Container operating system, method, cluster, device, storage medium and program product

Abstract

The invention provides a container operating system and method, a cluster, equipment, a storage medium and a program product, and the system comprises an audit entry component which runs in a container and is used for sending user information corresponding to a connection channel and a process identifier corresponding to the audit entry component to an agent component after the connection channel is established between a client and the container; the proxy component is used for generating corresponding session identifiers for the user information corresponding to the connection channels and sending the session information of the containers to the kernel component; the kernel component is used for monitoring at least one operation executed on a target container in the at least one container through the connection channel in a kernel mode, determining a session identifier to which the operation belongs according to a process executing the operation and acquired session information for any operation, and synchronizing operation information corresponding to the operation to the proxy component, and the agent component determines the operation record of the target container and the user executing the corresponding operation. And the comprehensiveness of auditing the operation in the container is improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more particularly to a container operating system, method, cluster, device, storage medium, and program product. Background Technology

[0002] A cluster can include multiple host machines. Each host machine can run multiple containers. When a user performs an operation within any container, that operation needs to be audited.

[0003] In related technologies, an additional agent system can be set up outside the cluster to operate on the containers within the cluster. Users can send user commands to the cluster through this agent system. The agent system can then audit the operations performed on the containers based on these user commands. However, this approach has the potential to execute complex scripts within containers, allowing operations based on these scripts to evade auditing. This can lead to omissions in the auditing of certain operations within the containers, resulting in low comprehensiveness of the auditing of container operations. Summary of the Invention

[0004] This application provides a container operating system, method, cluster, device, storage medium, and program product to address the problem of low audit comprehensiveness of operations within containers.

[0005] In a first aspect, embodiments of this application provide a container operating system for operating at least one container in a host machine, the system comprising:

[0006] An audit entry component running in the container is used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client;

[0007] The proxy component is used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0008] The kernel component is used to monitor in kernel mode at least one operation performed on the target container in the at least one container through the connection channel. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation.

[0009] In one possible implementation, the system further includes:

[0010] An interface service component is used to invoke the admission control component when a container creation request initiated by the client is received; wherein, the container creation request includes the mount directory of the container to be created;

[0011] The access control component is used to add an audit directory to the mount directory of the container to be created;

[0012] The proxy component is also used to place the audit entry component in the audit directory of the container when the container is first run after it is created.

[0013] In one possible implementation, the system further includes:

[0014] An interface service component is used to obtain the "enter container" command sent by the client for any container, and to create a connection channel between the container and the client based on the "enter container" command.

[0015] An admission control component is used to update the entry container command to obtain an updated entry container command;

[0016] The node proxy component is used to start the audit entry component in the corresponding container according to the updated container entry command.

[0017] In one possible implementation, the command to enter the container includes a user command; the admission control component is specifically used for:

[0018] The user command in the "Enter Container" command is replaced with the target command to obtain the updated "Enter Container" command. The target command includes a command for invoking the audit entry component and the user command, so that the node agent component starts the audit entry component in the corresponding container after obtaining the updated "Enter Container" command.

[0019] In one possible implementation, the target command specifically includes:

[0020] The audit directory, audit entry component name, and user command corresponding to the container;

[0021] The audit directory is used to place the audit entry component, so that the node agent component can start the audit entry component in the corresponding container according to the audit directory and the audit entry component name.

[0022] In one possible implementation, the session information includes a session identifier and a process identifier corresponding to the audit entry component;

[0023] The kernel component determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation with the proxy component, including:

[0024] Determine the process ID of the parent process to which the process performing this operation belongs;

[0025] Based on the process identifier corresponding to the parent process, a session identifier matching the operation is determined from the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component, the operation information including the session identifier matching the operation.

[0026] In one possible implementation, the proxy component is further configured to: store the process identifier and user information corresponding to the audit entry component;

[0027] Accordingly, the proxy component determines the operation records of the target container and the user who performed the corresponding operation, including:

[0028] Based on the session identifier in the operation information of each operation synchronized by the kernel component, determine the user information corresponding to each operation;

[0029] An audit log is generated based on the user information corresponding to each operation. The audit log includes operation records for the target container and user information corresponding to each operation.

[0030] Secondly, embodiments of this application provide a container operation method applied to a container operating system, wherein the container operating system includes an audit entry component, a proxy component, and a kernel component running in the container, and the method includes:

[0031] After the client establishes a connection channel with the container, the audit entry component running in the container sends the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component; wherein, the user information is used to indicate the user of the client;

[0032] The proxy component generates corresponding session identifiers for the user information of each connection channel and sends the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0033] The kernel component monitors in kernel mode at least one operation performed on a target container in at least one container through the connection channel. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component.

[0034] The proxy component determines the operation records of the target container and the user who performed the corresponding operation.

[0035] In one possible implementation, the system further includes an interface service component and an access control component; the method further includes:

[0036] Upon receiving a container creation request initiated by the client, the access control component is invoked through the interface service component; wherein, the container creation request includes the mount directory of the container to be created;

[0037] The access control component adds an audit directory to the mount directory of the container to be created.

[0038] When the container is first run after it is created, the audit entry component is placed in the audit directory of the container through the proxy component.

[0039] Thirdly, embodiments of this application provide a container operation method applied to an audit entry component, the method comprising:

[0040] After the client establishes a connection channel with the target container, it sends the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component. The user information is used to indicate the user of the client. Any operation performed on the target container through the connection channel is monitored by the kernel component in kernel mode. The kernel component is used to determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation.

[0041] The proxy component is used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0042] Fourthly, embodiments of this application provide a container operation method applied to a proxy component, the method comprising:

[0043] Generate corresponding session identifiers for the user information of each connection channel;

[0044] Session information of each container is sent to the kernel component so that the kernel component can monitor at least one operation performed on the target container in kernel mode. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the agent component so that the agent component can determine the operation record of the target container and the user who performed the corresponding operation.

[0045] The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container;

[0046] The audit entry component is used to send user information corresponding to the connection channel and process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. The user information is used to indicate the user of the client.

[0047] Fifthly, embodiments of this application provide a container operation method applied to kernel components, the method comprising:

[0048] Monitor at least one operation performed on the target container via the connection channel in kernel mode;

[0049] For any operation, the session identifier to which the operation belongs is determined based on the process of executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation;

[0050] The proxy component is used to generate corresponding session identifiers for the user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0051] The audit entry component is used to send user information corresponding to the connection channel and process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client.

[0052] Sixthly, embodiments of this application provide a cluster, including: an interface server and at least one host machine;

[0053] The interface server includes an interface service component, through which a connection channel is established between the client and the container in the host machine.

[0054] The host machine includes:

[0055] An audit entry component running in the container is used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client;

[0056] The proxy component is used to generate corresponding session identifiers for the user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0057] A kernel component is used to monitor at least one operation performed on the target container through the connection channel in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record for the target container and the user who performed the corresponding operation.

[0058] In a seventh aspect, embodiments of this application provide an electronic device, including: a memory and a processor;

[0059] The memory stores computer-executed instructions;

[0060] The processor executes computer execution instructions stored in the memory, causing the processor to perform the method described in any one of the second to fifth aspects.

[0061] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in any one of the second to fifth aspects.

[0062] Eighthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the methods shown in any one of the second to fifth aspects.

