A method, apparatus, equipment, and media for the operation and maintenance management of a containerized environment.

Abstract

This application discloses a method, apparatus, device, and medium for the operation and maintenance management of a containerized environment, relating to the field of container management technology. The method includes: obtaining a target container environment isolation instruction, and determining a target container and a target preset isolation mode based on the target container environment isolation instruction; obtaining container information of the target container through a preset container information acquisition method, and creating a corresponding temporary isolation directory for the target container based on the container information; loading a namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template; binding the temporary isolation namespace to the temporary isolation directory, and mounting the directory of the host machine tools corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

Description

Technical Field

[0001] This invention relates to the field of container management technology, and in particular to a method, apparatus, equipment and medium for the operation and maintenance management of containerized environments. Background Technology

[0002] Container technology, as a lightweight virtualization technology, achieves efficient resource utilization and rapid application deployment by isolating the application's runtime environment, and has become the infrastructure of cloud computing and microservice architectures. When a container malfunctions, operations personnel typically need to enter the container to perform operational analysis. Currently, to solve the problems of troubleshooting and management in container environments, the Docker exec solution or the nsenter tool are commonly used for container access. The Docker exec solution achieves container access and operation by calling commands while the container is running, relying entirely on existing tools within the container and requiring certain conditions for container operation. It is unsuitable when the container or tool system malfunctions, and when containers are built using a minimalist principle, the lack of commonly used tools prevents the direct execution of necessary diagnostic commands, significantly reducing troubleshooting efficiency. The nsenter tool allows entering the namespace of a specified process to execute commands for container access and operation, but it requires manually specifying the target process and the type of namespace to enter, and requires finding the corresponding process identifier of the container using other commands. Furthermore, it does not provide environment preparation and configuration functions, requiring manual configuration, increasing the operational steps, raising the barrier to entry, and making it prone to errors.

[0003] In summary, resolving the contradiction between environmental isolation and tool environment that leads to low efficiency in container operation and maintenance management is a pressing technical issue that needs to be addressed. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for the operation and maintenance management of containerized environments, which can solve the problem of low efficiency in container operation and maintenance management caused by the contradiction between environmental isolation and tool environment. The specific solution is as follows:

[0005] Firstly, this application provides a method for the operation and maintenance management of a containerized environment, including:

[0006] Obtain the target container environment isolation instruction, and determine the corresponding target container and target preset isolation mode based on the target container environment isolation instruction; the target preset isolation mode is a mode of isolation by combining namespaces according to operation and maintenance requirements; the namespaces include network namespace, process namespace and file system namespace;

[0007] The container information of the target container is obtained through a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information;

[0008] Load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template;

[0009] The temporary isolation namespace is bound to the temporary isolation directory, and the directory of the host machine tools corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace. An interactive shell script is then started in the target temporary isolation namespace to perform operation and maintenance management of the target container.

[0010] Optionally, determining the corresponding target container and target preset isolation mode based on the target container environment isolation instruction includes:

[0011] The target container environment isolation instruction is parsed to determine the target preset isolation mode and the target container identifier in the target container environment isolation instruction;

[0012] Obtain the namespace path of the target container based on the target container identifier;

[0013] Accordingly, the step of loading the corresponding namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template, includes:

[0014] Load the corresponding namespace combination template according to the target preset isolation mode;

[0015] Determine the namespace to be combined corresponding to the namespace combination template, and determine the target namespace path corresponding to the namespace to be combined through the namespace path;

[0016] The temporary isolation namespace corresponding to the target preset isolation mode is initialized based on the target namespace path.

[0017] Optionally, obtaining the container information of the target container through a preset container information acquisition method includes:

[0018] If a target containerization platform is detected to be running, the storage layer path of the target container is obtained through a preset containerization platform application programming interface; or, if no target containerization platform is detected to be running, the storage layer path of the target container is obtained by calling the application programming interface of other containers running besides the target container.

[0019] Alternatively, by calling the application programming interface of the preset container orchestration management system, the container information of the target container of the target deployment unit in the target container orchestration management system can be obtained;

[0020] Alternatively, by calling the application programming interface of the target container runtime, the relevant processes of the target container can be queried to determine the process identifier of the relevant process, and the target directory content of the target container can be parsed according to the process identifier to obtain the namespace information and control group information mounted by the target container.

[0021] Optionally, creating a corresponding temporary isolation directory for the target container based on the container information includes:

[0022] The container root directory path of the target container is determined based on the container information, and the container root directory path is bound and mounted to a preset root file system mount point to map the container root directory path to a temporary isolated directory.

[0023] The target script environment variables are generated using the container information to initialize the shell script;

[0024] The working mode of the shell script is marked based on the target preset isolation mode, and the corresponding target container environment variables are added to the shell script according to the container information to obtain the interactive shell script;

[0025] Create a session metadata file containing the container information so that the session environment of the interactive shell script can be reconstructed based on the session metadata file when the session of the interactive shell script is interrupted;

[0026] The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container during runtime.

[0027] Optionally, after creating a corresponding temporary isolation directory for the target container based on the container information, the method further includes:

[0028] The directory of preset software tools is mounted to the temporary isolation directory so that when the host machine tools are unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tools.

