Mirror construction method, apparatus, device, and storage medium

Abstract

The application belongs to the technical field of computers and discloses a mirror image construction method, device, equipment and storage medium. When a mirror image construction instruction is received, a mirror image construction file corresponding to the mirror image construction instruction is acquired; a basic mirror image and a mirror image dependent file corresponding to the mirror image construction file are acquired; security mirror image fingerprint information corresponding to the basic mirror image and security dependent fingerprint information corresponding to the mirror image dependent file are found; the basic mirror image and the mirror image dependent file are subjected to security verification according to the security mirror image fingerprint information and the security dependent fingerprint information; and when the security verification is passed, the mirror image is constructed according to the basic mirror image and the mirror image dependent file. Since the security verification is performed on the basic mirror image and the mirror image dependent file according to the pre-recorded security mirror image fingerprint information and the security dependent fingerprint information, it is ensured that the basic mirror image and the mirror image dependent file used in the mirror image construction process are not tampered with, and the security of the mirror image construction process is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular to an image construction method, device, equipment and storage medium. BACKGROUND

[0002] The current mainstream container technology solution Docker adopts a method based on an image construction file Dockerfile to construct a container image, and the Dockerfile is a text file containing multiple image construction instructions and descriptions, which has a direct impact on the construction of the container image.

[0003] In the existing container image production process, the Dockerfile needs to be edited according to actual needs and specifications first, then the docker build command is executed according to the Dockerfile to generate an image, and then the docker push instruction is used to push the completed image to the specified image repository. After the image production is completed, the corresponding Dockerfile needs to be pushed to the code repository or database for storage, so that the secondary production or optimization of the image can be based on the Dockerfile in the future.

[0004] In the secondary production or optimization process of the image, the Dockerfile needs to be read from the code repository or database to the local first, and there is no measure to check the read Dockerfile during this period, and it cannot be determined whether it meets the expectations. The read Dockerfile may have been tampered with, in addition, there are usually some dependent files when building an image, such dependent files may have been tampered with, and there is no perfect measure to check such dependent files at present.

[0005] Based on the above reasons, the existing technology image construction process has many hidden dangers, and cannot guarantee the safety of the image construction process, which is easy to be attacked by hackers, thereby causing the image to be maliciously tampered with, which may cause the image construction to fail, affect the integration and deployment of the system, or even cause the system to crash, and the business cannot operate normally, thereby causing significant losses.

[0006] The above content is only used to assist in understanding the technical solutions of the present application, and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0007] The main purpose of the present application is to provide an image construction method, device, equipment and storage medium, which aims to solve the technical problem that the prior art cannot guarantee the safety of the image construction process.

[0008] To achieve the above purpose, the present application provides a method, which comprises the following steps:

[0009] When the image building instruction is received, an image building file corresponding to the image building instruction is acquired;

[0010] An underlying image corresponding to the image building file and an image dependency file are acquired;

[0011] Security image fingerprint information corresponding to the underlying image and security dependency fingerprint information corresponding to the image dependency file are found;

[0012] The underlying image and the image dependency file are subjected to security verification according to the security image fingerprint information and the security dependency fingerprint information;

[0013] When the security verification is passed, the underlying image and the image dependency file are subjected to image building.

[0014] Optionally, the step of acquiring the image building file corresponding to the image building instruction when the image building instruction is received comprises:

[0015] When the image building instruction is received, the image building instruction is subjected to parameter analysis to obtain a building file identifier;

[0016] The image building file corresponding to the image building instruction is found in a target blockchain according to the building file identifier;

[0017] The step of finding the security image fingerprint information corresponding to the underlying image and the security dependency fingerprint information corresponding to the image dependency file comprises:

[0018] The security image fingerprint information corresponding to the underlying image and the security dependency fingerprint information corresponding to the image dependency file are found in the target blockchain.

[0019] Optionally, before the step of acquiring the image building file corresponding to the image building instruction when the image building instruction is received, the method further comprises:

[0020] When a file saving request is received, an image building file in the file saving request is extracted;

[0021] The image building file is subjected to instruction analysis to obtain a file path involved by a target instruction, so as to determine a dependency file path;

[0022] An image dependency file is determined according to the dependency file path;

[0023] The image dependency file is subjected to fingerprint operation by a preset dependency fingerprint algorithm, so as to obtain dependency fingerprint information corresponding to the image dependency file;

[0024] The image building file and the dependency fingerprint information are saved to a target blockchain.

[0025] Optionally, before the step of performing instruction analysis on the image construction file to obtain a file path involved by a target instruction to determine a dependent file path, the method further comprises:

[0026] performing a specification check and instruction validity detection on the image construction file;

[0027] When the specification check and instruction validity detection are both passed, performing the step of performing instruction analysis on the image construction file to obtain a file path involved by a target instruction to determine a dependent file path.

