Container construction method, apparatus, device, and storage medium

Abstract

The application relates to the field of research and development management, and discloses a container construction method, a container construction device, a container construction equipment and a storage medium. The method comprises the following steps: obtaining a to-be-constructed container program, compiling the to-be-constructed container program, and obtaining a plurality of container image layers; running each container image layer, filtering each container image layer according to a running result, and obtaining a filtered container image layer; using a composite field to concatenate each filtered container image layer, performing intersection analysis and security marking on the concatenated container image layer, and obtaining a marked container image layer; performing hash calculation on the marked container image layer, obtaining a first hash value, optimizing a concatenation connection relationship between each marked container image layer according to the first hash value, and obtaining a corresponding running container. A high-security Docker container is constructed.

Description

Technical Field

[0001] This invention relates to the field of research and development management, and in particular to a container construction method, apparatus, device and storage medium. Background Technology

[0002] In recent years, with the rapid development of cloud computing, virtualization-based application platforms have been widely used. By adopting standard hardware and virtualization technology, application configuration costs can be reduced, and user application resource needs can be met sequentially. However, while traditional virtual machine technology adds support for the hypervisor layer, it also increases system performance consumption and requires complete application isolation. Docker containers, as a lightweight, high-performance, and convenient emerging virtual machine technology, achieve secure isolation by sharing the host operating system kernel between containers, ensuring resource availability and isolation, thus leading to the widespread adoption of Docker containers.

[0003] Current Docker container files are built by taking snapshots of Docker images and then uploading the images to a remote Docker repository or saving them locally. However, the downloading and building of Docker containers may be done through third-party container image libraries or links. Traditional static code scanning techniques, such as Fortify, are insufficient to perform static code security scans on containers, resulting in reduced security of the built container files. In other words, the security of existing Docker container build files is relatively low. Summary of the Invention

[0004] The main objective of this invention is to address the issue of low file security in existing Docker container builds.

[0005] The first aspect of this invention provides a container construction method, comprising: obtaining a container program to be built and compiling the container program to obtain multiple container image layers; running each of the container image layers and filtering each of the container image layers according to the running results to obtain filtered container image layers; concatenating each of the filtered container image layers using a composite field, and performing intersection analysis and security labeling on the concatenated container image layers to obtain labeled container image layers; performing hash calculation on the labeled container image layers to obtain a first hash value, and optimizing the concatenation connection relationship between each of the labeled container image layers according to the first hash value to obtain a corresponding running container.

[0006] Optionally, in a first implementation of the first aspect of the present invention, compiling the container program to be built to obtain multiple container image layers includes: parsing multiple instruction information in the container program to be built, and reading the base image instructions of the container image file corresponding to each instruction information from a preset instruction library; using the base image instructions to create an image corresponding to each instruction information, and obtaining multiple container image layers according to the created images.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of running each of the container image layers and filtering each of the container image layers according to the running results to obtain filtered container image layers includes: generating an identifier for each of the container image layers according to the running results, and determining whether each of the container image layers has the same identifier; determining whether each of the container image layers has the same identifier; if each of the container image layers has the same identifier, then filtering the container image layers with the same identifier to obtain filtered container image layers.

[0008] Optionally, in a third implementation of the first aspect of the present invention, the composite field includes a first type of field and a second type of field. The step of concatenating the filtered container image layers using the composite field includes: identifying the running order of the first-layer container image and the other layer container images in the filtered container image layers; marking the first-layer container image using the first type of field and the other layer container images using the second type of field according to the running order to obtain marking information; and concatenating the first-layer container image and the other layer container images according to the marking information.

[0009] Optionally, in the fourth implementation of the first aspect of the present invention, the step of performing intersection analysis and security labeling on the concatenated container image layers to obtain labeled container image layers includes: traversing the file structure information corresponding to the concatenated container image layers, and obtaining the storage address of each concatenated container image layer and the labeling information based on the traversal result; calculating the second hash value of the storage address, and performing hash mapping on the second hash value to obtain the corresponding mapping result; detecting whether each mapping result is different, and using a preset marker to perform security labeling on each concatenated container image layer based on the detection result to obtain labeled container image layers.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the step of using a preset marker to perform security annotation on each of the concatenated container image layers according to the detection result to obtain an annotated container image layer includes: if the detection result is that the mapping result corresponding to the first layer container image is different, then the concatenated container image layer is security-annotated using a preset marker to obtain an annotated container image layer; if the detection result is that the mapping result corresponding to the other layer container images is different, then the other layer container images are security-annotated using a preset marker to obtain an annotated container image layer.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, optimizing the concatenation connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container includes: extracting file digest information corresponding to each labeled container image layer, and concatenating the first hash value with the file digest information; calculating a third hash value after concatenating the first hash value with the file digest information, and determining whether the third hash value is less than the first hash value; if the third hash value is less than the first hash value, then using the third hash value to adjust the concatenation connection relationship between each labeled container image layer to obtain the corresponding running container.

