Container mirror image security reinforcement method and system

Abstract

The invention provides a container mirror image security reinforcement method and system.The method is scheduled and executed by a Jenkins assembly line, and when the method is executed, a service source code and a container mirror image construction instruction are obtained; obtaining a basic container mirror image based on the container mirror image construction instruction in response to security scanning of the security reinforcement server on the service source code and the container mirror image construction instruction; and in response to security scanning of the security reinforcement server on the basic container mirror image, constructing a service container mirror image based on the service source code, the container mirror image construction instruction and the basic container mirror image. Therefore, the source code and the basic container mirror image are scanned through the security reinforcement server, so that the security of easy mirror image manufacturing is ensured; in addition, the container mirror image security reinforcement method provided by the embodiment of the invention is automatically dispatched and executed by a Jenkins assembly line, so that the manufacturing efficiency and normalization of the container mirror image are improved.

Description

Technical Field

[0001] The present application relates to the field of software information technology, and in particular to a container image security reinforcement method and system. Background Art

[0002] Jenkins is an open source, scalable web-based software development and operation platform for continuous integration, delivery, and deployment. The Jenkins pipeline is a method of automating software development workflows that can be used for tasks such as building, testing, and deployment.

[0003] In the cloud-native era, Docker container technology has quickly become the standard for application deployment due to its lightweight and efficient features. Container images are generally produced by pulling code, compiling and building, and using Dockerfile. However, the production process of container images is accompanied by security challenges, such as image vulnerabilities and configuration errors. How to securely harden container images to ensure the security of containers has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, the present application provides a container image security reinforcement method and system for performing security reinforcement on container images to ensure the security of container production.

[0005] The technical solution is as follows:

[0006] In a first aspect, an embodiment of the present application provides a method for securing a container image, the method being executed by a Jenkins pipeline scheduler, the method comprising:

[0007] Obtain business source code and container image building instructions;

[0008] In response to the security hardening server performing a security scan on the business source code and the container image building instruction, obtaining a basic container image based on the container image building instruction;

[0009] In response to the security hardening server performing a security scan on the base container image, a business container image is built based on the business source code, the container image building instruction, and the base container image.

[0010] In an optional implementation, obtaining the service source code and the container image building instruction includes:

[0011] The Jenkins server obtains the business source code and the container image building instructions from the code repository server.

[0012] In an optional implementation, obtaining a base container image based on the container image building instruction includes:

[0013] The security reinforcement server obtains the container image building instruction sent by the Jenkins server;

[0014] The security hardening server determines the storage address of the basic container image based on the container image building instruction;

[0015] The security hardening server obtains the basic container image from a public container image repository based on the storage address.

[0016] In an optional implementation, the method further includes:

[0017] The security hardening server performs a security scan on the basic container image, and after the basic container image passes the security scan, stores the basic container image in a secure container image repository to obtain a hardened basic container image.

[0018] In an optional implementation, the method further includes:

[0019] The security hardening server modifies the storage address of the basic container image to a hardened storage address associated with the secure container image repository;

[0020] The security hardening server modifies the container image building instruction into a hardened container image building instruction based on the hardened storage address;

[0021] The security hardening server sends the business source code and the hardened container image building instructions to the container compilation node.

[0022] In an optional implementation, building a business container image based on the business source code, the container image building instruction, and the basic container image includes:

[0023] The container compilation node determines the hardened storage address according to the hardened container image building instruction;

[0024] The container compilation node obtains the hardened basic container image based on the hardened storage address;

[0025] The container compilation node builds the business container image based on the business source code, the reinforced container image building instructions and the reinforced basic container image.

[0026] In a second aspect, an embodiment of the present application provides a container image security reinforcement system, which is executed by a Jenkins pipeline scheduling, and the system includes: a Jenkins server, a security reinforcement server, and a container compilation node; wherein,

[0027] The Jenkins server is used to obtain business source code and container image building instructions;

[0028] The security reinforcement server is used to perform a security scan on the business source code and the container image building instruction, and after the business source code and the container image building instruction pass the security scan, obtain a basic container image based on the container image building instruction;

[0029] The container compilation node is used to build a business container image based on the business source code, the container image building instructions and the basic container image by performing a security scan on the basic container image on the security hardening server.