[0063] This application provides a container operating system, method, cluster, device, storage medium, and program product. The container operating system may include an audit entry component, a proxy component, and a kernel component running within the container. Specifically, the audit entry component running within the container can send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after a connection channel is established between the client and the container. The proxy component can generate corresponding session identifiers for the user information of each connection channel and send the session information of each container to the kernel component. The kernel component can monitor at least one operation performed on a target container within at least one container through the connection channel in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. On the one hand, since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the existing technology where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusiveness to user usage habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, so that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing. Attached Figure Description

[0064] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0065] Figure 1 A schematic diagram illustrating an application scenario provided for an exemplary embodiment of this application;

[0066] Figure 2 A schematic diagram of a container operating system provided for an exemplary embodiment of this application;

[0067] Figure 3 A schematic diagram of another container operating system provided for an exemplary embodiment of this application;

[0068] Figure 4A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 1 ;

[0069] Figure 5 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 2 ;

[0070] Figure 6 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 3 ;

[0071] Figure 7 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 4 ;

[0072] Figure 8 A flowchart illustrating a container creation process provided for an exemplary embodiment of this application;

[0073] Figure 9 A schematic flowchart illustrating a container operation provided for an exemplary embodiment of this application;

[0074] Figure 10 A schematic diagram of a cluster provided for an exemplary embodiment of this application;

[0075] Figure 11 A schematic diagram of another cluster provided for an exemplary embodiment of this application;

[0076] Figure 12 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0077] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0078] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0079] Below, in conjunction with Figure 1 The application scenarios of this application will be explained.

[0080] Figure 1 This is a schematic diagram illustrating an application scenario provided for an exemplary embodiment of this application. Please refer to [link / reference]. Figure 1 A cluster can include multiple host machines, and any single host machine can contain multiple containers. For example, the multiple host machines can be host machine 1, host machine 2, ... Host machine 1 can contain container a and container b.

[0081] Users can send user commands to the target container through a client. The host machine where the target container resides can respond to the user commands and perform operations on the target container. For example, a user can send a user command to container 'a' through a client. If the user command instructs to operate on container 'a', then host machine 1 can respond to the user command and operate on container 'a'.

[0082] In related technologies, an additional agent system can be set up outside the cluster to operate on the containers within the cluster. Users can send user commands to the cluster through this agent system. The agent system can then audit the operations performed on the containers based on these user commands. However, this approach has the potential to execute complex scripts within containers, allowing operations based on these scripts to evade auditing. This can lead to omissions in the auditing of certain container operations, resulting in incomplete auditing.

[0083] In this embodiment, the cluster may include a container operating system, which may include an audit entry component, a proxy component, and a kernel component running within the container. The kernel component can monitor at least one operation performed on the container and, for any given operation, associate the operation with its associated session identifier and synchronize the corresponding operation information to the proxy component, so that the proxy component can determine the operation record corresponding to any given operation based on the operation information; wherein, at least one operation may be performed through the container's connection channel; the session identifier is generated by the proxy component for the user information corresponding to the connection channel. On the one hand, since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the existing technology where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusiveness to user usage habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, so that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0084] The technical solutions shown in this application will now be described in detail through specific embodiments. It should be noted that the following embodiments may exist independently or in combination with each other; for identical or similar content, the description will not be repeated in different embodiments.

[0085] Figure 2 This is a schematic diagram of a container operating system provided for an exemplary embodiment of this application. Please refer to [link / reference]. Figure 2 The host machine can host a container operating system. The container operating system can include: an audit entry point component, an agent component, and a kernel component running within the container. The container operating system can be used to operate at least one container on the host machine.

[0086] The host machine can include kernel mode and user mode. The audit entry component and agent component run in user mode, while kernel components can run in kernel mode.

[0087] The host machine can include at least one container group (Pod). Any Pod can include at least one container. For example, the host machine can include Pod1, and Pod1 can include container 1.

[0088] For any container, a connection channel can be established between the container and the client. Optionally, the connection channel can be a persistent connection channel. For example, a persistent connection channel can be a connection channel established according to the WebSocket protocol or the Transmission Control Protocol (TCP). For example, connection channel 1 can be established between the client and container 1.

[0089] For any container, an audit entry component can be set up. After a connection channel is established between the client and the container, the audit entry component can send the user information corresponding to the connection channel, as well as the process ID (PID) of the audit entry component, to the proxy component. The process ID refers to the identifier of the process running the audit entry component in the container.

[0090] For example, the audit entry component can send the user information corresponding to connection channel 1 and the process identifier PID1 corresponding to the audit entry component to the agent component.

[0091] A proxy component can be configured on the host machine. This proxy component can generate corresponding session identifiers for the user information of each connection channel and send the session information of each container to the kernel component. The container's session information can be used to indicate the process and session identifier corresponding to the audit entry component within the container.

[0092] For any given connection channel, the channel is created based on the previous entry command into the container. The updated entry command may include user information, therefore the connection channel has corresponding user information. For example, the user information may include user identifier (ID), user account, user role, etc. The user role can be a developer, tester, or administrator, etc.

[0093] The proxy component can generate a corresponding session identifier for user information, so as to record user information through the session identifier. For example, if the user information 1 corresponding to connection channel 1 includes user identifier User01 and user role as developer, the proxy component can generate a corresponding session identifier S1 for user information 1, so that user information 1 can be recorded through session identifier S1.

[0094] For any container, the container's session information may include a session identifier and the process identifier corresponding to the audit entry component in the container.

[0095] For example, if connection channel 1 is the connection channel for container 1, the proxy component generates a corresponding session identifier S1 based on the user information corresponding to connection channel 1. If the process identifier corresponding to the audit entry component in container 1 is PID1, then the proxy component can determine that the session information corresponding to container 1 includes both session identifier S1 and process identifier PID1. The proxy component can then send the session information corresponding to container 1 to the kernel component.

[0096] A client can send at least one user command to a container through a connection channel. For any given user command, the command instructs the client's user on an action to be taken within the container. For example, user command 1, "rmfile1.txt", could instruct the deletion of file 1 within container 1.

[0097] A container may include a container runtime component (not shown in the diagram), which can perform at least one operation on the container based on at least one user command. For example, if user command 1 is "rm file1.txt", then the container runtime component can execute user command 1 to delete file 1 in container 1.

[0098] For any given host machine, the host may include kernel components. In kernel mode, kernel components can monitor at least one operation performed on the target container through the connection channel. By monitoring at least one operation performed on the target container in kernel mode through kernel components, operations executed according to complex scripts can be directly traced, avoiding the omission of some operations.

[0099] For any given operation, the kernel component can determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information.

[0100] Since the audit entry component in the target container is started by the entry command that creates the connection channel, and at least one user command corresponding to at least one operation performed on the target container is initiated through this connection channel, the process executing each operation in at least one operation is a child process of the process executing the audit entry component. That is, the process executing the audit entry component in the target container can be the parent process, and the process executing at least one operation in the target container according to at least one user command can be a child process of the parent process.

[0101] Since any session information may include a session identifier and the process identifier corresponding to the audit entry component, for any operation, the kernel component can determine the process that performs the operation, and determine the session identifier to which the operation belongs based on the process identifier in the obtained session information, and then determine the operation information corresponding to the operation.

[0102] The operation information may include the session identifier to which the operation belongs, and may also include at least one of the following: the operation time, the user command corresponding to the operation, and the process identifier of the process executing the operation.

[0103] For example, if there are two containers, the kernel component can obtain the session information of container 1 and the session information of container 2. The session information of container 1 may include session identifier S1 and process identifier PID1; the session information of container 2 may include session identifier S2 and process identifier PID2.

