Method and system for accessing and starting Docker container of TLS authentication based on Websocket
Technical Field
The invention relates to the technical field of cloud computing, in particular to a method and a system for accessing and starting a Docker container of TLS authentication based on Websocket.
Background
Docker (Docker is a LXC-based advanced container engine that is an open source for the DotCloud of PaaS providers, with source code hosted on Github, open source based on the go language and compliant with the Apache2.0 protocol) is an open source application container engine that allows developers to package their applications and dependency packages into a portable container and then distribute it to any popular Linux machine.
Conventionally, to secure communications in a Docker container environment, the TLS protocol is typically used for encrypted transport (TLSTransport Layer Security is used to provide confidentiality and data integrity between two communicating applications). That is, by creating a self-signed certificate file and using a-TLS-verify command line option when running a Docker Daemon (Docker Daemon is a Daemon running in the background in the Docker container architecture), the server of the Docker container opens TLS authentication. Only clients that own the TLS key file can connect to the server of the Docker container. The server of the Docker container remains secure as long as the encrypted keys between the server and the client of the Docker container are secure. A key file is created on the server of the Docker container and distributed to trusted clients, and clients holding the key file can connect to the server of the Docker container.
WebSocket is a new protocol of HTML 5. The full duplex communication between the browser and the server is realized, server resources and bandwidth can be better saved, real-time communication is achieved, the full duplex communication is established on a TCP (transmission control protocol), data are transmitted through the TCP as HTTP, but the full duplex communication is different from HTTP in the greatest extent: the WebSocket is a two-way communication protocol, and after connection is established, the WebSocket server and the Browser/Client Agent can actively send or receive data to each other; WebSocket requires that a client side similar to TCP and a server side are connected through handshaking, and can communicate with each other only after the connection is successful.
The Docker container provides an interface to connect through websockets. However, in the Docker container environment where TLS authentication is started, it is impossible to establish a Websocket connection and access the Docker container directly through the interface.
Disclosure of Invention
The technical task of the invention is to provide a method and a system for accessing a Docker container for starting TLS authentication based on Websocket, so as to solve the problem that Websocket connection cannot be directly established and the Docker container cannot be accessed through the interface in the Docker container environment for starting TLS authentication in the prior art.
The technical task of the present invention is achieved in the following way,
the method for accessing the Docker container starting TLS authentication based on the Websocket comprises a Websocket client and a Websocket server; the method comprises the following steps:
(1) selecting a Docker container to be accessed and initiating an access request by a user through accessing a Web interface;
(2) the Web interface starts a Websocket client to apply for a Websocket object and sends a connection request;
(3) the Websocket server side starts a port monitoring request, acquires a Docker container ID transmitted by the Websocket client side after receiving a Websocket client side connection request, and queries a host machine IP address where the Docker container is located;
(4) loading a TLS certificate file of a host machine where the Docker container is located by the Websocket server;
(5) the Websocket server generates a URL address of a Docker container interface through a host machine IP address and the ID of the Docker container;
(6) the Websocket server establishes Websocket connection to the Docker container through the URL address of the Docker container interface and provides the Websocket connection for the Websocket client to use;
(7) and the Websocket client successfully establishes connection, and opens a Web page containing the console terminal for the user to use.
In the step (2), the request parameters of the Websocket object are the address and the port of the Websocket server and the ID of the Docker container.
And the TLS certificate file takes the Websocket server as an agent, establishes the connection between the Websocket client and the Docker container, and remotely enters the Docker container for starting TLS authentication.
A system for initiating TLS authenticated Docker containers based on Websocket access, comprising
① access request unit, which is used to select the Docker container to be accessed on the Web interface and initiate the access request;
② Websocket communication unit for providing information interaction and realizing bidirectional communication function;
the Websocket communication unit comprises a Websocket client and a Websocket server,
the Websocket client comprises a connection request unit,
the connection request unit is used for applying for a Websocket object and sending out a connection request by starting the Websocket client on a Web interface;
the Websocket server comprises a monitoring unit, a TLS authentication unit, an acquisition unit and a Websocket connection unit,
the monitoring unit is used for monitoring a connection request of the Websocket client, acquiring a Docker container ID transmitted by the Websocket client and inquiring a host machine IP address where the Docker container is located;
the TLS authentication unit loads a TLS certificate file of a host machine where the Docker container is located and is used for providing confidentiality and complete data access;
the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring the IP address of a host machine and the ID of a Docker container to generate the URL address of a Docker container interface;
the Websocket connecting unit is used for establishing Websocket connection to the Docker container through the URL address of the Docker container interface and providing the Websocket connection for the Websocket client to use;
③ the Websocket client successfully establishes connection for opening a Web page containing a console terminal for a user to use.
