Container image storage method, system, computer device and computer storage medium

Abstract

The present disclosure provides a container image storage method, system, computer device and computer-readable storage medium, wherein the method includes: constructing a security detection identification chain for the container image; determining the first security level category of the container image based on the security detection identification chain; and storing the container image in a corresponding image repository based on the first security level category. The present disclosure divides the security level of the container image based on the security detection identification chain, and stores the container image in an image repository of the corresponding security level according to the security level, so as to at least solve the current storage security problem of the container image. When the image is deployed in the container, different image repositories can be used according to different security level requirements, thereby ensuring the security of various applications in the container while effectively improving the convenience of obtaining and using the container image and improving the user experience.

Description

Technical Field

[0001] The present disclosure relates to the technical field of container images, and in particular to a container image storage method, a container image storage system, a computer device, and a computer-readable storage medium. Background Art

[0002] As a type of cloud native technology, container technology is widely used due to its fast and efficient, high portability, and low resource consumption. As the basis for container operation, images are widely deployed in containers with the extensive use of containers. The image repository (Docker Hub) is the location where images are stored and is also an important channel for obtaining images. Currently, the main image repositories include public repositories and private repositories. Among them, public repositories are widely used by users due to their large number of images, ease of use, and openness. In this case, many security issues are also generated. Relevant research reports show that more than 30% of official images in the image repository contain high-risk vulnerabilities, and nearly 70% of images have high-risk or medium-risk vulnerabilities. At the same time, due to the open nature of the image repository, it is often exploited by hackers to implant malware such as Trojans and backdoors when making images, and upload malicious images to the image repository.

[0003] The security of container images has become one of the main security issues faced by cloud-native technology container deployment. How to effectively solve the image storage security problem has become an important way to ensure container security. Summary of the invention

[0004] The present disclosure provides a container image storage method, system, computer device and computer-readable storage medium to at least solve the current storage security problem of container images, thereby effectively ensuring the security of containers.

[0005] To achieve the above objectives, the present disclosure provides a container image storage method, comprising:

[0006] Build a security detection identification chain for container images;

[0007] Determine a first security level category of the container image based on the security detection identification chain; and store the container image in a corresponding image repository based on the first security level category.

[0008] In one implementation, building a security detection identification chain for a container image includes:

[0009] Adding a detection mark and a security level mark to the container image based on the security detection result of the container image; and

[0010] A security detection identifier chain is constructed for the container image based on the detection identifier and the security level identifier.

[0011] In one embodiment, before adding a detection identifier and a security level identifier to the container image based on the security detection result of the container image, the method further includes:

[0012] Perform security checks on container images to obtain security test results for container images;

[0013] The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

[0014] In one embodiment, before determining the first security level category of the container image based on the security detection identification chain, the method further includes:

[0015] Pre-classify a number of first security level categories for container images and a number of second security level categories for image repositories;

[0016] Establishing a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories;

[0017] The storing the container image in a corresponding image repository based on the first security level category includes:

[0018] Based on the security level category, the container image is stored in an image repository corresponding to a second security level category according to the mapping relationship.

[0019] To achieve the above objectives, the present disclosure further provides a container image storage system, including:

[0020] An identification chain building module, which is configured to build a security detection identification chain for the container image;

[0021] a category determination module, which is configured to determine a first security level category of the container image based on the security detection identification chain; and

[0022] A storage module is configured to store the container image in a corresponding image repository based on the first security level category.

[0023] In one implementation, the identification chain building module includes:

[0024] an identification adding unit, configured to add a detection identification and a security level identification to the container image based on a security detection result of the container image; and

[0025] A construction unit is configured to construct a security detection identifier chain for the container image based on the detection identifier and the security level identifier.

[0026] In one implementation, the identification chain building module further includes:

[0027] a security detection unit, configured to perform a security detection on the container image before the identification adding unit adds the detection identification and the security level identification to the container image, and obtain a security detection result of the container image;

[0028] The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

[0029] In one embodiment, the system further comprises:

[0030] A classification module, configured to pre-classify a plurality of first security level categories for container images and a plurality of second security level categories for image repositories before the identification and classification module determines the first security level category of the container image;

[0031] A mapping module, configured to establish a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories;

[0032] The storage module is specifically configured to store the container image in an image repository corresponding to a second security level category according to the mapping relationship based on the security level category.

[0033] To achieve the above objectives, the present disclosure also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the container image storage method.

[0034] To achieve the above-mentioned purpose, the present disclosure also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the container image storage method.

