Container execution device, container updating system, container updating method, and container updating program

Abstract

A container execution device (30) executes software containers using container images. Upon acquisition of a container launch instruction for a software container, a container image sharing unit (330) acquires a container image (320) and a determination information table (321). An extraction target determination unit (332) uses the container image (320) to execute the software container and, when executing the software container, extracts update information on the basis of determination information and records the update information as a new layer at new layer information (322). Upon acquiring an update instruction for updating the container image, a new layer generation unit (333) updates the container image (320) on the basis of the new layer information (322).

Description

CONTAINER EXECUTION DEVICE, CONTAINER RENEWAL SYSTEM, CONTAINER RENEWAL METHOD, AND CONTAINER RENEWAL PROGRAM

[0001] The present disclosure relates to a container execution device, a container update system, a container update method, and a container update program.

[0002] A software container is a type of virtualization technology. It is possible to separate the user space for each software container, and each software container contains a set of software necessary to run an application. An example of a software container is Docker. A software container is also simply called a container. A container image is a collection of files and meta information necessary to run a container. A container image is made up of multiple layers. A container image can be updated by adding a layer on top of the container image, regardless of the update content, such as adding, updating, or deleting files.

[0003] Container images are typically updated by building them on a device equipped with a build system (using docker build in the case of Docker) based on an image creation configuration file that reflects the changes. The image creation configuration file is a design file for the container image (Dockerfile in the case of Docker).

[0004] Patent Literature 1 discloses a technology for recording changes made to an original container image in a container running in an execution environment, and a technology for enabling the changes made in the execution environment to be reflected when the container image is updated.

[0005] Japanese Patent Application Laid-Open No. 2021-039393

[0006] Patent Document 1 cites methods for acquiring changes in the execution environment, such as logging in to the execution environment using ssh or the like and adding them to the image (executing docker commit in the case of Docker), or copying all data within the application instance. The technology in Patent Document 1 only allows the execution environment to choose whether to import all changes in the container image, or not import them at all. On the other hand, when applying containers to environments with limited hardware resources, such as embedded devices, it is desirable to minimize the size of the added layer when updating the container image. Therefore, it is desirable to extract the minimum necessary update information when updating a container image.

[0007] The present disclosure aims to reduce the size of added layers when updating a container image by extracting the minimum necessary update information.

[0008] The container execution device of the present disclosure is a container execution device that executes a software container using a container image, and includes: a container image sharing unit that, when a container start instruction that is an instruction to start the software container is received, acquires the container image and a judgment information table in which judgment information that is information for determining update information when updating the container image is set; an extraction target determination unit that executes the software container using the container image and, based on the judgment information, extracts the update information when executing the software container and records the update information as a new layer in new layer information; and a new layer generation unit that, when an update instruction that is an instruction to update the container image is received, updates the container image by adding a new layer to the container image based on the new layer information.

[0009] According to the container execution device of the present disclosure, it is possible to extract the minimum necessary update information based on the judgment information table, thereby achieving the effect of reducing the size of the layer added when updating the container image.

[0010] 1 is a diagram showing an example of the overall configuration of a container update system according to a first embodiment. FIG. 2 is a diagram showing an example of the configuration of a container registry server according to the first embodiment. FIG. 3 is a diagram showing an example of the configuration of a container management device according to the first embodiment. FIG. 4 is a diagram showing an example of the configuration of a container execution device according to the first embodiment. FIG. 5 is a flow diagram showing an example of the operation of a container startup process in the container update system according to the first embodiment. FIG. 6 is a flow diagram showing an example of the operation of an updated container image search process according to the first embodiment. FIG. 7 is a flow diagram showing an example of the operation of an extraction target determination process in the container execution device according to the first embodiment. FIG. 8 is a diagram showing an example of the configuration of a determination information table according to the first embodiment. FIG. 9 is a flow diagram showing an example of the operation of a new layer generation process in the container execution device according to the first embodiment. FIG. 10 is a diagram showing an example of the configuration of a determination information table according to a first modification of the first embodiment. FIG. 11 is a diagram showing an example of the configuration of a determination information table according to a third modification of the first embodiment. FIG. 12 is a diagram showing an example of the configuration of a container execution device according to the second embodiment. FIG. 13 is a flow diagram showing an example of the operation of a new layer integration process according to the second embodiment. FIG. 14 is a diagram showing an example of the hardware configuration of each device in the container update systems according to the first and second embodiments. FIG. 15 is a diagram showing an example of the hardware configuration of each device in the container update system according to a seventh modification of the first and second embodiments.

[0011] The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are assigned the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

[0012] Embodiment 1. ***Description of Configuration*** Fig. 1 is a diagram showing an example of the overall configuration of a container update system 500 according to this embodiment. Fig. 2 is a diagram showing an example of the configuration of a container registry server 10 according to this embodiment. Fig. 3 is a diagram showing an example of the configuration of a container management device 20 according to this embodiment. Fig. 4 is a diagram showing an example of the configuration of a container execution device 30 according to this embodiment.

