IP Library › Granted Patent US 12681751
Granted Patent B2
US 12681751 · App. 18/478,910 · Granted Jul 14, 2026

Method and apparatus for starting secure container

Inventors: Huamin Tang (Hangzhou, CN); Yupeng Chen (Hangzhou, CN)
Assignee: Cloud Intelligence Assets Holding (Singapore) Private Limited
G06F9/45558G06F2009/45562G06F2009/45575G06F2009/45587G06F2009/45591
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12681751
App. No.
18/478,910
Granted
Jul 14, 2026
Kind
B2
Abstract

A method and an apparatus for starting a secure container are provided. The method includes: adding a container image into a secure container in a read-only manner when starting a first container corresponding to the container image in the secure container; aggregating a read-write layer of the first container with the container image in the secure container to obtain a file system of the first container; and aggregating a read-write layer of a second container with the container image when starting the second container corresponding to the added container image in the secure container to obtain a file system of the second container.

Claims (50)

1 . A method implemented by a computing device, the method comprising:

adding a container image into a secure container in a read-only manner when starting a first container corresponding to the container image in the secure container;

aggregating a read-write layer of the first container with the container image in the secure container to obtain a file system of the first container; and

aggregating a read-write layer of a second container with the container image when starting the second container corresponding to the added container image in the secure container to obtain a file system of the second container, wherein aggregating the read-write layer of the second container with the added container image in the secure container when starting the second container corresponding to the container image in the secure container to obtain the file system of the second container, comprises:

detecting a transfer of the container image to the secure container;

determining whether the container image has been added into the secure container when the transfer of the container image to the secure container is detected, wherein determining whether the container image has been added into the secure container comprises:

determining whether a current reference count corresponding to the container image is an initial value;

if the current reference count is the initial value, determining that the container image has not been added into the secure container; and

if the current reference count is not the initial value, determining that the container image has been added to the secure container, wherein the current reference count corresponding to the container image is updated accordingly when the container image is used by any container and when a task of the any container that uses the container image is finished; and

if determining that the container image has been added into the secure container, aggregating the read-write layer of the second container with the added container image in the secure container to obtain the file system of the second container.

2 . The method according to claim 1 , further comprising:

when starting a third container, in a virtual machine kernel of the secure container, creating a read-write layer directory from a directory of a storage medium according to a unique identifier of the third container and assigning thereof to the third container.

3 . The method according to claim 1 , wherein adding the container image into the secure container in the read-only manner comprises:

adding a block device of the container image into the secure container in the read-only manner through a storage driver of a block device on a host machine, the block device storing the container image, wherein the storage driver of the block device on the host machine stores the container image in a form of block device according to a block device type defined in a configuration file of the secure container.

4 . The method according to claim 3 , wherein adding the block device of the container image into the secure container in the read-only manner through the storage driver of the block device on the host machine comprises:

receiving a block device delivered by the storage driver on the host machine; and

mounting the block device on an image directory in the secure container, and recording a path of an image directory of the block device, wherein aggregating the read-write layer of the second container with the added container image in the secure container comprises: aggregating a path of the read-write layer of the second container with the path of the image directory of the block device in the secure container to obtain a path of the file system of the second container.

5 . The method according to claim 1 , further comprising:

determining whether to delete the container image from the secure container according to a preset deletion policy after tasks of all containers corresponding to the container image are finished.

6 . One or more non-transitory computer readable media storing executable instructions that, when executed by one or more processors, cause the one or more processors to perform acts comprising:

adding a container image into a secure container in a read-only manner when starting a first container corresponding to the container image in the secure container;

aggregating a read-write layer of the first container with the container image in the secure container to obtain a file system of the first container; and

aggregating a read-write layer of a second container with the container image when starting the second container corresponding to the added container image in the secure container to obtain a file system of the second container, wherein aggregating the read-write layer of the second container with the added container image in the secure container when starting the second container corresponding to the container image in the secure container to obtain the file system of the second container, comprises:

detecting a transfer of the container image to the secure container;

determining whether the container image has been added into the secure container when the transfer of the container image to the secure container is detected, wherein determining whether the container image has been added into the secure container comprises:

determining whether a current reference count corresponding to the container image is an initial value;

if the current reference count is the initial value, determining that the container image has not been added into the secure container; and

if the current reference count is not the initial value, determining that the container image has been added to the secure container, wherein the current reference count corresponding to the container image is updated accordingly when the container image is used by any container and when a task of the any container that uses the container image is finished; and

if determining that the container image has been added into the secure container, aggregating the read-write layer of the second container with the added container image in the secure container to obtain the file system of the second container.

7 . The one or more non-transitory computer readable media according to claim 6 , the acts further comprising:

when starting a third container, in a virtual machine kernel of the secure container, creating a read-write layer directory from a directory of a storage medium according to a unique identifier of the third container and assigning thereof to the third container.

8 . The one or more non-transitory computer readable media according to claim 6 , wherein adding the container image into the secure container in the read- only manner comprises:

adding a block device of the container image into the secure container in the read-only manner through a storage driver of a block device on a host machine, the block device storing the container image, wherein the storage driver of the block device on the host machine stores the container image in a form of block device according to a block device type defined in a configuration file of the secure container.

9 . The one or more non-transitory computer readable media according to claim 8 , wherein adding the block device of the container image into the secure container in the read-only manner through the storage driver of the block device on the host machine comprises:

receiving a block device delivered by the storage driver on the host machine; and

mounting the block device on an image directory in the secure container, and recording a path of an image directory of the block device, wherein aggregating the read-write layer of the second container with the added container image in the secure container comprises: aggregating a path of the read-write layer of the second container with the path of the image directory of the block device in the secure container to obtain a path of the file system of the second container.

10 . The one or more non-transitory computer readable media according to claim 6 , the acts further comprising:

determining whether to delete the container image from the secure container according to a preset deletion policy after tasks of all containers corresponding to the container image are finished.

11 . An apparatus comprising:

one or more processors;

memory;

an adding module stored in the memory and executable by the one or more processors to add a container image into a secure container in a read-only manner when starting a first container corresponding to the container image in the secure container;

a detection module stored in the memory and executable by the one or more processors to detect a transfer of the container image to the secure container;

an image determination module stored in the memory and executable by the one or more processors to determine whether the container image has been added to the secure container when detecting the transfer of the container image to the secure container, wherein the image determination module comprises:

a reference count determination submodule configured to determine whether a current reference count corresponding to the container image is an initial value;

a first reference determination module configured to determine that the container image has not been added to the secure container if the current reference count is the initial value; and

a re-reference determination module configured to determine that the container image has been added to the secure container if the current reference count is not the initial value;

a first merge module stored in the memory and executable by the one or more processors to aggregate a read-write layer of the first container with the container image in the secure container to obtain a file system of the first container; and

a second merge module stored in the memory and executable by the one or more processors to aggregate a read-write layer of a second container with the container image when starting the second container corresponding to the added container image in the secure container to obtain a file system of the second container.

12 . The apparatus according to claim 11 , wherein: the adding module is configured to add the container image to the secure container in the read-only manner if the image determination module determines that the container image has not been added to the secure container; and the second merge module is configured to aggregate the read-write layer of the second container with the added container image in the secure container to obtain the file system of the second container if the image determination module determines that the container image has not been added to the secure container.