Container deployment method and device, program product and storage medium

Abstract

The invention discloses a container deployment method and device, a program product and a storage medium, and the method comprises the steps: sending a decryption task to a first component to indicate the first component to perform decryption processing on a target data stream carried in the received decryption task, and obtaining a file system and configuration information of a target container; creating a running environment of the target container based on the file system and the configuration information; and deploying the target container by utilizing the second component and the file system in the running environment. Through the method and the device, the problem of low container deployment efficiency caused by incapability of enabling the container to adapt to the target operating system in related technologies is solved, and the effect of improving the deployment efficiency of the container in the target operating system is further achieved.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a container deployment method and apparatus, a program product, and a storage medium. Background Technology

[0002] As a crucial component of modern cloud computing and microservice architectures, container technology's deployment efficiency and runtime performance directly impact the responsiveness and cost-effectiveness of enterprise information technology (IT) systems. Common container deployment methods are typically optimized for x86 architectures, and these methods heavily rely on specific hardware and operating system characteristics during container image decryption, container runtime environment creation, and container startup.

[0003] However, these methods often fall short when containers need to run on target operating systems that are not x86 architecture. For example, on servers with Acorn RISC Machine (ARM) architecture, due to the difference in instruction sets, traditional container deployment methods may not be able to directly call the kernel interface of the target operating system, resulting in container startup failures or low running efficiency.

[0004] There is currently no solution to the above problems in the relevant technologies. Summary of the Invention

[0005] This application provides a container deployment method and apparatus, program product, and storage medium to at least solve the problem of low container deployment efficiency caused by the inability to adapt containers to the target operating system in related technologies.

[0006] According to one aspect of the embodiments of this application, a container deployment method is provided, comprising: sending a decryption task to a first component to instruct the first component to perform decryption processing on a target data stream carried in the received decryption task to obtain a file system and configuration information of a target container, wherein the file system includes files required for the target container to run; creating a runtime environment for the target container based on the file system and the configuration information; and deploying the target container in the runtime environment using a second component and the file system, wherein the second component is used to convert target code into code under a standardized code structure that can be recognized by the target operating system, and the standardized code structure is used to ensure that the target container correctly calls the kernel interface of the target operating system when it starts.

[0007] In an exemplary embodiment, creating a runtime environment for the target container based on the file system and configuration information includes: parsing the specification information and resource requirements of the target container from the configuration information, wherein the specification information represents the software configuration required to run the target container, and the resource requirements represent the hardware resource conditions required to run the target container; inputting the specification information and resource requirements into a target model to obtain instruction information output by the target model for instructing a target server, wherein the target server is a server determined by the target model after performing a target operation on the specification information and resource requirements, the target server is compatible with the software configuration of the target container, and the hardware resources of the target server meet the hardware resource conditions; and creating the runtime environment in the target server based on the file system and configuration information.

[0008] In an exemplary embodiment, the target operation includes: selecting M first servers from N servers included in the cluster whose hardware resources meet the aforementioned hardware resource conditions and are compatible with the aforementioned software configuration, wherein N and M are both integers greater than 1, and M is less than or equal to N; determining the load status of the M first servers after the target container is deployed on the M first servers based on the historical performance status of the M first servers; calculating the scores of the M first servers after the target container is deployed based on the M load statuses to obtain M target values, wherein each of the target values ​​represents the capacity of the corresponding first server to support the target container; and determining the first server corresponding to the highest target value among the M target values ​​as the target server.

[0009] In an exemplary embodiment, after deploying the target container using the second component and the file system in the above-described operating environment, the method further includes: during the runtime of the target container, using a third component to monitor the system call behavior executed when the target process runs P times within the target container, to obtain P target sequences, wherein the target process requests the operating system kernel of the target server to provide target services by executing the system call behavior, the target server is a server where the target container is deployed, and one target sequence is used to record the system call behavior executed when the target container runs the target process once, where P is an integer greater than 1; calculating the similarity between the P target sequences and the first sequence to obtain P target values, wherein the first sequence includes the system call behavior executed when the target container runs the target process normally; and terminating the runtime of the target container on the target server if Q of the P target values ​​are less than a preset threshold, where Q is an integer greater than 1 and Q is less than or equal to P.

[0010] In an exemplary embodiment, each of the above target values ​​is calculated by: converting the system call behaviors recorded in the above target sequence into feature vectors to obtain multiple first vectors; concatenating the multiple first vectors based on the order of the system call behaviors recorded in the above target sequence to obtain a second vector; calculating the similarity between the second vector and the third vector to obtain the above target value, wherein the third vector is a vector representation of the above first sequence.

[0011] In an exemplary embodiment, if Q out of P target values ​​are less than a preset threshold, before terminating the operation of the target container on the target server, the method further includes: selecting M first servers from N servers in the cluster whose hardware resources meet the hardware resource conditions and are compatible with the software configuration, wherein the configuration information includes the specification information and resource requirements of the target container, the specification information is used to represent the software configuration required to run the target container, the resource requirements are used to represent the hardware resource conditions required to run the target container, N and M are both integers greater than 1, and M is less than or equal to N; determining the server with the lowest load pressure among the M first servers as the second server; deploying the target container to the second server according to the obtained target container running status snapshot information and storage volume, so that the target process of the target container runs normally on the second server, wherein the running status snapshot information includes the process status and network status of all processes running in the target container, and the storage volume is used to store the data required to run the target process and other processes.

[0012] In an exemplary embodiment, the target data stream includes multi-layer mirror data, which constitute the file system. Each layer of the mirror data has a first identifier, which is generated using a hash algorithm. The first identifier is used to determine the consistency between the data recorded in the encrypted target data stream and the decrypted target data stream.