[0028] Optionally, after the step of performing security check on the basis image and the image dependent file to construct an image, the method further comprises:

[0029] obtaining a container image constructed;

[0030] performing fingerprint calculation on the container image by a preset image fingerprint algorithm to obtain image fingerprint information corresponding to the container image;

[0031] obtaining an image identifier corresponding to the container image, and storing the image identifier and the image fingerprint information into the target block chain;

[0032] When receiving storage success information fed back by the target block chain, saving the container image into a preset image warehouse.

[0033] Optionally, the step of obtaining the basis image and the image dependent file corresponding to the image construction file comprises:

[0034] performing instruction analysis on the image construction file to obtain a first instruction path corresponding to a first type of instruction and a second instruction path corresponding to a second type of instruction;

[0035] obtaining the basis image corresponding to the image construction file according to the first instruction path, and obtaining the image dependent file corresponding to the image construction file according to the second instruction path.

[0036] Optionally, the step of performing security check on the basis image and the image dependent file according to the security image fingerprint information and the security dependent fingerprint information comprises:

[0037] converting the basis image into a target image check format to obtain a check image file;

[0038] converting the image dependent file into a target dependent check format to obtain a check dependent file;

[0039] The preset mirror image fingerprint algorithm and the check mirror image file are used to determine check mirror image fingerprint information, and the preset dependency fingerprint algorithm and the check dependency file are used to determine check dependency fingerprint information;

[0040] When the check mirror image fingerprint information is consistent with the secure mirror image fingerprint information, and the check dependency fingerprint information is consistent with the secure dependency fingerprint information, it is determined that the security check is passed.

[0041] In addition, to achieve the above object, the application further provides an image construction device, which comprises the following modules:

[0042] A file management module is configured to acquire an image construction file corresponding to an image construction instruction when the image construction instruction is received;

[0043] An information acquisition module is configured to acquire a base image and an image dependency file corresponding to the image construction file;

[0044] An information acquisition module is configured to acquire secure mirror image fingerprint information corresponding to the base image and secure dependency fingerprint information corresponding to the image dependency file;

[0045] A security check module is configured to perform security check on the base image and the image dependency file according to the secure mirror image fingerprint information and the secure dependency fingerprint information;

[0046] An image construction module is configured to perform image construction according to the base image and the image dependency file when the security check is passed.

[0047] In addition, to achieve the above object, the application further provides an image construction device, which comprises the following modules:

[0048] In addition, to achieve the above object, the application further provides a computer readable storage medium, which stores an image construction program, and the steps of the image construction method are implemented when the image construction program is executed.

[0049] The application acquires the image building file corresponding to the image building instruction when the image building instruction is received, acquires the base image and the image dependent file corresponding to the image building file, finds the security image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the image dependent file, performs security check on the base image and the image dependent file according to the security image fingerprint information and the security dependent fingerprint information, and performs image building according to the base image and the image dependent file when the security check is passed. Since the security check is performed on the base image and the image dependent file according to the pre-recorded security image fingerprint information and the security dependent fingerprint information, it is ensured that the base image and the image dependent file used in the image building process are not tampered, and the security of the image building process is improved. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a structural schematic diagram of an electronic device of a hardware running environment related to the embodiment scheme of the application.

[0051] Figure 2 is a flowchart of the first embodiment of the image building method of the application.

[0052] Figure 3 is a flowchart of the second embodiment of the image building method of the application.

[0053] Figure 4 is a storage flowchart of the image building file in the second embodiment of the image building method of the application.

[0054] Figure 5 is a construction flowchart of the container image in the second embodiment of the image building method of the application.

[0055] Figure 6 is a structural block diagram of the first embodiment of the image building device of the application.

[0056] The implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are intended to explain the application and are not intended to limit the application.

[0058] Reference Figure 1 , Figure 1 is a structural schematic diagram of an image building device of a hardware running environment related to the embodiment scheme of the application.

[0059] As Figure 1As shown, the electronic device can include a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between the components. The user interface 1003 can include a display, an input unit such as a keyboard, and can also include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 can be a high-speed random access memory (RAM) memory, or a stable non-volatile memory (NVM), such as a disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0060] Those skilled in the art can understand that Figure 1 The structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0061] As Figure 1 As shown, the memory 1005 as a storage medium can include an operating system, a network communication module, a user interface module, and an image building program.

[0062] In Figure 1 As shown in the electronic device, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present application can be arranged in the image building device, and the electronic device calls the image building program stored in the memory 1005 through the processor 1001, and executes the image building method provided by the embodiment of the present application.

[0063] The embodiment of the present application provides an image building method, which refers to Figure 2 , Figure 2 The flowchart of the first embodiment of the image building method of the present application.

