CN118590395A - A network management method, system, electronic device and storage medium for container - Google Patents

Abstract

The application discloses a network management method, a network management system, electronic equipment and a storage medium of a container, and belongs to the technical field of container management technology. The network management method of the container comprises the following steps: creating a network bridge on a host machine, and carrying out network configuration on the network bridge; starting a target container on the host; generating a corresponding container end virtual network card in each target container respectively, and generating a corresponding bridge end virtual network card for each container end virtual network card in the bridge; creating a plurality of mobile network cards by dialing the first container, and generating a policy routing table; the policy routing table is used for describing the mapping relation between the container and the mobile network card; and routing the data packet transmitted by the target container through the network bridge to the corresponding mobile network card according to the strategy routing table. The application can set network isolation for the container and improve the network management capability of the container.

Description

A network management method, system, electronic device and storage medium for container

Technical Field

The present application relates to the technical field of container management, and in particular to a network management method, system, electronic device and storage medium for a container.

Background Art

Container is a virtualization technology that runs on a host machine and is used for resource isolation. Multiple containers can run on a host machine, and each container can access the local area network, or the Internet through a mobile network card or a WLAN (Wireless Local Area Network) card. However, in related technologies, there is no network isolation between containers, and network resource allocation cannot be achieved.

Therefore, how to set up network isolation for containers and improve the network management capabilities of containers is a technical problem that technical personnel in this field currently need to solve.

Summary of the invention

The purpose of the present application is to provide a network management method for a container, a network management system for a container, an electronic device and a storage medium, which can set network isolation for the container and improve the network management capability of the container.

In order to solve the above technical problems, the present application provides a network management method for a container, the method comprising:

Create a network bridge on the host machine and perform network configuration on the network bridge;

Starting a target container on the host machine; wherein the target container includes: a first container for implementing mobile network dialing, a second container for implementing Android application interface interaction, and a third container for implementing instrument application interface interaction;

Generate a corresponding container-side virtual network card in each of the target containers, and generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards;

Using the first container to dial up and create multiple mobile network cards, and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card;

The data packet transmitted by the target container through the bridge is routed to the corresponding mobile network card according to the policy routing table.

Optionally, also include:

Adding a first firewall rule to the first container so that a first tag is added to a data packet sent by the first container through the corresponding container-side virtual network card;

Adding a second firewall rule to the second container so that a second tag is added to a data packet sent by the second container through the corresponding container-side virtual network card;

Accordingly, the first container is used to dial up and create multiple mobile network cards, and a policy routing table is generated, including:

Using the first container to dial up and create a first mobile network card and a second mobile network card;

Generate the policy routing table including a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is a mapping relationship between the first tag and the first mobile network card, and the second mapping relationship is a mapping relationship between the second tag and the second mobile network card.

Optionally, routing the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table includes:

Routing the data packet transmitted by the first container through the bridge to the first mobile network card according to the policy routing table;

The data packet transmitted by the second container through the bridge is routed to the second mobile network card according to the policy routing table.

Optionally, also include:

Query the network namespace of the WLAN physical network card;

Add the network namespace of the WLAN physical network card to the network namespace of the second container.

Optionally, also include:

Setting the default network type of the second container to Ethernet;

Set the DNS address of the container-side virtual network card corresponding to the second container according to the configuration file;

Set the default gateway of the second container to the IP address of the bridge.

Optionally, also include:

Setting the default gateway of the first container to the IP address of the bridge;

Correspondingly, after dialing and creating multiple mobile network cards using the first container, the method further includes:

The DNS address used for the dial-up operation of the first container is set to the DNS address of the first container.

Optionally, a network bridge is created on the host machine, and network configuration of the network bridge is performed, including:

Use a network bridging tool to create the bridge on the host machine, and configure a default IP address for the bridge according to a configuration file.

The present application also provides a network management system for a container, the system comprising:

A network bridge creation module, used to create a network bridge on the host machine and perform network configuration on the network bridge;

A container startup module, used to start a target container on the host machine; wherein the target container includes: a first container for implementing mobile network dialing, a second container for implementing Android application interface interaction, and a third container for implementing instrument application interface interaction;

A peer-to-peer network establishment module, used to generate a corresponding container-side virtual network card in each of the target containers, and to generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards;

A dialing module, used to dial up multiple mobile network cards using the first container, and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card;

A data routing module is used to route the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

The present application also provides a storage medium on which a computer program is stored. When the computer program is executed, the steps of the network management method for the container are implemented.

