Mirror image generation method and device, electronic equipment and storage medium

Abstract

The invention relates to a mirror image generation method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The mirror image generation method comprises the steps of obtaining a first file list; wherein the first file list comprises newly added files and / or changed files in the container running process; the container is created based on a basic mirror image; the changed file represents a file which exists in the basic mirror image and has changed content; the newly added file represents a file which does not exist in the basic mirror image; deleting a target file from the first file list to obtain a second file list; and generating a target mirror image based on the files in the second file list and the basic mirror image. By means of the method and device, the target file can be automatically removed when the mirror image is generated, and the size of the space occupied by the mirror image generated in the container running process is reduced.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and particularly relates to a mirror image generation method and device, electronic equipment and storage medium. BACKGROUND

[0002] The mirror image (may also be referred to as a container mirror image) refers to a file system obtained by encapsulating an application program, a file required for running the application program and the like according to an Open Container Initiative (OCI) mirror image standard.

[0003] In the related art, after performing operations such as creating a file, modifying a file, deleting a file or reading a file during container running, the newly added files and the changed files in the container are packaged into a new mirror image layer, and then a new mirror image is constructed. SUMMARY

[0004] The related mirror image generation method has the problem of large occupied space of the generated mirror image.

[0005] Therefore, the present disclosure provides a mirror image generation method, device, electronic equipment, storage medium and computer program product.

[0006] According to an aspect of the present disclosure, a mirror image generation method is provided, which includes:

[0007] obtaining a first file list; wherein the first file list includes newly added files and / or changed files during container running; the container is created based on a base mirror image; the changed files represent files existing in the base mirror image but with changed content; and the newly added files represent files not existing in the base mirror image;

[0008] deleting target files from the first file list to obtain a second file list;

[0009] generating a target mirror image based on the files in the second file list and the base mirror image.

[0010] In some embodiments, the obtaining of the first file list includes:

[0011] comparing an existing mirror image layer related to the container and a container working layer to obtain the newly added files and / or the changed files during the container running; wherein the container working layer is used to store at least files generated by operations of creating a file and / or modifying a file during the container running; and the existing mirror image layer at least includes a base mirror image layer, and the base mirror image layer is a mirror image layer in the base mirror image.

[0012] In some embodiments, generating a target image based on the files in the second file list and the base image comprises:

[0013] packing the files in the second file list into a new image layer;

[0014] combining the new image layer and a base image layer to obtain the target image.

[0015] In some embodiments, the method further comprises:

[0016] obtaining feature information of each file in the first file list; wherein the feature information is determined according to file content and / or file path;

[0017] determining, as the target file, a file in the first file list whose association relationship between the feature information and preset feature information satisfies a preset condition.

[0018] In some embodiments, the method further comprises:

[0019] determining, as the target file, a file specified by a user and / or a file under a directory specified by the user in the first file list.

[0020] In some embodiments, the method further comprises:

[0021] determining, as the target file, a file selected by a user in response to a selection operation of the user on the files in the first file list.

[0022] In some embodiments, the method further comprises:

[0023] obtaining sensitive information and / or a junk file;

[0024] determining a feature of the sensitive information and / or a feature of the junk file;

[0025] determining the preset feature information based on the feature of the sensitive information and / or the feature of the junk file.

[0026] According to another aspect of the present disclosure, there is provided an image generation apparatus, the apparatus comprising:

[0027] an obtaining module configured to obtain a first file list; wherein the first file list comprises a newly added file and / or a changed file in a container running process; the container is created based on a base image; the changed file indicates a file present in the base image but with changed content; the newly added file indicates a file not present in the base image;

[0028] a deleting module configured to delete a target file from the first file list to obtain a second file list;

[0029] generate a target image based on the files in the second file list and the base image.

[0030] According to another aspect of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0031] According to another aspect of the present disclosure, a non-volatile computer readable storage medium is provided, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of the above method.

[0032] According to another aspect of the present disclosure, a computer program product is provided, comprising a computer program, or a non-volatile computer readable storage medium carrying the computer program, wherein the computer program is executed by a processor to implement the steps of the above method.

[0033] According to the aspects of the present disclosure, a first file list is obtained; wherein the first file list comprises newly added files and / or changed files in a container running process; the container is created based on a base image; the changed files represent files that exist in the base image but have changed contents; the newly added files represent files that do not exist in the base image; a target file is deleted from the first file list to obtain a second file list; and a target image is generated based on the files in the second file list and the base image. In this way, the target file can be automatically deleted when the image is generated, thereby effectively reducing the space occupied by the generated image; at the same time, the user does not need to have the ability to actively delete the target file, and can automatically delete the target file during the process of generating the image of the running container, thereby reducing the requirement for the user's coding ability and improving the user experience. In some examples, the target file can include a file containing sensitive information, so that the file containing sensitive information can be automatically deleted when the image is generated, thereby avoiding the spread of sensitive information and protecting the user's privacy and data security.

