Docker container local image tampering detection method, startup method, device and equipment

Abstract

The present invention provides a method, a startup method, a device and an apparatus for detecting tampering of a local image of a Docker container. The method comprises: obtaining an image layer file after decompression of an image compression package file corresponding to a Docker container; comparing whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container; if the values ​​are consistent, further comparing whether the file after decompression of the image layer file is consistent with the file of the local image of the Docker container; if the files are consistent, determining that the local image of the Docker container has not been tampered with; if the values ​​are inconsistent or the files are inconsistent, determining that the local image of the Docker container has been tampered with, and outputting corresponding inconsistent information as tampered information. The present invention can detect the risk of illegal tampering of the local image of the Docker container, thereby ensuring the safe operation of the container.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a Docker container local image tampering detection method, startup method, device and equipment. Background Art

[0002] Cloud computing is an Internet-based computing method that allows shared hardware and software resources and information to be provided to computers and other devices on demand. After more than a decade of development, cloud computing, as an important infrastructure for digital transformation, has evolved from the stage of "cloud-oriented migration applications" to the stage of "cloud-oriented application construction", that is, from the "resource-centric" to the "application-centric" cloud-native infrastructure stage. In the process of building cloud-native applications and service platforms, Docker technology has become an important supporting technology for cloud-native and other application scenarios with its lightweight, second-level deployment, easy portability, elastic scalability, and active and powerful community support.

[0003] However, the existing Docker technology does not verify the integrity of the container's image layer. When the local image of the container is illegally tampered with, the result of the illegal tampering will be directly mounted and applied in the container, which will affect the security of the running container. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a Docker container local image tampering detection method, startup method, device and equipment to solve the problem that the prior art does not verify the integrity of the container's image layer. When the local image of the container is illegally tampered with, the result of the illegal tampering will be directly mounted and applied in the container, which will affect the security of the running container.

[0005] In a first aspect, the present invention provides a Docker container local image tampering detection method, which is applied to a Docker container local device, comprising:

[0006] Get the image layer file after decompressing the image compression package file corresponding to the Docker container;

[0007] Compare the SHA256 of the image layer file with the DiffID value of the local image of the Docker container to see if they are consistent;

[0008] If the values ​​are consistent, further compare whether the decompressed file of the image layer file is consistent with the file of the local image of the Docker container;

[0009] If the files are consistent, it is determined that the local image of the Docker container has not been tampered with; if the values ​​are inconsistent or the files are inconsistent, it is determined that the local image of the Docker container has been tampered with, and the corresponding inconsistency information is output as the tampered information.

[0010] Preferably, obtaining the image layer file after decompressing the image compression package file corresponding to the Docker container specifically includes:

[0011] Download the image compressed package file corresponding to the Docker container from the Docker container image repository;

[0012] Decompress the image compression package file to obtain the image layer file.

[0013] Preferably, comparing whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container specifically includes:

[0014] Obtaining hierarchical information of the image layer file;

[0015] Calculate the SHA256 value of the image layer file according to the hierarchical information of the image layer file;

[0016] Get the DiffID value of the local image of the Docker container;

[0017] Compare the SHA256 value with the DiffID value to see if they are consistent.

[0018] Preferably, after outputting the corresponding inconsistent information as the tampered information, the method further comprises:

[0019] A user instruction issued by a user according to the tampered information is received, and the local image of the Docker container is modified according to the user instruction.

[0020] Preferably, modifying the local image of the Docker container according to the user instruction specifically includes:

[0021] If the values ​​are inconsistent, replace the file of the local image of the Docker container with the file after decompression of the image layer file according to the user instruction, and synchronously update the value of the DiffID of the local image of the Docker container; or,

[0022] If the files are inconsistent, modify the files of the local image of the Docker container according to the user instructions.

[0023] In a second aspect, the present invention provides a Docker container startup method, which is applied to a Docker container local device, comprising:

[0024] Receive Docker container startup instructions;

[0025] Check whether there is a local image storing the Docker container locally;

[0026] If there is storage, use the Docker container local image tampering detection method as described above to detect whether the local image of the Docker container has been tampered with;

[0027] If it is not tampered with, the Docker container is run based on the local image of the Docker container, otherwise the running of the Docker container is prohibited.

