Network management method and system for container, and electronic device and storage medium

Abstract

Disclosed are a network management method and system for a container, and an electronic device and a storage medium. The network management method for a container comprises: creating a network bridge on a host machine, and carrying out network configuration on the network bridge; starting target containers on the host machine, wherein the target containers comprise a first container configured to realize mobile network-based dialing, a second container configured to realize interface interaction of Android applications, and a third container configured to realize interface interaction of instrument applications; respectively generating a corresponding container end virtual network interface card in each target container, and generating a corresponding network bridge end virtual network interface card for each container end virtual network interface card in the network bridge; using the first container to perform dialing to create a plurality of mobile network interface cards, and generating a strategy routing table, wherein the strategy routing table is used for describing a mapping relationship between a container and a mobile network interface card; and on the basis of the strategy routing table, routing to the respective mobile network interface cards data packets transmitted by the target containers via the network bridge.

Description

Network management method, system, electronic device and storage medium of container

[0001] REFERENCE TO RELATED APPLICATION

[0002] The present disclosure claims the full right of priority of the Chinese Invention Patent Application No. 202410625775.1, filed on May 20, 2024, and entitled “Network management method, system, electronic device and storage medium of container”, to the State Intellectual Property Office of the People’s Republic of China, and incorporates it by reference in its entirety.

[0003] TECHNICAL FIELD

[0004] The present disclosure generally relates to the technical field of container management, and more particularly to a network management method, system, electronic device and storage medium of container.

[0005] BACKGROUND

[0006] Container is a virtualization technology for resource isolation running on a host computer. Multiple containers can be run on a host computer, and each container can access a local area network or access the Internet through a mobile network card or a WLAN card. However, in the related art, there is no network isolation between containers, and the allocation of network resources cannot be achieved.

[0007] SUMMARY

[0008] In one aspect, the present disclosure provides a network management method of container, comprising:

[0009] creating a bridge on a host computer and performing network configuration on the bridge;

[0010] starting a target container on the host computer; wherein the target container comprises a first container configured to implement mobile network dialing, a second container configured to implement Android application interface interaction, and a third container configured to implement instrument application interface interaction;

[0011] generating a corresponding container-side virtual network card in each of the target containers, and generating a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge;

[0012] creating multiple mobile network cards using the first container dialing and generating a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card; and

[0013] routing the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

[0014] In some embodiments, the network management method of the container further comprises:

[0015] adding a first firewall rule for the first container, so that the first container adds a first mark in a data packet sent through a corresponding container-side virtual network card;

[0016] adding a second firewall rule for the second container, so that the second container adds a second mark in a data packet sent through a corresponding container-side virtual network card;

[0017] Correspondingly, using the first container to dial to create a plurality of mobile network cards, and generating a policy routing table, comprising:

[0018] using the first container to dial to create a first mobile network card and a second mobile network card; and

[0019] generating the policy routing table containing a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is a mapping relationship between the first mark and the first mobile network card, and the second mapping relationship is a mapping relationship between the second mark and the second mobile network card.

[0020] In some embodiments, according to the policy routing table, the data packet transmitted by the target container through the network bridge is routed to the corresponding mobile network card, comprising:

[0021] according to the policy routing table, the data packet transmitted by the first container through the network bridge is routed to the first mobile network card; and

[0022] according to the policy routing table, the data packet transmitted by the second container through the network bridge is routed to the second mobile network card.

[0023] In some embodiments, the network management method of the container further comprises:

[0024] querying the network namespace of the WLAN physical network card; and

[0025] adding the network namespace of the WLAN physical network card to the network namespace of the second container.

[0026] In some embodiments, the network management method of the container further comprises:

[0027] setting the default network type of the second container to Ethernet;

[0028] setting the dns address of the corresponding container-side virtual network card of the second container according to the configuration file; and

[0029] set the default gateway of the second container to the IP address of the bridge.

[0030] In some embodiments, the network management method of the container further comprises:

[0031] setting the default gateway of the first container to the IP address of the bridge;

[0032] Correspondingly, after creating multiple mobile network cards by dialing with the first container, the method further comprises:

[0033] setting the dns address used by the first container dialing operation to the dns address of the first container.