[0029] Optionally, the step of loading the corresponding namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template, includes:

[0030] If the target preset isolation mode is the preset network view mode, then load the corresponding container network namespace combination template and inherit the network namespace of the target container, so as to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container.

[0031] If the target preset isolation mode is the preset process sandbox mode, then the corresponding container process namespace combination template is loaded, and based on the preset network view mode, the process namespace of the target container and the newly created file system namespace are shared, so as to use the container process namespace combination template to initialize the temporary isolation namespace where the mount point is located in the newly created file system namespace.

[0032] If the target preset isolation mode is the preset full isolation mode, then the corresponding container file system namespace combination template is loaded, and based on the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in terms of network dimension, process dimension and file system dimension.

[0033] Optionally, starting an interactive shell script in the target temporary isolated namespace and performing operation and maintenance management of the target container through the interactive shell script includes:

[0034] Start an interactive shell script in the target temporary isolated namespace;

[0035] Determine whether the current session status of the interactive shell script meets the preset activity conditions;

[0036] If the current session status of the interactive shell script meets the preset active conditions, the interactive shell script listens for the operation and maintenance management instructions of the target container, and after listening for the operation and maintenance management instructions, executes the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumps to the step of determining whether the current session status of the interactive shell script meets the preset active conditions.

[0037] If the current session status of the interactive shell script does not meet the preset active conditions, then the session of the interactive shell script will be cleaned up.

[0038] Secondly, this application provides an operation and maintenance management device for a containerized environment, comprising:

[0039] The mode determination module is used to obtain the target container environment isolation instruction and determine the corresponding target container and the target preset isolation mode based on the target container environment isolation instruction;

[0040] The directory creation module is used to obtain the container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information;

[0041] The space initialization module is used to load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template.

[0042] The directory mounting module is used to bind the temporary isolation namespace to the temporary isolation directory and mount the directory of the host machine tools corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0043] Thirdly, this application provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to execute the computer program to implement the aforementioned operation and maintenance management method for containerized environments.

[0046] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned operation and maintenance management method for a containerized environment.

[0047] In this application, a target container environment isolation instruction is obtained, and a corresponding target container and a target preset isolation mode are determined based on the target container environment isolation instruction; the container information of the target container is obtained through a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information; a corresponding namespace combination template is loaded according to the target preset isolation mode, and the corresponding temporary isolation namespace is initialized using the namespace combination template; the temporary isolation namespace is bound to the temporary isolation directory, and the directory of the host machine tool corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script. As can be seen from the above, this application first obtains the target container environment isolation instruction and determines the target container and the target preset isolation mode accordingly. Then, it obtains the container information of the target container through a preset container information acquisition method to create a temporary isolation directory based on the container information. Next, it loads the corresponding namespace combination template according to the target preset isolation mode and initializes the temporary isolation namespace. Finally, it binds the temporary isolation namespace to the temporary isolation directory and mounts the host machine tool directory to the read-only path of the temporary isolation directory, forming the target temporary isolation namespace. This allows for the execution of interactive shell scripts within the namespace for operation and maintenance management of the target container. In this way, through the above process of this application, the traditional full namespace binding is decoupled into an independent control dimension. Namespaces are combined as needed according to the target preset isolation mode to initialize the temporary isolation namespace, ensuring that all operation traces are confined within the temporary isolation space. This effectively avoids interference with the normal operation of the target container. Simultaneously, by mounting the host machine tool directory, it facilitates operation by maintenance personnel using familiar tools, improving operational efficiency and security. This achieves efficient management of the container environment and solves the problem of low container operation and maintenance efficiency caused by the contradiction between environment isolation and tool environment. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 This application discloses a flowchart of an operation and maintenance management method for a containerized environment.

[0050] Figure 2This is a schematic diagram of the modular architecture of an operation and maintenance management method for a containerized environment disclosed in this application;

[0051] Figure 3 This is a schematic diagram of the core operation process of the operation and maintenance management method for a containerized environment disclosed in this application;

[0052] Figure 4 This is a schematic diagram of a pre-defined isolation mode disclosed in this application;

[0053] Figure 5 This is a schematic diagram of the operation and maintenance management device for a containerized environment disclosed in this application;

[0054] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] When a container malfunctions, operations personnel typically need to access the container to perform operational analysis. Currently, to address troubleshooting and management issues in container environments, Docker exec or the nsenter tool are commonly used for container access. Docker exec, which accesses and manages containers by calling commands while the container is running, relies entirely on existing tools within the container and requires certain conditions to be met for the container to function. It is unsuitable when the container or tool system malfunctions. Furthermore, when containers are built using a minimalist approach, the lack of commonly used tools prevents the direct execution of necessary diagnostic commands, significantly reducing troubleshooting efficiency. The nsenter tool allows access to a specified process's namespace to execute commands within that namespace, but it requires manually specifying the target process and the type of namespace to enter. It also necessitates using other commands to find the corresponding process identifier for the container. Additionally, it lacks environment preparation and configuration features, requiring manual configuration, increasing the operational steps, raising the barrier to entry, and making it prone to errors.

