Container execution device, container update system, container update method, and container update program
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- MITSUBISHI ELECTRIC CORP
- Filing Date
- 2024-10-16
- Publication Date
- 2026-06-23
Smart Images
Figure 00000021_0000 
Figure 00000021_0001 
Figure 00000022_0000
Abstract
Description
Technical Field
[0001] The present disclosure relates to a container execution device, a container update system, a container update method, and a container update program.
Background Art
[0002] A software container is a type of virtualization technology. It is possible to separate the user space for each software container, and each software container contains all the software necessary for the execution of an application. An example of a software container is Docker. A software container is also simply referred to as a container. Also, a container image is a collection of files and meta-information necessary for the execution of a container. A container image is composed of multiple layers. A container image can be updated by adding a layer on top of the container image regardless of update contents such as addition, update, and deletion of files.
[0003] To update a container image, it is common to build (docker build in the case of Docker) on a device equipped with a build system based on a configuration file for creating an image that reflects the changes. A configuration file for creating an image is a design file of the container image (Dockerfile in the case of Docker).
[0004] Patent Document 1 discloses a technique for recording the contents changed from the original container image in a container operating in an execution environment. And a technique for making it possible to reflect the changes in the execution environment when updating the container image is disclosed.
Prior Art Documents
Patent Documents
[0005]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0006] In Patent Document 1, in order to obtain changes in the execution environment, methods such as logging in to the execution environment using ssh or the like and adding to the image (executing docker commit if it is Docker), or copying all the data in the application instance are mentioned. In the technology of Patent Document 1 like this, it is only possible to set either to capture all the changed contents in the container image in the execution environment or not to capture all of them. On the other hand, when applying a container to an environment with limited hardware resources such as an embedded device, it is desirable to make the size of the additional layer at the time of updating the container image as small as possible. Therefore, it is desirable to extract the minimum necessary update information when updating the container image.
[0007] An object of the present disclosure is to reduce the size of the additional layer at the time of updating the container image by extracting the minimum necessary update information.
Means for Solving the Problems
[0008] A container execution device according to the present disclosure is a container execution device that executes a software container using a container image. When a container start instruction, which is an instruction to start the software container, is received, a container image sharing unit that acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. The software container is executed using the container image, and based on the determination information, the update information is extracted when the software container is executed, and the extraction target determination unit that records the update information as a new layer in the new layer information. When an update instruction, which is an instruction to update the container image, is acquired, a new layer generation unit that updates the container image by adding a new layer to the container image based on the new layer information is provided.
Effect of the Invention
[0009] According to the container execution device according to the present disclosure, it is possible to extract the minimum necessary update information based on the determination information table, and there is an effect that the size of the additional layer at the time of updating the container image can be reduced.
Brief Description of the Drawings
[0010]
Figure 1
Figure 2
Figure 3
Figure 4
Figure 5
Figure 6
Figure 7
Figure 8
Figure 9
Figure 10
Figure 11
Figure 12
Figure 13
Figure 14
Figure 15
Embodiments for Carrying Out the Invention
[0011] Hereinafter, this embodiment will be described with reference to the drawings. In each drawing, the same or corresponding parts are denoted by the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.
[0012] Embodiment 1. ***Description of Configuration*** FIG. 1 is a diagram showing an overall configuration example of a container update system 500 according to this embodiment. FIG. 2 is a diagram showing a configuration example of the container registry server 10 according to this embodiment. FIG. 3 is a diagram showing a configuration example of the container management device 20 according to this embodiment. FIG. 4 is a diagram showing a configuration example of the container execution device 30 according to this embodiment.
[0013] The container update system 500 includes a container registry server 10, a container management device 20, and a plurality of container execution devices 30. The container registry server 10 and the container management device 20 can communicate with each other via, for example, the Internet. Each of the container management device 20 and the plurality of container execution devices 30 can communicate with each other via, for example, an intranet or a LAN such as a factory internal network. LAN is an abbreviation for Local Area Network. Note that FIG. 1 is an example, and the container registry server 10 may be arranged in the same local network as other devices. Also, the container execution device 30 may communicate with the container management device 20 via the Internet.
[0014] The plurality of container execution devices 30 are execution devices that each execute a software container using a container image. The container execution device 30 is also referred to as a container execution device. The container registry server 10 stores a container image 110 corresponding to each container execution device and a determination information table 113 corresponding to the container image 110. In the determination information table 113, determination information, which is information for determining update information when updating the container image 110, is set. The container management device 20 instructs the start and end of the container and manages the execution status of the container in each container execution device. Also, the update timing of the container image is managed. Note that in the following description, the software container may sometimes be simply referred to as a container.
[0015] The container registry server 10 is a computer. The container registry server 10 includes a processor 12, a storage device 11 composed of a memory or an auxiliary storage device, and a communication device 13. Also, although not shown, it may include hardware such as an input / output interface. The processor 12 is connected to other hardware via signal lines and controls these other hardware.