[0034] In some embodiments, a bridge is created on a host computer and network configuration is performed on the bridge, including:

[0035] the bridge is created on the host computer using a network bridging tool and a default IP address is configured for the bridge according to a configuration file.

[0036] In another aspect, the disclosure also provides a network management system of a container, which comprises:

[0037] a bridge creation module configured to create a bridge on a host computer and perform network configuration on the bridge;

[0038] a container starting module configured to start a target container on the host computer; wherein the target container comprises a first container configured to implement mobile network dialing, a second container configured to implement Android application interface interaction, and a third container configured to implement instrument application interface interaction;

[0039] a peer-to-peer network establishment module configured to generate a corresponding container-side virtual network card in each of the target containers and generate a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge;

[0040] a dialing module configured to create multiple mobile network cards by dialing with the first container and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card;

[0041] a data routing module configured to route the data packets transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

[0042] In yet another aspect, the disclosure also provides a storage medium having a computer program stored thereon, wherein the computer program is executed to implement the network management method of the container according to the disclosure.

[0043] In still another aspect, the present disclosure also provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor invokes the computer program in the memory to implement the network management method of the container.

[0044] In some embodiments, the network isolation mechanism is used to create a bridge on the host computer and perform network configuration; the bridge can forward data packets from different network interfaces, and each container has an independent network namespace, avoiding network interference and conflict between containers. In some embodiments, after starting the target container on the host computer, a corresponding container-side virtual network card is generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card is generated in the bridge; the above-mentioned setting mode of the virtual network card can ensure that each container can independently access the network and does not interfere with each other. In some embodiments, a plurality of mobile network cards are created by dialing the first container, and a policy routing table is generated; according to the policy routing table, the data packets transmitted by the target container through the bridge are routed to the corresponding mobile network card. In some embodiments, network isolation can be set for the container, and the network management capability of the container is improved.

[0045] BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present disclosure, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0047] FIG. 1 is a flowchart of the network management method of the container according to an embodiment of the present disclosure;

[0048] FIG. 2 is a structural diagram of the user space of the host computer in the related art;

[0049] FIG. 3 is a structural diagram of the user space of the host computer according to an embodiment of the present disclosure; and

[0050] FIG. 4 is a structural diagram of the network management system of the container according to an embodiment of the present disclosure.

[0051] DETAILED DESCRIPTION

[0052] To make the purposes, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some but not all of the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

[0053] Please refer to FIG. 1, which is a flow chart of a network management method of a container according to an embodiment of the present disclosure.

[0054] The specific steps can include:

[0055] S101: creating a bridge on a host computer and performing network configuration on the bridge;

[0056] S102: starting target containers on the host computer;

[0057] S103: generating a corresponding container-side virtual network card in each of the target containers, and generating a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge;

[0058] S104: creating a plurality of mobile network cards by using the first container dialing and generating a policy routing table; and

[0059] S105: routing data packets transmitted by the target containers through the bridge to the corresponding mobile network cards according to the policy routing table.

[0060] In some embodiments, the method can be applied to electronic devices such as smartphones, tablets, computers, etc., which can run containers and bridges as host computers. The bridge is a network device working at the data link layer, which can connect multiple different containers and enable them to communicate with each other. After creating the bridge, the bridge can be configured, such as setting up static routes, enabling IP forwarding, configuring firewall rules, etc. In some embodiments, the bridge can be created on the host computer using the network bridging tool brctl, and the bridge can be configured with a default IP address according to a configuration file.

[0061] In some embodiments, a target container can be started on the host machine by a specific command or tool. After the target container is started, the target container will run a specified application or service and interact with the host machine and other containers to achieve specific business logic or functional requirements. The target container includes a first container, a second container, and a third container. The first container is configured to implement mobile network dialing, the second container is configured to implement Android application interface interaction, and the third container is configured to implement instrument application interface interaction. The present embodiment does not limit the number of each of the above target containers.

