Container mirror image updating risk assessment method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a container mirror image updating risk assessment method and device, computer equipment, a readable storage medium and a program product. The method comprises the following steps: receiving an update risk assessment request of a to-be-updated container mirror image, wherein the update risk assessment request comprises an identifier of the to-be-updated container mirror image; according to the identifier of the to-be-updated container mirror image, inquiring to obtain influence parameter information of a plurality of functional layers in the to-be-updated container mirror image; and obtaining an update risk assessment result of the to-be-updated container mirror image based on the influence parameter information of the plurality of functional layers, and outputting the update risk assessment result. By adopting the method, risk assessment can be carried out on updating of the container mirror image.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a container image update risk assessment method, apparatus, computer equipment, readable storage medium, and program product. Background Art

[0002] As computer technology continues to evolve, backend services and corresponding orchestration technologies become increasingly mature, and microservices in applications are becoming increasingly popular. Container deployment has become the prevailing standard for current application deployment. As a lightweight process-based virtualization technology, containers not only achieve isolation, but also take into account system resource management and control, and have very good portability.

[0003] Applications deployed based on containers are also called container applications. A standard container application is often composed of the underlying hardware system, operating system, container system, and application. In customer container applications, new features and patches of container applications often need to be updated frequently to enhance user experience and increase system stability. Therefore, it is necessary to perform corresponding vulnerability and feature upgrades on the container system or application involved.

[0004] The container images that the container system depends on are often composed of multiple layers of container images. The upgrade of the container system is to update the container image, and many container applications may rely on the same container image. Updating the container image will have a great impact on the stability of the entire system. Therefore, it is necessary to conduct a risk assessment on the update of the container image before the container image is updated. Based on this, how to conduct a risk assessment on the update of the container image has become an urgent problem to be solved. Summary of the invention

[0005] Based on this, it is necessary to provide a container image update risk assessment method, device, computer equipment, readable storage medium and program product that can implement risk assessment on container image updates in response to the above technical problems.

[0006] In a first aspect, the present application provides a method comprising: receiving an update risk assessment request for a container image to be updated, the update risk assessment request comprising an identifier of the container image to be updated; querying and obtaining, based on the identifier of the container image to be updated, impact parameter information of multiple functional layers in the container image to be updated; obtaining an update risk assessment result of the container image to be updated based on the impact parameter information of the multiple functional layers, and outputting the update risk assessment result.

[0007] In one of the embodiments, the update risk assessment request also includes an identifier of at least one functional layer to be updated in the container image to be updated; based on the impact parameter information of multiple functional layers, an update risk assessment result of the container image to be updated is obtained, including: according to the identifier of each functional layer to be updated, searching for the impact parameter information of each functional layer to be updated from the impact parameter information of multiple functional layers to obtain the impact parameter information of each functional layer to be updated; and obtaining the update risk assessment result according to the impact parameter information of each functional layer to be updated.

[0008] In one of the embodiments, the impact parameter information of the function layer to be updated includes at least one of a first impact weight matrix of the function layer to be updated on other function layers, an impact weight of the function layer to be updated on the container image to be updated, and a score value of the function layer to be updated.

[0009] In one of the embodiments, an update risk assessment result is obtained based on the impact parameter information of each functional layer to be updated, including: calculating the impact value of each functional layer to be updated on the container image to be updated based on the first impact weight matrix corresponding to each functional layer to be updated, the impact weight corresponding to each functional layer to be updated and the score value of each functional layer to be updated; and obtaining the update risk assessment result based on the impact value of each functional layer to be updated on the container image to be updated.

[0010] In one of the embodiments, an update risk assessment result is obtained according to the impact value of each to-be-updated functional layer on the container image to be updated, including: according to the identifier of the container image to be updated, querying and obtaining a second impact weight matrix of the container image to be updated on other container images in the image repository; and obtaining the update risk assessment result according to the second impact weight matrix corresponding to the container image to be updated and the impact value of each to-be-updated functional layer on the container image to be updated.

