CN105190545B - Virtual method and device and computer equipment - Google Patents

Abstract

A virtualization method and device and computer equipment are used to solve the defects that the existing container virtualization technology cannot truly isolate files between containers, and the security is not enough; and the operation is complicated and the cost is large. In some feasible implementations of the present invention, the method includes: the operating system creates an independent VFS instance for each of the multiple containers, and configures an independent VFS instance for each container in the file system through the VFS instance of each container. The file management structure enables multiple containers to be configured with mutually independent VFS instances, and multiple containers are respectively configured with mutually independent file management structures; the operating system receives the files sent by the application in the first container among the multiple containers When an operation request is made, the VFS instance of the first container invokes the file management structure of the first container to operate on the files involved in the file operation request.

Description

Virtualization method and device and computer equipment

technical field

The invention relates to the field of computer technology, in particular to a virtualization method and device and computer equipment.

Background technique

Operating system virtualization is an emerging computer virtualization technology. The operating system virtualization defined by Gartner (Gartner, also translated by Gu Neng Company) means that a shared operating system allows multiple different applications to run in isolation under the control of a copy of the operating system.

A container is a lightweight operating system virtualization technology. The container is composed of process access control isolation technology and process group management control technology implemented in the kernel mode, plus a complete set of user mode management tools. Containers effectively divide the resources managed by a single operating system into isolated resource groups to better balance conflicting resource usage needs among the isolated groups. By providing a way to create and enter the container, the container allows the applications in the container to run on an independent operating system, but can share many underlying system resources. For containers, there are currently many mature products, such as LXC (Linux Container, Linux container) for Linux systems.

In the existing container-based operating system virtualization technology, multiple containers share the virtual file system (Virtual File Systems, VFS) and the underlying file system (File Systems, FS), and the file isolation between containers is through the conversion of file paths It is implemented by combining access control policies.

Among them, VFS is an interface layer between the file system and the service. VFS can abstract all the details of each file system of Linux, making different file systems look the same to the Linux kernel and other processes running in the system. When it comes to operations on files, VFS maps these operations to the corresponding file system. The underlying file system refers to the actual file system such as Ext4, which is responsible for managing the reading and storage of data on the disk.

Practice has found that because the underlying file system is shared between containers, the files between containers are not really isolated. Therefore, the existing container virtualization technology cannot completely shield the file operations between containers, and the security is not enough; in some special cases, Upper-level users or the kernel may break through this limitation and operate files in other containers. Moreover, for operations involving files, the existing container virtualization technology needs to perform file path conversion, access control and verification, and the operation is complex and expensive.

Contents of the invention

Embodiments of the present invention provide a virtualization method and device and computer equipment to solve the defects that the existing container virtualization technology cannot truly isolate files between containers, and the security is not enough; and the operation is complicated and the cost is large.

The first aspect of the present invention provides a virtualization method for a virtualization system; the virtualization system includes: a hardware layer, an operating system and a file system running on the hardware layer, and the operating systems are divided into mutually isolated a plurality of containers, each of which is an isolated operation execution environment for application programs to run; the plurality of containers includes a first container, and the first container is any one of the plurality of containers container; the file system can be divided into multiple independent file management structures; the virtualization method includes: the operating system creates an independent virtual file system VFS instance for each container in the multiple containers, and Configure an independent file management structure for each container in the file system through the VFS instance of each container, so that the multiple containers are respectively configured with mutually independent VFS instances, and the multiple containers are respectively configured with mutually independent files Management structure: when the operating system receives a file operation request from an application in the first container, it invokes the file management structure of the first container through the VFS instance of the first container to perform the file operation request involved files.

In a first possible implementation manner, the method further includes: the operating system assigning a dedicated processing thread to the first container, and using the dedicated processing thread of the first container to process the first container The operation of the application program in the first container is processed, and after all the operations corresponding to the application program in the first container are processed, the processing thread dedicated to the first container is released.

With reference to the first possible implementation of the first aspect, in a second possible implementation, the method further includes: the operating system receives the message sent by the processing thread dedicated to the first container when it starts working. After the lock request, lock the file management structure of the first container to prohibit other processing threads from accessing the file management structure of the first container; After the unlock request is sent during work, the file management structure of the first container is unlocked.