[0013] According to another aspect of the embodiments of this application, a container deployment apparatus is also provided, comprising: a sending module, configured to send a decryption task to a first component, to instruct the first component to perform decryption processing on a target data stream carried in the received decryption task to obtain a file system and configuration information of a target container, wherein the file system includes files required for the target container to run; a creation module, configured to create a runtime environment for the target container based on the file system and the configuration information; and a deployment module, configured to deploy the target container in the runtime environment using a second component and the file system, wherein the second component is configured to convert target code into code under a standardized code structure that can be recognized by the target operating system, and the standardized code structure is configured to ensure that the target container correctly calls the kernel interface of the target operating system when it starts.

[0014] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed by a processor.

[0015] According to another aspect of the embodiments of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the steps in any of the method embodiments described above.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to perform the steps of any of the above method embodiments through the computer program.

[0017] This application sends the decryption task to the first component to improve decryption efficiency through hardware-accelerated instruction set calls. Then, based on the decrypted file system and configuration information, it creates a runtime environment for the target container and deploys the target container within that environment. By modifying the container runtime source code and using conditional compilation, it ensures seamless integration of critical operations such as process creation, resource limits, and namespaces with the target operating system. Furthermore, it ensures that even with differences in operating system details, the target container can start and run stably, avoiding deployment interruptions due to compatibility issues. Therefore, it solves the problem of low container deployment efficiency caused by the inability to adapt containers to the target operating system in related technologies, thus improving the deployment efficiency of containers on the target operating system. Attached Figure Description

[0018] Figure 1 This is a schematic diagram illustrating an application scenario of a container deployment method according to an embodiment of this application;

[0019] Figure 2 This is a flowchart illustrating a container deployment method according to an embodiment of this application;

[0020] Figure 3 This is a flowchart illustrating a method for deploying a target container according to an embodiment of this application;

[0021] Figure 4 This is a structural block diagram of a container deployment apparatus according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application. Furthermore, in the absence of conflict, the various embodiments and features in the embodiments of the present application can be arbitrarily combined with each other in principle.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] According to one aspect of the embodiments of this application, a method for deploying containers is provided. Optionally, in this embodiment, the above-described container deployment method may be applied to, but is not limited to, [examples of other methods]. Figure 1The hardware environment shown includes terminal device 102 and server 104. Server 104 can be connected to terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) to terminal device 102 or clients installed on terminal device 102. A database can be set up on server 104 or independently of server 104 to provide data storage services for server 104.

[0025] The aforementioned network may include, but is not limited to, at least one of the following: wired network and wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network (WAN), metropolitan area network (MAN), and local area network (LAN). The aforementioned wireless network may include, but is not limited to, at least one of the following: Wireless Fidelity (WIFI) and Bluetooth. Terminal device 102 may be, but is not limited to, a personal computer (PC), mobile phone, tablet computer, etc. Server 104 may be, but is not limited to, a cloud server, server cluster, or other server types.

[0026] The container deployment method of this application embodiment can be executed by server 104, terminal device 102, or jointly by server 104 and terminal device 102. Alternatively, the container deployment method of this application embodiment can be executed by a client installed on terminal device 102.

[0027] Taking the container deployment method in this embodiment executed by terminal device 102 as an example, Figure 2 This is a schematic diagram illustrating the deployment process of a container according to an embodiment of this application, such as... Figure 2 As shown, the process of this method may include the following steps:

[0028] Step S202: Send a decryption task to the first component to instruct the first component to perform decryption processing on the target data stream carried in the received decryption task to obtain the file system and configuration information of the target container, wherein the file system includes the files required for the target container to run.

[0029] Optionally, the solution in this embodiment can be applied to the financial and government sectors, which have extremely high requirements for the efficient, secure, and reliable deployment of container technology. Application scenarios for the solution in this embodiment include, but are not limited to: containerized application deployment on government cloud platforms, startup of container services with high security requirements in the financial industry, containerized migration of critical business systems in the energy sector, and rapid container deployment of edge computing nodes in the manufacturing industry. For example, in the deployment of transaction systems in the financial industry, banks need to run Oracle database-based transaction processing applications in containerized form on domestically produced servers (such as servers based on Kunpeng processors, running the Kylin operating system). Using the method in this embodiment, the bank can first send the encrypted container image data stream to the first component for efficient decryption processing based on hardware acceleration, obtaining the target container's file system and configuration information. Next, based on the decrypted file system and configuration information, a matching runtime environment is created on the domestically produced server to ensure that the container's resource requirements are met. Finally, in the created runtime environment, the second component is used to convert the Oracle database application code into a form compatible with the Kylin operating system kernel interface, thereby ensuring that the container can correctly call the Kylin system's kernel services when it starts, achieving rapid and stable deployment of the Oracle database container in a domestically developed cloud environment. This process also ensures the secure transmission and processing of transaction data, as well as the efficient utilization and high availability of system resources, meeting the stringent requirements of the financial industry for the deployment of container technology in the domestic cloud environment.

[0030] Optionally, the target data stream in this embodiment is a container image data stream, which consists of multiple layers of image data. Each layer represents a component or state snapshot of the container, such as the operating system layer, application layer, configuration layer, etc. This data is encrypted during transmission for security or storage efficiency reasons. For example, a container image may contain a Kylin operating system layer, a specific database software layer, and a user configuration layer.

[0031] Optionally, the first component in this embodiment is a decryption component or service for the container image, which is responsible for receiving the encrypted target data stream and performing decryption operations. For example, the first component may integrate a dedicated driver library for domestically produced chips (such as Kunpeng and Phytium), which can use hardware acceleration instruction sets (such as the hw_decrypt() function in the KAE acceleration library) to decrypt the target data stream, thereby improving decryption speed and security.

[0032] Optionally, the file system in this embodiment refers to the file structure that the container can use, including all the necessary files and directories for the target container to run. The file system extracted from the decrypted target data stream contains the files, libraries, configuration files, etc., that the container depends on for its operation. For example, in a MySQL-based container image, the file system would include the MySQL binary files, configuration files (my.cnf), data files (.ibd and .frm, etc.), and dependent library files (libmysqlclient.so, etc.).