[0012] A second aspect of the present invention provides a container building apparatus, comprising: a program compilation module for obtaining a container program to be built and compiling the container program to be built to obtain multiple container image layers; an image filtering module for running each of the container image layers and filtering each of the container image layers according to the running results to obtain filtered container image layers; a security labeling module for concatenating each of the filtered container image layers using composite fields, and performing intersection analysis and security labeling on the concatenated container image layers to obtain labeled container image layers; and a hash optimization module for performing hash calculation on the labeled container image layers to obtain a first hash value, and optimizing the concatenation connection relationship between each of the labeled container image layers according to the first hash value to obtain a corresponding running container.

[0013] Optionally, in a first implementation of the second aspect of the present invention, the program compilation module includes: an instruction reading unit, configured to parse multiple instruction information in the container program to be built, and read the base image instruction of the container image file corresponding to each instruction information from a preset instruction library; and an image building unit, configured to create an image corresponding to each instruction information using the base image instruction, and obtain multiple corresponding container image layers based on the created images.

[0014] Optionally, in a second implementation of the second aspect of the present invention, the image filtering module includes: an identifier generation unit, configured to generate identifiers for each container image layer based on the running results, and determine whether each container image layer has the same identifier; and an image filtering unit, configured to filter the container image layers with the same identifier if each container image layer has the same identifier, to obtain the filtered container image layers.

[0015] Optionally, in a third implementation of the second aspect of the present invention, the security labeling module includes: a layer sequence identification unit, used to identify the running order of the first-layer container image and other layer container images in the filtered container image layers; an image labeling unit, used to label the first-layer container image using the first type of field and the other layer container images using the second type of field according to the running order, to obtain labeling information; and an image concatenation unit, used to concatenate the first-layer container image and the other layer container images according to the labeling information.

[0016] Optionally, in the fourth implementation of the second aspect of the present invention, the security labeling module further includes: a mirror traversal unit, used to traverse the file structure information corresponding to the concatenated container image layers, and obtain the storage address of each concatenated container image layer and the labeling information according to the traversal result; a hash mapping unit, used to calculate the second hash value of the storage address, and perform hash mapping on the second hash value to obtain the corresponding mapping result; and a concatenation labeling unit, used to detect whether each mapping result is different, and use a preset label to perform security labeling on each concatenated container image layer according to the detection result to obtain the labeled container image layer.

[0017] Optionally, in a fifth implementation of the second aspect of the present invention, the concatenated labeling unit includes: if the detection result is that the mapping result corresponding to the first layer container image is different, then a preset marker is used to perform a safety label on the concatenated container image layer to obtain a labeled container image layer; if the detection result is that the mapping result corresponding to the other layer container images is different, then a preset marker is used to perform a safety label on the other layer container images to obtain a labeled container image layer.

[0018] Optionally, in a sixth implementation of the second aspect of the present invention, the hash optimization module includes: a digest connection unit, configured to extract file digest information corresponding to each of the labeled container image layers, and connect the first hash value with the file digest information; a hash calculation unit, configured to calculate a third hash value after connecting the first hash value with the file digest information, and determine whether the third hash value is less than the first hash value; and an image adjustment unit, configured to, if the third hash value is less than the first hash value, use the third hash value to adjust the serial connection relationship between each of the labeled container image layers to obtain the corresponding running container.

[0019] A third aspect of the present invention provides a container building apparatus, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the container building apparatus to perform the various steps of the container building method described above.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the steps of the container construction method described above.

[0021] The technical solution provided by this invention involves obtaining a container program to be built and compiling it to obtain multiple container image layers; running each container image layer and filtering them based on the running results to obtain filtered container image layers; concatenating the filtered container image layers using composite fields, and performing intersection analysis and security labeling on the concatenated container image layers to obtain labeled container image layers; performing hash calculation on the labeled container image layers to obtain a first hash value, and optimizing the concatenation relationship between the labeled container image layers based on the first hash value to obtain the corresponding running container. Compared with the prior art, this application compiles the obtained container program to be built and filters the compilation results to obtain filtered container image layers; then concatenates the filtered container image layers using composite fields, performs intersection analysis and security labeling on the concatenation results, and then optimizes the hash relationship between the labeled container image layers to obtain the corresponding running container. This achieves security scanning and connection optimization of each image layer, shortens the security scanning time of the container, and improves the running speed of the built container, thus realizing the construction of a highly secure Docker running container. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the first embodiment of the container construction method in this invention;

[0023] Figure 2 This is a schematic diagram of a second embodiment of the container construction method in this invention;

[0024] Figure 3 This is a schematic diagram of a third embodiment of the container construction method in this invention;

[0025] Figure 4 This is a schematic diagram of the fourth embodiment of the container construction method in this invention;

[0026] Figure 5 This is a schematic diagram of the fifth embodiment of the container construction method in this invention;

[0027] Figure 6 This is a schematic diagram of one embodiment of the container construction apparatus in this invention;

[0028] Figure 7 This is a schematic diagram of another embodiment of the container construction apparatus in this invention;

[0029] Figure 8 This is a schematic diagram of one embodiment of the container construction device in this invention. Detailed Implementation

[0030] This invention provides a container construction method, apparatus, device, and storage medium. The method includes: obtaining a container program to be built and compiling the program to obtain multiple container image layers; running each container image layer and filtering them based on the results to obtain filtered container image layers; concatenating the filtered container image layers using composite fields and performing intersection analysis and security labeling on the concatenated layers to obtain labeled container image layers; performing hash calculation on the labeled container image layers to obtain a first hash value, and optimizing the concatenation relationship between the labeled container image layers based on the first hash value to obtain a corresponding running container. This achieves the construction of a highly secure Docker container.