With reference to the first aspect or the first or second possible implementation of the first aspect, in a third possible implementation, calling the file of the first container through the VFS instance of the first container The management structure operating the file involved in the file operation request includes: calling the file system through the VFS instance of the first container, and sending the file operation request to the file system; so that the file system can identify When finding out that the file operation request originates from the first container, perform operations on the files involved in the file operation request in the file management structure of the first container.

The second aspect of the present invention provides a virtualization device, which is applied to a virtualization system; the virtualization system includes: a hardware layer, an operating system and a file system running on the hardware layer, and the operating systems are divided into mutually isolated a plurality of containers, each of which is an isolated operation execution environment for application programs to run; the plurality of containers includes a first container, and the first container is any one of the plurality of containers container; the file system can be divided into multiple file management structures independent of each other; the virtualization device is embedded in the operating system; the virtualization device includes: a configuration module for making the operating system the Each of the multiple containers creates an independent virtual file system VFS instance, so that the operating system configures an independent file management structure for each container in the file system through the VFS instance of each container, so that the multiple The containers are respectively configured with mutually independent VFS instances, and the plurality of containers are respectively configured with mutually independent file management structures; the operation module is configured to enable the operating system to receive the files sent by the application in the first container When an operation request is made, the operating system is made to call the file management structure of the first container through the VFS instance of the first container to operate on the files involved in the file operation request.

In a first possible implementation manner, the configuration module is further configured to enable the operating system to assign a dedicated processing thread to the first container, and the dedicated processing thread of the first container performs the processing on the The operation of the application program in the first container is processed, and after all the operations corresponding to the application program in the first container are processed, the operating system is made to release the processing thread dedicated to the first container.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, the device further includes: a locking and unlocking module, configured to enable the operating system to receive the first container-specific After the processing thread sends the lock request when starting to work, the file management structure of the first container is locked, and other processing threads are prohibited from accessing the file management structure of the first container; and, the operating system receives The file management structure of the first container is unlocked after the unlock request sent by the processing thread dedicated to the first container is finished.

With reference to the second aspect or the first or second possible implementation manner of the second aspect, in a third possible implementation manner, the operation module is specifically configured to enable the operating system to receive the first When an application in the container sends a file operation request, the operating system is made to call the file system through the VFS instance of the first container, and the file operation request is sent to the file system; so that the file When the system recognizes that the file operation request originates from the first container, it operates on the file involved in the file operation request in the file management structure of the first container.

The third aspect of the present invention provides a computer device, including: a hardware layer, an operating system and a file system running on the hardware layer; the hardware layer includes a processor, a memory, a communication interface, a bus, the processor, and a memory , the communication interface communicates with each other through the bus; the communication interface is used to receive and send data; the memory is used to store programs; the processor is used to execute the programs in the memory; the operating system run in the processor; the operating system is divided into a plurality of containers isolated from each other, each of which is an isolated operation execution environment for application programs to run; the plurality of containers include the first container, the first container is any one of the plurality of containers; the file system can be divided into multiple file management structures independent of each other; wherein, the processor performs the following steps: for the multiple Each container in the container creates an independent virtual file system VFS instance, and configures an independent file management structure for each container in the file system through the VFS instance of each container, so that the multiple containers are configured with each other Independent VFS instance, and the plurality of containers are respectively configured with independent file management structures; when receiving a file operation request from the application program in the first container, the VFS instance of the first container is used to call the The file management structure of the first container operates on the files involved in the file operation request.

In a first possible implementation manner, the processor further performs the following steps: allocating a dedicated processing thread to the first container, and using the dedicated processing thread of the first container to process the The operation of the application program is processed, and after all the operations corresponding to the application program in the first container are processed, the processing thread dedicated to the first container is released.

With reference to the first possible implementation manner of the third aspect, in a second possible implementation manner, the processor further executes the following step: receiving an add message sent by the processing thread dedicated to the first container when it starts working; After the lock request, the file management structure of the first container is locked, and other processing threads are prohibited from accessing the file management structure of the first container; the unlocking message sent by the processing thread dedicated to the first container when finishing work is received After the request, the file management structure of the first container is unlocked.

With reference to the third aspect or the first or second possible implementation manner of the third aspect, in a third possible implementation manner, the processor further performs the following steps: receiving the application in the first container When a file operation request is issued by the program, the file system is invoked through the VFS instance of the first container, and the file operation request is sent to the file system; so that the file system can identify the source of the file operation request In the first container, operate the file involved in the file operation request in the file management structure of the first container.