[0033] Optionally, the configuration information in this embodiment includes container startup parameters, environment variables, mount points, resource limits (such as Central Processing Unit (CPU) and memory limits), etc. This information guides the creation and configuration of the container runtime environment. For example, the configuration information may specify the local directory ( / data) that the container needs to mount as a persistent storage volume, the CPU and memory resources allocated to the container (2 cores and 4GB), and environment variables (DB_HOST, DB_PORT) used to configure database connections.

[0034] Step S204: Create the runtime environment for the target container based on the file system and configuration information described above.

[0035] Step S206: In the above-mentioned operating environment, the target container is deployed using the second component and the above-mentioned file system. The second component is used to convert the target code into code under a standardized code structure that the target operating system can recognize. The standardized code structure is used to ensure that the target container correctly calls the kernel interface of the target operating system when it starts.

[0036] Optionally, the standardized code structure in this embodiment refers to converting the application code within the container into a form compatible with the target operating system kernel interface. Specifically, the second component can be an application compatibility layer or code conversion service that converts system calls or dependencies in the application code into a form that matches the kernel interface of the target operating system (such as Kylin or UnionTech Operating System (UOS)), ensuring that the application in the container can correctly call kernel services. For example, the second component can convert commonly used syscalls under the x86 architecture into equivalent system calls under the ARM architecture, or convert calls to specific libraries (such as libpthread.so) into calls to pre-built libraries in the Kylin system.

[0037] Optionally, the target operating system in this embodiment refers to a domestically developed operating system in the domestic IT cloud environment, such as Kylin or UOS. These systems are based on the ARM architecture and differ from traditional x86-based Linux systems in terms of system calls, resource management, and security policies. For example, the UOS operating system is based on the ARM architecture and has a different kernel version and system call implementation than traditional Linux.

[0038] For example, in a domestic cloud computing environment within the financial industry, a containerized application based on an Oracle database needs to be deployed. However, the image data is encrypted during transmission, and the application code was originally designed for the x86 architecture. To deploy this container on a server running the UOS operating system (based on ARM architecture), the following method is used: First, a first component (such as the KAE acceleration library) decrypts the received encrypted image data stream, obtaining a decrypted file system containing the Oracle database binary files, configuration files, and related dependency library files. Next, based on the decrypted file system and configuration information (such as the database listening port and resource limits), a specific runtime environment is created on the target server (running the UOS operating system), such as setting cgroups and namespaces to match UOS kernel characteristics. Finally, in the runtime environment, a second component (such as a Sidecar container or agent) is used to convert the Oracle database application code into a code structure compatible with the UOS kernel interface. For example, syscalls specific to the x86 architecture are converted into equivalent calls under the ARM architecture, ensuring that the container can correctly call UOS kernel services. Through this series of operations, the container is successfully deployed and runs efficiently on a domestic operating system.

[0039] In this embodiment, the decryption task is sent to the first component to improve decryption efficiency through hardware-accelerated instruction set calls. Then, based on the decrypted file system and configuration information, a runtime environment for the target container is created and deployed within that environment. By modifying the container's runtime source code and using conditional compilation, key operations such as process creation, resource limits, and namespaces are ensured to seamlessly integrate with the target operating system. Furthermore, even with differences in operating system details, the target container can start and run stably, avoiding deployment interruptions due to compatibility issues. Therefore, this solves the problem of low container deployment efficiency caused by the inability to adapt containers to the target operating system in related technologies, thus improving the deployment efficiency of containers within the target operating system.

[0040] In an exemplary embodiment, creating a runtime environment for the target container based on the file system and configuration information includes: parsing the specification information and resource requirements of the target container from the configuration information, wherein the specification information represents the software configuration required to run the target container, and the resource requirements represent the hardware resource conditions required to run the target container; inputting the specification information and resource requirements into a target model to obtain instruction information output by the target model for instructing a target server, wherein the target server is a server determined by the target model after performing a target operation on the specification information and resource requirements, the target server is compatible with the software configuration of the target container, and the hardware resources of the target server meet the hardware resource conditions; and creating the runtime environment in the target server based on the file system and configuration information.

[0041] Optionally, the specification information in this embodiment specifically includes the software environment configuration required for the target container to run, such as the operating system version (e.g., UOS 20.04), dependent library files (e.g., libssl.so.1.1), and runtime environment (e.g., Java 8 or Python 3.7). For example, a Node.js-based application container might require Node.js version 12.16.1 and the npm package manager as part of its specification information.

[0042] Optionally, the resource requirements in this embodiment refer to the hardware resource requirements of the container runtime, including the number of CPUs, memory size, disk space, network bandwidth, etc. For example, an image processing container may require at least 4 CPU cores and 8GB of memory, as well as a high-speed network interface to support its high-performance computing needs.

[0043] Optionally, the target model in this embodiment is an intelligent scheduling model used to determine which server is most suitable for deploying the target container based on the container's specifications and resource requirements, combined with the real-time status and historical performance data of servers within the cluster. The target model may be based on machine learning algorithms, such as decision trees, neural networks, or genetic algorithms, to comprehensively evaluate server compatibility and resource matching. For example, the model may consider information such as the server's CPU architecture, kernel version, remaining memory, and disk I / O rate to predict the container's operating efficiency and stability on different servers.

[0044] Optionally, the target operation in this embodiment refers to a series of evaluation and decision-making processes performed by the target model, aimed at selecting a suitable server from the cluster. This may include, but is not limited to, matching resource requirements, checking software configuration compatibility, analyzing historical load status, etc., ultimately outputting indication information for the target server for the actual deployment of the container.

[0045] Optionally, in this embodiment, the target server refers to the server in the cluster selected by the target model for deploying a specific container. It not only needs to meet the hardware resource requirements of the container but also ensure software configuration compatibility to provide a suitable environment for container operation. For example, in a cluster containing two different CPU architectures, Kunpeng and Phytium, the target model might recommend a Kunpeng server with sufficient memory and storage space as the target server because it is more suitable for running memory-intensive application containers.

[0046] This embodiment intelligently selects the most suitable server to create the runtime environment based on the container's resource requirements and software configuration, ensuring that the target container runs on a target server with matching performance, thereby improving resource utilization efficiency and load balancing.