The present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps executed by the network management method of the container are implemented.

The present application creates a bridge on the host machine and performs network configuration; the bridge can forward data packets from different network interfaces, and the above-mentioned network isolation mechanism can enable each container to have an independent network namespace, avoiding network interference and conflict between containers. After starting the target container on the host machine, a corresponding container-side virtual network card can be generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card can be generated in the bridge. The above-mentioned setting method of the virtual network card can ensure that each container can access the network independently and does not interfere with each other. The present application also uses the first container to dial to create multiple mobile network network cards, and generates a policy routing table, and routes the data packets transmitted by the target container through the bridge to the corresponding mobile network network card according to the policy routing table. Therefore, the present application can set network isolation for the container and improve the network management capabilities of the container. The present application also provides a network management system, a storage medium and an electronic device for a container, which have the above-mentioned beneficial effects and are not repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a flow chart of a network management method for a container provided by an embodiment of the present application;

FIG2 is a schematic diagram of the structure of the host user space in the related art;

FIG3 is a schematic diagram of the structure of a host user space provided in an embodiment of the present application;

FIG. 4 is a schematic diagram of the structure of a network management system for a container provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

Please refer to FIG. 1 below, which is a flow chart of a network management method for a container provided in an embodiment of the present application.

Specific steps may include:

S101: Create a network bridge on the host machine, and perform network configuration on the network bridge;

Among them, this embodiment can be applied to electronic devices such as smart phones, tablet computers, and computers, which can run containers and bridges as hosts. A bridge is a network device that works at the data link layer and can connect multiple different containers and communicate with each other. After creating a bridge, the network configuration of the bridge can be performed, such as setting static routing, enabling IP forwarding, configuring firewall rules, etc. As a feasible implementation method, this embodiment can use the network bridging tool brctl to create the bridge on the host machine, and configure the default IP address for the bridge according to the configuration file.

S102: Start a target container on the host machine;

Among them, this embodiment can start the target container on the host machine through a specific command or tool. After the target container is started, the target container will run the specified application or service and interact with the host machine and other containers to achieve specific business logic or functional requirements. The target container includes a first container, a second container and a third container. The first container is used to implement mobile network dialing, the second container is used to implement Android application interface interaction, and the third container is used to implement instrument application interface interaction. This embodiment does not limit the number of each of the above target containers.

S103: Generate a corresponding container-side virtual network card in each of the target containers, and generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards;

Among them, this embodiment can generate virtual network cards in the target container and the bridge to establish a peer-to-peer network; specifically, a corresponding container-side virtual network card is generated in each of the target containers, and a corresponding bridge-side virtual network card is generated in the bridge for each container-side virtual network card, that is, the number of bridge-side virtual network cards is the same as the number of target containers.

The container-side virtual network card enables the container to communicate in the network, and the bridge-side virtual network card serves as the interface between the bridge and the container, responsible for forwarding traffic between the container and the external network. The above method ensures the isolation and forwarding efficiency of container network traffic, thereby improving the network performance and security of the entire system.

S104: Use the first container to dial up and create multiple mobile network cards, and generate a policy routing table;

Among them, the first container is a container for implementing mobile network dialing, and a dialing application may exist in the first container to implement the dialing function. In this embodiment, the first container can be used to dial to create multiple mobile network network cards, and a policy routing table can also be generated. The policy routing table is used to describe the mapping relationship between the container and the mobile network network card. The above process uses the first container to dial to create a mobile network network card. In combination with the mobile network network card and the policy routing table, flexible access to the mobile network by the container can be achieved.

Specifically, in this embodiment, a dial-up operation can be performed through the first container to create multiple mobile network cards. These mobile network cards allow the target container to connect to the external mobile network so as to enable the target container to access the mobile network. The policy routing table is used to determine the mobile network card through which the data packets sent by each container should pass for forwarding.

S105: Routing the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

The target container can send data packets to the corresponding bridge-side virtual network card in the bridge through the container-side virtual network card, and the host can route the data packets to the corresponding mobile network card based on the policy routing table to achieve access to the Internet. The above-mentioned target container can also achieve access to the local area network through the bridge.

