Vulnerability repairing method and device for container mirror image, equipment and medium

Abstract

The embodiment of the invention relates to a vulnerability repairing method and device for a container mirror image, equipment and a medium. The method comprises the steps of obtaining a target application identifier of a target application program in a to-be-repaired container mirror image; in a vulnerability repair library, determining a vulnerability repair code for performing vulnerability repair on the target application according to the target application identifier; adding the vulnerability repair code into a first-layer construction document of the to-be-repaired container mirror image to obtain a second-layer construction document; constructing a target container mirror image according to the second-layer construction document; wherein the target container mirror image is a container mirror image obtained by completing vulnerability repair based on the to-be-repaired container mirror image. Therefore, automatic modification of the layer construction document based on existing vulnerabilities is achieved, manual intervention in the vulnerability repairing process is reduced, the container mirror image for repairing the original vulnerabilities is generated according to the modified layer construction document, full-process automatic repairing of the container mirror image vulnerabilities is achieved, and the vulnerability repairing efficiency is improved. And the requirements of rapid iteration and instant response can be well met.

Description

Technical Field

[0001] The present disclosure relates to the field of container security technology, and in particular to a method, device, equipment and medium for repairing vulnerabilities in container images. Background Art

[0002] With the development of cloud computing and container technology, container images are increasingly widely used, and the security requirements for container images are becoming increasingly high. In related technologies, users are required to intervene to scan and / or process vulnerabilities. However, this vulnerability repair method is difficult to meet the needs of rapid iteration and immediate response. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a container image vulnerability repair method, device, equipment and medium.

[0004] The present disclosure provides a method for repairing a vulnerability in a container image, including:

[0005] Obtain the target application identifier of the target application in the container image to be repaired;

[0006] In the vulnerability repair library, determining a vulnerability repair code for repairing the vulnerability of the target application program according to the target application identifier;

[0007] Adding the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document;

[0008] A target container image is built according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

[0009] The embodiment of the present disclosure also provides a container image vulnerability repair device, including:

[0010] An acquisition module, used to obtain a target application identifier of a target application in a container image to be repaired;

[0011] A determination module, configured to determine, in a vulnerability repair library, a vulnerability repair code for repairing a vulnerability in the target application program according to the target application identifier;

[0012] An adding module is used to add the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document;

[0013] A construction module is used to build a target container image according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

[0014] An embodiment of the present disclosure also provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the vulnerability repair method of the container image provided by the embodiment of the present disclosure.

[0015] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the vulnerability repair method of the container image provided by the embodiment of the present disclosure.

[0016] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the vulnerability repair solution of the container image provided in the embodiment of the present disclosure, the method includes: obtaining the target application identifier of the target application in the container image to be repaired; in the vulnerability repair library, determining the vulnerability repair code for repairing the vulnerability of the target application according to the target application identifier; adding the vulnerability repair code to the first layer build document of the container image to be repaired to obtain the second layer build document; building the target container image according to the second layer build document; wherein the target container image is the container image obtained by completing the vulnerability repair based on the container image to be repaired. By adopting the above technical solution, according to the target application identifier of the target application in the container image to be repaired, the determination of the vulnerability repair code is automatically realized, and the vulnerability repair code is automatically added to the corresponding position in the first layer build document corresponding to the container image to be repaired, the second layer build document is obtained, and the target container image for completing the vulnerability repair is built based on the second layer build document, realizing the automatic modification of the layer build document based on the existing vulnerability, reducing the manual intervention in the vulnerability repair process, generating the container image that completes the repair of the original vulnerability according to the modified layer build document, realizing the full process automatic repair of the container image vulnerability, and can better meet the needs of fast iteration and instant response. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart of a method for repairing a vulnerability in a container image provided by an embodiment of the present disclosure;

[0020] Figure 2 A schematic diagram of a container image vulnerability repair method provided by an embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram of the structure of a container image vulnerability repair device provided by an embodiment of the present disclosure;