[0047] In an exemplary embodiment, the target operation includes: selecting M first servers from N servers included in the cluster whose hardware resources meet the aforementioned hardware resource conditions and are compatible with the aforementioned software configuration, wherein N and M are both integers greater than 1, and M is less than or equal to N; determining the load status of the M first servers after the target container is deployed on the M first servers based on the historical performance status of the M first servers; calculating the scores of the M first servers after the target container is deployed based on the M load statuses to obtain M target values, wherein each of the target values ​​represents the capacity of the corresponding first server to support the target container; and determining the first server corresponding to the highest target value among the M target values ​​as the target server.

[0048] Optionally, the cluster in this embodiment consists of multiple servers connected via a network, working collaboratively to provide a computing environment with higher performance, availability, and scalability. The servers in the cluster typically have similar or complementary functions, enabling them to jointly support the operation of specific applications or services.

[0049] Optionally, in this embodiment, N servers represent the total number of servers in the cluster. These servers may run on different hardware architectures (such as x86, ARM, etc.) and operating systems (such as Linux, Windows, domestic OS, etc.).

[0050] Optionally, the hardware resource conditions in this embodiment refer to the specific hardware resource requirements required for the container to run, including but not limited to CPU architecture type, computing power (such as support for encrypted acceleration instructions), memory size, storage type (such as solid state drive (SSD) and hard disk drive (HDD)), network bandwidth, etc.

[0051] Optionally, the software configuration in this embodiment represents the operating environment of the software inside the container, including the operating system version, specific library files, runtime environment, dependent basic software or services (such as databases, middleware), etc.

[0052] Optionally, in this embodiment, the M first servers are a subset of servers selected from the N servers that meet the hardware resource requirements and software configuration compatibility.

[0053] Optionally, the historical performance status of the first server in this embodiment refers to the server's performance data over a period of time, such as CPU utilization, memory usage, disk I / O, network latency, etc., which are used to assess the server's current health status and past performance.

[0054] Optionally, the load status in this embodiment is used to describe the expected resource usage of the server after the target container is deployed. The calculation takes into account the resource requirements of the container and the current resource usage of the server.

[0055] Optionally, the score in this embodiment is used to quantitatively evaluate the first server's ability to carry the target container. It is usually calculated based on the load status and other key performance indicators. The higher the score, the stronger the server's carrying capacity.

[0056] Optionally, the target value in this embodiment is a score calculated by each first server based on its load status after deploying the target container, used to compare and select the best deployment target.

[0057] Optionally, in this embodiment, the target server is the server with the highest score selected from the M first servers based on the target value, and will be used to actually deploy the target container.

[0058] For example, in a containerized deployment scenario for a government cloud platform, an organization is advancing a project involving large-scale data processing and analysis, requiring the deployment of these data processing applications on a server cluster within a domestic IT innovation environment. The cluster includes servers based on x86 and ARM architectures, running domestic operating systems such as Kylin and UOS. The application container configuration information specifies requirements such as ARM architecture servers, at least 32GB of memory, high-speed SSD storage, and a specific version of database software. The system first selects M servers from N servers that meet the hardware resource requirements (e.g., ARM architecture, memory size, storage type) and software configuration requirements (e.g., database version). Next, based on the historical performance of the M servers (e.g., average CPU utilization and memory usage over the past week), the system predicts the load status of each server after deploying the target container. Then, the system calculates a score for each server, considering its hardware resources, current load, and historical performance, quantifying its capacity to support the container. Finally, the server with the highest score is selected as the target server, and the application container is deployed on it to ensure optimal performance and resource utilization. For example, assuming N=10, and after filtering, M=5, the system calculates the scores of these 5 servers to be 85, 90, 88, 92, and 87 respectively. The system will select the first server with a score of 92 as the target server and deploy the target container to achieve efficient and stable data processing services. Through this process, not only is the smooth operation of the container ensured, but resource allocation is also optimized, avoiding waste of resources in the cluster and improving the overall system performance and response speed.

[0059] This embodiment evaluates the carrying capacity of each server in the cluster and selects the server with the best performance to deploy the target container. This achieves optimal deployment of the target container, ensuring that the target server meets the specific requirements of the container while possessing good resource redundancy, making it an ideal deployment target. This ensures that the container can execute on the most suitable and load-balanced node, thereby optimizing overall system performance and resource utilization, avoiding server overload, and enhancing the stability and responsiveness of the target container after deployment.

[0060] In an exemplary embodiment, after deploying the target container using the second component and the file system in the above-described operating environment, the method further includes: during the runtime of the target container, using a third component to monitor the system call behavior executed when the target process runs P times within the target container, to obtain P target sequences, wherein the target process requests the operating system kernel of the target server to provide target services by executing the system call behavior, the target server is a server where the target container is deployed, and one target sequence is used to record the system call behavior executed when the target container runs the target process once, where P is an integer greater than 1; calculating the similarity between the P target sequences and the first sequence to obtain P target values, wherein the first sequence includes the system call behavior executed when the target container runs the target process normally; and terminating the runtime of the target container on the target server if Q of the P target values ​​are less than a preset threshold, where Q is an integer greater than 1 and Q is less than or equal to P.

[0061] Optionally, the target container in this embodiment specifically refers to one or a group of containers deployed in the domestic cloud environment, which carries the operation of specific business applications, such as financial transactions, government affairs processing, energy data analysis, etc.

[0062] Optionally, the third component in this embodiment is a security monitoring agent that can run inside the target container or as part of the container runtime to monitor the system call behavior of the container process in real time. This component may be based on Extended Berkeley Packet Filter (eBPF) technology or other kernel tracing technologies.

[0063] Optionally, in this embodiment, the P runs of the target process refer to the number of times a key process in the target container runs within a specified time window (such as within the past few minutes). P is an integer greater than 1, representing multiple observations of the process's activity.

[0064] Optionally, the system call behavior in this embodiment is the interaction method between the application and the operating system kernel, such as file reading / writing, network socket creation, process creation (fork), signal handling (signal), file permission operation (chmod), etc.