It can be seen from the above that the embodiment of the present invention configures an independent VFS instance for each container, and configures an independent file management structure for each container in the underlying file system. When performing operations involving files, the VFS instance of the container The technical solution of invoking the file management structure of the container to operate the involved files has achieved the following technical effects:

On the one hand, by configuring an independent VFS instance and an independent file management structure for each container, real file isolation is realized between containers, which can completely shield file operations between containers and improve security;

On the other hand, by configuring an independent VFS instance and an independent file management structure for each container, each container can have a dedicated file system path. For operations involving files, there is no need to perform file path conversion and access control and collation. experience, reducing operational complexity and system overhead.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that are required in the description of the embodiments and prior art. Obviously, the accompanying drawings in the following description are only some implementations of the present invention For example, those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a flowchart of a virtualization method provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of the architecture of a container and a file system in an embodiment of the present invention;

FIG. 3 is a schematic diagram of a file system in an embodiment of the present invention;

Fig. 4a is a schematic diagram of a virtualization device provided by an embodiment of the present invention;

Fig. 4b is a schematic diagram of a virtualization device provided by another embodiment of the present invention;

Fig. 5 is a schematic diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

Embodiments of the present invention provide a virtualization method and device and computer equipment to solve the defects that the existing container virtualization technology cannot truly isolate files between containers, and the security is not enough; and the operation is complicated and the cost is large.

In order to enable those skilled in the art to better understand the solutions of the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

In the following, specific examples will be used to describe in detail respectively.

First, a brief introduction is made to the virtualization system involved in the technical solution of the present invention. The virtualization system mentioned in this embodiment is a computer system, including: a hardware layer, an operating system and a file system running on the hardware layer, the operating system is divided into multiple containers isolated from each other, and each The container is an isolated operation execution environment for application programs to run; the file system can be divided into multiple independent file management structures. in:

The hardware layer is the hardware platform on which the virtualization environment runs. The hardware layer can include a variety of hardware. For example, the hardware layer of a computing node can include a processor (such as CPU) and memory (such as memory), and can also include high-speed/low-speed input/output (I/O, Input /Output) device, and other devices with specific processing functions, such as IOMMU (Input/Output Memory Management Unit), where the IOMMU can be used for the translation of the physical address of the virtual machine and the physical address of the Host.

The container is an isolated operation execution environment separated from the operating system, and each container can be regarded as a part of the operating system (such as a Linux system). Applications of different users or organizations are executed in different containers. Data isolation can be provided between containers. In contrast to traditional virtualization, containers require neither instruction-level emulation nor on-the-fly translation. Containers can run instructions locally on the core CPU without any special interpretation mechanism. Additionally, containers avoid the complexities of paravirtualization and system call replacement. For the convenience of description, it is assumed herein that the above-mentioned multiple containers include the first container, and the first container may be any one of the multiple containers.

The said file system may be a file system integrated in the operating system, or an externally mounted file system. In the embodiment of the present invention, it is necessary to improve the file system so that each file system supports such a feature: the file system should be allowed to be divided into multiple mutually independent file management structures, or in other words, allowed to be divided into multiple mutually independent file management structures. Independent storage space.

In the computer system, the bottom layer can include multiple physical file systems, such as Ext4, etc. In order to make the multiple bottom file systems work uniformly, a virtual file system (VFS) can be provided on the bottom file system, and the VFS can combine multiple The underlying file system is unified and abstracted into a file system for users to use. The upper-layer application can use the API (Application Programming Interface, application programming interface) to call the VFS layer through the library, and the VFS then maps the operation to the corresponding underlying file system. VFS is the manager of the file system, which is created in memory by the operating system during initialization. VFS only exists in memory and does not exist in any external storage space. Moreover, the VFS is established when the system starts and dies when the system is shut down.

Referring to FIG. 1 , an embodiment of the present invention provides a virtualization method for the above virtualization system. Methods can include:

110. The operating system creates an independent virtual file system VFS instance for each of the plurality of containers, and configures an independent file management structure for each container in the file system through the VFS instance of each container, The multiple containers are respectively configured with mutually independent VFS instances, and the multiple containers are respectively configured with mutually independent file management structures.