This embodiment creates a bridge on the host machine and performs network configuration; the bridge can forward data packets from different network interfaces. Through the above-mentioned network isolation mechanism, each container can have an independent network namespace, avoiding network interference and conflicts between containers. After starting the target container on the host machine, a corresponding container-side virtual network card can be generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card can be generated in the bridge. The above-mentioned setting method of the virtual network card can ensure that each container can access the network independently and does not interfere with each other. This embodiment also uses the first container to dial to create multiple mobile network network cards, and generates a policy routing table. According to the policy routing table, the data packets transmitted by the target container through the bridge are routed to the corresponding mobile network network card. Therefore, this embodiment can set network isolation for the container and improve the network management capabilities of the container.

As a further introduction to the embodiment corresponding to FIG. 1 , after starting the target container, corresponding firewall rules can be added to the target container. In the above manner, when the target container sends data packets through its corresponding container-side virtual network card, the firewall will automatically add preset tags to these data packets. These tags can be any information that can distinguish different containers or different network traffic.

Specifically, in this embodiment, a first firewall rule may be added to the first container so that a first tag is added to a data packet sent by the first container through the corresponding container-side virtual network card; a second firewall rule may be added to the second container so that a second tag is added to a data packet sent by the second container through the corresponding container-side virtual network card.

Furthermore, this embodiment can also use the first container to dial up and create the first mobile network card and the second mobile network card; on this basis, generate the policy routing table containing the first mapping relationship and the second mapping relationship; wherein the first mapping relationship is the mapping relationship between the first tag and the first mobile network card, and the second mapping relationship is the mapping relationship between the second tag and the second mobile network card. The routing table constructed in the above manner contains multiple mapping relationships, each mapping relationship corresponds the previously added tag to a specific mobile network card.

On the basis of adding the first firewall rule and the second firewall rule, and creating the first mobile network network card and the second mobile network network card, the data packets transmitted by the first container through the bridge can be routed to the first mobile network network card according to the policy routing table; the data packets transmitted by the second container through the bridge can also be routed to the second mobile network network card according to the policy routing table.

Specifically, when the first container sends data packets through the bridge, the bridge will check the tags in these data packets. After the bridge can find the first mobile network card corresponding to this tag by consulting the policy routing table, it can route these data packets to the first mobile network card, thereby enabling the first container to access the mobile network. When the second container sends data packets through the bridge, the bridge will check the tags in these data packets. After the bridge can find the second mobile network card corresponding to this tag by consulting the policy routing table, it can route these data packets to the second mobile network card, thereby enabling the second container to access the mobile network. The above method can ensure the correct forwarding and efficient management of container network traffic.

As a feasible implementation, the network namespace of the WLAN physical network card can also be queried, and the network namespace of the WLAN physical network card can be added to the network namespace of the second container. In this way, the second container can access the Internet through the WLAN physical network card, and the containers (i.e., the first container and the third container) that do not add the WLAN physical network card in the network namespace cannot access the Internet through the WLAN physical network card.

As a feasible implementation, the second container can also be configured in the following manner: setting the default network type of the second container to Ethernet; setting the dns (Domain Name System) address of the container-side virtual network card corresponding to the second container according to the configuration file; setting the default gateway of the second container to the IP address of the bridge. The above manner can ensure the stability and efficiency of the second container in network communication, so that the second container can interact smoothly with other containers or external networks to meet different business needs.

As a feasible implementation, the first container can also be configured in the following manner: the default gateway of the first container is set to the IP (Internet Protocol) address of the bridge; after using the first container to dial up and create multiple mobile network cards, the DNS address used for the dial-up operation of the first container is set to the DNS address of the first container. The above configuration can ensure the stability and efficiency of the first container in network communication, so that the first container can interact smoothly with other containers or external networks.

The process described in the above embodiment is explained below by starting a network management solution of three containers on Android in actual application.

Please refer to Figure 2, which is a schematic diagram of the structure of the host user space in the related technology. The host user space Host userspace includes a first container, a second container and a third container. The first container runs an application tbox app for dialing, the second container runs an application Android app for interacting with the Android application interface, and the third container runs an application cluster app for interacting with the instrument application interface. The first container can create mobile network network cards apn1 and apn2, and the second container can be connected to the WLAN physical network card. The above three containers are started on the Android system, and the Android startup part outside the container is named host. The first container is used to implement mobile network dialing, also known as the tbox container; the second container is used to implement the interaction of the Android app ui, also known as the ivi container; the third container is used to implement the interaction of the instrument app ui, also known as the cluster container.