[0011] In one of the embodiments, the method further includes: when detecting that a container image is updated in the image repository, obtaining and storing the impact parameter information of each functional layer in the updated container image.

[0012] In the second aspect, the present application also provides an update risk assessment device for a container image, which includes: a receiving module, used to receive an update risk assessment request for a container image to be updated, the update risk assessment request including an identifier of the container image to be updated; a query module, used to query and obtain impact parameter information of multiple functional layers in the container image to be updated according to the identifier of the container image to be updated; an output module, used to obtain an update risk assessment result of the container image to be updated based on the impact parameter information of multiple functional layers, and output the update risk assessment result.

[0013] In one of the embodiments, the update risk assessment request also includes an identifier of at least one functional layer to be updated in the container image to be updated; the output module is specifically used to search for the impact parameter information of each functional layer to be updated from the impact parameter information of multiple functional layers according to the identifier of each functional layer to be updated; and obtain the update risk assessment result according to the impact parameter information of each functional layer to be updated.

[0014] In one of the embodiments, the impact parameter information of the function layer to be updated includes at least one of a first impact weight matrix of the function layer to be updated on other function layers, an impact weight of the function layer to be updated on the container image to be updated, and a score value of the function layer to be updated.

[0015] In one of the embodiments, the output module is specifically used to calculate the impact value of each functional layer to be updated on the container image to be updated based on the first impact weight matrix corresponding to each functional layer to be updated, the impact weight corresponding to each functional layer to be updated, and the score value of each functional layer to be updated; and obtain the update risk assessment result based on the impact value of each functional layer to be updated on the container image to be updated.

[0016] In one of the embodiments, the output module is specifically used to query and obtain, according to the identifier of the container image to be updated, a second impact weight matrix of the container image to be updated on other container images in the image repository; and obtain an update risk assessment result according to the second impact weight matrix corresponding to the container image to be updated and the impact value of each functional layer to be updated on the container image to be updated.

[0017] In one of the embodiments, the device further includes an acquisition module, which is used to acquire and store the impact parameter information of each functional layer in the updated container image when a container image update is detected in the image repository.

[0018] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0019] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0020] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0021] The above-mentioned update risk assessment method, device, computer equipment, readable storage medium and program product of the container image receive an update risk assessment request for the container image to be updated, the update risk assessment request includes the identifier of the container image to be updated, and then, based on the identifier of the container image to be updated, query to obtain the impact parameter information of multiple functional layers in the container image to be updated, and then based on the impact parameter information of the multiple functional layers, obtain the update risk assessment result of the container image to be updated, and output the update risk assessment result, thereby realizing the update risk assessment of the container image. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0023] FIG1 is a diagram of an application environment of a container image update risk assessment method according to an embodiment;

[0024] FIG2 is a schematic diagram of a process of a method for assessing risk of updating a container image in one embodiment;

[0025] FIG3 is a schematic diagram of a flow chart of a method for assessing risk of updating a container image in another embodiment;

[0026] FIG4 is a schematic diagram of a flow chart of a method for assessing risk of updating a container image in another embodiment;

[0027] FIG5 is a schematic diagram of a flow chart of a method for assessing risk of updating a container image in another embodiment;

[0028] FIG6 is a schematic diagram of a data structure stored in an image repository in one embodiment;

[0029] FIG7 is a structural block diagram of a container image update risk assessment device in one embodiment;

[0030] FIG8 is a schematic diagram of the architecture of a container image update risk assessment system in one embodiment;

[0031] FIG. 9 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0033] The update risk assessment method of the container image provided in the embodiment of the present application can be applied in the application environment shown in FIG. 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal receives an update risk assessment request for the container image to be updated, and the update risk assessment request includes the identifier of the container image to be updated; according to the identifier of the container image to be updated, the influence parameter information of multiple functional layers in the container image to be updated is queried; based on the influence parameter information of multiple functional layers, the update risk assessment result of the container image to be updated is obtained, and the update risk assessment result is output. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0034] In an exemplary embodiment, as shown in FIG2 , a container image update risk assessment method is provided, which is described by taking the method applied to the terminal in FIG1 as an example, and includes the following steps 201 to 203. Among them:

[0035] Step 201: receiving a risk assessment update request for a container image to be updated, where the risk assessment update request includes an identifier of the container image to be updated.