[0031] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 The first embodiment of the container construction method in this invention includes:

[0033] 101. Obtain the container program to be built and compile it to obtain multiple container image layers;

[0034] It is understood that the executing entity of this invention can be a container building device, a terminal, or a server; no specific limitation is made here. This embodiment of the invention will be described using a server as an example.

[0035] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0036] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0037] In this embodiment, the container program to be built refers to the application to be released, used to build the container. This application is a computer program that performs one or more specific tasks, runs in user mode, can interact with the user, and has a visual user interface. The container image layer refers to the compilation of the program using Docker images and containers, so that each image layer generates a corresponding execution instruction. This achieves instruction programming of the container program to be built, establishing a one-to-one correspondence between each image layer and each instruction.

[0038] In practical applications, the process involves obtaining the container program to be built using Docker, parsing its instruction information to obtain multiple instruction information, and reading the base image file corresponding to each instruction information from a pre-built instruction library. Then, the base image file is used to build the image instruction execution file corresponding to each instruction information, and the multiple container image layers corresponding to the entire container program to be built are obtained by combining the created image execution files.

[0039] 102. Run each container image layer, and filter each container image layer based on the results to obtain the filtered container image layers;

[0040] In this embodiment, by running the constructed container image layer and filtering the running container image layer, a container image layer that meets the basic requirement of non-conflict operation is obtained. This allows the initially constructed container layer to be run experimentally, and the results of the operation are used to check whether the constructed container image layer will have any running conflicts. This ensures that the initially constructed container image layer can run normally without running obstacles or program running obstacles such as repeated runs, thereby improving the stable operation of the constructed container image layer.

[0041] In practical applications, based on the multiple container image layers obtained from the above processing and their corresponding instruction information, the instruction information corresponding to each container image layer is executed sequentially. At the same time, the identifier (UUID) of each container image layer is generated based on the execution results of each instruction information. Then, the identity of the generated identifiers corresponding to each container image layer is judged. If there are identical identifiers among the container image layers, the container image layers with identical identifiers are filtered out, and the container image layers with different identifiers are retained, resulting in the filtered container image layers.

[0042] 103. Use composite fields to concatenate the filtered container image layers, and perform intersection analysis and security annotation on the concatenated container image layers to obtain the annotated container image layers.

[0043] In this embodiment, the composite field, namely the Parent multi-digit field, refers to the parent object of a control, section, or control containing other controls that can be referenced using the Parent property. If the parent object is a control, the Parent property returns the control object; if the parent object is a Microsoft Access object, it returns an AccessObject object, thus linking different container image layers together. The IDE intersection analysis refers to determining whether there is a one-to-many relationship between different container image layers. If there are multiple intersections, the program may not be able to accurately run the next image layer after reaching that container image layer, leading to errors in the container image layer's execution. The security label refers to marking the container image layer for safe operation if it can achieve complete normal operation, so as to ensure that the final Docker build can guarantee normal operation.

[0044] In practical applications, the execution order of the first-layer container image and other container images in the filtered container image layers is identified. Based on the execution order of each container image layer, the first-layer container image is marked using a first type of field, and other container images are marked using a second type of field, obtaining marking information. The first-layer container image and other container images are then concatenated based on the marking information. The file structure information corresponding to the concatenated container image layers is then traversed, and the storage address of each concatenated container image layer and its marking information is obtained based on the traversal results. A second hash value is calculated for each storage address, and a hash mapping is performed to obtain the corresponding mapping result. The mapping results are checked for differences. If the mapping result corresponding to the first-layer container image is different, a preset marker is used to securely mark the concatenated container image layer, resulting in a marked container image layer. Similarly, if the mapping results corresponding to other container images are different, a preset marker is used to securely mark the other container images, resulting in a marked container image layer.

[0045] 104. Perform hash calculation on the labeled container image layers to obtain the first hash value, and optimize the serial connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container.

[0046] In this embodiment, hash calculation refers to using the MD5 message digest algorithm (a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value to ensure the integrity and consistency of information transmission) to calculate the corresponding hash value (sha56), thereby obtaining the first hash value. By calculating the first hash value of the labeled container image layer, the linking relationship of each container image layer is optimized using the first hash value, thereby optimizing the built Docker container. This makes the operation of each container image layer of the built Docker container more reasonable and efficient, which can not only speed up the running speed of the container to be built, but also improve the user's satisfaction with the built Docker container.

[0047] In practical applications, the file digest information corresponding to each labeled container image layer is extracted, and the first hash value is concatenated with the file digest information. Then, the third hash value after concatenating the first hash value with the file digest information is calculated, and it is determined whether the third hash value is less than the first hash value. If the third hash value is less than the first hash value, the third hash value is used to adjust the concatenation relationship between each labeled container image layer to obtain the corresponding Docker running container.