[0028] Preferably, after checking whether there is a local image storing the Docker container locally, the method further includes:

[0029] If not stored, download the image compression package file corresponding to the Docker container from the Docker container image repository;

[0030] Decompress the image compression package file to obtain an image layer file;

[0031] The image layer file is further decompressed, and the Docker container is run based on the decompressed file of the image layer file.

[0032] In a third aspect, the present invention provides a Docker container local image tampering detection device, comprising:

[0033] The acquisition module is used to obtain the image layer file after decompressing the image compression package file corresponding to the Docker container;

[0034] A first comparison module, connected to the acquisition module, is used to compare whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container;

[0035] A second comparison module is connected to the first comparison module, and is used to further compare whether the file after the image layer file is decompressed is consistent with the file of the local image of the Docker container if the values ​​are consistent;

[0036] A determination output module is connected to the second comparison module, and is used to determine that the local image of the Docker container has not been tampered with if the files are consistent; and to determine that the local image of the Docker container has been tampered with if the values ​​are inconsistent or the files are inconsistent, and output corresponding inconsistency information as tampered information.

[0037] In a fourth aspect, the present invention provides a Docker container startup device, comprising:

[0038] A receiving module, used to receive a Docker container startup instruction;

[0039] A checking module, connected to the receiving module, for checking whether there is a local image storing the Docker container locally;

[0040] A detection module, connected to the inspection module, for detecting whether the local image of the Docker container has been tampered with by using the Docker container local image tampering detection method as described above if there is storage;

[0041] A running module is connected to the detection module and is used to run the Docker container based on the local image of the Docker container if it has not been tampered with, otherwise the running of the Docker container is prohibited.

[0042] In a fifth aspect, the present invention provides a Docker container local device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the Docker container local image tampering detection method as described above, and / or the Docker container startup method as described above.

[0043] The present invention provides a Docker container local image tampering detection method, startup method, device and equipment. The method uses the image compression package file corresponding to the Docker container as a benchmark for detecting whether the local image of the Docker container has been tampered with, gradually decompresses the image compression package file and compares it with the local image to find out whether the local image has been tampered with and where it has been tampered with, and promptly finds the risk of illegal tampering of the local image of the Docker container, thereby ensuring that the image file based on it is safe when the container is running, so that the running of the container is also safe. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a flow chart of a method for detecting tampering of a local image of a Docker container according to an embodiment of the present invention;

[0045] Figure 2 It is a flow chart of another Docker container local image tampering detection method according to an embodiment of the present invention;

[0046] Figure 3 This is a flow chart of a method for starting a Docker container according to an embodiment of the present invention;

[0047] Figure 4 is a flow chart of another method for starting a Docker container according to an embodiment of the present invention;

[0048] Figure 5 It is a structural schematic diagram of a Docker container local image tampering detection device according to an embodiment of the present invention;

[0049] Figure 6 It is a structural schematic diagram of a Docker container starting device according to an embodiment of the present invention;

[0050] Figure 7 It is a structural schematic diagram of a Docker container local device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0052] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0053] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0054] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0055] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0056] It can be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0057] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0058] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0059] In order to better understand the present invention, firstly, the local image of the Docker container and the container startup based on the local image are described.

[0060] In an embodiment of the present invention, the image stored in the local device of the Docker container is downloaded from the image repository in advance and then decompressed and stored locally. A specific example of the container image download process is shown in code block 1:

[0061] Code block 1: Download the container image

[0062]

[0063] An image is a file composed of multiple layers. Each layer has a corresponding LayerID. The LayerID is calculated for the container image repository. A specific example of LayerID is shown in code block 2. Code block 2 indicates that the downloaded image contains 4 compressed layers:

[0064] Code block 2: Container image LayerID

[0065]

[0066] After the container image is downloaded locally, only the decompressed file (referred to as the file of the container local image in this application) is stored locally, and the compressed file is not stored locally. The corresponding DiffID is stored locally synchronously. A specific example of DiffID is shown in code block 3 (only part of the DiffID is shown):

[0067] Code block 3: Container local image DiffID

[0068]

[0069] DiffID is calculated by the local device of the Docker container based on the decompressed image layer. It is a verification of the image file. In addition, DiffID can also be used to find the local storage location of the decompressed container local image file. A specific example of the search method is as follows:

[0070] Step 1: Calculate the chainID based on the following formula

[0071] If the layer is at the bottom layer and has no parent layer, then DiffID = chainID;

[0072] Otherwise, chainID(n)=sha256sum(chainID(n-1))DiffID(n))

[0073] Step 2: Based on the cache-id in the chainID directory, you can find the local storage path of the decompressed image

[0074] / var / lib / docker / overlay2 / <cache-id>

[0075] When the container is started, the image becomes the operating environment of the container file system - the read-only rootfs, and the container is actually the result of using the storage driver to mount a read-write layer on the read-only rootfs. The joint mount technology can mount multiple file systems on a mount point at the same time, integrating the original directory of the mount point with the mounted content, so that the final visible file system will contain the files and directories of each layer after integration.