[0064] In this embodiment, the image building method includes the following steps:

[0065] Step S10: When the image building instruction is received, the image building file corresponding to the image building instruction is acquired.

[0066] It should be noted that the execution subject of this embodiment can be the image building device, which can be a personal computer, server or other electronic device, or other devices with the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the image building device is used as an example to illustrate the image building method of the present invention.

[0067] It should be noted that the image build instruction can be an instruction generated on the image build device when a user needs to build an image, or it can be an instruction sent by the user to the image build device from another device. The image build instruction may include a build file identifier for the image build file, which can be a unique identifier for the image build file. Obtaining the image build file corresponding to the image build instruction can involve retrieving the build file identifier from the image build instruction, and then searching for the image build file in the image build file repository based on the build file identifier. The image build file repository can be a database, code repository, or other similar library used to store pre-edited image build files.

[0068] Step S20: Obtain the base image and image dependency files corresponding to the image build file.

[0069] It's important to note that when building a container image, a base image is typically used as the foundation, upon which customizations are made. This base image is called the base image. An image build file can contain multiple build instructions, each specifying the dependency files required during the image construction process. Obtaining the base image and dependency files corresponding to an image build file involves reading the build instructions within the file and determining these instructions accordingly.

[0070] Furthermore, to ensure accurate acquisition of the base image and image dependency files corresponding to the image build file, step S20 in this embodiment may include:

[0071] The image build file is parsed to obtain a first instruction path corresponding to a first type of instruction and a second instruction path corresponding to a second type of instruction; the base image corresponding to the image build file is obtained according to the first instruction path, and the image dependency file corresponding to the image build file is obtained according to the second instruction path.

[0072] It should be noted that the first type of instruction can be the image build instruction used to specify the base image in the image build file generation specification, such as the FROM instruction. The second type of instruction can be the image build instruction used to specify the dependent files in the image build file generation specification, such as the COPY and ADD instructions.

[0073] It can be understood that the image building instruction in the image building file is set to be a file introduction instruction, and the file introduction path is generally included in the instruction. The file introduction path can be a path of a single file or a specified directory. For example, when a single file A is introduced, the path of the file A is / XX / A, the path of the file A is taken as the file introduction path, and the corresponding image building instruction is ADD / XX / A. Or, when multiple files are introduced, a directory / XX / X / can be specified as the dependent file path, and the corresponding image building instruction is ADD / XX / X / (all files in the / XX / X / directory are taken as image dependent files). The first instruction path corresponding to the first type instruction can be the file introduction path included in the first type instruction, which is taken as the first instruction path. The second instruction path corresponding to the second type instruction can be the file introduction path included in the second type instruction, which is taken as the second instruction path.

[0074] It should be understood that since the first type instruction is an instruction for specifying a base image and the second type instruction is an instruction for specifying a dependent file, the base image can be obtained through the first instruction path and the image dependent file can be obtained through the second instruction path.

[0075] In actual use, the first type instruction in the image building file generally has only one instruction, that is, only one base image is generally specified, and the second type instruction can have multiple instructions, that is, multiple image dependent files can be specified. When there are multiple second type instructions, the multiple second type instructions can be processed separately, the second instruction path corresponding to each second type instruction is obtained, and finally multiple image dependent files are obtained according to the second instruction paths.

[0076] Step S30: searching for the security image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the image dependent file.

[0077] It should be noted that searching for the security image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the image dependent file can be searching for the security image fingerprint information corresponding to the base image and the security dependent fingerprint information of the image dependent file in the security fingerprint information library. The security image fingerprint information can be the fingerprint information corresponding to the base image, the security dependent fingerprint information can be the fingerprint information corresponding to the image dependent file, the security fingerprint information library can be a database or other functionally similar library that saves the fingerprint information of each file, and the fingerprint information in the security fingerprint information library can be pre-entered by the administrator.

[0078] It can be understood that when there are multiple image dependent files, the security dependent fingerprint information corresponding to each image dependent file can be obtained respectively.

[0079] Step S40: Perform security verification on the base image and the image dependency files based on the security image fingerprint information and the security dependency fingerprint information.

[0080] Understandably, by verifying the security of the base image and its dependent files based on the security image fingerprint and security dependency fingerprint, it can be determined whether the base image and its dependent files have been tampered with.

[0081] Furthermore, in order to quickly perform security verification and improve verification efficiency, step SS40 of this embodiment may include:

[0082] The base image is converted into the target image verification format to obtain a verification image file; the image dependency file is converted into the target dependency verification format to obtain a verification dependency file; the verification image fingerprint information is determined by a preset image fingerprint algorithm and the verification image file, and the verification dependency fingerprint information is determined by a preset dependency fingerprint algorithm and the verification dependency file; when the verification image fingerprint information is consistent with the security image fingerprint information, and the verification dependency fingerprint information is consistent with the security dependency fingerprint information, the security verification is deemed to have passed.