[0057] To overcome the aforementioned technical problems, this application provides a containerized environment operation and maintenance management method to solve the problem of low efficiency in container operation and maintenance management caused by the contradiction between environment isolation and tool environment.

[0058] See Figure 1As shown in the figure, this invention discloses an operation and maintenance management method for a containerized environment, including:

[0059] Step S11: Obtain the target container environment isolation instruction, and determine the corresponding target container and target preset isolation mode based on the target container environment isolation instruction; the target preset isolation mode is a mode of isolation by combining namespaces according to operation and maintenance requirements; the namespaces include network namespace, process namespace and file system namespace.

[0060] In this embodiment, after obtaining the target container environment isolation command, the target container to be managed and the corresponding specified target preset isolation mode are determined according to the target container environment isolation command. The target container environment isolation command is an isolation command initiated by the user through a preset interface, such as `exec --net <container ID>`, which means temporarily switching to the network environment of the target container in the current command. The target preset isolation mode is a mode that combines namespaces for isolation based on operational needs; the namespaces include network namespaces, process namespaces, and file system namespaces.

[0061] It should be noted that, such as Figure 2 The diagram illustrates the modular architecture of a containerized environment operation and maintenance management method provided in this application. Specifically, the containerized environment operation and maintenance management method of this application adopts a three-layer modular architecture. The user interaction layer provides a multi-mode selection interface, supporting operation command input for three preset modes: network view, process sandbox, and complete isolation. The target container environment isolation command is initiated through the CLI (Command-Line Interface) of the user interaction layer. The policy decision layer generates dynamic isolation policies based on the user-selected preset modes, including namespace combination rules, resource mounting schemes, and security control logic. The kernel adaptation layer implements low-level operations such as namespace switching, file system mounting, and environment isolation through the operating system kernel interface. Figure 3The diagram illustrates the core operation flow of a containerized environment operation and maintenance management method provided in this application. First, the user inputs the target container environment isolation command. The system receives the command, parses the target container identifier and isolation mode, and then adapts to container runtimes such as Docker (a containerization platform) or Kubernetes (a container orchestration management system) across platforms. It obtains the process identifier and namespace path of the target container, selects and loads the corresponding namespace combination template based on the isolation mode (e.g., only network namespace inheritance), creates a temporary isolation space, dynamically configures the container context environment, and starts a shell (a command-line interpreter) interactive script in the initialization environment, restricting the operation scope to the isolation sandbox while allowing sharing of resources and environment within the container.

[0062] It should be noted that, in this embodiment, after obtaining the target container environment isolation instruction, the processing flow for determining the target container and the target preset isolation mode is as follows: The target container environment isolation instruction is parsed to determine the target preset isolation mode and the target container identifier within the instruction; the namespace path of the target container is obtained based on the target container identifier. That is, the target container environment isolation instruction is parsed to determine the user-specified target preset isolation mode and the target container identifier, and the namespace path of the target container is obtained based on the target container identifier, so that a temporary isolation namespace corresponding to the target preset isolation model can be initialized subsequently based on the namespace path. In this way, this embodiment proposes an isolation mode form that can combine namespaces for isolation according to operational needs, supporting users to combine namespace isolation according to their own needs, improving the flexibility of container isolation, and meeting different operational needs of users.

[0063] Step S12: Obtain the container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information.

[0064] In this embodiment, container information related to the target container is obtained using a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information to ensure the isolation and security of container operation and maintenance. The temporary isolation directory is an independent temporary directory allocated for each container session, used for storing and cleaning up all operations and configuration restrictions within this scope; the container information includes the relevant parameters and metadata of the target container during runtime.

[0065] It should be noted that this embodiment dynamically identifies the container environment and automatically obtains relevant parameters and metadata of the container runtime, i.e., the container information, through the open interfaces and implementation principles of common container runtimes. The processing flow is as follows: If a target containerization platform is detected to be running, the storage layer path of the target container is obtained through a preset containerization platform application programming interface; or, if no target containerization platform is detected to be running, the storage layer path of the target container is obtained by calling the application programming interfaces of other container runtimes besides the target container; or, the container information of the target container in the target deployment unit of the target container orchestration management system is obtained by calling the application programming interface of a preset container orchestration management system; or, the relevant processes of the target container are queried by calling the application programming interface of the target container runtime to determine the process identifier of the relevant processes, and the target directory content of the target container is parsed according to the process identifier to obtain the namespace information and control group information mounted by the target container. The target deployment unit is the smallest deployment unit in the target container orchestration management system. That is, this embodiment can obtain the storage layer path of the target container based on the determination of whether a target containerization platform is currently running. Specifically, if a running application is detected, it can be obtained through a pre-defined containerization platform application programming interface, such as the Docker API (Application Programming Interface); if no running application is detected, it can be obtained by calling the application programming interfaces of other containers besides the target container. This embodiment can also query the process identifier (PID) of the relevant process of the target container by calling the application programming interface of the target container, and parse the target directory content of the target container based on the process identifier to obtain the namespace information and control group (Cgroup) information mounted by the target container. For example, by using the process PID, the / proc / directory of a Linux (an operating system) can be parsed. <pid> / ns and / proc / <pid>The system can obtain the namespace and Cgroup information of the container by accessing resources such as ` / cgroup`. In addition, this embodiment can also obtain container information of the target container, the smallest deployment unit in the target container orchestration management system, by calling a preset container orchestration management system application programming interface, such as the K8S (Kubernetes, a container orchestration management system) API. This information includes, but is not limited to, container ID (identity document) information, runtime type, and other information.

