Method for dynamically starting mirror image module through compiling parameters
By dynamically adjusting configurations using compilation parameters when container startup, the problem of cumbersome start-up process and difficult automatic deployment is solved, and flexibility and security is improved, and the potential to support large-scale projects and enterprise-level applications is achieved.
Patent Information
- Application Number
- CN202410876893.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-02
- Publication Date
- 2024-12-27
AI Technical Summary
The startup process of Docker images is cumbersome and error-prone, making it difficult to achieve automation and scale deployment, and manual configuration may introduce security risks and maintenance complexity.
By compiling parameters, dynamically adjusting the application configuration when the container starts, including defining environment variables, file mount paths and port mappings, storing these parameters in the metadata of the mirror module to achieve dynamic startup of the mirror module.
Improves flexibility in container configuration, enables developers to quickly adjust container configuration, reduces the risk of errors in manual configuration, supports automation and scale deployment, and enhances security and maintainability.
Smart Images
Figure CN119201200A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a method for dynamically starting a mirror module by compiling parameters. Background Art
[0002] With the rapid development of cloud computing and containerization technology, enterprises and organizations are increasingly inclined to adopt microservice architecture and containerization deployment to achieve efficient, flexible and scalable application deployment. Docker, as a leader in this trend, has been widely used in the industry for its lightweight, portable and easy-to-manage features.
[0003] However, although Docker provides powerful containerization capabilities, in actual applications, the startup process of Docker images still faces some challenges. First, starting a Docker image usually involves multiple manual configuration steps, such as setting environment variables, mounting files or volumes, and configuring network parameters. These steps are not only cumbersome but also prone to errors, especially in large projects with a large number of containers and images to manage. Manual configuration is not only inefficient but also prone to human errors.
[0004] Secondly, manual configuration is not conducive to automation and large-scale deployment. With the rise of DevOps culture, automation and continuous integration / continuous deployment (CI / CD) have become important trends in modern software development and operation. However, the traditional Docker image startup method often relies on manual operations, which is difficult to achieve automation and large-scale deployment, thus limiting the potential of Docker in large-scale projects and enterprise-level applications.
[0005] In addition, manual configuration may also lead to security and maintainability issues. When configuring environment variables and mounting files, if sensitive information is accidentally exposed or unsafe configurations are introduced, it may bring security risks to the system. At the same time, manual configuration also increases the complexity of the system, making subsequent maintenance and updates more difficult.
[0006] Therefore, a method for dynamically starting the image module by compiling parameters is proposed. Summary of the invention
[0007] This specification provides a method for dynamically starting an image module through compilation parameters. The compilation parameters can dynamically adjust the configuration of an application when the container is started, thereby improving the flexibility of the configuration and allowing developers to quickly adjust the container configuration according to different environments or requirements.
[0008] This specification provides a method for dynamically starting an image module by compiling parameters, including:
[0009] Get compilation parameters;
[0010] The compilation parameters are defined in a text file in the virtualization container engine, a mirror module of the virtualization container is constructed, and the compilation parameters are stored in metadata of the constructed mirror module of the virtualization container;
[0011] The mirror module is configured based on the compilation parameters to achieve dynamic startup of the mirror module.
[0012] Optionally, the compilation parameters include environment variables, file mount path, and port mapping.
[0013] Optionally, defining the compilation parameters in a text file in the virtualization container engine includes:
[0014] Defining the environment variable in the text file by a first instruction;
[0015] Creating a directory in the text file that can be mounted when the container is running, and specifying the file mounting path as a directory that can be mounted when the container is running through a second instruction;
[0016] The container listening port is specified in the text file, and the container listening port is port mapped through the target option in the third instruction.
[0017] Optionally, storing the compilation parameters in metadata of the image module of the constructed virtualized container includes:
[0018] Pull the image module of the virtualized container to the local computer, obtain the Layer list and Layer digest of the virtualized container by reading the manifest file of the virtualized container, and locate the storage address of the metadata of the image module;
[0019] The compilation parameter is stored in the storage address.
[0020] Optionally, also include:
[0021] Get the release version and its path, as well as the local vulnerability library;
[0022] Traversing the path of the release version to search whether the release version exists, and when the release version exists, recording the actual version information;
[0023] Extracting software package information based on the actual version information;
[0024] The software package information is compared with the local vulnerability database to obtain the hit software package security vulnerabilities and generate a vulnerability report.