In the related scheme, after the tbox container is started, the tbox app dials the two-way apn of the mobile network. After the ivi container is started, the Android app opens the WLAN network. The host and the three containers can use the two-way apn mobile network, and the host and the three containers can use the WLAN network. In the above scheme, the container does not have a separate network namespace, and network isolation is not implemented; there is no overall network management strategy in the above scheme, and it is impossible to allocate mobile network and WLAN network resources, nor to restrict the network of a single container. The network namespace net namespace is an isolated environment with a separate network stack (network card, routing table, iptables). The network namespace is used to isolate network devices and services.

In order to solve the defects of the above-mentioned related technologies, the present application provides a network management solution based on starting three containers on Android, which can realize network allocation and network restriction of multiple containers.

Please refer to Figure 3, which is a schematic diagram of the structure of a host user space provided by an embodiment of the present application. The host user space Host userspace includes a first container, a second container, a third container and a bridge bridge br0. The network namespace netns (net namespace) of the first container includes an application tbox app and an eth virtual network card (i.e., a container-side virtual network card), the network namespace netns of the second container includes an application Android app, an eth virtual network card and a WLAN physical network card, and the network namespace netns of the third container includes an application cluster app and an eth virtual network card. The bridge includes a bridge-side virtual network card tbox_peer corresponding to the eth virtual network card of the first container, a bridge-side virtual network card ivi_peer corresponding to the eth virtual network card of the second container, and a bridge-side virtual network card ic_peer corresponding to the eth virtual network card of the third container. The first container can create mobile network cards apn1 and apn2.

Specifically, in this embodiment, during the Android startup configuration process, the following operations A1 to A4 may be performed:

Operation A1: Configure the network bridge on the host machine.

Specifically, in this operation, before starting the first container, the second container, and the third container, the init process of the host machine Host can be used to use the network bridge tool brctl to configure the bridge br0 on the host machine and start the bridge br0. The default IP address of the bridge br0 can also be configured, such as 192.168.0.0/24. The init process is the number one process in the user space started by Android, and all user processes are incubated by the init process.

Action A2: Set the container's launch configuration and add the virtual network card to the bridge.

Specifically, when the first container, the second container, and the third container are started, a veth pair virtual network card (i.e., container-side virtual network card) is generated according to the configuration file, and a peer-to-peer network is created. One end of the network is assigned to the container, and the other end is connected to the bridge specified by lxc.network.link, which is specified by the lxc.network.veth.pair option. In the above manner, a container-side virtual network card can be added to the first container, the second container, and the third container, and a bridge-side virtual network card can be added to the bridge, so that the container-side virtual network card and the bridge-side virtual network card form a peer-to-peer network.

After the above operations A1 and A2 are performed, the local area network of the first container, the second container and the third container can be built, and the IP addresses of different network namespaces can be obtained through the bridge.

Operation A3: Perform network configuration on the second container.

Specifically, this operation can set the default network type of the second container to Ethernet, without the need to set other information of the virtual network card separately. This operation can also set the DNS address of the eth virtual network card in the second container (such as 8.8.8.8 or 114.114.114.114), so that the application in the second container can access the Internet domain name. This operation can also switch the network namespace of the WLAN physical network card to the network namespace of the second container, so that the WLAN network is only used by the second container. This operation can also set the default gateway of the second container to the bridge IP address. This operation can also add firewall rules in the second container, so that all data packets going out of the second container virtual network card interface are marked with a specific mark 02.

Operation A4: Perform network configuration on the first container.

Specifically, this operation can set the default gateway of the first container to the bridge IP address, and can also add a firewall rule for the first container so that all data packets going out from the virtual network card interface of the first container are marked with a specific mark01.

Specifically, in this embodiment, during the configuration process after starting the mobile network, the following operations B1 to B2 may be performed:

Operation B1: Perform network configuration on the first container.

Specifically, the first container can use the tbox app to dial up and create mobile network cards apn1 and apn2. This operation can also set the dns address used for dialing up as the dns address of the first container, for example: ip ro add${DNS_IP}dev${IFACE_NAME}.

Operation B2: Set the policy routing table iptable mark in the host environment.