As shown in FIG. 2 , it is a schematic diagram of the architecture of the container and the file system in the embodiment of the present invention. Compared with all containers sharing one VFS instance in the prior art, in the embodiment of the present invention, a computer operating system such as a Linux system can create multiple VFS instances, so as to configure an independent VFS instance for each container. By mounting the VFS instance configured for each container in the container, a unique matching relationship is established between each container and each VFS instance, and the application in each container can only call the VFS mounted in the container instance, but cannot call VFS instances of other containers. For example, taking Figure 2 as an example, VFS1 can be configured for Container1, and VFS2 can be configured for Container1.

As shown in FIG. 3 , it is a schematic diagram of a file system according to an embodiment of the present invention. The file system is generally organized in a file management tree. The file system in the existing computer system includes only one file management tree, which is shared by multiple containers, and the data of multiple containers can be interleavedly stored in any position of the file management tree. As shown in Figure 3, the file system of the embodiment of the present invention divides a plurality of mutually independent file management trees with the container as the unit, thereby configuring an independent file management tree for each container as the file management tree configured for the container structure. Each file management structure can be assigned a unique identification symbol by the computer operating system, for example, a serial number can be used to identify each file management structure.

Wherein, the file management structure of each container is configured to the container by the operating system through the VFS instance of the container in the file system. The VFS instance of a container abstracts all the details of the container's file management structure. Therefore, each container's VFS instance and file management structure have a unique matching relationship, and each container's VFS instance can only call the container. The file management structure of the container, but cannot call the file management structure of other containers.

It can be seen from the above that the technical solution of the present invention is designed and adapted for container virtualization from the perspective of the file system. By setting independent VFS instances and independent file management structures for containers, each container can only operate its own files.

It should be noted that, in the embodiment of the present invention, a structure in which a traditional single file management tree is divided into multiple trees is adopted to realize dividing a file system into multiple file management structures. However, in file systems organized in other forms, the file management structure can also be divided in other forms.

In the embodiment of the present invention, the computer system supports mounting an external file system. The mounted external file system needs to support the following features as described above: inside the file system, it is allowed to divide the container into multiple independent file management structures to support each A container configures an independent file management structure. In the embodiment of the present invention, the mounted external file system will be regarded as an independent underlying file system and mounted into the container. Mounting an external file system is a major feature of the Linux file system, and the embodiment of the present invention implements the extension of the file system by supporting this feature.

In the embodiment of the present invention, in order to improve system performance and provide support for parallel container operations, it is preferable to use a computer system with multi-core or many-core processors. The computer operating system can configure a dedicated processing thread for each container, so that The tasks of each container are executed by different processing threads, so that multiple containers have the capability of parallel processing. Among them, the processing thread of a certain container will be released back to the resource pool after the task is completed. For example: the operating system may assign a dedicated processing thread to the first container among the plurality of containers, and the processing thread dedicated to the first container processes the operation of the application program in the first container, and After all the operations corresponding to the application program in the first container are processed, the processing thread dedicated to the first container is released.

120. When the operating system receives a file operation request from an application program in the first container, it invokes the file management structure of the first container through the VFS instance of the first container to perform operations on the file operation request. file to operate.

In the prior art, since multiple containers share the VFS and the underlying file system, for operations involving files, the VFS needs to set a file system path conversion function for each container, for example: /->/home/lxc1/ , /root->/home/lxc1/root, etc.

In the embodiment of the present invention, since each container is configured with its own independent VFS instance, and each container is configured with an independent file management structure through the VFS instance of each container; therefore, there is no need to configure path conversion, and each container Each has its own fixed file system path.

When a container such as the application program in the first container needs to perform operations involving files, it will send a file operation request to the VFS instance of the first container. After receiving the file operation request, the VFS instance of the first container does not need to perform path conversion. The file management structure of the first container may be directly invoked to operate on the files involved in the file operation request.

Wherein, when the operating system receives the file operation request from the application program in the first container, it invokes the file management structure of the first container through the VFS instance of the first container to perform the file operation request related to Specifically, it may include: when the operating system receives a file operation request from an application program in the first container, calling the file system through the VFS instance of the first container, and transferring the Sending the file operation request to the file system; so that when the file system recognizes that the file operation request originates from the first container, the file operation request involved in the file management structure of the first container file to operate.