[0076] A specific example of starting a container is shown in Code Snippet 4:

[0077] Code block 4: Start a container

[0078]

[0079] Using the joint mount technology, after starting the container, a new read-write layer and init layer are created in addition to the original image layer. The original image layer is combined as a read-only layer in the container for unified display. When users modify files in the container, they actually only change the read-write layer, and will not overwrite the file system of the underlying read-only layer. The read-write layer will hide the original version of the read-only layer, so users will find that the file system has changed.

[0080] In order to more clearly demonstrate the impact of illegally tampered local image files on the safe operation of containers, we simulate an illegal file creation process in the local image file of the container (the actual tampering process may be that the attacker stores some illegal files in the storage location of the local image file of the container, which is equivalent to illegally modifying the content of the image to achieve the purpose of the attack). A specific example of illegally creating a file is shown in Code Block 5:

[0081] Code block 5: Simulate the process of illegally tampering with the local image file

[0082]

[0083] It can be seen from code block 5 that a file.txt file is illegally written into the underlying file 54675e311cbf / diff / root of the local image.

[0084] If we start a container based on the local image tampered by code block 5, a specific example is shown in code block 6:

[0085] Code block 6: Start a container

[0086]

[0087] It can be seen from code block 6 that due to the influence of the illegally tampered image file, the illegally tampered file exists in the started container.

[0088] Based on the above description, the specific implementation of the technical solution of the present invention will be described in more detail below with reference to the accompanying drawings.

[0089] Embodiment 1:

[0090] like Figure 1 As shown, Embodiment 1 of the present invention provides a Docker container local image tampering detection method, which is applied to a Docker container local device, including:

[0091] S31, obtaining the image layer file after decompressing the image compression package file corresponding to the Docker container.

[0092] Optionally, obtaining the image layer file after decompressing the image compression package file corresponding to the Docker container specifically includes:

[0093] Download the image compressed package file corresponding to the Docker container from the Docker container image repository;

[0094] Decompress the image compression package file to obtain the image layer file.

[0095] Specifically, in this embodiment, Figure 2 As shown, in the case where the image stored in the Docker container local device may be tampered with, first execute step 6.1. Get the image layer file after decompressing the image compression package file, and use it as the basis for verification. The specific method is to download the corresponding image compression package file from the image warehouse. The image is a file composed of multiple layers. The image compression package file needs to be decompressed to obtain the image layer file. A specific example is shown in code block 7:

[0096] Code block 7: Get the container image compression package file and image layer file

[0097]

[0098] S32. Compare the SHA256 of the image layer file with the DiffID value of the local image of the Docker container to see if they are consistent.

[0099] Optionally, comparing whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container specifically includes:

[0100] Obtaining hierarchical information of the image layer file;

[0101] Calculate the SHA256 value of the image layer file according to the hierarchical information of the image layer file;

[0102] Get the DiffID value of the local image of the Docker container;

[0103] Compare the SHA256 value with the DiffID value to see if they are consistent.

[0104] Specifically, in this embodiment, Figure 2 As shown, the local device of the Docker container executes step 6.2. Determine whether the SHA256 value of the image layer file is consistent with the DiffID. By viewing the detailed information of the local image, we can find the locally stored DiffID. For the result shown in code block 7, by viewing the json file information in the directory, we can determine the hierarchical information of the obtained image layer file. A specific example is shown in code block 8:

[0105] Code block 8: manifest.json file content

[0106]

[0107] Calculate the SHA256 value of layer.tar based on the layer information obtained in code block 8, and compare it with the corresponding DiffID value to determine whether the two are equal.

[0108] S33. If the values ​​are consistent, further compare whether the decompressed file of the image layer file is consistent with the file of the local image of the Docker container.