[0083] It should be noted that the base image and its dependent files may not be a single file, but rather a combination of multiple files. Calculating fingerprint information directly in the original format may be very slow. Therefore, converting the base image to the target image verification format and the image dependent files to the target dependency verification format can facilitate fingerprint information calculation and thus improve efficiency.

[0084] In practical use, converting the base image to the target image verification format to obtain a verification image file can be done by saving the base image as a compressed file with the ".tar" extension using the "docker save" command. Converting image dependency files to the target dependency verification format to obtain verification dependency files can be done by compressing the image dependency files into a compressed file with the ".zip" extension. The default image fingerprint algorithm can be the secure hash algorithm SHA256, or an algorithm similar to MD5. The default dependency fingerprint algorithm can also be the secure hash algorithm SHA256, or an algorithm similar to MD5. Both the default image fingerprint algorithm and the default dependency fingerprint algorithm can be preset by administrators; they can use the same algorithm or different algorithms.

[0085] It can be understood that if the verification image fingerprint information is consistent with the secure image fingerprint information, it can be indicated that the base image has not been tampered with, and if the verification dependency fingerprint information is consistent with the secure dependency fingerprint information, it can be indicated that the image dependency file has not been tampered with.

[0086] Step S50: When the security verification passes, performing image construction according to the base image and the image dependency file.

[0087] It should be noted that if the security verification passes, it indicates that the base image and the image dependency file have not been tampered with, and therefore the image construction operation can be performed.

[0088] In actual use, the image construction can be performed according to the base image and the image dependency file through the docker build command, and the target image can be obtained when the construction is completed.

[0089] It can be understood that after the image construction is completed, the target image obtained by the construction can also be pushed to the preset image repository for saving, so as to be reused subsequently, for example, the image is directly pulled from the preset image repository for deployment to the container for running or the constructed target image is used as a base image for secondary image construction.

[0090] The embodiment obtains the image construction file corresponding to the image construction instruction when the image construction instruction is received, obtains the base image and the image dependency file corresponding to the image construction file, finds the secure image fingerprint information corresponding to the base image and the secure dependency fingerprint information corresponding to the image dependency file, performs security verification on the base image and the image dependency file according to the secure image fingerprint information and the secure dependency fingerprint information, and performs image construction according to the base image and the image dependency file when the security verification passes. Since the security verification is performed on the base image and the image dependency file according to the pre-recorded secure image fingerprint information and the secure dependency fingerprint information, it is ensured that the base image and the image dependency file used in the image construction process have not been tampered with, and the security of the image construction process is improved.

[0091] Reference Figure 3 , Figure 3 The flowchart of a second embodiment of the image construction method of the application is shown.

[0092] Based on the above-mentioned first embodiment, the image construction method of the embodiment further includes, before the step S10:

[0093] Step S01: When a file saving request is received, extracting the image construction file in the file saving request.

[0094] It should be noted that the file saving request can be a request sent by a user to the image building device when the user needs to save the image building file after editing the image building file, and the file saving request can include the image building file that needs to be saved. Extracting the image building file in the file saving request can be parsing the file saving request to obtain the image building file included in the file saving request.

[0095] Step S02: performing instruction analysis on the image building file to obtain a file path involved by a target instruction, so as to determine a dependent file path.

[0096] It should be noted that the target instruction can be a second type instruction, that is, an instruction for specifying a dependent file, and obtaining a file path involved by the target instruction to determine a dependent file path can be reading a dependent file path included in the target instruction.

[0097] It can be understood that the base image used when editing the image building file is generally an image already existing in the preset image repository, so it is not necessary to generate fingerprint information of the base image when saving the image building file, and therefore the base image does not need to be obtained here.

[0098] Further, in order to ensure that all saved image building files can be normally used, the embodiment can further include, before step S02:

[0099] performing specification checking and instruction validity detection on the image building file; when the specification checking and the instruction validity detection are both passed, performing the step of performing instruction analysis on the image building file to obtain a file path involved by a target instruction, so as to determine a dependent file path.

[0100] It should be noted that the specification checking can be checking whether the content in the image building file conforms to the specification of the image building file of Docker, and the instruction validity detection can be detecting whether each image building instruction in the image building file is a valid instruction, for example, detecting whether the file corresponding to the image building instruction exists and whether the file format conforms to the requirements.

[0101] It can be understood that since the image building file is edited manually, manual operation is prone to editing errors, instruction writing errors, and the like in practice, and if the image building file is directly saved, the saved image building file can have format errors, instruction errors, or file specification errors, and the like, resulting in that a container image cannot be correctly built according to the image building file. Therefore, before saving, the image building file can be first subjected to specification checking and instruction validity detection. When the specification checking and the validity detection are both passed, it indicates that a container image can be correctly built according to the image building file, and therefore the subsequent steps can be performed.