Assuming that container 1 is configured with an independent VFS instance 1, and VFS instance 1 has an independent file management structure 1 for the container 1 in file system 1, then the files of container 1 will be placed in the corresponding file management structure 1 . Then, if the application in container 1 needs to operate on file 1, it will issue a file operation request, call VFS instance 1, and call file system 1 through VFS instance 1, and the file operation request can include container 1 or file management structure 1 so that the file system 1 can identify it, and then the file system 1 can operate on the file 1 in the file management structure 1.

It can be seen that the files of each container will be placed in the file management structure corresponding to the container, and the application of each container can only use the VFS instance of the container to call the file system to operate on the files in the file management structure of the container. It cannot operate on other file management structures. Therefore, this solution can provide complete isolation between containers.

It should be noted that, in the technical solution of the present invention, it is assumed that two or more containers have files with the same name. Although the names of the files are the same, the two files will belong to different containers and different file management structures, and will be classified as Allocated in different storage spaces; that is, files with the same name are treated as different files and operated independently by each container.

Moreover, the technical solution of the present invention will not affect the performance of the file system in a separate container, because within a file system, an independent file management structure is configured for each container, an independent storage space is opened up, and an independent index node (inode) and Directory items (dentry), each container can only operate its own part, and this operation will not increase the load in a single container.

In addition, the technical solution of the present invention can improve the parallelism of the file system.

In the prior art, for multiple containers, the underlying file system is completely shared, so the file operation in one container will lock the entire file system, causing the processing thread of another container to wait when there is a task. Containers cannot be fully parallelized.

However, the technical solution of the present invention divides the underlying file system into multiple file management structures with containers as units, and each file management structure is logically completely independent. The operating system kernel can configure multiple kernel processing threads to handle kernel-related matters. Here, each container can be configured with a dedicated processing thread to handle file operations in the container.

Since each container is configured with an independent file management structure and an independent processing thread, when the processing thread of a container is working, it will only lock the file management structure of the container and will not affect other file management structures. The processing threads can work at the same time, so that the file operations between containers in the system can be completely parallel.

Specifically, when the processing thread dedicated to the first container among the above multiple containers starts working, it may send a lock request to the operating system, and the operating system may, after receiving the lock request, issue a lock request to the first container. The file management structure of a container is locked, and other processing threads are prohibited from accessing the file management structure of the first container; and, when the processing thread dedicated to the first container finishes working, it can send an unlock request to the operating system, The operating system may unlock the file management structure of the first container after receiving the unlock request.

It should be noted that, in the embodiment of the present invention, although each container is isolated from each other and cannot directly manipulate the files of other containers, it is allowed to share files between each container through network sharing or similar sharing methods .

It can be understood that the above solutions of the embodiments of the present invention may be specifically implemented in computer equipment, for example.

As can be seen from the above, the embodiment of the present invention configures an independent VFS instance for each container, and configures an independent file management structure for each container in the file system. When an application in any container performs an operation involving a file, through the The VFS instance of the container calls the file management structure of the container to operate the technical solution on the involved files, which has achieved the following technical effects:

On the one hand, by configuring an independent VFS instance and an independent file management structure for each container, real file isolation is realized between containers, which can completely shield file operations between containers and improve security; in the prior art, container The file system is shared between the containers, and the isolation between the containers is realized at the operating system level, so the isolation is not good and it is easy to be broken through; however, in the embodiment of the present invention, the isolation between the containers is realized at the file system level, which is truly complete isolation.

On the other hand, each container is configured with an independent VFS instance and an independent file management structure, so it has a fixed file system path. For operations involving files, there is no need to perform file path conversion and access control and verification, which reduces the number of operations. complexity and system overhead;

On the other hand, on the basis of configuring an independent VFS instance and file management structure for each container, and then configuring an independent processing thread for each container, so that multiple containers can achieve complete parallel operation;

In another aspect, the technical solution of the present invention can share the storage space of the operating system and maximize the utilization of the storage space of the file system.

In order to better implement the above solutions of the embodiments of the present invention, related devices for coordinating the implementation of the above solutions are also provided below.