[0109] Specifically, in this embodiment, Figure 2 As shown, if step 6.2 determines that the SHA256 value of layer.tar is equal to the corresponding DiffID value, the Docker container local device further executes step 6.3. decompresses the image layer file, and step 6.4. determines whether the decompressed file of the image layer file is consistent with the file of the local image. A specific example of decompressing the image layer file is shown in code block 9:

[0110] Code block 9: Unzip the package file layer.tar

[0111]

[0112] Based on the illegally tampered local storage image directory layer 54675e311cbf / root / directory simulated in code block 5, the local image file tampered by code block 5 is compared with the file decompressed by code block 9 to determine whether the decompressed file of the image layer file is consistent with the local image file. A specific example is shown in code block 10:

[0113] Code block 10: Compare files to determine whether the local storage image has been tampered with

[0114]

[0115] The meaning of code block 10 is: compare the differences between two files, file 1: layer0 / root / , file 2: / var / lib / docker / overlay2 / 54675e311cbf / diff / root / , where file 1 is a benchmark file and file 2 is a local image file. If file 2 is consistent with file 1, it means that the local image has not been tampered with. If file 2 is inconsistent with file 1, it means that the local image file has been tampered with. In this example, as shown in code block 10, the tampered file is found through comparison.

[0116] S34. If the files are consistent, it is determined that the local image of the Docker container has not been tampered with; if the values ​​are inconsistent or the files are inconsistent, it is determined that the local image of the Docker container has been tampered with, and corresponding inconsistency information is output as tampered information.

[0117] Optionally, after outputting the corresponding inconsistent information as the tampered information, the method further includes:

[0118] A user instruction issued by a user according to the tampered information is received, and the local image of the Docker container is modified according to the user instruction.

[0119] Optionally, modifying the local image of the Docker container according to a user instruction specifically includes:

[0120] If the values ​​are inconsistent, replace the file of the local image of the Docker container with the file after decompression of the image layer file according to the user instruction, and synchronously update the value of the DiffID of the local image of the Docker container; or,

[0121] If the files are inconsistent, modify the files of the local image of the Docker container according to the user instructions.

[0122] Specifically, in this embodiment, Figure 2 As shown, after the code block 10 finds the tampered file, the tampered information is output to the user. The user can judge whether to delete the tampered image based on the tampered information and replace the local image with the re-downloaded image, or the user can directly modify the file of the local image. The detection method of this embodiment 1 can be detected when the container is started, after the container is started, or before the container is started.

[0123] Embodiment 2:

[0124] like Figure 3 As shown, Embodiment 2 of the present invention provides a Docker container startup method, which is applied to a Docker container local device, including:

[0125] S1, receiving the Docker container start instruction;

[0126] S2. Check whether there is a local image storing the Docker container locally;

[0127] S3. If there is storage, use the Docker container local image tampering detection method as described in Example 1 to detect whether the local image of the Docker container has been tampered with;

[0128] S4. If it has not been tampered with, run the Docker container based on the local image of the Docker container; otherwise, prohibit running the Docker container.

[0129] Optionally, after checking whether there is a local image storing the Docker container locally, the method further includes:

[0130] If not stored, download the image compression package file corresponding to the Docker container from the Docker container image repository;

[0131] Decompress the image compression package file to obtain an image layer file;

[0132] The image layer file is further decompressed, and the Docker container is run based on the decompressed file of the image layer file.

[0133] Specifically, in this embodiment, the process of starting a Docker container on the local device is as follows: Figure 4 As shown, including:

[0134] Step 1. Start a container;

[0135] Step 2. Determine whether the image is stored locally;

[0136] If the judgment result of step 2 is no, execute steps 3-5, where:

[0137] Step 3. Download the image from the image repository;

[0138] Step 4. Run the container based on the newly downloaded image;

[0139] Step 5. The container runs normally;

[0140] If the result of step 2 is yes, execute step 6 to check whether the local image has been illegally tampered with; the specific process of step 6 is as follows Figure 2 As shown;

[0141] If the judgment result of step 6 is no, execute steps 7 and 5, where:

[0142] Step 7. Run the container based on the local image; then jump to step 5;

[0143] If the result of step 6 is yes, execute steps 8-9, where:

[0144] Step 8. Disable the container from starting;

[0145] Step 9. Wait for user processing.

[0146] Figure 4 A local container tamper-proof startup method is demonstrated. The integrity of the local storage image is checked before the container runs, which can effectively avoid the container operation security risks caused by the tampering of the local image.