[0102] In actual use, when the normative check fails or the instruction validity detection fails, a failure report can also be generated according to the normative check result or the instruction validity detection result, and the failure report is displayed to the user to prompt the user to the cause of the failure so as to modify the mirror building file.

[0103] Step S03: determining a mirror dependency file according to the dependency file path.

[0104] It can be understood that determining the mirror dependency file according to the dependency file path can be reading the file corresponding to the dependency file path to obtain the mirror dependency file.

[0105] Step S04: performing fingerprint operation on the mirror dependency file by a preset dependency fingerprint algorithm to obtain dependency fingerprint information corresponding to the mirror dependency file.

[0106] It should be noted that the preset dependency fingerprint algorithm can also be a secure hash algorithm 256, or other similar algorithms. The preset dependency fingerprint algorithm can be used to perform fingerprint operation on the mirror dependency file to obtain the dependency fingerprint information corresponding to the mirror dependency file, which can be compressing the mirror dependency file into a compressed file with a “.zip” suffix, and then calculating the hash value of the compressed file by the preset dependency fingerprint algorithm, and taking the calculated hash value as the dependency fingerprint information corresponding to the mirror dependency file.

[0107] Step S05: saving the mirror building file and the dependency fingerprint information to a target blockchain.

[0108] It should be noted that the blockchain has technical features such as tamper resistance and traceability, so storing the mirror building file in the target blockchain can effectively prevent the mirror building file and the dependency fingerprint information from being tampered with, and can improve security.

[0109] In actual use, according to actual needs, the association relationship between each mirror dependency file can also be saved to the target blockchain.

[0110] It can be understood that when the target blockchain finishes saving the mirror building file and the dependency fingerprint information, it can also feed back the building file identifier of the mirror building file in the target blockchain to the mirror building device, and the mirror building device can save the building file identifier.

[0111] Step S10 can specifically include:

[0112] Step S101: when receiving a mirror building instruction, performing parameter analysis on the mirror building instruction to obtain a building file identifier.

[0113] It can be understood that the mirror image construction instruction can contain a file identifier of a specified mirror image construction file, that is, a construction file identifier. The mirror image construction instruction is parsed to obtain the parameters carried in the mirror image construction instruction, and the construction file identifier is obtained.

[0114] Step S102: searching for the mirror image construction file corresponding to the mirror image construction instruction in the target blockchain according to the construction file identifier.

[0115] It should be noted that, since the blockchain has the technical features of tamper resistance and traceability, searching for the mirror image construction file corresponding to the mirror image construction instruction in the target blockchain according to the construction file identifier can effectively prevent the mirror image construction file from being tampered with and improve security.

[0116] The step S30 comprises:

[0117] Step S30': searching for the security mirror image fingerprint information corresponding to the base image and the security dependency fingerprint information corresponding to the mirror image dependency file in the target blockchain.

[0118] It can be understood that, since the blockchain has the technical features of tamper resistance and traceability, saving the fingerprint information of each file to the target blockchain can ensure the authenticity of the security mirror image fingerprint information corresponding to the base image and the security dependency fingerprint information corresponding to the mirror image dependency file found in the target blockchain, improve the effectiveness of security verification, and further improve security.

[0119] Further, in order to facilitate subsequent determination of whether the constructed container image has been tampered with when the container image is reused, and to ensure the security of image reuse, the embodiment step S50 can further comprise:

[0120] When the image construction is completed, the container image constructed is obtained; a fingerprint of the container image is calculated by a preset mirror image fingerprint algorithm to obtain mirror image fingerprint information corresponding to the container image; a mirror image identifier corresponding to the container image is obtained, and the mirror image identifier and the mirror image fingerprint information are stored in the target blockchain; when receiving storage success information fed back by the target blockchain, the container image is saved in a preset image warehouse.

[0121] It should be noted that the preset mirror fingerprint algorithm can be a secure hash algorithm 256, or an algorithm similar to MD5. The preset mirror fingerprint algorithm can be used to perform fingerprint operation on the container mirror to obtain the mirror fingerprint information corresponding to the container mirror. The container mirror can be saved as a compressed file with a ".tar" suffix by using the "docker save" command, and then the hash value of the compressed file can be calculated by using the preset mirror fingerprint algorithm, and the hash value can be used as the mirror fingerprint information corresponding to the container mirror. The mirror identifier can be the identifier of the container mirror. The mirror identifier and the mirror fingerprint information can be stored in the target block chain. The container mirror can be saved in the preset mirror warehouse. The container mirror can be pushed into the preset mirror warehouse, so that the preset mirror warehouse saves the container mirror.