[0030] In an optional implementation, the system further includes: a code repository server; and the Jenkins server, which is specifically used to obtain the business source code and the container image building instructions from the code repository server.

[0031] In an optional implementation, the system further includes: a public container image repository; and the security hardening server is specifically used to:

[0032] Obtain the container image building instruction sent by the Jenkins server;

[0033] Determining a storage address of the base container image based on the container image building instruction;

[0034] The basic container image is obtained from the public container image repository based on the storage address.

[0035] In an optional implementation, the system also includes: a secure container image repository; the security hardening server is also used to: perform a security scan on the base container image, and after the base container image passes the security scan, store the base container image in the secure container image repository to obtain a hardened base container image.

[0036] In an optional implementation, the security hardening server is further used to:

[0037] Modify the storage address of the base container image to a hardened storage address associated with the secure container image repository;

[0038] Modifying the container image building instruction into a hardened container image building instruction based on the hardened storage address;

[0039] The business source code and the hardened container image building instructions are sent to the container compilation node.

[0040] In an optional implementation, the container compilation node is specifically used to:

[0041] Determine the hardened storage address according to the hardened container image building instruction;

[0042] Acquire the hardened basic container image based on the hardened storage address;

[0043] The business container image is constructed based on the business source code, the reinforced container image construction instruction and the reinforced basic container image.

[0044] The above technical solution has the following beneficial effects:

[0045] The embodiment of the present application provides a method for security reinforcement of container images. The method is scheduled and executed by the Jenkins pipeline. When executing the method, the business source code and the container image building instructions are obtained; in response to the security reinforcement server performing a security scan on the business source code and the container image building instructions, a basic container image is obtained based on the container image building instructions; in response to the security reinforcement server performing a security scan on the basic container image, a business container image is constructed based on the business source code, the container image building instructions and the basic container image. It can be seen that the present application scans the source code and the basic container image through the security reinforcement server to ensure the security of easy image production; in addition, the container image security reinforcement method provided by the embodiment of the present application is automatically scheduled and executed by the Jenkins pipeline, which improves the efficiency and standardization of container image production.

[0046] The embodiment of the present application also provides a system corresponding to the above method, which has the same beneficial effects as the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of the structure of a container image security reinforcement system provided in an embodiment of the present application;

[0048] Figure 2 A flowchart of a container image security reinforcement method provided in an embodiment of the present application;

[0049] Figure 3 A schematic diagram of a workflow of a security reinforcement server provided in an embodiment of the present application;

[0050] Figure 4 A flowchart of another method for securing a container image provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] In order to achieve security reinforcement of container images to ensure the security of container image production, the embodiment of the present application provides a container image security reinforcement method, which can be executed by Jenkins pipeline scheduling. The method can be applied to Figure 1 The container image security reinforcement system provided includes: Jenkins server Server1, code repository server Server2, public container image repository Server3, secure container image repository Server4, security reinforcement server Server5 and container compilation node Server6.

[0053] Jenkins server Server1 can schedule other services Server2 to Server6 based on the Jenkins pipeline.

[0054] The code repository server Server2 is used to store business source code and container image building instructions Dockerfile. Dockerfile is a text file that contains all the instructions for building a Docker image. Dockerfile defines the image building process through a series of instructions. These instructions describe how to start from the base image, add, modify or install necessary software and configuration, and finally generate a new Docker image. These instructions can be about setting up the working environment, installing software, defining environment variables, etc., to ensure that the image has all the required functions and configurations.

[0055] The public container image repository Server3 is used to store basic container images that have not been security scanned.

[0056] The secure container image repository Server4 is used to store scanned and hardened basic container images and prepared business container images.

[0057] The security reinforcement server Server5 is used to perform static scanning of business codes, virus scanning of business codes, security scanning of container image building instructions Dockerfile, security scanning of public basic images, reinforcement of container image building instructions Dockerfile, etc.

