Container-based task execution method and apparatus

Patent metadata

Field	Value
Publication number	US-12505203-B2
Application number	US-202218571877-A
Country	US
Kind code	B2
Filing date	Jul 12, 2022
Priority date	Aug 24, 2021
Publication date	Dec 23, 2025
Grant date	Dec 23, 2025

Abstract

Embodiments of this specification provide a container-based task execution method and apparatus. The method can be performed by a container management platform. When receiving a task description file that is for a to-be-executed task and that is submitted by a user, the container management platform can determine whether a first identifier of a first image file carried in the description file is in a whitelist, where the first identifier can be added to the whitelist when it is determined that specified executable file information included in the first image file is secure; and if the first identifier is in the whitelist, considers that the to-be-executed task is secure, and can execute the to-be-executed task based on a container group created by using the task description file and the specified executable file information included in the first image file.

First claim

What is claimed is:

1 . A container-based task execution method, comprising:
receiving a submitted task description file for a to-be-executed task, wherein the task description file comprises a first identifier of a first image file; upon determining that the first identifier is in a whitelist, detecting whether there is specified executable file information in the task description file, wherein the first identifier is added to the whitelist in accordance with a determination that specified executable file information comprised in the first image file is secure; upon detecting that there is no specified executable file information in the task description file, creating a container group by using the task description file, and executing the to-be-executed task based on the container group and the specified executable file information comprised in the first image file.

2 . The method according to claim 1 , wherein receiving the submitted task description file for the to-be-executed task comprises:
receiving the task description file that is for the to-be-executed task and that is obtained based on an input operation performed by a user.

3 . The method according to claim 1 , further comprising:
upon determining that the first identifier is not in the whitelist, rejecting execution of the to-be-executed task.

4 . The method according to claim 1 , wherein detecting whether there is specified executable file information in the task description file comprises:
detecting whether an executable file field in the task description file is in an unset state, and upon detecting that the executable file field in the task description file is in the unset state, determining that there is no specified executable file information in the task description file.

5 . The method according to claim 4 , wherein the unset state comprises that a field value is a null value, or the field value is a preset value identifying that the field value is unavailable.

6 . The method according to claim 1 , further comprising:
upon detecting that there is specified executable file information in the task description file, rejecting execution of the to-be-executed task.

7 . The method according to claim 1 , wherein the method is performed by a container management platform.

8 . The method according to claim 7 , wherein the container management platform comprises an admission layer and a management layer;
the admission layer receives the submitted task description file for the to-be-executed task, wherein the task description file comprises the first identifier of the first image file; upon determining that the first identifier is in the whitelist, detects whether there is specified executable file information in the task description file; and upon detecting that there is no specified executable file information in the task description file, sends the task description file to the management layer; and the management layer executes the to-be-executed task based on the container group created by using the task description file and the specified executable file information comprised in the first image file.

9 . The method according to claim 7 , wherein executing the to-be-executed task comprises:
generating a container group description file based on the task description file; and executing the to-be-executed task based on the container group created by using the container group description file and the specified executable file information comprised in the first image file.

10 . The method according to claim 9 , wherein executing the to-be-executed task based on the container group created by using the container group description file and the specified executable file information comprised in the first image file comprises:
creating the container group by using the container group description file, and executing the to-be-executed task based on the container group and the specified executable file information comprised in the first image file.

11 . The method according to claim 9 , wherein executing the to-be-executed task comprises:
sending the container group description file to a specified node device, so that the node device creates the container group by using the container group description file, and executes the to-be-executed task by using the container group and the specified executable file information comprised in the first image file.

12 . The method according to claim 7 , wherein the container management platform is further configured to deploy the to-be-executed task to a server and a plurality of service party devices; and executing the to-be-executed task comprises:
generating a first container group description file for the server based on the task description file, wherein the first container group description file comprises configuration information for the server; respectively generating second container group description files for the plurality of service party devices based on the task description file, wherein the second container group description files respectively comprise configuration information for corresponding service party devices; sending the plurality of generated container group description files to the corresponding server and service party devices, so that the server and the service party devices create container groups by using the respective container group description files, and execute the to-be-executed task based on the respectively created container groups and the specified executable file information comprised in the first image file.

13 . A computing device comprising:
a memory, and a processor coupled to the memory, the processor configured to execute a container management platform, including an admission layer and a management layer, wherein the admission layer is configured to receive a submitted task description file for a to-be-executed task, wherein the task description file comprises an identifier of a first image file; upon determining that the first identifier is in a whitelist, detects whether there is specified executable file information in the task description file; and upon detecting that there is no specified executable file information in the task description file, sends the task description file to the management layer, wherein the first identifier is added to the whitelist upon determining that specified executable file information comprised in the first image file is secure; and the management layer is configured to execute the to-be-executed task based on a container group created by using the task description file and the specified executable file information comprised in the first image file.

14 . A non-transitory computer-readable storage medium comprising instructions stored therein that, when executed by a processor of a computing device, cause the processor to:
receive a submitted task description file for a to-be-executed task, wherein the task description file comprises a first identifier of a first image file; upon determining that the first identifier is in a whitelist, detect whether there is specified executable file information in the task description file, wherein the first identifier is added to the whitelist in accordance with a determination that specified executable file information comprised in the first image file is secure; upon detecting that there is no specified executable file information in the task description file, create a container group by using the task description file, and execute the to-be-executed task based on the container group and the specified executable file information comprised in the first image file.

Assignees

• Alipay Hangzhou Inf Tech Co Ltd

Inventors

• Lu yu fei
• Wu ting cheng
• Chen Xing Yu
• Hu Xiao Long

Classifications

• G06F21/565

  by checking file integrity · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title