[0013] The container update system 500 includes a container registry server 10, a container management device 20, and a plurality of container execution devices 30. The container registry server 10 and the container management device 20 can communicate with each other, for example, via the Internet. The container management device 20 and each of the plurality of container execution devices 30 can communicate with each other, for example, via an intranet such as a network within a factory or a LAN. LAN is an abbreviation for Local Area Network. Note that FIG. 1 is an example, and the container registry server 10 may be located on the same local network as other devices. Furthermore, the container execution device 30 may communicate with the container management device 20 via the Internet.

[0014] Each of the multiple container execution devices 30 is an execution device that executes a software container using a container image. The container execution device 30 is also referred to as a container execution device. The container registry server 10 stores a container image 110 corresponding to each container execution device and a determination information table 113 corresponding to the container image 110. The determination information table 113 contains determination information that is information for determining update information when updating the container image 110. The container management device 20 instructs the startup and shutdown of containers and manages the execution status of containers in each container execution device. It also manages the update timing of the container image. In the following description, a software container may be simply referred to as a container.

[0015] The container registry server 10 is a computer. The container registry server 10 includes a processor 12, a storage device 11 configured from a memory or an auxiliary storage device, and a communication device 13. Although not shown, the container registry server 10 may also include hardware such as an input / output interface. The processor 12 is connected to other hardware via a signal line and controls the other hardware.

[0016] The container registry server 10 includes, as functional elements, a storage unit 119 and a table registration unit 120. As an example, the storage unit 119 stores container images A, B, and C and determination information tables D, E, and F corresponding to each container image. A container image and a determination information table form one set. The number of sets is arbitrary and may be greater than one. A container image can be executed on any container execution device. The table registration unit 120 registers each container image and the determination information table. For example, a user registers each container image and the corresponding determination information table in the container registry server 10 via the table registration unit 120.

[0017] The container management device 20 is a computer. The container management device 20 includes a processor 23, a storage device 21 configured from a memory or an auxiliary storage device, and a communication device 22. Although not shown, the device 20 may also include hardware such as an input / output interface. The processor 23 is connected to other hardware via signal lines and controls the other hardware.

[0018] The container management apparatus 20 includes, as functional elements, a storage unit 219, an image update instruction unit 230, and a container configuration management unit 231. The storage unit 219 stores a container activation status 210.

[0019] The container execution device 30 is a computer. The container execution device 30 includes a processor 33, a storage device 32 configured from a memory or an auxiliary storage device, and a communication device 31. Although not shown, the container execution device 30 may also include hardware such as an input / output interface. The processor 33 is connected to other hardware via signal lines and controls the other hardware.

[0020] The container execution device 30 includes, as functional elements, a storage unit 329, a container image sharing unit 330, a container startup management unit 331, an extraction target determination unit 332, a new layer generation unit 333, and a container execution environment 334. The storage unit 329 stores a container image 320 and a determination information table 321. It also stores new layer information 322 corresponding to the container image 320. The container image 320, the determination information table 321, and the new layer information 322 form one set. There may be multiple sets of these.

[0021] Hereinafter, the container registry server 10, the container management device 20, and the container execution device 30 may be referred to as the devices of the container update system 500. In addition, the container management device 20 may have the same functions as the container execution device 30.

[0022] ***Description of Operation*** Next, the operation of the container update system 500 according to this embodiment will be described. The operation procedure of the container update system 500 corresponds to a container update method. Furthermore, the program that realizes the container update processing, which is the operation of the container update system 500, corresponds to a container update program.

[0023] 5 is a flow diagram showing an example of the operation of a container startup process in the container update system 500 according to this embodiment. Fig. 5 shows the process up to the startup of a container in the container execution device 30 according to this embodiment.

[0024] <Processing of the Container Management Apparatus 20> In step S101, the container configuration management unit 231 receives an instruction to update the container configuration from the user using a configuration file or the like. This instruction refers to, for example, applying a manifest file to the Kubernetes control plane. Alternatively, the container management apparatus itself may determine whether or not the container configuration needs to be updated based on an increase or decrease in the load on the container or whether the container is stopped. In step S102, the container configuration management unit 231 determines a container deployment destination based on the container information defined in the configuration file or the like. For example, in the case of Kubernetes, the deployment destination is determined based on the amount of hardware resources required by each container and the total amount of resources in the container execution apparatus. In step S103, the container configuration management unit 231 transmits a container startup instruction to the determined container execution apparatus to start the container.

[0025] <Processing of Container Execution Device 30> In step S104, the container execution device 30 receives a container startup instruction. In step S105, when the container startup instruction is received, the container image sharing unit 330 executes a search process for an updated container image.

[0026] FIG. 6 is a flow diagram illustrating an example of an operation of an updated container image search process according to this embodiment. FIG. 6 illustrates an updated container image search process in which the container execution device 30 receives a container startup instruction and searches for whether the same container image has been updated before starting the container. When the container startup management unit 331 receives a container startup instruction that is an instruction to start a software container, the container image sharing unit 330 executes the following process. The container image sharing unit 330 acquires a container image and a determination information table in which determination information is set, which is information for determining update information when updating a container image. At this time, the container image sharing unit 330 queries other container execution devices as to whether the container image has been updated and searches for the updated container image, as described below. The container image sharing unit 330 searches for whether the container image specified in the container startup instruction has been updated in the other container execution devices. If the container image has been updated, the container image sharing unit 330 acquires the updated container image and the determination information table corresponding to the updated container image from the other container execution devices. If the container image has not been updated, the container image sharing unit 330 acquires the container image specified by the container startup instruction from the container registry server and the determination information table corresponding to the container image.