[0035] According to the container image storage method, system, computer device and computer-readable storage medium provided by the present disclosure, a security detection identification chain is constructed for the container image, and then the first security level category of the container image is determined based on the security detection identification chain, and the container image is stored in the corresponding image repository based on the first security level category. The present disclosure divides the security level of the container image based on the security detection identification chain, and then stores it in the image repository of the corresponding security level to ensure the security of the container image. When the image is deployed in the container, different image repositories can be used according to different security level requirements, thereby ensuring the security of various applications in the container, and can effectively improve the convenience of obtaining and using container images, and enhance the user experience.

[0036] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings are used to provide further understanding of the technical solution of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the technical solution of the present disclosure and do not constitute a limitation on the technical solution of the present disclosure.

[0038] Figure 1 A flowchart of a container image storage method provided by an embodiment of the present disclosure;

[0039] Figure 2 A schematic diagram of a scene of an image warehouse in an embodiment of the present disclosure;

[0040] Figure 3 A flowchart of another container image storage method provided by an embodiment of the present disclosure;

[0041] Figure 4 A flowchart of another container image storage method provided by an embodiment of the present disclosure;

[0042] Figure 5 A schematic diagram of the structure of a container image storage system provided in an embodiment of the present disclosure;

[0043] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] To make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; and, in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other.

[0046] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present disclosure, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0047] With the widespread use of cloud computing and virtualization technologies, all walks of life are clouding their businesses to varying degrees. However, simply converting hosts, platforms or applications to virtualized forms cannot solve the problems of slow upgrades, bloated architectures, and inability to quickly iterate in traditional applications. Therefore, the concept of cloud native came into being. Cloud native technology is represented by continuous delivery, DevOps (a combination of Development and Operations, collaboration and integration), containers, orchestration, and microservices. Container technology can effectively divide the resources of a single operating system into isolated groups, so as to better balance conflicting resource usage requirements between isolated groups. It is widely used because of its fast and efficient, high portability, and low resource consumption. As the basis for container operation, images are widely deployed in containers with the extensive use of containers. Due to security vulnerabilities in the current storage method of container images, the use of containers cannot be guaranteed.

[0048] To solve the above problems, the embodiments of the present disclosure ensure the security of container images by constructing a security detection identification chain for the container image, and then dividing the security level of the container image based on the security detection identification chain, and then storing it in a container image library with a corresponding security level. When the image is deployed in the container, different image repositories can be used according to different security level requirements, thereby ensuring the security of various applications in the container and improving the convenience of obtaining and using container images.

[0049] Please refer to Figure 1 , Figure 1 A flowchart of a container image storage method provided in an embodiment of the present disclosure, the method comprising steps S101-S103.

[0050] In step S101, a security detection identification chain is constructed for the container image.

[0051] In this embodiment, a security detection identification chain is constructed for the container image that needs to be stored in the container image repository to identify the security of the container image. Specifically, the security detection identification chain includes the security identification added to the container image during each detection process, where the security identification may include a detection identification and a security level identification. By constructing a security detection identification chain for the container image, the entire process of security detection of the container image can be tracked to ensure that the container image stored in the image repository has security detection traceability.

[0052] Take the example of a safety detection identification chain including identification 1---detection identification and identification 2---safety level identification, where the detection identification is as described in Table 1 below, and the safety level identification is as shown in Table 2 below.

[0053]

[0054]

[0055] Table 1

[0056]

[0057]

[0058] Table 2

[0059] In step S102, a first security level category of the container image is determined based on the security detection identification chain.

[0060] In this embodiment, the first security level category of the container image is determined based on the security level identifier in the security detection identification chain. For example, images with SECURITY levels S1 and S2 are classified as images with low security levels, images with levels S3 and S4 are classified as images with medium security levels, and images with level S5 are classified as images with high security levels. Taking multiple security detections on container images as an example, the corresponding security detection identification chain S-CHAIN ​​formed is used to track the entire security inspection process of the image. The method for forming a security detection identification chain is illustrated as follows:

[0061] Step 1: After checking and killing viruses, Trojans, and malicious programs, there is no threat. The identification information is:

[0062] S-CHAIN SECURITY A S1

[0063] Step 2: After checking and killing viruses, Trojans, and malicious programs, there are no threats. At the same time, after completing the vulnerability scan, there are no high-risk vulnerabilities. The identification information is:

[0064] S-CHAIN SECURITY A-B01 S2

[0065] Step 3: After checking and killing viruses, Trojans, and malicious programs, there are no threats. After completing the vulnerability scan, there are no high-risk vulnerabilities. After completing the vulnerability scan again, there are no medium-risk and high-risk vulnerabilities. The identification information is:

[0066] S-CHAIN SECURITY A-B01-B02 S3

[0067] Step 4: After checking and killing viruses, Trojans, and malicious programs, there are no threats. After completing the vulnerability scan, there are no high-risk vulnerabilities. After completing the vulnerability scan again, there are no medium-risk and high-risk vulnerabilities. After completing the vulnerability scan for the third time, there are no low-risk, medium-risk, and high-risk vulnerabilities. The identification information is:

[0068] S-CHAIN SECURITY A-B01-B02-B03 S4

[0069] Step 5: After checking and killing viruses, Trojans, and malicious programs, there are no threats. After completing the vulnerability scan, there are no high-risk vulnerabilities. After completing the vulnerability scan again, there are no medium-risk and high-risk vulnerabilities. After completing the vulnerability scan for the third time, there are no low-risk, medium-risk, and high-risk vulnerabilities. After completing the compliance item detection, there are no non-compliant items. The identification information is:

[0070] S-CHAIN SECURITY A-B01-B02-B03-C S5

[0071] It should be noted that, in some embodiments, the content of the container image security detection is not limited to the above-mentioned security detection method, and the above-mentioned five steps do not need to be performed step by step. After a certain step of detection is performed and the result is obtained, the corresponding detection identification and security level identification can be added. Further, in order to limit the total length of the security detection identification chain S-CHAIN, the identification added after the detection can be limited to 15. When it exceeds 15, the second or third identification is deleted on the basis of retaining the first identification, and so on. It can be understood that the determination of the first security level category of the container image is obtained based on the latest security level identification of the security detection identification chain.

[0072] In step S103, the container image is stored in a corresponding image repository based on the first security level category.

[0073] Specifically, multiple image repositories of different categories can be built according to the different security levels of container images. For example, three different image repositories of high, medium, and low can be built for use in different environments. For example, in a personal environment where there is no requirement for a security level, for convenience, a low-security-level image can be used; if a test environment has certain requirements for a security level and a certain degree of convenience can be sacrificed, a medium-security-level image can be used; if a production environment has a high security level requirement and the network and system security must be guaranteed, a high-security-level image must be used. Figure 2As shown, the image repository with a low security level is used to store the container images of S1 and S2, the image repository with a medium security level is used to store the container images of S3 and S4, and the image repository with a high security level is used to store the container image of S5.

[0074] In the related art, in order to solve the security problem of container images, a private image repository is established, and the images downloaded from the public repository are detected for insecurity problems in the images using security detection technology, and then the images that have passed the security detection are stored in the private image repository. The above scheme simply relies on security detection to process all images, which improves the security of image storage to a certain extent, but it does not build different levels of security image repositories according to actual usage, which also brings certain inconveniences to actual business use; in addition, although security detection is carried out, identification information is not added to the image and an identification chain is formed. When using the image, it is not possible to intuitively judge what security level the image is at, nor can the historical rectification of the image be judged. Compared with the related art, this embodiment realizes the identification of the security detection process of the container image by constructing a security detection identification chain, and determines the security level of the container image, and then divides it into the corresponding image repository according to its security level, which not only effectively guarantees the security of images of different security levels, but also improves the convenience of users in using container images.

[0075] Furthermore, unlike the related art, this embodiment does not need to create a private image repository, but divides the existing public repository, which reduces the image storage cost to a certain extent. Specifically, the common information of container images at present includes REPOSITORY, TAG, IMAGE ID, CREATED, and SIZE. This embodiment adds S-CHAIN ​​information to the original information to indicate the security detection identification chain, and adds SECURITY to indicate the security level, as shown in the following table:

[0076]

[0077] Take the http image downloaded from the public repository as an example to explain the added identification information:

[0078] For example, the image was checked for viruses, Trojans, and malicious programs, and a vulnerability scan was performed to find no high-risk vulnerabilities. The specific information is as follows:

[0079]

[0080]

[0081] If the image is scanned for vulnerabilities and no medium-risk or high-risk vulnerabilities are found, and then a baseline test is performed, the specific information is as follows:

[0082]

[0083] Furthermore, in this embodiment, after performing security detection on the container image, a detection identifier and a security level identifier are added to the container image based on the security detection result, and then a security detection identifier chain is constructed to track the security detection process of the container image. The security detection identifier chain is constructed for the container image (step S101). Figure 3 As shown, the following steps are included:

[0084] S101b, adding a detection mark and a security level mark to the container image based on the security detection result of the container image; and

[0085] S101c. Construct a security detection identifier chain for the container image based on the detection identifier and the security level identifier.