[0062] In some embodiments, a virtual network card can be generated in the target container and the bridge to establish a peer-to-peer network. In some embodiments, a corresponding container-side virtual network card is generated in each of the target containers, and a corresponding bridge-side virtual network card is generated in the bridge for each container-side virtual network card, i.e., the number of bridge-side virtual network cards is the same as the number of target containers.

[0063] In some embodiments, the container-side virtual network card enables the container to communicate in the network, and the bridge-side virtual network card serves as an interface between the bridge and the container and is responsible for forwarding traffic between the container and the external network. In this way, the isolation and forwarding efficiency of the container network traffic are ensured, thereby improving the network performance and security of the entire system.

[0064] In some embodiments, the first container is a container configured to implement mobile network dialing, and a dialing application can exist in the first container to implement dialing functions. In some embodiments, the first container can be used to create multiple mobile network cards by dialing, and a policy routing table can also be generated to describe the mapping relationship between the container and the mobile network card. The above process uses the first container to create mobile network cards by dialing, and in combination with the mobile network card and the policy routing table, the container can flexibly access the mobile network.

[0065] In some embodiments, dialing operations can be performed through the first container to create multiple mobile network cards. These mobile network cards allow the target container to connect to the external mobile network to achieve access to the mobile network by the target container. The policy routing table is used to determine the mobile network card through which the data packet sent by each container should be forwarded.

[0066] In some embodiments, the target container can send data packets to the corresponding bridge-side virtual network card in the bridge through the container-side virtual network card. The host machine can route the data packets to the corresponding mobile network card based on the policy routing table to achieve access to the Internet. The above target container can also access the local area network through the bridge.

[0067] In some embodiments, a bridge is created on the host computer and configured for network; the bridge can forward data packets from different network interfaces, and each container can have an independent network namespace through the network isolation mechanism, avoiding network interference and conflict between containers. In some embodiments, after starting the target container on the host computer, a corresponding container-side virtual network card can be generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card can also be generated in the bridge; through the above setting mode of the virtual network card, each container can independently access the network and does not interfere with each other. In some embodiments, a plurality of mobile network cards are created by dialing the first container, and a policy routing table is generated; according to the policy routing table, the data packets transmitted by the target container through the bridge are routed to the corresponding mobile network card. In some embodiments, network isolation can be set for the container, improving the network management capability of the container.

[0068] As a further introduction to the embodiment corresponding to FIG. 1, after starting the target container, a corresponding firewall rule can be added to the target container. Through the above method, when the target container sends data packets through its corresponding container-side virtual network card, the firewall will automatically add preset markers to these data packets. These markers can be any information that can distinguish different containers or different network traffic.

[0069] In some embodiments, a first firewall rule can be added to the first container, so that the first container adds a first marker to the data packets sent through the corresponding container-side virtual network card. In some embodiments, a second firewall rule can also be added to the second container, so that the second container adds a second marker to the data packets sent through the corresponding container-side virtual network card.

[0070] In some embodiments, the first container can also be used to dial to create a first mobile network card and a second mobile network card; on this basis, the policy routing table containing a first mapping relationship and a second mapping relationship is generated; wherein the first mapping relationship is the mapping relationship between the first marker and the first mobile network card, and the second mapping relationship is the mapping relationship between the second marker and the second mobile network card. The routing table constructed in the above manner contains a plurality of mapping relationships, and each mapping relationship corresponds the previously added marker to a specific mobile network card.

[0071] On the basis of adding the first firewall rule and the second firewall rule and creating the first mobile network card and the second mobile network card, the data packets transmitted by the first container through the bridge can be routed to the first mobile network card according to the policy routing table; and the data packets transmitted by the second container through the bridge can also be routed to the second mobile network card according to the policy routing table.

[0072] In some embodiments, when the first container transmits data packets through the bridge, the bridge checks the marks in the data packets. After the bridge finds the first mobile network card corresponding to the mark by consulting the policy routing table, the data packets can be routed to the first mobile network card, so that the first container accesses the mobile network. When the second container transmits data packets through the bridge, the bridge checks the marks in the data packets. After the bridge finds the second mobile network card corresponding to the mark by consulting the policy routing table, the data packets can be routed to the second mobile network card, so that the second container accesses the mobile network. In this way, the correct forwarding and efficient management of the container network traffic can be ensured.