The Websocket object request parameters applied by the connection request unit are Websocket server side addresses and ports and the ID of the Docker container.
Loading a TLS certificate file of a host machine where a Docker container is located through a Websocket server, using the Websocket server as an agent, establishing connection between a Websocket client and the Docker container, and entering the Docker container for starting TLS authentication remotely.
Compared with the prior art, the method and the system for starting the Docker container of TLS authentication based on WebSocket access have the following advantages:
1. according to the method and the system for starting the Docker container based on WebSocket access TLS authentication, the TLS certificate file of the host machine where the Docker container is located is loaded through the WebSocket server, the WebSocket server is used as a proxy, the connection between the WebSocket client and the Docker container is established, remote access to the Docker container for starting the TLS authentication is realized, any transformation on the Docker container is not needed, and the method and the system can be realized based on WebSocket connection;
2. loading a TLS certificate file of a host machine where the Docker container is located, wherein the TLS certificate file is used for providing confidentiality and complete data access, and the access security is improved;
3. the method and the system for starting the Docker container of TLS authentication based on WebSocket access have the characteristics of simplicity and convenience in use, reliability, good expansibility and the like, and have good popularization and use values.
Drawings
The invention is further described below with reference to the accompanying drawings.
Fig. 1 is a flow diagram of a method and system for accessing a Docker container for initiating TLS authentication based on WebSocket.
Detailed Description
A method for Web access to a Docker container of the present invention is described in detail below with reference to the drawings and the detailed description.
Example 1:
the invention discloses a method for accessing and starting a Docker container of TLS authentication based on Websocket, wherein the Websocket comprises a Websocket client and a Websocket server; the method comprises the following steps:
(1) selecting a Docker container to be accessed and initiating an access request by a user through accessing a Web interface;
(2) the Web interface starts a Websocket client to apply for a Websocket object and sends a connection request;
(3) the Websocket server side starts a port monitoring request, acquires a Docker container ID transmitted by the Websocket client side after receiving a Websocket client side connection request, and queries a host machine IP address where the Docker container is located;
(4) loading a TLS certificate file of a host machine where the Docker container is located by the Websocket server;
(5) the Websocket server generates a URL address of a Docker container interface through a host machine IP address and the ID of the Docker container;
(6) the Websocket server establishes Websocket connection to the Docker container through the URL address of the Docker container interface and provides the Websocket connection for the Websocket client to use;
(7) and the Websocket client successfully establishes connection, and opens a Web page containing the console terminal for the user to use.
Example 2:
the invention discloses a method for accessing and starting a Docker container of TLS authentication based on Websocket, wherein the Websocket comprises a Websocket client and a Websocket server; the method comprises the following steps:
(1) selecting a Docker container to be accessed and initiating an access request by a user through accessing a Web interface;
(2) the Web interface starts a Websocket client to apply for a Websocket object and sends a connection request;
(3) the Websocket server side starts a port monitoring request, acquires a Docker container ID transmitted by the Websocket client side after receiving a Websocket client side connection request, and queries a host machine IP address where the Docker container is located;
(4) loading a TLS certificate file of a host machine where the Docker container is located by the Websocket server;
(5) the Websocket server generates a URL address of a Docker container interface through a host machine IP address and the ID of the Docker container;
(6) the Websocket server establishes Websocket connection to the Docker container through the URL address of the Docker container interface and provides the Websocket connection for the Websocket client to use;
(7) and the Websocket client successfully establishes connection, and opens a Web page containing the console terminal for the user to use.
In step (2), the request parameters of the Websocket object are the Websocket server-side address and port and the ID of the Docker container.
Example 3:
the invention discloses a method for accessing and starting a Docker container of TLS authentication based on Websocket, wherein the Websocket comprises a Websocket client and a Websocket server; the method comprises the following steps:
(1) selecting a Docker container to be accessed and initiating an access request by a user through accessing a Web interface;
(2) the Web interface starts a Websocket client to apply for a Websocket object and sends a connection request;
(3) the Websocket server side starts a port monitoring request, acquires a Docker container ID transmitted by the Websocket client side after receiving a Websocket client side connection request, and queries a host machine IP address where the Docker container is located;
(4) loading a TLS certificate file of a host machine where the Docker container is located by the Websocket server;
(5) the Websocket server generates a URL address of a Docker container interface through a host machine IP address and the ID of the Docker container;
(6) the Websocket server establishes Websocket connection to the Docker container through the URL address of the Docker container interface and provides the Websocket connection for the Websocket client to use;
(7) and the Websocket client successfully establishes connection, and opens a Web page containing the console terminal for the user to use.
In step (2), the request parameters of the Websocket object are the Websocket server-side address and port and the ID of the Docker container.