[0027] For example, the outline of the operation when the container startup management unit 331 of the container execution device-B receives a container startup instruction is as follows. The container startup management unit 331 of the container execution device-B requests the container image sharing unit 330 to check whether the specified container image has been updated within the system. The container image sharing unit 330 queries the other container execution devices to update the container image. The container image sharing unit 330 of the container execution device-A receives this query and checks whether the specified container image exists and whether it has been updated. If it determines that the container image has been updated, it replies with the updated container image and a determination information table. The container execution device-B starts the container using the updated container image received from the container execution device-A. Specifically, the operation is as follows.

[0028] <Process for instructing query on whether an update has been made> In step S401, the container startup management unit 331 instructs the container image sharing unit 330 to inquire whether a container image in the system has been updated. In step S402, the container image sharing unit 330 sends a message to other container execution devices in the system inquiring whether a container image has been updated. This message includes the container image name and version.

[0029] <Processing when an inquiry about whether an update has been made> In step S403, the container execution device 30 receives an inquiry about whether the container image has been updated. The container execution device 30 in this case is a different container execution device from the container execution device that sent the message in step S402. In step S404, the container image sharing unit 330 checks whether a newer version than the version requested in the inquiry exists among the container images managed within the container execution device.

[0030] If a new version, i.e., an updated container image exists (YES in step S405), the process proceeds to step S406. If a new version, i.e., an updated container image does not exist (NO in step S405), the process proceeds to step S407-2.

[0031] In step S406, the container image sharing unit 330 prepares to deploy the updated container image. Specifically, the updated container image and the determination information table are combined into an archive file. The container image sharing unit 330 may also convert the updated container image into a compressed file. For example, in the case of Docker, the updated container image can be converted into a compressed file using docker save.

[0032] In step S407-1, the container image sharing unit 330 transmits the archive file created in step S406 to the inquiring container execution device together with information that "an updated container image exists." In step S407-2, the container image sharing unit 330 transmits information that "no update exists" to the inquiring container execution device.

[0033] <Processing when "Updated container image available" is received> In step S408-1, the container image sharing unit 330 receives the information "Updated container image available" along with an archive file that combines the updated container image and determination information table created in step S406. The container image sharing unit 330 restores the original file and converts the updated container image into an executable state. For example, in the case of Docker, the compressed file can be decompressed using docker load.

[0034] <Processing when "No Update" is Receipt> In step S408-2, the container image sharing unit 330 acquires the container image specified by the container startup instruction and the judgment information table corresponding to the container image from the container registry server. Note that if the container registry server cannot be accessed directly, a server may be installed within the system and the information may be acquired from there. Alternatively, the information may be acquired via a container management device.

[0035] Next, the description returns to step S108 in FIG.

[0036] In step S108, the container startup management unit 331 instructs the extraction target determination unit 332 to monitor the container. In step S109, the container startup management unit 331 generates a container from the container image acquired in step S105 and starts the container execution process.

[0037] FIG. 7 is a flowchart showing an example of the operation of the extraction target determination process in the container execution device 30 according to this embodiment.

[0038] <Extraction Target Determination Process> The extraction target determination unit 332 executes a software container using a container image and extracts update information during execution of the software container based on the determination information. The extraction target determination unit 332 then records the update information as a new layer in the new layer information 322. For example, the determination information table includes, as determination information, an execution command to be executed by the software container. As described above, the determination information is information used to determine update information when updating a container image. Therefore, the extraction target determination unit 332 determines the update information to be extracted based on the execution command, which is the determination information, and extracts the update information during execution of the container.

[0039] The extraction target determination unit 332 monitors whether an execution command is being executed when a software container is executed. Then, the extraction target determination unit 332 extracts the update result of the execution command as update information. Specifically, this is as follows.

[0040] In step S201, the extraction target determination unit 332 reads the contents of the determination information table and sets the execution command to be monitored. The extraction target determination unit 332 repeats the processes of steps S203 to S206 until the container to be monitored stops (steps S202 and S207).

[0041] In step S203, the extraction target determination unit 332 waits until a command is executed within the container. For example, the extraction target determination unit 332 monitors command execution using, for example, the tracing function of the OS. OS is an abbreviation for Operating System. In step S204, the extraction target determination unit 332 checks whether the executed command is the execution command set in step S201. In step S205, when the execution command of the monitoring target is executed, the extraction target determination unit 332 traces the processing content of the command. In step S206, the extraction target determination unit 332 saves, as update information, files or environment variables updated by the execution command of the monitoring target as a result of the tracing in the new layer information 322. At this time, the extraction target determination unit 332 saves files in the new layer information 322 so that the directory structure is the same as that in the container. Updates resulting from command execution also include the addition or deletion of files or environment variables.