[0066] It should be further noted that the temporary isolation directory contains a preset root file system mount point, an interactive shell script, and a session metadata file, and its storage format may be as follows:

[0067] / tmp / <container ID> /

[0068] ├── rootfs # Preset root filesystem mount point, used to mount the root directory of the container filesystem in fully isolated mode.

[0069] ├── rc_file # Dynamically generated environment configuration file, also known as an interactive shell script, used to load the configuration by default when the shell starts.

[0070] └── profile # Session metadata file, used to persist data and avoid duplicate operations and data retrieval;

[0071] Therefore, the process for creating the temporary isolation directory is as follows: The root directory path of the target container is determined based on the container information, and the root directory path is bound and mounted to a preset root file system mount point to map the root directory path to the temporary isolation directory; target script environment variables are generated using the container information to initialize the shell script; the working mode of the shell script is marked based on the target preset isolation mode, and the corresponding target container environment variables are added to the shell script according to the container information to obtain the interactive shell script; a session metadata file containing the container information is created so that the session environment of the interactive shell script can be rebuilt based on the session metadata file when the session of the interactive shell script is interrupted; wherein, the temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container during runtime. In other words, this embodiment first determines the root directory path of the target container based on the storage layer path in the container information, which is the root directory path obtained from the Docker / K8S runtime. Then, by binding and mounting the root directory path to a preset root file system mount point, the root directory path is mapped to a temporary isolated directory, forming a file view consistent with the target container. Subsequently, target script environment variables such as the preset container root directory path and host toolchain symbolic link path are generated using the container information to initialize the shell script. Simultaneously, the shell script's working mode is marked based on the target preset isolation mode, such as whether a process name is mounted. Namespace, whether it is in full isolation mode, etc., are specified. Based on the container information, the corresponding target container environment variables are added to the shell script. For example, a PS1 prompt (an environment variable) such as [container-abc123] is dynamically set to identify the current container, thus obtaining the interactive shell script. Finally, a session metadata file containing the container information is created, including but not limited to the container ID, the main process PID, and the original namespace information of the target container. This allows for rapid reconstruction of the interactive shell script's session environment based on the session metadata file in the event of session interruption or manual interruption, without needing to re-acquire the information. It is understood that this embodiment can also securely encapsulate functions in the interactive shell script to provide convenient operations, such as one-click mounting of the container root directory, one-click mounting tools, etc.

[0072] It should be noted that, after creating the temporary isolation directory, this embodiment can also mount a directory of preset software tools to the temporary isolation directory. This allows the target container to be managed and maintained by calling the preset software tools when the host machine tools are unavailable. In other words, to alleviate the problem of most commonly used tools being unavailable, this embodiment can mount a set of preset software tools, such as the directory of busybox (an open-source project providing common operating system commands), to the temporary isolation directory, thus resolving the binary opposition between full isolation and full sharing in traditional container operation and maintenance solutions. In this way, this embodiment automatically obtains the container information of the target container through a preset container information acquisition method, avoiding the tedious process of manual configuration and information acquisition, and greatly improving the efficiency and accuracy of obtaining container runtime data; a temporary isolation directory is created based on the container information, so that all operations and configuration restrictions are stored and cleaned within this scope, which can ensure the isolation and security of operations; a preset root file system mount point is set in the temporary isolation directory, which can switch under complete isolation to alleviate the problem of most commonly used tools being unavailable, and a session metadata file is set for persistent data, supporting breakpoint operation recovery, which can avoid repeated operations and repeated data acquisition.

[0073] Step S13: Load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template.

[0074] In this embodiment, after creating the temporary isolated directory, a corresponding namespace combination template is loaded according to the determined target preset isolation mode, and the corresponding temporary isolated namespace is initialized using the namespace combination template. The temporary isolated namespace is a namespace created by the user based on isolation strategies determined by the user according to different dimensions.

[0075] Specifically, in this embodiment, a corresponding namespace combination template can be loaded according to the target preset isolation mode; the namespace to be combined corresponding to the namespace combination template is determined, and the target namespace path corresponding to the namespace to be combined is determined through the namespace path; a temporary isolation namespace corresponding to the target preset isolation mode is initialized based on the target namespace path. That is, the corresponding namespace combination template is loaded first, then the namespace to be combined corresponding to the namespace combination template is determined, the target namespace path corresponding to the namespace to be combined is determined from the namespace path, and then the temporary isolation namespace corresponding to the target preset isolation mode is initialized using the target namespace path.

