a corresponding temporary isolation namespace using the namespace combination template; Bind the temporary isolation namespace to the temporary isolation directory, and mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0005] Optionally, determining a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction includes: Parsing the target container environment isolation instruction to determine a target preset isolation mode and a target container identifier in the target container environment isolation instruction; Obtaining a namespace path of a target container according to the target container identifier; Accordingly, the step of loading a corresponding namespace combination template according to the target preset isolation mode and initializing a corresponding temporary isolation namespace using the namespace combination template includes: Load the corresponding namespace combination template according to the target preset isolation mode; Determine the namespace to be combined corresponding to the namespace combination template, and determine the target namespace path corresponding to the namespace to be combined through the namespace path; Initialize a temporary isolation namespace corresponding to the target preset isolation mode based on the target namespace path.

[0006] Optionally, the acquiring the container information of the target container by using a preset container information acquisition method includes: If it is detected that the target containerization platform is currently running, the storage layer path of the target container is obtained through a preset containerization platform application programming interface, or if it is not detected that the target containerization platform is currently running, the storage layer path of the target container is obtained by calling the application programming interface of other container runtimes except the target container; Or, by calling a preset container orchestration management system application programming interface, obtaining the container information of the target container of the target deployment unit in the target container orchestration management system; Alternatively, by calling the application programming interface of the target container runtime, the relevant process of the target container is queried to determine the process identifier of the relevant process, and the target directory content of the target container is parsed according to the process identifier to obtain the namespace information and control group information mounted on the target container.

[0007] Optionally, creating a corresponding temporary isolation directory for the target container based on the container information includes: Determine a container root directory path of the target container according to the container information, and bind-mount the container root directory path to a preset root file system mount point to map the container root directory path to a temporary isolation directory; Generate target script environment variables through the container information to initialize the shell script; Marking the working mode of the shell script based on the target preset isolation mode, and adding the corresponding target container environment variables to the shell script according to the container information to obtain the interactive shell script; Creating a session metadata file containing the container information, so that when the session of the interactive shell script is interrupted, the session environment of the interactive shell script is rebuilt based on the session metadata file; The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container when it is running.

[0008] Optionally, after creating a corresponding temporary isolation directory for the target container based on the container information, the method further includes: The directory of the preset software tool is mounted to the temporary isolation directory, so that when the host tool is unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tool.

[0009] Optionally, loading a corresponding namespace combination template according to the target preset isolation mode and initializing a corresponding temporary isolation namespace using the namespace combination template includes: If the target preset isolation mode is the preset network view mode, load the corresponding container network namespace combination template and inherit the network namespace of the target container to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container; If the target preset isolation mode is the preset process sandbox mode, the corresponding container process namespace combination template is loaded, and based on the preset network view mode, the process namespace of the target container is shared, and a new file system namespace is created, so as to utilize the container process namespace combination template to initialize a temporary isolation namespace whose mount point is located in the newly created file system namespace; If the target preset isolation mode is the preset complete isolation mode, the corresponding container file system namespace combination template is loaded, and on the basis of the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in the network dimension, process dimension and file system dimension.

[0010] Optionally, starting an interactive shell script in the target temporary isolation namespace and performing operation and maintenance management of the target container through the interactive shell script includes: Launching an interactive shell script in the target temporary isolated namespace; Determine whether the current interactive shell script session meets a preset active condition; If the current session status of the interactive shell script meets the preset active condition, the interactive shell script monitors the operation and maintenance management instructions of the target container, and after monitoring the operation and maintenance management instructions, executes the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumps to the step of determining whether the current session status of the interactive shell script meets the preset active condition; If the current session status of the interactive shell script does not meet the preset active condition, the session of the interactive shell script is cleared.

[0011] In a second aspect, the present application provides an operation and maintenance management device for a containerized environment, comprising: A mode determination module is used to obtain a target container environment isolation instruction and determine a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction; A directory creation module, configured to obtain container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; A space initialization module is used to load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template; A directory mounting module is used to bind the temporary isolation namespace to the temporary isolation directory, and to mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0012] In a third aspect, the present application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned operation and maintenance management method for the containerized environment.

[0013] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned operation and maintenance management method of the containerized environment.