[0016] The container registry server 10 includes a storage unit 119 and a table registration unit 120 as functional elements. In the storage unit 119, as an example, container images A, B, C and determination information tables D, E, F corresponding to the respective container images are stored. The container image and the determination information table are a set. The number of this set is arbitrary and may be more. The container image can be executed by any container execution device. The table registration unit 120 registers each container image and the determination information table. For example, the user registers the determination information table corresponding to each container image in the container registry server 10 via the table registration unit 120.
[0017] The container management device 20 is a computer. The container management device 20 includes a processor 23, a storage device 21 composed of a memory or an auxiliary storage device, and a communication device 22. Further, although not shown, it may include hardware such as an input / output interface. The processor 23 is connected to other hardware via signal lines and controls these other hardware.
[0018] The container management device 20 includes, as functional elements, a storage unit 219, an image update instruction unit 230, and a container configuration management unit 231. The container startup status 210 is stored in the storage unit 219.
[0019] The container execution device 30 is a computer. The container execution device 30 includes a processor 33, a storage device 32 composed of a memory or an auxiliary storage device, and a communication device 31. Further, although not shown, it may include hardware such as an input / output interface. The processor 33 is connected to other hardware via signal lines and controls these other hardware.
[0020] The container execution device 30 includes, as functional elements, a storage unit 329, a container image sharing unit 330, a container startup management unit 331, an extraction target determination unit 332, a new layer generation unit 333, and a container execution environment 334. The storage unit 329 stores the container image 320 and the determination information table 321. Further, new layer information 322 corresponding to the container image 320 is stored. The container image 320, the determination information table 321, and the new layer information 322 form a set of three. There may be a plurality of such sets.
[0021] Hereinafter, the devices of the container registry server 10, the container management device 20, and the container execution device 30 may be referred to as the devices of the container update system 500. Further, the container management device 20 may have the same functions as the container execution device 30.
[0022] ***Explanation of Operations*** Next, the operations of the container update system 500 according to the present embodiment will be described. The operation procedure of the container update system 500 corresponds to the container update method. Further, a program that realizes the container update process, which is an operation of the container update system 500, corresponds to the container update program.
[0023] FIG. 5 is a flowchart showing an operation example of the container startup process in the container update system 500 according to the present embodiment. FIG. 5 shows the processing until the container is started in the container execution device 30 according to the present embodiment.
[0024] <Processing of the Container Management Device 20> In step S101, the container configuration management unit 231 is instructed by the user to update the container configuration using a configuration file or the like. This instruction refers to, for example, the application process of the manifest file to the Kubernetes Control Plane. Alternatively, a case where the container management device itself determines the necessity of updating the container configuration due to an increase or decrease in the load of the container or stopping the container is also conceivable. In step S102, the container configuration management unit 231 determines the container deployment destination based on the container information defined in the configuration file and the like. For example, in the case of Kubernetes, the deployment destination is determined from the amount of hardware resources required by each container and the total resources in the container execution device. In step S103, the container configuration management unit 231 sends a container start instruction for instructing the start of the container to the determined container execution device.
[0025] <Processing of Container Execution Device 30> In step S104, the container execution device 30 receives the container start instruction. In step S105, when the container start instruction is received, the container image sharing unit 330 executes a search process for updated container images.
[0026] FIG. 6 is a flowchart showing an operation example of the updated container image search process according to the present embodiment. In FIG. 6, when the container execution device 30 receives a container start instruction and starts the container, it shows an updated container image search process for searching whether the same container image has been updated. When the container image sharing unit 330 obtains a container start instruction which is an instruction for the container start management unit 331 to start a software container, it executes the following process. The container image sharing unit 330 obtains a container image and a determination information table in which determination information for determining update information when updating the container image is set. At this time, the container image sharing unit 330 inquires other container execution devices about the presence or absence of container image updates as follows, and searches for updated container images. The container image sharing unit 330 searches whether the container image instructed by the container startup instruction has been updated in other container execution devices. If it has been updated, the container image sharing unit 330 acquires the updated container image and the determination information table corresponding to the updated container image from other container execution devices. If it has not been updated, the container image sharing unit 330 acquires the container image instructed by the container startup instruction and the determination information table corresponding to the container image from the container registry server.
[0027] For example, the outline of the operation when the container startup management unit 331 of the container execution device - B receives a container startup instruction is as follows. The container startup management unit 331 of the container execution device - B requests the container image sharing unit 330 to confirm whether the instructed container image has not been updated within the system. The container image sharing unit 330 inquires about the update of the container image from other container execution devices. The container image sharing unit 330 of the container execution device - A receives this inquiry and checks the existence and update status of the specified container image. If it can be determined that the container image has been updated, it returns the updated container image and the determination information table. In the container execution device - B, the container is started using the updated container image received from the container execution device - A. Specifically, it is as follows.
[0028] <Process for instructing an inquiry about update status> In step S401, the container startup management unit 331 instructs the container image sharing unit 330 to inquire about the update status of the container image within the system. In step S402, the container image sharing unit 330 sends a message to inquire whether there is an update to the container image to other container execution devices in the system. This message includes the container image name and version.