[0022] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0024] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0025] With the development of cloud computing and container technology, container technology has been widely welcomed due to its lightweight and fast deployment characteristics. The application of container images has become more and more extensive. However, in the life cycle management of container images, security issues are particularly prominent, and the security requirements for container images are getting higher and higher. In order to cope with the challenges of application vulnerabilities in container images, the industry has developed a variety of detection and repair technologies, as shown in the following examples:

[0026] 1. Static analysis tools. Static analysis tools can be used to perform security checks during the code writing phase, helping users to discover and correct security issues at an early stage. However, this method may generate a large number of false positives and false negatives, causing users to be tired of dealing with unnecessary warnings or ignoring real vulnerabilities. In addition, the common security repair methods in some static analysis tools may require the participation of multiple developers, which consumes a lot of human resources.

[0027] 2. Dynamic analysis tools. Dynamic analysis tools can monitor the behavior of an application while it is running, thereby detecting potential vulnerabilities. However, dynamic analysis tools can only detect vulnerabilities after they have been successfully exploited, which is less timely.

[0028] 3. Manual repair. After the vulnerability is discovered, the user is notified to manually intervene to update the code or install a patch. This method has a low degree of automation, low repair efficiency, and problems such as incomplete repair.

[0029] In summary, although the related technologies have solved the application vulnerability problem of container images to a certain extent, there are still problems such as lack of closed-loop mechanism and lack of automated repair and verification process, which makes it difficult to meet the needs of rapid iteration and immediate response. In particular, the integration in the continuous integration (Continuous Integration) / continuous deployment (Continuous Deployment, CD) pipeline is not high, making the repair process cumbersome and error-prone.

[0030] Therefore, it is particularly important to propose a more intelligent automatic repair solution for container image application vulnerabilities.

[0031] In order to solve the above problems, the embodiments of the present disclosure provide a method for repairing vulnerabilities in a container image, which is introduced below in conjunction with specific embodiments.

[0032] Figure 1 A flow chart of a method for repairing a vulnerability in a container image provided by an embodiment of the present disclosure, the method for repairing a vulnerability in a container image can be applied to a device for repairing a vulnerability in a container image. The device for repairing a vulnerability in a container image can be implemented by software and / or hardware, and the device for repairing a vulnerability in a container image can generally be integrated in an electronic device. The device for repairing a vulnerability in a container image can automatically trigger a corresponding pipeline to perform online repairs on the application vulnerability when an application vulnerability is found in the container image. The pipeline is a mechanism for automating different steps of development, testing, and deployment during software development and delivery. The pipeline forms a continuous workflow through a series of stages and steps, thereby improving the efficiency and quality of software delivery. The main components of the pipeline include: building, testing, deployment, monitoring, and feedback, etc. Specifically, building includes: compiling code, generating executable files or container images. Testing includes: automated testing (e.g., unit testing, integration testing, etc.) to verify the correctness of the code. Deployment includes: deploying the application to a production environment or a test environment. Monitoring and feedback include: monitoring the running status of the application, collecting feedback information, and helping continuous improvement. In an agile development and development and operation collaboration (DevOps) environment, pipelines can help respond quickly to changes and meet user needs.

[0033] like Figure 1 As shown in the figure, the vulnerability repair methods of this container image include:

[0034] Step 101: Obtain a target application identifier of a target application in a container image to be repaired.

[0035] Among them, the container image to be repaired can be a container image for which application vulnerabilities are to be repaired, and the container image to be repaired can be understood as an unfinished container image. The target application can be an application for which it is to be determined whether there are reparable vulnerabilities, and the target application can be all or part of the applications in the container image to be repaired. This embodiment does not limit the type of the target application. For example, the target application can include a browser, office software, Web application, database, etc. The target application identifier can be used to identify the target application. This example does not limit the target application identifier. For example, the target application identifier can include the name and version of the target application. For example, the target application identifier can include the name and version of the Web server software and the name and version of the Java application server software.