[0073] In some embodiments, the network namespace of the WLAN physical card can also be queried, and the network namespace of the WLAN physical card can be added to the network namespace of the second container. In this way, the second container can access the Internet through the WLAN physical card, and the containers (i.e., the first container and the third container) that do not have the WLAN physical card added to the network namespace cannot access the Internet through the WLAN physical card.

[0074] In some embodiments, the second container can also be configured in the following manner: the default network type of the second container is set to Ethernet; the dns address of the container-side virtual network card corresponding to the second container is set according to the configuration file; and the default gateway of the second container is set to the IP address of the bridge. In this way, the stability and efficiency of the second container in network communication can be ensured, so that the second container can interact smoothly with other containers or external networks to meet different business needs.

[0075] In some embodiments, the first container can also be configured in the following manner: the default gateway of the first container is set to the IP address of the bridge; and after a plurality of mobile network cards are created by dialing using the first container, the dns address used by the first container dialing operation is set to the dns address of the first container. In this way, the stability and efficiency of the first container in network communication can be ensured, so that the first container can interact smoothly with other containers or external networks.

[0076] The following describes the flow described in the above embodiment through a network management scheme of starting three containers on an Android in actual application.

[0077] Referring to FIG. 2, which is a structural diagram of a host user space in the related art, the host user space Host userspace includes a first container, a second container, and a third container. The first container runs an application tbox app for dialing. The second container runs an application Android app for interacting with an Android application interface. The third container runs an application cluster app for interacting with a cluster application interface. The first container can create mobile network cards apn1 and apn2. The second container can be connected with a WLAN physical network card. The three containers are started on an Android system. An Android startup part outside the containers is named a host. The first container is configured to implement a mobile network dialing function, also referred to as a tbox container. The second container is configured to implement an Android app ui interaction function, also referred to as an ivi container. The third container is configured to implement a cluster app ui interaction function, also referred to as a cluster container.

[0078] In the related scheme, after the tbox container is started, the tbox app performs dialing of two apns of a mobile network. After the ivi container is started, the Android app opens a WLAN network. The Host host and the three containers can use the two apn mobile networks. The Host host and the three containers can use the WLAN network. In the above scheme, the containers do not have a separate network namespace, and network isolation is not implemented. In the above scheme, there is no overall network management strategy, and the allocation of mobile network and WLAN network resources cannot be performed. A single container cannot be limited in network. A network namespace net namespace is an isolated environment that has a separate network stack (network card, routing forwarding table, iptables). The network namespace is used to isolate network devices and services.

[0079] To solve the defects in the above related art, the present disclosure provides a network management scheme based on starting three containers on an Android, which can implement network allocation and network limitation of multiple containers.

[0080] Referring to FIG. 3, which is a structural diagram of a host user space according to an embodiment of the present disclosure, the host user space Host userspace includes a first container, a second container, a third container, and a bridge bridge br0. The network namespace netns of the first container includes an application tbox app and an eth virtual network card (i.e., a container-side virtual network card). The network namespace netns of the second container includes an application Android app, an eth virtual network card, and a WLAN physical network card. The network namespace netns of the third container includes an application cluster app and an eth virtual network card. The bridge includes a bridge-side virtual network card tbox_peer corresponding to the eth virtual network card of the first container, a bridge-side virtual network card ivi_peer corresponding to the eth virtual network card of the second container, and a bridge-side virtual network card ic_peer corresponding to the eth virtual network card of the third container. The first container can create a mobile network card apn1 and a mobile network card apn2.

[0081] In some embodiments, the following operations A1-A4 can be performed in an Android startup configuration process.

[0082] Operation A1: Perform bridge configuration in the host.

[0083] Operation A2: Set the startup configuration of the container and add the virtual network card to the bridge.

[0084] Operation A3: Perform network configuration on the second container.

[0085] Operation A4: Perform network configuration on the first container.