[0086] Furthermore, before adding a detection identifier and a security level identifier to the container image based on the security detection result of the container image (step S101b), the method further includes step S101a:

[0087] In step S101a, a security check is performed on the container image to obtain a security check result of the container image;

[0088] The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

[0089] Specifically, by performing security checks on container images, three items can be implemented: image vulnerability scanning, image virus detection, and image compliance detection. Through scanning, it is possible to discover image vulnerabilities, viruses, Trojans, malicious programs, and non-compliance items. When the image scan is completed, the results are output and a detection mark and security level mark are added.

[0090] Please refer to Figure 4 , Figure 4 A flow chart of another container image storage method provided for an embodiment of the present disclosure. Based on the previous embodiment, this embodiment implements classified storage of container images by establishing a mapping relationship between container images and image repositories regarding security levels. While ensuring the security of container images, it is convenient for users to download suitable container images, thereby improving user experience. Specifically, before determining the first security level category of the container image based on the security detection identification chain (step S102), it also includes steps S401 and S402, and step S103 is further divided into step S103a.

[0091] In step S401, a plurality of first security level categories related to container images and a plurality of second security level categories related to image repositories are pre-divided.

[0092] In step S402, a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories is established.

[0093] In step S103a, based on the security level category and according to the mapping relationship, the container image is stored in an image repository corresponding to the second security level category.

[0094] For example, the security level category of the container image and the security level of the image warehouse are divided into high security level, medium security level and low security level, wherein the high security level of the container image and the high security level of the image warehouse are mapped to each other, and so on, after the security level category of the container image is determined, it is stored in the corresponding image warehouse based on its mapping relationship. In some embodiments, different security levels and mapping relationships can also be divided, and this embodiment does not limit this.

[0095] Based on the same technical concept, the embodiment of the present disclosure also provides a container image storage system. Figure 5 As shown, the system includes an identification chain building module 51, a category determination module 52 and a storage module 53, wherein:

[0096] The identification chain construction module 51 is configured to construct a security detection identification chain for the container image;

[0097] The category determination module 52 is configured to determine the first security level category of the container image based on the security detection identification chain; and

[0098] The storage module 53 is configured to store the container image in a corresponding image repository based on the first security level category.

[0099] In one implementation, the identification chain building module 51 includes:

[0100] an identification adding unit, configured to add a detection identification and a security level identification to the container image based on a security detection result of the container image; and

[0101] A construction unit is configured to construct a security detection identifier chain for the container image based on the detection identifier and the security level identifier.

[0102] In one implementation, the identification chain building module further includes:

[0103] a security detection unit, configured to perform a security detection on the container image before the identification adding unit adds the detection identification and the security level identification to the container image, and obtain a security detection result of the container image;

[0104] The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

[0105] In one embodiment, the system further comprises:

[0106] A classification module, configured to pre-classify a plurality of first security level categories for container images and a plurality of second security level categories for image repositories before the identification and classification module determines the first security level category of the container image;

[0107] A mapping module, configured to establish a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories;

[0108] The storage module is specifically configured to store the container image in an image repository corresponding to a second security level category according to the mapping relationship based on the security level category.

[0109] Based on the same technical concept, the embodiment of the present disclosure also provides a computer device, such as Figure 6 As shown, the computer device includes a memory 61 and a processor 62, wherein the memory 61 stores a computer program, and when the processor 62 runs the computer program stored in the memory 61, the processor 62 executes the container image storage method.

[0110] Based on the same technical concept, an embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the container image storage method.

[0111] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A container image storage method, characterized in that: include: Constructing a security detection identification chain for the container image, wherein the security detection identification chain includes a security identification added to the container image during each detection process, wherein the security identification includes a detection identification and a security level identification; Determine a first security level category of the container image based on the security detection identification chain; and, storing the container image in a corresponding image repository based on the first security level category; The step of building a security detection identification chain for a container image includes: A detection mark and a security level mark are added to the container image based on the security detection result of the container image; the security detection conditions of the container image include five types, namely, no threat after virus, Trojan and malicious program detection, no high-risk vulnerability after vulnerability scanning, no medium-risk and high-risk vulnerability after vulnerability scanning, no low-risk, medium-risk and high-risk vulnerability after vulnerability scanning, and no non-compliance after compliance item detection; the security level of the container image is divided into five levels, among which the first security level corresponds to no threat after only virus, Trojan and malicious program detection, or no vulnerability after only vulnerability scanning, or no non-compliance after only compliance item detection, and the second security level corresponds to no threat after virus, Trojan and malicious program detection, and no high-risk vulnerability after vulnerability scanning, or no non-compliance after virus, Trojan and malicious program detection. Threat, and no non-compliance items after compliance detection, or no high-risk vulnerabilities after vulnerability scanning, and no non-compliance items after compliance detection, the third level security level corresponds to no threats after virus, Trojan and malicious program detection, and no medium-risk and high-risk vulnerabilities after vulnerability scanning, or no medium-risk and high-risk vulnerabilities after vulnerability scanning, and no non-compliance items after compliance detection, the fourth level security level corresponds to no threats after virus, Trojan and malicious program detection, and no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, or no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, and no non-compliance items after compliance detection, the fifth level security level corresponds to no threats after virus, Trojan and malicious program detection, no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, and no non-compliance items after compliance detection; and, A security detection identifier chain is constructed for the container image based on the detection identifier and the security level identifier.