[0036] In this embodiment, in response to a manual trigger or an automatic trigger, the container image vulnerability repair device can start a pipeline for making a target container image in a continuous integration pipeline. The container image vulnerability repair device can obtain a target application identifier such as the name and version of the target application in the container image to be repaired in the pipeline.

[0037] In the embodiment of the present disclosure, there are multiple methods for obtaining the target application identifier, which is not limited in this embodiment. Examples are described as follows.

[0038] Optionally, obtaining a target application identifier of a target application in the container image to be repaired includes: obtaining a parameter value of an application parameter corresponding to the container image to be repaired, and determining the target application identifier according to the parameter value.

[0039] The application parameters may be pre-set parameters for users to write application-related custom values. The parameter values ​​may be specific parameter values ​​written by the user.

[0040] In this embodiment, application parameters are reserved for the container image to be repaired, and the user can write the name and version of the target application into the parameter value of the application parameter in advance. The vulnerability repair device of the container image can obtain the parameter value corresponding to the application parameter and use the parameter value as the target application identifier.

[0041] Optionally, obtaining a target application identifier of a target application in the container image to be repaired includes: obtaining a first-layer build document of the container image to be repaired, extracting basic image information in the first-layer build document, and determining the target application identifier based on the basic image information.

[0042] Among them, the layer build document (Dockerfile) is a text document, which can contain a series of instructions for automating the process of building a container image. The layer build document can define one or more of the basic environment, application, library, configuration file, and dependency of the container image. The layer build document is the core of building a Docker container image. Through the layer build document, users can manage and deploy applications in the container image more easily. The first layer build document can be used to build the container image to be repaired, and the first layer build document can be understood as a pre-configured original document. The basic image information can be information that identifies the basic image. The basic image can be used to provide an initial operating system environment or runtime environment for the construction of the container image to be repaired. The basic image can be understood as the starting point for building the container image.

[0043] In this embodiment, the vulnerability repair device of the container image can obtain the first-layer construction document used to build the container image to be repaired, and extract the basic image information located after the (FROM) instruction in the first-layer construction document. Since the container image to be repaired is built based on the basic image, the container image to be repaired has all or part of the application programs in the basic image. The vulnerability repair device of the container image can determine the application identifier corresponding to the basic image information, and determine the target application identifier based on the application identifier.

[0044] Optionally, obtaining a target application identifier of a target application program in the container image to be repaired includes: obtaining a dependency document corresponding to the container image to be repaired, and determining the target application identifier according to the dependency document.

[0045] The dependency document may be a document for dependency management of the container image to be repaired. This embodiment does not limit the dependency document. For example, the dependency document may be package.json, requirements.txt, etc.

[0046] In this embodiment, the container image vulnerability repair device can obtain the dependency document of the project where the container image to be repaired is located, and determine the code library and its version and / or the framework and its version used by the container image to be repaired according to the information recorded in the dependency document, and determine the target application identifier according to the code library and its version and / or the framework and its version.

[0047] Optionally, obtaining a target application identifier of a target application program in the container image to be repaired includes: scanning the container image to be repaired by using a container scanning tool to obtain the target application identifier.

[0048] The container scanning tool may be a tool for performing security scanning on a container image. This embodiment does not limit the container scanning tool. For example, the container scanning tool may be Trivy, Clair, etc.

[0049] In this embodiment, the vulnerability repair device of the container image can analyze the container image to be repaired through a container scanning tool, automatically identify the target application identifier corresponding to the container image to be repaired, and send the target application identifier to the vulnerability repair device of the container image, and the vulnerability repair device of the container image receives the target application identifier.

[0050] Optionally, obtaining a target application identifier of a target application program in the container image to be repaired includes: obtaining version identification information of the container image to be repaired through a version tool, and determining the target application identifier according to the version identification information.