[0034] Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present disclosure and serve to explain the principles of the present disclosure.

[0036] Figure 1 A flowchart showing a method of generating an image according to some embodiments of the present disclosure.

[0037] Figure 2 FIG. 1 shows a block diagram of an electronic device according to an embodiment of the disclosure.

[0038] Figure 3 FIG. 1 shows a block diagram of an electronic device according to an embodiment of the disclosure. DETAILED DESCRIPTION

[0039] Various exemplary embodiments, features, and aspects of the disclosure will be described below in detail with reference to the accompanying drawings. The same reference numbers in different drawings denote the same or similar elements / functionally similar elements. Although various aspects of embodiments are illustrated in the drawings, the drawings are not necessarily drawn to scale unless specifically noted.

[0040] As used herein, the terms "comprise", "comprising", "have", "having", "include", "including", "contain", "containing", or variants thereof, are open-ended, and include one or more stated features, integers, elements, steps, components, or functions but do not preclude the presence or addition of one or more other features, integers, elements, steps, components, functions, or groups thereof.

[0041] When an element is referred to as being "connected", "coupled", "responsive", or "related" to another element, it can be directly connected, coupled, responsive, or related to the other element, or intervening elements can be present.

[0042] Although the terms first, second, third, etc. can be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another element / operation. Thus, a first element / operation in some embodiments could be termed a second element / operation in other embodiments without departing from the teachings of the present inventive concept.

[0043] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations.

[0044] In addition, for the purpose of convenience and brevity, detailed descriptions of well-known functions and structures incorporated herein can not be described in detail. It should be appreciated that the present disclosure can be practiced with the exact details as

[0045] First, possible application scenarios of the technical solutions in the embodiments of the disclosure will be exemplarily described below.

[0046] Scenario one, an image can be built by means of docker or kaniko, etc. through Dockerfile; wherein, docker is a container runtime (Container Runtime Interface, CRI); Kaniko is a tool designed for container image building; Dockerfile is a text file containing instructions to be executed in a container, such as instructions for installing software, creating files, etc., and also includes information such as base image. As an example, a user can prewrite or obtain a Dockerfile according to needs, and then use docker or kaniko, etc. to start a container based on the base image indicated by the Dockerfile, and automatically execute the instructions in the Dockerfile layer by layer to create files, modify files, delete files or read files, etc., wherein after executing each layer of instructions, the newly added and changed files involved in the execution of the layer of instructions are packaged into a new image layer; in this way, a new image is built by generating image layers layer by layer.

[0047] Scenario two, a running container can be saved as a new image by means of nerdctl or ctr, etc. ; wherein, nerdctl is a containerd client tool compatible with the docker command line interface (Command Line Interface, CLI) style, and ctr is the native CLI tool of Containerd; Containerd is a kind of container runtime. As an example, a container is started based on a base image, and during the running of the container, nerdctl or ctr, etc. are used to create files, modify files, delete files or read files, etc. After the above operations are completed, the newly added and changed files in the container are packaged into a new image layer, and then a new image is built.

[0048] In the related art, when the newly added and changed files are packaged into an image layer in the above scenarios, all newly added and changed files during the running of the container will be packaged, resulting in a too large occupied space of the finally generated image. Moreover, during the running of the container, the user cannot operate the image, which makes the user unable to reduce the storage space occupancy of the image by operating the image to generate the used files, and the user experience is poor.

[0049] To solve the above technical problems, the present disclosure proposes an image generation method (see the detailed description below), which can automatically delete target files before image generation during the running of the container, thereby effectively reducing the occupied space of the generated image; at the same time, the user does not need to have the ability to actively delete target files, so as to realize automatic deletion of target files, thereby reducing the requirement for user coding ability, etc., and improving the user experience.

[0050] In some examples, the target file can include a file containing sensitive information, so that the file containing sensitive information can be automatically deleted during image generation, thereby avoiding the spread of sensitive information and protecting the privacy and data security of the user. The sensitive information includes information that causes the leakage of privacy data related to the container. For example, the sensitive information includes information such as a code repository token.