[0036] The identifier of the container image to be updated is unique.

[0037] In one possible implementation, the terminal provides a human-computer interaction interface. When the terminal detects a trigger operation for an update risk assessment of a container image to be updated, the terminal sends an update risk assessment request carrying an identifier of the container image to be updated to an update risk assessment device for the container image in the terminal, so that the update risk assessment device for the container image in the terminal receives the update risk assessment request.

[0038] In another possible implementation, a terminal receives an update risk assessment request carrying an identifier of a container image to be updated sent by another terminal, such as a computer receiving the update risk assessment request sent by a mobile phone.

[0039] Step 202: According to the identifier of the container image to be updated, query and obtain the influencing parameter information of multiple function layers in the container image to be updated.

[0040] Among them, the container image to be updated includes multiple layers, and the container image to be updated can be abstracted into multiple functional layers, and each functional layer is assigned a unique identifier. Multiple functional layers can correspond to multiple layers one by one, that is, one functional layer corresponds to one layer; or multiple layers can be divided according to characteristics, one characteristic may correspond to multiple layers, and multiple functional layers can correspond to multiple characteristics one by one, that is, one functional layer corresponds to multiple layers. It should be noted that abstracting the container image to be updated into multiple functional layers can be defined as metadata in the container file (Dockerfile).

[0041] For each functional layer, the impact parameter information of the functional layer includes at least one of the first impact weight matrix of the functional layer on other functional layers, the impact weight of the functional layer on the container image to be updated, and the score value of the functional layer. Among them, the first impact weight matrix of the functional layer on other functional layers refers to the matrix composed of the degree of influence of the functional layer on other functional layers. For example, the container image to be updated includes four functional layers, and the first impact weight matrix of functional layer A on functional layer B, functional layer C and functional layer D is . The impact weight of the functional layer on the updated container image refers to the degree of influence of the functional layer on the updated container image. The sum of the impact weights of all functional layers on the updated container image is 1. Among them, the functional layer with a greater impact on the updated container image is assigned a larger weight; the functional layer with a smaller impact on the updated container image is assigned a smaller weight; the functional layer with no impact can be removed and is not considered in the risk assessment process. The score of the functional layer is the score given by the reviewer or developer for the impact of the functional layer on the updated container image. It should be noted that the impact parameter information of the functional layer can be defined as metadata in the container file.

[0042] In a possible implementation, according to the identifier of the container image to be updated, the influencing parameter information of multiple functional layers in the container image to be updated is queried from the image warehouse. The image warehouse stores multiple container images, the dependencies between multiple functional layers in each container image, and the influencing parameter information of multiple functional layers in each container image.

[0043] It should be noted that in the design phase, the naming of the image repository needs to be standardized, so that in the application phase, it is possible to query relevant information from the image repository based on the identifier of the container image to be updated.

[0044] Step 203: Based on the impact parameter information of multiple functional layers, an update risk assessment result of the container image to be updated is obtained, and the update risk assessment result is output.

[0045] Among them, the risk assessment result can be a risk assessment level. For example, the risk assessment levels include P0, P1, P2, P3, P4 and P5. The P0 level indicates the lowest risk, and the P5 level indicates the highest risk.

[0046] In a possible implementation, the update risk assessment result is determined based on the impact parameter information of all functional layers. For example, based on the impact parameter information of each functional layer, the impact value of each functional layer on the container image to be updated is calculated, and the impact values ​​of each functional layer on the container image to be updated are added to obtain a first sum value, and the risk assessment result is determined based on the first sum value.

[0047] In another possible implementation, the update risk assessment result is determined based on the impact parameter information of some functional layers. For example, the update risk assessment request also includes the identifier of at least one functional layer to be updated in the container image to be updated, and based on the identifier of each functional layer to be updated, the impact parameter information of each functional layer to be updated is queried from the impact parameter information of multiple functional layers; based on the impact parameter information of each functional layer to be updated, the impact value of each functional layer to be updated on the container image to be updated is calculated, the impact values ​​of each functional layer to be updated on the container image to be updated are added together to obtain a second sum value, and the risk assessment result is determined based on the second sum value.