[0014] In this application, a target container environment isolation instruction is obtained, and a corresponding target container and a target preset isolation mode are determined based on the target container environment isolation instruction; container information of the target container is obtained through a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information; a corresponding namespace combination template is loaded according to the target preset isolation mode, and the corresponding temporary isolation namespace is initialized using the namespace combination template; the temporary isolation namespace is bound to the temporary isolation directory, and the directory of the host tool corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace, and perform operation and maintenance management of the target container through the interactive shell script. As can be seen from the above, the present application first obtains the target container environment isolation instruction, and determines the target container and the target preset isolation mode accordingly, and then obtains the container information of the target container through the preset container information acquisition method to create a temporary isolation directory according to the container information, and then loads the corresponding namespace combination template according to the target preset isolation mode, and initializes the temporary isolation namespace, and finally binds the temporary isolation namespace to the temporary isolation directory, and mounts the host tool directory to the read-only path of the temporary isolation directory to form a target temporary isolation namespace, so that the interactive shell script can be started therein to perform operation and maintenance management on the target container. In this way, through the above process of the present application, the traditional full namespace binding is decoupled into an independent control dimension, and the namespace is combined on demand according to the target preset isolation mode to initialize the temporary isolation namespace, and ensure that all operation traces are limited to the temporary isolation space, which can effectively avoid interference with the normal operation of the target container. At the same time, by mounting the host tool directory, it is convenient for operation and maintenance personnel to use familiar tools to operate, improve operation and maintenance efficiency and security, and achieve efficient management of the container environment, thereby solving the problem of low efficiency of container operation and maintenance management caused by the contradiction between environment isolation and tool environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0016] Figure 1 This is a flow chart of an operation and maintenance management method for a containerized environment disclosed in this application; Figure 2A schematic diagram of the modular architecture of an operation and maintenance management method for a containerized environment disclosed in this application; Figure 3 This is a core operation flow diagram of an operation and maintenance management method for a containerized environment disclosed in this application; Figure 4 A schematic diagram of a framework of a preset isolation mode disclosed in this application; Figure 5 This is a schematic diagram of the structure of an operation and maintenance management device for a containerized environment disclosed in this application; Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0018] When a container anomaly occurs, operations and maintenance personnel often need to enter the container to perform operations and maintenance analysis. Currently, to address troubleshooting and management issues in container environments, Docker exec solutions or nsenter tools are commonly used for container access. The Docker exec solution implements container access and maintenance by calling commands while the container is running. This relies entirely on existing tools within the container and requires the container to meet its operating conditions. It is not applicable when the container and tool systems fail. Furthermore, when containers are built using the minimization principle, the lack of commonly used tools prevents the direct execution of necessary diagnostic commands, significantly reducing troubleshooting efficiency. The nsenter tool allows access to the namespace of a specified process to execute commands within the namespace for container access and maintenance. However, the target process and the namespace type to be entered must be manually specified, and other commands must be used to find the process identifier corresponding to the container. Furthermore, it does not provide environmental preparation and configuration functions, requiring configuration to be performed manually. This increases the number of steps, raises the barrier to use, and is prone to errors.

[0019] In order to overcome the above technical problems, the present application provides an operation and maintenance management method for a containerized environment to solve the problem of low efficiency of container operation and maintenance management caused by the contradiction between environmental isolation and tool environment.

[0020] See also Figure 1 As shown, an embodiment of the present invention discloses an operation and maintenance management method for a containerized environment, including: Step S11, obtain the target container environment isolation instruction, and determine the corresponding target container and the target preset isolation mode based on the target container environment isolation instruction; the target preset isolation mode is a mode for isolation based on the combined namespace according to operation and maintenance requirements; the namespace includes a network namespace, a process namespace and a file system namespace.

[0021] In this embodiment, after obtaining the target container environment isolation instruction, the target container to be operated and managed and the corresponding specified target preset isolation mode are determined according to the target container environment isolation instruction. The target container environment isolation instruction is an isolation instruction initiated by the user through a preset interface, such as exec --net <container ID>, which means temporarily switching to the network environment of the target container in the current command; the target preset isolation mode is a mode of isolation based on the combination of namespaces according to operation and maintenance requirements; the namespace includes a network namespace, a process namespace, and a file system namespace.