[0086] In some embodiments, the operation can be performed before the startup of the first container, the second container, and the third container, using the init process of the host Host to configure and start the bridge br0 on the host using the network bridge tool brctl. The bridge br0 can also be configured with a default IP address, such as 192.168.0.0 / 24. The init process is the first process of the user space started by Android, and all user processes are hatched by the init process.

[0087] In some embodiments, the first container, the second container and the third container are started to generate a veth pair virtual network card (i.e. a container-side virtual network card) according to the configuration file, to create a peer-to-peer network, one end of which is assigned to the container, and the other end is connected to the bridge specified by lxc.network.link. The container-side virtual network card and the bridge-side virtual network card form a peer-to-peer network through the lxc.network.veth.pair option.

[0088] After the above operation A1 and operation A2 are executed, the local area network of the first container, the second container and the third container can be completed, and the IP address of different network namespaces can be obtained through the bridge.

[0089] In some embodiments, operation A3 can set the default network type of the second container to Ethernet, and does not need to separately set other information of the virtual network card by a command. This operation can also set the dns address (e.g. 8.8.8.8 or 114.114.114.114) of the eth virtual network card in the second container, so that the application program in the second container can access the Internet domain name. This operation can also switch the network namespace of the WLAN physical network card to the network namespace of the second container, so that the WLAN network is only used by the second container. This operation can also set the default gateway of the second container to the IP address of the bridge. This operation can also add a firewall rule in the second container, so that all data packets from the virtual network card interface of the second container are marked with a specific mark mark 02.

[0090] In some embodiments, operation A4 can set the default gateway of the first container to the IP address of the bridge, and can also add a firewall rule for the first container, so that all data packets from the virtual network card interface of the first container are marked with a specific mark mark 01.

[0091] In some embodiments, during the configuration process after starting the mobile network, the following operations B1-B2 can be performed:

[0092] Operation B1: network configuration of the first container; and

[0093] Operation B2: setting a policy routing table iptable mark in the host environment.

[0094] In some embodiments, the first container can create a mobile network card apn1 and a mobile network card apn2 using the tbox app dial-up. The operation can also set the DNS address used by the dial-up to the DNS address of the first container, for example: ip ro add ${DNS_IP} dev ${IFACE_NAME}.

[0095] In some embodiments, a policy routing table can be added in the host environment, and all data packets carrying MARK go through the created policy routing table. The above-mentioned policy routing table can send data packets carrying source marking MARK 02 from the mobile network card apn2, and also send data packets carrying source marking MARK 01 from the mobile network card apn1.

[0096] In some embodiments, the first container, the second container and the third container are all network isolated by starting separate network namespaces. The first container and the second container can access the local area network and the Internet through the veth virtual card and the bridge, and the third container can only access the local area network.

[0097] In some embodiments, the mobile network cards apn1 and apn2 are distinguished by the policy routing table, the mobile network card apn1 can only be used by the first container, and the mobile network card apn2 can only be used by the second container; the WLAN network can only be used by the second container and is invisible to the host environment and other containers. It can be seen that the present scheme is based on the principles of Android and container network namespace, relies on the veth virtual card and the bridge, and through the configuration of the policy routing table, the network of each container is independently distributed, and the network capabilities of each container and the host can also be controlled.

[0098] If the present scheme is used, the second container starts the WLAN network verification, which can achieve the following effects: the Android app in the second container can normally use the WLAN network to access the Internet; the WLAN physical card in the host environment is invisible and cannot access the Internet; the WLAN physical card in the third container is invisible and cannot access the Internet; the WLAN physical card in the first container is invisible and cannot access the Internet.

[0099] If the present scheme is used, the first container starts the mobile network verification, which can achieve the following effects: the first container can normally access the Internet; the second container can normally access the Internet; the host cannot access the Internet; the third container cannot access the Internet; the tcpdump test policy routing is normally effective, the second container uses the mobile network apn2, and the first container uses the mobile network card apn1.

[0100] If the solution is used, the third container network cannot access the local area network, the third container can access the second container virtual network card IP address and the first container virtual network card IP address, and the host cannot access the Internet in the scene of WLAN network and mobile network connection.

