GPU-based user container processing method and apparatus, and device and medium

Abstract

The embodiments of the present disclosure relate to the field of data processing. Provided are a GPU-based user container processing method and apparatus, and a device and a medium. The method comprises: first, on the basis of a task to be executed that requires GPU usage, allocating a GPU to a secure container in a pass-through mode; then, on the basis of said task, creating in the secure container a GPU node corresponding to the GPU, and mounting the GPU node and a GPU user-mode driver library to a target user container corresponding to said task; and finally, by means of the GPU node and the GPU user-mode driver library that are mounted in the target user container, executing said task in the target user container, and generating an execution result, wherein the secure container is used for running user containers, and runs on a host machine corresponding to the GPU. The present technical solution improves the efficiency and accuracy of a configuration process, thereby effectively reducing labor costs and lowering the requirements for the professional expertise of tenants.

Description

GPU-based user container processing method, device, equipment and medium

[0001] The present disclosure claims priority to Chinese Patent Application No. 202410888850.3, filed on July 4, 2024 with the Chinese Patent Office, entitled "GPU-based user container processing method, device, equipment and medium", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the field of computer technology, and particularly relates to a GPU-based user container processing method, device, equipment and medium. BACKGROUND

[0003] At present, the calculation of current machine learning or deep learning algorithms is mainly based on the computing power provided by a graphic processing unit (GPU). A machine learning platform provided by a cloud vendor provides a set of services for data storage, data cleaning, model development and deployment based on a GPU computing cluster for users.

[0004] However, when a user uses the services of the machine learning platform, the user needs to manually configure related GPU resources, which is low in efficiency and accuracy and high in labor cost. SUMMARY

[0005] The application provides a GPU-based user container processing method, device, equipment and medium to solve the problems of low efficiency and accuracy and high labor cost in the manual configuration process.

[0006] In a first aspect, the present disclosure provides a GPU-based user container processing method, comprising:

[0007] allocating a GPU to a secure container in a pass-through manner according to a to-be-executed task that needs to use the GPU, the secure container being used to run a user container, and the secure container running on a host corresponding to the GPU;

[0008] creating a GPU node corresponding to the GPU in the secure container according to the to-be-executed task;

[0009] mounting the GPU node and a GPU user mode driver library to a target user container corresponding to the to-be-executed task;

[0010] executing the to-be-executed task in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generating an execution result.

[0011] In a possible implementation, the creating, according to the to-be-executed task, of the GPU node corresponding to the GPU in the secure container comprises:

[0012] determining, according to the to-be-executed task, a target kernel mode driver of the GPU;

[0013] loading the target kernel mode driver into a virtual machine kernel of the secure container;

[0014] creating, according to the target kernel mode driver, the GPU node in the secure container.

[0015] In a possible implementation, the determining, according to the to-be-executed task, of the target kernel mode driver of the GPU comprises:

[0016] determining an identifier and a version number of the target kernel mode driver carried in the to-be-executed task;

[0017] obtaining, according to the identifier and the version number, a target kernel mode driver corresponding to the identifier and the version number from a kernel mode driver library.

[0018] In a possible implementation, the GPU user mode driver library comprises a GPU query program, a dynamic library, and a soft link of the dynamic library, and the executing, by the GPU node mounted in the target user container and the GPU user mode driver library, of the to-be-executed task in the target user container to generate an execution result comprises:

[0019] updating the soft link of the dynamic library in the target user container to obtain an updated soft link;

[0020] checking, by the GPU query program, a usage of the GPU;

[0021] when it is determined, according to the usage, that the GPU can execute the to-be-executed task, invoking the GPU to execute the to-be-executed task by the GPU node, the dynamic library, the updated soft link, and the target kernel mode driver to generate the execution result.

[0022] In a possible implementation, the method further comprises:

[0023] creating, according to the to-be-executed task, a user container corresponding to the to-be-executed task in the secure container.

[0024] In a possible implementation, after the executing, by the GPU node mounted in the target user container and the GPU user mode driver library, of the to-be-executed task in the target user container to generate an execution result, the method further comprises:

[0025] unmounting the GPU node and the GPU user mode driver library mounted in the target user container;

[0026] destroying the target user container.

[0027] In a possible implementation, after the GPU node and the GPU user mode driver library mounted in the target user container are used to execute the to-be-executed task in the target user container and an execution result is generated, the method further includes:

[0028] deleting the GPU node in the secure container;

[0029] unmounting the target kernel mode driver in the virtual machine kernel;

[0030] unbinding the GPU of the secure container.

[0031] In a second aspect, the embodiments of the present disclosure provide a GPU-based user container processing method, applied to a host machine, and including:

[0032] allocating a GPU required by a task execution request sent by a terminal device used by a tenant to a secure container in a pass-through manner, the secure container being used to run a user container, and the secure container running on the host machine;

[0033] loading a target kernel mode driver corresponding to the GPU to a virtual machine kernel of the secure container according to the task execution request;

[0034] mounting a GPU node corresponding to the target kernel mode driver and a GPU user mode driver library to a target user container corresponding to the task execution request according to the target kernel mode driver;

[0035] executing the task execution request in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generating an execution result;

[0036] sending the execution result to the terminal device.

[0037] In a third aspect, the embodiments of the present disclosure provide a GPU-based user container processing apparatus, including:

[0038] an allocation module, configured to allocate a GPU to a secure container in a pass-through manner according to a to-be-executed task requiring to use the GPU, the secure container being used to run a user container, and the secure container running on a host machine corresponding to the GPU;

[0039] A creating module is configured to create a GPU node corresponding to the GPU in the secure container according to the to-be-executed task;

[0040] A mounting module is configured to mount the GPU node and the GPU user-space driver library to a target user container corresponding to the to-be-executed task.

[0041] An executing module is configured to execute the to-be-executed task in the target user container through the GPU node and the GPU user-space driver library mounted in the target user container, and generate an execution result.

[0042] In a possible implementation, the creating module is specifically configured to:

[0043] According to the to-be-executed task, determine a target kernel-space driver of the GPU;

[0044] Load the target kernel-space driver into a virtual machine kernel of the secure container;

[0045] According to the target kernel-space driver, create the GPU node in the secure container.

[0046] In a possible implementation, the creating module is specifically configured to:

[0047] Determine an identifier and a version number of the target kernel-space driver carried in the to-be-executed task;

[0048] According to the identifier and the version number, obtain a target kernel-space driver corresponding to the identifier and the version number from a kernel-space driver library.