[0051] Exemplarily, the image generation method provided by the present disclosure can be executed by a terminal device, a server, or a part of an electronic device, wherein the terminal device can be a desktop terminal or a mobile terminal, for example, various types of electronic devices such as a notebook computer, a tablet computer, a desktop computer, a smart phone, a smart speaker, a smart watch, a smart television, and a vehicle-mounted terminal. The server can be a standalone physical server, a server cluster composed of multiple physical servers, or a distributed system, and can also be a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, content distribution network, and big data and artificial intelligence platform.

[0052] The image generation method provided by the present disclosure will be described in detail below. Figure 1 The image generation method provided by the present disclosure will be described in detail below.

[0053] Figure 1 A flowchart of an image generation method according to some embodiments of the present disclosure is shown. As shown in the flowchart, the method can include the following steps: Figure 1

[0054] Step 101, obtaining a first file list; wherein the first file list includes a newly added file and / or a changed file in a container running process; the container is created based on a base image; the changed file represents a file that exists in the base image but the content of which is changed; and the newly added file represents a file that does not exist in the base image.

[0055] Exemplarily, the user can select a base image from a public or private image repository according to business needs, or can select a base image from the local, which is not limited; for example, when the user develops a new application, a base image with development tools can be selected from the image repository, and a container is created based on the base image, so that the user can use the development tools to perform various development operations in the container running process.

[0056] ​Since the container runs, file creation, file modification, file deletion, file reading and other operations will be performed; with the creation of files, new files will be generated accordingly, for example, installing software that is not in the base image in the container will generate configuration files and residual installation packages for the software; with the modification of files, changed files will be generated accordingly, for example, writing new content in a file in the base image will change the content of the file, thereby generating a changed file.

[0057] In some embodiments, the first file list can be obtained after the creation, modification, deletion or reading of files in the container is completed during the running of the container.

[0058] As an example, in the scenario of building an image through a Dockerfile by means of a tool such as docker or kaniko, for any layer instruction in the Dockerfile, executing the layer instruction will start a new temporary container, and file creation, file modification, file deletion or file reading and other operations can be performed in the running of the temporary container, for example, software can be installed in the temporary container through the “RUN” instruction in the Dockerfile, and files can be copied in the temporary container through the “COPY” instruction in the Dockerfile, wherein the temporary container is built on the basis of existing image layers (including base image layers and each new image layer generated by previously executing each layer instruction in the Dockerfile); then, after the creation, modification, deletion or reading of files in the temporary container is completed, a first file list corresponding to the layer instruction can be obtained, and the first file list includes files newly added and / or files changed in the running of the temporary container when executing the layer instruction; in this way, the instructions in the Dockerfile are executed layer by layer, and after each layer instruction is executed, a first file list corresponding to the layer instruction can be obtained.

[0059] As another example, in the scenario of saving a running container as a new image by means of a tool such as nerdctl or ctr, a container is started based on a base image, and file creation, file modification, file deletion or file reading and other operations can be performed in the container; then, after the creation, modification, deletion or reading of files in the container is completed, a first file list can be obtained, and the first file list includes files newly added and / or files changed in the running of the container by means of nerdctl or ctr.

[0060] In some embodiments, the obtaining the first file list can include: comparing an existing image layer related to the container and a container working layer to obtain files newly added and / or changed during running of the container; wherein the container working layer is configured to store at least files generated by a file creating operation and / or a file modifying operation during running of the container; and the existing image layer includes at least a base image layer, and the base image layer is an image layer in the base image.

[0061] The existing image layer refers to an image layer that already exists before the container working layer is created. The existing image layer can include the base image layer. Exemplarily, the existing image layer can also include a new image layer generated during an image building process before the container working layer is created. The container working layer is created on top of the existing image layer when the corresponding container is started. Files newly added during running of the container (i.e., the newly added files) and files changed during running of the container (i.e., the changed files) are stored in the container working layer. For example, based on the file creating operation performed during running of the container, the newly added files are added to the container working layer. For another example, based on the file modifying operation performed during running of the container, the corresponding file in the existing image layer is copied to the container working layer for modification, and the modified file is saved in the container working layer. Considering that the newly added files and / or the changed files during running of the container are only stored in the container working layer and not stored in the existing image layer, the files existing in the container working layer and not existing in the existing image layer can be determined as the newly added files and / or the changed files during running of the container by comparing the existing image layer and the container working layer.