[0022] It needs to be explained that, Figure 2 The figure shows a modular architecture diagram of an operation and maintenance management method for a containerized environment provided by the present application. That is, the operation and maintenance management method for a containerized environment of the present application adopts a three-layer modular architecture, wherein the user interaction layer is used to provide a multi-mode selection interface, supporting the input of operation instructions for three preset modes: network view, process sandbox, and complete isolation. The target container environment isolation instruction is an instruction initiated through the CLI (Command-Line Interface) command line interface of the user interaction layer; the policy decision layer is used to generate a dynamic isolation policy according to the preset mode selected by the user, including namespace combination rules, resource mounting schemes, and security control logic; the kernel adaptation layer is used to implement underlying operations such as namespace switching, file system mounting, and environment isolation through the operating system kernel interface. As Figure 3 The figure shows a core operation process diagram of an operation and maintenance management method for a containerized environment provided by the present application. First, the user inputs the target container environment isolation instruction, receives the target container environment isolation instruction, parses the target container identifier and isolation mode, and then, when a container such as Docker (a containerized platform) or Kubernetes (a container orchestration management system) is adapted across platforms, obtains the process identifier and namespace path of the target container, selects and loads the corresponding namespace combination template according to the isolation mode, such as only inheriting the network namespace, and then creates a temporary isolation space, dynamically configures the container context environment, and starts a shell (a command line interpreter) interactive script in the initialization environment, limiting the operation scope to the isolated sandbox while being able to share the resources and environment in the container.

[0023] It should be pointed out that, after obtaining the target container environment isolation instruction, the processing flow of determining the target container and the target preset isolation mode in this embodiment is as follows: parsing the target container environment isolation instruction to determine the target preset isolation mode and the target container identifier in the target container environment isolation instruction; obtaining the namespace path of the target container according to the target container identifier. That is, parsing the target container environment isolation instruction to determine the target preset isolation mode specified by the user and the target container identifier of the target container, and obtaining the namespace path of the target container according to the target container identifier, so as to subsequently initialize the temporary isolation namespace corresponding to the target preset isolation model according to the namespace path. In this way, this embodiment proposes an isolation mode form that can combine namespaces for isolation according to operation and maintenance requirements, supports users to combine namespace isolation according to their own needs, improves the flexibility of container isolation, and meets the different operation and maintenance needs of users.

[0024] Step S12: Acquire container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information.

[0025] In this embodiment, container information related to the target container is obtained using a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information to ensure the isolation and security of container operation and maintenance operations. The temporary isolation directory is an independent temporary directory allocated for each container session, used for storing and clearing all operations and configuration restrictions within this scope; the container information is the relevant parameters and metadata of the target container during runtime.

[0026] It should be noted that this embodiment dynamically identifies the container environment through the open interface and implementation principle of common container runtimes and automatically obtains container runtime-related parameters and metadata, namely, the container information. The processing flow is as follows: If it is detected that the target containerization platform is currently running, the storage layer path of the target container is obtained through the preset containerization platform application programming interface, or, if it is not detected that the target containerization platform is currently running, the storage layer path of the target container is obtained by calling the application programming interface of other container runtimes other than the target container; or, by calling the preset container orchestration management system application programming interface, the container information of the target container of the target deployment unit in the target container orchestration management system is obtained; or, by calling the application programming interface of the target container runtime, the relevant process of the target container is queried to determine the process identifier of the relevant process, and the target directory content of the target container is parsed according to the process identifier to obtain the namespace information and control group information of the target container mount. Among them, the target deployment unit is the smallest deployment unit in the target container orchestration management system. That is, this embodiment can obtain the storage layer path of the target container based on the judgment of whether the target containerization platform is currently running. Specifically, if it is detected that it is running, it can be obtained through the preset containerization platform application programming interface, such as Docker API (i.e., Application Programming Interface); if it is not detected that it is running, it can be obtained by calling the application programming interface of other container runtimes except the target container. This embodiment can also query the process identifier (i.e., Process ID, PID) of the relevant process of the target container by calling the application programming interface of the target container runtime, and parse the target directory content of the target container according to the process identifier to obtain the namespace information and control group (i.e., Cgroup, Control Group) information mounted on the target container, for example, by parsing the linux (an operating system) directory / proc / <pid> / ns and / proc / <pid> / cgroup, etc., to obtain the namespace information and Cgroup information of the container mount. In addition, this embodiment can also obtain container information of the target container, the smallest deployment unit in the target container orchestration management system, including but not limited to container ID (identity document) information, runtime type, and other information, by calling a preset container orchestration management system application programming interface, such as the K8S (i.e., Kubernetes, a container orchestration management system) API.