[0104] If the kernel component detects that operation 1 (i.e., deleting file 1) was executed in container 1 according to user command 1, and the process executing operation 1 is process PID3, which is a child process of process PID1, then the kernel component can determine that the session to which operation 1 belongs is S1 based on process PID3 and the two session information pieces obtained. The kernel component can determine that the operation information 1 of operation 1 includes: session identifier S1, operation time 2024 / 10 / 29 13:00, user command 1 (i.e., "rm file1.txt"), and process identifier PID3 of the process executing operation 1.

[0105] Kernel components can synchronize operation information corresponding to each operation with proxy components, so that proxy components can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information of each operation.

[0106] The operation log can include each operation corresponding to the target container, as well as the operation information corresponding to each operation.

[0107] For example, the kernel component can synchronize operation information 1 of operation 1 to the proxy component. If operation information 1 is as shown in the example above, the proxy component can determine the session identifier S1 in operation information 1, and determine the user information corresponding to operation 1 as user information 1 based on the session identifier S1. If user information 1 includes user identifier User01 and user role as developer, then the user executing operation 1 can be determined to be the developer indicated by user identifier User01 based on user information 1. The proxy component can generate operation record 1 based on operation information 1, and operation record 1 can include operation 1 and the operation information 1 corresponding to operation 1.

[0108] In this embodiment, the container operating system may include an audit entry component, a proxy component, and a kernel component running within the container. The audit entry component, running within the container, can send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. The proxy component can generate corresponding session identifiers for the user information of each connection channel and send the session information of each container to the kernel component. The kernel component can monitor at least one operation performed on the target container in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. On the one hand, since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the existing technology where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusiveness to user usage habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, so that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0109] Below, in Figure 2 Based on the illustrated embodiments, combined with Figure 3 The above container operating system will be described in detail.

[0110] Figure 3 This is a schematic diagram of another container operating system provided for an exemplary embodiment of this application. Please see [link to schematic diagram]. Figure 3 The container operating system may also include: an interface service component and an admission control component.

[0111] Optionally, the cluster can have multiple interface service components and multiple admission control components. The container operating system can include at least one interface service component and at least one admission control component. Any interface service component can invoke any admission control component.

[0112] The process of creating a container may include steps 1.1 to 1.5.

[0113] During container creation, the interface service component can invoke the admission control component upon receiving a container creation request from a client. The admission control component can then add an audit directory to the mount directory of the container to be created.

[0114] For example, in step 1.1, the client can send a container creation request to the interface service component. In step 1.2, the interface service component can invoke the admission control component to add an audit directory to the mount directory of the container to be created.

[0115] Optionally, the container creation request may include the mount directory of the container to be created, and may also include at least one of the following: user identifier, target Pod identifier, identifier of the container to be created, and image file of the container to be created.

[0116] Among them, the user identifier can be used to indicate the corresponding user, the target Pod identifier can be used to indicate the target Pod, and the identifier of the container to be created can be used to indicate the container to be created.

[0117] For example, container creation request 1 may include user identifier User01, target Pod identifier Pod1, container 1 identifier C1, the mount directory corresponding to container 1 directory1, and the image file corresponding to container 1.

[0118] The audit directory can be used to place audit entry components. For example, the audit directory can be the / audit-cmd / directory.

[0119] For example, if container creation request 1 is as shown in the example above, the admission control component can add the / audit-cmd / directory to directory 1 of container 1.

[0120] Optionally, the cluster may also include a scheduler (not shown in the figure). The interface service component can send a container creation request to the scheduler, which can allocate the container to the target host based on the container creation request and send the identifier of the target host to the interface service component.

[0121] For any given host machine, the host machine may also include a node proxy (kubelet) component. In step 1.3, the node proxy component can obtain the container creation request from the interface service component. If the target host machine corresponding to the container creation request is the host machine where the node proxy component resides, then in step 1.4, the node proxy component can create the container on the host machine according to the container creation request.

[0122] For example, if container creation request 1 is as illustrated above, and the scheduler allocates container 1 to host machine 1 based on container creation request 1, then the scheduler can send the identifier of host machine 1 to the interface service component. If the node proxy component in host machine 1 obtains container creation request 1 from the interface service component and determines that the target host machine corresponding to container creation request 1 is host machine 1, then the node proxy component can create container 1 in host machine 1 according to container creation request 1.

[0123] In step 1.5, when the container is first run after it is created, the proxy component can place the audit entry component in the container's audit directory.

[0124] For example, after creating container 1 on host machine 1, the agent component can place the audit entry component in the / audit-cmd / directory of container 1 when container 1 runs for the first time.

[0125] The process of running a container may include steps 2.1 to 2.12.

[0126] During container operation, the interface service component can also be used to obtain the "enter container" command sent by the client for any container, and create a connection channel between the container and the client based on the "enter container" command. For example, the "enter container" command can be the `kubectl exec` command. For instance, in step 2.1, the client can send an "enter container" request to the interface service component for container 1.

[0127] In step 2.2, the interface service component can create a connection channel between the client and container 1.

[0128] For example, the command to enter the container 1 could be "kubectl exec -it Pod1 -c container1 --sh", which instructs the user to enter container 1 and start a command interpreter (shell) within container 1. The interface service component can obtain the command to enter container 1 sent by the client and create a connection channel 1 between container 1 and the client based on the command.

[0129] In step 2.3, the admission control component can be used to update the entry container command, obtain the updated entry container command, and send the updated entry container command to the interface service component.

[0130] The admission control component can be specifically used to: replace the user command in the entry command to the container with the target command to obtain the updated entry command to the container, so that the node agent component can start the audit entry component in the corresponding container after obtaining the updated entry command.

[0131] The command to enter a container can include user commands. For example, if the command to enter a container is "kubectl exec -itpod1 -c container1 --sh", then "sh" is a user command.

[0132] The target command may include commands for invoking the audit entry component and user commands. Optionally, the target command may specifically include: the audit directory corresponding to the container, the name of the audit entry component, and the user command. The audit directory can be used to house the audit entry component. Optionally, the target command may also include user information. The access control component can determine the user information of the user who sent the command to enter the container.

[0133] For example, the target command can be " / audit-cmd / audit-entrypoint<user information><user command>", where " / audit-cmd / audit-entrypoint" is the command to call the audit entry component, " / audit-cmd / " can be the audit directory corresponding to the container, and audit-entrypoint can be the name of the audit entry component.

[0134] For example, if the command to enter the container is "kubectl exec -it Pod1 -c container1 --sh", the admission control component can replace the user command "sh" in the command to enter the container with the target command / audit-cmd / audit-entrypoint<user ID User01>sh, and thus obtain the updated command to enter the container as "kubectl exec -it Pod1 -c container1 -- / audit-cmd / audit-entrypoint<user ID User01>sh".

[0135] In step 2.4, after the interface service component receives the updated enter container command, it can send the updated enter container command to the node proxy component.

[0136] In step 2.5, after the node agent component receives the updated entry container command, it can determine the audit directory and audit entry component name in the updated entry container command, and then start the audit entry component in the corresponding container according to the audit directory and audit entry component name.

[0137] For example, if the updated "Enter Container Command 1" is as shown in the example above, the interface service component can send the updated "Enter Container Command 1" to the node proxy component. After receiving the updated "Enter Container Command 1", the node proxy component can determine that the audit directory is / audit-cmd / and the audit entry component name is audit-entrypoint, and determine that the corresponding container is container 1. Then, based on the audit directory / audit-cmd / and the audit entry component name audit-entrypoint, the node proxy component can start the audit entry component in container 1 and execute the user command "sh", that is, open a shell in container 1.