[0042] 8 is a diagram showing an example of the configuration of the determination information table 321 according to this embodiment. In the determination information table 321, the contents of the execution commands to be monitored are set as the determination information 211. The extraction target determination unit 332 extracts files or environment variables updated by the execution commands defined in the determination information table 321 as the update information 212. The extraction target determination unit 332 then adds the extracted update information 212 to the new layer information 322 as a new layer. The determination information table 321 needs to be registered in the container registry server 10 before the container is started.

[0043] 8 , the extraction target determination unit 332 monitors the execution content of the container by referring to the determination information table 321. The extraction target determination unit 332 extracts, as the update information 212, " / dirB / file-C,file-D" that was updated by the process corresponding to the execution command name "app-B", the first argument "argB", and the second argument "argC" defined in the determination information table 321. The extraction target determination unit 332 then adds the update information 212 to the new layer information 322.

[0044] FIG. 9 is a flowchart showing an example of the operation of a new layer generation process in the container execution device 30 according to this embodiment.

[0045] <New Layer Generation Process> When the new layer generation unit 333 acquires a container update instruction, which is an instruction to update a container image, the new layer generation unit 333 adds a new layer to the container image based on the new layer information 322. This updates the container image.

[0046] An overview of the new layer generation process will be described. The new layer generation unit 333 receives a container image update instruction sent from the container management device 20. Upon receiving the update instruction, the new layer generation unit 333 creates a script that copies the entire set of files and directories included in the new layer information 322 into the container. If the environment variables have also been updated, the new layer generation unit 333 also defines a permanent environment variable update process. Next, the container_update is started using the container image before the update. At this time, the settings are changed so that the above script is executed at startup. Upon startup, the container_update copies files from the new layer information 322 and updates the environment variables, creating a state in which only the desired information is updated. The new layer generation unit 333 stops the container_update, updates the container image, and adds a new layer to the container image. After the container image update is complete, the new layer information 322, the container_update, and the script are deleted. Specifically, the process is as follows.

[0047] In step S301, the image update instruction unit 230 of the container management device 20 transmits an instruction to update a container image. The timing for transmitting the instruction to update a container image is when a change in the container configuration requires a change in the container execution device, for example.

[0048] In step S302, the new layer generation unit 333 receives the update instruction. The new layer generation unit 333 starts a new layer generation process, which is a container image update process, triggered by the reception of the update instruction. The update instruction also includes information on whether to continue or stop the operation of the container.

[0049] In step S303, the new layer generation unit 333 creates a script that copies the set of files and directories included in the new layer information 322 into the container. If the environment variables have also been updated, a permanent environment variable update process is also added to the script. In step S303a, the new layer generation unit 333 refers to information included in the update instruction as to whether to continue or stop the operation of the container. If the information indicates that the container operation is to be stopped (YES in step S303a), the new layer generation unit 333 stops the currently running container_original in step S304. If the information indicates that the container operation is to be continued (NO in step S303a), the process proceeds to step S305.

[0050] In step S305, the new layer generation unit 333 launches the container_update using the container image before the update. At this time, the settings are changed so that the script created in step S303 is executed instead of a normal application when the container is launched. For example, in the case of Docker, cmd or entrypoint is overwritten. In step S306, the new layer generation unit 333 stops the container_update because the generation of the container image including the desired update content is completed in step S305. In step S307, the new layer generation unit 333 reflects the operation results of the container_update in the container image. For example, in the case of Docker, docker commit is executed for the container_update. This generates the updated container image. In step S308, the new layer generation unit 333 deletes temporary data for the container image update. The temporary data deleted here is the new layer information 322, the script generated in step S303, and the container_update.

[0051] The new layer generation unit 333 may overwrite the updated container image with the container image in the storage unit 329. Alternatively, the new layer generation unit 333 may store the updated container image in the storage unit 329 separately from the original container image in the storage unit 329.

[0052] ***Other Configurations*** <Variation 1> In the present embodiment, a description has been given of an aspect in which the content of an execution command to be monitored is set as the determination information 211 in the determination information table 321. In Variation 1, a description will be given of an aspect in which an execution interface executed by a software container is set as the determination information 211 in the determination information table 321. The extraction target determination unit 332 monitors whether an interface defined in the determination information table 321 is being executed when the software container is executed, and extracts the update result by the execution interface as the update information 212.

[0053] FIG. 10 is a diagram showing an example of the configuration of a determination information table 321 according to Variation 1 of this embodiment. In FIG. 10, the execution interface is referred to as an execution API. The execution interface is also referred to as an execution function. API is an abbreviation for Application Programming Interface. In the determination information table 321, the contents of the execution interface, rather than the execution command, are set as the determination information 211. For example, the determination information table 321 contains information such as the execution API name, first argument, and second argument. The extraction target determination unit 332 monitors the behavior within the application when determining the update information 212, which is extraction target information, based on the contents of the execution interface.

[0054] <Modification 2> In Modification 2, a description will be given of an aspect in which the names of files, directories, or environment variables are set as the judgment information 211 in the judgment information table 321. When a software container is executed, the extraction target determination unit 332 monitors whether the file, directory, or environment variable, which is the judgment information 211, has been updated, and extracts the update result of the file, directory, or environment variable as update information 212.