[0027] It should be further pointed out that the temporary isolation directory contains the preset root file system mount point, interactive shell script and session metadata file, and its storage format can be as follows: / tmp / <container ID> / ├── rootfs # Preset root file system mount point, used to mount the root directory of the container file system in full isolation mode ├── rc_file # Dynamically generated environment configuration file, also known as interactive shell script, used for the default configuration loaded when the shell is opened └── profile #Session metadata file, used to persist data and avoid repeated operations and data retrieval; Therefore, the processing flow for creating the temporary isolation directory is as follows: determine the container root directory path of the target container according to the container information, and bind and mount the container root directory path to the preset root file system mount point to map the container root directory path to the temporary isolation directory; generate the target script environment variable through the container information to initialize the shell script; mark the working mode of the shell script based on the target preset isolation mode, and add the corresponding target container environment variable to the shell script according to the container information to obtain the interactive shell script; create a session metadata file containing the container information, so that when the session of the interactive shell script is interrupted, the session environment of the interactive shell script can be rebuilt based on the session metadata file; wherein, the temporary isolation directory includes the preset root file system mount point, the interactive shell script and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container when it is running. That is, this embodiment first determines the container root directory path of the target container according to the storage layer path in the container information, that is, the container root directory path obtained from the Docker / K8S runtime, and bind-mounts the container root directory path to the preset root file system mount point, maps the container root directory path to a temporary isolation directory, and forms a file view consistent with the target container; then generates target script environment variables such as the preset container root directory path, the host tool chain symbolic link path, etc. through the container information to initialize the shell script, and marks the working mode of the shell script based on the target preset isolation mode, such as whether the process command is mounted. The interactive shell script is then created based on the container information, such as the namespace, whether it is in full isolation mode, etc. The corresponding target container environment variables are added to the shell script, such as dynamically setting a PS1 prompt (an environment variable) such as [container-abc123] to identify the current container, thereby obtaining the interactive shell script. Finally, a session metadata file containing the container information is created, including but not limited to the container ID, the main process PID, and the original namespace information of the target container. This allows the interactive shell script session environment to be quickly rebuilt based on the session metadata file when the interactive shell script session is interrupted or manually interrupted, without the need to re-acquire information. It is understood that this embodiment can also securely encapsulate functions in the interactive shell script to provide convenient operations, such as one-click mounting of the container root directory, one-click mounting tools, etc.

[0028] It should be noted that after creating the temporary isolation directory, this embodiment can also mount a directory of preset software tools into the temporary isolation directory. This allows the target container's operation and maintenance management to be performed by calling the preset software tools when the host tools are unavailable. In other words, to alleviate the issue of most commonly used tools being unavailable, this embodiment can mount a set of preset software tools, such as the directory of busybox (an open source project that provides common operating system commands), into the temporary isolation directory, resolving the binary opposition between full isolation and full sharing in traditional container operation and maintenance solutions. In this way, this embodiment automatically obtains the container information of the target container through a preset container information acquisition method, avoiding the tedious process of manual configuration and information acquisition, and greatly improving the efficiency and accuracy of obtaining container runtime data; a temporary isolation directory is created according to the container information, so that all operations and configuration restrictions are stored and cleaned within this range, which can ensure the isolation and security of operations; a preset root file system mount point is set in the temporary isolation directory, which can be switched in a completely isolated state to alleviate the unavailability of most common tools, and at the same time, a session metadata file for persistent data is set to support breakpoint operation recovery, which can avoid repeated operations and repeated data acquisition.

[0029] Step S13: Load the corresponding namespace combination template according to the target preset isolation mode, and use the namespace combination template to initialize the corresponding temporary isolation namespace.

[0030] In this embodiment, after creating the temporary isolation directory, the corresponding namespace combination template is loaded according to the determined target preset isolation mode, and the corresponding temporary isolation namespace is initialized using the namespace combination template. The temporary isolation namespace is a namespace created by the user based on the isolation strategy determined by the user according to their own needs and different dimensions.

[0031] Specifically, this embodiment can load the corresponding namespace combination template according to the target preset isolation mode; determine the namespace to be combined corresponding to the namespace combination template, and determine the target namespace path corresponding to the namespace to be combined through the namespace path; and initialize the temporary isolation namespace corresponding to the target preset isolation mode based on the target namespace path. That is, first load the corresponding namespace combination template, then determine the namespace to be combined corresponding to the namespace combination template, determine the target namespace path corresponding to the namespace to be combined from the namespace path, and then use the target namespace path to initialize the temporary isolation namespace corresponding to the target preset isolation mode.