[0065] Optionally, each target sequence in this embodiment is a list or data structure that records the specific system call sequence executed during the runtime of a target process. Each target sequence corresponds to one execution of the target process.

[0066] Optionally, the first sequence in this embodiment is a typical system call behavior sequence executed by the target process when the target container is in normal operating state, which is usually obtained by learning or analyzing the running records of the container in a healthy state.

[0067] Optionally, the similarity calculation in this embodiment is used to quantify the degree of difference between the target sequence and the first sequence. The methods that may be used include, but are not limited to, cosine similarity, Jaccard similarity, edit distance (Levenshtein distance), etc.

[0068] Optionally, the target value in this embodiment is used to represent the calculated similarity index. The smaller the value, the greater the difference and the higher the possibility of potential anomalies.

[0069] Optionally, the preset threshold in this embodiment is a pre-set value used to distinguish between normal system call behavior and potentially abnormal behavior. When the target value is lower than the threshold, the system considers that the current system call behavior may have deviated from the normal operating mode.

[0070] Optionally, in practical use, terminating the target container on the target server includes, but is not limited to, the following operations: Invoking a secure erasure module, which performs multiple overwrite operations on the sensitive storage volume mounted by the target container on the target server (e.g., first write all 0x00, second write all 0xFF, third write randomly), and uses the SM4 algorithm to verify the overwrite process. Subsequently, through a hook script, it actively cleans up residual process information, network namespace interfaces, and log files of the target container in system directories such as / proc and / sys on the target server.

[0071] For example, consider the real-time monitoring of a financial trading system container. Given the unique nature of the financial industry, any potential security threat could cause significant losses. In this scenario, the target container hosts a high-frequency trading application that frequently accesses databases and network resources, performing complex calculations and data processing. On a typical trading day, the critical processes within the target container run 100 times (P=100). Through a third component, the system captures and records the system call behavior executed in each of these 100 runs in real time, forming 100 target sequences. Simultaneously, the system stores a first sequence learned from previous running states, representing the expected system call behavior in a normal trading process. Next, the system compares the similarity between each target sequence and the first sequence using methods such as cosine similarity calculation, obtaining 100 target values. If five of these values ​​(Q=5) are abnormally low, meaning the deviation from normal behavior exceeds a preset threshold (e.g., the similarity to normal behavior should be higher than 95%), the system determines that the target container's operating environment may have been attacked or misconfigured. At this point, to prevent further risks, the system will automatically terminate the target container on the target server, trigger a security alert, and initiate a backup container or recovery process to maintain the continuity and security of financial services. This real-time monitoring and anomaly detection mechanism effectively prevents unknown threats, reduces the probability of financial security incidents, and protects users' funds and the fairness of transactions.

[0072] This embodiment monitors system call behavior during container operation and stops container operation when an anomaly is detected. This allows for the timely detection and handling of unstable factors in the target container's operation, improving system security and availability.

[0073] In an exemplary embodiment, each of the above target values ​​is calculated by: converting the system call behaviors recorded in the above target sequence into feature vectors to obtain multiple first vectors; concatenating the multiple first vectors based on the order of the system call behaviors recorded in the above target sequence to obtain a second vector; calculating the similarity between the second vector and the third vector to obtain the above target value, wherein the third vector is a vector representation of the above first sequence.

[0074] Optionally, in this embodiment, the first vector is a set of feature vectors of all system calls extracted from the target sequence, representing the characteristics of all system call behaviors during the execution of the target process. For example, for open(" / etc / hosts"), there might be a vector represented as [1, 0, 0, 0, 23], where the number 1 indicates the position of the call in the sequence, and 23 indicates the timestamp of the call.

[0075] Optionally, in this embodiment, the second vector is a composite vector formed by concatenating all the first vectors according to the actual order of system call behaviors in the target sequence. This composite vector not only contains the features of all system calls but also retains their execution order information for subsequent similarity calculation.

[0076] Optionally, the third vector in this embodiment is a vector representation of the system call behavior executed by the target process within the target container under normal operating conditions, which is equivalent to a benchmark or template used to compare with the second vector.

[0077] Optionally, the similarity calculation in this embodiment is based on a distance metric between vectors (such as Euclidean distance, Manhattan distance, cosine similarity, etc.) to evaluate the degree of similarity between the two. For example, a cosine similarity close to 1 indicates a high degree of similarity, while a similarity close to 0 indicates complete dissimilarity.

[0078] This embodiment utilizes a vector similarity calculation method to evaluate the difference between the system call behavior and normal behavior during container runtime. By quantifying the monitoring results, anomaly detection becomes more accurate, reducing the possibility of false positives and false negatives.

[0079] In an exemplary embodiment, if Q out of P target values ​​are less than a preset threshold, before terminating the operation of the target container on the target server, the method further includes: selecting M first servers from N servers in the cluster whose hardware resources meet the hardware resource conditions and are compatible with the software configuration, wherein the configuration information includes the specification information and resource requirements of the target container, the specification information is used to represent the software configuration required to run the target container, the resource requirements are used to represent the hardware resource conditions required to run the target container, N and M are both integers greater than 1, and M is less than or equal to N; determining the server with the lowest load pressure among the M first servers as the second server; deploying the target container to the second server according to the obtained target container running status snapshot information and storage volume, so that the target process of the target container runs normally on the second server, wherein the running status snapshot information includes the process status and network status of all processes running in the target container, and the storage volume is used to store the data required to run the target process and other processes.

[0080] Optionally, the load pressure in this embodiment refers to the resource usage of the server at the current moment or over a past period, including indicators such as CPU utilization, memory usage, disk I / O, and network throughput, which are used to assess whether the server is under high load.

[0081] Optionally, the runtime snapshot information in this embodiment refers to a "snapshot" of the current runtime state of the container when the container is migrated or deployed, including the process state of all processes (such as running, paused, exited), network state (such as open ports, network connections), memory image, file system state, etc.