[0055] In this way, the names of files or directories, rather than execution commands, may be defined in the determination information table 321. When identifying extraction target information based on the names of files, directories, or environment variables, the extraction target determination unit 332 periodically monitors whether the target files / directories and environment variables have been updated.

[0056] <Variation 3> Variation 3 describes an example in which received data received by a software container is set as the determination information 211 in the determination information table 321. The extraction target determination unit 332 monitors whether received data is being received when the software container is executed, and extracts the update result when the received data is received as the update information 212.

[0057] 11 is a diagram showing an example of the configuration of a determination information table 321 according to a third modification of this embodiment. The determination information table 321 may define received data instead of execution commands. For example, the determination information table 321 contains information such as the input interface, interface name, received data name, data sender, and response application. When received data is defined, the extraction target determination unit 332 extracts files and environment variables updated by response processing upon data reception as update information 212, which is extraction target information. When determining extraction target information based on received data, the extraction target determination unit 332 monitors the received data and behavior within the application.

[0058] <Modification 4> In the present embodiment, the update information 212 based on the determination information table 321 is extracted as the new layer. In Modification 4, a mode will be described in which the new layer generation unit 333 acquires an update file to be added to the container image along with an update instruction. When the new layer generation unit 333 acquires the update file along with the update instruction, the new layer generation unit 333 integrates the update file into the new layer information 322, and updates the container image based on the new layer information 322 obtained by integrating the update file.

[0059] In this way, the new layer may include not only the extraction results based on the determination information table 321 but also update files received from outside. In this case, the image update instruction unit 230 sends the container image update instruction and the update file together to the new layer generation unit 333. The update file is, for example, information such as a file, a new version of an application, or material information. The new layer generation unit 333 merges the received update file into the new layer information and then launches container_update. A method for merging the received update file into the new layer information may be to copy it using a script. By integrating the update content within the container and the update content from outside the device into a single layer, the number of layers to be managed can be reduced.

[0060] <Modification 5> In this embodiment, the container management device 20 transmits a container activation instruction to the container execution device 30 while referring to the container activation status 210. In Modification 5, a description will be given of an aspect in which the new layer generation unit 333 updates the container image in response to a container activation instruction sent to another container execution device. At this time, it is assumed that the container execution device 30 may receive a stop instruction directed to the device itself.

[0061] The new layer generation unit 333 monitors container start instructions for other container execution devices. When the new layer generation unit 333 detects a container start instruction for other container execution devices and receives a stop instruction for its own device, it stops the container_original (step S304) and updates the container image based on the new layer information 322. On the other hand, when the new layer generation unit 333 detects a container start instruction for other container execution devices and does not receive a stop instruction for its own device, it updates the container image based on the new layer information without stopping the container_original.

[0062] In this way, the trigger for generating a container layer may be when the container management device sends a container start instruction to a container execution device that is to become a new container execution target. In this case, the new layer generation unit 333 of the container execution device needs to have a function for capturing container start instructions for other container execution devices. For example, the container execution device may capture an adjacent container execution device and update the container image when a container start instruction is received from the adjacent container execution device. Alternatively, even if the container execution device does not have a function for capturing the start instruction, the container execution device may inquire of another container execution device about whether a container start instruction has been received, and update the container image when the other container execution device has received a container start instruction.

[0063] <Variation 6> In this embodiment, the new layer information is reflected in the container image by generating a script that adds new layer information to the container image. In Variation 6, the new layer generation unit 333 may import the new layer information into an update software container and execute a container image update process on the update software container to generate an updated container image. In Variation 6, the new layer generation unit 333 may add a command that imports the new layer information to an image creation configuration file and generate the container image based on the image creation configuration file to generate an updated container image. The image creation configuration file is a file in which settings for generating a container image are defined. For example, in the case of Docker, it is Dockerfile.

[0064] In this way, a container layer can be updated by updating the image creation configuration file. When updating the image creation configuration file, a process is added to copy the entire set of files and directories included in the new layer information. In order to complete the process within the container execution device, a build function must be provided. Note that when building on a device outside the system, the image creation configuration file and new layer information are uploaded to the container build device.

[0065] ***Explanation of Effects of the Present Embodiment*** As described above, the container update system 500 according to the present embodiment can extract, as update information, only the processing execution results based on the conditions defined in the determination information table. Therefore, the container update system 500 according to the present embodiment has the effect of being able to determine whether or not changes to a container image need to be reflected based on more detailed conditions, such as on a file-by-file basis.

[0066] Furthermore, in the container update system 500 according to this embodiment, the filtering results of the execution process are imported into the update container, so that the container image can be updated at the deployment destination. Therefore, the container update system 500 according to this embodiment has the advantage that only the necessary update information can be extracted and the container execution device itself can update the container image.

[0067] Furthermore, in the container update system 500 according to the present embodiment, the updated container image can be shared between the container execution devices by inquiring whether the container image has been updated between the container execution devices. Therefore, the container update system 500 according to the present embodiment has the advantage that the updated container image can be shared between the container execution devices without going through another device.