[0032] It is understandable that if Figure 4 The figure shows a framework diagram of a preset isolation mode provided by the present application. Among them, the target preset isolation mode of this embodiment includes three modes: preset network view mode, preset process sandbox mode and preset complete isolation mode. Therefore, the processing flow of initializing the temporary isolation namespace according to the target preset isolation mode is as follows: If the target preset isolation mode is the preset network view mode, the corresponding container network namespace combination template is loaded, and the network namespace of the target container is inherited to utilize the container network namespace combination template to initialize the temporary isolation namespace that shares the network configuration of the target container; if the target preset isolation mode is the preset process sandbox mode, the corresponding container process namespace combination template is loaded, and on the basis of the preset network view mode, the process of the target container is shared. namespace, and a new file system namespace, so as to utilize the container process namespace combination template to initialize a temporary isolated namespace whose mount point is located in the newly created file system namespace; if the target preset isolation mode is the preset complete isolation mode, the corresponding container file system namespace combination template is loaded, and on the basis of the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to utilize the container file system namespace combination template to initialize a temporary isolated namespace that is isolated from the host machine of the target container in the network dimension, process dimension and file system dimension.That is, for the preset network view mode, after creating the temporary isolation directory used for operation and maintenance and loading the corresponding container network namespace combination template, this embodiment can inherit the network namespace of the target container and retain the process and file system namespace of the host machine, so as to use the container network namespace combination template to initialize the temporary isolation namespace and ensure the availability of the host tool chain. In this state, the interactive shell script started shares the network configuration with the container and has the same IP address, dns (Domain Name System) configuration, routing configuration, etc., and can use the network tools available in the host to troubleshoot network problems in the container; for the preset process sandbox mode, after loading the corresponding container process namespace combination template, this embodiment can share the process namespace of the target container on the basis of the preset network view mode, and at the same time create a new file system namespace to initialize the temporary isolation namespace with the mount point located in the newly created file system namespace, that is, this mode mounts the system mount point in a separately created file system namespace, so that common process management tools such as ps (a process management tool) can obtain the same process perspective in the container. At this time, it can be used in the interactive shell script. The process management tool operates and investigates the process tree and process resource usage, completing the establishment of a mapping relationship between the container process tree and the host monitoring tool. For the preset full isolation mode, after loading the container file system namespace combination template, this embodiment can inherit the container file system namespace of the target container based on the preset process sandbox mode, and simultaneously utilize a target command such as chroot (a command used to change the root directory of the currently running process and its child processes) to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, thereby initializing a temporary isolated namespace that is isolated from the host of the target container in the network, process, and file system dimensions. At this point, the interactive shell script has full access to the container's network, process, and file system space, and can locate most of the problems encountered.

[0033] It should be noted that since the preset complete isolation mode uses the same root file path, interactive shell scripts can no longer access the host's tool directory. Therefore, this embodiment can use the mounted preset software tools to alleviate the problem of most commonly used tools being unavailable. In this way, this embodiment proposes three freely combinable isolation modes: preset network view mode, preset process sandbox mode, and preset complete isolation mode. It supports namespace combination schemes at different security levels, and achieves flexible control from local to global from the three dimensions of network, process, and file system, ensuring a dynamic balance between security and convenience.

[0034] Step S14: Bind the temporary isolation namespace to the temporary isolation directory, and mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0035] In this embodiment, after creating the temporary isolation namespace and the temporary isolation directory, the two are bound, the configuration of the shell script is loaded, the container-aware prompt and security alias are set, and the directory of the host tool corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0036] It should be pointed out that the processing flow after starting the interactive shell script is as follows: starting the interactive shell script in the target temporary isolation namespace; judging whether the current session status of the interactive shell script meets the preset active condition; if the current session status of the interactive shell script meets the preset active condition, monitoring the operation and maintenance management instructions of the target container through the interactive shell script, and after monitoring the operation and maintenance management instructions, executing the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumping to the step of judging whether the current session status of the interactive shell script meets the preset active condition; if the current session status of the interactive shell script does not meet the preset active condition, clearing the session of the interactive shell script. That is, after the interactive shell script is started in the target temporary isolation namespace, this embodiment can determine in real time whether the current session status of the interactive shell script meets the preset active condition. If the preset active condition is met, it means that the current user is using the interactive shell script to perform maintenance operations. Therefore, the interactive shell script can monitor the operation and maintenance management instructions initiated by the user for the target container, and after monitoring the operation and maintenance management instructions, execute the operation and maintenance management instructions, and jump to the step of determining whether the current session status of the interactive shell script meets the preset active condition to complete the operation and maintenance management operation of the target container; if the preset active condition is not met, it is determined that the current user's maintenance operation has ended, and automatic cleanup can be triggered to clean up the session of the interactive shell script and release useless resource space. In this way, after starting the interactive shell script, this embodiment determines in real time whether the session of the current interactive shell script is active, and automatically cleans up the session after determining that it is inactive, thereby releasing excess resource space in a timely manner, avoiding resource waste, improving the efficiency of target container operation and maintenance management and the rationality of resource utilization, and ensuring that the operation and maintenance environment always remains in a good state; when it is determined to be active, it responds to operation and maintenance instructions in a timely manner to ensure that the operation and maintenance work is carried out efficiently.