[0048] In this embodiment of the invention, a container program to be built is obtained and compiled to obtain multiple container image layers; each container image layer is run, and the results are filtered to obtain filtered container image layers; the filtered container image layers are concatenated using composite fields, and intersection analysis and security labeling are performed on the concatenated container image layers to obtain labeled container image layers; a hash calculation is performed on the labeled container image layers to obtain a first hash value, and the concatenation connection relationship between the labeled container image layers is optimized based on the first hash value to obtain the corresponding running container. Compared with the prior art, this application compiles the obtained container program to be built and filters the compilation results to obtain filtered container image layers; then concatenates the filtered container image layers using composite fields, performs intersection analysis and security labeling on the concatenation results, and then optimizes the hash relationship between the labeled container image layers to obtain the corresponding running container. This achieves security scanning and connection optimization of each image layer, shortens the security scanning time of the container, and improves the running speed of the built container, thus realizing the construction of a highly secure Docker running container.

[0049] Please see Figure 2 The second embodiment of the container construction method in this invention includes:

[0050] 201. Parse out multiple instruction information in the container program to be built, and read the base image instructions of the container image file corresponding to each instruction information from the pre-built instruction library;

[0051] In this embodiment, the instruction information refers to the requirement information for executing instructions to achieve various functions; the pre-built instruction library refers to the Dockerfile instruction library, which includes instruction information for running various image programs; by running the Dockerfile instruction library to build the basic image instructions for each instruction information, the container program to be built is transformed into the corresponding image container instructions.

[0052] In practical applications, the process involves obtaining the container program to be built using Docker, parsing its instruction information (which includes multiple instruction requirements), and then reading the base image instructions of the corresponding container image file based on the pre-defined Dockerfile instruction library in the parsed instruction information.

[0053] 202. Use the base image instructions to create images corresponding to each instruction information, and obtain multiple container image layers based on the created images;

[0054] In this embodiment, based on the base image instructions obtained from the above processing, the base image instructions and corresponding instruction information are used to build the image, that is, to obtain the corresponding operation and execution instructions, and based on the created images, to obtain multiple corresponding container image layers.

[0055] 203. Run each container image layer, and filter each container image layer based on the results to obtain the filtered container image layers;

[0056] 204. Use composite fields to concatenate the filtered container image layers, and perform intersection analysis and security annotation on the concatenated container image layers to obtain the annotated container image layers.

[0057] 205. Perform hash calculation on the labeled container image layers to obtain the first hash value, and optimize the serial connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container.

[0058] In this embodiment of the invention, multiple instruction information in the container program to be built is parsed, and the base image instructions corresponding to each instruction information in the container image file are read from a preset instruction library. The base image instructions are used to create the image corresponding to each instruction information, and multiple container image layers are obtained based on the created images. Compared with the prior art, this application analyzes the container program to be built and uses the instruction information therein to match the corresponding base image instructions, thereby constructing multiple container image layers. This allows for a simpler and easier way to convert the required program functionality into corresponding container image layer execution instructions.

[0059] Please see Figure 3 The third embodiment of the container construction method in this invention includes:

[0060] 301. Obtain the container program to be built and compile it to obtain multiple container image layers;

[0061] 302. Generate identifiers for each container image layer based on the execution results, and determine whether there are identical identifiers among the container image layers;

[0062] In this embodiment, the identifier refers to the Universal Identifier (UUID), which is a 128-bit value that can be calculated using a certain algorithm. To improve efficiency, the commonly used UUID can be shortened to 16 bits, and the UUID is used to identify the attribute type, and is considered a unique identifier across all spaces and times.

[0063] In practical applications, based on the multiple container image layers obtained from the above processing, each container image layer and its corresponding instruction information are executed sequentially. At the same time, a general identifier calculation algorithm is used to generate the identifiers corresponding to each container image layer. Then, based on the identifiers corresponding to each container image layer obtained from the above processing, it is determined whether each container image layer has the same identifier. This is done by determining whether the identifiers corresponding to each pair of container image layers are the same.

[0064] 303. If the container image layers have the same identifier, then filter the container image layers with the same identifier to obtain the filtered container image layers.

[0065] In this embodiment, if the comparison and judgment find that the container image layers have the same identifier, the container image layers corresponding to the same identifier are filtered out, or the container with the corresponding identifier is reconstructed, or one of the image layers is included as the required container image layer, so as to realize the container image layers with different identifiers, thereby obtaining the filtered container image layers with different identifiers.

[0066] 304. Use composite fields to concatenate the filtered container image layers, and perform intersection analysis and security annotation on the concatenated container image layers to obtain the annotated container image layers.

[0067] 305. Perform hash calculation on the labeled container image layers to obtain the first hash value, and optimize the serial connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container.