[0049] In a possible implementation, the creating module is specifically configured to:

[0050] In the target user container, update a soft link of the dynamic library, and obtain an updated soft link;

[0051] According to the use case, determine whether the GPU can execute the to-be-executed task;

[0052] When it is determined that the GPU can execute the to-be-executed task according to the use case, invoke the GPU to execute the to-be-executed task through the GPU node, the dynamic library, the updated soft link, and the target kernel-space driver, and generate the execution result.

[0053] In a possible implementation, the creating module is further configured to:

[0054] According to the to-be-executed task, create a user container corresponding to the to-be-executed task in the secure container.

[0055] In a possible implementation, after the GPU node and the GPU user-mode driver library mounted in the target user container are used to execute the to-be-executed task in the target user container and generate an execution result, the GPU-based user container processing apparatus further includes:

[0056] an unloading module configured to unload the GPU node and the GPU user-mode driver library mounted in the target user container;

[0057] a destroying module configured to destroy the user container.

[0058] In a possible implementation, after the GPU node and the GPU user-mode driver library mounted in the target user container are used to execute the to-be-executed task in the target user container and generate an execution result, the GPU-based user container processing apparatus further includes:

[0059] a deleting module configured to delete the GPU node in the secure container;

[0060] the unloading module is further configured to unload the target kernel-mode driver in the virtual machine kernel;

[0061] an unbinding module configured to unbind the GPU of the secure container.

[0062] In a fourth aspect, an embodiment of the present disclosure provides a GPU-based user container processing apparatus, applied to a host computer, and the apparatus includes:

[0063] a receiving module configured to allocate a GPU required by a task execution request sent by a terminal device used by a tenant to a secure container in a pass-through manner, the secure container being used to run a user container, and the secure container running on the host computer;

[0064] a loading module configured to load a target kernel-mode driver corresponding to the GPU to a virtual machine kernel of the secure container according to the task execution request;

[0065] a mounting module configured to mount a GPU user-mode driver library and a GPU node corresponding to the target kernel-mode driver to a target user container corresponding to the task execution request according to the target kernel-mode driver;

[0066] an executing module configured to execute the task execution request in the target user container by using the GPU node and the GPU user-mode driver library mounted in the target user container, and generate an execution result;

[0067] a sending module configured to send the execution result to the terminal device.

[0068] In a fifth aspect, an electronic device is provided, and includes a memory and a processor.

[0069] The memory stores computer-executable instructions.

[0070] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method in the first aspect, the second aspect, and possible implementation manners.

[0071] In a sixth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores computer-executable instructions for implementing the method in the first aspect, the second aspect, and possible implementation manners when the computer-executable instructions are executed by a processor.

[0072] In a seventh aspect, a computer program product is provided, and the computer program product includes a computer program for implementing the method in the first aspect, the second aspect, and possible implementation manners when the computer program is executed by a processor.

[0073] The GPU-based user container processing method, device, equipment and medium provided by the embodiments of the present disclosure, the method comprises: first, according to the need to use the GPU of the to-be-executed task, the GPU is allocated to the security container in a pass-through manner. Then, according to the to-be-executed task, the GPU node corresponding to the GPU is created in the security container, and the GPU node and the GPU user mode driver library are mounted to the target user container corresponding to the to-be-executed task. Finally, the to-be-executed task is executed in the target user container through the mounted GPU node and GPU user mode driver library in the target user container, and an execution result is generated. Wherein, the security container is used to run the user container, and the security container runs on the host corresponding to the GPU. The technical solution provides a scheme of automatically using the GPU in the security container based on the GPU pass-through. After the GPU is passed through to the security container, the GPU node can be automatically created in the security container, and the GPU node and the GPU user mode driver library are mounted to the target user container, so as to realize the purpose of automatically configuring the GPU resource for the target user container, so that the GPU can be automatically used in the security container. The whole process does not need manual participation, improves the efficiency and accuracy of the configuration process, and effectively reduces the labor cost and the requirement for the professional level of the tenant. BRIEF DESCRIPTION OF DRAWINGS

[0074] The accompanying drawings, which are included to provide a further understanding of the present disclosure and constitute a part of the present disclosure, illustrate the illustrative embodiments of the present disclosure and their description serve to explain the present disclosure, and do not constitute improper limitations on the present disclosure. In the drawings:

[0075] FIG. 1 is a scene diagram of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0076] FIG. 2 is a flow diagram of an embodiment one of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0077] FIG. 3 is a flow diagram of an embodiment two of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0078] FIG. 4 is a flow diagram of an embodiment three of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0079] FIG. 5 is a flow diagram of an embodiment four of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0080] FIG. 6 is a flow diagram of an embodiment five of a GPU-based user container processing method according to an embodiment of the present disclosure;

[0081] FIG. 7 is a structural diagram of an embodiment one of a GPU-based user container processing apparatus according to an embodiment of the present disclosure;

[0082] FIG. 8 is a structural diagram of an embodiment two of a GPU-based user container processing apparatus according to an embodiment of the present disclosure;

[0083] FIG. 9 is a structural diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0084] To make the objectives, technical solutions, and advantages of the present disclosure clearer, the following will describe the technical solutions of the present disclosure in conjunction with specific embodiments of the present disclosure and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present disclosure but not all the embodiments. Based on the embodiments in the present disclosure, any other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present disclosure. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use, and processing of the relevant data need to comply with relevant laws, regulations, and standards, and provide corresponding operation entry for the user to choose authorization or rejection.

[0085] First, the terms involved in the embodiments of the present disclosure are explained:

[0086] Host machine: A physical server that provides computing resources, storage, and network connectivity, and runs virtualization software to support a virtualized environment. Assuming there is a cloud provider that offers Virtual Private Server (VPS) services, in this case, the host machine refers to the physical servers used by the cloud provider to host the tenant's VPS instances. These host machines divide the physical resources into multiple virtual machines through virtualization software such as Kernel-based Virtual Machine (KVM) and others, each virtual machine is a VPS instance, they share the computing resources of the host machine.

[0087] Security container: A lightweight virtual machine that runs a user container, providing an independent unit containing the running environment and required applications, allowing the application to be packaged, distributed, and deployed in a unified environment, and effectively running within the user container, simplifying the software development, deployment, and operation process.

[0088] User container: A container that runs user business, usually containing the required applications, dependencies, and configurations of the user, and providing isolation, portability, and scalability advantages.