[0076] It is understandable that, such as Figure 4 The diagram shows a framework of a preset isolation mode provided in this application. In this embodiment, the target preset isolation mode includes three modes: preset network view mode, preset process sandbox mode, and preset full isolation mode. Therefore, the process for initializing the temporary isolation namespace according to the target preset isolation mode is as follows: If the target preset isolation mode is the preset network view mode, the corresponding container network namespace combination template is loaded, and the network namespace of the target container is inherited to initialize a temporary isolation namespace sharing the network configuration of the target container using the container network namespace combination template; if the target preset isolation mode is the preset process sandbox mode, the corresponding container process namespace combination template is loaded, and the process of the target container is shared based on the preset network view mode. The system initializes a temporary isolated namespace with the mount point located in the newly created file system namespace using the container process namespace combination template. If the target preset isolation mode is a preset full isolation mode, the system loads the corresponding container file system namespace combination template and inherits the container file system namespace of the target container based on the preset process sandbox mode. The system also uses the target command to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, thereby initializing a temporary isolated namespace that is isolated from the host machine of the target container in terms of network, process, and file system dimensions using the container file system namespace combination template.In other words, for the preset network view mode, after creating the temporary isolated directory used for operation and maintenance and loading the corresponding container network namespace combination template, this embodiment can inherit the network namespace of the target container, retain the process and file system namespaces of the host machine, and use the container network namespace combination template to initialize the temporary isolated namespace, ensuring the availability of the host toolchain. In this state, the started interactive shell script shares the network configuration with the container, having the same IP address, DNS (Domain Name System) configuration, routing configuration, etc., and can use the network tools available to the host to troubleshoot network problems in the container. For the preset process sandbox mode, after loading the corresponding container process namespace combination template, this embodiment can share the process namespace of the target container on the basis of the preset network view mode, and at the same time create a new file system namespace to initialize the temporary isolated namespace where the mount point is located in the newly created file system namespace. That is, this mode mounts the system mount point in a separately created file system namespace, so that common process management tools such as ps (a process management tool) can obtain the same process perspective within the container. At this time, it is possible to use the interactive shell script. The process management tool operates on and investigates the process tree and process resource usage, establishing a mapping between the container process tree and the host monitoring tool. For the preset fully isolated mode, this embodiment, after loading the container file system namespace combination template, can inherit the target container's container file system namespace based on the preset process sandbox mode. Simultaneously, using a target command such as chroot (a command used to change the root directory of the currently running process and its child processes), the execution directory of the interactive shell script is switched to the container directory where the container's root directory path is located, thus initializing a temporary isolated namespace that is isolated from the target container's host machine in terms of network, process, and file system dimensions. At this point, the interactive shell script can fully access the container's network, process, and file system spaces, enabling it to locate most encountered problems.

[0077] It should be noted that, because the preset fully isolated mode uses the same root file path, interactive shell scripts can no longer access the host's tool directory. Therefore, this embodiment can use the mounted preset software tools to alleviate the problem of most commonly used tools being unavailable. Thus, this embodiment proposes three freely combinable isolation modes: preset network view mode, preset process sandbox mode, and preset fully isolated mode. It supports namespace combination schemes under different security levels, achieving flexible control from local to global across network, process, and file system dimensions, ensuring a dynamic balance between security and convenience.

[0078] Step S14: Bind the temporary isolation namespace to the temporary isolation directory, and mount the directory of the host machine tools corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0079] In this embodiment, after creating the temporary isolation namespace and the temporary isolation directory, the two are bound together, the configuration of the shell script is loaded, a container-aware prompt and security alias are set, and the directory of the host tools corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start the interactive shell script in the target temporary isolation namespace and perform the operation and maintenance management of the target container through the interactive shell script.

[0080] It should be noted that the processing flow after starting the interactive shell script is as follows: The interactive shell script is started in the target temporary isolated namespace; it is determined whether the current session status of the interactive shell script meets the preset active conditions; if the current session status of the interactive shell script meets the preset active conditions, the interactive shell script listens for the operation and maintenance management instructions of the target container, and upon receiving the operation and maintenance management instructions, executes the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumps to the step of determining whether the current session status of the interactive shell script meets the preset active conditions; if the current session status of the interactive shell script does not meet the preset active conditions, the session of the interactive shell script is cleaned up. That is, after the interactive shell script is started in the target temporary isolated namespace, this embodiment can determine in real time whether the current session status of the interactive shell script meets the preset active conditions. If the preset active conditions are met, it means that the current user is using the interactive shell script to perform maintenance operations. Therefore, the interactive shell script can listen for operation and maintenance management commands initiated by the user for the target container, and after listening for the operation and maintenance management commands, execute the operation and maintenance management commands and jump to the step of determining whether the current session status of the interactive shell script meets the preset active conditions to complete the operation and maintenance management operation of the target container. If the preset active conditions are not met, it is determined that the current user's maintenance operation has ended, and automatic cleanup can be triggered to clean up the session of the interactive shell script and release useless resource space. In this way, after starting the interactive shell script, this embodiment can determine in real time whether the current interactive shell script session is active, and automatically clean up the session when it is determined to be inactive, so as to release excess resource space in a timely manner, avoid resource waste, improve the efficiency of target container operation and maintenance management and the rationality of resource utilization, and ensure that the operation and maintenance environment is always in good condition; when it is determined to be active, it can respond to operation and maintenance instructions in a timely manner to ensure that operation and maintenance work is carried out efficiently.

