Session isolation configuration

1. Install dependencies

   macOS/Linux

   # Install with pip3
   pip3 install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   # If you encounter permission issues, use the --user argument
   pip3 install --user alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   # For macOS Homebrew Python environments, use --break-system-packages
   pip3 install --break-system-packages alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util

   Windows

   # Install with pip
   pip install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util
   # Or specify Python 3
   py -3 -m pip install alibabacloud_fc20230330 alibabacloud_credentials alibabacloud_tea_openapi alibabacloud_tea_util

2. Write the code to create a session

   Create a Python file (for example, createSession.py) and copy the following code into it, replacing the key parameters. This example shows how to create a session for "Tenant A" by mounting its dedicated NAS directory (<YOUR-NAS-SERVER-ADDR>:/tenant-a-data) to the instance's /mnt/data path, and specifying the user identity as UID=1001 and GID=1001.

   Key methods and parameters

   Important

   You can configure both dynamic session-based NAS mounting and static NAS mounting in the function's Configuration > Advanced Settings > Storage at the same time. However, note the following:

   • The User ID and Group ID defined in the NASConfig must match the User ID and Group ID used in the function's static mount settings.

   • The same mount path (mount_dir) cannot be used for both dynamic session mounting and static function mounting.

   • config.endpoint:

     • <Account ID>: Replace with your Alibaba Cloud account ID.

     • <Endpoint>: Refer to the Function Compute 3.0 Service Endpoints list. The format is fcv3.[region_id].aliyuns.com.

   • CreateSessionInput:

     • session_ttlin_seconds: The total lifecycle of the session, in seconds.

     • session_idle_timeout_in_seconds: The session's idle timeout period, in seconds.

   • client.create_session_with_options: Replace <Function Name> with the name of the function for which you are creating the session.

     • NASMountConfig: NAS mount configuration.

       • mount_dir: The mount path within the instance, for example, /home/test.

       • server_addr: The NAS file storage address and the tenant-specific subdirectory.

     • user_id: Specify a unique POSIX User ID for this session.

     • group_id: Specify a unique POSIX Group ID for this session.

   # -*- coding: utf-8 -*-
   from alibabacloud_fc20230330.client import Client as FC20230330Client
   from alibabacloud_credentials.client import Client as CredentialClient
   from alibabacloud_tea_openapi import models as open_api_models
   from alibabacloud_fc20230330 import models as fc20230330_models
   from alibabacloud_tea_util import models as util_models
   # 1. Create the account client.
   credential = CredentialClient()
   config = open_api_models.Config(credential=credential)
   config.endpoint = f'<Account ID>.<Endpoint>'
   client = FC20230330Client(config)
   # 2. Prepare the NAS mount configuration.
   nas_mount_config = fc20230330_models.NASMountConfig(
       mount_dir='/mnt/data',  # The mount path inside the instance
       server_addr='<YOUR-NAS-SERVER-ADDR>:/<tenant-a-path>'  # NAS file storage address and tenant-specific subdirectory
   )
   # 3. Configure NAS and user identity (assign a unique UID/GID to Tenant A).
   nas_config = fc20230330_models.NASConfig(
       mount_points=[nas_mount_config],
       user_id=1001,  # Specify a unique POSIX User ID for this session
       group_id=1001  # Specify a unique POSIX Group ID for this session
   )
   # 4. Construct the CreateSession request.
   create_session_input = fc20230330_models.CreateSessionInput(
       nas_config=nas_config,
       session_ttlin_seconds=3600,
       session_idle_timeout_in_seconds=600
   )
   create_session_request = fc20230330_models.CreateSessionRequest(
       body=create_session_input
   )
   # 5. Send the request.
   runtime = util_models.RuntimeOptions()
   response = client.create_session_with_options('<Function Name>', create_session_request, {}, runtime)
   # 6. Get the session ID from the response.
   print(response.body.to_map())
   session_id = response.body.session_id
   print(f"Session created successfully. Session ID: {session_id}")
   

3. Run the code

   export ALIBABA_CLOUD_ACCESS_KEY_ID=LTAI****************
   export ALIBABA_CLOUD_ACCESS_KEY_SECRET=<yourAccessKeySecret>
   python3 createSession.py

   Parameters

   • ALIBABA_CLOUD_ACCESS_KEY_ID: The AccessKey ID of your Alibaba Cloud account or RAM user.

   • ALIBABA_CLOUD_ACCESS_KEY_SECRET: The AccessKey Secret of your Alibaba Cloud account or RAM user.