[0089] Graphic Processing Unit (GPU): A processor designed specifically for processing graphics and image data, originally designed to accelerate computer graphics rendering, but now widely used in scientific computing, artificial intelligence, deep learning, and other fields. Compared with traditional Central Processing Unit (CPU), GPU has a large number of cores and high parallel computing capability, capable of processing large-scale data and performing a large number of computing tasks simultaneously. This makes GPU perform well in handling workloads that require large-scale data parallel computing. For example, in deep learning, the parallel computing capability of GPU can speed up the training of neural network models.

[0090] RunC: A container runtime tool responsible for managing and executing the life cycle of containers. It implements the Open Container Initiative (OCI) specification, which is an open standard for container runtime and image format, meaning that containers created by RunC can interoperate with other container tools that follow the OCI standard. RunC provides a set of command-line tools for creating, starting, stopping, and destroying containers, as well as managing various runtime parameters of containers. It interacts with the Linux kernel interface, using Linux namespaces, Control Group (cgroup), and other features to achieve container isolation and resource limitations.

[0091] Next, the scenario involved in the embodiments of the present disclosure is introduced:

[0092] Nowadays, machine learning and deep learning algorithms obtain an initial model by modeling the research problem, and train the initial model based on a large amount of training data, thereby learning the training parameters to generate a trained model. In actual application, the trained model can be used to predict and analyze data, thereby obtaining the processing result output by the trained model. In the above process, the entire model training and application process is mainly based on the computing power provided by the GPU card.

[0093] In the field of cloud computing, major cloud vendors have launched machine learning platforms based on GPU computing clusters. These platforms provide tenants with various services they need, such as data storage, data cleaning, model development and deployment, etc. Through these machine learning platforms, tenants can efficiently preprocess and feature engineer data, optimize model structures and train them, and ultimately achieve accurate prediction and in-depth analysis of data.

[0094] In addition, the machine learning platform also provides flexible resource configuration and management functions for tenants, which can dynamically adjust the allocation of computing resources according to demand to meet the needs of tasks of different scales and complexities. At the same time, the machine learning platform usually provides a rich algorithm library and development tools to help tenants quickly build and deploy various machine learning models, accelerating the online and landing of projects.

[0095] In cloud computing, a physical machine is usually shared by multiple tenants. If the task or container of one tenant maliciously attacks the host kernel, it may affect the normal operation of the tasks of other tenants, causing security problems and resource competition.

[0096] To solve this problem, cloud vendors usually use virtualization technology, such as virtual machines, to isolate different tenants. Each tenant's task or container can run inside its own virtual machine, and virtual machines are isolated from each other and do not share kernels and host resources. This approach provides stronger security, thereby meeting the strong isolation needs of multi-tenancy and ensuring that problems of one tenant do not negatively affect other tenants. RunC containers are usually run inside virtual machines to achieve more lightweight application deployment. RunC containers isolate multiple tasks based on cgroup, and multiple RunC containers share the host kernel.

[0097] The security container is a kind of light virtual machine, and the user container runs in the security container. The RunC container has an nvidia-docker component to meet the user's use of the GPU. However, before using the user container, the user container needs to be configured, and the configuration process needs to be implemented by the tenant himself, which has a high requirement on the operation level of the tenant. Moreover, since the manual processing process also needs to consume a lot of time and cannot guarantee the accuracy of the processing, there are problems of low efficiency and accuracy and high labor cost.

[0098] Based on the above technical problems, the technical concept of the present disclosure is that the existing technology cannot guarantee the rigor of manual processing, resulting in low efficiency and accuracy of the existing technology. Based on this, the present disclosure provides a GPU-based user container processing method, which can automatically load the kernel mode driver after the GPU is directly connected to the security container, create a GPU node, mount the GPU node to the user container, mount the user mode driver library to the user container, and achieve the purpose of automatically using the GPU inside the virtual machine without human intervention, effectively improving the efficiency and accuracy of processing and reducing the labor cost.

[0099] FIG. 1 is a schematic diagram of a GPU-based user container processing method according to an embodiment of the present disclosure. As shown in FIG. 1, the scenario includes a terminal device 11 and a machine learning platform 12. The machine learning platform 12 includes multiple host computers, such as host computer 121, host computer 122, and host computer 123 in FIG. 1. Each host computer runs a security container, which is used to run a user container. The user container is used to process a task execution request sent by a tenant through the terminal device 11.

[0100] Optionally, each host computer in the machine learning platform 12 can communicate with the terminal device 11 in a wired or wireless manner.

[0101] In actual application, when the tenant needs to use the machine learning platform 12 to perform model training or model application, or other tasks based on the GPU, the tenant can send a task execution request to the machine learning platform 12 through the terminal device 11. After receiving the task execution request sent by the terminal device 11, the machine learning platform 12 can allocate a host computer for the task execution request to process it.

[0102] It should be understood that the machine learning platform 12 can allocate the task execution request to any host computer in an idle state, can allocate the task execution request to a host computer pre-configured for the terminal device 11, and can also allocate a host computer pre-configured for the type of the task execution request according to the type of the task execution request. The specific allocation manner can be determined according to actual conditions, and the present disclosure does not specifically limit this.

[0103] FIG. 1 illustrates an example of a machine learning platform 12 assigning a task execution request to a host 122, which creates a user container corresponding to the task execution request in a secure container according to the task execution request, processes the task execution request, and automatically loads a kernel-mode driver in the secure container, creates a GPU node, and mounts the GPU node and a user-mode driver library to the user container, so that the user container can process the task execution request through the GPU of the host 122.

[0104] Further, after the user container finishes processing the task execution request, an execution result is generated, and the host 122 sends the execution result to the terminal device 11 for the tenant to review and further process.

[0105] It should be understood that the specific processing process of the host 122 will be specifically explained in the following embodiments, which will not be repeated here.

[0106] It should be understood that in actual applications, the number of user containers running in the secure container can be determined according to actual conditions, and FIG. 1 only illustrates an example of one, and the embodiments of the present disclosure do not specifically limit this.

[0107] The technical solutions shown in the present disclosure will be described in detail through specific embodiments. It should be noted that the following embodiments can exist independently or in combination, and for the same or similar content, the description will not be repeated in different embodiments.

[0108] FIG. 2 is a flowchart of an embodiment of a GPU-based user container processing method provided by the present disclosure. As shown in FIG. 2, the GPU-based user container processing method can be implemented through the following steps:

[0109] S21, according to a task to be executed that needs to use a GPU, the GPU is assigned to a secure container in a pass-through manner.

[0110] The execution subject of the embodiments of the present disclosure is an electronic device, which can be a terminal device such as a notebook computer, a desktop computer, a tablet computer, etc., or a server such as the host of the machine learning platform 12 in FIG. 1. In actual applications, whether the electronic device is a terminal device or a server can be determined according to actual conditions, and the embodiments of the present disclosure do not specifically limit this.