[0068] In this embodiment of the invention, identifiers for each container image layer are generated based on the execution results, and it is determined whether there are identical identifiers among the container image layers. If identical identifiers exist among the container image layers, the container image layers with identical identifiers are filtered to obtain filtered container image layers. Compared to existing technologies, this application executes instruction information on the container image layers and generates unique identifiers, then performs identity checks on the identifiers to determine whether the initially constructed container image layers have the same scenario. This ensures that the constructed container image layers are free of redundancy, simplifies the execution of programs within the container image layers, achieves Docker static detection, and guarantees the reliability and security of the container image layer operation.

[0069] Please see Figure 4 The fourth embodiment of the container construction method in this invention includes:

[0070] 401. Obtain the container program to be built and compile it to obtain multiple container image layers;

[0071] 402. Run each container image layer, and filter each container image layer based on the results to obtain the filtered container image layers;

[0072] 403. Identify the execution order of the first-layer container image and other container images in the filtered container image layers;

[0073] In this embodiment, the first-layer container image refers to the first container image that serves as the first layer of the container image layer, according to the layering order of the constructed container image layers; the running order refers to the direction in which the container image layers implement the image layer of the container program to be built.

[0074] In practical applications, based on the filtered container image layers described above, the initially built container image layers are identified according to their build order, thereby obtaining the running order of the first-layer container image and other container images besides the first-layer container image.

[0075] 404. Based on the execution order, the first-layer container image is marked using the first type of field, and other layer container images are marked using the second type of field to obtain marking information;

[0076] In this embodiment, the first field refers to the first-level tag field (parent field) information of the Parent composite field; the second field refers to the tag field (child field) information of other layers of the Parent composite field.

[0077] In practical applications, based on the execution order of the first-layer container image and the other layer container images, the first layer is marked using the first field of the Parent composite field, and the remaining layers are sub-marked using the second field of the Parent composite field through a queue structure, thereby obtaining the marking information.

[0078] 405. Based on the tagging information, concatenate the first-layer container image with the other layer container images;

[0079] In this embodiment, "concatenation" refers to connecting container image layers in a series according to a certain data structure (such as array, queue, stack, linked list, heap, etc.). Here, the series connection of linked list structure will be explained.

[0080] In practical applications, based on the aforementioned tagging information, the first-layer container image and other layer container images are linked together in a linked list. The tagging information of the first-layer container image is used as the head of the linked list, and the other layer container images are linked together sequentially according to their running order, thereby realizing the chain connection of each container image layer through the tagging information.

[0081] 406. Traverse the file structure information corresponding to the concatenated container image layers, and obtain the storage address of each concatenated container image layer and tag information based on the traversal results;

[0082] In this embodiment, the file structure information refers to the root directory information of the built container image layer stored in the container repository, that is, the storage address of each container image layer in the container repository.

[0083] In practical applications, based on the concatenated container image layers described above, the address traversal program inside the Docker container is used to run the program to obtain the file structure information corresponding to the concatenated container image layers. Then, based on the traversal results, the storage address information of each concatenated container image layer and its corresponding tag information is obtained.

[0084] 407. Calculate the second hash value of the storage address, and perform a hash mapping on the second hash value to obtain the corresponding mapping result;

[0085] In this embodiment, hash mapping refers to quickly calculating and determining whether there is an intersection between the mapping results using a hashmap.

[0086] In practical applications, the storage address information of each concatenated container image layer obtained by the above traversal and its corresponding tag information is hashed to obtain a second hash value. Then, the second hash value is hash-mapped using a hashmap to obtain the mapping result corresponding to each concatenated container image layer.

[0087] 408. Check whether the mapping results are different, and based on the detection results, use preset markers to mark each concatenated container image layer for safety, and obtain the marked container image layer.

[0088] In this embodiment, based on the mapping results corresponding to each concatenated container image layer, it is detected whether the mapping results are different, that is, whether the mapping results have an intersection. If the detection result is that the mapping result corresponding to the first layer container image is different, then the concatenated container image layer is marked with a preset marker to obtain a marked container image layer. That is, after the topmost mount layer is scanned, it can be quickly determined that all files without intersection are safe, and the scanning process of this layer can be skipped and marked with a security label. If the detection result is that the mapping results corresponding to other layer container images are different, then the other layer container images are marked with a security label using a preset marker to obtain a marked container image layer. That is, for layers with intersection, it is necessary to scan the files containing intersection separately. After all scans are completed, the scanning results of all layers can be marked with a security label.

[0089] Furthermore, when any client pulls layers, the pull action can be intervened through configuration. Configuration options include: 1. Layers that fail security scans are not allowed to be submitted; 2. Layers that pass security scans but have security issues in the middle layers are allowed to be submitted but will trigger an alert; 3. Layers that fail security scans are allowed to be submitted but will trigger an alert. These three configurations are used for three different scenarios. The first scenario is suitable for environments with high security requirements, while the second and third scenarios can be used for scenarios with low security requirements, such as intranet development environments.

[0090] 409. Perform hash calculation on the labeled container image layers to obtain the first hash value, and optimize the serial connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container.