[0029] <Processing when receiving an inquiry about the presence or absence of an update> In step S403, the container execution device 30 receives an inquiry about whether there is an update to the container image. Here, the container execution device 30 is a container execution device different from the container execution device that sent the message in step S402. In step S404, the container image sharing unit 330 checks whether there is a newer version of the container image managed within its own device than the version for which the inquiry was received.
[0030] If there is a newer version, that is, an updated container image (YES in step S405), the process proceeds to step S406. If there is no newer version, that is, an updated container image (NO in step S405), the process proceeds to step S407-2.
[0031] In step S406, the container image sharing unit 330 prepares for the deployment of the updated container image. Specifically, it archives the updated container image together with the determination information table. Also, the container image sharing unit 330 may convert the updated container image into a compressed file. For example, in the case of Docker, it is possible to convert the updated container image into a compressed file by docker save.
[0032] In step S407-1, the container image sharing unit 330 sends the archive file created in step S406 to the container execution device that made the inquiry, together with the information "There is an updated container image". In step S407-2, the container image sharing unit 330 transmits information of "no update" to the inquiry source.
[0033] <Processing when "there is an updated container image" is received> In step S408-1, the container image sharing unit 330 receives an archive file combining the updated container image created in step S406 and the determination information table with the information of "there is an updated container image". The container image sharing unit 330 restores the original file and converts the updated container image into an executable state. For example, in the case of Docker, the compressed file can be decompressed by docker load.
[0034] <Processing when "no update" is received> In step S408-2, the container image sharing unit 330 acquires the container image instructed by the container startup instruction from the container registry server and the determination information table corresponding to the container image. If direct access to the container registry server is not possible, a server may be installed inside the system and acquired from there. Or it may be acquired via the container management device.
[0035] Next, return to step S108 in FIG. 5 and continue the explanation.
[0036] In step S108, the container startup management unit 331 instructs the extraction target determination unit 332 to monitor the container. In step S109, the container startup management unit 331 generates a container from the container image acquired in step S105 and starts the execution process of the container.
[0037] FIG. 7 is a flowchart showing an operation example of the extraction target determination process in the container execution device 30 according to the present embodiment.
[0038] <Extraction target determination process> The extraction target determination unit 332 executes a software container using a container image, and extracts update information during the execution of the software container based on determination information. Then, the extraction target determination unit 332 records the update information as a new layer in the new layer information 322. For example, in the determination information table, an execution command executed by a software container is set as determination information. As described above, the determination information is information for determining update information when updating a container image. Therefore, the extraction target determination unit 332 determines the update information to be extracted based on the execution command that is the determination information, and extracts the update information during the execution of the container.
[0039] The extraction target determination unit 332 monitors whether an execution command is being executed during the execution of the software container. Then, the extraction target determination unit 332 extracts the update result by the execution command as update information. Specifically, it is as follows.
[0040] In step S201, the extraction target determination unit 332 reads the content of the determination information table and sets the execution command to be monitored. The extraction target determination unit 332 repeats the processing from step S203 to step S206 until the container to be monitored stops (step S202, step S207).
[0041] In step S203, the extraction target determination unit 332 waits until a command is executed inside the container. For example, the extraction target determination unit 332 monitors the execution of the command using the trace function of the OS. OS is an abbreviation for Operating System. In step S204, the extraction target determination unit 332 checks whether the executed command is the execution command set in step S201. In step S205, when the execution command to be monitored is executed, the extraction target determination unit 332 traces the processing content by that command. In step S206, the extraction target determination unit 332 saves, as update information, a file or an environment variable updated by the execution command of the monitoring target in the new layer information 322 as a result of tracing. At this time, the extraction target determination unit 332 saves the file in the new layer information 322 so that the directory configuration is the same as that in the container. In addition, as the update content by command execution, addition or deletion of a file or an environment variable is also included.
[0042] FIG. 8 is a diagram showing a configuration example of the determination information table 321 according to the present embodiment. In the determination information table 321, the content of the execution command to be monitored is set as the determination information 211. The extraction target determination unit 332 extracts, as update information 212, a file or an environment variable updated by the execution command defined in the determination information table 321. Then, the extraction target determination unit 332 adds the extracted update information 212 to the new layer information 322 as a new layer. The determination information table 321 needs to be registered in the container registry server 10 before the container is started.
[0043] In FIG. 8, the extraction target determination unit 332 refers to the determination information table 321 and monitors the execution content of the container. The extraction target determination unit 332 extracts " / dirB / file-C,file-D" updated by the process corresponding to the execution command name "app-B", the first argument "argB", and the second argument "argC" defined in the determination information table 321 as the update information 212. Then, the extraction target determination unit 332 adds the update information 212 to the new layer information 322.
[0044] FIG. 9 is a flowchart showing an operation example of the new layer generation process in the container execution device 30 according to the present embodiment.
[0045] <New layer generation process> When the new layer generation unit 333 receives a container update instruction, which is an instruction to update the container image, it adds a new layer to the container image based on the new layer information 322. As a result, the container image is updated.