[0082] Optionally, the storage volume in this embodiment is the data storage space that the container relies on during runtime. It can be a persistent data volume or a temporary file system used to store the data and status information required by the running process.

[0083] Optionally, in this embodiment, when the target container is migrated, the source server (i.e., the target server mentioned above) creates a snapshot containing all process states of the target container (such as PID, parent PID, process name, and running status), network connection states (such as open ports, network protocols, and connection status), and the container's memory image. Simultaneously, the data storage volume mounted on the container is also copied to ensure that the complete running environment of the target container is reproduced on the second server.

[0084] For example, a bank is deploying a containerized service for real-time transaction processing. The target container hosts the transaction processing application, requiring significant memory resources and high-speed network communication. It also needs to run on an ARM-based server to fully utilize the parallel computing capabilities of the ARM processor. Furthermore, the container relies on the DM database and a specific version of the Tomcat middleware. The bank's domestic IT cloud cluster consists of N=300 servers, of which M=60 servers meet the aforementioned hardware resource requirements and software configuration compatibility requirements. Through continuous monitoring, the system determined that the second server was the candidate server with the lowest current load, with a CPU utilization of only 25% and a memory usage of 30%. Subsequently, the system retrieved a snapshot of the running status from the server currently running the target container, including the status of all processes, network connection information, and the contents of the storage volume. This data was efficiently replicated to the second server, ensuring that the target processes of the target container (such as the transaction processing program) could run accurately and flawlessly in the new environment, maintaining the continuity of transaction services and data consistency.

[0085] In this embodiment, after detecting an anomaly in the target container on the target server, the system intelligently selects a backup server to quickly deploy the target container to continue running the target process, effectively shortening the fault recovery time, ensuring business continuity, and improving user experience and overall system performance.

[0086] In an exemplary embodiment, the target data stream includes multi-layer mirror data, which constitute the file system. Each layer of the mirror data has a first identifier, which is generated using a hash algorithm. The first identifier is used to determine the consistency between the data recorded in the encrypted target data stream and the decrypted target data stream.

[0087] Optionally, in this embodiment, the first identifier is a unique identifier for each layer of mirrored data, typically generated using a hash algorithm (such as SHA-256, SM3, etc.). This is used to ensure data integrity and consistency, preventing data from being tampered with during transmission.

[0088] Optionally, the hash algorithm in this embodiment is an algorithm that converts data of arbitrary length into a fixed-length output (hash value or hash value). Common hash algorithms include the SHA series, MD5, and Chinese national cryptographic algorithms (SM2 / SM3 / SM4), which are used for data verification, encrypted signatures, and other scenarios.

[0089] In practical use, to ensure the security of the target data stream and the subsequent construction of the target container, the target data stream is encrypted during both its construction and transmission. Specifically, this can be achieved through the following steps: During the image construction phase, specifically in the Continuous Integration / Continuous Deployment (CI / CD) pipeline, a national cryptographic signature plugin (corresponding to the first component mentioned above) is integrated. This plugin uses the SM3 algorithm to generate hash values ​​for each layer of data in the image and ultimately signs the entire image manifest using the private key of the construction server (based on the SM2 algorithm). Simultaneously, the image's metadata (builder, time, dependency list) and its SM3 hash value are uploaded to a pre-defined consortium blockchain network via a smart contract for evidence storage. During the image transmission period, that is, in the communication between the image registry and the container engine, the TLS protocol based on the national cryptographic algorithm is forcibly enabled, the SM2 certificate is used for two-way authentication and key negotiation, and the SM4 algorithm is used to encrypt the transmitted payload. At the same time, at the sending end, the image data stream is divided into blocks of 1MB and the SM3 check value is calculated. These check values ​​are serialized and transmitted together. The receiving end performs real-time verification while receiving data.

[0090] For example, within a financial industry data center, there's a running container service processing customer transaction data. For system maintenance and software upgrades, the latest container image needs to be downloaded from a remote image repository. This image consists of multiple layers, each representing a different software package and system configuration. During the download process, the image data is transmitted encrypted to prevent interception and tampering by hackers. When the receiving end acquires each layer of image data, it calculates its hash value (first identifier) ​​and compares it with the hash value provided by the sending end to ensure data consistency. Assume the first layer of the image is the base operating system layer, with a hash value of d9e7b7c3e0 (this is just an example; the actual hash value would be longer). At the sending end, this layer's data is encrypted before being transmitted to the receiving end. After decryption, the receiving end calculates the hash value of this layer's data. If it perfectly matches the sending end's hash value, it proves the data has not been tampered with during transmission, ensuring file system consistency. The receiving end continues to perform the same hash value verification for each subsequent layer until all layers' data have been downloaded and confirmed to be correct. Subsequently, the system builds a file system based on this image data, deploys and runs the target container. In this way, even in insecure network environments, the secure transmission of container images and the integrity of the container runtime environment can be ensured, thereby guaranteeing the security of financial transaction data and the stable operation of container services.

[0091] This embodiment ensures the consistency of container image data through hash identifiers, enabling verification of data integrity even in multi-layer image scenarios. This improves data security, prevents image tampering, and guarantees the reliability of subsequent target container deployments.

[0092] Figure 3 This is a flowchart illustrating a method for deploying a target container according to an embodiment of this application. A large domestic bank is actively implementing its information technology innovation strategy and has decided to deploy a real-time transaction processing system (i.e., the aforementioned target container) in its data center. This system needs to run on a domestically developed operating system (such as the Kylin operating system). Figure 3 As shown, the target container is deployed on the target server using the following steps:

[0093] In step S302, the bank's container management platform uses the decryptor (corresponding to the first component mentioned above) set in the platform to perform decryption processing on the target data stream carried in the received decryption task, and obtains the file system and configuration information of the target container. The target data stream is generated after the container management platform initiates a request to pull the encrypted real-time transaction processing system container image from the central image repository. The target data stream is encrypted during transmission (using national cryptographic algorithms, such as SM4).