[0122] It can be understood that when the preset mirror warehouse receives the container mirror, the mirror identifier corresponding to the container mirror can be obtained, and whether there is a container mirror with the same mirror identifier has been saved can be found according to the mirror identifier. If not, the container mirror is saved. If it exists, it can not be saved, or the existing container mirror can be cleared and the received container mirror can be saved.

[0123] It can be understood that since the mirror fingerprint information corresponding to the container mirror is stored in the target block chain, when the container mirror needs to be reused in the future, the mirror fingerprint information corresponding to the container mirror can be found in the target block chain to verify the container mirror, and whether the container mirror obtained when the mirror is reused is tampered with can be confirmed.

[0124] Reference Figure 4 , Figure 4 The storage process diagram of the mirror construction file of the embodiment is shown in FIG. 1.

[0125] As Figure 4As shown, when the user finishes editing the image build file (Dockerfile file), the user generates a file saving request according to the Dockerfile file and sends the file saving request to the image building device. Upon receiving the file saving request, the image building device can parse the file saving request to obtain the Dockerfile file, perform a standardization check (i.e., a standardization check and a command validity detection) on the Dockerfile file, and if the standardization check fails, show the user the reason for the failure so that the user can adjust the Dockerfile file. If the standardization check passes, the Dockerfile file is parsed to obtain a dependency file path corresponding to a second type of instruction in the Dockerfile file, a file corresponding to the dependency file path (i.e., a file set in a context path) is obtained, dependency fingerprint information of each dependency file is calculated, and the Dockerfile file, the dependency fingerprint information of each dependency file, and the association relationship between the dependency files are chained (i.e., stored in a target blockchain).

[0126] Reference Figure 5 , Figure 5 A schematic diagram of a container image building process of the present embodiment.

[0127] In actual use, in the process of performing a security check on the base image and the image dependency file according to the security image fingerprint information and the security dependency fingerprint information, the base image can be checked for security first, and then the image dependency file can be checked for security. If there are multiple image dependency files, each image dependency file can be checked in turn in a loop.

[0128] Figure 5 In the above process, the Dockerfile is an image build file, the base image is obtained by pulling the base image, the source directory file is an image dependency file, the base image hash is determined by a preset image fingerprint algorithm and the base image, the source directory file hash associated with the instruction is determined by a preset dependency fingerprint algorithm and the dependency file, and the image information is stored in a target blockchain.

[0129] The embodiment extracts the image construction file in the file saving request when receiving the file saving request, performs instruction analysis on the image construction file, obtains the file path involved by the target instruction to determine the dependent file path, determines the image dependent file according to the dependent file path, performs fingerprint operation on the image dependent file through a preset dependent fingerprint algorithm to obtain the dependent fingerprint information corresponding to the image dependent file, and saves the image construction file and the dependent fingerprint information to the target blockchain. Since the image construction file and the dependent fingerprint information are both saved to the target blockchain, and the blockchain has the technical features of tamper resistance and traceability, the image construction file can be ensured not to be tampered with when the image construction file is obtained from the target blockchain during subsequent container image construction, the safety image fingerprint information corresponding to the base image and the safety dependent fingerprint information corresponding to the image dependent file can be found in the target blockchain, the authenticity of the found safety image fingerprint information and safety dependent fingerprint information can be ensured, the effectiveness of the security verification can be improved, and the security during the image construction process is further improved.

[0130] In addition, the embodiment of the present application also provides a storage medium, wherein the storage medium stores an image construction program, and the image construction program is executed by a processor to realize the steps of the image construction method described above.

[0131] Reference Figure 4 , Figure 4 is a structural block diagram of the first embodiment of the image construction device of the present application.

[0132] As Figure 4 shown, the image construction device provided by the embodiment of the present application comprises:

[0133] The file management module 401 is configured to obtain the image construction file corresponding to the image construction instruction when receiving the image construction instruction.

[0134] The information acquisition module 402 is configured to obtain the base image and the image dependent file corresponding to the image construction file.

[0135] The information acquisition module 403 is configured to find the safety image fingerprint information corresponding to the base image and the safety dependent fingerprint information corresponding to the image dependent file.

[0136] The security verification module 404 is configured to perform security verification on the base image and the image dependent file according to the safety image fingerprint information and the safety dependent fingerprint information.

[0137] The image construction module 405 is configured to perform image construction according to the base image and the image dependent file when the security verification is passed.

[0138] The embodiment obtains the image building file corresponding to the image building instruction when receiving the image building instruction, obtains the base image and the image dependent file corresponding to the image building file, finds the security image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the image dependent file, performs security check on the base image and the image dependent file according to the security image fingerprint information and the security dependent fingerprint information, and performs image building according to the base image and the image dependent file when the security check is passed. Since the security check is performed on the base image and the image dependent file according to the pre-recorded security image fingerprint information and the security dependent fingerprint information, it is ensured that the base image and the image dependent file used in the image building process are not tampered with, and the security of the image building process is improved.