[0111] In this embodiment, in order to prevent mutual interference or resource grabbing between different tasks, a complete virtualization environment needs to be provided for task execution by a secure container, and different tasks are isolated by user containers running in the secure container. Since the task to be executed needs to use GPU computing power, the secure container and the user container need to be configured before the task to be executed is processed, so that the user container can call GPU resources.

[0112] In this step, the task to be executed can be a task generated by the electronic device itself or a task obtained from other devices, which is not limited. Since the GPU needs to be accessed when the task to be executed is executed, the GPU needs to be allocated to the secure container in a pass-through manner.

[0113] It should be understood that the secure container is used to run the user container, the secure container runs on a host corresponding to the GPU, and the relationship among the secure container, the user container, and the host can refer to the embodiment shown in FIG. 1, which will not be described here.

[0114] Optionally, the task to be executed can carry an identifier of the GPU, and the GPU corresponding to the identifier is allocated to the secure container in a pass-through manner. The electronic device can also determine the corresponding GPU according to the type of the task to be executed, and allocate the GPU to the secure container in a pass-through manner.

[0115] In a possible implementation, the GPU can be bound to a vfio-pci driver and then allocated to the secure container in a pass-through manner. Specifically, the GPU can be bound to the vfio-pci driver in the following manner: first, loading a vfio-pci module; then, determining a Peripheral Component Interconnect (PCI) address of the GPU; and finally, writing the PCI address of the GPU into a device binding file of the vfio-pci driver to bind the GPU to the vfio-pci driver.

[0116] The manner of first binding the GPU to the vfio-pci driver and then passing the GPU to the secure container in a pass-through manner enables the vfio-pci driver to correctly manage the state and reset operation of the GPU, provides direct access capability to the GPU, prevents unauthorized access to the GPU by untrusted code, and effectively improves the security, stability, and performance of the GPU.

[0117] Exemplarily, the task to be executed requiring the use of GPU usually involves work requiring large-scale computation, parallel processing and graphics rendering, such as scientific computation, machine learning and deep learning, data analysis and big data processing, image and video processing. For example, for scientific computation, the task to be executed can be astronomical simulation task, climate simulation task, quantum chemistry computation task, etc.; for machine learning and deep learning, the task to be executed can be model training task and model inference task; for data analysis and big data processing, the task to be executed can be image processing task, signal processing task, matrix operation task, etc.; for image and video processing, the task to be executed can be video editing task, special effect processing task, game scene rendering task, etc.

[0118] Optionally, since the user container occupies system resources during running, and in order to ensure that the environment for each task running is consistent, the user container needs to be destroyed after each task ends, and a new user container needs to be created when the next task needs to be executed. That is, the user container corresponding to the task to be executed can also be created in the secure container according to the task to be executed, so that the task to be executed is subsequently processed through the user container.

[0119] Exemplarily, the user container can be created by Kata Containers. Specifically, first, configure the container management system (such as Docker or Kubernetes) to use Kata Containers as the runtime, and then create the user container through the command line tool of the container management system. Further, after the user container is created, it can also be verified whether the user container is running using Kata Containers by viewing the log or entering the shell of the user container.

[0120] S22, according to the task to be executed, creating a GPU node corresponding to the GPU in the secure container.

[0121] In this step, since the user container is usually running in the isolated environment of the secure container, it can only access the resources provided by the secure container in which it is located. The GPU is directly passed into the secure container and is not exposed to the user container, so if the user container wants to use the GPU, it needs to create a GPU node corresponding to the GPU in the secure container and mount the GPU node to the user container, so that the user container calls the GPU resource through the GPU node. Therefore, first, a GPU node corresponding to the GPU needs to be created in the secure container.

[0122] It should be understood that the secure container at this time has been allocated with the GPU.

[0123] In a possible implementation, the target GPU corresponding to the target kernel mode driver is first loaded into the virtual machine kernel of the secure container, and the GPU node corresponding to the target GPU is created in the secure container according to the target kernel mode driver.

[0124] It should be understood that the specific implementation process and principles of this step will be described in the embodiment shown in FIG. 3, which will not be repeated here.

[0125] S23, mounting the GPU node and the GPU user mode driver library to the target user container corresponding to the to-be-executed task.

[0126] In this step, since the GPU user mode driver library is an interface between the user container and the GPU, and manages the allocation and release of the GPU resources, the application in the user container sends the to-be-executed task to the GPU for execution through the GPU user mode driver library. Therefore, the GPU node and the GPU user mode driver library need to be mounted to the user container corresponding to the to-be-executed task, so that the to-be-executed task is executed through the GPU node and the GPU user mode driver library subsequently.

[0127] In a possible implementation, the soft link of the GPU node file and the dynamic library in the GPU user mode driver library can be determined first, and then the GPU node file is mounted to the first instruction directory of the user container, and the soft link of the dynamic library is mounted to the second instruction directory of the user container, and the related parameters are configured, so that the user container can call the GPU node and the GPU user mode driver library.

[0128] In another possible implementation, the GPU node and the GPU user mode driver library can also be mounted through nvidia-docker.

[0129] Compared with directly copying the GPU user mode driver library to the user container, the mounting method can realize the sharing of resources between the target user container and the secure container, ensure that the GPU resources in the secure container and the target user container are consistent, and avoid version mismatch or compatibility problems. Further, if the GPU user mode driver library is updated or changed subsequently, only the GPU user mode driver library on the secure container needs to be updated, without the need to modify the content in the target user container, thereby reducing the maintenance cost and complexity. Finally, since the copying process needs to consume a large amount of time and needs to occupy additional storage space in the user container, the mounting method can effectively improve the processing efficiency and save the disk space.

[0130] S24, executing the to-be-executed task in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generating an execution result.

[0131] In this step, the target user container can directly access the GPU resource after mounting the GPU node and the GPU user space driver library. Therefore, the GPU node and the GPU user space driver library in the target user container can be used to execute the to-be-executed task by using the GPU in the target user container to obtain an execution result.

[0132] In a possible implementation, the GPU user space driver library includes a GPU query program, a dynamic library, and a soft link of the dynamic library. The soft link of the dynamic library can be updated in the target user container to obtain an updated soft link. Then, the GPU usage can be checked by using the GPU query program. When it is determined according to the usage that the GPU can execute the to-be-executed task, the GPU is called to execute the to-be-executed task by using the GPU node, the dynamic library, the updated soft link, and the target kernel space driver to generate an execution result.