[0062] As an example, in a scenario of building an image by means of a tool such as docker or kaniko through a Dockerfile, for any layer instruction in the Dockerfile, executing the layer instruction starts a new temporary container, and a new container working layer is created accordingly. Files generated by a file creating operation and / or a file modifying operation during running of the temporary container are stored in the new container working layer. Then, after the file creating, modifying, deleting, or reading operation and the like are completed in the temporary container, the newly added files and / or the changed files during running of the temporary container can be determined by comparing the existing image layer (including the base image layer and each new image layer generated by packing each layer instruction in the Dockerfile previously) and the new container working layer. In this way, the instructions in the Dockerfile are executed layer by layer. After each layer instruction is executed, the newly added files and / or the changed files during running of the corresponding temporary container for the layer instruction, i.e., the first file list corresponding to the layer instruction, can be determined by comparing the existing image layer and the corresponding new container working layer.

[0063] As another example, in a scenario of saving a running container as a new image by means of a tool such as nerdctl or ctr, a container is started based on a base image, and a container work layer is created on top of the base image layer. Files generated by creating and / or modifying files during running of the container are stored in the container work layer. After the operations of creating, modifying, deleting, or reading files in the container are completed, the base image layer and the container work layer are compared to determine the files newly added and / or changed during running of the container, that is, to obtain the first file list.

[0064] Step 102: deleting the target file from the first file list to obtain a second file list.

[0065] In some embodiments, the target file can include a business-irrelevant file and / or a file expected to be deleted by a user. The business-irrelevant file refers to a file that has no impact on business operation, for example, a temporary file, an installation package left by installed software, and the like. The file expected to be deleted by a user refers to a file subjectively expected to be deleted by a user, which can be specified by the user in advance. It can be understood that the business-irrelevant file and the file expected to be deleted by a user can be different, or can partially or wholly overlap, for example, the file expected to be deleted by a user and the business-irrelevant file can both include an installation package left by installed software.

[0066] Exemplarily, the business-irrelevant file and / or the file expected to be deleted by a user can also include a file containing sensitive information such as historical commands and user keys. In this way, the file containing sensitive information can be automatically deleted when the image is generated, reducing the occupied space of the generated image while avoiding the spread of sensitive information, protecting the private data of the user, and ensuring data security.

[0067] For example, taking the case that a user performs various development operations by using a development tool in the image as an example, the target file can include an installation file left by installed software of the user, a temporary cache file left by the user when using the development tool to perform operations, a Secure Shell (SSH) key, a token of a code repository, and the like.

[0068] As an example, in a scenario of building an image by means of a tool such as docker or kaniko through a Dockerfile, instructions in the Dockerfile are executed layer by layer. After each layer of instructions is executed, the target file is deleted from the obtained corresponding first file list to obtain a second file list corresponding to the layer of instructions. As another example, in a scenario of saving a running container as a new image by means of a tool such as nerdctl or ctr, the target file is deleted from the obtained first file list to obtain a second file list.

[0069] In some embodiments, one or more files in the first file list can be determined as target files, and then the target files are deleted from the first file list to obtain a second file list.

[0070] In some embodiments, the method further comprises determining the target files. The following illustrates the way of determining the target files.

[0071] In some embodiments, determining the target files comprises: obtaining feature information of each file in the first file list; wherein the feature information is determined according to file content and / or file path; determining a file in the first file list as the target file if an association between the feature information of the file and preset feature information satisfies a preset condition. In this way, the target files can be automatically determined based on the feature information of the files.

[0072] The file content represents the information contained in the file, for example, the code repository token. The file path represents the path of the file in the system, for example, / home / user / .ssh / id_rsa.

[0073] Exemplarily, taking the case that the feature information of the target file in the first file list is consistent with the preset feature information as an example, the feature information can be the first preset number of characters in the file content and / or the directory contained in the file path; and correspondingly, the preset feature information can be the preset number of specific characters and / or specific directory.

[0074] As an example, the feature information can be the first preset number of characters in the file content, and correspondingly, the preset feature information can be the preset number of specific characters; for any file in the first file list, the first preset number of characters in the file content of the file is determined, and the preset number of characters is compared with the preset number of specific characters, if they are consistent, the file is determined as the target file, if they are not consistent, the file is not determined as the target file. For example, considering different software vendors, the first certain number of characters in the code repository token are different, for example, the GitLab token starts with “glpat”, and the preset feature information can be set as “glpat”; for any file in the first file list, the first 5 characters in the code repository token of the file can be determined, if the 5 characters are consistent with “glpat”, it indicates that the code repository token of the file starts with “glpat”, and correspondingly, the file is determined as the target file.

[0075] As another example, the feature information can be a directory contained in a file path, and the preset feature information can be a specific directory. For any file in the first file list, the directory contained in the file path of the file is determined, and the directory is compared with the specific directory. If the two are consistent, the file is determined as the target file. If the two are inconsistent, the file is not determined as the target file. For example, the specific directory is "~ / .ssh / ", and if the file path of a file is "~ / .ssh / id_rsa", it can be determined that the directory contained in the file path of the file is "~ / .ssh / ", which is consistent with the specific directory, and the file is determined as the target file.