[0058] The container compilation node Server6 is used to only allow the basic container image to be pulled from the secure container image repository Server4 based on a pre-set network security policy, and to provide a secure compilation environment for making container images.

[0059] It should be noted that the embodiment of the present application does not limit the deployment method of Server1 to Server6 in actual applications. Technical personnel can deploy different services separately on different servers, or deploy some or all of the services on one server as appropriate. The embodiment of the present application does not limit this.

[0060] Combine the following Figure 2 A container image security reinforcement method provided in an embodiment of the present application is described, and the method may include:

[0061] Step S100: Obtain business source code and container image building instructions.

[0062] Among them, the business source code is the code used to make the business container image to realize the business function. It is generally pre-compiled by the staff and stored in the code warehouse server. The container image building instruction is specifically Dockerfile. Dockerfile is a text file that contains all the instructions for building the container image. Dockerfile is also pre-written by the staff and stored in the code warehouse server.

[0063] Optionally, the above step S100 specifically includes: the Jenkins server obtains business source code and container image building instructions from the code repository server.

[0064] Among them, the Jenkins pipeline calls the Jenkins server to obtain business source code and container image building instructions from the code repository server.

[0065] Step S200: In response to the security hardening server performing a security scan on the business source code and the container image building instructions, a basic container image is obtained based on the container image building instructions.

[0066] Among them, after obtaining the business source code and container image building instructions, the Jenkins server pushes them to the security hardening server, and the security hardening server performs a security scan on the business source code and container image building instructions. When the security scan passes, the security hardening server obtains the basic container image from the public container image repository through the container image building instructions. It can be understood that the container image building instructions include the storage information and container image information of the basic container image, and the security hardening server can obtain the basic container image from the public container image repository based on the storage information and container image information.

[0067] Specifically, the security hardening server can perform static code scanning and virus scanning on the business source code. Static code scanning on the business source code means directly scanning the business source code, directly analyzing the characteristics of the detected program, and finding out semantic defects, security vulnerabilities and other problems in the code. Static code scanning generally includes code quality inspection, security inspection and compliance inspection. Virus scanning of business source code can avoid security issues in the source code. Security scanning of container image build instructions means looking for potential security issues in Dockerfile, such as using base images with unspecified tags, unencrypted passwords, and exposure of sensitive files.

[0068] Step S300: In response to the security hardening server performing a security scan on the base container image, a business container image is constructed based on the business source code, the container image construction instruction, and the base container image.

[0069] Specifically, after obtaining the basic container image, the security hardening server further performs a security scan on the basic container image. When the security scan passes, the container compilation node can build a business container image based on the business source code, container image building instructions, and the basic container image. Among them, the container compilation node is pre-set with a network security policy, which only allows the basic container image to be pulled from the secure container image repository, providing a secure compilation environment for making container images.

[0070] Optionally, when the security hardening server passes the security scan of the base container image, the security hardening server modifies the storage address of the base container image to a hardened storage address associated with the secure container image repository, and based on the hardened storage address, modifies the container image build instructions to hardened container image build instructions; and sends the business source code and the hardened container image build instructions to the container compilation node.

[0071] Specifically, when the security hardening server passes the security scan of the basic container image, the basic container image is stored in the secure container image repository to obtain a hardened basic container image; then the storage address of the basic container image is modified to the hardened storage address associated with the secure container image repository, and the container image build instructions are modified to the hardened container image build instructions (the container image reference address is changed from the public container image repository to the secure container image repository), and finally the business source code and the hardened container image build instructions are sent to the container compilation node.

[0072] Combine the following Figure 3 A schematic diagram of the workflow of a security hardening server is shown, which illustrates the workflow of the security hardening server provided in an embodiment of the present application.

[0073] The fully reinforced server receives the business source code and container image building instructions pushed by the Jenkins server, and performs static scanning, virus scanning, and security scanning on the business source code and container image building instructions Dockerfile. When the security scan passes, the referenced base container image is pulled from the public container image repository and the base container image is scanned for security. If the scan passes, the base container image is pushed to the secure container image repository for storage, and the base image reference address of the Dockerfile is changed to the secure container image repository address to obtain the reinforced Dockerfile; finally, the scanned source code and the reinforced Dockerfile are pushed to the container compilation node. If any security scan fails, the process ends and an error indication is returned.