[0094] In step S304, the container management platform inputs the specification information and resource requirements into the target model to obtain the instruction information output by the target model to instruct the target server. The target server is the server determined by the target model after performing target operations on the specification information and resource requirements. The target server is compatible with the software configuration of the target container and the hardware resources of the target server meet the hardware resource conditions. The specification information is used to indicate the software configuration required to run the target container, and the resource requirements are used to indicate the hardware resource conditions required to run the target container. In this example, the target server is deployed with a domestic operating system (such as the Kylin operating system).

[0095] Step S306: The container management platform creates the runtime environment of the target container on the target server based on the file system and configuration information. The decrypted file system contains all the necessary files and directories of the transaction processing application. The configuration information defines the container's resource limits, network interfaces, environment variables, etc. The container management platform creates an isolated runtime environment based on this information, including setting the container's cgroups and namespaces, reserving necessary CPU and memory resources, configuring network port mapping, etc.

[0096] In step S308, the container management platform deploys the target container to the target server using the second component and the file system. The second component is a code converter, responsible for converting the target code (i.e., the transaction processing application code) in the container image into a format compatible with the Kylin operating system kernel interface on the host machine (i.e., the aforementioned target server). Upon container startup, the platform uses the converted code and the decrypted file system to start the target container, ensuring that the transaction processing application can directly and correctly call the Kylin operating system kernel interface, such as system calls clone, execve, and open.

[0097] Through this optional example, the national cryptographic algorithm ensures the confidentiality and integrity of container image data during transmission, reducing the risk of data leakage. The code converter allows banks to use code compatible with the kernel interface of domestic operating systems, avoiding security vulnerabilities caused by code incompatibility at runtime. Furthermore, the code converter optimizes the code for the architectural characteristics of domestic CPUs (such as the multi-core layout of the Kunpeng chip), ensuring the compatibility of the transaction processing system container on different domestic operating systems (such as Kylin OS and UOS) without requiring modifications to the application code. This significantly enhances the container's portability and deployment flexibility, reducing maintenance costs. Simultaneously, the container's runtime environment is precisely configured with resource limits during creation, enabling the container to fully utilize hardware resources during startup and runtime, improving transaction processing speed and avoiding resource waste. Therefore, this solves the problem of low container deployment efficiency caused by the inability to adapt containers to the target operating system in related technologies, achieving the effect of improving the deployment efficiency of containers on the target operating system.

[0098] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0099] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0100] According to another aspect of the embodiments of this application, a container deployment apparatus is also provided, which can be used to implement the container deployment method provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0101] Figure 4 This is a structural block diagram of a container deployment apparatus according to an embodiment of this application, such as... Figure 4 As shown, the device includes:

[0102] Sending module 42 is used to send a decryption task to the first component, so as to instruct the first component to perform decryption processing on the target data stream carried in the received decryption task to obtain the file system and configuration information of the target container, wherein the file system includes the files required by the target container to run.

[0103] Create module 44 to create the runtime environment for the target container based on the file system and configuration information described above;

[0104] Deployment module 46 is used to deploy the target container in the above-mentioned operating environment using the second component and the above-mentioned file system. The second component is used to convert the target code into code under a standardized code structure that can be recognized by the target operating system. The standardized code structure is used to ensure that the target container correctly calls the kernel interface of the target operating system when it starts.

[0105] The target data stream includes multiple layers of mirrored data, which constitute the file system. Each layer of the mirrored data has a first identifier, which is generated using a hash algorithm. The first identifier is used to determine the consistency between the data recorded in the encrypted target data stream and the decrypted target data stream.

[0106] It should be noted that the sending module 42 in this embodiment can be used to perform the above step S202, the creation module 44 in this embodiment can be used to perform the above step S204, and the deployment module 46 in this embodiment can be used to perform the above step S206.

[0107] In an exemplary embodiment, the creation module 44 is further configured to: parse the specification information and resource requirements of the target container from the configuration information, wherein the specification information represents the software configuration required to run the target container, and the resource requirements represent the hardware resource conditions required to run the target container; input the specification information and the resource requirements into the target model to obtain the indication information output by the target model for instructing the target server, wherein the target server is a server determined by the target model after performing a target operation on the specification information and the resource requirements, the target server is compatible with the software configuration of the target container, and the hardware resources of the target server meet the hardware resource conditions; and create the runtime environment in the target server based on the file system and the configuration information. The aforementioned target operation includes: selecting M first servers from the N servers included in the cluster that meet the aforementioned hardware resource conditions and are compatible with the aforementioned software configuration, where N and M are both integers greater than 1, and M is less than or equal to N; determining the load status of the M first servers after the target container is deployed based on the historical performance status of the M first servers; calculating the scores of the M first servers after the target container is deployed based on the M load statuses, obtaining M target values, where each of the aforementioned target values ​​represents the capacity of the corresponding first server to support the target container; and determining the first server corresponding to the highest target value among the M target values ​​as the aforementioned target server.

[0108] In an exemplary embodiment, the deployment module 46 is further configured to, after deploying the target container in the aforementioned operating environment using the second component and the aforementioned file system, monitor the system call behavior executed when the target process runs P times within the target container using the third component during the runtime of the target container, to obtain P target sequences, wherein the target process requests the operating system kernel of the target server to provide target services by executing the aforementioned system call behavior, the target server being a server on which the target container is deployed, and one of the aforementioned target sequences is used to record the system call behavior executed when the target container runs the target process once, where P is an integer greater than 1; calculate the similarity between the P aforementioned target sequences and the first sequence respectively to obtain P target values, wherein the first sequence includes the system call behavior executed when the target container runs the target process normally; and terminate the runtime of the target container on the target server if Q of the P aforementioned target values ​​are less than a preset threshold, wherein Q is an integer greater than 1 and Q is less than or equal to P.

[0109] In an exemplary embodiment, the deployment module 46 is further configured to calculate each of the target values ​​by: converting the system call behaviors recorded in the target sequence into feature vectors to obtain multiple first vectors; concatenating the multiple first vectors based on the order of the system call behaviors recorded in the target sequence to obtain a second vector; calculating the similarity between the second vector and the third vector to obtain the target value, wherein the third vector is a vector representation of the first sequence.