[0076] As another example, the feature information can be a directory contained in a file path, and the preset feature information can be a specific directory. For any file in the first file list, the directory contained in the file path of the file is determined, and the directory is compared with the specific directory. If the two are consistent, the file is determined as the target file. If the two are inconsistent, the file is not determined as the target file. For example, the specific directory is "~ / .ssh / ", and if the file path of a file is "~ / .ssh / id_rsa", it can be determined that the directory contained in the file path of the file is "~ / .ssh / ", which is consistent with the specific directory, and the file is determined as the target file.

[0077] Exemplarily, the method further comprises: obtaining sensitive information and / or a garbage file; determining a feature of the sensitive information and / or a feature of the garbage file; and determining the preset feature information based on the feature of the sensitive information and / or the feature of the garbage file.

[0078] The sensitive information refers to information related to user privacy, such as user credentials and historical instructions. The garbage file refers to a file that is of no business value, temporary, and redundant during the running of a system or an application.

[0079] Considering that the sensitive information and the garbage file can change continuously, the sensitive information and the garbage file can be updated every preset period, so as to determine the latest feature of the sensitive information and the latest feature of the garbage file, and thus the determined preset feature information can reflect the latest feature of the sensitive information and the latest feature of the garbage file, so as to accurately and comprehensively screen out the files containing the sensitive information and the garbage file as the target file from the first file list.

[0080] As an example, sensitive information can be acquired, a feature of the sensitive information is determined, and then preset feature information is determined based on the feature of the sensitive information; the feature of the sensitive information can include a storage directory of the sensitive information in the system and / or a preset number of characters in the sensitive information. For example, taking a certain specific code repository token as the sensitive information, the first certain number of characters in the code repository token of different software manufacturers are different, and then the first certain number of characters in the specific code repository token is the feature of the specific code repository token, and then the first certain number of specific characters in the specific code repository token can be taken as the preset feature information. For another example, taking a user's historical command as the sensitive information, the user's historical command is usually stored in a file under the "~ / .history / " directory, and then the "~ / .history / " directory is the feature of the user's historical command, and then the specific directory "~ / .history / " can be taken as the preset feature information. For another example, taking a user key as the sensitive information, the user's SSH key is usually stored in a file under the "~ / .ssh / " directory, and then the "~ / .ssh / " directory is the feature of the user key, and then the specific directory "~ / .ssh / " can be taken as the preset feature information.

[0081] As another example, a garbage file can be acquired, a feature of the garbage file is determined, and then preset feature information is determined based on the feature of the garbage file, and the feature of the garbage file can include a storage directory of the garbage file in the system. For example, taking a temporary file as the garbage file, the temporary file is usually stored under the "~ / .tmp / " directory, and then the "~ / .tmp / " directory is the feature of the temporary file, and then the specific directory "~ / .tmp / " can be taken as the preset feature information.

[0082] As another example, sensitive information and a garbage file can be acquired, the features of the sensitive information and the garbage file are respectively determined by the above example manner, and then the features of the sensitive information and the garbage file are determined as preset feature information. For example, taking a user's historical command as the sensitive information and a temporary file as the garbage file, then the two specific directories "~ / .history / " and "~ / .tmp / " can be taken as the preset feature information.

[0083] As another example, the feature extraction on the sensitive information and / or the garbage file can also be used to obtain the feature of the sensitive information and / or the feature of the garbage file as the preset feature information. The feature extraction is performed on each file in the first file list to obtain the feature information of each file. In a case where the similarity between the feature information of each file and the preset feature information is greater than a similarity threshold, the file is taken as a target file.

[0084] In some embodiments, the target files are determined by: determining, as the target files, the files in the first file list that are specified by the user and / or the files under the directories specified by the user. For example, the user can specify the files (i.e., the user-specified files) and / or the directories (i.e., the user-specified directories) that are desired to be removed in advance, e.g., the user can specify in advance that the files under the “~ / .ssh / ” directory are desired to be removed; and then, in the process of generating the image, the target files are automatically filtered out from the first file list and automatically deleted based on the user-specified files and / or the user-specified directories, so as to meet the needs of the user, and the user does not need to have the ability to actively delete files, so that the user can achieve automatic deletion of the files desired to be removed by the user, thereby reducing the requirement for the user's coding ability and improving the user experience.