[0025] Optionally, the comparing the software package information with the local vulnerability database to obtain the hit software package security vulnerability and generating a vulnerability report includes:
[0026] The virus engine is called through an interface to scan the metadata of the image module. When the virus engine detects a suspected malicious file, it wants to publicly disclose the virus database to extract virus samples;
[0027] The suspected malicious text is subjected to fuzzy hash operation by ssdeep, and matched with the fuzzy hash value of the virus sample to determine whether the suspected malicious file is a malicious file.
[0028] Optionally, configuring the mirror module based on the compilation parameters to enable dynamic startup of the mirror module includes:
[0029] The configuration parameters of the mirror module of the virtualization container are set according to the environment variables, the files on the host machine are mounted to the mirror module of the virtualization container according to the file mounting path, and the network access rights of the virtualization are set according to the port mapping to realize dynamic loading and startup of the mirror module.
[0030] Optionally, configuring the mirror module based on the compilation parameters to enable dynamic startup of the mirror module includes:
[0031] Get the local image hash value;
[0032] Performing hash operations on the layer file and the metadata respectively, and performing hash operations on the layer file after the hash operation and the metadata after the hash operation to determine a metric value;
[0033] Verifying the metric value with the local image hash value;
[0034] When the metric value is consistent with the local image hash value, the dynamic startup of the image module is completed.
[0035] Optionally, the hash operation includes a SHA-384 operation.
[0036] In the present invention, the configuration of the application can be dynamically adjusted when the container is started through compilation parameters, which improves the flexibility of the configuration and allows developers to quickly adjust the container configuration according to different environments or requirements. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0038] Figure 1 A schematic diagram of the principle of a method for dynamically starting a mirror module by compiling parameters provided in an embodiment of this specification;
[0039] Figure 2 A schematic diagram of the structure of a device for dynamically starting a mirror module by compiling parameters provided in an embodiment of this specification;
[0040] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification;
[0041] Figure 4 A schematic diagram of a computer-readable medium provided for an embodiment of this specification. DETAILED DESCRIPTION
[0042] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.
[0043] The following is combined with Figure 1-4 The exemplary embodiments of the present invention are described more fully. However, the exemplary embodiments can be implemented in various forms, and it should not be understood that the present invention is limited to the embodiments set forth herein. On the contrary, providing these exemplary embodiments can make the present invention more comprehensive and complete, and it is more convenient to fully convey the inventive concept to those skilled in the art. The same reference numerals in the figures represent the same or similar elements, components or parts, and thus their repeated description will be omitted.
[0044] Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a specific embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.
[0045] In the description of specific embodiments, the features, structures, characteristics or other details described in the present invention are intended to enable those skilled in the art to fully understand the embodiments. However, it does not exclude that those skilled in the art can practice the technical solutions of the present invention without one or more of the specific features, structures, characteristics or other details.
[0046] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.
[0047] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.
[0048] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.
[0049] Figure 1 A schematic diagram of a method for dynamically starting a mirror module by compiling parameters provided in an embodiment of this specification, the method may include:
[0050] S110: Obtain compilation parameters;
[0051] Optionally, the compilation parameters include environment variables, file mount path, and port mapping.
[0052] S120: defining the compilation parameters in a text file in the virtualization container engine, constructing an image module of the virtualization container, and storing the compilation parameters in metadata of the constructed image module of the virtualization container;
[0053] Optionally, defining the compilation parameters in a text file in the virtualization container engine includes:
[0054] Defining the environment variable in the text file by a first instruction;
[0055] Creating a directory in the text file that can be mounted when the container is running, and specifying the file mounting path as a directory that can be mounted when the container is running through a second instruction;
[0056] The container listening port is specified in the text file, and the container listening port is port mapped through the target option in the third instruction.
[0057] In a specific embodiment of the present specification, the virtualization container engine includes Docker. The first instruction includes an ENV instruction and a docker run instruction. The text file includes a Dockerfile. Environment variables are a set of key-value pairs passed to the container process when the container is running. They can be set using the ENV instruction in the Dockerfile, or passed using the -e or --env flag in the docker run command.
[0058] The second instruction includes the VOLUME instruction and the docker run instruction. File mounting is the process of mounting files or directories on the host machine into the container. This can be achieved through the -v or --volume flag in the docker run command.
[0059] The third instruction includes the EXPOSE instruction and the docker run instruction. Port mapping is to map the port inside the container to the port on the host so that the service inside the container can be accessed from the host. This can also be achieved through the -p or --publish flag in the docker run command.
