US 12,443,430 B2
Data processing method based on container engine and related device
Yuan Yue, Beijing (CN); Luping Liu, Beijing (CN); and Zhiqiang Dong, Beijing (CN)
Assigned to Tencent Cloud Computing (Beijing) Co., Ltd., Beijing (CN)
Filed by Tencent Cloud Computing (Beijing) Co., Ltd., Beijing (CN)
Filed on Apr. 18, 2023, as Appl. No. 18/302,100.
Application 18/302,100 is a continuation of application No. PCT/CN2021/107698, filed on Jul. 21, 2021.
Claims priority of application No. 202110286214.X (CN), filed on Mar. 17, 2021.
Prior Publication US 2023/0259386 A1, Aug. 17, 2023
Int. Cl. H04L 9/40 (2022.01); G06F 3/04842 (2022.01); G06F 9/455 (2018.01); G06F 16/9535 (2019.01); G06F 16/9538 (2019.01); H04L 15/16 (2006.01)
CPC G06F 9/45558 (2013.01) [H04L 63/20 (2013.01); G06F 2009/45587 (2013.01); G06F 2009/45595 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A data processing method based on a container engine, performed by a computer device and comprising:
generating a container creation process according to a creation request for an isolation container when a container engine daemon obtains the creation request, the container creation process being used for creating the isolation container;
forwarding the creation request from the container engine daemon to a security policy agent component in response to detecting that the container creation process is started;
acquiring, from the creation request by using the security policy agent component, creation dependency resource information of the isolation container;
acquiring a valid policy file of a container engine corresponding to the isolation container by using the security policy agent component;
performing validity verification on the creation dependency resource information based on the valid policy file, to obtain a validity verification result of the isolation container; and
creating the isolation container when the validity verification result is a valid result, wherein the performing the validity verification on the creation dependency resource information based on the valid policy file to obtain the validity verification result comprises:
searching the valid policy file for invalid privileged field information by using the security policy agent component;
searching for target privileged field information in the creation dependency resource information when the invalid privileged field information is first privileged state information; and
determining the validity verification result based on whether the target privileged field information is found in the creation dependency resource information.