[0048] The specific implementation methods of determining the risk assessment result according to the first sum value and determining the risk assessment result according to the second sum value can both be to determine the risk assessment result by determining the interval to which the sum value belongs, wherein different intervals correspond to different risk assessment levels.

[0049] Outputting the updated risk assessment result may be displaying the updated risk assessment result on a human-computer interaction interface of a terminal, or sending the updated risk assessment result to a sender of the updated risk assessment request via a text message or email notification.

[0050] In the above container image update risk assessment method, an update risk assessment request for a container image to be updated is received, the update risk assessment request includes the identifier of the container image to be updated, and then, based on the identifier of the container image to be updated, the impact parameter information of multiple functional layers in the container image to be updated is queried, and then based on the impact parameter information of the multiple functional layers, the update risk assessment result of the container image to be updated is obtained, and the update risk assessment result is output, thereby realizing the update risk assessment of the container image. The update risk assessment result can be used as a basis for line cutover risk assessment, and can also be used as a relevant automatic cutover threshold assessment standard.

[0051] In one embodiment, as shown in FIG3 , another update risk assessment method for a container image is provided. The update risk assessment request also includes an identifier of at least one to-be-updated functional layer in the to-be-updated container image; based on the impact parameter information of the multiple functional layers, an update risk assessment result of the to-be-updated container image is obtained, including:

[0052] Step 301 : According to the identifier of each to-be-updated functional layer, the influencing parameter information of each to-be-updated functional layer is searched from the influencing parameter information of multiple functional layers to obtain the influencing parameter information of each to-be-updated functional layer.

[0053] Among them, the identifier of the functional layer to be updated is unique. The impact parameter information of the functional layer to be updated includes at least one of the first impact weight matrix of the functional layer to be updated on other functional layers, the impact weight of the functional layer to be updated on the container image to be updated, and the score value of the functional layer to be updated. The first impact weight matrix of the functional layer to be updated on other functional layers refers to a matrix composed of the degree of influence of the functional layer to be updated on other functional layers. For example, the container image to be updated includes four functional layers, and the functional layer to be updated is functional layer A, then the first impact weight matrix of functional layer A on functional layer B, functional layer C and functional layer D is The impact weight of the function layer to be updated on the container image to be updated refers to the impact of the function layer to be updated on the container image to be updated. The sum of the impact weights of all function layers on the container image to be updated is 1. The score of the function layer to be updated is the score given by the reviewer or developer on the impact of the function layer to be updated on the container image to be updated.

[0054] In a possible implementation manner, based on the identifier of each to-be-updated functional layer, each to-be-updated functional layer is searched from multiple functional layers, thereby obtaining the influencing parameter information of each to-be-updated functional layer.

[0055] Step 302: Obtain an update risk assessment result based on the influencing parameter information of each to-be-updated functional layer.

[0056] In one possible implementation, based on the impact weight corresponding to each functional layer to be updated and the score value of each functional layer to be updated, the impact value of each functional layer to be updated on the container image to be updated is calculated; based on the impact value of each functional layer to be updated on the container image to be updated, an update risk assessment result is obtained.

[0057] In another possible implementation, as shown in FIG4 , another container image update risk assessment method is provided. According to the impact parameter information of each functional layer to be updated, an update risk assessment result is obtained, including:

[0058] Step 401 , according to the first influence weight matrix corresponding to each to-be-updated functional layer, the influence weight corresponding to each to-be-updated functional layer and the score value of each to-be-updated functional layer, the influence value of each to-be-updated functional layer on the to-be-updated container image is calculated.

[0059] In a possible implementation, for each functional layer to be updated, the first impact weight matrix corresponding to the functional layer to be updated and the score value of the functional layer to be updated are multiplied to obtain a first matrix, and all values ​​in the first matrix are summed to obtain a first impact value; the impact weight corresponding to the functional layer to be updated and the score value of the functional layer to be updated are multiplied to obtain a second impact value; the first impact value and the second impact value are summed to obtain the impact value of the functional layer to be updated on the container image to be updated.