[0139] Further, the file management module 401 is further configured to, when receiving an image building instruction, perform parameter analysis on the image building instruction to obtain a building file identifier, and find an image building file corresponding to the image building instruction in a target blockchain according to the building file identifier.

[0140] The information acquisition module 403 is further configured to find security image fingerprint information corresponding to the base image and security dependent fingerprint information corresponding to the image dependent file in the target blockchain.

[0141] Further, the file management module 401 is further configured to, when receiving a file saving request, extract an image building file in the file saving request, perform instruction analysis on the image building file to obtain a file path involved in a target instruction, determine a dependent file path, determine an image dependent file according to the dependent file path, perform fingerprint operation on the image dependent file by a preset dependent fingerprint algorithm to obtain dependent fingerprint information corresponding to the image dependent file, and save the image building file and the dependent fingerprint information to a target blockchain.

[0142] Further, the file management module 401 is further configured to perform specification checking and instruction validity detection on the image building file, and perform the instruction analysis on the image building file to obtain a file path involved in a target instruction to determine a dependent file path when the specification checking and the instruction validity detection are both passed.

[0143] Further, the mirror image construction module 405 is further configured to, when the mirror image construction is completed, acquire the container mirror image constructed; perform fingerprint operation on the container mirror image by using a preset mirror image fingerprint algorithm to obtain mirror image fingerprint information corresponding to the container mirror image; acquire a mirror image identifier corresponding to the container mirror image, and store the mirror image identifier and the mirror image fingerprint information into the target block chain; and when receiving storage success information fed back by the target block chain, save the container mirror image into a preset mirror image warehouse.

[0144] Further, the information acquisition module 402 is further configured to perform instruction analysis on the mirror image construction file to acquire a first instruction path corresponding to a first type of instruction and a second instruction path corresponding to a second type of instruction; acquire a base mirror image corresponding to the mirror image construction file according to the first instruction path, and acquire a mirror image dependent file corresponding to the mirror image construction file according to the second instruction path.

[0145] Further, the security verification module 404 is further configured to convert the base mirror image into a target mirror image verification format to obtain a verification mirror image file; convert the mirror image dependent file into a target dependent verification format to obtain a verification dependent file; determine verification mirror image fingerprint information by using a preset mirror image fingerprint algorithm and the verification mirror image file, and determine verification dependent fingerprint information by using a preset dependent fingerprint algorithm and the verification dependent file; and when the verification mirror image fingerprint information is consistent with the security mirror image fingerprint information, and the verification dependent fingerprint information is consistent with the security dependent fingerprint information, determine that the security verification is passed.

[0146] It should be understood that the above is only an example, and does not constitute any limitation on the technical solutions of the present application. In specific applications, those skilled in the art can set it according to the needs, and the present application does not limit it.

[0147] It should be noted that the above-described workflow is only illustrative and does not limit the scope of protection of the present application. In actual application, those skilled in the art can select part or all of them according to actual needs to achieve the purpose of the embodiment, which is not limited here.

[0148] In addition, technical details not described in detail in this embodiment can be referred to the mirror image construction method provided by any embodiment of the present application, which will not be repeated here.

[0149] Moreover, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of "including" "comprising" or "having" and variations thereof herein is intended to encompass the presence of one or more recited elements or steps and not the exclusion of any other integers or steps. The use of "including", "comprising", "having" and "with" and variations thereof herein is intended to encompass the presence of one or more recited elements or steps and not the exclusion of any other integers or steps.

[0150] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0151] Those skilled in the art can clearly understand the above-mentioned embodiment methods by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a read only memory (ROM) / RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in the embodiments of the present application.

[0152] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, which is made by using the content of the specification and drawings of the present application, is also included in the patent protection scope of the present application.

Claims

1. A mirror construction method, characterized by, The mirror image construction method comprises the following steps: Upon receiving the mirror image construction instruction, the mirror image construction file corresponding to the mirror image construction instruction is acquired; The base image and the mirror image dependent file corresponding to the mirror image construction file are acquired; The security mirror image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the mirror image dependent file are found out; The security of the base image and the mirror image dependent file is checked according to the security mirror image fingerprint information and the security dependent fingerprint information; Upon passing the security check, the mirror image is constructed according to the base image and the mirror image dependent file; Before the step of acquiring the mirror image construction file corresponding to the mirror image construction instruction upon receiving the mirror image construction instruction, the method further comprises the following steps: Upon receiving the file saving request, the mirror image construction file in the file saving request is extracted; The file path involved by the target instruction is acquired by performing instruction analysis on the mirror image construction file, so as to determine the dependent file path; The mirror image dependent file is determined according to the dependent file path; The dependent fingerprint information corresponding to the mirror image dependent file is obtained by performing fingerprint operation on the mirror image dependent file through a preset dependent fingerprint algorithm; The mirror image construction file and the dependent fingerprint information are saved to the target blockchain.