[0037] As can be seen from the above, the embodiment of the present application first obtains the target container environment isolation instruction, and determines the target container and the target preset isolation mode based on this, and then obtains the container information of the target container through the preset container information acquisition method to create a temporary isolation directory according to the container information, and then loads the corresponding namespace combination template according to the target preset isolation mode, and initializes the temporary isolation namespace, and finally binds the temporary isolation namespace to the temporary isolation directory, and mounts the host tool directory to the read-only path of the temporary isolation directory to form a target temporary isolation namespace, so as to start an interactive shell script in it to perform operation and maintenance management on the target container. In this way, through the above process of the embodiment of the present application, on the one hand, an isolation mode form is proposed that can be used to isolate namespaces according to operation and maintenance needs, which supports users to combine namespace isolation according to their own needs, improves the flexibility of container isolation, and meets users' different operation and maintenance needs; on the one hand, the container information of the target container is automatically obtained through the preset container information acquisition method, avoiding the tedious process of manual configuration and information acquisition, and greatly improving the efficiency and accuracy of obtaining container runtime data; on the one hand, a temporary isolation directory is created according to the container information, so that all operations and configuration restrictions are stored and cleaned within this range, which can ensure the isolation and security of operations; on the one hand, a preset root file system mount point is set in the temporary isolation directory, which can be switched in a completely isolated state to alleviate the problem of unavailability of most common tools, and at the same time, a session metadata file for persistent data is set to support breakpoint operation recovery, which can avoid repeated operations and repeated data acquisition; On the one hand, it proposes three freely combined isolation modes: preset network view mode, preset process sandbox mode and preset complete isolation mode. It supports namespace combination schemes under different security levels, and realizes flexible control from local to global from the three dimensions of network, process and file system, ensuring a dynamic balance between security and convenience; on the one hand, after starting the interactive shell script, it judges in real time whether the session of the current interactive shell script is active, and automatically cleans up the session after judging it as inactive, so as to release excess resource space in time and avoid resource waste, thereby improving the efficiency of target container operation and maintenance management and the rationality of resource utilization, and ensuring that the operation and maintenance environment always remains in a good state; on the other hand, it responds to operation and maintenance instructions in time when it is judged to be active, ensures the efficient operation and maintenance work, and ensures that all operation traces are limited to the temporary isolation space, which can effectively avoid interference with the normal operation of the target container, and thus solve the problem of low efficiency of container operation and maintenance management caused by the contradiction between environmental isolation and tool environment.

[0038] Accordingly, see Figure 5 As shown, the embodiment of the present application also provides an operation and maintenance management device for a containerized environment, including: A mode determination module 11 is configured to obtain a target container environment isolation instruction and determine a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction; A directory creation module 12 is configured to obtain container information of the target container by using a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; A space initialization module 13 is configured to load a corresponding namespace combination template according to the target preset isolation mode, and initialize a corresponding temporary isolation namespace using the namespace combination template; The directory mounting module 14 is used to bind the temporary isolation namespace with the temporary isolation directory, and mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0039] As can be seen from the above, the embodiment of the present application first obtains the target container environment isolation instruction, and determines the target container and the target preset isolation mode accordingly, and then obtains the container information of the target container through the preset container information acquisition method to create a temporary isolation directory according to the container information, and then loads the corresponding namespace combination template according to the target preset isolation mode, and initializes the temporary isolation namespace, and finally binds the temporary isolation namespace to the temporary isolation directory, and mounts the host tool directory to the read-only path of the temporary isolation directory to form a target temporary isolation namespace, so that the interactive shell script can be started therein to perform operation and maintenance management on the target container. In this way, through the above process of the embodiment of the present application, the traditional full namespace binding is decoupled into an independent control dimension, and the namespace is combined on demand according to the target preset isolation mode to initialize the temporary isolation namespace, and ensure that all operation traces are limited to the temporary isolation space, which can effectively avoid interference with the normal operation of the target container. At the same time, by mounting the host tool directory, it is convenient for operation and maintenance personnel to use familiar tools to operate, improve operation and maintenance efficiency and security, and achieve efficient management of the container environment, thereby solving the problem of low efficiency of container operation and maintenance management caused by the contradiction between environment isolation and tool environment.