[0060] Step 402 : obtaining an update risk assessment result according to the impact value of each to-be-updated functional layer on the to-be-updated container image.

[0061] In a possible implementation, the impact values ​​of all to-be-updated functional layers on the to-be-updated container image are summed to directly obtain an update risk assessment result.

[0062] In another possible implementation, an update risk assessment result is obtained according to the sum of the impact values ​​of all to-be-updated functional layers on the to-be-updated container image and the impact of the to-be-updated container image on other container images.

[0063] In this embodiment, by determining the update risk assessment result according to the influencing parameter information of each to-be-updated functional layer, the amount of calculation is small, thereby improving the efficiency of risk assessment.

[0064] In one embodiment, as shown in FIG5 , another container image update risk assessment method is provided. According to the impact value of each to-be-updated functional layer on the to-be-updated container image, an update risk assessment result is obtained, including:

[0065] Step 501: According to the identifier of the container image to be updated, query and obtain a second influence weight matrix of the container image to be updated on other container images in the image repository.

[0066] Among them, in addition to storing multiple container images, the dependencies between multiple functional layers in each container image, and the impact parameter information of multiple functional layers in each container image, the image warehouse can also store the dependencies between container images and the second impact weight matrix of each container image on other container images. As shown in Figure 6, an example of a data structure stored in an image warehouse is shown. It should be noted that the image warehouse can be an image Git warehouse.

[0067] The second impact weight matrix of a container image on other container images refers to the matrix of the impact of the container image on other container images. For example, the image repository includes four container images, and the function layer to be updated is container image AA. The second impact weight matrix of container image AA on container image BB, container image CC, and container image DD is .

[0068] In a possible implementation, the terminal queries the image repository based on the identifier of the container image to be updated, and obtains a second influence weight matrix of the container image to be updated on other container images in the image repository.

[0069] Step 502 : Obtain an update risk assessment result according to the second impact weight matrix corresponding to the container image to be updated and the impact value of each function layer to be updated on the container image to be updated.

[0070] In a possible implementation, the impact values ​​of each to-be-updated functional layer on the to-be-updated container image are added to obtain a second sum value; a second impact weight matrix corresponding to the to-be-updated container image is multiplied by the second sum value to obtain a second matrix, and all values ​​in the second matrix are summed to obtain a first total impact value; a risk assessment level is determined according to the interval to which the first total impact value belongs; and the risk assessment level is used as the update risk assessment result.

[0071] In another possible implementation, the image repository also stores the score of each container image, and the score of the container image is the score given by the reviewer or developer based on the impact of the container image on other container images. Therefore, according to the identifier of the container image to be updated, the score of the container image to be updated can also be queried. Therefore, the update risk assessment result can be obtained by: adding the impact values ​​of each functional layer to be updated on the container image to be updated to obtain a second sum; multiplying the second impact weight matrix corresponding to the container image to be updated and the score of the container image to be updated to obtain a third matrix, summing all the values ​​in the second matrix to obtain a third sum; adding the second sum and the third sum to obtain a second total impact value; determining the risk assessment level according to the interval to which the second total impact value belongs; and using the risk assessment level as the update risk assessment result.

[0072] In this embodiment, the impact of the container image to be updated on other container images is also considered, so that the risk assessment is more comprehensive and the update risk assessment result is more accurate.

[0073] In one of the embodiments, the method further includes: when detecting that a container image is updated in the image repository, obtaining and storing the impact parameter information of each functional layer in the updated container image.

[0074] In a possible implementation, the image repository may be configured with a webhook. When a container image is updated in the image repository, relevant data of the updated container image is obtained and stored, so that the risk assessment of the updated container image can be performed during subsequent updates.

[0075] The relevant data of the updated container image obtained may include: the dependency relationship between multiple functional layers in the updated container image, the impact parameter information of multiple functional layers in the updated container image, the dependency relationship between the updated container image and other container images, and at least one of the second impact weight matrices of the updated container image on other container images.