[0081] As can be seen from the above, the embodiments of this application first obtain the target container environment isolation instruction, and determine the target container and the target preset isolation mode accordingly. Then, the container information of the target container is obtained through the preset container information acquisition method, so as to create a temporary isolation directory based on the container information. Next, the corresponding namespace combination template is loaded according to the target preset isolation mode, and the temporary isolation namespace is initialized. Finally, the temporary isolation namespace is bound to the temporary isolation directory, and the host tool directory is mounted to the read-only path of the temporary isolation directory to form the target temporary isolation namespace, so as to start an interactive shell script in it to perform operation and maintenance management of the target container. In this way, through the above process of the embodiments of this application, on the one hand, a form of isolation mode that can combine namespaces for isolation according to operational needs is proposed, supporting users to combine namespace isolation according to their own needs, improving the flexibility of container isolation and meeting different operational needs of users; on the other hand, the container information of the target container is automatically obtained through a preset container information acquisition method, avoiding the tedious process of manual configuration and information acquisition, and greatly improving the efficiency and accuracy of obtaining container runtime data; on the other hand, a temporary isolation directory is created according to the container information, so that all operations and configuration restrictions are stored and cleaned within this scope, which can ensure the isolation and security of operations; on the other hand, a preset root file system mount point is set in the temporary isolation directory, which can switch under complete isolation to alleviate the problem of most commonly used tools being unavailable, and a session metadata file for persistent data is set to support breakpoint operation recovery, which can avoid repeated operations and repeated data acquisition; This approach proposes three freely combinable isolation modes: a preset network view mode, a preset process sandbox mode, and a preset fully isolated mode. It supports namespace combination schemes under different security levels, achieving flexible control from local to global perspectives across network, process, and file system dimensions, ensuring a dynamic balance between security and convenience. On one hand, after starting the interactive shell script, it continuously checks the session's activity level and automatically cleans up the session when inactive, releasing excess resource space to avoid waste and improve the efficiency and rationality of target container operation and maintenance management, ensuring the operation and maintenance environment remains in good condition. On the other hand, it responds promptly to operation and maintenance commands when active, ensuring efficient operation and maintenance work and confining all operation traces to a temporary isolated space. This effectively avoids interference with the normal operation of the target container, thus solving the problem of low container operation and maintenance efficiency caused by the contradiction between environment isolation and tool environment.

[0082] Accordingly, see Figure 5 As shown in the illustration, this application also provides an operation and maintenance management device for a containerized environment, including:

[0083] The mode determination module 11 is used to obtain the target container environment isolation instruction and determine the corresponding target container and the target preset isolation mode based on the target container environment isolation instruction;

[0084] The directory creation module 12 is used to obtain the container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information;

[0085] The space initialization module 13 is used to load the corresponding namespace combination template according to the target preset isolation mode, and use the namespace combination template to initialize the corresponding temporary isolation namespace.

[0086] The directory mounting module 14 is used to bind the temporary isolation namespace to the temporary isolation directory and mount the directory of the host machine tools corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script.

[0087] As can be seen from the above, this embodiment first obtains the target container environment isolation instruction and determines the target container and target preset isolation mode accordingly. Then, it obtains the container information of the target container through a preset container information acquisition method to create a temporary isolation directory based on the container information. Next, it loads the corresponding namespace combination template according to the target preset isolation mode and initializes the temporary isolation namespace. Finally, it binds the temporary isolation namespace to the temporary isolation directory and mounts the host machine tool directory to the read-only path of the temporary isolation directory, forming a target temporary isolation namespace. This allows for the launch of interactive shell scripts within the namespace for operation and maintenance management of the target container. In this way, through the above process of this embodiment, the traditional full namespace binding is decoupled into an independent control dimension. Namespaces are combined as needed according to the target preset isolation mode to initialize the temporary isolation namespace, ensuring that all operation traces are confined within the temporary isolation space. This effectively avoids interference with the normal operation of the target container. Simultaneously, by mounting the host machine tool directory, it facilitates operation by maintenance personnel using familiar tools, improving operational efficiency and security. This achieves efficient management of the container environment and solves the problem of low container operation and maintenance efficiency caused by the contradiction between environment isolation and tool environment.

[0088] In some specific embodiments, the pattern determination module 11 may specifically include:

[0089] The instruction parsing unit is used to parse the target container environment isolation instruction to determine the target preset isolation mode and the target container identifier in the target container environment isolation instruction;

[0090] The path acquisition unit is used to acquire the namespace path of the target container based on the target container identifier;

[0091] Accordingly, the space initialization module 13 may specifically include:

[0092] A template loading unit is used to load the corresponding namespace combination template according to the target preset isolation mode;

[0093] A space determination unit is used to determine the namespace to be combined corresponding to the namespace combination template, so as to determine the target namespace path corresponding to the namespace to be combined through the namespace path;

[0094] The space initialization unit is used to initialize the temporary isolation namespace corresponding to the target preset isolation mode based on the target namespace path.