[0068] Embodiment 2 In this embodiment, differences from and additions to embodiment 1 will be mainly described. In this embodiment, components having the same functions as those in embodiment 1 will be assigned the same reference numerals, and descriptions thereof will be omitted.

[0069] ***Description of Configuration*** Fig. 12 is a diagram showing an example of the configuration of the container execution device 30 according to this embodiment. In this embodiment, in addition to the configuration of embodiment 1, a new layer integrating unit 337 is provided. The other configuration is the same as in embodiment 1.

[0070] The new layer integrating unit 337 inquires of the other container execution devices whether or not new layer information corresponding to the container image exists. If the other container execution devices have new layer information corresponding to the container image, the new layer integrating unit 337 acquires the new layer information corresponding to the container image as new layer information of the other container execution devices. Then, the new layer integrating unit 337 integrates the new layer information of the other container execution devices into the new layer information of its own device.

[0071] ***Explanation of Operation***

[0072] In the first embodiment, the description is given on the assumption that the same container is executed by one container execution device 30. In the present embodiment, an aspect will be described in which new layer information of the multiple container execution devices 30 is merged when the same container is executed by multiple container execution devices 30.

[0073] An overview of the functions of the container update system 500 according to this embodiment will be described. As in the first embodiment, each container execution device generates new layer information 322 based on the determination information table 321. Upon receiving an update instruction from the container management device 20, the new layer generation unit 333 requests the new layer integration unit 337 to send a confirmation message indicating whether or not the new layer information needs to be merged. At this time, the container management device 20 determines which container execution device will perform the merge so that confirmation messages are not sent simultaneously from multiple container execution devices. The container management device 20 then transmits the update instruction only to the container execution device to be merged. Examples of the method of determination by the container management device 20 include making a determination based on the hardware performance of the machine or the available storage capacity. Furthermore, as in the fifth modification of the first embodiment, instead of directly instructing the container image to be updated, the determination may be made indirectly by monitoring container startup instructions sent to other container execution devices. In this case, the container management device 20 instructs the container execution device to monitor the container startup instruction in advance.

[0074] When the new layer integrating unit 337 receives a request to send a confirmation message regarding whether merging is necessary, it checks with other container execution devices in the system whether new layer information for the target container image exists. If new layer information has been stored in the other container execution devices, the new layer information is returned. The new layer integrating unit 337 that made the request merges the new layer information acquired from the other container execution devices with the new layer information of its own device. Specifically, this is as follows.

[0075] FIG. 13 is a flowchart showing an example of the operation of the new layer merging process according to this embodiment.

[0076] <Confirmation Message Transmission Process> In step S501, the new layer generation unit 333 instructs the new layer integrating unit 337 to merge new information layers. In step S502, the new layer integrating unit 337 transmits a confirmation message to other container execution devices in the system to inquire about the presence or absence of new layer information. The confirmation message includes the container image name and version.

[0077] <Processing when a confirmation message is received> In step S503, the new layer integrating unit 337 receives the confirmation message. Note that the processing from step S503 to step S507 is performed by the container execution device that received the confirmation message. In step S504, the new layer integrating unit 337 checks whether the new layer information managed within its own device corresponds to the inquired version.

[0078] If new layer information corresponding to the inquired version exists (YES in step S505), the process proceeds to step S506. If new layer information corresponding to the inquired version does not exist (NO in step S505), the process proceeds to step S507-2.

[0079] In step S506, the new layer integrating unit 337 prepares to expand the new layer information corresponding to the inquired version. For example, the new layer integrating unit 337 converts the new layer information into a compressed file. In step S507-1, the new layer integrating unit 337 transmits the compressed file created in step S506 together with information that "new layer information exists" to the inquiring source. In step S507-2, the new layer integrating unit 337 transmits information that "new layer information does not exist" to the inquiring source.

[0080] <Processing when a confirmation message is received> In step S508, the new layer integrating unit 337 receives the information that "new layer information is available" and the compressed file created in step S506. Note that the processing from step S508 to step S509 is processing in the container execution device that sent the confirmation message. In step S509, the new layer integrating unit 337 expands and merges the "new layer information" received from the other device into the "new layer information" of its own device. If a conflict occurs, the new layer information received from the other device is given priority. If the contents of its own device are given priority, the received "new layer information" is expanded in a different location, and only the information that is not included in the "new layer information" of its own device is merged.

[0081] ***Description of Effects of the Present Embodiment*** As described above, in the container update system 500 according to the present embodiment, each container execution device extracts only update information that matches the conditions defined in the determination information table, and creates new layer information. Then, when updating a container image, the new layer information of each container execution device is aggregated. This makes it possible to determine whether or not to reflect changes even when multiple containers are running. Therefore, the container update system 500 according to the present embodiment has the advantage of being able to determine whether or not to reflect changes made to multiple instances based on the same container image based on more detailed conditions, such as on a file-by-file basis.

[0082] ***Explanation of Hardware Configuration Example*** FIG. 14 is a diagram showing an example of the hardware configuration of each device of the container updating system 500 according to this embodiment.