Specifically, in this embodiment, a policy routing table can be added in the host environment, and all packets carrying MARK go through the created policy routing table. The above policy routing table can send packets carrying source mark MARK 02 from the mobile network card apn2, and can also send packets carrying source mark MARK 01 from the mobile network card apn1.

In the above scheme, the first container, the second container and the third container all achieve network isolation by starting a separate network namespace. The first container and the second container can access the local area network and the Internet through the veth virtual network card and the bridge, and the third container can only access the local area network.

In this solution, mobile network cards apn1 and apn2 are distinguished by the policy routing table. Mobile network card apn1 can only be used by the first container, and mobile network card apn2 can only be used by the second container; WLAN network can only be used by the second container, and is invisible to the host environment and other containers. It can be seen that this solution is based on the principles of Android and container network namespaces, relying on veth virtual network cards and bridge bridging, and through the configuration of policy routing tables, the network of each container is independently distributed, and the network capabilities of each container and the host can be controlled.

If this solution is used, the second container starts WLAN network verification to achieve the following effects: the Android app in the second container can use the WLAN network to access the Internet normally; the WLAN physical network card in the host environment is invisible and cannot access the Internet; the WLAN physical network card in the third container is invisible and cannot access the Internet; the WLAN physical network card in the first container is invisible and cannot access the Internet.

If this solution is used, the following effects can be achieved by starting mobile network verification in the first container: the Internet can be accessed normally in the first container; the Internet can be accessed normally in the second container; the host cannot access the Internet; the third container cannot access the Internet; the policy routing is captured and tested to be effective normally, the second container uses the mobile network apn2, and the first container uses the mobile network card apn1.

If this solution is used, the third container network cannot access the local area network, the third container can access the second container virtual network card IP address and the first container virtual network card IP address, and the host cannot access the Internet in the scenario of WLAN network and mobile network connection.

Please refer to FIG. 4 , which is a schematic diagram of the structure of a network management system for a container provided in an embodiment of the present application;

The system may include:

A network bridge creation module 401 is used to create a network bridge on a host machine and perform network configuration on the network bridge;

A container startup module 402 is used to start a target container on the host machine; wherein the target container includes: a first container for implementing mobile network dialing, a second container for implementing Android application interface interaction, and a third container for implementing instrument application interface interaction;

A peer-to-peer network establishing module 403, used to generate a corresponding container-side virtual network card in each of the target containers, and to generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards;

The dialing module 404 is used to dial up multiple mobile network cards using the first container and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card;

The data routing module 405 is used to route the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table.

This embodiment creates a bridge on the host machine and performs network configuration; the bridge can forward data packets from different network interfaces. Through the above-mentioned network isolation mechanism, each container can have an independent network namespace, avoiding network interference and conflicts between containers. After starting the target container on the host machine, a corresponding container-side virtual network card can be generated in each target container, and a bridge-side virtual network card corresponding to each container-side virtual network card can be generated in the bridge. The above-mentioned setting method of the virtual network card can ensure that each container can access the network independently and does not interfere with each other. This embodiment also uses the first container to dial to create multiple mobile network network cards, and generates a policy routing table. According to the policy routing table, the data packets transmitted by the target container through the bridge are routed to the corresponding mobile network network card. Therefore, this embodiment can set network isolation for the container and improve the network management capabilities of the container.

Furthermore, it also includes:

a rule configuration module, configured to add a first firewall rule to the first container so that a first tag is added to a data packet sent by the first container through the corresponding container-side virtual network card; and to add a second firewall rule to the second container so that a second tag is added to a data packet sent by the second container through the corresponding container-side virtual network card;

Correspondingly, the dialing module 404 uses the first container to dial to create multiple mobile network network cards, and the process of generating a policy routing table includes: using the first container to dial to create a first mobile network network card and a second mobile network network card; generating the policy routing table including a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is a mapping relationship between the first tag and the first mobile network network card, and the second mapping relationship is a mapping relationship between the second tag and the second mobile network network card.

Further, the data routing module 405 routes the data packets transmitted by the target container through the bridge to the corresponding mobile network network card according to the policy routing table, including: routing the data packets transmitted by the first container through the bridge to the first mobile network network card according to the policy routing table; routing the data packets transmitted by the second container through the bridge to the second mobile network network card according to the policy routing table.

Furthermore, it also includes:

The WLAN management module is used to query the network namespace of the WLAN physical network card; and is also used to add the network namespace of the WLAN physical network card to the network namespace of the second container.