[0060] Optionally, storing the compilation parameters in metadata of the image module of the constructed virtualized container includes:
[0061] Pull the image module of the virtualized container to the local computer, obtain the Layer list and Layer digest of the virtualized container by reading the manifest file of the virtualized container, and locate the storage address of the metadata of the image module;
[0062] The compilation parameter is stored in the storage address.
[0063] In the specific implementation of this specification, the image module of the virtualized container is pulled from the image repository to the local computer through the docker pull command. The manifest file of the image module is a JSON file that describes the top-level configuration of the image and the information of each layer. The manifest is accessed through the underlying API of Docker or tools (such as skopeo).
[0064] By parsing the manifest file, you can get the manifests of each layer of the image and their digest values. These digest values are used to uniquely identify each layer of the image.
[0065] Optionally, also include:
[0066] Get the release version and its path, as well as the local vulnerability library;
[0067] Traversing the path of the release version to search whether the release version exists, and when the release version exists, recording the actual version information;
[0068] Extracting software package information based on the actual version information;
[0069] The software package information is compared with the local vulnerability database to obtain the hit software package security vulnerabilities and generate a vulnerability report.
[0070] In a specific implementation of the present specification, the local vulnerability library includes a CVE vulnerability library. According to the path traversal search of each release version file, the release version of the base image layer is detected, such as the UbuntuPrecise system version file path is / etc / lsb-release, and the Alpine system version file path is / etc / Alpine / release. By traversing all possible system version file paths, the corresponding version file is found and the version information is stopped and recorded, and then the corresponding version of the rootfs root file system default path is used to find and read the corresponding software package list information, such as the Centos package list file is located in / var / lib / rpm / packages, and the Ubuntu and Debian package list files are located in var / lib / dpkg / status. The corresponding software package and version number are obtained by reading the files in the corresponding directory, and compared with the local CVE vulnerability library to obtain the hit software package CVE security vulnerability, and generate a leak scan report. Regularly scan the scanned old image layer again to discover potential new vulnerabilities. In view of the different intranet environments for containerized deployment in various units, the methods of handling security vulnerabilities are also different. Therefore, it is allowed to set up a vulnerability whitelist and not scan the CVE vulnerabilities in the whitelist, so that users can check key vulnerabilities according to their needs.
[0071] Optionally, the comparing the software package information with the local vulnerability database to obtain the hit software package security vulnerability and generating a vulnerability report includes:
[0072] The virus engine is called through an interface to scan the metadata of the image module. When the virus engine detects a suspected malicious file, it wants to publicly disclose the virus database to extract virus samples;
[0073] The suspected malicious text is subjected to fuzzy hash operation by ssdeep, and matched with the fuzzy hash value of the virus sample to determine whether the suspected malicious file is a malicious file.
[0074] In the specific implementation of this specification, after the vulnerability scan, the Docker image is further scanned for malicious programs by reading the image layer file content. Since the attacker may pack the malicious file and change the file encoding and hash value to evade the detection of the scanning engine, the simple hash algorithm cannot accurately identify the malicious file and has a high probability of missing reports.
[0075] The virus engine is called through the interface to scan files. If a malicious file is detected, the virus sample is extracted from the public virus database, and then ssdeep is used to perform fuzzy hash operations on the suspicious file and match the fuzzy hash value of the virus sample file to determine whether it is a malicious file. After that, the results of the two detection methods can be compared. If the two detection results are consistent and determined to be a malicious program, a prompt will be given to the user.
[0076] S130: configuring the mirror module based on the compilation parameters to enable dynamic startup of the mirror module.
[0077] Optionally, the S130 includes:
[0078] The configuration parameters of the image of the virtualized container are set according to the environment variables, the files on the host machine are mounted to the image module of the virtualized container according to the file mounting path, and the network access rights of the virtualization are set according to the port mapping to realize dynamic loading and startup of the image module.
[0079] In a specific implementation of this specification, when starting a container, you can use the -e or --env flag to set environment variables. These environment variables will be passed to the process in the container and can be used to configure the application. Alternatively, the ENV instruction can be used in the Dockerfile to set default environment variables. Use the -v or --volume flag to mount files or directories on the host into the container. Use the -p or --publish flag to map ports in the container to ports on the host so that services in the container can be accessed from the host. After the above settings are completed, the docker run command can be used to start the container and dynamically load and configure the container based on the environment variables, file mounting, and port mappings set previously.