[0085] In some embodiments, the target files are determined by: determining, as the target files, the files in the first file list that are specified by the user and / or the files under the directories specified by the user. For example, the user can specify the files (i.e., the user-specified files) and / or the directories (i.e., the user-specified directories) that are desired to be removed in advance, e.g., the user can specify in advance that the files under the “~ / .ssh / ” directory are desired to be removed; and then, in the process of generating the image, the target files are automatically filtered out from the first file list and automatically deleted based on the user-specified files and / or the user-specified directories, so as to meet the needs of the user, and the user does not need to have the ability to actively delete files, so that the user can achieve automatic deletion of the files desired to be removed by the user, thereby reducing the requirement for the user's coding ability and improving the user experience.

[0086] It should be noted that in actual application, one or more of the above-mentioned ways can be selected to determine the target files, and then the target files are automatically deleted when the image is generated. For example, in the case that the user uses the development tools in the image to perform various development operations, the following files can be determined from the first file list and automatically deleted by using one or more of the above-mentioned ways: the installation files left by the user in the “ / var / lib / apt” directory and other directories when the user installs software; the garbage files left by the user in the “~ / .tmp / ” directory when the user uses the development tools (such as vs code or Jupiter) to perform development operations; the user's own SSH key stored in the “~ / .ssh / ” directory when the user connects to the development machine (i.e., a hardware device or a cloud service resource specially used for technical development in a specific field); the token of the user's own code repository left in the container during the development operation of the user, and the like. In this way, in the process of generating the image, the user-specified files, the files under the user-specified directories, the files containing sensitive information, and the garbage files are automatically deleted.

[0087] In some embodiments, after the target files are determined, the target files can be deleted in the container working layer, and the remaining files in the container working layer are the files in the second file list.

[0088] Step 103: generating a target image based on the files in the second file list and the base image.

[0089] Since the target file does not exist in the second file list, in this step, the target image not containing the target file is generated based on the files in the second file list and the base image, and the target image occupies smaller space, thereby effectively reducing the occupied space of the image generated in the container running process.

[0090] In some embodiments, in this step, generating the target image based on the files in the second file list and the base image can include: packaging the files in the second file list into a new image layer; and combining the new image layer and the base image layer to obtain the target image.

[0091] Illustratively, after the target file is deleted in the container working layer, the remaining files in the container working layer can be packaged into a new image layer, thereby realizing packaging the files in the second file list into a new image layer.

[0092] Illustratively, packaging the files in the second file list into a new image layer can include: packaging the files in the second file list into a TAR (Tape Archive) archive file; and further combining the TAR archive file and the base image layer to generate a file system, i.e., the target image. In this way, the target image includes the files newly added and / or the files changed in the container running process, except for the target file. For the files changed in the container running process, the original files in the base image before the change are hidden in the target image, and only the changed files in the new image layer are retained.

[0093] As an example, in the scenario of building an image by means of a tool such as docker or kaniko through a Dockerfile, the instructions in the Dockerfile are executed layer by layer, after each layer of instructions is executed, the target file is deleted from the obtained first file list, thereby obtaining the second file list corresponding to the layer of instructions, and then the files in the second file list corresponding to the layer of instructions can be packaged into a new image layer. In this way, a new image layer can be generated after each layer of instructions is executed. After all the instructions of the layers are executed, each new image layer generated by packaging after each layer of instructions is executed and the base image layer are combined, thereby obtaining the target image.

[0094] As another example, in the scenario of saving a running container as a new image by means of a tool such as nerdctl or ctr, the target file is deleted from the obtained first file list, thereby obtaining the second file list, and then the files in the second file list can be packaged into a new image layer. The new image layer and the base image layer are combined, thereby obtaining the target image.

[0095] In some embodiments, the generated target image can be further pushed into a public or private image repository for subsequent use by the user or shared for use by others.

[0096] In the embodiments of the present disclosure, a first file list is acquired, wherein the first file list includes newly added files and / or changed files in a container running process; the container is created based on a base image; the changed files represent files that exist in the base image but have changed contents; the newly added files represent files that do not exist in the base image; a target file is deleted from the first file list to obtain a second file list; and a target image is generated based on the files in the second file list and the base image. In this way, the target file can be automatically deleted in the process of generating the image of the running container, thereby effectively reducing the occupied space of the generated image in the container running process. At the same time, the user does not need to have the ability to actively delete the target file, and the target file can be automatically deleted in the container running process (the user cannot actively operate the image in the container running), thereby reducing the requirement for the user's coding ability and improving the user experience. In some examples, the target file can include a file containing sensitive information, so that the file containing sensitive information can be automatically deleted when the image is generated, thereby avoiding the spread of sensitive information, protecting the user's privacy, and ensuring data security.