[0133] Optionally, the GPU query program can be a binary program in the GPU user space driver library.

[0134] Optionally, the GPU usage generally refers to a load condition of the GPU, including utilization, temperature, power consumption, memory usage, fan speed, and the like of the GPU. In actual application, whether the GPU can execute the to-be-executed task can be determined according to whether each index of the GPU usage meets an expectation, for example, whether the utilization of the GPU is lower than 80%.

[0135] In a possible implementation, calling the GPU to execute the to-be-executed task by using the GPU node, the dynamic library, the updated soft link, and the target kernel space driver can be implemented by the following steps: when it is determined that the GPU can execute the to-be-executed task, executing a GPU computing task execution program, calling the updated soft link by using the GPU computing task execution program, thereby calling the dynamic library, calling the GPU node to operate the target kernel space driver by using the dynamic library, so that the GPU executes the to-be-executed task.

[0136] In another possible implementation, the calling of the GPU to execute the to-be-executed task can be implemented through the following steps: when it is determined that the GPU can execute the to-be-executed task, executing a GPU computing task execution program, finding and calling a dynamic library through the updated soft link, and calling a GPU node according to an application programming interface (API) capable of interacting with the GPU included in the dynamic library. The API processes operations such as memory allocation, data transmission, and instruction sending, and ensures that the to-be-executed task can be correctly sent to the GPU. In the process of interacting with the GPU node, the dynamic library communicates with the target kernel mode driver through a system call, and the target kernel mode driver configures the GPU to start executing the to-be-executed task after receiving the instruction from the dynamic library. After the GPU finishes executing the to-be-executed task, the execution result is returned to the dynamic library.

[0137] The GPU-based user container processing method provided by the embodiments of the present disclosure first allocates the GPU to the secure container in a pass-through manner according to a to-be-executed task that needs to use the GPU. Then, according to the to-be-executed task, a GPU node corresponding to the GPU is created in the secure container, and the GPU node and a GPU user mode driver library are mounted to a target user container corresponding to the to-be-executed task. Finally, the to-be-executed task is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and an execution result is generated. The secure container is used to run the user container, and the secure container runs on a host corresponding to the GPU. The technical solution provides a scheme for automatically using the GPU in the secure container scenario based on GPU pass-through. After the GPU is passed through to the secure container, the GPU node can be automatically created in the secure container, and the GPU node and the GPU user mode driver library are mounted to the target user container, so as to achieve the purpose of automatically configuring the GPU resource for the target user container, and the GPU can be automatically used in the secure container. The whole process does not need manual participation, improves the efficiency and accuracy of the configuration process, and effectively reduces the labor cost and the requirement for the professional level of the tenant.

[0138] Based on the embodiment shown in FIG. 2, the implementation process of S22 is explained and described through a specific embodiment.

[0139] FIG. 3 is a flowchart of a second embodiment of the GPU-based user container processing method provided by the embodiments of the present disclosure. As shown in FIG. 3, S22 can be implemented through the following steps:

[0140] S31, determining a target kernel mode driver of the GPU according to the to-be-executed task.

[0141] In this step, the target kernel mode driver carried in the task to be executed carries the identification of the target kernel mode driver, and the corresponding target kernel mode driver can be determined according to the identification of the target kernel mode driver.

[0142] In actual application, each GPU has its own design and function to process specific types of tasks. For example, some GPUs may be more suitable for graphics processing (such as game rendering, video editing, etc.), and some other GPUs may be more suitable for compute-intensive tasks (such as deep learning, scientific computing, etc.). Therefore, in order to improve processing efficiency, when the tenant needs to perform a job based on the GPU of the electronic device, the electronic device can determine the corresponding multiple GPUs according to the type of the task to be executed, and then determine the identification of the kernel mode driver corresponding to each GPU, and display it through the display of the terminal device used by the tenant, so that the user determines the identification of the target kernel mode driver.

[0143] Optionally, after determining the identification of the kernel mode driver corresponding to each GPU, the electronic device can directly select one from the identifications of the kernel mode drivers corresponding to the multiple GPUs as the identification of the target kernel mode driver. For example, the identification of the kernel mode driver of the GPU with the lowest usage rate can be determined as the identification of the target kernel mode driver, the identification of the kernel mode driver of the GPU with the highest priority can be determined as the identification of the target kernel mode driver, a random one can be selected from the identifications of the kernel mode drivers of the GPUs as the identification of the target kernel mode driver, or a default GPU for different types of tasks can be configured in advance, and the identification of the kernel mode driver of the default GPU corresponding to the type can be determined as the identification of the target kernel mode driver.

[0144] In one possible implementation, the identification and version number of the target kernel mode driver carried in the task to be executed can be determined. Then, according to the identification and version number, the target kernel mode driver corresponding to the identification and version number is obtained from the kernel mode driver library.

[0145] For example, assuming that the tenant uses the GPU of the electronic device to perform an inference job of generating an image through his own terminal device, the electronic device determines the multiple GPUs corresponding to the inference job of generating an image and the multiple versions corresponding to each GPU, and displays them through the terminal device of the tenant, so that the user determines the identification and version number of the target kernel mode driver according to his own production job computing framework.

[0146] For example, the gpu-prestart-hook can be called to identify the identification and version number of the target kernel mode driver specified in the task to be executed.

[0147] Optionally, in addition to the user-determined manner, the electronic device can also determine the target kernel mode driver's identification and version number by itself. For example, the target GPU's identification and version number can be determined by using rate, priority, default, etc., and the target GPU's identification and version number can also be determined randomly.

[0148] S32, load the target kernel mode driver into the virtual machine kernel of the secure container.

[0149] In this step, the target kernel mode driver plays a key role in the operating system, responsible for communicating with the GPU and providing corresponding function and performance support. Therefore, in order to enable the secure container and the user container running in the secure container to use GPU resources, it is necessary to ensure that the GPU is correctly identified and initialized, and therefore it is also necessary to load the target kernel mode driver into the virtual machine kernel of the secure container.

[0150] S33, create a GPU node in the secure container according to the target kernel mode driver.

[0151] In this step, after loading the target kernel mode driver into the virtual machine kernel of the secure container, a GPU node can be created based on the target kernel mode driver, so that the GPU can be accessed through the target kernel mode driver based on the GPU node in the future.

[0152] In one possible implementation, it can be detected first whether the GPU has been correctly identified by the secure container and has been initialized. If it has been identified and initialized, a GPU node is created in the secure container; if it has not been identified / initialized, the target kernel mode driver is reloaded into the virtual machine kernel of the secure container.