[0080] Optionally, after S130, the following steps may be performed:
[0081] Get the local image hash value;
[0082] Performing hash operations on the layer file and the metadata respectively, and performing hash operations on the layer file after the hash operation and the metadata after the hash operation to determine a metric value;
[0083] Verifying the metric value with the local image hash value;
[0084] When the metric value is consistent with the local image hash value, the dynamic startup of the image module is completed.
[0085] Optionally, the hash operation includes a SHA-384 operation.
[0086] In the specific implementation of this specification, tampering monitoring during the image storage process is a point that is easily overlooked in the production environment. Trusted measurement can reduce the risk of the image being tampered with due to the loss of the host machine. Taking the overlay2 storage driver as an example, the layer metadata and layer files of the Docker image are respectively stored in docker / image / overlay2 / layerdb and docker / overlay2 / {cache-id} / diff. When the user uses commands such as Pull and build to pull or package the image, the trusted measurement action will be triggered. The trusted measurement module will perform a SHA-384 operation on the Layer file and metadata respectively to obtain two sets of measurement values. After that, the two sets of measurement values are spliced and another SHA-384 operation is performed to obtain the final trusted measurement value and store it in the database.
[0087] In the present invention, the configuration of the application can be dynamically adjusted when the container is started through compilation parameters, which improves the flexibility of the configuration and allows developers to quickly adjust the container configuration according to different environments or requirements.
[0088] Figure 2 A schematic diagram of a device for dynamically starting a mirror module by compiling parameters provided in an embodiment of this specification, the device may include:
[0089] An acquisition module 10 is used to acquire compilation parameters;
[0090] A construction module 20 is used to define the compilation parameters in a text file in the virtualization container engine, construct a mirror module of the virtualization container, and store the compilation parameters in metadata of the constructed mirror module of the virtualization container;
[0091] The startup module 30 is used to configure the mirror module based on the compilation parameters to realize dynamic startup of the mirror module.
[0092] Optionally, the compilation parameters include environment variables, file mount path, and port mapping.
[0093] Optionally, defining the compilation parameters in a text file in the virtualization container engine includes:
[0094] Defining the environment variable in the text file by a first instruction;
[0095] Creating a directory in the text file that can be mounted when the container is running, and specifying the file mounting path as a directory that can be mounted when the container is running through a second instruction;
[0096] The container listening port is specified in the text file, and the container listening port is port mapped through the target option in the third instruction.
[0097] Optionally, storing the compilation parameters in metadata of the image module of the constructed virtualized container includes:
[0098] Pull the image module of the virtualized container to the local computer, obtain the Layer list and Layer digest of the virtualized container by reading the manifest file of the virtualized container, and locate the storage address of the metadata of the image module;
[0099] The compilation parameter is stored in the storage address.
[0100] Optionally, also include:
[0101] Get the release version and its path, as well as the local vulnerability library;
[0102] Traversing the path of the release version to search whether the release version exists, and when the release version exists, recording the actual version information;
[0103] Extracting software package information based on the actual version information;
[0104] The software package information is compared with the local vulnerability database to obtain the hit software package security vulnerabilities and generate a vulnerability report.
[0105] Optionally, the comparing the software package information with the local vulnerability database to obtain the hit software package security vulnerability and generating a vulnerability report includes:
[0106] The virus engine is called through an interface to scan the metadata of the image module. When the virus engine detects a suspected malicious file, it wants to publicly disclose the virus database to extract virus samples;
[0107] The suspected malicious text is subjected to fuzzy hash operation by ssdeep, and matched with the fuzzy hash value of the virus sample to determine whether the suspected malicious file is a malicious file.
[0108] Optionally, the startup module 30 includes:
[0109] The configuration parameters of the image of the virtualized container are set according to the environment variables, the files on the host machine are mounted to the image module of the virtualized container according to the file mounting path, and the network access rights of the virtualization are set according to the port mapping to realize dynamic loading and startup of the image module.
[0110] Optionally, after starting the module 30, the following steps are included:
[0111] Get the local image hash value;
[0112] Performing hash operations on the layer file and the metadata respectively, and performing hash operations on the layer file after the hash operation and the metadata after the hash operation to determine a metric value;
[0113] Verifying the metric value with the local image hash value;
[0114] When the metric value is consistent with the local image hash value, the dynamic startup of the image module is completed.
[0115] Optionally, the hash operation includes a SHA-384 operation.