[0040] In some specific implementations, the mode determination module 11 may specifically include: An instruction parsing unit, configured to parse the target container environment isolation instruction to determine a target preset isolation mode and a target container identifier in the target container environment isolation instruction; A path acquisition unit, configured to acquire a namespace path of a target container according to the target container identifier; Accordingly, the space initialization module 13 may specifically include: A template loading unit, configured to load a corresponding namespace combination template according to the target preset isolation mode; a space determining unit, configured to determine a to-be-combined namespace corresponding to the namespace combination template, and to determine a target namespace path corresponding to the to-be-combined namespace through the namespace path; A space initialization unit is used to initialize the temporary isolation namespace corresponding to the target preset isolation mode based on the target namespace path.

[0041] In some specific implementations, the directory creation module 12 may specifically include: a path acquisition unit configured to acquire the storage layer path of the target container through a preset containerization platform application programming interface if it is detected that the target containerization platform is currently running, or to acquire the storage layer path of the target container by calling the application programming interface of another container runtime other than the target container if it is not detected that the target containerization platform is currently running; Or, an information acquisition unit is used to acquire the container information of the target container of the target deployment unit in the target container orchestration management system by calling a preset container orchestration management system application programming interface; Alternatively, a content parsing unit is configured to query a related process of the target container by calling an application programming interface when the target container is running to determine a process identifier of the related process, and parse the target directory content of the target container according to the process identifier to obtain namespace information and control group information mounted on the target container.

[0042] In some specific implementations, the directory creation module 12 may specifically include: A path mounting unit, configured to determine a container root directory path of the target container according to the container information, and bind-mount the container root directory path to a preset root file system mount point to map the container root directory path to a temporary isolation directory; A variable generating unit, configured to generate target script environment variables according to the container information to initialize a shell script; a variable adding unit, configured to mark the working mode of the shell script based on the target preset isolation mode, and add the corresponding target container environment variables to the shell script according to the container information to obtain the interactive shell script; a file creating unit, configured to create a session metadata file containing the container information, so as to reconstruct the session environment of the interactive shell script based on the session metadata file when the session of the interactive shell script is interrupted; The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container when it is running.

[0043] In some specific implementations, the operation and maintenance management device for the containerized environment may further include: The directory mounting unit is used to mount the directory of the preset software tool to the temporary isolation directory, so that when the host tool is unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tool.

[0044] In some specific implementations, the space initialization module 13 may specifically include: A space inheritance unit, configured to load a corresponding container network namespace combination template if the target preset isolation mode is a preset network view mode, and inherit the network namespace of the target container, so as to utilize the container network namespace combination template to initialize a temporary isolated namespace that shares the network configuration of the target container; a space sharing unit, configured to, if the target preset isolation mode is the preset process sandbox mode, load a corresponding container process namespace combination template, and share the process namespace of the target container and create a new file system namespace based on the preset network view mode, so as to utilize the container process namespace combination template to initialize a temporary isolation namespace whose mount point is located in the newly created file system namespace; The directory switching unit is configured to load a corresponding container file system namespace combination template if the target preset isolation mode is the preset complete isolation mode, and inherit the container file system namespace of the target container on the basis of the preset process sandbox mode, and use a target command to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in the network dimension, the process dimension, and the file system dimension.

[0045] In some specific implementations, the directory mounting module 14 may specifically include: A script launching unit, configured to launch an interactive shell script in the target temporary isolated namespace; A condition judgment unit, used to judge whether the current session of the interactive shell script meets the preset active condition; a step jumping unit, configured to, if the current session status of the interactive shell script satisfies a preset active condition, monitor the operation and maintenance management instructions of the target container through the interactive shell script, and execute the operation and maintenance management instructions after monitoring the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jump to the step of determining whether the current session status of the interactive shell script satisfies the preset active condition; The session clearing unit is configured to clear the session of the interactive shell script if the current session status of the interactive shell script does not meet a preset active condition.

[0046] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 6 This is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. The memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the operation and maintenance management method of the containerized environment disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment can specifically be an electronic computer.

[0047] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0048] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0049] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs that can be used to implement the operation and maintenance management method of the containerized environment executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks.

[0050] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned disclosed method for operating and maintaining a containerized environment. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0051] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0052] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0053] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0054] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a set of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0055] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.< / pid> < / pid>

Claims

1. A method for operation and maintenance management of a containerized environment, characterized in that: include: Obtain a target container environment isolation instruction, and determine a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction; The target preset isolation mode is a mode for isolation based on a combination of namespaces according to operation and maintenance requirements; the namespaces include network namespaces, process namespaces, and file system namespaces; Acquire container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; Loading a corresponding namespace combination template according to the target preset isolation mode, and initializing a corresponding temporary isolation namespace using the namespace combination template; Bind the temporary isolation namespace to the temporary isolation directory, and mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