[0074] Optionally, the above step S300 builds a business container image based on the business source code, the container image building instructions and the basic container image, specifically including: the container compilation node determines the reinforced storage address according to the reinforced container image building instructions; the container compilation node obtains the reinforced basic container image based on the reinforced storage address; the container compilation node builds the business container image based on the business source code, the reinforced container image building instructions and the reinforced basic container image.

[0075] Specifically, after the container compilation node obtains the hardened container image building instruction sent by the security hardening server, it can determine the storage address of the hardened basic container image, that is, the hardened storage address. Then the container compilation node obtains the hardened basic container image based on the hardened storage address, and finally the container compilation node builds the business container image based on the business source code, the hardened container image building instruction and the hardened basic container image.

[0076] It can be understood that the only difference between the hardened container image building instructions and the initial container image building instructions is that the storage address of the basic container image indicated in the Dockerfile is different.

[0077] Refer to the following Figure 4 A flowchart of another method for strengthening the security of a container image is shown, the method comprising:

[0078] (1) The Jenkins server obtains the business source code and Dockerfile from the code repository server;

[0079] (2) The Jenkins server schedules the security hardening server to scan the business source code and Dockerfile;

[0080] (3) After the scan is passed, the security hardening server pulls the basic container image from the public container image repository based on the Dockerfile;

[0081] (4) The security hardening server performs a security scan on the base container image. If the scan passes, the base container image is pushed to the secure container image repository.

[0082] (5) The security hardening server changes the basic image storage address to the secure container image warehouse address, and pushes the business source code and the hardened Dockerfile to the container compilation node;

[0083] (6) In response to the Jenkins server scheduling the container compilation node to build the code and produce the image, the container compilation node obtains the hardened basic container image from the secure container image repository based on the hardened Dockerfile, and builds the business container image based on the hardened Dockerfile, the hardened basic container image and the business source code, and finally pushes the business container image to the secure container image repository.

[0084] From the above, the embodiment of the present application provides a container image security reinforcement method. When executing this method, the source code is scanned for vulnerabilities or viruses through the security reinforcement server, and the security issues in the source code can be avoided. By performing a security scan on the basic container image through the security reinforcement server, the security issues caused by the basic container image can be avoided, and the security of easy image production can be ensured. Through the automated scheduling and execution of the Jenkins pipeline, the efficiency and standardization of container image production are improved.

[0085] Corresponding to the above method, the embodiment of the present application also provides a container image security reinforcement system, the structural diagram of which can be referred to Figure 1 The system is executed by Jenkins pipeline scheduling. The system includes: Jenkins server Server1, code repository server Server2, public container image repository Server3, secure container image repository Server4, security reinforcement server Server5 and container compilation node Server6; among them,

[0086] Jenkins server, used to obtain business source code and container image building instructions;

[0087] A security hardening server is used to perform security scans on business source code and container image building instructions, and obtain a basic container image based on the container image building instructions after the business source code and container image building instructions pass the security scan;

[0088] The container compilation node is used to build a business container image based on the business source code, container image building instructions and the basic container image through security scanning of the basic container image on the security hardening server.

[0089] In an optional implementation, the Jenkins server is specifically used to obtain business source code and container image building instructions from the code repository server.

[0090] In an optional implementation, the server is securely reinforced to:

[0091] Get the container image building instructions sent by the Jenkins server;

[0092] Determine the storage address of the base container image based on the container image building instructions;

[0093] Get the base container image from the public container image repository based on the storage address.

[0094] In an optional implementation, the security hardening server is also used to: perform a security scan on the base container image, and after the base container image passes the security scan, store the base container image in a secure container image repository to obtain a hardened base container image.

[0095] In an optional implementation, the security hardening server is further used for:

[0096] Change the storage address of the base container image to the hardened storage address associated with the secure container image repository;

[0097] Modify the container image building instruction to the hardened container image building instruction based on the hardened storage address;

[0098] Send the business source code and the hardened container image building instructions to the container compilation node.