Please refer to FIG. 4a, an embodiment of the present invention provides a virtualization device for a virtualization system, the virtualization system includes: a hardware layer, an operating system and a file system running on the hardware layer, and the operating system is Divided into a plurality of containers isolated from each other, each of the containers is an isolated operation execution environment for application programs to run; the plurality of containers include a first container, and the first container is the plurality of containers Any one container in; the file system can be divided into multiple file management structures independent of each other; the virtualization device is embedded (or integrated) in the operating system;

Virtualization appliances can include:

The configuration module 410 is configured to enable the operating system to create an independent virtual file system VFS instance for each of the plurality of containers, so that the operating system can create an independent virtual file system VFS instance for each container in the file system through the VFS instance of each container. Each container is configured with an independent file management structure, so that the multiple containers are respectively configured with mutually independent VFS instances, and the multiple containers are respectively configured with mutually independent file management structures;

An operation module 420, configured to enable the operating system to call the first container's The file management structure operates on the files involved in the file operation request.

In some embodiments of the present invention, the configuration module 420 is further configured to enable the operating system to allocate a dedicated processing thread for the first container, and the dedicated processing thread for the first container performs the processing for the first container. The operation of the application program in a container is processed, and after all the operations corresponding to the application program in the first container are processed, the operating system is made to release the processing thread dedicated to the first container.

As shown in Figure 4b, in some embodiments of the present invention, the system may further include: a locking and unlocking module 430, configured to enable the operating system to receive the message sent by the processing thread dedicated to the first container when it starts working. After the lock request, lock the file management structure of the first container to prohibit other processing threads from accessing the file management structure of the first container; and make the operating system receive the processing dedicated to the first container The thread unlocks the file management structure of the first container after completing the unlock request sent during the work.

In some embodiments of the present invention, the operation module 420 is specifically configured to enable the operating system to pass the first The VFS instance of the container calls the file system, and sends the file operation request to the file system; so that when the file system recognizes that the file operation request originates from the first container, the first The file involved in the file operation request is operated in the file management structure of the container.

It can be understood that the functions of each functional module of the virtualization device in the embodiment of the present invention can be specifically implemented according to the method in the above method embodiment, and the specific implementation process can refer to the relevant description in the above method embodiment, and will not be repeated here.

As can be seen from the above, the embodiment of the present invention configures an independent VFS instance for each container, and configures an independent file management structure for each container in the file system. When an application in any container performs operations involving files, the The VFS instance calls the file management structure of the container to operate the technical solution on the involved files, and has achieved the following technical effects:

On the one hand, by configuring an independent VFS instance and an independent file management structure for each container, real file isolation is realized between containers, which can completely shield file operations between containers and improve security;

On the other hand, each container is configured with an independent VFS instance and an independent file management structure, so it has a fixed file system path. For operations involving files, there is no need to perform file path conversion and access control and verification, which reduces the number of operations. complexity and system overhead;

On the other hand, on the basis of configuring an independent VFS instance and file management structure for each container, and then configuring an independent processing thread for each container, so that multiple containers can achieve complete parallel operation;

In another aspect, the technical solution of the present invention can share the storage space of the operating system and maximize the utilization of the storage space of the file system.

An embodiment of the present invention also provides a computer storage medium, which can store a program, and when the program is executed, some or all of the steps of the virtualization method described in the above method embodiments are included.

Please refer to FIG. 5, the embodiment of the present invention also provides a computer device 500, which may include:

The hardware layer, the hardware layer includes: a processor 510, a memory 520, a communication interface 530, and a bus 540, the processor 510, the memory 520, and the communication interface 530 communicate with each other through the bus 540; the communication interface 530 is used for receiving and sending data; the memory 520 is used to store programs; the processor 510 is used to execute the programs in the memory; the operating system runs in the processor 510 . The operating system is divided into a plurality of containers isolated from each other, each of which is an isolated operation execution environment for application programs to run; the plurality of containers include a first container, and the first container is Any one of the plurality of containers; the file system can be divided into a plurality of independent file management structures.

Wherein, the processor 510 performs the following steps: create an independent virtual file system VFS instance for each container in the plurality of containers, and configure an independent file for each container in the file system through the VFS instance of each container management structure, so that the multiple containers are respectively configured with mutually independent VFS instances, and the multiple containers are respectively configured with mutually independent file management structures; receiving a file operation request from an application program in the first container At this time, the file management structure of the first container is invoked through the VFS instance of the first container to operate on the file involved in the file operation request.