[0046] The outline of the new layer generation process will be described. The new layer generation unit 333 receives an update instruction for the container image sent from the container management device 20. When the new layer generation unit 333 receives the update instruction, it creates a script to copy the set of file directories included in the new layer information 322 into the container. If the environment variables are also updated, the update process for the persistent environment variables is also defined. Subsequently, using the container image before the update, start the container for update. At this time, change the settings so that the above script is executed at startup. In the container for update, file copying and environment variable updates are performed from the new layer information 322 simultaneously with startup, and a state where only the desired information is updated can be constructed. The new layer generation unit 333 stops the container for update, updates the container image, and adds a new layer to the container image. After the update of the container image is completed, the new layer information 322, the container for update, and the script are deleted. Specifically, it is as follows.
[0047] In step S301, the image update instruction unit 230 of the container management device 20 sends an update instruction for the container image. The timing for sending the update instruction for the container image is, for example, when a change in the container configuration requires a change in the container execution device.
[0048] In step S302, the new layer generation unit 333 receives the update instruction. The new layer generation unit 333 starts a new layer generation process, which is a container image update process, triggered by the reception of the update instruction. Also, the update instruction includes information on whether to continue or stop the operation of the container.
[0049] In step S303, the new layer generation unit 333 creates a script to copy the set of file directories included in the new layer information 322 into the container. If the environment variables are also updated, the script is also added with the process of updating the permanent environment variables. In step S303a, the new layer generation unit 333 refers to the information on whether to continue or stop the operation of the container included in the update instruction. In the case of information to stop the operation of the container (YES in step S303a), in step S304, the new layer generation unit 333 stops the running container_original. In the case of information to continue the operation of the container (NO in step S303a), the process proceeds to step S305.
[0050] In step S305, the new layer generation unit 333 starts container_update using the container image before the update. At this time, the setting is changed so that the script created in step S303 is executed instead of the normal application when the container starts. For example, in the case of Docker, the cmd or entrypoint is overwritten. In step S306, since the new layer generation unit 333 has completed the generation of the container image including the desired update content in step S305, the new layer generation unit 333 stops container_update. In step S307, the new layer generation unit 333 reflects the operation result of container_update in the container image. For example, in the case of Docker, docker commit is executed for container_update. As a result, the updated container image is generated. In step S308, the new layer generation unit 333 deletes the temporary data for updating the container image. The temporary data deleted here is the new layer information 322, the script generated in step S303, and container_update.
[0051] The new layer generation unit 333 may overwrite the container image in the storage unit 329 with the updated container image. Alternatively, the new layer generation unit 333 may store the updated container image in the storage unit 329 separately from the original container image in the storage unit 329.
[0052] ***Other configurations*** <Modification Example 1> In the present embodiment, the mode in which the content of the execution command to be monitored is set as the determination information 211 in the determination information table 321 has been described. In Modification Example 1, the mode in which the execution interface executed by the software container is set as the determination information 211 in the determination information table 321 will be described. The extraction target determination unit 332 monitors whether the interface defined in the determination information table 321 is being executed during the execution of the software container, and extracts the update result by the execution interface as the update information 212.
[0053] FIG. 10 is a diagram showing a configuration example of the determination information table 321 according to Modification Example 1 of the present embodiment. In FIG. 10, the execution interface is an execution API. The execution interface is also called an execution function. API is an abbreviation for Application Programming Interface. The content of the execution interface rather than the execution command is set as the determination information 211 in the determination information table 321. For example, information such as the execution API name, the first argument, and the second argument is set in the determination information table 321. When the extraction target determination unit 332 determines the update information 212 that is the extraction target information based on the content of the execution interface, it monitors the behavior inside the application.
[0054] <Modification Example 2> In Modification Example 2, the mode in which files, directory names, or environment variables are set as the determination information 211 in the determination information table 321 will be described. When the software container is executed, the extraction target determination unit 332 monitors whether the file, directory, or environment variable that is the determination information 211 has been updated, and extracts the update result of the file, directory, or environment variable as the update information 212.
[0055] In this way, in the determination information table 321, instead of the execution command, the name of a file or directory may be defined. When identifying extraction target information based on the name of a file, directory, or environment variable, the extraction target determination unit 332 periodically monitors whether the target file, directory, and environment variable have been updated.
[0056] <Modification Example 3> In Modification Example 3, an aspect in which received data received by the software container is set as the determination information 211 in the determination information table 321 will be described. When the software container is executed, the extraction target determination unit 332 monitors whether received data has been received, and extracts the update result when the received data is received as the update information 212.
[0057] FIG. 11 is a diagram showing a configuration example of the determination information table 321 according to Modification Example 3 of the present embodiment. In the determination information table 321, instead of the execution command, received data may be defined. For example, information such as an input interface, interface name, received data name, data transmission source, and response application is set in the determination information table 321. When received data is defined, the extraction target determination unit 332 extracts the file and environment variables updated by the response process at the time of data reception as the update information 212 that is the extraction target information. When determining the extraction target information based on the received data, the extraction target determination unit 332 monitors the received data and the behavior inside the application.