[0091] In this embodiment of the invention, the execution order of the first-layer container image and other container images in the filtered container image layers is identified; based on the execution order, the first-layer container image is marked using a first type of field, and other container images are marked using a second type of field to obtain marking information; based on the marking information, the first-layer container image and other container images are concatenated; the file structure information corresponding to the concatenated container image layers is traversed, and the storage address of each concatenated container image layer and the marking information is obtained based on the traversal result; a second hash value of the storage address is calculated, and the second hash value is hash-mapped to obtain the corresponding mapping result; it is detected whether each mapping result is different, and based on the detection result, each concatenated container image layer is security-marked using a preset marker to obtain marked container image layers. Compared to existing technologies, this application uses complex numbers of Parent to concatenate the initially built container image layers, and then performs hash mapping on the concatenated container image layers. The non-overlapping mapping results are then subjected to security standards to obtain labeled container image layers. This enables the static code security scanning of container image layers during the build process, ensuring the security of the built container image layers before the Docker container runs.

[0092] Please see Figure 5 The fifth embodiment of the container construction method in this invention includes:

[0093] 501. Obtain the container program to be built and compile it to obtain multiple container image layers;

[0094] 502. Run each container image layer, and filter each container image layer based on the results to obtain the filtered container image layers.

[0095] 503. Use composite fields to concatenate the filtered container image layers, and perform intersection analysis and security annotation on the concatenated container image layers to obtain the annotated container image layers.

[0096] 504. Extract the file digest information corresponding to each labeled container image layer, and concatenate the first hash value with the file digest information;

[0097] In this embodiment, the file digest information refers to the 128-bit (16-byte) hash value obtained by performing hash calculations on each container image layer using the MD5 message digest algorithm (a cryptographic hash function).

[0098] In practical applications, the MD5 message digest algorithm is used to perform hash calculation on the labeled container image layers obtained from the above processing to obtain the file digest information corresponding to each labeled container image layer. Then, the file digest information corresponding to each labeled container image layer is extracted, and the first hash value mentioned above is concatenated with the file digest information.

[0099] 505. Calculate the third hash value after concatenating the first hash value with the file digest information, and determine whether the third hash value is less than the first hash value;

[0100] In this embodiment, a hash calculation is performed on the result of concatenating the first hash value and the file digest information to obtain a third hash value. This third hash value is calculated by concatenating the file's MD5 hash value and the folder's SHA256 hash value using the string concatenation method, resulting in a SHA256 hash value for the same parent node. For example, for an empty folder, since there is no file overwriting issue, its SHA256 value is empty. The final SHA256 value is: sha256-c1 = sha256(sha256(md5(a1) + md5(a2)) + "" + "" + ""); and it is then determined whether the third hash value is less than the first hash value.

[0101] 506. If the third hash value is less than the first hash value, the third hash value is used to adjust the serial connection relationship between the labeled container image layers to obtain the corresponding running container.

[0102] In this embodiment, if the third hash value is less than the first hash value, the third hash value is used to perform hierarchical optimization on the serial connection relationship between the constructed container image layers to obtain the corresponding running container.

[0103] In this embodiment of the invention, file digest information corresponding to each labeled container image layer is extracted, and a first hash value is concatenated with the file digest information. A third hash value is calculated after concatenating the first hash value with the file digest information, and it is determined whether the third hash value is less than the first hash value. If the third hash value is less than the first hash value, the third hash value is used to adjust the concatenation relationship between each labeled container image layer to obtain the corresponding running container. Compared with the prior art, this application obtains a third hash value by concatenating the file digest information corresponding to the labeled container image layer with the first hash value and calculating the hash value after concatenation. The third hash value is then used to optimize the hierarchical structure of the labeled container image layers, making the constructed Docker container more concise and improving the container's running efficiency while ensuring security.

[0104] The container construction method in the embodiments of the present invention has been described above. The container construction apparatus in the embodiments of the present invention will be described below. Please refer to [link / reference]. Figure 6One embodiment of the container construction apparatus in this invention includes:

[0105] The program compilation module 601 is used to obtain the container program to be built and compile the container program to be built to obtain multiple container image layers;

[0106] The image filtering module 602 is used to run each of the container image layers and filter each of the container image layers according to the running results to obtain the filtered container image layers.

[0107] The safety labeling module 603 is used to concatenate the filtered container image layers using composite fields, and to perform intersection analysis and safety labeling on the concatenated container image layers to obtain the labeled container image layers.

[0108] The hash optimization module 604 is used to perform hash calculation on the labeled container image layers to obtain a first hash value, and optimize the serial connection relationship between each labeled container image layer according to the first hash value to obtain the corresponding running container.

[0109] In this embodiment of the invention, a container program to be built is obtained and compiled to obtain multiple container image layers; each container image layer is run, and the results are filtered to obtain filtered container image layers; the filtered container image layers are concatenated using composite fields, and intersection analysis and security labeling are performed on the concatenated container image layers to obtain labeled container image layers; a hash calculation is performed on the labeled container image layers to obtain a first hash value, and the concatenation connection relationship between the labeled container image layers is optimized based on the first hash value to obtain the corresponding running container. Compared with the prior art, this application compiles the obtained container program to be built and filters the compilation results to obtain filtered container image layers; then concatenates the filtered container image layers using composite fields, performs intersection analysis and security labeling on the concatenation results, and then optimizes the hash relationship between the labeled container image layers to obtain the corresponding running container. This achieves security scanning and connection optimization of each image layer, shortens the security scanning time of the container, and improves the running speed of the built container, thus realizing the construction of a highly secure Docker running container.