[0138] In step 2.6, the audit entry component can be used to send the process identifier of the audit entry component and the user information corresponding to the connection channel to the agent component.

[0139] The proxy component can include virtual interfaces (not shown in the diagram), each with a corresponding IP address. The proxy component can configure routing rules for the virtual interfaces.

[0140] For example, the proxy component may include a virtual interface audit-link0, the IP address of which can be 169.254.200.200, and the corresponding routing rule can be 169.254.200.200dev audit-link0, which means that data packets with a destination IP address of 169.254.200.200 are transmitted through the virtual interface named "audit-link0".

[0141] The proxy component can start a remote call service to communicate with the audit entry component. For example, the listening address of the remote call service can be 169.254.200.200:12356, indicating that the remote call service can listen on the network location of 169.254.200.200, with the port number 12356.

[0142] After the audit entry component is started in the container, it can determine the user information corresponding to the connection channel in the updated container entry command, and send the process identifier of the audit entry component and the user information corresponding to the connection channel to the agent component.

[0143] For example, if a connection channel 1 for container 1 is created based on the entry command 1, and if the process running the audit entry component in container 1 is process 1 with the corresponding process ID PID 1, and if the updated entry command 1 is as shown in the example above, then the audit entry component can determine user information 1, including user ID User01 and user role as developer, from the updated entry command 1. The audit entry component can then send the process ID PID 1 corresponding to the audit entry component and the user information 1 corresponding to connection channel 1 to the proxy component.

[0144] Optionally, the audit entry component can also send Pod information and container information to the proxy component. Optionally, the Pod information may include at least one of the following: Pod identifier, Pod tag, etc.; the container information may include at least one of the following: container identifier, container tag, etc.

[0145] After receiving the process identifier of the audit entry component, the user information of the connection channel, the Pod information, and the container information sent by the audit entry component, the proxy component can store the process identifier of the audit entry component, the user information of the connection channel, the Pod information, and the container information.

[0146] In step 2.7, the proxy component can generate a session identifier, and record the aforementioned user information, Pod information, and container information through the session identifier.

[0147] Since the session identifier is generated by the agent component after the audit entry component receives the process identifier and user information sent by the audit entry component and executes the updated entry command in the container, it is used to record user information. The container connection channel is generated by the entry command before the update. Therefore, the session identifier can be either the session identifier corresponding to the user information or the session identifier corresponding to the container connection channel.

[0148] In step 2.8, the proxy component can determine session information, which may include a session identifier and the process identifier corresponding to the audit entry component. The proxy component can send session information to the kernel component using Extended Berkeley Packet Filter (eBPF) technology.

[0149] The kernel component can receive session information for each container sent by the proxy component. For example, if there are two containers, the kernel component can obtain the session information for container 1 and container 2 sent by the proxy component. The session information for container 1 may include session identifier S1 and process identifier PID1; the session information for container 2 may include session identifier S2 and process identifier PID2.

[0150] In step 2.9, the container runtime component can execute at least one user command initiated through the connection channel to perform at least one operation.

[0151] In step 2.10, the kernel component may include an eBPF program. In kernel mode, the kernel component can monitor at least one operation performed on the target container through the eBPF program.

[0152] In step 2.11, for any operation, the kernel component can determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information in the following way, and synchronize the operation information corresponding to the operation to the proxy component: determine the process identifier corresponding to the parent process to which the process executing the operation belongs; determine the session identifier matching the operation from the obtained session information based on the process identifier corresponding to the parent process, and synchronize the operation information corresponding to the operation to the proxy component.

[0153] For example, if user command 1 is "rm file1.txt", and the container runtime component executes operation 1 (i.e., deletes file 1) in container 1 based on user command 1, then the kernel component can monitor operation 1. The kernel component can determine that the process executing operation 1 is process PID3, and that process PID3 is a child process of process 1. Therefore, the kernel component can determine that the parent process of the process executing operation 1 is process 1, and the process ID corresponding to the parent process is PID1. If the session information obtained by the kernel component includes session information of container 1 and session information of container 2, and the session information of container 1 includes session ID S1 and process ID PID1, and the session information of container 2 includes session ID S2 and process ID PID2, then the kernel component can determine that the session ID matching operation 1 is S1 based on the process ID PID1 corresponding to the parent process from the session information of container 1. The kernel component can determine that the operation time of operation 1 is 2024 / 10 / 29 13:00, the user command 1 corresponding to operation 1 is "rm file1.txt", and the process ID of the process executing operation 1 is PID3. The kernel component synchronizes the operation information 1 corresponding to operation 1 to the agent component. The operation information 1 may include: session identifier S1, operation time 2024 / 10 / 29 13:00, user command 1 (i.e. "rm file1.txt"), and process identifier PID3 of the process executing operation 1.

[0154] In step 2.12, after the proxy component obtains the operation information corresponding to multiple operations, it can determine the operation record for the target container and the user who performed the corresponding operation: based on the session identifier in the operation information of each operation synchronized by the kernel component, the user information corresponding to each operation is determined; based on the user information corresponding to each operation, an audit log is generated.

[0155] Since the proxy component records user information through session identifiers, and each operation has a corresponding session identifier, the proxy component can determine the user information corresponding to each operation based on the session identifier of each operation.

[0156] The proxy component can generate audit logs based on the user information corresponding to each operation. The audit logs can include operation records for the target container and the user information corresponding to each operation. Specifically, the operation records can include each operation corresponding to the target container and the operation information for each operation.

[0157] For example, the kernel component synchronizes the operation information corresponding to 10 operations to the proxy component. These 10 operations and the session identifiers in the operation information of each operation are shown in Table 1:

[0158] Table 1

[0159] operate Session identifier in operation information User Information Operation 1 S1 User Information 1 Operation 2 S1 User Information 1 Operation 3 S2 User Information 2 Operation 4 S2 User Information 2 Operation 5 S1 User Information 1 Operation 6 S2 User Information 2 Operation 7 S1 User Information 1 Operation 8 S2 User Information 2 Operation 9 S1 User Information 1 Operation 10 S1 User Information 1

[0160] If the user information corresponding to session identifier S1 is user information 1 and the user information corresponding to session identifier S2 is user information 2, then the proxy component can determine the user information corresponding to each operation as shown in Table 3.

[0161] If session identifier S1 is the session identifier corresponding to connection channel 1 of container 1, then the proxy component can determine that the operation record of container 1 includes 6 operations, namely operation 1, operation 2, operation 5, operation 7, operation 9, and operation 10. The operation record can include the operation information corresponding to each of the 6 operations. If user information 1 includes user identifier User01 and user role as developer, then the proxy component can determine that the user who performed the 6 operations is the developer indicated by user identifier User01.

[0162] In this application, each operation record in the audit log includes a session identifier corresponding to each operation. Therefore, based on the session identifier corresponding to each operation in the audit log, the link tracing capability of operations within the container can be realized; based on the user information corresponding to each operation in the audit log, the personnel who performed each operation can be identified.

[0163] In this embodiment of the application, the container operating system may include an audit entry component, a proxy component, a kernel component, an interface service component, and an admission control component running in the container. The interface service component can be used to obtain the container entry command sent by the client for any container, create a connection channel between the container and the client based on the container entry command, and call the admission control component when a container creation request initiated by the client is received. The admission control component can be used to add an audit directory to the mount directory of the container to be created. The proxy component can be used to place an audit entry component in the container's audit directory when the container is first run after creation. The audit entry component running in the container can be used to send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. The proxy component can be used to generate corresponding session identifiers for the user information corresponding to each connection channel and send the session information of each container to the kernel component. The kernel component can be used to monitor at least one operation performed on the target container through the connection channel in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. On the one hand, since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the existing technology where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusiveness to user usage habits and improving user experience. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, so that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0164] Below, based on any of the above embodiments, combined with Figure 4 This provides a container operation method applicable to the aforementioned container operating system.