[0153] Optionally, the GPU node corresponding to the GPU can be created by the mknod command.

[0154] Optionally, after creating the GPU node in the secure container, it can also be verified whether the GPU node is successfully associated with the GPU and can communicate with the GPU. If it cannot communicate with the GPU, the GPU node is destroyed and a new GPU node is recreated in the secure container.

[0155] In the embodiment of the present disclosure, first, the target kernel mode driver of the GPU is determined according to the task to be executed. Then, the target kernel mode driver is loaded into the virtual machine kernel of the secure container. Finally, the GPU node is created in the secure container according to the target kernel mode driver. In the technical solution, the electronic device can recommend the tenant with selectable kernel mode drivers based on the type of the task to be executed, so that the tenant can determine the target kernel mode driver from the selectable kernel mode drivers according to the actual situation. In the prior art, the tenant needs to determine the target kernel mode driver corresponding to the GPU by himself / herself and download the target kernel mode driver from the official website. Compared with the manual process, the technical solution can actively provide the tenant with selectable kernel mode drivers, and the tenant only needs to determine the target kernel mode driver from the selectable kernel mode drivers, so that the manual participation is less, the accuracy and efficiency of the configuration process are greatly improved, and the operation threshold of the tenant is reduced.

[0156] Based on any of the above embodiments, since the user container occupies system resources during running, and in order to ensure that the environment for each task running is consistent, the user container needs to be destroyed after each task ends. Specifically, after the execution result is generated, the GPU node and the GPU user mode driver library mounted in the target user container are unloaded, and finally the user container is destroyed.

[0157] By releasing the resources occupied by the target user container and destroying the target user container, the waste of resources can be avoided. At the same time, since the target user container may have vulnerabilities or be attacked, timely destruction of the target user container can reduce the risk of being attacked. Finally, the target user container is created before each task starts and is destroyed after the task ends, which can ensure that each task can use a brand new container and can ensure that the environment for task running is consistent, thereby reducing unpredictable problems.

[0158] Further, the resources occupied by the secure container can also be released. Specifically, after the execution result is generated, the GPU node in the secure container is deleted, the target kernel mode driver in the virtual machine kernel is unloaded, and the GPU of the secure container is unbound, thereby effectively avoiding the waste of resources.

[0159] Next, the interaction process among the host machine, the secure container and the user container is described to explain the GPU-based user container processing method.

[0160] FIG. 4 is a flowchart of the GPU-based user container processing method according to an embodiment of the present disclosure. As shown in FIG. 4, the GPU-based user container processing method can be implemented by the following steps:

[0161] S41, the host machine passes through the GPU to the secure container.

[0162] In this step, after the host computer receives the terminal device used by the tenant sends the task to be executed, the GPU required to execute the task to be executed can be determined based on the task to be executed, and the GPU is passed through to the security container.

[0163] S42, the security container loads the GPU kernel mode driver.

[0164] In this step, the security container can load the GPU kernel mode driver corresponding to the identification and version of the GPU kernel mode driver carried by the task to be executed to the virtual machine kernel based on the identification and version of the GPU kernel mode driver carried by the task to be executed.

[0165] S43, the security container creates a GPU node.

[0166] S44, the security container mounts the GPU node to the target user container.

[0167] Among them, the target user container is the user container corresponding to the task to be executed.

[0168] S45, the target user container detects that the GPU node is mounted successfully, and notifies the security container that the GPU node is mounted successfully.

[0169] S46, the security container mounts the GPU user mode library to the target user container.

[0170] S47, the target user container detects that the GPU user mode library is mounted successfully, and notifies the security container that the GPU user mode library is mounted successfully.

[0171] In this step, the target user container executes the task to be executed through the GPU node and the GPU user mode library after successfully mounting the GPU node and the GPU user mode library.

[0172] S48, after the task to be executed is executed, the security container is released.

[0173] In summary, the GPU is passed through to the security container after being bound to the vfio-pci driver, and the passed-through GPU can be seen in the security container. At the same time, the target user container corresponding to the task to be executed is constructed in the security container, and the target user container is started after the construction is completed. After the GPU is passed through to the security container, the kernel mode driver of the GPU is loaded into the virtual machine kernel of the security container. Then create a GPU node in the security container, and after the GPU node is created successfully, the GPU can be read and written through the GPU node.

[0174] Further, the security container mounts the created GPU node into the target user container, and a process in the target user container can directly access the GPU through the GPU node. Then, the GPU user space driver library pre-mounted from the host into the security container is mounted into the target user container, and the user space driver library includes a binary executable program (including the GPU query program in the embodiment shown in FIG. 1), a dynamic library and a soft link of the dynamic library. After the mounting, an update soft link action is performed.

[0175] Finally, the security container is released after the target user container executes the to-be-executed task and the task process in the target user container ends.

[0176] In combination with FIG. 1, the process of FIG. 4 is described in a more intuitive manner as follows.

[0177] FIG. 5 is a flowchart of an embodiment four of the GPU-based user container processing method provided in the disclosure. As shown in FIG. 5, the GPU-based user container processing method can be implemented through the following steps:

[0178] Step 1: The host machine directly passes the GPU to the security container.

[0179] Step 2: The security container loads the GPU kernel driver into the virtual machine kernel.

[0180] Step 3: The security container creates a GPU node.

[0181] Step 4: The security container mounts the GPU node into the target user container.

[0182] Step 5: The security container mounts the GPU user space library into the target user container.

[0183] In the above embodiment, the GPU hardware card and the GPU user space driver library are on the host machine, the security container runs on the host machine, and the target user container runs in the security container. The security container is a virtual machine with a kernel module (virtual machine kernel), and after the GPU is directly passed to the security container, the GPU kernel driver needs to be loaded. The target user container is a normal RunC container, and if the GPU is to be used, the GPU node and the GPU user space driver library are needed. Therefore, the GPU node and the GPU user space library are mounted into the target user container.

[0184] Next, the GPU-based user container processing method is described in detail from the interaction process between the terminal device used by the tenant and the host machine.

[0185] FIG. 6 is a flowchart of an embodiment of a GPU-based user container processing method according to the present disclosure. As shown in FIG. 6, the GPU-based user container processing method can be implemented by the following steps:

[0186] S61. The terminal device used by the tenant sends a task execution request to the host.

[0187] In an embodiment, the terminal device used by the tenant can communicate with the host in a wired or wireless manner, so that the GPU computing power of the host is used to perform related jobs.

[0188] In this step, when the tenant needs to use the GPU computing power provided by the host, the tenant can send a task execution request to the host to request the host to execute a to-be-executed task carried in the task execution request by using the GPU of the host, and obtain an execution result.