In some embodiments of the present invention, the processor 510 may also perform the following steps: assign a dedicated processing thread to the first container, and use the dedicated processing thread of the first container to process the application in the first container The operation of the program is processed, and after all the operations corresponding to the application program in the first container are processed, the processing thread dedicated to the first container is released.

In some embodiments of the present invention, the processor 510 may also perform the following steps: after receiving the lock request sent by the processing thread dedicated to the first container when starting to work, the file management structure of the first container Locking, prohibiting other processing threads from accessing the file management structure of the first container; after receiving the unlock request sent by the processing thread dedicated to the first container when finishing work, unlocking the file management structure of the first container .

In some embodiments of the present invention, the processor 510 may also perform the following steps: when receiving a file operation request from an application program in the first container, call the file system through the VFS instance of the first container , and send the file operation request to the file system; so that when the file system recognizes that the file operation request comes from the first container, in the file management structure of the first container, the The file involved in the file operation request is operated.

In some embodiments of the present invention, if the operations of two or more containers involve files with the same name, the file management structure of each container performs independent operations on the files involved in their respective storage spaces.

It can be understood that the functions of each functional module of the computer device in the embodiment of the present invention can be specifically implemented according to the method in the above method embodiment, and the specific implementation process can refer to the relevant description in the above method embodiment, and will not be repeated here.

It can be seen from the above that in some feasible implementations of the present invention, the embodiment of the present invention adopts an independent VFS instance for each container, and configures an independent file management structure for each container in the file system. When the application performs operations involving files, the VFS instance of the container invokes the technical solution of the container's file management structure to operate the involved files, achieving the following technical effects:

On the one hand, by configuring an independent VFS instance and an independent file management structure for each container, real file isolation is realized between containers, which can completely shield file operations between containers and improve security;

On the other hand, each container is configured with an independent VFS instance and an independent file management structure, so it has a fixed file system path. For operations involving files, there is no need to perform file path conversion and access control and verification, which reduces the number of operations. complexity and system overhead;

On the other hand, on the basis of configuring an independent VFS instance and file management structure for each container, and then configuring an independent processing thread for each container, so that multiple containers can achieve complete parallel operation;

In another aspect, the technical solution of the present invention can share the storage space of the operating system and maximize the utilization of the storage space of the file system.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because Certain steps may be performed in other orders or simultaneously in accordance with the present invention. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: ROM, RAM, disk or CD, etc.

The above is a detailed introduction of a virtualization method and device and computer equipment provided by the embodiment of the present invention. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The description of the above embodiment is only for helping Understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, the content of this specification is not It should be understood as a limitation of the present invention.

Claims (9)

1. a kind of virtual method, which is characterized in that be used for virtualization system；

The virtualization system includes: hardware layer, runs on operating system and file system on hardware layer, the operation system System is divided into the multiple containers being isolated from each other, each described container is the operation performing environment of an isolation, for supplying It is run with program；The multiple container includes the first container, and the first container is any one container in the multiple container； The file system can be divided into mutually independent multiple document structure managements；

The virtual method includes:

The operating system is that each container in the multiple container creates an independent Virtual File System VFS example, And the VFS example for passing through each container is that each container configures independent document structure management in file system, so that described Multiple containers are configured mutually independent VFS example respectively, and the multiple container is configured mutually independent file pipe respectively Manage structure；

When the operating system receives the file operation requests of the sending of the application program in the first container, pass through described first The file that the VFS example of container calls the document structure management of the first container to be related to the file operation requests is grasped Make；

After the operating system receives the locking request that the dedicated processing thread of the first container is sent when starting to work, The document structure management of the first container is locked, the file management knot of the first container described in other processing thread accesses is forbidden Structure；

It is right after the operating system receives the unlocking request that the dedicated processing thread of the first container is sent in power cut-off The document structure management of the first container unlocks.

2. the method according to claim 1, wherein the operating system receives the application in the first container Before the file operation requests that program issues, further includes:

The operating system is that the first container distributes a dedicated processing thread, by the dedicated processing of the first container Thread handles the operation of application program in the first container, the application program in corresponding to the first container After all operation processings, the dedicated processing thread of the first container is discharged.