[0101] Referring to FIG. 4, FIG. 4 is a structural schematic diagram of a container network management system provided by an embodiment of the present disclosure;

[0102] The container network management system can include:

[0103] A bridge creation module 401 configured to create a bridge on a host and perform network configuration on the bridge;

[0104] A container starting module 402 configured to start a target container on the host; wherein the target container includes a first container configured to implement mobile network dialing, a second container configured to implement Android application interface interaction, and a third container configured to implement instrument application interface interaction;

[0105] A peer-to-peer network establishment module 403 configured to generate a corresponding container-side virtual network card in each of the target containers and generate a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge;

[0106] A dialing module 404 configured to create a plurality of mobile network cards by dialing using the first container and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card; and

[0107] A data routing module 405 configured to route the data packets transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

[0108] In some embodiments, a bridge is created on a host and network configuration is performed; the bridge can forward data packets from different network interfaces, and the above network isolation mechanism can enable each container to have an independent network namespace, avoiding network interference and conflict between containers. In some embodiments, after starting the target container on the host, a corresponding container-side virtual network card can be generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card can also be generated in the bridge, and the above virtual network card setting method can ensure that each container can independently access the network and does not interfere with each other. In some embodiments, a plurality of mobile network cards are created by dialing using the first container, and a policy routing table is generated, and the data packets transmitted by the target container through the bridge are routed to the corresponding mobile network card according to the policy routing table. Therefore, network isolation for containers can be set up, and the network management capability for containers can be improved.

[0109] In some embodiments, the network management system of the container further comprises:

[0110] a rule configuration module, configured to add a first firewall rule for the first container, so that the first container adds a first mark in a data packet sent through a corresponding container-side virtual network card; and configured to add a second firewall rule for the second container, so that the second container adds a second mark in a data packet sent through a corresponding container-side virtual network card;

[0111] Correspondingly, the dialing module 404 utilizes the first container to dial to create a plurality of mobile network cards and generates a policy routing table, including: utilizing the first container to dial to create a first mobile network card and a second mobile network card; and generating the policy routing table containing a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is a mapping relationship between the first mark and the first mobile network card, and the second mapping relationship is a mapping relationship between the second mark and the second mobile network card.

[0112] In some embodiments, the data routing module 405 routes a data packet transmitted by the target container through the bridge to a corresponding mobile network card according to the policy routing table, including: routing a data packet transmitted by the first container through the bridge to the first mobile network card according to the policy routing table; and routing a data packet transmitted by the second container through the bridge to the second mobile network card according to the policy routing table.

[0113] In some embodiments, the network management system of the container further comprises:

[0114] a WLAN management module, configured to query a network namespace of a WLAN physical network card; and configured to add the network namespace of the WLAN physical network card to a network namespace of the second container.

[0115] In some embodiments, the network management system of the container further comprises:

[0116] a second container configuration module, configured to set a default network type of the second container as Ethernet; and configured to set a dns address of a container-side virtual network card corresponding to the second container according to a configuration file; and configured to set a default gateway of the second container as an IP address of the bridge.

[0117] In some embodiments, the network management system of the container further comprises:

[0118] The first container configuration module is configured to set a default gateway of the first container as an IP address of the bridge, and is further configured to set a dns address used by the first container dial operation as a dns address of the first container after a plurality of mobile network cards are created by dialing the first container.

[0119] In some embodiments, the process of creating and network configuring the bridge by the bridge creation module 401 includes creating the bridge on the host computer using a network bridging tool and configuring a default IP address for the bridge according to a configuration file.

[0120] Since the embodiments of the system part correspond to the embodiments of the method part, the embodiments of the system part are described in the description of the embodiments of the method part, and are not described here.

[0121] The present disclosure also provides a storage medium having a computer program stored thereon, which, when executed, can implement the network management method of the container. The storage medium can include a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0122] The present disclosure also provides an electronic device, which can include a memory having a computer program stored therein and a processor, which, when invoked, can implement the network management method of the container. Of course, the electronic device can also include various network interfaces, power supplies and other components.