2. The method according to claim 1, characterized in that: Before adding a detection identifier and a security level identifier to the container image based on the security detection result of the container image, the method further includes: Perform security checks on container images to obtain security test results for container images; The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

3. The method according to claim 1, characterized in that Before determining the first security level category of the container image based on the security detection identification chain, the method further includes: Pre-classify a number of first security level categories for container images and a number of second security level categories for image repositories; Establishing a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories; The storing the container image in a corresponding image repository based on the first security level category includes: Based on the security level category, the container image is stored in an image repository corresponding to a second security level category according to the mapping relationship.

4. A container image storage system, characterized in that: include: An identification chain building module, which is configured to build a security detection identification chain for the container image, wherein the security detection identification chain includes a security identification added to the container image during each detection process, wherein the security identification includes a detection identification and a security level identification; a category determination module, which is configured to determine a first security level category of the container image based on the security detection identification chain; and a storage module, configured to store the container image in a corresponding image repository based on the first security level category; The identification chain building module includes: an identification adding unit, which is configured to add a detection identification and a security level identification to the container image based on the security detection result of the container image; the security detection conditions of the container image include five types, namely, no threat after virus, Trojan and malicious program detection, no high-risk vulnerability after vulnerability scanning, no medium-risk and high-risk vulnerability after vulnerability scanning, no low-risk, medium-risk and high-risk vulnerability after vulnerability scanning, and no non-compliant items after compliance item detection; the security level of the container image is divided into five levels, wherein the first security level corresponds to no threat after only virus, Trojan and malicious program detection, or no vulnerability after only vulnerability scanning, or no non-compliant items after compliance item detection, and the second security level corresponds to no threat after virus, Trojan and malicious program detection, and no high-risk vulnerability after vulnerability scanning, or virus, Trojan and malicious program detection. There are no threats after virus, Trojan and malicious program killing, and there are no non-compliance items after compliance testing, or there are no high-risk vulnerabilities after vulnerability scanning, and there are no non-compliance items after compliance testing. The third-level security level corresponds to no threats after virus, Trojan and malicious program killing, and there are no medium-risk and high-risk vulnerabilities after vulnerability scanning, or there are no medium-risk and high-risk vulnerabilities after vulnerability scanning, and there are no non-compliance items after compliance testing. The fourth-level security level corresponds to no threats after virus, Trojan and malicious program killing, and there are no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, or there are no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, and there are no non-compliance items after compliance testing. The fifth-level security level corresponds to no threats after virus, Trojan and malicious program killing, no low-risk, medium-risk and high-risk vulnerabilities after vulnerability scanning, and no non-compliance items after compliance testing; and, A construction unit is configured to construct a security detection identifier chain for the container image based on the detection identifier and the security level identifier.

5. The system according to claim 4, characterized in that The identification chain building module also includes: a security detection unit, configured to perform a security detection on the container image before the identification adding unit adds the detection identification and the security level identification to the container image, and obtain a security detection result of the container image; The security detection result includes any one or any combination of image vulnerability scanning detection results, image virus detection results and image compliance detection results.

6. The system according to claim 4, characterized in that Also includes: A classification module, configured to pre-classify a plurality of first security level categories for container images and a plurality of second security level categories for image repositories before the identification and classification module determines the first security level category of the container image; A mapping module, configured to establish a mapping relationship between the first security level categories of the container images and the second security levels of the image repositories; The storage module is specifically configured to store the container image in an image repository corresponding to a second security level category according to the mapping relationship based on the security level category.

7. A computer device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the container image storage method according to any one of claims 1 to 3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the processor performs the container image storage method according to any one of claims 1 to 3.

Images