[0076] In summary, the present application provides a container image update risk assessment method, which is a specific implementation step for implementing the container image update risk assessment:

[0077] Step 1: A terminal receives an update risk assessment request for a container image to be updated, where the update risk assessment request includes an identifier of the container image to be updated and an identifier of at least one function layer to be updated in the container image to be updated.

[0078] In step 2, the terminal queries and obtains the influence parameter information of multiple functional layers in the container image to be updated, and the second influence weight matrix of the container image to be updated on other container images in the image repository according to the identifier of the container image to be updated; wherein the influence parameter information of the functional layer to be updated includes the first influence weight matrix of the functional layer to be updated on other functional layers, the influence weight of the functional layer to be updated on the container image to be updated, and the score value of the functional layer to be updated.

[0079] Step 3: The terminal searches for the influencing parameter information of each to-be-updated functional layer from the influencing parameter information of multiple functional layers according to the identifier of each to-be-updated functional layer.

[0080] In step 4, the terminal calculates the impact value of each to-be-updated functional layer on the to-be-updated container image according to the first impact weight matrix corresponding to each to-be-updated functional layer, the impact weight corresponding to each to-be-updated functional layer, and the score value of each to-be-updated functional layer.

[0081] In step 5, the terminal obtains an update risk assessment result according to the second impact weight matrix corresponding to the container image to be updated and the impact value of each function layer to be updated on the container image to be updated, and outputs the update risk assessment result.

[0082] In addition, when the terminal detects that there is a container image update in the image repository, it obtains and stores the impact parameter information of each functional layer in the updated container image.

[0083] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0084] Based on the same inventive concept, the embodiment of the present application also provides a container image update risk assessment device for implementing the container image update risk assessment method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiment of the update risk assessment device for one or more container images provided below can refer to the limitations of the container image update risk assessment method above, and will not be repeated here.

[0085] In an exemplary embodiment, as shown in FIG. 7 , a container image update risk assessment device is provided. The container image update risk assessment device 700 includes: a receiving module 701, a query module 702, and an output module 703, wherein:

[0086] The receiving module 701 is configured to receive an update risk assessment request for a container image to be updated, where the update risk assessment request includes an identifier of the container image to be updated.

[0087] The query module 702 is used to query and obtain the influencing parameter information of multiple function layers in the container image to be updated according to the identifier of the container image to be updated.

[0088] The output module 703 is used to obtain an update risk assessment result of the container image to be updated based on the impact parameter information of multiple functional layers, and output the update risk assessment result.

[0089] In one of the embodiments, the update risk assessment request also includes an identifier of at least one functional layer to be updated in the container image to be updated; the output module 703 is specifically used to search for the impact parameter information of each functional layer to be updated from the impact parameter information of multiple functional layers according to the identifier of each functional layer to be updated; and obtain the update risk assessment result according to the impact parameter information of each functional layer to be updated.

[0090] In one of the embodiments, the impact parameter information of the function layer to be updated includes at least one of a first impact weight matrix of the function layer to be updated on other function layers, an impact weight of the function layer to be updated on the container image to be updated, and a score value of the function layer to be updated.

[0091] In one of the embodiments, the output module 703 is specifically used to calculate the impact value of each functional layer to be updated on the container image to be updated based on the first impact weight matrix corresponding to each functional layer to be updated, the impact weight corresponding to each functional layer to be updated, and the score value of each functional layer to be updated; and obtain the update risk assessment result based on the impact value of each functional layer to be updated on the container image to be updated.

[0092] In one of the embodiments, the output module 703 is specifically used to query and obtain, based on the identifier of the container image to be updated, a second impact weight matrix of the container image to be updated on other container images in the image repository; and obtain an update risk assessment result based on the second impact weight matrix corresponding to the container image to be updated and the impact value of each functional layer to be updated on the container image to be updated.

[0093] In one of the embodiments, the device further includes an acquisition module, which is used to acquire and store the impact parameter information of each functional layer in the updated container image when a container image update is detected in the image repository.