[0058] <Modification Example 4> In the present embodiment, the update information 212 based on the determination information table 321 has been extracted as the new layer. In Modification Example 4, a mode in which the new layer generation unit 333 acquires an update file to be added to the container image together with an update instruction will be described. When the new layer generation unit 333 acquires an update file together with an update instruction, it integrates the update file into the new layer information 322, and updates the container image based on the new layer information 322 obtained by integrating the update file.
[0059] In this way, the new layer may include not only the extraction result based on the determination information table 321 but also an update file received from the outside. In this case, the image update instruction unit 230 transmits an update instruction for the container image and the update file to the new layer generation unit 333 together. The update file is, for example, information such as a file, a new version of an application, or material information. After merging the received update file into the new layer information, the new layer generation unit 333 starts the container_update. As a method of merging the received update file into the new layer information, it may be copied with a script. By integrating the update content inside the container and the update content from outside the device into one layer, the number of layers to be managed can be reduced.
[0060] <Modification Example 5> In the present embodiment, the container management device 20 transmits a container start instruction to the container execution device 30 while referring to the container start status 210. In Modification Example 5, a mode in which the new layer generation unit 333 updates the container image using a container start instruction for another container execution device as a trigger will be described. At this time, it is assumed that the container execution device 30 may receive a stop instruction for its own device.
[0061] The new layer generation unit 333 monitors container startup instructions for other container execution devices. When the new layer generation unit 333 detects a container startup instruction for another container execution device and receives a stop instruction for its own device, it stops container_original (step S304) and updates the container image based on the new layer information 322. On the other hand, when the new layer generation unit 333 detects a container startup instruction for another container execution device and does not receive a stop instruction for its own device, it updates the container image based on the new layer information without stopping container_original.
[0062] Thus, as a trigger for generating a container layer, it may be when the container management device newly sends a container startup instruction to a container execution device to be the container execution target. In this case, the new layer generation unit 333 of the container execution device needs to have a function of capturing a container startup instruction for another container execution device. For example, it may capture an adjacent container execution device and update the container image when a container startup instruction comes to the adjacent container execution device. Alternatively, even without a function of capturing a startup instruction, it may inquire whether another container execution device has received a container startup instruction and update the container image when another container execution device has received a container startup instruction.
[0063] <Modification Example 6> In this embodiment, by generating a script for adding new layer information to the container image, the new layer information is reflected in the container image. In Modification Example 6, the new layer generation unit 333 may generate an updated container image by incorporating the new layer information into a software container for update and executing a container image update process on the software container for update. In Modification Example 6, the new layer generation unit 333 may add a command for importing new layer information to the image creation setting file, and generate an updated container image by generating a container image based on the image creation setting file. The image creation setting file is a file in which the setting contents for generating a container image are defined. For example, in the case of Docker, it is a Dockerfile.
[0064] Thus, as a method for updating a container layer, the image creation setting file may be updated. When updating the image creation setting file, a process of copying the entire set of files and directories included in the new layer information is added. In order to be self - contained within the container execution device, a build function is required. When building with a device outside the system, the image creation setting file and the new layer information are uploaded to the container build device.
[0065] ***Explanation of the Effects of this Embodiment*** As described above, in the container update system 500 according to this embodiment, only the processing execution result based on the conditions defined in the determination information table can be extracted as update information. Therefore, according to the container update system 500 according to this embodiment, there is an effect that it is possible to determine whether or not to reflect the change content of the container image under more detailed conditions such as file units.
[0066] Also, in the container update system 500 according to this embodiment, by importing the filtering result of the execution process into the update - target container, the container image can be updated even at the deployment destination. Therefore, according to the container update system 500 according to this embodiment, there is an effect that only the necessary update information can be extracted and the container image can be updated by the container execution device itself.
[0067] In the container update system 500 according to this embodiment, by inquiring whether there is an update to the container image between container execution devices, updated container images can be shared. Therefore, according to the container update system 500 according to this embodiment, there is an effect that updated container images can be shared between container execution devices without going through another device.
[0068] Embodiment 2. In this embodiment, mainly, the points different from Embodiment 1 and the points added to Embodiment 1 will be described. In this embodiment, components having the same functions as those in Embodiment 1 are denoted by the same reference numerals, and their descriptions are omitted.
[0069] ***Description of the configuration*** FIG. 12 is a diagram showing a configuration example of the container execution device 30 according to this embodiment. In this embodiment, in addition to the configuration of Embodiment 1, a new layer integration unit 337 is provided. Regarding other configurations, they are the same as those in Embodiment 1.
[0070] The new layer integration unit 337 inquires whether other container execution devices have new layer information corresponding to the container image. If other container execution devices have new layer information corresponding to the container image, the new layer integration unit 337 acquires the new layer information corresponding to the container image as the new layer information of other container execution devices. Then, the new layer integration unit 337 integrates the new layer information of other container execution devices into the new layer information of its own device.
[0071] ***Description of the operation***
[0072] In Embodiment 1, the description was made on the premise that the same container is executed by one container execution device 30. In this embodiment, when the same container is executed by a plurality of container execution devices 30, the mode of merging the new layer information of the plurality of container execution devices 30 will be described.