[0095] In some specific embodiments, the directory creation module 12 may specifically include:

[0096] The path acquisition unit is used to obtain the storage layer path of the target container through a preset containerization platform application programming interface if a target containerization platform is detected to be running, or to obtain the storage layer path of the target container by calling the application programming interface of other containers running besides the target container if no target containerization platform is detected to be running.

[0097] Alternatively, the information acquisition unit is used to acquire container information of the target container of the target deployment unit in the target container orchestration management system by calling the application programming interface of the preset container orchestration management system;

[0098] Alternatively, the content parsing unit is used to query the relevant processes of the target container by calling the application programming interface of the target container runtime, to determine the process identifier of the relevant process, and to parse the target directory content of the target container according to the process identifier to obtain the namespace information and control group information mounted by the target container.

[0099] In some specific embodiments, the directory creation module 12 may specifically include:

[0100] The path mounting unit is used to determine the container root directory path of the target container based on the container information, and bind and mount the container root directory path to a preset root file system mount point to map the container root directory path to a temporary isolated directory.

[0101] A variable generation unit is used to generate target script environment variables based on the container information to initialize the shell script;

[0102] The variable addition unit is used to mark the working mode of the shell script based on the target preset isolation mode, and add the corresponding target container environment variables to the shell script according to the container information to obtain the interactive shell script;

[0103] The file creation unit is used to create a session metadata file containing the container information so that when the session of the interactive shell script is interrupted, the session environment of the interactive shell script can be reconstructed based on the session metadata file.

[0104] The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container during runtime.

[0105] In some specific embodiments, the operation and maintenance management device for the containerized environment may further include:

[0106] The directory mounting unit is used to mount the directory of the preset software tools to the temporary isolation directory, so that when the host machine tools are unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tools.

[0107] In some specific embodiments, the space initialization module 13 may specifically include:

[0108] The space inheritance unit is used to load the corresponding container network namespace combination template and inherit the network namespace of the target container if the target preset isolation mode is the preset network view mode, so as to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container.

[0109] The space sharing unit is used to load the corresponding container process namespace combination template if the target preset isolation mode is the preset process sandbox mode, and share the process namespace of the target container and the newly created file system namespace based on the preset network view mode, so as to use the container process namespace combination template to initialize the temporary isolation namespace where the mount point is located in the newly created file system namespace.

[0110] The directory switching unit is used to load the corresponding container file system namespace combination template if the target preset isolation mode is the preset full isolation mode, and inherit the container file system namespace of the target container based on the preset process sandbox mode, and use the target command to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in terms of network dimension, process dimension and file system dimension.

[0111] In some specific embodiments, the directory mounting module 14 may specifically include:

[0112] A script startup unit is used to start an interactive shell script in the target temporary isolated namespace.

[0113] The condition judgment unit is used to determine whether the current session status of the interactive shell script meets the preset active conditions;

[0114] The step jump unit is used to listen for the operation and maintenance management instructions of the target container through the interactive shell script if the current session status of the interactive shell script meets the preset active conditions, and execute the operation and maintenance management instructions after listening to the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jump to the step of determining whether the current session status of the interactive shell script meets the preset active conditions.

[0115] The session cleanup unit is used to clean up the session of the interactive shell script if the current session status does not meet the preset active conditions.

[0116] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the operation and maintenance management method of the containerized environment disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0117] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0118] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0119] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the operation and maintenance management method of the containerized environment executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0120] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned operation and maintenance management method for a containerized environment. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0121] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0122] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0123] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0124] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0125] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.< / pid> < / pid>

Claims

1. A method for operation and maintenance management of a containerized environment, characterized in that, include: Obtain the target container environment isolation instruction, and determine the corresponding target container and target preset isolation mode based on the target container environment isolation instruction; The target preset isolation mode is a mode of isolation based on the combination of namespaces according to operation and maintenance needs; the namespaces include network namespaces, process namespaces, and file system namespaces; The container information of the target container is obtained through a preset container information acquisition method, and a corresponding temporary isolation directory is created for the target container based on the container information; Load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template; The temporary isolation namespace is bound to the temporary isolation directory, and the directory of the host machine tools corresponding to the target container is mounted to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script; The step of loading the corresponding namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template, includes: If the target preset isolation mode is the preset network view mode, then load the corresponding container network namespace combination template and inherit the network namespace of the target container, so as to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container. If the target preset isolation mode is the preset process sandbox mode, then the corresponding container process namespace combination template is loaded, and based on the preset network view mode, the process namespace of the target container and the newly created file system namespace are shared, so as to use the container process namespace combination template to initialize the temporary isolation namespace where the mount point is located in the newly created file system namespace. If the target preset isolation mode is the preset full isolation mode, then the corresponding container file system namespace combination template is loaded, and based on the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in terms of network dimension, process dimension and file system dimension.

2. The operation and maintenance management method for a containerized environment according to claim 1, characterized in that, The step of determining the corresponding target container and target preset isolation mode based on the target container environment isolation instruction includes: The target container environment isolation instruction is parsed to determine the target preset isolation mode and the target container identifier in the target container environment isolation instruction; Obtain the namespace path of the target container based on the target container identifier; Accordingly, the step of loading the corresponding namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template, includes: Load the corresponding namespace combination template according to the target preset isolation mode; Determine the namespace to be combined corresponding to the namespace combination template, and determine the target namespace path corresponding to the namespace to be combined through the namespace path; The temporary isolation namespace corresponding to the target preset isolation mode is initialized based on the target namespace path.