[0165] Figure 4 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 1 Please see. Figure 4 The method may include:

[0166] S401. When a container creation request initiated by the client is received, the admission control component is called through the interface service component.

[0167] The container creation request may include the mount directory of the container to be created. Optionally, the container creation request may also include at least one of the following: user identifier, target Pod identifier, identifier of the container to be created, and image file of the container to be created.

[0168] For example, container creation request 1 may include user identifier User01, target Pod identifier Pod1, container 1 identifier C1, the mount directory corresponding to container 1 directory1, and the image file corresponding to container 1. After receiving container creation request 1 sent by the client, the interface service component can call the admission control component.

[0169] S402. Add an audit directory to the mount directory of the container to be created using the access control component.

[0170] The audit directory can be used to place audit entry components. For example, the audit directory can be the / audit-cmd / directory.

[0171] For example, the admission control component can determine the directory 1 of container 1 in container creation request 1, and add the / audit-cmd / directory under directory 1.

[0172] S403. When the container is first run after it is created, place the audit entry component in the container's audit directory through the proxy component.

[0173] For example, after creating container 1 on host machine 1, the agent component can place the audit entry component in the / audit-cmd / directory of container 1 when container 1 runs for the first time.

[0174] S404. After the client establishes a connection channel with the container, the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component are sent to the agent component through the audit entry component running in the container.

[0175] User information can be used to indicate the user of the client.

[0176] Upon receiving an "Enter Container" command for any given container, the interface service component can create a connection channel between the container and the client. Through this connection channel, at least one user command can be initiated to the container to execute at least one operation.

[0177] The host machine can run at least one container and one agent component. Each container can contain an audit entry point component.

[0178] For example, after establishing connection channel 1 between the client and container 1, the audit entry component in container 1 can send the process identifier PID1 corresponding to the audit entry component and the user information 1 corresponding to connection channel 1 to the agent component. The user information 1 may include the user identifier User01 and the user role as a developer.

[0179] S405. The proxy component generates corresponding session identifiers for the user information of each connection channel and sends the session information of each container to the kernel component.

[0180] After receiving the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component from the audit entry component, the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel, so as to record the user information through the session identifier.

[0181] The proxy component can generate container session information based on the session identifier and the process identifier corresponding to the audit entry component. The container's session information can include the process identifier corresponding to the audit entry component and the session identifier. This session information can be used to indicate the process and session identifier corresponding to the audit entry component within the container.

[0182] For example, if the user information 1 corresponding to connection channel 1 includes user identifier User01 and user role as developer, the proxy component can generate a corresponding session identifier S1 for user information 1. If the process identifier corresponding to the audit entry component in container 1 is PID1, the proxy component can determine that the session information corresponding to container 1 includes session identifier S1 and process identifier PID1. The proxy component can then send the session information corresponding to container 1 to the kernel component.

[0183] S406. Monitor at least one operation performed on a target container in at least one container through a connection channel in kernel mode using kernel components. For any operation, determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the agent component.

[0184] Kernel components can include eBPF programs. In kernel mode, kernel components can monitor at least one operation performed on a target container through eBPF programs.

[0185] For example, if there are two containers, the kernel component can obtain the session information of container 1 and the session information of container 2. The session information of container 1 may include session identifier S1 and process identifier PID1; the session information of container 2 may include session identifier S2 and process identifier PID2.

[0186] If the kernel component detects that operation 1 (i.e., deleting file 1) was executed in container 1 according to user command 1, and the process executing operation 1 is process PID3, which is a child process of process PID1, then the kernel component can determine that the session to which operation 1 belongs is S1 based on process PID3 and the two session information pieces obtained. The kernel component can determine that the operation information of operation 1 includes: session identifier S1, operation time 2024 / 10 / 29 13:00, user command 1 (i.e., "rm file1.txt"), and process identifier PID3 of the process executing operation 1.

[0187] S407. Determine the operation records of the target container and the user who performed the corresponding operation through the proxy component.

[0188] After receiving operation information for at least one operation from the kernel component, the proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information for at least one operation.

[0189] For example, if operation 1 is executed in container 1, the agent component receives operation information 1 for operation 1, which includes: session identifier S1, operation time 2024 / 10 / 29 13:00, user command 1 (i.e., "rm file1.txt"), and process identifier PID3 of the process executing operation 1. Based on the session identifier S1 in operation information 1, the agent component can determine that the user information corresponding to operation 1 is user information 1. If user information 1 is as shown in the example above, the agent component can determine that the user executing operation 1 is the user indicated by user identifier User01. The agent component can also determine that the operation record of container 1 includes operation 1 and the corresponding operation information 1 based on operation information 1.

[0190] In this embodiment, when the container operating system receives a container creation request initiated by the client, it can call the admission control component through the interface service component. The admission control component then adds an audit directory to the mount directory of the container to be created. Upon the container's first runtime after creation, an audit entry component can be placed in the container's audit directory through a proxy component. After the client establishes a connection channel with the container, the audit entry component running in the container can send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component. The proxy component generates corresponding session identifiers for the user information of each connection channel and sends the session information of each container to the kernel component. The kernel component can monitor at least one operation performed on a target container in at least one container through the connection channel in kernel mode. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information. The operation information corresponding to the operation is synchronized to the proxy component, thereby allowing the proxy component to determine the operation record of the target container and the user who performed the corresponding operation. On the one hand, since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the existing technology where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusiveness to user usage habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, so that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0191] Below, based on any of the above embodiments, combined with Figure 5 This section explains the container operation methods on the audit entry component side.

[0192] Figure 5 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 2 Please see. Figure 5 The method may include:

[0193] S501. After the client establishes a connection channel with the target container, send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component.

[0194] The host machine can include at least one container, and the target container can be any one of the at least one containers.

[0195] An audit entry component can be set up in the target container.

[0196] For example, after establishing connection channel 1 between the client and container 1, the audit entry component in container 1 can send the process identifier PID1 corresponding to the audit entry component and the user information 1 corresponding to connection channel 1 to the agent component. The user information 1 may include the user identifier User01 and the user role as a developer.

[0197] The proxy component can be used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The container's session information is used to indicate the process and session identifier corresponding to the audit entry component within the container.

[0198] For example, if there are two containers on the host machine, container 1 has a corresponding connection channel 1 and container 2 has a corresponding connection channel 2, then the proxy component can generate a corresponding session identifier S1 for user information 1 corresponding to connection channel 1, and a corresponding session identifier S2 for user information 2 corresponding to connection channel 2. The proxy component can send the session information 1 of container 1 and the session information 2 of container 2 to the kernel component. The session information 1 of container 1 can include the process identifier PID1 corresponding to the audit entry component in container 1 and the session identifier S1; the session information 2 of container 2 can include the process identifier PID2 corresponding to the audit entry component in container 2 and the session identifier S2.

[0199] For any given operation, the operation can be monitored in kernel space by kernel components. Kernel components can determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information of the operation with the agent component, so that the agent component can determine the operation record of the target container and the user who executed the corresponding operation.

[0200] Since the session identifier is generated by the proxy component for the user information corresponding to the connection channel, the kernel component can determine the session identifier to which each operation belongs. Therefore, the proxy component can determine the user information corresponding to each operation based on the session identifier, and thus determine the user who performs each operation.