[0116] The functions of the device in the embodiment of the present invention have been described in the above method embodiment, so for details not provided in the description of this embodiment, please refer to the relevant description in the above embodiment, and no further description will be given here.
[0117] Based on the same inventive concept, an embodiment of this specification also provides an electronic device.
[0118] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.
[0119] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Figure 3 The electronic device 300 according to the embodiment of the present invention is described. Figure 3 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.
[0120] like Figure 3As shown, the electronic device 300 is in the form of a general computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components (including the storage unit 320 and the processing unit 310), a display unit 340, etc.
[0121] The storage unit stores program codes, which can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the above processing method section of this specification. For example, the processing unit 310 can perform the following steps: Figure 1 Steps shown.
[0122] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .
[0123] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.
[0124] Bus 330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.
[0125] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable viewers to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 through the bus 330. It should be understood that although Figure 3Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0126] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, including a number of instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the present invention. When the computer program is executed by a data processing device, the computer-readable medium can implement the above method of the present invention, that is: Figure 1 The method shown.
[0127] Figure 4 A schematic diagram of a computer-readable medium provided for an embodiment of this specification.
[0128] accomplish Figure 1 The computer program of the method shown can be stored on one or more computer readable media. The computer readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.
[0129] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.
[0130] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the viewer computing device, partially on the viewer device, as a stand-alone software package, partially on the viewer computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the viewer computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0131] In summary, the present invention can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that general data processing devices such as microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.
[0132] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
[0133] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.
[0134] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims
1. A method for dynamically starting a mirror module by compiling parameters, characterized in that: include: Get compilation parameters; The compilation parameters are defined in a text file in the virtualization container engine, a mirror module of the virtualization container is constructed, and the compilation parameters are stored in metadata of the constructed mirror module of the virtualization container; The mirror module is configured based on the compilation parameters to achieve dynamic startup of the mirror module.
2. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 1, characterized in that: The compilation parameters include environment variables, file mounting paths, and port mappings.
3. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 2, characterized in that: Defining the compilation parameters in a text file in the virtualization container engine includes: Defining the environment variable in the text file by a first instruction; Creating a directory in the text file that can be mounted when the container is running, and specifying the file mounting path as a directory that can be mounted when the container is running through a second instruction; The container listening port is specified in the text file, and the container listening port is port mapped through the target option in the third instruction.
4. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 3, characterized in that: The storing of the compilation parameters in the metadata of the image module of the constructed virtualized container includes: Pull the image module of the virtualized container to the local computer, obtain the Layer list and Layer digest of the virtualized container by reading the manifest file of the virtualized container, and locate the storage address of the metadata of the image module; The compilation parameter is stored in the storage address.
5. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 4, characterized in that: Also includes: Get the release version and its path, as well as the local vulnerability library; Traversing the path of the release version to search whether the release version exists, and when the release version exists, recording the actual version information; Extracting software package information based on the actual version information; The software package information is compared with the local vulnerability database to obtain the hit software package security vulnerabilities and generate a vulnerability report.
6. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 5, characterized in that: After comparing the software package information with the local vulnerability database to obtain the hit software package security vulnerability and generating a vulnerability report, the method includes: The virus engine is called through an interface to scan the metadata of the image module. When the virus engine detects a suspected malicious file, it wants to publicly disclose the virus database to extract virus samples; The suspected malicious text is subjected to fuzzy hash operation by ssdeep, and matched with the fuzzy hash value of the virus sample to determine whether the suspected malicious file is a malicious file.
7. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 6, characterized in that: The configuring the mirror module based on the compilation parameters to realize dynamic startup of the mirror module includes: The configuration parameters of the mirror module of the virtualization container are set according to the environment variables, the files on the host machine are mounted to the mirror module of the virtualization container according to the file mounting path, and the network access rights of the virtualization are set according to the port mapping to realize dynamic loading and startup of the mirror module.
8. The method for implementing dynamic startup of a mirror module by compiling parameters according to claim 7, characterized in that: After configuring the mirror module based on the compilation parameters to realize dynamic startup of the mirror module, the method includes: Get the local image hash value; Performing hash operations on the layer file and the metadata respectively, and performing hash operations on the layer file after the hash operation and the metadata after the hash operation to determine a metric value; Verifying the metric value with the local image hash value; When the metric value is consistent with the local image hash value, the dynamic startup of the image module is completed.
9. The method for realizing dynamic startup of a mirror module by compiling parameters according to claim 8, characterized in that: The hash operation includes a SHA-384 operation.