[0123] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts are described in the method part. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present disclosure, the present disclosure can be improved and modified, and these improvements and modifications also fall within the protection scope of the claims of the present disclosure.

[0124] It is further noted that the terminology "first", "second" and the like used in the specification are merely used for differentiating one entity or action from another, and do not necessarily imply any actual physical or logical relationship or order between such entities or actions. Moreover, the use of the term "including", "containing" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements is not required to comprise only those elements but can include other elements not expressly listed or inherent to such process, method, article or apparatus. An element proceeded by "comprises a... " does not, without further restriction, exclude the presence of additional elements of the same type in the process, method, article or apparatus that comprises the element.

Claims

1.A network management method of containers, comprising: creating a bridge on a host and configuring a network for the bridge; starting target containers on the host; wherein the target containers comprise a first container configured to implement mobile network dialing, a second container configured to implement Android application interface interaction, and a third container configured to implement instrument application interface interaction; generating a corresponding container-side virtual network card in each of the target containers, and generating a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge; creating a plurality of mobile network cards using the first container dialing and generating a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the containers and the mobile network cards; and routing data packets transmitted by the target containers through the bridge to corresponding mobile network cards according to the policy routing table. 2.The network management method of containers according to claim 1, further comprising: adding a first firewall rule to the first container, so that a first mark is added to data packets sent by the first container through the corresponding container-side virtual network card; adding a second firewall rule to the second container, so that a second mark is added to data packets sent by the second container through the corresponding container-side virtual network card; correspondingly, creating a plurality of mobile network cards using the first container dialing and generating a policy routing table, comprises: creating a first mobile network card and a second mobile network card using the first container dialing; and generating the policy routing table containing a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is the mapping relationship between the first mark and the first mobile network card, and the second mapping relationship is the mapping relationship between the second mark and the second mobile network card. 3.The network management method of containers according to claim 1 or 2, wherein routing data packets transmitted by the target containers through the bridge to corresponding mobile network cards according to the policy routing table, comprises: routing data packets transmitted by the first container through the bridge to the first mobile network card according to the policy routing table; and routing data packets transmitted by the second container through the bridge to the second mobile network card according to the policy routing table. 4.The network management method of containers according to any one of claims 1 to 3, further comprising: inquiring a network namespace of a WLAN physical network card; and adding the network namespace of the WLAN physical network card to a network namespace of the second container. 5.The network management method of containers according to any one of claims 1 to 4, further comprising: setting a default network type of the second container as Ethernet; setting a dns address of the container-side virtual network card corresponding to the second container according to a configuration file; and setting a default gateway of the second container as an IP address of the bridge. 6.The network management method of containers according to any one of claims 1 to 5, further comprising: setting a default gateway of the first container as the IP address of the bridge. ​ ​ Correspondingly, after creating multiple mobile network cards by dialing the first container, the method further comprises: setting the dns address used by the first container dialing operation as the dns address of the first container. 7.The network management method of the container according to any one of claims 1 to 6, wherein creating a bridge on a host computer and performing network configuration on the bridge comprises: creating the bridge on the host computer using a network bridging tool, and configuring a default IP address for the bridge according to a configuration file. 8.A network management system of a container, comprising: a bridge creation module configured to create a bridge on a host computer and perform network configuration on the bridge; a container starting module configured to start a target container on the host computer; wherein the target container comprises: a first container configured to implement mobile network dialing, a second container configured to implement Android application interface interaction, and a third container configured to implement instrument application interface interaction; a peer-to-peer network establishment module configured to generate a corresponding container-side virtual network card in each of the target containers, and generate a corresponding bridge-side virtual network card for each of the container-side virtual network cards in the bridge; a dialing module configured to dial to create multiple mobile network cards by using the first container, and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card; a data routing module configured to route data packets transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table. 9.An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor invokes the computer program in the memory to implement the network management method of the container according to any one of claims 1 to 7. 10.A storage medium, wherein the storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by a processor to implement the network management method of the container according to any one of claims 1 to 7. ​

Images