3. method according to claim 1 or 2, which is characterized in that the VFS example by the first container is called The document structure management of the first container carries out operation to the file that the file operation requests are related to

The file system is called by the VFS example of the first container, and the file operation requests are sent to described File system；When identifying the file operation requests from the first container so as to the file system, described the The file being related in the document structure management of one container to the file operation requests operates.

4. a kind of virtualization apparatus, which is characterized in that be applied to virtualization system；

The virtualization system includes: hardware layer, runs on operating system and file system on hardware layer, the operation system System is divided into the multiple containers being isolated from each other, each described container is the operation performing environment of an isolation, for supplying It is run with program；The multiple container includes the first container, and the first container is any one container in the multiple container； The file system can be divided into mutually independent multiple document structure managements；The virtualization apparatus is embedded in the behaviour Make in system；

The virtualization apparatus includes:

Configuration module, for making each container in the multiple container of the operating system create an independent virtual text Part system VFS example, the VFS example for making the operating system pass through each container are that each container configuration is only in file system Vertical document structure management, so that the multiple container is configured mutually independent VFS example, and the multiple container point respectively It is not configured mutually independent document structure management；

Operation module, for making the operating system receive the file operation requests that the application program in the first container issues When, make the operating system call the document structure management of the first container to institute by the VFS example of the first container The file that file operation requests are related to is stated to be operated；

Locking and unlocked state are starting work for making the operating system receive the dedicated processing thread of the first container As when the locking request that sends after, the document structure management of the first container is locked, other processing thread accesses institute is forbidden State the document structure management of the first container；And the operating system is made to receive the dedicated processing thread of the first container After the unlocking request sent in power cut-off, the document structure management of the first container is unlocked.

5. device according to claim 4, it is characterised in that:

The configuration module is also used to that the operating system the first container is made to distribute a dedicated processing thread, by The dedicated processing thread of the first container, is handled the operation of application program in the first container, and corresponding to In the first container after all operation processings of application program, the operating system is set to discharge the first container dedicated Processing thread.

6. device according to claim 4 or 5, it is characterised in that:

The operation module, specifically for making the operating system receive the file that the application program in the first container issues When operation requests, the operating system is made to call the file system by the VFS example of the first container, and by the text Part operation requests are sent to the file system；So that the file system identifies the file operation requests from described When the first container, the file being related in the document structure management of the first container to the file operation requests is grasped Make.

7. a kind of computer equipment characterized by comprising

Hardware layer runs on operating system and file system on hardware layer；The hardware layer includes processor, memory, Communication interface, bus, the processor, memory, the communication interface communication mutual by the bus；The communication interface, For sending and receiving data；The memory is for storing program；

The processor is used to execute the described program in the memory；The operating system is in the processor； The operating system is divided into the multiple containers being isolated from each other, each described container is that the operation of an isolation executes ring Border, for being run for application program；The multiple container includes the first container, and the first container is in the multiple container Any one container；The file system can be divided into mutually independent multiple document structure managements；

Wherein, the processor executes following steps: independent virtual for each container creation one in the multiple container File system VFS example, and the VFS example for passing through each container is that each container configures independent file pipe in file system Structure is managed, so that the multiple container is configured mutually independent VFS example respectively, and the multiple container is configured phase respectively Mutual independent document structure management；When receiving the file operation requests that the application program in the first container issues, pass through institute State the file that the VFS example of the first container calls the document structure management of the first container to be related to the file operation requests It is operated；

The processor, which also executes the following steps:, receives what the dedicated processing thread of the first container was sent when starting to work After locking request, the document structure management of the first container is locked, the first container described in other processing thread accesses is forbidden Document structure management；It is right after receiving the unlocking request that the dedicated processing thread of the first container is sent in power cut-off The document structure management of the first container unlocks.

8. computer equipment according to claim 7, it is characterised in that:

The processor, which also executes the following steps:, distributes a dedicated processing thread for the first container, by described first The dedicated processing thread of container, handles the operation of application program in the first container, holds corresponding to described first In device after all operation processings of application program, the dedicated processing thread of the first container is discharged.

9. computer equipment according to claim 7 or 8, it is characterised in that:

The processor also executes the following steps: the file operation requests for receiving the sending of the application program in the first container When, the file system is called by the VFS example of the first container, and the file operation requests are sent to the text Part system；When identifying the file operation requests from the first container so as to the file system, described first The file being related in the document structure management of container to the file operation requests operates.