[0073] The outline of the functions of the container update system 500 according to this embodiment will be described. Similar to Embodiment 1, in each container execution device, new layer information 322 is generated based on the determination information table 321. When receiving an update instruction from the container management device 20, the new layer generation unit 333 requests the new layer integration unit 337 to send a confirmation message for whether to merge the new layer information. At this time, the container management device 20 determines which container execution device will perform the merge so that confirmation messages are not sent simultaneously from multiple container execution devices. Then, the container management device 20 sends an update instruction only to the container execution device to be merged. Examples of the determination method in the container management device 20 include determining based on the hardware performance of the machine or the free capacity of the storage. Also, similar to Modification Example 5 of Embodiment 1, instead of directly instructing the update of the container image, it may be indirectly determined by monitoring the container startup instruction for other container execution devices. In this case, the container management device 20 instructs the container execution device to monitor the container startup instruction in advance.
[0074] When receiving a request to send a confirmation message for whether to merge, the new layer integration unit 337 checks with other container execution devices in the system whether there is new layer information for the target container image. If new layer information is stored in other container execution devices, the new layer information is returned. In the new layer integration unit 337 that is the request source, the new layer information acquired from other container execution devices is merged into the new layer information of its own device. Specifically, it is as follows.
[0075] FIG. 13 is a flowchart showing an operation example of the new layer integration process according to this embodiment.
[0076] <Confirmation Message Sending Process> In step S501, the new layer generation unit 333 instructs the new layer integration unit 337 to merge the new information layer. In step S502, the new layer integration unit 337 sends a confirmation message to inquire about the presence or absence of new layer information to other container execution devices in the system. The confirmation message includes the container image name and version.
[0077] <Processing at the time of receiving the confirmation message> In step S503, the new layer integration unit 337 receives the confirmation message. Note that the processing from step S503 to step S507 is the processing in the container execution device that received the confirmation message. In step S504, the new layer integration unit 337 checks whether there is new layer information corresponding to the version inquired about among the new layer information managed within its own device.
[0078] If there is new layer information corresponding to the version inquired about (YES in step S505), the process proceeds to step S506. If there is no new layer information corresponding to the version inquired about (NO in step S505), the process proceeds to step S507-2.
[0079] In step S506, the new layer integration unit 337 executes the preparation for deploying the new layer information corresponding to the version inquired about. For example, the new layer integration unit 337 converts the new layer information into a compressed file. In step S507-1, the new layer integration unit 337 sends the compressed file created in step S506 together with the information "There is new layer information" to the inquirer. In step S507-2, the new layer integration unit 337 sends the information "There is no new layer information" to the inquirer.
[0080] <Processing at the time of receiving the confirmation message> In step S508, the new layer integration unit 337 receives the information "with new layer information" and the compressed file created in step S506. Note that the processing from step S508 to step S509 is the processing in the container execution device that sent the confirmation message. In step S509, the new layer integration unit 337 expands and merges the "new layer information" received from other devices into the "new layer information" within its own device. When a conflict occurs, the new layer information received from other devices is prioritized. If the content of its own device is to be prioritized, the received "new layer information" is expanded to another location, and only the information not included in the "new layer information" of its own device is merged.
[0081] ***Explanation of the effects of this embodiment*** As described above, in the container update system 500 according to this embodiment, only the update information that matches the conditions defined in the determination information table is extracted in each container execution device, and new layer information is created. Then, when the container image is updated, the new layer information of each container execution device is aggregated. As a result, even if there are multiple running containers, it is possible to determine whether to reflect. Therefore, according to the container update system 500 according to this embodiment, there is an effect that it is possible to determine whether to reflect based on more detailed conditions such as file units for the changed contents in multiple instances based on the same container image.
[0082] ***Explanation of a hardware configuration example*** FIG. 14 is a diagram showing a hardware configuration example of each device of the container update system 500 according to this embodiment.
[0083] Each device of the container update system 500 is a computer. Each device of the container update system 500 includes a processor 910 and other hardware such as a memory 921, an auxiliary storage device 922, an input / output interface 930, and a communication device 950. The processor 910 is connected to the other hardware via a signal line 80 and controls these other hardware. The processor 910 is an example of processors 12, 23, 33. The communication device 950 is an example of communication devices 13, 22, 31. The memory 921 or the auxiliary storage device 922 is an example of storage devices 11, 21, 32.
[0084] The functions of each device of the container update system 500 are realized by software. The processor 910 is a device that executes a container update program. The container update program is a program that realizes the functions of each device of the container update system 500. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.
[0085] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM or DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device for storing data. A specific example of the auxiliary storage device 922 is an HDD. Also, the auxiliary storage device 922 may be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, or DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.
[0086] The input / output interface 930 is an interface for connecting input / output devices. As a specific example, the input / output interface 930 is a port for USB or HDMI (registered trademark). USB is an abbreviation for Universal Serial Bus. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface.