[0201] For example, if a kernel component monitors 10 operations in kernel mode, as shown in Table 1, then for operation 1, the kernel component can determine the session identifier to which operation 1 belongs as S1 based on process 2 executing operation 1 and the obtained session information 1 and session information 2. Similarly, the kernel component can determine the session identifiers corresponding to operations 2, 3, ..., and 10, as shown in Table 1. The kernel component can synchronize the operation information corresponding to these 10 operations to the agent component, and the operation information includes the session identifier.

[0202] If the target container is container 1, and the session identifier S1 corresponds to user information 1, then the proxy component can determine that the operation record of container 1 can include 6 operations, namely operation 1, operation 2, operation 5, operation 7, operation 9, and operation 10, as well as the operation information corresponding to each of these 6 operations. If user information 1 is as shown in the example above, then the proxy component can determine that the user executing these 6 operations is the developer indicated by user identifier User01.

[0203] Similarly, if the target container is container 2, and session identifier S2 corresponds to user information 2, then the proxy component can determine that the operation record of container 2 may include four operations: operation 3, operation 4, operation 6, and operation 8, as well as the operation information corresponding to each of these four operations. If user information 2 includes user identifier User02 and the user role is tester, then the proxy component can determine that the user executing these four operations is the tester indicated by user identifier User02.

[0204] In this embodiment, the container may include an audit entry component. After the client establishes a connection channel with the target container, the audit entry component can send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component. Any operation performed on the target container through the connection channel can be monitored by the kernel component in kernel mode. The kernel component is used to determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. The proxy component is used to generate corresponding session identifiers for the user information corresponding to each connection channel and send the session information of each container to the kernel component. Since the audit entry component can send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component, the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel. In kernel mode, after the kernel component monitors any operation performed on the target container through the connection channel, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation. This achieves comprehensive auditing of any operation performed by the target container, without missing any operation. This ensures that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0205] Below, based on any of the above embodiments, combined with Figure 6 This section explains the container operation methods on the proxy component side.

[0206] Figure 6 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 3 Please see. Figure 6 The method may include:

[0207] S601. Generate corresponding session identifiers for the user information of each connection channel.

[0208] The host machine may include at least one container and one agent component.

[0209] For any container, a connection channel can be established between the container and the client. The connection channel can have corresponding user information, and the proxy component can generate a corresponding session identifier for the user information of the connection channel.

[0210] For example, if there are two containers in the host machine, container 1 has a corresponding connection channel 1 and container 2 has a corresponding connection channel 2, then the proxy component can generate a corresponding session identifier S1 for user information 1 corresponding to connection channel 1, and can generate a corresponding session identifier S2 for user information 2 corresponding to connection channel 2.

[0211] S602. Send the session information of each container to the kernel component so that the kernel component can monitor at least one operation performed on the target container in kernel mode. For any operation, determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the agent component so that the agent component can determine the operation record of the target container and the user who performed the corresponding operation.

[0212] Container session information can be used to indicate the process and session identifier corresponding to the audit entry component within the container. The container session information may include the process identifier and session identifier corresponding to the audit entry component within the container. The process identifier can be used to indicate the process corresponding to the audit entry component within the container.

[0213] For example, if there are two containers in the host machine, the agent component can send session information 1 of container 1 and session information 2 of container 2 to the kernel component. The session information 1 of container 1 may include the process ID PID1 and session ID S1 corresponding to the audit entry component in container 1; the session information 2 of container 2 may include the process ID PID2 and session ID S2 corresponding to the audit entry component in container 2.

[0214] The audit entry component can be used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container.

[0215] For example, after establishing connection channel 1 between the client and container 1, the audit entry component in container 1 can send the process identifier PID1 corresponding to the audit entry component and the user information 1 corresponding to connection channel 1 to the agent component. The user information 1 may include the user identifier User01 and the user role as a developer.

[0216] For any operation, the kernel component can determine the session identifier of the operation based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the agent component. For details of the specific execution process, please refer to the relevant content in step S406, which will not be repeated here.

[0217] In this embodiment, the host machine may include a proxy component. The proxy component can generate corresponding session identifiers for the user information of each connection channel and send the session information of each container to the kernel component. This allows the kernel component to monitor at least one operation performed on the target container in kernel mode. For any operation, the proxy component determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation with the proxy component. This enables the proxy component to determine the operation record of the target container and the user who performed the corresponding operation. The audit entry component can be used to send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. The user information is used to indicate the user of the client. Since the proxy component can generate corresponding session identifiers for user information corresponding to the connection channel, and the kernel component can associate any operation performed on the target container through the connection channel with the corresponding session identifier after monitoring any operation performed on the target container through the connection channel in the kernel space, the proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation. This achieves comprehensive auditing of any operation performed by the target container, without missing any operation, and makes it impossible for operations performed according to complex scripts to escape auditing, thus improving the comprehensiveness of auditing.

[0218] Below, based on any of the above embodiments, combined with Figure 7 This section explains the container operation methods on the kernel component side.

[0219] Figure 7 A flowchart illustrating a container operation method provided for an exemplary embodiment of this application. Figure 4 Please see. Figure 7 The method may include:

[0220] S701, Monitor in kernel mode at least one operation performed on the target container via the connection channel.

[0221] The host machine can include at least one container, and the target container can be any one of the at least one containers.

[0222] Through the connection channel, at least one user command can be sent to the target container. The container runtime component in the target container can perform at least one operation on the target container based on at least one user command.

[0223] For example, if the host machine can include container 1 and container 2, then for container 1, assuming the kernel component can monitor in kernel mode the 6 operations performed on container 1 through connection channel 1, which can be operation 1, operation 2, operation 5, operation 7, operation 9 and operation 10 in Table 1; for container 2, assuming the kernel component can monitor in kernel mode the 4 operations performed on container 2 through connection channel 2, which can be operation 3, operation 4, operation 6 and operation 8 in Table 1.

[0224] S702. For any operation, determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the proxy component so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation.

[0225] The proxy component can be used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. Among them, the container's session information is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0226] The audit entry component can be used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container.

[0227] Since the session identifier is generated by the proxy component for the user information corresponding to the connection channel, the kernel component can determine the session identifier to which each operation belongs. Therefore, the proxy component can determine the user information corresponding to each operation based on the session identifier, and thus determine the user executing each operation. The proxy component can then generate the operation record of the target container based on the operation information of each operation.

[0228] For example, if a kernel component monitors 10 operations in kernel mode, as shown in Table 1, then for operation 1, the kernel component can determine the session identifier to which operation 1 belongs as S1 based on process 2 executing operation 1 and the obtained session information 1 and session information 2. Similarly, the kernel component can determine the session identifiers corresponding to operation 2, operation 3, ..., operation 10, as shown in Table 1. The kernel component can determine the operation information corresponding to these 10 operations respectively and synchronize the operation information corresponding to these 10 operations to the agent component. The operation information may include the session identifier.

[0229] For example, if the target container is container 1 and the session identifier S1 corresponds to user information 1, then the proxy component can determine that the operation record of container 1 may include 6 operations, namely operation 1, operation 2, operation 5, operation 7, operation 9, and operation 10, as well as the operation information of these 6 operations. If user information 1 is as shown in the example above, then the proxy component can determine that the user executing these 6 operations is the developer indicated by user identifier User01.

[0230] Similarly, if the target container is container 2, and session identifier S2 corresponds to user information 2, then the proxy component can determine that the operation record of container 2 may include four operations: operation 3, operation 4, operation 6, and operation 8, as well as the operation information for these four operations. If user information 2 is as shown in the example above, then the proxy component can determine that the user performing these four operations is the tester indicated by user identifier User02.