[0110] Please see Figure 7 Another embodiment of the container construction apparatus in this invention includes:

[0111] The program compilation module 601 is used to obtain the container program to be built and compile the container program to be built to obtain multiple container image layers;

[0112] The image filtering module 602 is used to run each of the container image layers and filter each of the container image layers according to the running results to obtain the filtered container image layers.

[0113] The safety labeling module 603 is used to concatenate the filtered container image layers using composite fields, and to perform intersection analysis and safety labeling on the concatenated container image layers to obtain the labeled container image layers.

[0114] The hash optimization module 604 is used to perform hash calculation on the labeled container image layers to obtain a first hash value, and optimize the serial connection relationship between each labeled container image layer according to the first hash value to obtain the corresponding running container.

[0115] Furthermore, the program compilation module 601 includes:

[0116] The instruction reading unit 6011 is used to parse out multiple instruction information in the container program to be built, and read the base image instruction of the container image file corresponding to each instruction information from the preset instruction library; the image building unit 6012 is used to create the image corresponding to each instruction information using the base image instruction, and obtain multiple corresponding container image layers based on the created images.

[0117] Furthermore, the mirror filtering module 602 includes:

[0118] The identifier generation unit 6021 is used to generate identifiers for each container image layer based on the running results, and to determine whether there are identical identifiers among the container image layers; the image filtering unit 6022 is used to filter the container image layers with identical identifiers among the container image layers if there are identical identifiers among the container image layers, and to obtain the filtered container image layers.

[0119] Furthermore, the security labeling module 603 includes:

[0120] The layer sequence identification unit 6031 is used to identify the running order of the first layer container image and other layer container images in the filtered container image layer; the image marking unit 6032 is used to mark the first layer container image using the first type of field and the other layer container images using the second type of field according to the running order to obtain marking information; the image concatenation unit 6033 is used to concatenate the first layer container image and the other layer container images according to the marking information.

[0121] Furthermore, the safety labeling module 603 also includes:

[0122] The image traversal unit 6034 is used to traverse the file structure information corresponding to the concatenated container image layers, and obtain the storage address of each concatenated container image layer and the tag information based on the traversal result; the hash mapping unit 6035 is used to calculate the second hash value of the storage address, and perform hash mapping on the second hash value to obtain the corresponding mapping result; the concatenation labeling unit 6036 is used to detect whether each mapping result is different, and according to the detection result, use a preset tag to perform security labeling on each concatenated container image layer to obtain the labeled container image layer.

[0123] Furthermore, the serial labeling unit 6036 includes:

[0124] If the detection result shows that the mapping result corresponding to the first layer container image is different, then the concatenated container image layer is marked with a preset marker to obtain a marked container image layer; if the detection result shows that the mapping result corresponding to the other layer container images is different, then the other layer container images are marked with a preset marker to obtain a marked container image layer.

[0125] Furthermore, the hash optimization module 604 includes:

[0126] The summary connection unit 6041 is used to extract the file summary information corresponding to each of the labeled container image layers, and to connect the first hash value with the file summary information; the hash calculation unit 6042 is used to calculate the third hash value after connecting the first hash value with the file summary information, and to determine whether the third hash value is less than the first hash value; the image adjustment unit 6043 is used to adjust the serial connection relationship between each of the labeled container image layers by using the third hash value if the third hash value is less than the first hash value, so as to obtain the corresponding running container.

[0127] In this embodiment of the invention, the basic image instructions are parsed from the obtained container program to be built, and various images are created using these instructions to obtain multiple container image layers. Identifiers for each container image layer are then generated, and these identifiers are used to filter the container image layers. The filtered container image layers are then marked with fields and the marks are concatenated. The concatenated container image layers are then hashed, and the mapping results are checked and security-labeled to obtain labeled containers. Finally, the concatenation connection relationship between the labeled image containers is optimized to obtain the corresponding running container. Compared to existing technologies, this application not only performs security scanning and security labeling on container image layers during construction but also optimizes the connection of the constructed image layers, achieving the construction of a highly secure and efficient running container.

[0128] above Figure 6 and Figure 7 The container building apparatus in this embodiment of the invention will be described in detail from the perspective of modular functional entities. The container building device in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0129] Figure 8 This is a schematic diagram of a container building device 800 provided in an embodiment of the present invention. The container building device 800 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 810 (e.g., one or more processors) and a memory 820, and one or more storage media 830 (e.g., one or more mass storage devices) for storing application programs 833 or data 832. The memory 820 and storage media 830 can be temporary or persistent storage. The program stored in the storage media 830 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the container building device 800. Furthermore, the processor 810 may be configured to communicate with the storage media 830 and execute the series of instruction operations in the storage media 830 on the container building device 800.