[0189] In a specific implementation, the tenant can determine the to-be-executed task by using the terminal device, and determine the identity of the GPU required by the host to execute the to-be-executed task, the identity of the target kernel mode driver corresponding to the GPU, and the version number of the target kernel mode driver.

[0190] Correspondingly, the host receives the task execution request sent by the terminal device.

[0191] S62. The host allocates the GPU required by the task execution request to the secure container in a pass-through manner according to the task execution request sent by the terminal device used by the tenant.

[0192] In this step, the task execution request can carry the identity of the GPU required by the to-be-executed task, and the host can allocate the GPU corresponding to the identity of the GPU to the secure container in a pass-through manner; the host can also allocate the GPU corresponding to the type of the to-be-executed task to the secure container in a pass-through manner.

[0193] The secure container is used to run the user container, and the secure container runs on the host.

[0194] S63. The host loads the target kernel mode driver corresponding to the GPU into the virtual machine kernel of the secure container according to the task execution request.

[0195] In this step, the task execution request includes the to-be-executed task requiring the use of the GPU, the identity of the target kernel mode driver, and the version number of the target kernel mode driver. The target kernel mode driver of the GPU is determined according to the identity and the version number of the target kernel mode driver, and then the host loads the target kernel mode driver into the virtual machine kernel of the secure container.

[0196] S64, according to the target kernel mode driver, mount the GPU user mode driver library and the GPU node corresponding to the target kernel mode driver to the target user container corresponding to the task execution request.

[0197] In this step, the host machine creates a GPU node in the secure container according to the target kernel mode driver. Further, the host machine creates a target user container corresponding to the task to be executed in the secure container according to the task to be executed. Finally, the host machine mounts the GPU node and the GPU user mode driver library to the target user container corresponding to the task to be executed.

[0198] S65, the host machine executes the task execution request in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generates an execution result.

[0199] S66, the host machine sends the execution result to the terminal device.

[0200] Correspondingly, the terminal device receives the execution result sent by the host machine.

[0201] Optionally, after generating the execution result, the target user container can also be destroyed, and the resources of the secure container are released. For specific implementation process, please refer to the related content in the above embodiment, which will not be repeated here.

[0202] The following is an embodiment of the device of the present disclosure, which can be used to execute the method embodiment of the present disclosure. For details not disclosed in the device embodiment of the present disclosure, please refer to the method embodiment of the present disclosure.

[0203] Fig. 7 is a structural schematic diagram of a first embodiment of a GPU-based user container processing device provided by the present embodiment, please refer to Fig. 7, the GPU-based user container processing device 70 comprises:

[0204] The allocation module 71 is configured to allocate the GPU to the secure container in a pass-through manner according to the task to be executed which needs to use the GPU, the secure container being used to run the user container, and the secure container running on the host machine corresponding to the GPU.

[0205] The creation module 72 is configured to create a GPU node corresponding to the GPU in the secure container according to the task to be executed.

[0206] The mounting module 73 is configured to mount the GPU node and the GPU user mode driver library to the target user container corresponding to the task to be executed.

[0207] The execution module 74 is configured to execute the task to be executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generate an execution result.

[0208] In a possible implementation, the creating module 72 is specifically configured to:

[0209] According to the to-be-executed task, the target kernel mode driver of the GPU is determined.

[0210] The target kernel mode driver is loaded into the virtual machine kernel of the secure container.

[0211] According to the target kernel mode driver, the GPU node is created in the secure container.

[0212] In a possible implementation, the creating module 72 is specifically configured to:

[0213] The identification and version number of the target kernel mode driver carried in the to-be-executed task are determined.

[0214] According to the identification and version number, the target kernel mode driver corresponding to the identification and version number is obtained from the kernel mode driver library.

[0215] In a possible implementation, the creating module 72 is specifically configured to:

[0216] In the target user container, the soft link of the dynamic library is updated to obtain the updated soft link.

[0217] The use of the GPU is viewed through the GPU query program.

[0218] When it is determined according to the use that the GPU can execute the to-be-executed task, the GPU is called to execute the to-be-executed task through the GPU node, the dynamic library, the updated soft link, and the target kernel mode driver, to generate an execution result.

[0219] In a possible implementation, the creating module 72 is further configured to:

[0220] According to the to-be-executed task, the user container corresponding to the to-be-executed task is created in the secure container.

[0221] In a possible implementation, after the to-be-executed task is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and an execution result is generated, the user container processing apparatus 70 based on the GPU further includes:

[0222] The unloading module is configured to unload the GPU node and the GPU user mode driver library mounted in the target user container.

[0223] The destroying module is configured to destroy the user container.

[0224] In a possible implementation, after the GPU nodes and the GPU user-space driver library corresponding to the target kernel-space driver are mounted to the target user container, the GPU-based user container processing apparatus 70 further includes:

[0225] a deleting module, configured to delete the GPU nodes in the secure container.

[0226] an uninstalling module, configured to uninstall the target kernel-space driver in the virtual machine kernel.

[0227] an unbinding module, configured to unbind the GPU of the secure container.

[0228] The GPU-based user container processing apparatus 70 provided by the embodiments of the present disclosure can execute the technical solutions shown in the method embodiments, and the implementation principles and beneficial effects are similar, which will not be repeated here.

[0229] FIG. 8 is a structural schematic diagram of a second embodiment of a GPU-based user container processing apparatus provided by the embodiments of the present disclosure. As shown in FIG. 8, the GPU-based user container processing apparatus 80 is applied to a host computer, and the GPU-based user container processing apparatus 80 includes:

[0230] a receiving module 81, configured to allocate GPUs required by a task execution request sent by a terminal device used by a tenant to a secure container in a pass-through manner, and the secure container is used to run a user container, and the secure container runs on the host computer.

[0231] a loading module 82, configured to load a target kernel-space driver corresponding to the GPU to a virtual machine kernel of the secure container according to the task execution request.

[0232] a mounting module 83, configured to mount a GPU user-space driver library and GPU nodes corresponding to the target kernel-space driver to a target user container corresponding to the task execution request according to the target kernel-space driver.

[0233] an executing module 84, configured to execute the task execution request in the target user container through the GPU nodes and the GPU user-space driver library mounted in the target user container, and generate an execution result.

[0234] a sending module 85, configured to send the execution result to the terminal device.

[0235] The GPU-based user container processing apparatus 80 provided by the embodiments of the present disclosure can execute the technical solutions shown in the method embodiments, and the implementation principles and beneficial effects are similar, which will not be repeated here.

