Container-oriented Linux kernel virtualizing system and method thereof

Patent metadata

Field	Value
Publication number	US-12242877-B2
Application number	US-202217661991-A
Country	US
Kind code	B2
Filing date	May 4, 2022
Priority date	Sep 17, 2021
Publication date	Mar 4, 2025
Grant date	Mar 4, 2025

Abstract

The present invention relates to a container-oriented Linux kernel virtualizing system, at least comprising: a virtual kernel constructing module, being configured to provide a virtual kernel customization template for a user to edit and customize a virtual kernel of a container, and generate the virtual kernel taking a form of a loadable kernel module based on the edited virtual kernel customization template; and a virtual kernel instance module, being configured to reconstruct and isolate a Linux kernel, and operate a virtual kernel instance in a separate address space in response to a kernel request from a corresponding container. The container-oriented Linux kernel virtualizing system of the present invention is based on the use of a loadable module.

First claim

What is claimed is:

1. A container-oriented Linux kernel virtualizing system, at least comprising:
a virtual kernel constructing module, being configured to provide a virtual kernel customization template for a user to edit and customize a virtual kernel of a container, and generate the virtual kernel taking a form of a loadable kernel module based on the edited virtual kernel customization template; and
a virtual kernel instance module, being configured to reconstruct and isolate a Linux kernel, and operate a virtual kernel instance in a separate address space in response to a kernel request from a corresponding container, wherein the system further comprises a virtual kernel loading/unloading module, which is for loading the corresponding virtual kernel into the Linux kernel when the container is launched, maintaining mapping relationship between the container and the virtual kernel, and/or unloading and deleting the virtual kernel when a lifecycle of the container ends; and
a virtual kernel managing module, which is configured to:
intercept a kernel-call request made by the container, and when the container makes a the kernel-call request, based on a predefined hook collection and a corresponding ftrace callback function, forward the kernel-call request of the container to the virtual kernel instance for processing.

2. The system of claim 1 , wherein the virtual kernel instance module is for creating and initializing the virtual kernel instance, and/or providing the container with virtual kernel services, and/or multiplexing other parts of the Linux kernel.

3. The system of claim 2 , wherein the virtual kernel instance module at least comprises a reconstruction sub-module and a security sub-module, wherein
the reconstruction sub-module is for reconstructing configurations and parameters in the Linux kernel, and/or for calling a call table that has Linux kernel reconstructed; and
the security sub-module is for providing the virtual kernel with a separate running address space and performing local integration and optimization on a global security module of the Linux kernel.

4. The system of claim 3 , wherein the virtual kernel constructing module is further configured to:
allow the user to select how the virtual kernel is customized;
semantically parse a user-edited customization file so as to generate a virtual kernel source code;
compile the virtual kernel source code, so as to output the obtained virtual kernel in the form of a loadable kernel module; and
store the virtual kernel in the form of a loadable kernel module into a warehouse for subsequent use.

5. The system claim 4 , wherein the virtual kernel constructing module is further configured to:
semantically parse the customization file to acquire virtual kernel configurations, parameters, and a call table and write them into the virtual kernel source code;
semantically parse call-filtering rules, and write parameter detection obtained from parsing into the corresponding kernel call source code;
semantically parse file permission detection rules, and write a file and permission information obtained from parsing into a data structure of the virtual kernel source code; and
integrate parts of custom source codes to generate the virtual kernel source code.

6. The system of claim 5 , wherein the virtual kernel loading/unloading module is further configured to:
monitor container operation through a runc runtime, wherein:
if creation of a container is monitored, acquiring the corresponding virtual kernel from the virtual kernel warehouse according to a container name of the container;
combining the container id of the container and the virtual kernel name to rename a virtual kernel module;
loading the virtual kernel module into the Linux kernel;
sending an initialization request to the virtual kernel instance module; and
loading the corresponding virtual kernel.

7. A container-oriented Linux kernel virtualizing method, at least comprising:
providing a virtual kernel customization template for a user to edit and customize;
generating the virtual kernel taking a form of a loadable kernel module based on the virtual kernel customization template; and
reconstructing and isolating a Linux kernel, and operating a virtual kernel instance in a separate address space in response to a kernel request from a corresponding container; and
the method further comprising loading the corresponding virtual kernel into the Linux kernel when the container is launched, and maintaining mapping relationship between the container and the virtual kernel, and/or unloading and deleting the virtual kernel when a lifecycle of the container ends;
intercepting a kernel-call request made by the container; and
when the container makes the kernel-call request, based on a predefined hook collection and a corresponding ftrace callback function, forwarding the kernel-call request of the container to the virtual kernel instance for processing.

8. The method of claim 7 , further comprising:
the virtual kernel instance module creating and initializing the virtual kernel instance, and/or providing the container with virtual kernel services, and/or multiplexing other parts of the Linux kernel.

9. The method of claim 8 , wherein the virtual kernel instance module at least comprises a reconstruction sub-module and a security sub-module, wherein
the reconstruction sub-module is for reconstructing configurations and parameters in the Linux kernel, and/or for calling a call table that has Linux kernel reconstructed; and
the security sub-module is for providing the virtual kernel with a separate running address space and performing local integration and optimization on a global security module of the Linux kernel.

10. The method of claim 9 , further comprising:
allowing the user to select how the virtual kernel is customized;
semantically parsing a user-edited customization file so as to generate a virtual kernel source code;
compiling the virtual kernel source code, so as to output the obtained virtual kernel in the form of a loadable kernel module; and
storing the virtual kernel in the form of a loadable kernel module into a warehouse for subsequent use.

11. The method of claim 10 , further comprising:
semantically parsing the customization file to acquire virtual kernel configurations, parameters, and a call table and writing them into the virtual kernel source code;
semantically parsing call-filtering rules, and write parameter detection obtained from parsing into the corresponding kernel call source code;
semantically parsing file permission detection rules, and writing a file and permission information obtained from parsing into a data structure of the virtual kernel source code; and
integrating parts of custom source codes to generate the virtual kernel source code.

12. The method of claim 11 , further comprising:
monitoring container operation through a runc runtime, wherein:
if creation of a container is monitored, acquiring the corresponding virtual kernel from the virtual kernel warehouse according to a container name of the container;
combining the container id of the container and the virtual kernel name to rename a virtual kernel module;
loading the virtual kernel module into the Linux kernel;
sending an initialization request to the virtual kernel instance module; and
loading the corresponding virtual kernel.

13. The method of claim 12 , wherein
the virtual kernel loading/unloading module renames virtual kernels in the Linux kernel based on the container id,
after solving the naming conflict by means of the renaming mechanism, the PID namespace of the container and the vi

Assignees

• Univ Huazhong Science Tech

Inventors

• Wu Song
• Huang Hang
• Wang Kun
• Wang Honglei
• Jin Hai

Classifications

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title