[0097] It should be noted that the above application scenarios described in the embodiments of the present disclosure are for more clearly illustrating the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. It is known to those of ordinary skill in the art that, for other similar or new scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems. In addition, since different container runtimes or tools use unified specifications (such as all conforming to the OCI standard) when packaging images, the embodiments of the present disclosure do not limit the container runtime or tool involved in the execution process of the above image generation method, and those of ordinary skill in the art can use different container runtimes or tools such as docker, containerd, podman, cri-o, etc. to implement the image generation method in the embodiments of the present disclosure.

[0098] Based on the same inventive concept of the above method embodiments, the embodiments of the present disclosure also provide an image generation device, which can be used to execute the technical solutions described in the above method embodiments.

[0099] Figure 2 A structural diagram of an image generation device according to some embodiments of the present disclosure is shown as Figure 2 shown,

[0100] The apparatus comprises: an acquisition module 201 configured to acquire a first file list; wherein the first file list comprises files added and / or changed during running of a container; the container is created based on a base image; the changed files represent files existing in the base image but with changed content; the added files represent files not existing in the base image; a deletion module 202 configured to delete target files from the first file list to obtain a second file list; and a generation module 203 configured to generate a target image based on files in the second file list and the base image.

[0101] In the embodiments of the present disclosure, a first file list is acquired; wherein the first file list comprises files added and / or changed during running of a container; the container is created based on a base image; the changed files represent files existing in the base image but with changed content; the added files represent files not existing in the base image; target files are deleted from the first file list to obtain a second file list; and a target image is generated based on files in the second file list and the base image. In this way, the target files can be automatically deleted during generation of the image of the running container, thereby effectively reducing the occupied space of the image of the running container; meanwhile, the user does not need to have the ability to actively delete the target files, and the target files can be automatically deleted during generation of the image of the running container, thereby reducing the requirement for the user's coding ability and the like, and improving the user experience. In some examples, the target files can comprise files containing sensitive information, so that the files containing sensitive information can be automatically deleted during image generation, thereby avoiding the spread of sensitive information, protecting the user's private data, and ensuring data security.

[0102] In some embodiments, the acquisition module 201 is further configured to determine the files added and / or changed during running of the container by comparing an existing image layer related to the container and a container working layer; wherein the container working layer is configured to store at least files generated by creating files and / or modifying files during running of the container; and the existing image layer comprises at least a base image layer, and the base image layer is an image layer in the base image.

[0103] In some embodiments, the generation module 203 is further configured to pack the files in the second file list into a new image layer; and combine the new image layer and a base image layer to obtain the target image.

[0104] In some embodiments, the apparatus further includes a determining module configured to: acquire feature information of each file in the first file list; wherein the feature information is determined according to file content and / or file path; and determine, as the target file, a file in the first file list whose feature information is consistent with preset feature information.

[0105] In some embodiments, the determining module is further configured to: determine, as the target file, a file pre-specified by a user and / or a file under a directory pre-specified by the user in the first file list.

[0106] In some embodiments, the determining module is further configured to: determine, as the target file, a file selected by a user in response to a selection operation of the user on a file in the first file list.

[0107] In some embodiments, the determining module is further configured to: acquire sensitive information and / or a junk file; determine a feature of the sensitive information and / or a feature of the junk file; and determine the preset feature information based on the feature of the sensitive information and / or the feature of the junk file.

[0108] In some embodiments, the apparatus provided by the embodiments of the present disclosure has functions or includes modules that can be used to execute the methods described in the above method embodiments, and the specific implementation can refer to the description of the above method embodiments. For brevity, details are not repeated here.

[0109] The embodiments of the present disclosure also provide an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0110] The embodiments of the present disclosure also provide a non-volatile computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the above method.

[0111] The embodiments of the present disclosure also provide a computer program product, including a computer program or a non-volatile computer readable storage medium carrying the computer program, wherein the computer program is executed by a processor to implement the steps of the above method.

[0112] Figure 3 A block diagram of an electronic device according to some embodiments of the present disclosure is shown. For example, the electronic device 1900 can be provided as a server or a terminal device. Referring to Figure 3The electronic device 1900 includes a processing component 1922, which is further composed of one or more processors, and a memory resource represented by the memory 1932, for storing instructions executable by the processing component 1922, such as an application program. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0113] The electronic device 1900 can further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 can operate based on an operating system stored in the memory 1932, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM or the like.