[0231] In this embodiment, the host machine may include a kernel component. The kernel component can monitor at least one operation performed on the target container through the connection channel in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. The proxy component can be used to generate corresponding session identifiers for the user information corresponding to each connection channel and send the session information of each container to the kernel component. The audit entry component can be used to send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. Since the audit entry component can send the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component, the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel. In kernel mode, after the kernel component monitors any operation performed on the target container through the connection channel, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation. This achieves comprehensive auditing of any operation performed by the target container, without missing any operation. This ensures that operations performed according to complex scripts cannot escape auditing, thus improving the comprehensiveness of auditing.

[0232] Below, based on any of the above embodiments, combined with Figure 8 This section explains the container creation process.

[0233] Figure 8 This is a flowchart illustrating a container creation process provided for an exemplary embodiment of this application. Please refer to [link / reference]. Figure 8It includes client, interface service components, and access control components.

[0234] In step ①, the client can send a container creation request to the interface service component. The container creation request can include the mount directories of the containers to be created. For example, if the containers to be created are container 1 and container 2, the container creation request can include the mount directories of container 1 and container 2.

[0235] In step ②, after receiving the container creation request, the interface service component can call the admission control component.

[0236] In step ③, the admission control component can add an audit directory to the mount directory of the container to be created. The audit directory can be used to place the audit entry component. The audit entry component can be used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container.

[0237] For example, if the audit directory is the / audit-cmd / directory, and if the container creation request includes the mount directory of container 1 and the mount directory of container 2, then the admission control component can add the / audit-cmd / directory to the mount directory of container 1, and can add the / audit-cmd / directory to directory 2 of container 2.

[0238] In this embodiment, the client can send a container creation request to the interface service component, and the interface service component can respond to the container creation request by invoking the admission control component. The admission control component can add an audit directory to the mount directory of the container to be created, and the audit directory can be used to place the audit entry component. Adding an audit directory to the mount directory of the container to be created by the admission control component facilitates the subsequent placement of the audit entry component in the audit directory.

[0239] Below, based on any of the above embodiments, combined with Figure 9 The operation process of the container is explained.

[0240] Figure 9 This is a schematic flowchart illustrating a container operation as provided in an exemplary embodiment of this application. Please refer to [link / reference]. Figure 9 It includes client, interface service component, access control component, node proxy component, audit entry component, proxy component, container runtime component, and kernel component. Among them, the node proxy component, audit entry component, proxy component, container runtime component, and kernel component are located on the host machine.

[0241] In step ①, the client can send a command to the interface service component to enter the container for the target container.

[0242] In step ②, after receiving the entry command, the interface service component can create a connection channel between the target container and the client. The interface service component can also invoke the admission control component.

[0243] In step ③, the admission control component can replace the user command in the container entry command with the target command to obtain the updated container entry command. For example, if the container entry command 1 is "kubectl exec -it Pod1 -c container1 --sh", the admission control component can replace the user command "sh" in the container entry command 1 with the target command / audit-cmd / audit-entrypoint<user identifier User01>sh, thus obtaining the updated container entry command 1 as "kubectl exec -it Pod1 -c container1 -- / audit-cmd / audit-entrypoint<user identifier User01>sh".

[0244] In step ④, the interface service component can send an updated command to enter the container to the node proxy component.

[0245] In step ⑤, after the node agent component obtains the updated enter container command, it can determine the audit directory and audit entry component name in the updated enter container command, and then start the audit entry component in the target container according to the audit directory and audit entry component name, and execute the user command in the updated enter container command.

[0246] In step ⑥, the audit entry component can send the process identifier corresponding to the audit entry component and the user information corresponding to the connection channel of the target container to the agent component. The process identifier refers to the identifier of the process running the audit entry component. The user information can be determined in the updated container entry command.

[0247] In step ⑦, after receiving the process identifier and user information, the agent component can generate a session identifier and record user information through the session identifier.

[0248] In step ⑧, the proxy component can send session information to the kernel component. The session information may include a session identifier and a process identifier.

[0249] In step 9, the container runtime component can execute at least one user command initiated through the connection channel to perform at least one operation on the target container.

[0250] In step 10, the kernel component can monitor at least one operation and determine the session identifier corresponding to each operation.

[0251] Specifically, for any given operation, the kernel component can determine the parent process to which the process executing the operation belongs, and determine the process identifier of the parent process. Then, based on the process identifier of the parent process, it can determine the session identifier that matches the operation from the acquired session information.

[0252] In the steps In this process, the kernel component can determine the operation information corresponding to each operation and synchronize the operation information corresponding to each operation with the proxy component. The operation information may include a session identifier.

[0253] In the steps In the process, after the proxy component obtains the operation information corresponding to each operation, it can generate audit logs. The audit logs can include operation records of the target container and user information corresponding to each operation.

[0254] Specifically, the proxy component can determine the user information corresponding to each operation based on the session identifier in the operation information of each operation, and generate operation records based on the operation information corresponding to each operation.

[0255] In this embodiment, on the one hand, since the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in the kernel state, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the prior art where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusive auditing of user usage habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation audit, making it impossible for operations executed according to complex scripts to escape auditing, thus improving the comprehensiveness of auditing. It does not rely on Custom Resource Definition (CRD) technology to store additional information in the cluster, which can avoid the client launching a large number of kubectl queries in a short period of time. In scenarios involving the exec command, there may be risks to cluster stability and a sharp increase in component memory usage. Furthermore, the technical solution in this application supports customers in enabling auditing of operations in each container as needed. Auditing can be enabled for operations in a specific target container, which is flexible and controllable and can meet customers' auditing needs for operations within containers in different scenarios.

[0256] Below, in conjunction with Figure 10 The cluster described in any of the above embodiments will be explained.

[0257] Figure 10 This is a schematic diagram of a cluster provided for an exemplary embodiment of this application. Please refer to... Figure 10 The cluster can include an interface server and at least one host machine. For example, the at least one host machine can be host machine 1, host machine 2, ...

[0258] An interface server can include an interface service component. Clients and containers on the host machine can establish a connection channel through this interface service component.

[0259] For any given host machine, the host machine may include: an audit entry component, a proxy component, and a kernel component running in the container.

[0260] The audit entry component can be used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container.

[0261] The proxy component can be used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

[0262] The kernel component can be used to monitor at least one operation performed on the target container through the connection channel in kernel mode. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the agent component so that the agent component can determine the operation record for the target container and the user who performed the corresponding operation.

[0263] In this embodiment, the cluster may include an interface server and at least one host machine. The interface server may include an interface service component; the host machine may include an audit entry component, a proxy component, and a kernel component running in a container. On the one hand, since the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel, and after the kernel component monitors any operation performed on the target container through the connection channel in kernel mode, it can associate any operation with the corresponding session identifier. The proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus realizing comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the prior art where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusive auditing of user habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation, making it impossible for operations executed according to complex scripts to escape auditing, thereby improving the comprehensiveness of auditing.

[0264] Figure 11 A schematic diagram of another cluster provided for an exemplary embodiment of this application. Please refer to... Figure 11 ,exist Figure 10 Based on the illustrated embodiment, the cluster may further include a control server.

[0265] The control server may include an admission control component. This component can be used to add an audit directory to the mount directory of the container to be created.