[0099] In an optional implementation, the container compilation node is specifically used to:

[0100] Determine the hardened storage address according to the hardened container image building instructions;

[0101] Obtain the hardened basic container image based on the hardened storage address;

[0102] Build a business container image based on the business source code, the hardened container image building instructions, and the hardened basic container image.

[0103] It should be noted that the steps executed by each module in a container image security reinforcement system provided in an embodiment of the present application and the related technical features correspond to the method provided in the embodiment of the application. The description of the system part can be found in the embodiment of the aforementioned method part and will not be repeated here.

[0104] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0105] Those skilled in the art can understand that the flowchart shown in the figure is only an example in which the embodiments of the present application can be implemented, and the scope of application of the embodiments of the present application is not limited by any aspect of the flowchart.

[0106] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and equipment can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0107] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0108] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0109] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for strengthening the security of a container image, characterized in that: The method is executed by Jenkins pipeline scheduling, and the method includes: Obtain business source code and container image building instructions; In response to the security hardening server performing a security scan on the business source code and the container image building instruction, obtaining a basic container image based on the container image building instruction; In response to the security hardening server performing a security scan on the base container image, a business container image is built based on the business source code, the container image building instruction, and the base container image.

2. The method according to claim 1, characterized in that The obtaining of the business source code and the container image building instructions includes: The Jenkins server obtains the business source code and the container image building instructions from the code repository server.

3. The method according to claim 2, characterized in that The obtaining of a base container image based on the container image building instruction includes: The security reinforcement server obtains the container image building instruction sent by the Jenkins server; The security hardening server determines the storage address of the basic container image based on the container image building instruction; The security hardening server obtains the basic container image from a public container image repository based on the storage address.

4. The method according to claim 3, characterized in that The method further comprises: The security hardening server performs a security scan on the basic container image, and after the basic container image passes the security scan, stores the basic container image in a secure container image repository to obtain a hardened basic container image.

5. The method according to claim 4, characterized in that The method further comprises: The security hardening server modifies the storage address of the basic container image to a hardened storage address associated with the secure container image repository; The security hardening server modifies the container image building instruction into a hardened container image building instruction based on the hardened storage address; The security hardening server sends the business source code and the hardened container image building instructions to the container compilation node.

6. The method according to claim 5, characterized in that The step of building a business container image based on the business source code, the container image building instruction, and the basic container image includes: The container compilation node determines the hardened storage address according to the hardened container image building instruction; The container compilation node obtains the hardened basic container image based on the hardened storage address; The container compilation node builds the business container image based on the business source code, the reinforced container image building instructions and the reinforced basic container image.

7. A container image security reinforcement system, characterized in that: The system is executed by Jenkins pipeline scheduling, and the system includes: Jenkins server, security hardening server and container compilation node; wherein, The Jenkins server is used to obtain business source code and container image building instructions; The security reinforcement server is used to perform a security scan on the business source code and the container image building instruction, and after the business source code and the container image building instruction pass the security scan, obtain a basic container image based on the container image building instruction; The container compilation node is used to build a business container image based on the business source code, the container image building instructions and the basic container image by performing a security scan on the basic container image on the security hardening server.

8. The system according to claim 7, characterized in that The system also includes: a public container image repository; The security reinforcement server is specifically used for: Obtain the container image building instruction sent by the Jenkins server; Determining a storage address of the base container image based on the container image building instruction; The basic container image is obtained from the public container image repository based on the storage address.

9. The system according to claim 8, characterized in that The system also includes: a secure container image repository; The security reinforcement server is further used to: perform a security scan on the basic container image, and after the basic container image passes the security scan, store the basic container image in the secure container image repository to obtain a reinforced basic container image.

10. The system according to claim 9, characterized in that The security reinforcement server is also used for: Modify the storage address of the base container image to a hardened storage address associated with the secure container image repository; Modifying the container image building instruction into a hardened container image building instruction based on the hardened storage address; The business source code and the hardened container image building instructions are sent to the container compilation node.

Images