4. Sample response

   {
     'containerId': 'c-********-********-************', 
     'createdTime': '2025-10-30T06:38:10Z', 
     'functionName': '****', 
     'lastModifiedTime': '2025-10-30T06:38:10Z', 
     'nasConfig': 
       {
         'groupId': 1001, 
         'mountPoints': [
           {
             'enableTLS': False, 
             'mountDir': '/home/test', 
             'serverAddr': '*-*.*.nas.aliyuncs.com:/test'
              }
                ], 
                'userId': 1001
                }, 
      'qualifier': 'LATEST', 
      'sessionAffinityType': 'HEADER_FIELD', 
      'sessionId': '******************', 
      'sessionIdleTimeoutInSeconds': 600, 
      'sessionStatus': 'Active', 
      'sessionTTLInSeconds': 3600
      }
   Session created successfully. Session ID: ************

Step 2: Use the mounted NAS

When you invoke the function, include the SessionID obtained in the previous step. The function instance can then access the mounted /mnt/data directory. The following example uses a Web function. Modify the code in your function and redeploy it.

import os
from flask import Flask, request, jsonify
# ... (app setup) ...
# Assume the NAS mount point is /mnt/data
NAS_MOUNT_PATH = '/mnt/data'
app = Flask(__name__)
@app.route('/<path:path>', methods=['GET', 'POST'])
def handle_nas_request(path):
    rid = request.headers.get('x-fc-request-id')
    print(f"FC Invoke Start RequestId: {rid}")
    # Construct the full file path on the NAS.
    # Note: Prevent path traversal attacks.
    safe_path = os.path.normpath(os.path.join(NAS_MOUNT_PATH, path))
    if not safe_path.startswith(NAS_MOUNT_PATH):
        return "Path traversal attempt detected!", 400
    response_data = {}
    if request.method == 'POST':
        # Write to file.
        body = request.data.decode('utf-8')
        try:
            with open(safe_path, 'w') as f:
                f.write(body)
            response_data['message'] = f"Successfully wrote to {safe_path}"
            print(f"Wrote to {safe_path}")
        except Exception as e:
            return str(e), 500
    elif request.method == 'GET':
        # Read from file.
        try:
            if os.path.exists(safe_path) and os.path.isfile(safe_path):
                with open(safe_path, 'r') as f:
                    content = f.read()
                response_data['content'] = content
                print(f"Read from {safe_path}")
            else:
                return f"File not found: {safe_path}", 404
        except Exception as e:
            return str(e), 500
    print(f"FC Invoke End RequestId: {rid}")
    return jsonify(response_data)  # Use jsonify to return a JSON-formatted response.
# ... (if __name__ == '__main__': block) ...

Triggers for automatic release

Manual release

You can manually delete a session by calling the DeleteSession API:

DELETE /services/{serviceName}/functions/{functionName}/sessions/{sessionId}

Upon successful deletion:

• The corresponding instance is released immediately.

• The routing rule becomes invalid.

• Subsequent requests that use the old session ID will be rejected or will trigger a new session, depending on the session ID reuse configuration.

  Note

  Session ID reuse configuration: When calling the CreateSession API, you can control whether a session ID can be reused by configuring the disableSessionIdReuse parameter.

  • The default value is false, which allows reuse. After a session expires, you can send a new request with the same SessionID. The system treats it as a new session and binds it to a new instance.

  • If set to true, the SessionID cannot be reused after the session expires.

How it works

This feature deeply integrates the NAS mount operation with the CreateSession API call. Using HeaderField affinity as an example, the overall process is as follows:

Preparation phase: Create and configure a session with storage

The goal of this phase is to create an isolated session environment that is bound to specific storage for later use.

1. Initiate a creation request: The backend management service calls the CreateSession API and specifies the NAS mount configuration and the user identity (UID/GID) for isolation in the request.

2. Instance preparation and mounting: After receiving a request, the Function Compute (FC) platform prepares a function instance that performs a NAS mount operation based on its configuration to mount a dedicated directory to a specified path, such as /mnt/data.

3. Bind and return ID: After a successful mount, the platform binds this instance to a newly generated, unique SessionID and returns the ID to the backend service.

Invocation phase: Use the configured session

This phase uses the prepared session environment to execute the actual business logic.

1. Make a call request: The backend management service calls the InvokeFunction API and passes the previously obtained SessionID in a specific HTTP request header, such as x-affinity-header-v1.

2. Request routing: The gateway and scheduler of the Function Compute platform use this SessionID to accurately route the request to the specific bound function instance.

3. Code execution: The function code is executed in this instance. At this point, because the environment and permissions are pre-configured, the code can directly read from and write to the mounted NAS directory.

4. Return result: After a function completes execution, the result is returned layer by layer to the original caller.

Key features

For example, Tenant A (UID=10001) cannot read files belonging to Tenant B (UID=10002), even if they are on the same NAS.