Furthermore, it also includes:

The second container configuration module is used to set the default network type of the second container to Ethernet; it is also used to set the DNS address of the container-side virtual network card corresponding to the second container according to the configuration file; it is also used to set the default gateway of the second container to the IP address of the bridge.

Furthermore, it also includes:

The first container configuration module is used to set the default gateway of the first container to the IP address of the bridge; and is also used to set the DNS address used for the dial-up operation of the first container to the DNS address of the first container after creating multiple mobile network cards by dialing using the first container.

Furthermore, the process in which the bridge creation module 401 creates a bridge on the host machine and performs network configuration on the bridge includes: using a network bridging tool to create the bridge on the host machine, and configuring a default IP address for the bridge according to a configuration file.

Since the embodiments of the system part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the system part, which will not be repeated here.

The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

The present application also provides an electronic device, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the electronic device may also include various network interfaces, power supplies and other components.

The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims (10)

1. A container network management method, comprising: Create a network bridge on the host machine and perform network configuration on the network bridge; Starting a target container on the host machine; wherein the target container includes: a first container for implementing mobile network dialing, a second container for implementing Android application interface interaction, and a third container for implementing instrument application interface interaction; Generate a corresponding container-side virtual network card in each of the target containers, and generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards; Using the first container to dial up and create multiple mobile network cards, and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card; The data packet transmitted by the target container through the bridge is routed to the corresponding mobile network card according to the policy routing table. 2. The network management method for a container according to claim 1, further comprising: Adding a first firewall rule to the first container so that a first tag is added to a data packet sent by the first container through the corresponding container-side virtual network card; Adding a second firewall rule to the second container so that a second tag is added to a data packet sent by the second container through the corresponding container-side virtual network card; Accordingly, the first container is used to dial up and create multiple mobile network cards, and a policy routing table is generated, including: Using the first container to dial up and create a first mobile network card and a second mobile network card; Generate the policy routing table including a first mapping relationship and a second mapping relationship; wherein the first mapping relationship is a mapping relationship between the first tag and the first mobile network card, and the second mapping relationship is a mapping relationship between the second tag and the second mobile network card. 3. The network management method for a container according to claim 2, characterized in that routing the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table, comprising: Routing the data packet transmitted by the first container through the bridge to the first mobile network card according to the policy routing table; The data packet transmitted by the second container through the bridge is routed to the second mobile network card according to the policy routing table. 4. The network management method for a container according to claim 1, further comprising: Query the network namespace of the WLAN physical network card; Add the network namespace of the WLAN physical network card to the network namespace of the second container. 5. The network management method for a container according to claim 1, further comprising: Setting the default network type of the second container to Ethernet; Set the DNS address of the container-side virtual network card corresponding to the second container according to the configuration file; Set the default gateway of the second container to the IP address of the bridge. 6. The network management method for a container according to claim 1, further comprising: Setting the default gateway of the first container to the IP address of the bridge; Correspondingly, after dialing and creating multiple mobile network cards using the first container, the method further includes: The DNS address used for the dial-up operation of the first container is set to the DNS address of the first container. 7. The network management method for a container according to claim 1, characterized in that creating a network bridge on a host machine and performing network configuration on the network bridge comprises: Use a network bridging tool to create the bridge on the host machine, and configure a default IP address for the bridge according to a configuration file. 8. A network management system for a container, comprising: A network bridge creation module, used to create a network bridge on the host machine and perform network configuration on the network bridge; A container startup module, used to start a target container on the host machine; wherein the target container includes: a first container for implementing mobile network dialing, a second container for implementing Android application interface interaction, and a third container for implementing instrument application interface interaction; A peer-to-peer network establishment module, used to generate a corresponding container-side virtual network card in each of the target containers, and to generate a corresponding bridge-side virtual network card in the bridge for each of the container-side virtual network cards; A dialing module, used to dial up multiple mobile network cards using the first container, and generate a policy routing table; wherein the policy routing table is used to describe the mapping relationship between the container and the mobile network card; A data routing module is used to route the data packet transmitted by the target container through the bridge to the corresponding mobile network card according to the policy routing table. 9. An electronic device, characterized in that it comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the network management method for the container according to any one of claims 1 to 7 are implemented. 10. A storage medium, characterized in that the storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by a processor, the steps of the network management method for a container according to any one of claims 1 to 7 are implemented.