[0110] In an exemplary embodiment, the deployment module 46 is further configured to, before ending the operation of the target container on the target server, select M first servers from the N servers included in the cluster whose hardware resources meet the hardware resource conditions and are compatible with the software configuration, when Q out of the P target values ​​are less than a preset threshold. The configuration information includes the specification information and resource requirements of the target container. The specification information represents the software configuration required to run the target container, and the resource requirements represent the hardware resource conditions required to run the target container. N and M are both integers greater than 1, and M is less than or equal to N. The server with the lowest load pressure among the M first servers is determined as the second server. Based on the obtained snapshot information of the target container's running status and the storage volume, the target container is deployed to the second server so that the target process of the target container runs normally on the second server. The snapshot information of the running status includes the process status and network status of all processes running in the target container, and the storage volume is used to store data required for running the target process and other processes.

[0111] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0112] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when run.

[0113] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0114] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0115] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0116] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0117] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0118] The embodiments described herein also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0119] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0120] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0121] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method of deploying a container, characterized by, The method comprises the following steps: sending a decryption task to a first component to instruct the first component to perform decryption processing on target data stream carried in the received decryption task to obtain file system and configuration information of a target container, wherein the file system comprises files required by the target container during runtime; creating a running environment of the target container based on the file system and the configuration information; deploying the target container in the running environment by using a second component and the file system, wherein the second component is used to convert target code into code in a standardized code structure recognizable by a target operating system, and the standardized code structure is used to ensure correct calling of a kernel interface of the target operating system when the target container is started.

2. The method of claim 1, wherein, The step of creating a running environment of the target container based on the file system and the configuration information comprises the following steps: parsing specification information and resource requirements of the target container from the configuration information, wherein the specification information is used to represent software configuration required when the target container is running, and the resource requirements are used to represent hardware resource conditions required when the target container is running; inputting the specification information and the resource requirements into a target model to obtain indication information output by the target model, wherein the indication information is used to instruct a target server, the target server is a server determined by the target model after performing a target operation on the specification information and the resource requirements, the target server is compatible with the software configuration of the target container, and hardware resources of the target server meet the hardware resource conditions; creating the running environment in the target server based on the file system and the configuration information.

3. The method of claim 2, wherein, The target operation comprises the following steps: selecting M first servers from N servers included in a cluster, wherein hardware resources of the M first servers meet the hardware resource conditions and are compatible with the software configuration, N and M are both integers greater than 1, and M is less than or equal to N; determining load states of the M first servers after the target container is deployed in the M first servers based on historical performance states of the M first servers; calculating scores of the M first servers after the target container is deployed based on the M load states to obtain M target values, wherein each target value is used to represent the ability of a corresponding first server to carry the target container; determining the first server corresponding to the target value with the highest value in the M target values as the target server.

4. The method of claim 1, wherein, After the target container is deployed in the running environment by using the second component and the file system, the method further comprises the following steps: monitoring system call behaviors performed by a target process during P times of running in the target container by using a third component to obtain P target sequences, wherein the target process requests a target operating system kernel of a target server to provide a target service by performing the system call behaviors, the target server is a server in which the target container is deployed, one target sequence is used to record the system call behaviors performed by the target container when the target process is run once, and P is an integer greater than 1. Calculate the similarity between P target sequences and a first sequence respectively, obtaining P target values, wherein the first sequence includes system call behaviors executed when the target container normally runs the target process; In the case that Q of the P target values are less than a preset threshold, end the running of the target container on the target server, wherein Q is an integer greater than 1, and Q is less than or equal to P.

5. The method of claim 4, wherein, Each target value is calculated by the following method: Convert the system call behaviors recorded in the target sequence into feature vectors to obtain a plurality of first vectors; Splice a plurality of first vectors based on the order of system call behaviors recorded in the target sequence to obtain a second vector; Calculate the similarity between the second vector and a third vector to obtain the target value, wherein the third vector is a vector representation of the first sequence.

6. The method of claim 4, wherein, In the case that Q of the P target values are less than a preset threshold, before ending the running of the target container on the target server, the method further comprises: Filter M first servers from N servers included in the cluster, wherein the hardware resources of the M first servers meet the hardware resource conditions and are compatible with the software configuration, the configuration information includes specification information and resource requirements of the target container, the specification information is used to indicate the required software configuration when running the target container, and the resource requirements are used to indicate the required hardware resource conditions, N and M are integers greater than 1, and M is less than or equal to N; Determine the server with the smallest load pressure among the M first servers as a second server; Deploy the target container to the second server according to the obtained running state snapshot information and storage volume of the target container, so that the target process of the target container normally runs on the second server, wherein the running state snapshot information includes process states and network states of all processes running in the target container, and the storage volume is used to store data required for running the target process and other processes.

7. The method of claim 1, wherein, The target data stream includes multi-layer image data, the multi-layer image data constitutes the file system, each layer of the image data has a first identifier, the first identifier is generated by using a hash algorithm, and the first identifier is used to determine the consistency of the data recorded in the encrypted target data stream and the decrypted target data stream.

8. A deployment device for a container, characterized by Comprise: The sending module is configured to send a decryption task to a first component to instruct the first component to perform decryption processing on a target data stream carried in the received decryption task to obtain a file system and configuration information of a target container, wherein the file system includes files required when the target container runs; The creating module is configured to create a running environment of the target container based on the file system and the configuration information. A deployment module is configured to deploy the target container in the running environment by using a second component and the file system, wherein the second component is configured to convert target code into code in a standardized code structure recognizable by a target operating system, and the standardized code structure is configured to ensure that a kernel interface of the target operating system is correctly invoked when the target container is started.

9. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions, when executed by a processor, implement the steps of the method of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program / instructions, when executed by a processor, implement the steps of the method of any one of claims 1-7.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program / instructions, when executed by a processor, implement the steps of the method of any one of claims 1-7.

Images