[0266] In this embodiment, the cluster may include an interface server, a control server, and at least one host machine. The interface server may include an interface service component; the control server may include an admission control component; and the host machine may include an audit entry component, a proxy component, and a kernel component running in the container. On one hand, since the proxy component can generate a corresponding session identifier for the user information corresponding to the connection channel, and the kernel component can associate any operation performed on the target container through the connection channel with the corresponding session identifier after monitoring it in kernel mode, the proxy component can determine the operation record of the target container and the user who performed the corresponding operation based on the operation information corresponding to each operation, thus achieving comprehensive auditing of any operation performed by the target container. On the other hand, since the container operating system is located inside the cluster, compared with the prior art where users need to re-authenticate in an additional proxy system, users do not need to change their original usage habits and authentication methods, thus achieving non-intrusive auditing of user habits. Therefore, combining these two aspects, comprehensive auditing of at least one operation is achieved in a non-intrusive manner, without omitting any operation, making it impossible for operations performed according to complex scripts to escape auditing, thereby improving the comprehensiveness of auditing.

[0267] Figure 12 This is a schematic diagram of the structure of an electronic device provided for an exemplary embodiment of this application. Please refer to... Figure 12 The electronic device 10 may include a processor 11 and a memory 12. Exemplarily, the processor 11 and the memory 12 are interconnected via a bus 13.

[0268] The memory 12 stores computer-executed instructions;

[0269] The processor 11 executes the computer execution instructions stored in the memory 12, causing the processor 11 to perform the method as shown in the above method embodiment.

[0270] Figure 12 The electronic device shown in the embodiments can be the host machine, interface server, or control server described in any of the above embodiments.

[0271] Accordingly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in the above-described method embodiments.

[0272] Accordingly, embodiments of this application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the methods shown in the above-described method embodiments.

[0273] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0274] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0275] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0276] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0277] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0278] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0279] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0280] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0281] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A container operating system, characterized in that, The system is used to operate on at least one container in a host machine, the system comprising: An audit entry component running in the container is used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client; The proxy component is used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container. The kernel component is used to monitor in kernel mode at least one operation performed on the target container in the at least one container through the connection channel. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation.

2. The system according to claim 1, characterized in that, The system also includes: An interface service component is used to invoke the admission control component when a container creation request initiated by the client is received; wherein, the container creation request includes the mount directory of the container to be created; The access control component is used to add an audit directory to the mount directory of the container to be created; The proxy component is also used to place the audit entry component in the audit directory of the container when the container is first run after it is created.

3. The system according to claim 1, characterized in that, The system also includes: An interface service component is used to obtain the "enter container" command sent by the client for any container, and to create a connection channel between the container and the client based on the "enter container" command. An admission control component is used to update the entry container command to obtain an updated entry container command; The node proxy component is used to start the audit entry component in the corresponding container according to the updated container entry command.

4. The system according to claim 3, characterized in that, The command to enter the container includes a user command; the admission control component is specifically used for: The user command in the "Enter Container" command is replaced with the target command to obtain the updated "Enter Container" command. The target command includes a command for invoking the audit entry component and the user command, so that the node agent component starts the audit entry component in the corresponding container after obtaining the updated "Enter Container" command.

5. The system according to claim 4, characterized in that, The target command specifically includes: The audit directory, audit entry component name, and user command corresponding to the container; The audit directory is used to place the audit entry component, so that the node agent component can start the audit entry component in the corresponding container according to the audit directory and the audit entry component name.

6. The system according to any one of claims 1-5, characterized in that, The session information includes a session identifier and a process identifier corresponding to the audit entry component; The kernel component determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation with the proxy component, including: Determine the process ID of the parent process to which the process performing this operation belongs; Based on the process identifier corresponding to the parent process, a session identifier matching the operation is determined from the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component, the operation information including the session identifier matching the operation.

7. The system according to any one of claims 1-5, characterized in that, The proxy component is also used to: store the process identifier and user information corresponding to the audit entry component; Accordingly, the proxy component determines the operation records of the target container and the user who performed the corresponding operation, including: Based on the session identifier in the operation information of each operation synchronized by the kernel component, determine the user information corresponding to each operation; An audit log is generated based on the user information corresponding to each operation. The audit log includes operation records for the target container and user information corresponding to each operation.

8. A method for operating a container, characterized in that, Applied to a container operating system, wherein the container operating system includes an audit entry component, a proxy component, and a kernel component running in the container, the method includes: After the client establishes a connection channel with the container, the audit entry component running in the container sends the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component; wherein, the user information is used to indicate the user of the client; The proxy component generates corresponding session identifiers for the user information of each connection channel and sends the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container. The kernel component monitors in kernel mode at least one operation performed on a target container in at least one container through the connection channel. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component. The proxy component determines the operation records of the target container and the user who performed the corresponding operation.

9. The method according to claim 8, characterized in that, The system further includes an interface service component and an access control component; the method further includes: Upon receiving a container creation request initiated by the client, the access control component is invoked through the interface service component; wherein, the container creation request includes the mount directory of the container to be created; The access control component adds an audit directory to the mount directory of the container to be created. When the container is first run after it is created, the audit entry component is placed in the audit directory of the container through the proxy component.

10. A method for operating a container, characterized in that, Applied to the audit entry component, the method includes: After the client establishes a connection channel with the target container, it sends the user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component. The user information is used to indicate the user of the client. Any operation performed on the target container through the connection channel is monitored by the kernel component in kernel mode. The kernel component is used to determine the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronize the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation. The proxy component is used to generate corresponding session identifiers for user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container.

11. A method for operating a container, characterized in that, Applied to a proxy component, the method includes: Generate corresponding session identifiers for the user information of each connection channel; Session information of each container is sent to the kernel component so that the kernel component can monitor at least one operation performed on the target container in kernel mode. For any operation, the session identifier to which the operation belongs is determined based on the process executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the agent component so that the agent component can determine the operation record of the target container and the user who performed the corresponding operation. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container; The audit entry component is used to send user information corresponding to the connection channel and process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container. The user information is used to indicate the user of the client.

12. A method for operating a container, characterized in that, Applied to kernel components, the method includes: Monitor at least one operation performed on the target container via the connection channel in kernel mode; For any operation, the session identifier to which the operation belongs is determined based on the process of executing the operation and the obtained session information, and the operation information corresponding to the operation is synchronized to the proxy component so that the proxy component can determine the operation record of the target container and the user who performed the corresponding operation; The proxy component is used to generate corresponding session identifiers for the user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container. The audit entry component is used to send user information corresponding to the connection channel and process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client.

13. A cluster, characterized in that, include: An interface server and at least one host machine; The interface server includes an interface service component, through which a connection channel is established between the client and the container in the host machine. The host machine includes: An audit entry component running in the container is used to send user information corresponding to the connection channel and the process identifier corresponding to the audit entry component to the proxy component after the client establishes a connection channel with the container; wherein, the user information is used to indicate the user of the client; The proxy component is used to generate corresponding session identifiers for the user information corresponding to each connection channel, and send the session information of each container to the kernel component. The session information of the container is used to indicate the process and session identifier corresponding to the audit entry component in the container. A kernel component is used to monitor at least one operation performed on the target container through the connection channel in kernel mode. For any operation, it determines the session identifier to which the operation belongs based on the process executing the operation and the obtained session information, and synchronizes the operation information corresponding to the operation to the proxy component, so that the proxy component can determine the operation record for the target container and the user who performed the corresponding operation.

14. An electronic device, characterized in that, include: At least one processor; as well as A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, cause the electronic device to perform the method according to any one of claims 8-12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 8-12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 8-12.

Images