[0094] Each module in the above container image update risk assessment device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0095] In one embodiment, the present application also provides a system for implementing update risk assessment of container images, and the architecture diagram of the system is shown in FIG8 .

[0096] The system includes a human-computer interaction interface (also called UI), an analyzer, a database, a parser, a collector and an image warehouse. The image warehouse stores multiple container images. The data stored for each container image has multiple functional layers, a first impact weight matrix and a second impact weight matrix.

[0097] When the system receives an update risk assessment request for the container image to be updated, the collector sends a PULL command to the image repository, obtains the relevant data packet of the container image to be updated from the image repository based on the HOOK, and sends the data packet to the parser; the parser disassembles the data packet to obtain relevant data for risk assessment, and stores it in the database. After analyzing the relevant data for risk assessment obtained from the database, it processes the data to obtain the update risk assessment result of the container image to be updated, and sends it to the human-computer interaction interface, which displays the update risk assessment result of the container image to be updated.

[0098] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for assessing the update risk of a container image is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0099] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0100] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of any one of the method embodiments described above are implemented.

[0101] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above method embodiments are implemented.

[0102] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the method embodiments described above.

[0103] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0104] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0105] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A container image update risk assessment method, characterized in that: The method comprises: Receiving an update risk assessment request for a container image to be updated, wherein the update risk assessment request includes an identifier of the container image to be updated; According to the identifier of the container image to be updated, query and obtain the influencing parameter information of multiple function layers in the container image to be updated; Based on the impact parameter information of the multiple functional layers, an update risk assessment result of the container image to be updated is obtained, and the update risk assessment result is output.

2. The method according to claim 1, characterized in that The update risk assessment request also includes an identifier of at least one to-be-updated functional layer in the to-be-updated container image; and obtaining an update risk assessment result of the to-be-updated container image based on the impact parameter information of the multiple functional layers includes: According to the identifier of each of the to-be-updated functional layers, searching for the influencing parameter information of each of the to-be-updated functional layers from the influencing parameter information of the multiple functional layers to obtain the influencing parameter information of each of the to-be-updated functional layers; The update risk assessment result is obtained according to the influencing parameter information of each of the functional layers to be updated.

3. The method according to claim 2, characterized in that The influence parameter information of the to-be-updated function layer includes at least one of a first influence weight matrix of the to-be-updated function layer on each of the other function layers, an influence weight of the to-be-updated function layer on the to-be-updated container image, and a score value of the to-be-updated function layer.

4. The method according to claim 3, characterized in that The step of obtaining the update risk assessment result according to the influencing parameter information of each of the function layers to be updated includes: An influence value of each of the to-be-updated functional layers on the to-be-updated container image is calculated according to the first influence weight matrix corresponding to each of the to-be-updated functional layers, the influence weight corresponding to each of the to-be-updated functional layers, and the score value of each of the to-be-updated functional layers; The update risk assessment result is obtained according to the impact value of each of the to-be-updated functional layers on the to-be-updated container image.

5. The method according to claim 4, characterized in that The step of obtaining the update risk assessment result according to the impact value of each of the to-be-updated functional layers on the to-be-updated container image includes: According to the identifier of the container image to be updated, query and obtain a second influence weight matrix of the container image to be updated on other container images in the image repository; The update risk assessment result is obtained according to the second impact weight matrix corresponding to the container image to be updated and the impact value of each of the function layers to be updated on the container image to be updated.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: When a container image update is detected in the image repository, the impact parameter information of each functional layer in the updated container image is obtained and stored.

7. A container image update risk assessment device, characterized in that: The device comprises: A receiving module, configured to receive an update risk assessment request for a container image to be updated, wherein the update risk assessment request includes an identifier of the container image to be updated; A query module, configured to query and obtain, according to the identifier of the container image to be updated, the influence parameter information of multiple function layers in the container image to be updated; An output module is used to obtain an update risk assessment result of the container image to be updated based on the impact parameter information of the multiple functional layers, and output the update risk assessment result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images