[0236] It should be noted that the division of each module of the above apparatus is only a logical function division, and all or part of them can be integrated into a physical entity or physically separated when actually implemented. And these modules can all be realized in the form of software called by a processing element. They can also be realized in the form of hardware. Some modules can be realized in the form of software called by a processing element, and some modules can be realized in the form of hardware. In addition, all or part of these modules can be integrated together or realized independently. The processing element here can be an integrated circuit with signal processing capability. In the implementation process, each step of the above method or each module can be completed by the integrated logic circuit of hardware in the processing element or the instructions in the form of software.

[0237] Fig. 9 is a structural schematic diagram of an electronic device provided by the embodiment of the present disclosure. Referring to Fig. 9, the electronic device 90 can include a processor 91 and a memory 92. Exemplarily, the processor 91, the memory 92, and each part are connected with each other through a bus 93.

[0238] The memory 92 stores computer execution instructions.

[0239] The processor 91 executes the computer execution instructions stored in the memory 92, so that the processor 91 executes the GPU-based user container processing method as shown in the above method embodiment.

[0240] Optionally, the above various devices of the electronic device 90 can be connected through a system bus.

[0241] Optionally, the electronic device 90 can further include a transceiver for communicating with the terminal device of the tenant. In hardware implementation, the receiving module 81 and the sending module 85 in the embodiment shown in Fig. 8 correspond to the transceiver in this embodiment.

[0242] It should be understood that the processor 91 can be a CPU, and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in combination with the present disclosure can be directly embodied as hardware processor execution or executed by hardware and software module combination in the processor.

[0243] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus. The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0244] Optionally, the electronic device 90 provided by the embodiment of the present disclosure can be implemented as the host computer in FIG. 1.

[0245] The electronic device 90 provided by the embodiment of the present disclosure can be used to execute the GPU-based user container processing method provided by any of the above method embodiments, and the implementation principle and technical effects are similar, which will not be described here.

[0246] Correspondingly, the embodiment of the present disclosure provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When the computer execution instructions are executed by the processor, the GPU-based user container processing method of the above method embodiment is implemented.

[0247] Correspondingly, the embodiment of the present disclosure can also provide a computer program product, including a computer program, which can implement the GPU-based user container processing method shown in the above method embodiment when executed by the processor.

[0248] Those skilled in the art should understand that the embodiments of the present disclosure can be provided as a method, a system, or a computer program product. Therefore, the present disclosure can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0249] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0250] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks.

[0251] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0252] In one typical configuration, the electronic device includes one or more processors, input / output interfaces, network interfaces, and memory.

[0253] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0254] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), SRAM, dynamic random access memory (DRAM), other types of RAM, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by an electronic device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0255] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0256] The above only is an embodiment of the disclosure, and is not used to limit the disclosure. The disclosure can have various changes and variations for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the disclosure shall be included in the scope of claims of the disclosure.

Claims

1. A GPU-based user container processing method, wherein, The method comprises the following steps: According to the to-be-executed task, a GPU node corresponding to the GPU is created in the security container; The GPU node and a GPU user mode driver library are mounted to a target user container corresponding to the to-be-executed task; The to-be-executed task is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and an execution result is generated. The method further comprises the following steps:

2. The method of claim 1, wherein, According to the to-be-executed task, a user container corresponding to the to-be-executed task is created in the security container. After the to-be-executed task is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and the execution result is generated, the method further comprises the following steps: The GPU node and the GPU user mode driver library mounted in the target user container are unmounted; The target user container is destroyed.

3. The method of claim 2, wherein, After the to-be-executed task is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and the execution result is generated, the method further comprises the following steps: The GPU node in the security container is deleted; The target kernel mode driver in the virtual machine kernel is unmounted; 4. The method of claim 2 or 3, wherein, The GPU of the security container is unbound. The method is applied to a host computer, and the method comprises the following steps: ​ ​ 5. The method according to any one of claims 1 to 4, wherein, ​ ​ 6. The method according to any one of claims 1 to 5, wherein, ​ ​ ​ 7. The method according to any one of claims 2 to 6, wherein, ​ ​ ​ ​ 8. A GPU-based user container processing method, wherein, ​ According to a task execution request sent by a terminal device used by a tenant, a graphics processing unit (GPU) required by the task execution request is allocated to a secure container in a pass-through manner, the secure container being used to run a user container, the secure container running on a host computer; According to the task execution request, a target kernel mode driver corresponding to the GPU is loaded into a virtual machine kernel of the secure container; According to the target kernel mode driver, a GPU user mode driver library and a GPU node corresponding to the target kernel mode driver are mounted to a target user container corresponding to the task execution request; The task execution request is executed in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and an execution result is generated; The execution result is sent to the terminal device.

9. A GPU-based user container processing apparatus, wherein, Comprise: An allocation module is configured to allocate a graphics processing unit (GPU) to a secure container in a pass-through manner according to a to-be-executed task requiring the use of the GPU, the secure container being used to run a user container, the secure container running on a host computer corresponding to the GPU; A creation module is configured to create a GPU node corresponding to the GPU in the secure container according to the to-be-executed task; A mounting module is configured to mount the GPU node and a GPU user mode driver library to a target user container corresponding to the to-be-executed task; An execution module is configured to execute the to-be-executed task in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generate an execution result.

10. A GPU-based user container processing apparatus, wherein, Applied to a host computer, the apparatus comprises: A receiving module is configured to allocate a graphics processing unit (GPU) required by a task execution request sent by a terminal device used by a tenant to a secure container in a pass-through manner, the secure container being used to run a user container, the secure container running on a host computer; A loading module is configured to load a target kernel mode driver corresponding to the GPU into a virtual machine kernel of the secure container according to the task execution request; A mounting module is configured to mount a GPU user mode driver library and a GPU node corresponding to the target kernel mode driver to a target user container corresponding to the task execution request according to the target kernel mode driver; An execution module is configured to execute the task execution request in the target user container through the GPU node and the GPU user mode driver library mounted in the target user container, and generate an execution result; A sending module is configured to send the execution result to the terminal device.

11. An electronic device, comprising: Comprise: A memory and a processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory, so that the processor executes the method of any one of claims 1 to 8.

12. A computer readable storage medium, wherein, The computer readable storage medium stores computer execution instructions, and when the computer execution instructions are executed by the processor, the computer execution instructions are used to implement the method of any one of claims 1 to 8.

13. A computer program product comprising a computer program, wherein, The computer program is executed by the processor to implement the method of any one of claims 1 to 8.

Images