[0114] In an exemplary embodiment, a non-transitory computer readable storage medium, such as the memory 1932 including computer program instructions, is also provided, which can be executed by the processing component 1922 of the electronic device 1900 to complete the above method.

[0115] The computer readable storage medium can be a tangible device that can retain and store programs for use by an instruction execution device. The computer readable storage medium, for example, can be, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanism that can store and read instructions such as one or more of the following: a punch card, an eddy current card, a magnetic strip on a card, as well as any suitable combination of the foregoing. The computer readable storage medium used is not to be construed as a transitory signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or an electrical signal passing through a wire.

[0116] The computer program (or computer readable program instructions) described herein can be downloaded from a computer readable storage medium to various computing / processing devices by way of a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0117] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computing / processing device, partly on the user's computing / processing device, as a stand-alone software package, partly on the user's computing / processing device and partly on a remote computing / processing device or entirely on the remote computing / processing device or server. In the latter scenario, the remote computing / processing device can be connected to the user's computing / processing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing / processing device, for example, through the Internet using an Internet Service Provider. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0118] The computer readable program instructions can also be loaded onto a computing / processing device, other programmable data processing apparatus, or other device to cause a series of operations to be performed on the computing / processing device, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computing / processing device, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0119] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include a non-transitory computer readable storage medium that can be a computer readable storage medium having no data, programs, program modules, and / or computer readable program instructions presently, and / or not yet, on the computer readable storage medium. The instructions can be stored in a computer readable storage medium that can be any device or apparatus that can store such computer readable program instructions.

[0120] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0121] In the technical solutions of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure, and application of the user-related information comply with relevant laws and regulations, necessary security measures are taken, and the public order and good customs are not violated. Moreover, the authorization or consent of the user is obtained before the user-related information is acquired or collected. For example, the user-related information includes, but is not limited to, the sensitive information in the foregoing embodiments.

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architectures, functions, and operations of the systems, methods, and computer program products according to the embodiments of the present disclosure. In this regard, each block in the flowcharts and block diagrams can represent a module, a program segment, or a portion of an instruction, which includes one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions noted in the blocks can occur in different orders than those noted in the accompanying drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a special-purpose hardware-based system that performs the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0123] Having described above several embodiments of the disclosure, any modifications and variations that fall within the scope of the described embodiments are also intended to be within the scope of the disclosure. As will be apparent to those skilled in the art, some modifications and variations to the embodiments described above can be practiced while staying within the scope and spirit of the described embodiments. The foregoing description of the described embodiments has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the described embodiments to the precise form disclosed. Many modifications and variations are possible in light of the above teachings. It is intended that the disclosed embodiments be limited only by the claims.

Claims

1. A mirror image generation method characterized by comprising: The method comprises: obtaining a first file list; wherein the first file list comprises files added and / or changed during container running; the container is created based on a base image; the changed files represent files existing in the base image but with changed content; the added files represent files not existing in the base image; from the first file list, deleting target files to obtain a second file list; generating a target image based on the files in the second file list and the base image.

2. The method of claim 1, wherein, The obtaining of the first file list comprises: comparing an existing image layer related to the container and a container working layer to obtain files added and / or changed during container running; wherein the container working layer is used to store at least files generated by creating file operations and / or modifying file operations during container running; the existing image layer at least comprises a base image layer, and the base image layer is an image layer in the base image.

3. The method of claim 1, wherein, The generating of the target image based on the files in the second file list and the base image comprises: packing the files in the second file list into a new image layer; combining the new image layer and the base image layer to obtain the target image.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: obtaining feature information of each file in the first file list; wherein the feature information is determined according to file content and / or file path; determining, as the target files, files in the first file list whose association relationship between the feature information and preset feature information meets a preset condition.

5. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: determining, as the target files, files in the first file list specified by a user and / or files under a directory specified by the user.

6. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: in response to a selection operation of a user on files in the first file list, determining the files selected by the user as the target files.

7. The method of claim 4, wherein, The method further comprises: obtaining sensitive information and / or garbage files; determining features of the sensitive information and / or features of the garbage files; determining the preset feature information based on the features of the sensitive information and / or the features of the garbage files.

8. An image generation apparatus characterized by comprising: The apparatus comprises: an obtaining module configured to obtain a first file list; wherein the first file list comprises files added and / or changed during container running; the container is created based on a base image; the changed files represent files existing in the base image but with changed content; the added files represent files not existing in the base image; a deleting module configured to delete target files from the first file list to obtain a second file list; a generating module configured to generate a target image based on the files in the second file list and the base image.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, is arranged to perform the method of any one of claims 1 to 8. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

10. A non-transitory computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images