[0087] The communication device 950 is an interface for communicating with external devices. As a specific example, the communication device 950 is a port for Ethernet (registered trademark) or a device for performing wireless communication.
[0088] The container update program is executed in each device of the container update system 500. The container update program is loaded into the processor 910 and executed by the processor 910. The memory 921 stores not only the container update program but also the OS. The processor 910 executes the container update program while executing the OS. The container update program and the OS may be stored in the auxiliary storage device 922. The container update program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that part or all of the container update program may be incorporated into the OS.
[0089] Each device of the container update system 500 may include a plurality of processors that replace the processor 910. These multiple processors share the execution of the container update program. Each processor is a device that executes the container update program, just like the processor 910.
[0090] Data, information, signal values, and variable values used, processed, or output by the container update program are stored in the memory 921, auxiliary storage device 922, or registers or cache memory within the processor 910.
[0091] The "part" of each part of each device of the container update system 500 may be read as "circuit", "step", "procedure", "process", or "circuitry". The container update program causes a computer to execute each process in which the "part" of each part of each device of the container update system 500 is read as "process". The "process" of each process of each device of the container update system 500 may be read as "program", "program product", "computer-readable storage medium storing the program", or "computer-readable recording medium recording the program". Also, the container update method is a method performed when each device of the container update system 500 executes the container update program. The container update program may be stored and provided in a computer-readable recording medium. Also, the container update program may be provided as a program product.
[0092] ***Other configurations*** <Modification Example 7> In this embodiment, the functions of each part of each device of the container update system 500 are realized by software. As a modification, the functions of each part of each device of the container update system 500 may be realized by hardware. Specifically, each device of the container update system 500 includes an electronic circuit 909 instead of the processor 910.
[0093] FIG. 15 is a diagram showing a hardware configuration example of each device of the container update system 500 according to Modification Example 7 of the present embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of each part of each device of the container update system 500. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.
[0094] The functions of each part of each device of the container update system 500 may be realized by one electronic circuit, or may be distributed and realized by a plurality of electronic circuits.
[0095] As another modification example, some functions of each part of each device of the container update system 500 may be realized by an electronic circuit, and the remaining functions may be realized by software. Also, some or all of the functions of each part of each device of the container update system 500 may be realized by firmware.
[0096] Each of the processor and the electronic circuit is also called a processing circuit. That is, the functions of each part of each device of the container update system 500 are realized by the processing circuit.
[0097] In the above Embodiments 1 and 2, each part of each device of the container update system 500 has been described as an independent functional block. However, the configuration of each device of the container update system 500 does not have to be the configuration as in the above-described embodiments. The functional blocks of each device of the container update system 500 may have any configuration as long as they can realize the functions described in the above-described embodiments. Also, each device of the container update system 500 may be a system composed of a plurality of devices instead of a single device. Moreover, in Embodiments 1 and 2, a plurality of parts may be combined and implemented, or alternatively, one part of these embodiments may be implemented. Additionally, these embodiments may be combined and implemented in any way, either as a whole or partially. That is, in Embodiments 1 and 2, free combinations of each embodiment, modifications of any constituent elements of each embodiment, or omissions of any constituent elements in each embodiment are possible.
[0098] Note that the above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of the applications of the present disclosure, or the scope of the uses of the present disclosure. The above-described embodiments can be variously modified as necessary. For example, the procedures described using flowcharts or sequence diagrams may be modified as appropriate.
Explanation of Reference Numerals
[0099] 10 Container registry server, 20 Container management device, 30 Container execution device, 11, 21, 32 Storage device, 12, 23, 33 Processor, 13, 22, 31 Communication device, 80 Signal line, 110, 320 Container image, 113, 321 Determination information table, 211 Determination information, 212 Update information, 119, 219, 329 Storage unit, 120 Table registration unit, 210 Container startup status, 230 Image update instruction unit, 231 Container configuration management unit, 322 New layer information, 330 Container image sharing unit, 331 Container startup management unit, 332 Extraction target determination unit, 333 New layer generation unit, 334 Container execution environment, 335 Container_original, 336 Container_update, 337 New layer integration unit, 500 Container update system, 909 Electronic circuit, 910 Processor, 921 Memory, 922 Auxiliary storage device, 930 Input / output interface, 950 Communication device.
Claims
1. In a container execution device that runs software containers using container images, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The container execution device is A container update system comprising multiple container execution devices and a container management device used in each of the multiple container execution devices for managing the startup and shutdown of containers and the updating of container images is provided, A container execution device comprising a new layer integration unit that queries other container execution devices for the existence of new layer information corresponding to the container image, and if the other container execution device has new layer information corresponding to the container image, acquires the new layer information corresponding to the container image as new layer information of the other container execution device, and integrates the new layer information of the other container execution device into the new layer information.
2. The new layer generation unit is: The container execution device according to claim 1, which generates an updated container image by incorporating the new layer information into an update software container and performing an update process on the update software container.
3. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned determination information table contains execution commands to be executed by the software container as the determination information. The extraction target determination unit is, A container execution device that monitors whether the execution command is being executed when the software container is being run, and extracts the update results from the execution command as update information.
4. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned determination information table contains, as determination information, the execution interface to be executed by the software container. The extraction target determination unit is, A container execution device that monitors whether the execution interface is running when the software container is executed, and extracts the update results from the execution interface as update information.
5. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned determination information table contains the names of files, directories, or environment variables as the determination information. The extraction target determination unit is, A container execution device that monitors whether the files, directories, or environment variables have been updated during the execution of the software container, and extracts the update results of the files, directories, or environment variables as update information.
6. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned determination information table contains the received data received by the software container as the determination information. The extraction target determination unit is, A container execution device that monitors whether the received data is received when the software container is executed, and extracts the update result when the received data is received as the update information.
7. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned new layer generation unit is: A container execution device that, upon obtaining an update file to be added to the container image along with the update instruction, integrates the update file into the new layer information and updates the container image based on the new layer information obtained by integrating the update file.
8. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The container execution device is A container update system comprising multiple container execution devices and a container management device used in each of the multiple container execution devices for managing the startup and shutdown of containers and the updating of container images is provided, The aforementioned new layer generation unit is: A container execution device that monitors container startup instructions to other container execution devices and, when it detects a container startup instruction corresponding to the container image, updates the container image based on the new layer information.
9. A container execution device that executes a software container using a container image, When a container startup command, which is an instruction to start the software container, is received, the container image sharing unit acquires the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set. An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction is received, which is an instruction to update the container image, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. Equipped with, The aforementioned new layer generation unit is: A container execution device that generates an updated container image by adding a command to incorporate the new layer information to an image creation configuration file that defines the settings for generating the aforementioned container image, and generating the container image based on the image creation configuration file.
10. The container update system is, The container registry server includes the container image and the determination information table, The container image sharing unit is, The container execution device according to claim 1, which searches whether the container image specified by the container startup instruction has been updated on another container execution device, and if it has been updated, obtains the updated container image and the determination information table corresponding to the updated container image from the other container execution device, and if it has not been updated, obtains the container image specified by the container startup instruction and the determination information table corresponding to the container image from the container registry server.
11. Multiple container execution devices, each running a software container using a container image, A container registry server that stores the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, A container management device manages the startup and shutdown of containers and the updating of container images for each of the aforementioned plurality of container execution devices. Equipped with, Each of the aforementioned plurality of container execution devices is When a container startup instruction, which is an instruction to start the software container, is transmitted from the container management device, the container image sharing unit acquires the container image and the determination information table, An extraction target determination unit executes the software container using the container image, and based on the determination information, extracts the update information when the software container is executed and records the update information as a new layer in the new layer information, When an update instruction, which is an instruction to update the container image, is received from the container management device, a new layer generation unit updates the container image by adding a new layer to the container image based on the new layer information. A new layer integration unit queries other container execution devices to determine whether new layer information corresponding to the container image exists, and if the other container execution device has new layer information corresponding to the container image, it acquires the new layer information corresponding to the container image as the new layer information of the other container execution device and integrates the new layer information of the other container execution device into the new layer information. A container update system equipped with the following features.
12. A container update method used in a container update system comprising: a plurality of container execution devices, each executing a software container using a container image; a container registry server that stores the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set; and a container management device that manages the startup and shutdown of containers and the updating of container images for each of the plurality of container execution devices, When the computer receives a container startup instruction from the container management device, which is an instruction to start the software container, it acquires the container image and the determination information table. The computer executes the software container using the container image, and based on the determination information, extracts the update information during the execution of the software container, and records the update information as a new layer in the new layer information. When the computer receives an update instruction from the container management device, which is an instruction to update the container image, it updates the container image by adding a new layer to the container image based on the new layer information. A container update method comprising: a computer querying another container execution device for the existence of new layer information corresponding to the container image; if the other container execution device has new layer information corresponding to the container image, acquiring the new layer information corresponding to the container image as the new layer information of the other container execution device; and integrating the new layer information of the other container execution device into the new layer information.
13. A container update program used in a container update system comprising: a plurality of container execution devices, each executing a software container using a container image; a container registry server that stores the container image and a determination information table in which determination information, which is information for determining update information when updating the container image, is set; and a container management device that manages the startup and shutdown of containers and the updating of container images for each of the plurality of container execution devices, When a container startup instruction, which is an instruction to start the software container, is transmitted from the container management device, a container image sharing process is performed to acquire the container image and the determination information table. The software container is executed using the container image, and based on the determination information, the update information is extracted during the execution of the software container, and the update information is recorded as a new layer in the new layer information, which is an extraction target determination process. When an update instruction, which is an instruction to update the container image, is received from the container management device, a new layer generation process is performed to update the container image by adding a new layer to the container image based on the new layer information. A new layer integration process is performed to query other container execution devices for the existence of new layer information corresponding to the container image, and if the other container execution device has new layer information corresponding to the container image, to obtain the new layer information corresponding to the container image as the new layer information of the other container execution device, and to integrate the new layer information of the other container execution device into the new layer information. A container update program that causes a computer to run.