And the TLS certificate file takes the Websocket server as an agent, establishes the connection between the Websocket client and the Docker container, and remotely enters the Docker container for starting TLS authentication.
Example 4:
the system for starting the Docker container of TLS authentication based on Websocket access comprises
① access request unit, which is used to select the Docker container to be accessed on the Web interface and initiate the access request;
② Websocket communication unit for providing information interaction and realizing bidirectional communication function;
the Websocket communication unit comprises a Websocket client and a Websocket server,
the Websocket client comprises a connection request unit,
the connection request unit is used for applying for a Websocket object and sending out a connection request by starting the Websocket client on a Web interface;
the Websocket server comprises a monitoring unit, a TLS authentication unit, an acquisition unit and a Websocket connection unit,
the monitoring unit is used for monitoring a connection request of the Websocket client, acquiring a Docker container ID transmitted by the Websocket client and inquiring a host machine IP address where the Docker container is located;
the TLS authentication unit loads a TLS certificate file of a host machine where the Docker container is located and is used for providing confidentiality and complete data access;
the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring the IP address of a host machine and the ID of a Docker container to generate the URL address of a Docker container interface;
the Websocket connecting unit is used for establishing Websocket connection to the Docker container through the URL address of the Docker container interface and providing the Websocket connection for the Websocket client to use;
③ the Websocket client successfully establishes connection for opening a Web page containing a console terminal for a user to use.
Example 5:
the system for starting the Docker container of TLS authentication based on Websocket access comprises
① access request unit, which is used to select the Docker container to be accessed on the Web interface and initiate the access request;
② Websocket communication unit for providing information interaction and realizing bidirectional communication function;
the Websocket communication unit comprises a Websocket client and a Websocket server,
the Websocket client comprises a connection request unit,
the connection request unit is used for applying for a Websocket object and sending out a connection request by starting the Websocket client on a Web interface;
the Websocket server comprises a monitoring unit, a TLS authentication unit, an acquisition unit and a Websocket connection unit,
the monitoring unit is used for monitoring a connection request of the Websocket client, acquiring a Docker container ID transmitted by the Websocket client and inquiring a host machine IP address where the Docker container is located;
the TLS authentication unit loads a TLS certificate file of a host machine where the Docker container is located and is used for providing confidentiality and complete data access;
the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring the IP address of a host machine and the ID of a Docker container to generate the URL address of a Docker container interface;
the Websocket connecting unit is used for establishing Websocket connection to the Docker container through the URL address of the Docker container interface and providing the Websocket connection for the Websocket client to use;
③ the Websocket client successfully establishes connection for opening a Web page containing a console terminal for a user to use.
The Websocket object request parameters applied by the connection request unit are Websocket server side addresses and ports and the ID of the Docker container.
Example 6:
the system for starting the Docker container of TLS authentication based on Websocket access comprises
① access request unit, which is used to select the Docker container to be accessed on the Web interface and initiate the access request;
② Websocket communication unit for providing information interaction and realizing bidirectional communication function;
the Websocket communication unit comprises a Websocket client and a Websocket server,
the Websocket client comprises a connection request unit,
the connection request unit is used for applying for a Websocket object and sending out a connection request by starting the Websocket client on a Web interface;
the Websocket server comprises a monitoring unit, a TLS authentication unit, an acquisition unit and a Websocket connection unit,
the monitoring unit is used for monitoring a connection request of the Websocket client, acquiring a Docker container ID transmitted by the Websocket client and inquiring a host machine IP address where the Docker container is located;
the TLS authentication unit loads a TLS certificate file of a host machine where the Docker container is located and is used for providing confidentiality and complete data access;
the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring the IP address of a host machine and the ID of a Docker container to generate the URL address of a Docker container interface;
the Websocket connecting unit is used for establishing Websocket connection to the Docker container through the URL address of the Docker container interface and providing the Websocket connection for the Websocket client to use;
③ the Websocket client successfully establishes connection for opening a Web page containing a console terminal for a user to use.
The Websocket object request parameters applied by the connection request unit are Websocket server side addresses and ports and the ID of the Docker container.
Loading a TLS certificate file of a host machine where a Docker container is located through a Websocket server, using the Websocket server as an agent, establishing connection between a Websocket client and the Docker container, and entering the Docker container for starting TLS authentication remotely.
The present invention can be easily implemented by those skilled in the art from the above detailed description. It should be understood, however, that the present invention is not limited to the 6 specific embodiments described above. On the basis of the disclosed embodiments, a person skilled in the art can combine different technical features at will, thereby implementing different technical solutions.
In addition to the technical features described in the specification, the technology is known to those skilled in the art.