[0130] The container building appliance 800 may also include one or more power supplies 840, one or more wired or wireless network interfaces 850, one or more input / output interfaces 860, and / or one or more operating systems 831, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 8 The container building equipment structure shown does not constitute a limitation on the container building equipment and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0131] The present invention also provides a container building apparatus, the computer apparatus including a memory and a processor, the memory storing computer-readable instructions, which, when executed by the processor, cause the processor to perform the various steps of the container building methods in the above embodiments.

[0132] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the various steps of the container construction method.

[0133] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0134] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0135] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0136] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A container construction method, characterized in that, The container construction method includes: Obtain the container program to be built, and compile the container program to obtain multiple container image layers; Run each of the container image layers, and filter each of the container image layers based on the running results to obtain the filtered container image layers; The filtered container image layers are concatenated using composite fields, and the concatenated container image layers are subjected to intersection analysis and security annotation to obtain the annotated container image layers. A hash calculation is performed on the labeled container image layers to obtain a first hash value, and the serial connection relationship between each labeled container image layer is optimized based on the first hash value to obtain the corresponding running container; The composite field includes a first type of field and a second type of field. The step of concatenating the filtered container image layers using the composite field includes: Identify the execution order of the first-layer container image and other container images in the filtered container image layers; According to the running order, the first-layer container image is marked using the first type of field, and the other layer container images are marked using the second type of field to obtain marking information; Based on the marking information, the first-layer container image and the other layer container images are concatenated; The step of performing intersection analysis and security annotation on the concatenated container image layers to obtain the annotated container image layers includes: Traverse the file structure information corresponding to the concatenated container image layers, and obtain the storage address of each concatenated container image layer and the tag information based on the traversal results; Calculate the second hash value of the storage address, and perform a hash mapping on the second hash value to obtain the corresponding mapping result; The mapping results are checked to see if they are different. Based on the results, the concatenated container image layers are marked with a preset marker to obtain the marked container image layers.

2. The container construction method according to claim 1, characterized in that, The process of compiling the container program to be built yields multiple container image layers, including: Parse multiple instruction information from the container program to be built, and read the base image instructions of the container image file corresponding to each instruction information from the preset instruction library; The base image instructions are used to create images corresponding to each instruction information, and multiple container image layers are obtained based on the created images.

3. The container construction method according to claim 2, characterized in that, The step of filtering each container image layer based on the results of the operation to obtain filtered container image layers includes: Based on the results of the operation, an identifier for each container image layer is generated, and it is determined whether the container image layers have the same identifier. If all the container image layers have the same identifier, then the container image layers with the same identifier are filtered to obtain the filtered container image layers.

4. The container construction method according to claim 1, characterized in that, Based on the detection results, each of the concatenated container image layers is marked with a preset marker to obtain a marked container image layer, including: If the detection result is that the mapping result corresponding to the first-layer container image is different, then the concatenated container image layer is marked with a preset marker to obtain the marked container image layer. If the detection result shows that the mapping results corresponding to the other layer container images are different, the other layer container images are marked with a preset marker to obtain the marked container image layer.

5. The container construction method according to claim 1, characterized in that, The step of optimizing the concatenation connection relationship between each labeled container image layer based on the first hash value to obtain the corresponding running container includes: Extract the file digest information corresponding to each labeled container image layer, and concatenate the first hash value with the file digest information; Calculate the third hash value obtained by concatenating the first hash value with the file digest information, and determine whether the third hash value is less than the first hash value; If the third hash value is less than the first hash value, then the third hash value is used to adjust the serial connection relationship between the labeled container image layers to obtain the corresponding running container.

6. A container construction apparatus, characterized in that, The container construction apparatus includes: The program compilation module is used to obtain the container program to be built and compile the container program to be built to obtain multiple container image layers; The image filtering module is used to run each of the container image layers and filter each of the container image layers according to the running results to obtain the filtered container image layers. The security labeling module is used to concatenate the filtered container image layers using composite fields, and to perform intersection analysis and security labeling on the concatenated container image layers to obtain the labeled container image layers. The hash optimization module is used to perform hash calculation on the labeled container image layers to obtain a first hash value, and optimize the serial connection relationship between each labeled container image layer according to the first hash value to obtain the corresponding running container. The composite field includes a first type of field and a second type of field, and the security labeling module includes: The layer sequence identification unit is used to identify the running order of the first layer container image and other layer container images in the filtered container image layer; The image marking unit is used to mark the first-layer container image using the first type of fields and to mark the other layer container images using the second type of fields according to the running order, so as to obtain marking information; A mirror concatenation unit is used to concatenate the first-layer container image and the other layer container images according to the marking information; The security labeling module further includes: a mirror traversal unit, used to traverse the file structure information corresponding to the concatenated container image layers, and obtain the storage address of each concatenated container image layer and the labeling information based on the traversal result; A hash mapping unit is used to calculate a second hash value of the storage address and perform hash mapping on the second hash value to obtain a corresponding mapping result; The concatenated annotation unit is used to detect whether the mapping results are different, and based on the detection results, to perform safety annotation on each concatenated container image layer using a preset marker to obtain an annotated container image layer.

7. A container construction device, characterized in that, The container building device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the container building device to perform the steps of the container building method as described in any one of claims 1-5.

8. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the various steps of the container construction method as described in any one of claims 1-5.

Images