[0147] Embodiment 3:

[0148] like Figure 5 As shown, Embodiment 3 of the present invention provides a Docker container local image tampering detection device, comprising:

[0149] An acquisition module 31 is used to obtain the image layer file after decompressing the image compression package file corresponding to the Docker container;

[0150] A first comparison module 32, connected to the acquisition module 31, is used to compare whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container;

[0151] A second comparison module 33 is connected to the first comparison module 32, and is used to further compare whether the file after decompression of the image layer file is consistent with the file of the local image of the Docker container if the values ​​are consistent;

[0152] The determination output module 34 is connected to the second comparison module 33, and is used to determine that the local image of the Docker container has not been tampered with if the files are consistent; and to determine that the local image of the Docker container has been tampered with if the values ​​are inconsistent or the files are inconsistent, and output corresponding inconsistency information as tampered information.

[0153] Optionally, the acquisition module 31 specifically includes:

[0154] A download unit, used to download the image compression package file corresponding to the Docker container from the image repository;

[0155] A decompression unit is connected to the downloading unit and is used to decompress the image compression package file to obtain the image layer file.

[0156] Optionally, the first comparison module 32 specifically includes:

[0157] A first acquisition unit, used to acquire the hierarchical information of the image layer file;

[0158] A calculation unit, connected to the first acquisition unit, configured to calculate a SHA256 value of the image layer file according to the hierarchical information of the image layer file;

[0159] A second acquisition unit is used to obtain a value of the DiffID of the local image of the Docker container;

[0160] A first comparison unit is connected to the calculation unit and the second acquisition unit, and is used to compare whether the value of the SHA256 is consistent with the value of the DiffID.

[0161] Optionally, the Docker container local image tampering detection device further includes:

[0162] The modification module is connected to the determination output module 34 and is used to receive a user instruction issued by a user according to the tampered information, and modify the local image of the Docker container according to the user instruction.

[0163] Optionally, the modification module specifically includes:

[0164] A first modification unit is configured to replace the file of the local image of the Docker container with the file after decompression of the image layer file according to a user instruction if the values ​​are inconsistent, and to synchronously update the value of the DiffID of the local image of the Docker container; and / or,

[0165] The second modification unit is used to modify the file of the local image of the Docker container according to a user instruction if the file is inconsistent.

[0166] Embodiment 4:

[0167] like Figure 6 As shown, Embodiment 4 of the present invention provides a Docker container startup device, including:

[0168] Receiving module 1, used to receive the Docker container startup instruction;

[0169] A checking module 2, connected to the receiving module 1, is used to check whether there is a local image storing the Docker container locally;

[0170] A detection module 3, connected to the inspection module 2, is used to detect whether the local image of the Docker container has been tampered with by using the Docker container local image tampering detection method as described above if there is storage;

[0171] The running module 4 is connected to the detection module 3 and is used to run the Docker container based on the local image of the Docker container if it has not been tampered with, otherwise the running of the Docker container is prohibited.

[0172] Optionally, the Docker container starting device further includes:

[0173] A download decompression module is used to download the image compression package file corresponding to the Docker container from the Docker container image repository if there is no local image of the Docker container stored, decompress the image compression package file to obtain an image layer file, and further decompress the image layer file;

[0174] The running module 4 is also used to run the Docker container based on the file after the image layer file is decompressed.

[0175] Embodiment 5:

[0176] like Figure 7 As shown, embodiment 5 of the present invention provides a Docker container local device, the device includes a memory 10 and a processor 20, the memory 10 stores a computer program, when the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the Docker container local image tampering detection method as described in embodiment 1, and / or the Docker container startup method as described in embodiment 2.

[0177] The memory 10 is connected to the processor 20. The memory 10 may be a flash memory, a read-only memory or other memory. The processor 20 may be a central processing unit or a single-chip microcomputer.

[0178] The memory 10 includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable readonly memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0179] Embodiments 1-5 of the present invention provide a Docker container local image tampering detection method, startup method, device and equipment. The image compression package file corresponding to the Docker container is used as a basis for detecting whether the local image of the Docker container has been tampered with. The image compression package file is gradually decompressed and compared with the local image to find out whether the local image has been tampered with and where it has been tampered with. The risk of illegal tampering of the local image of the Docker container is discovered in time, thereby ensuring that the image file based on it is safe when the container is running, so that the running of the container is also safe.