3. The operation and maintenance management method for a containerized environment according to claim 1, characterized in that, The step of obtaining the container information of the target container through a preset container information acquisition method includes: If a target containerization platform is detected to be running, the storage layer path of the target container is obtained through a preset containerization platform application programming interface; or, if no target containerization platform is detected to be running, the storage layer path of the target container is obtained by calling the application programming interface of other containers running besides the target container. Alternatively, by calling the application programming interface of the preset container orchestration management system, the container information of the target container of the target deployment unit in the target container orchestration management system can be obtained; Alternatively, by calling the application programming interface of the target container runtime, the relevant processes of the target container can be queried to determine the process identifier of the relevant process, and the target directory content of the target container can be parsed according to the process identifier to obtain the namespace information and control group information mounted by the target container.

4. The operation and maintenance management method for a containerized environment according to claim 1, characterized in that, The step of creating a corresponding temporary isolation directory for the target container based on the container information includes: The container root directory path of the target container is determined based on the container information, and the container root directory path is bound and mounted to a preset root file system mount point to map the container root directory path to a temporary isolated directory. The target script environment variables are generated using the container information to initialize the shell script; The working mode of the shell script is marked based on the target preset isolation mode, and the corresponding target container environment variables are added to the shell script according to the container information to obtain the interactive shell script; Create a session metadata file containing the container information so that the session environment of the interactive shell script can be reconstructed based on the session metadata file when the session of the interactive shell script is interrupted; The temporary isolation directory includes the preset root file system mount point, the interactive shell script, and the session metadata file; the session metadata file is used to persistently store the container characteristics of the target container during runtime.

5. The operation and maintenance management method for a containerized environment according to claim 1, characterized in that, After creating a corresponding temporary isolation directory for the target container based on the container information, the process further includes: The directory of preset software tools is mounted to the temporary isolation directory so that when the host machine tools are unavailable, the operation and maintenance management of the target container can be performed by calling the preset software tools.

6. The operation and maintenance management method for a containerized environment according to any one of claims 1 to 5, characterized in that, The step of starting an interactive shell script in the target temporary isolated namespace and performing operation and maintenance management of the target container through the interactive shell script includes: Start an interactive shell script in the target temporary isolated namespace; Determine whether the current session status of the interactive shell script meets the preset activity conditions; If the current session status of the interactive shell script meets the preset active conditions, the interactive shell script listens for the operation and maintenance management instructions of the target container, and after listening for the operation and maintenance management instructions, executes the operation and maintenance management instructions to perform operation and maintenance management of the target container, and jumps to the step of determining whether the current session status of the interactive shell script meets the preset active conditions. If the current session status of the interactive shell script does not meet the preset active conditions, then the session of the interactive shell script will be cleaned up.

7. An operation and maintenance management device for a containerized environment, characterized in that, include: The mode determination module is used to obtain the target container environment isolation instruction and determine the corresponding target container and the target preset isolation mode based on the target container environment isolation instruction; The directory creation module is used to obtain the container information of the target container through a preset container information acquisition method, and create a corresponding temporary isolation directory for the target container based on the container information; The space initialization module is used to load the corresponding namespace combination template according to the target preset isolation mode, and initialize the corresponding temporary isolation namespace using the namespace combination template. The directory mounting module is used to bind the temporary isolation namespace to the temporary isolation directory and mount the directory of the host machine tools corresponding to the target container to the read-only path of the temporary isolation directory to obtain the target temporary isolation namespace, so as to start an interactive shell script in the target temporary isolation namespace and perform operation and maintenance management of the target container through the interactive shell script; The step of loading the corresponding namespace combination template according to the target preset isolation mode, and initializing the corresponding temporary isolation namespace using the namespace combination template, includes: If the target preset isolation mode is the preset network view mode, then load the corresponding container network namespace combination template and inherit the network namespace of the target container, so as to use the container network namespace combination template to initialize a temporary isolation namespace that shares the network configuration of the target container. If the target preset isolation mode is the preset process sandbox mode, then the corresponding container process namespace combination template is loaded, and based on the preset network view mode, the process namespace of the target container and the newly created file system namespace are shared, so as to use the container process namespace combination template to initialize the temporary isolation namespace where the mount point is located in the newly created file system namespace. If the target preset isolation mode is the preset full isolation mode, then the corresponding container file system namespace combination template is loaded, and based on the preset process sandbox mode, the container file system namespace of the target container is inherited, and the target command is used to switch the running directory of the interactive shell script to the container directory where the container root directory path is located, so as to use the container file system namespace combination template to initialize a temporary isolation namespace that is isolated from the host machine of the target container in terms of network dimension, process dimension and file system dimension.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the operation and maintenance management method for a containerized environment as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the operation and maintenance management method of the containerized environment as described in any one of claims 1 to 6.

Images