[0083] Each device in the container updating system 500 is a computer. Each device in the container updating system 500 includes a processor 910, as well as other hardware such as a memory 921, an auxiliary storage device 922, an input / output interface 930, and a communication device 950. The processor 910 is connected to the other hardware via a signal line 80 and controls the other hardware. The processor 910 is an example of the processors 12, 23, and 33. The communication device 950 is an example of the communication devices 13, 22, and 31. The memory 921 or the auxiliary storage device 922 is an example of the storage devices 11, 21, and 32.

[0084] The functions of each device in the container update system 500 are realized by software. The processor 910 is a device that executes the container update program. The container update program is a program that realizes the functions of each device in the container update system 500. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0085] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that saves data. A specific example of the auxiliary storage device 922 is an HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, or DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0086] The input / output interface 930 is an interface for connecting input / output devices. Specific examples of the input / output interface 930 include USB and HDMI (registered trademark) ports. USB stands for Universal Serial Bus. HDMI (registered trademark) stands for High-Definition Multimedia Interface.

[0087] The communication device 950 is an interface for communicating with an external device, and is specifically an Ethernet (registered trademark) port or a device for wireless communication.

[0088] The container update program is executed in each device of the container update system 500. The container update program is read into the processor 910 and executed by the processor 910. The memory 921 stores not only the container update program but also the OS. The processor 910 executes the container update program while executing the OS. The container update program and the OS may be stored in the auxiliary storage device 922. The container update program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that part or all of the container update program may be incorporated into the OS.

[0089] Each device in the container update system 500 may include multiple processors that replace the processor 910. These multiple processors share the task of executing the container update program. Each processor is a device that executes the container update program, just like the processor 910.

[0090] Data, information, signal values ​​and variable values ​​used, processed or output by the container update program are stored in memory 921, secondary storage device 922, or registers or cache memory within processor 910.

[0091] The "unit" of each unit of each device of the container update system 500 may be read as a "circuit," "step," "procedure," "process," or "circuitry." The container update program causes a computer to execute each process, with the "unit" of each unit of each device of the container update system 500 read as a "process." The "process" of each process of each device of the container update system 500 may be read as a "program," "program product," "computer-readable storage medium storing a program," or "computer-readable recording medium recording a program." Furthermore, the container update method is a method carried out by each device of the container update system 500 executing the container update program. The container update program may be provided by being stored in a computer-readable recording medium. Furthermore, the container update program may be provided as a program product.

[0092] ***Other Configurations*** <Variation 7> In this embodiment, the functions of each unit of each device of the container renewal system 500 are realized by software. As a variation, the functions of each unit of each device of the container renewal system 500 may be realized by hardware. Specifically, each device of the container renewal system 500 includes an electronic circuit 909 instead of the processor 910.

[0093] FIG. 15 is a diagram showing an example of the hardware configuration of each device of the container updating system 500 according to Variation 7 of this embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the function of each unit of each device of the container updating system 500. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, GA, ASIC, or FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0094] The functions of each part of each device of the container renewal system 500 may be realized by a single electronic circuit, or may be realized by distributing them across multiple electronic circuits.

[0095] As another modification, some of the functions of the units of the devices in the container updating system 500 may be realized by electronic circuits, and the remaining functions may be realized by software. Also, some or all of the functions of the units of the devices in the container updating system 500 may be realized by firmware.

[0096] Each of the processors and electronic circuits is also called a processing circuitry. In other words, the functions of each unit of each device in the container updating system 500 are realized by the processing circuitry.

[0097] In the above first and second embodiments, each unit of each device of the container update system 500 has been described as an independent functional block. However, the configuration of each device of the container update system 500 does not have to be the same as the configuration of the above-described embodiments. The functional blocks of each device of the container update system 500 may have any configuration as long as they can realize the functions described in the above-described embodiments. Furthermore, each device of the container update system 500 may not be a single device, but may be a system composed of multiple devices. Furthermore, multiple parts of the first and second embodiments may be combined and implemented. Alternatively, only one part of these embodiments may be implemented. In addition, these embodiments may be combined in any way, either as a whole or in part. That is, in the first and second embodiments, each embodiment may be freely combined, or any component of each embodiment may be modified, or any component of each embodiment may be omitted.

[0098] The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the scope of use of the present disclosure. The above-described embodiments can be modified in various ways as needed. For example, the procedures described using flow charts or sequence diagrams may be modified as appropriate.

[0099] 10 Container registry server, 20 Container management device, 30 Container execution device, 11, 21, 32 Storage device, 12, 23, 33 Processor, 13, 22, 31 Communication device, 80 Signal line, 110, 320 Container image, 113, 321 Determination information table, 211 Determination information, 212 Update information, 119, 219, 329 Storage unit, 120 Table registration unit, 210 Container startup status, 230 Image update instruction unit, 231 Container configuration management unit, 322 New layer information, 330 Container image sharing unit, 331 Container startup management unit, 332 Extraction target determination unit, 333 New layer generation unit, 334 Container execution environment, 335 Container_original, 336 Container_update, 337 New layer integration unit, 500 Container update system, 909 Electronic circuit, 910 Processor, 921 memory, 922 auxiliary storage device, 930 input / output interface, 950 communication device.