2. The mirror construction method of claim 1, wherein, The step of acquiring the mirror image construction file corresponding to the mirror image construction instruction upon receiving the mirror image construction instruction comprises the following steps: Upon receiving the mirror image construction instruction, the construction file identifier is obtained by performing parameter analysis on the mirror image construction instruction; The mirror image construction file corresponding to the mirror image construction instruction is found out in the target blockchain according to the construction file identifier; The step of finding out the security mirror image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the mirror image dependent file comprises the following steps: The security mirror image fingerprint information corresponding to the base image and the security dependent fingerprint information corresponding to the mirror image dependent file are found out in the target blockchain.

3. The mirror construction method of claim 1, wherein, Before the step of acquiring the file path involved by the target instruction by performing instruction analysis on the mirror image construction file, so as to determine the dependent file path, the method further comprises the following steps: The mirror image construction file is subjected to specification checking and instruction validity detection; When the specification checking and the instruction validity detection are both passed, the step of acquiring the file path involved by the target instruction by performing instruction analysis on the mirror image construction file, so as to determine the dependent file path, is performed.

4. The mirror construction method of claim 2, wherein, After the step of constructing the mirror image according to the base image and the mirror image dependent file upon passing the security check, the method further comprises the following steps: Upon completing the mirror image construction, the container image constructed is acquired; The container image is subjected to fingerprint operation through a preset mirror image fingerprint algorithm, so as to obtain the mirror image fingerprint information corresponding to the container image; The mirror image identifier corresponding to the container image is acquired, and the mirror image identifier and the mirror image fingerprint information are stored to the target blockchain; Upon receiving the storage success information fed back by the target blockchain, the container image is saved to a preset mirror image warehouse.

5. The mirror construction method according to any one of claims 1 to 4, wherein The step of acquiring the base image and the mirror image dependent file corresponding to the mirror image construction file comprises the following steps: The mirror image construction file is subjected to instruction analysis, a first instruction path corresponding to a first type of instruction and a second instruction path corresponding to a second type of instruction are obtained; The first instruction path is used to obtain a base image corresponding to the mirror image construction file, and the second instruction path is used to obtain a mirror image dependency file corresponding to the mirror image construction file.

6. The mirror construction method according to any one of claims 1 to 4, wherein The step of performing security verification on the base image and the mirror image dependency file according to the security mirror image fingerprint information and the security dependency fingerprint information comprises: The base image is converted into a target mirror image verification format to obtain a verification mirror image file; The mirror image dependency file is converted into a target dependency verification format to obtain a verification dependency file; Verification mirror image fingerprint information is determined through a preset mirror image fingerprint algorithm and the verification mirror image file, and verification dependency fingerprint information is determined through a preset dependency fingerprint algorithm and the verification dependency file; When the verification mirror image fingerprint information is consistent with the security mirror image fingerprint information, and the verification dependency fingerprint information is consistent with the security dependency fingerprint information, it is determined that the security verification is passed.

7. A mirror construction apparatus, characterized by The mirror image construction device comprises the following modules: A file management module is configured to obtain a mirror image construction file corresponding to a mirror image construction instruction when the mirror image construction instruction is received; An information obtaining module is configured to obtain a base image and a mirror image dependency file corresponding to the mirror image construction file; An information obtaining module is configured to find security mirror image fingerprint information corresponding to the base image and security dependency fingerprint information corresponding to the mirror image dependency file; A security verification module is configured to perform security verification on the base image and the mirror image dependency file according to the security mirror image fingerprint information and the security dependency fingerprint information; A mirror image construction module is configured to perform mirror image construction according to the base image and the mirror image dependency file when the security verification is passed. Before the step of obtaining the mirror image construction file corresponding to the mirror image construction instruction when the mirror image construction instruction is received, the following step is further included: When a file saving request is received, a mirror image construction file in the file saving request is extracted; The mirror image construction file is subjected to instruction analysis, a file path involved in a target instruction is obtained to determine a dependency file path; A mirror image dependency file is determined according to the dependency file path; A dependency fingerprint information corresponding to the mirror image dependency file is obtained through fingerprint operation on the mirror image dependency file by using a preset dependency fingerprint algorithm; The mirror image construction file and the dependency fingerprint information are saved to a target block chain.

8. A mirror construction device, characterized by The mirror image construction device comprises a processor, a memory, and a mirror image construction program stored on the memory and executable on the processor, and the mirror image construction program, when executed by the processor, implements the steps of the mirror image construction method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The mirror image construction program is stored on the computer readable storage medium, and the mirror image construction program, when executed, implements the steps of the mirror image construction method according to any one of claims 1-6.

Images