[0180] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for detecting tampering of a local image of a Docker container, characterized in that: Applicable to Docker container local devices, including: Get the image layer file after decompressing the image compression package file corresponding to the Docker container; Compare the SHA256 of the image layer file with the DiffID value of the local image of the Docker container to see if they are consistent. The DiffID is pre-calculated by the local device of the Docker container based on the decompressed image layer and is used to find the local storage location of the file of the local image of the Docker container; If the values ​​are consistent, further compare the file storage directory after decompression of the image layer file with the content of the root directory of the local storage image directory layer of the local image of the Docker container to determine whether the files are consistent; If the files are consistent, it is determined that the local image of the Docker container has not been tampered with; if the values ​​are inconsistent or the files are inconsistent, it is determined that the local image of the Docker container has been tampered with, and the corresponding inconsistency information is output as the tampered information, including outputting the tampered file information in the root directory of the local storage image directory layer if the files are inconsistent.

2. The method according to claim 1, characterized in that The step of obtaining the image layer file after decompressing the image compression package file corresponding to the Docker container specifically includes: Download the image compressed package file corresponding to the Docker container from the image repository; Decompress the image compression package file to obtain the image layer file.

3. The method according to claim 1 or 2, characterized in that: The comparing whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container specifically includes: Obtaining hierarchical information of the image layer file; Calculate the SHA256 value of the image layer file according to the hierarchical information of the image layer file; Get the DiffID value of the local image of the Docker container; Compare the SHA256 value with the DiffID value to see if they are consistent.

4. The method according to claim 1, characterized in that: After outputting the corresponding inconsistent information as the tampered information, the method further includes: A user instruction issued by a user according to the tampered information is received, and the local image of the Docker container is modified according to the user instruction.

5. The method according to claim 4, characterized in that Modifying the local image of the Docker container according to the user instruction specifically includes: If the values ​​are inconsistent, replace the file of the local image of the Docker container with the file after decompression of the image layer file according to the user instruction, and synchronously update the value of the DiffID of the local image of the Docker container; or, If the files are inconsistent, modify the files of the local image of the Docker container according to the user instructions.

6. A Docker container startup method, characterized in that: Applicable to Docker container local devices, including: Receive Docker container startup instructions; Check whether there is a local image storing the Docker container locally; If there is storage, using the Docker container local image tampering detection method as described in any one of claims 1 to 5 to detect whether the local image of the Docker container has been tampered with; If it is not tampered with, the Docker container is run based on the local image of the Docker container, otherwise the running of the Docker container is prohibited.

7. The method according to claim 6, characterized in that After checking whether there is a local image storing the Docker container locally, the method further includes: If not stored, download the image compressed package file corresponding to the Docker container from the image repository; Decompress the image compression package file to obtain an image layer file; The image layer file is further decompressed, and the Docker container is run based on the decompressed file of the image layer file.

8. A Docker container local image tampering detection device, characterized in that: include: The acquisition module is used to obtain the image layer file after decompressing the image compression package file corresponding to the Docker container; A first comparison module, connected to the acquisition module, is used to compare whether the SHA256 of the image layer file is consistent with the DiffID value of the local image of the Docker container, where the DiffID is pre-calculated by the local device of the Docker container according to the decompressed image layer and is used to find the local storage location of the file of the local image of the Docker container; A second comparison module is connected to the first comparison module, and is used to further compare the file storage directory after the image layer file is decompressed with the content of the root directory of the local storage image directory layer of the local image of the Docker container if the values ​​are consistent, so as to determine whether the files are consistent; A determination output module, connected to the second comparison module, for determining that the local image of the Docker container has not been tampered with if the files are consistent; And if the values ​​are inconsistent or the files are inconsistent, it is determined that the local image of the Docker container has been tampered with, and corresponding inconsistency information is output as tampered information, including outputting tampered file information in the root directory of the local storage image directory layer if the files are inconsistent.

9. A Docker container startup device, characterized in that: include: A receiving module, used to receive a Docker container startup instruction; A checking module, connected to the receiving module, for checking whether there is a local image storing the Docker container locally; A detection module, connected to the inspection module, for detecting whether the local image of the Docker container has been tampered with by using the Docker container local image tampering detection method according to any one of claims 1 to 5 if there is storage; A running module is connected to the detection module and is used to run the Docker container based on the local image of the Docker container if it has not been tampered with, otherwise the running of the Docker container is prohibited.

10. A Docker container local device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the Docker container local image tampering detection method as described in any one of claims 1 to 5, and / or the Docker container startup method as described in any one of claims 6 to 7.

Images