Claims

1. A container execution device that executes a software container using a container image, comprising: a container image sharing unit that, when a container start instruction that is an instruction to start the software container is received, acquires the container image and a judgment information table in which judgment information that is information for determining update information when updating the container image is set; an extraction target determination unit that executes the software container using the container image and, based on the judgment information, extracts the update information when executing the software container and records the update information as a new layer in new layer information; and a new layer generation unit that, when an update instruction that is an instruction to update the container image is received, updates the container image by adding a new layer to the container image based on the new layer information.

2. The container execution device according to claim 1, further comprising a new layer integration unit that queries other container execution devices to determine whether or not new layer information corresponding to the container image exists, and if the other container execution devices have new layer information corresponding to the container image, acquires the new layer information corresponding to the container image as new layer information for the other container execution devices, and integrates the new layer information of the other container execution devices into the new layer information.

3. A container execution device as described in claim 1 or claim 2, wherein the judgment information table has an execution command executed by the software container set as the judgment information, and the extraction target judgment unit monitors whether the execution command is being executed when the software container is executed, and extracts the update results by the execution command as the update information.

4. A container execution device as described in claim 1 or claim 2, wherein the judgment information table sets an execution interface executed by the software container as the judgment information, and the extraction target judgment unit monitors whether the execution interface is being executed when the software container is being executed, and extracts the update results by the execution interface as the update information.

5. A container execution device as described in claim 1 or claim 2, wherein the judgment information table is set with the name of a file, directory, or environment variable as the judgment information, and the extraction target judgment unit monitors whether the file, directory, or environment variable is updated when the software container is executed, and extracts the update results of the file, directory, or environment variable as the update information.

6. A container execution device as described in claim 1 or claim 2, wherein the judgment information table is set with received data received by the software container as the judgment information, and the extraction target judgment unit monitors whether the received data is received when the software container is executed, and extracts the update result when the received data is received as the update information.

7. A container execution device as described in claim 1 or claim 2, wherein the new layer generation unit generates an updated container image by importing the new layer information into an update software container and performing an update process on the container image for the update software container.

8. A container execution device as described in claim 1 or claim 2, wherein when the new layer generation unit receives an update file to be added to the container image along with the update instruction, it integrates the update file into the new layer information and updates the container image based on the new layer information obtained by integrating the update file.

9. The container execution device is provided in a container update system comprising a plurality of container execution devices and a container management device used in each of the plurality of container execution devices to manage the startup and shutdown of containers and the updating of container images, and the new layer generation unit monitors the container startup instructions for other container execution devices, and when a container startup instruction corresponding to the container image is detected, updates the container image based on the new layer information. A container execution device as described in claim 1 or claim 2.

10. A container execution device as described in claim 1 or claim 2, wherein the new layer generation unit generates an updated container image by adding a command to import the new layer information to an image creation configuration file in which settings for generating the container image are defined, and generating the container image based on the image creation configuration file.

11. The container execution device according to claim 2, wherein the container update system includes a container registry server that stores the container image and the judgment information table, and the container image sharing unit searches to determine whether the container image specified by the container startup instruction has been updated in another container execution device, and if it has been updated, obtains the updated container image and the judgment information table corresponding to the updated container image from the other container execution device, and if it has not been updated, obtains the container image specified by the container startup instruction and the judgment information table corresponding to the container image from the container registry server.

12. A container update system comprising: a plurality of container execution devices, each of which executes a software container using a container image; a container registry server that stores the container images and a judgment information table in which judgment information is set, which is information for determining update information when updating the container image; and a container management device that manages the startup and shutdown of containers and the updating of container images for each of the plurality of container execution devices, wherein each of the plurality of container execution devices comprises: a container image sharing unit that, when a container startup instruction, which is an instruction to start the software container, is sent from the container management device, acquires the container image and the judgment information table; an extraction target determination unit that executes the software container using the container image and, based on the judgment information, extracts the update information when executing the software container and records the update information as a new layer in new layer information; and a new layer generation unit that, when an update instruction, which is an instruction to update the container image, is received from the container management device, updates the container image by adding a new layer to the container image based on the new layer information.

13. A container update method used in a computer that executes a software container using a container image, wherein, when the computer receives a container start instruction that is an instruction to start the software container, the computer acquires the container image and a judgment information table in which judgment information is set that is information for determining update information when updating the container image; the computer executes the software container using the container image, and, based on the judgment information, extracts the update information when executing the software container and records the update information as a new layer in new layer information; and, when the computer receives an update instruction that is an instruction to update the container image, the computer updates the container image by adding a new layer to the container image based on the new layer information.

14. A container update program used in a computer that executes a software container using a container image, the container update program causing the computer to execute the following processes: a container image sharing process that, when a container start instruction that is an instruction to start the software container is received, acquires the container image and a judgment information table in which judgment information that is information for determining update information when updating the container image is set; an extraction target determination process that executes the software container using the container image and, based on the judgment information, extracts the update information when executing the software container and records the update information as a new layer in new layer information; and a new layer generation process that, when an update instruction that is an instruction to update the container image is received, updates the container image by adding a new layer to the container image based on the new layer information.

Images