2. The method for operation and maintenance management of a containerized environment according to claim 1, characterized in that: The determining of the corresponding target container and the target preset isolation mode based on the target container environment isolation instruction includes: Parsing the target container environment isolation instruction to determine a target preset isolation mode and a target container identifier in the target container environment isolation instruction; Obtaining a namespace path of a target container according to the target container identifier; Accordingly, the step of loading a corresponding namespace combination template according to the target preset isolation mode and initializing a corresponding temporary isolation namespace using the namespace combination template includes: Load the corresponding namespace combination template according to the target preset isolation mode; Determine the namespace to be combined corresponding to the namespace combination template, and determine the target namespace path corresponding to the namespace to be combined through the namespace path; Initialize a temporary isolation namespace corresponding to the target preset isolation mode based on the target namespace path.

3. The method for operation and maintenance management of a containerized environment according to claim 1, wherein: The acquiring of the container information of the target container by using a preset container information acquiring method includes: If it is detected that the target containerization platform is currently running, the storage layer path of the target container is obtained through a preset containerization platform application programming interface, or if it is not detected that the target containerization platform is currently running, the storage layer path of the target container is obtained by calling the application programming interface of other container runtimes except the target container; Or, by calling a preset container orchestration management system application programming interface, obtaining the container information of the target container of the target deployment unit in the target container orchestration management system; Alternatively, by calling the application programming interface of the target container runtime, the relevant process of the target container is queried to determine the process identifier of the relevant process, and the target directory content of the target container is parsed according to the process identifier to obtain the namespace information and control group information mounted on the target container.

4. The method for operation and maintenance management of a containerized environment according to claim 1, wherein: The creating a corresponding temporary isolation directory for the target container based on the container information includes: Determine a container root directory path of the target container according to the container information, and bind-mount the container root directory path to a preset root file system mount point to map the container root directory path to a temporary isolation directory; Generate target script environment variables through the container information to initialize the shell script; Marking the working mode of the shell script based on the target preset isolation mode, and adding the corresponding target container environment variables to the shell script according to the container information to obtain the interactive shell script; Creating a session metadata file containing the container information, so that when the session of the interactive shell script is interrupted, the session environment of the interactive shell script is rebuilt based on the session metadata file; The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container when it is running.

5. The method for operation and maintenance management of a containerized environment according to claim 1, wherein: After creating a corresponding temporary isolation directory for the target container based on the container information, the method further includes: The directory of the preset software tool is mounted to the temporary isolation directory, so that when the host tool is unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tool.

6. The method for operation and maintenance management of a containerized environment according to claim 4, characterized in that: The step of loading a corresponding namespace combination template according to the target preset isolation mode and initializing a corresponding temporary isolation namespace using the namespace combination template includes: If the target preset isolation mode is the preset network view mode, load the corresponding container network namespace combination template and inherit the network namespace of the target container to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container; If the target preset isolation mode is the preset process sandbox mode, the corresponding container process namespace combination template is loaded, and based on the preset network view mode, the process namespace of the target container is shared, and a new file system namespace is created, so as to utilize the container process namespace combination template to initialize a temporary isolation namespace whose mount point is located in the newly created file system namespace; If the target preset isolation mode is the preset complete isolation mode, the corresponding container file system namespace combination template is loaded, and on the basis of the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in the network dimension, process dimension and file system dimension.

7. The method for operation and maintenance management of a containerized environment according to any one of claims 1 to 6, characterized in that: The step of starting an interactive shell script in the target temporary isolated namespace and performing operation and maintenance management of the target container through the interactive shell script includes: Launching an interactive shell script in the target temporary isolated namespace; Determine whether the current interactive shell script session meets a preset active condition; If the current session status of the interactive shell script meets the preset active condition, the interactive shell script monitors the operation and maintenance management instructions of the target container, and after monitoring the operation and maintenance management instructions, executes the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumps to the step of determining whether the current session status of the interactive shell script meets the preset active condition; If the current session status of the interactive shell script does not meet the preset active condition, the session of the interactive shell script is cleared.

8. An operation and maintenance management device for a containerized environment, characterized in that: include: a mode determination module, configured to obtain a target container environment isolation instruction and determine a corresponding target container and a target preset isolation mode based on the target container environment isolation instruction; A directory creation module, configured to obtain container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; A space initialization module is used to load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template; A directory mounting module is used to bind the temporary isolation namespace to the temporary isolation directory, and to mount the directory of the host tool corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the operation and maintenance management method for a containerized environment as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the operation and maintenance management method of the containerized environment according to any one of claims 1 to 7.

Images