[0051] The version tool may be a version control system. The version identification information may be used to identify the version of the container image to be repaired, and the version identification information may be used to characterize the version update status of the application in the container image to be repaired.

[0052] In this embodiment, the vulnerability repair device for the container image can obtain the version submission record in the version tool, determine the version identification information of the container image to be repaired according to the version submission record, and query the relationship between the version and the application according to the version identification information to obtain the target application identification of the container image to be repaired.

[0053] Step 102: Determine, in the vulnerability repair library, vulnerability repair code for repairing the vulnerability of the target application program according to the target application identifier.

[0054] A vulnerability can be a defect, weakness or error in a system, software, hardware or network, which can be exploited to cause system damage, unauthorized access or other security issues. The vulnerability may be caused by negligence in code writing, design flaws or improper configuration. Application vulnerabilities can be vulnerabilities in applications, which may cause security issues in applications and mainly affect the functionality and security of applications. Application vulnerabilities can be exploited to control the behavior of applications, steal data, etc.

[0055] The vulnerability repair library can be a collection of codes for repairing application vulnerabilities, and the vulnerability repair library can include application identifiers and their corresponding vulnerability repair codes. The vulnerability repair code can be the code for repairing application vulnerabilities in the layer build document, and the vulnerability repair code is compatible with the layer build document and is compatible with the continuous integration pipeline.

[0056] In some embodiments of the present disclosure, the vulnerability repair code includes at least one of: a base image adjustment code, a directory replacement code, a variable setting code, and a command execution code.

[0057] The base image adjustment code may be a code for replacing the base image, and the base image adjustment code may include a base image based on an instruction and after replacement. The directory replacement code may be used to replace a default web application (webapps) directory, and corresponding security configurations may be added by replacing the default web application directory. The directory replacement code may include a copy instruction, a source directory where the replaced web application is located, and a target directory where the replaced web application is located.

[0058] The variable setting code can be used to set the variables of the container image. The variable setting code may include an environment variable setting instruction, an environment variable name, an environment variable value, etc. The environment variable value may be a specific value set for the environment variable name. This embodiment does not limit the environment variable value. For example, the environment variable value may include a memory setting value and / or a security setting value. The security of the container image can be improved by the variable setting code.

[0059] The command execution code can be used to execute a specific command, and the execution result of the command will be included in the corresponding image container. The present embodiment does not limit the command execution code. For example, the command execution code may include an execution instruction, a file processing command, and a configuration file path, so as to implement the execution of the corresponding file processing command on the configuration file. Alternatively, the command execution code may include an execution instruction and a password setting command, so as to implement the password setting for a specific user. The present embodiment does not limit the command. The command can be used to modify the configuration file of the application when building a container image. For example, the command can be used to limit the management authority and host access rights of a Java application server. Thus, the configuration file with security issues is adjusted to improve the security of the container image.

[0060] In some embodiments of the present disclosure, in a vulnerability repair library, a vulnerability repair code for repairing a vulnerability in a target application is determined based on a target application identifier, including: if the vulnerability repair library includes a target application identifier, determining whether there is a corresponding library code for the target application identifier in the vulnerability repair library, and if so, determining the library code as the vulnerability repair code.

[0061] The vulnerability repair library may store application identifiers, and some application identifiers may correspond to library codes, which may be codes for repairing vulnerabilities in the application programs corresponding to the application identifiers.

[0062] In this embodiment, the vulnerability repair library is queried according to the target application identifier. If the target application identifier exists in the vulnerability repair library, it is determined whether the library code corresponding to the target application identifier exists in the vulnerability repair library. If so, it means that the target application identifier has a corresponding vulnerability and the vulnerability has been resolved, and the library code is determined as the vulnerability repair code. If not, it means that although the target application identifier has a corresponding vulnerability, the vulnerability has not been resolved.

[0063] Step 103: Add the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document.

[0064] The second-layer build document may be a layer build document used to build the target container image. The second-layer build document may be understood as a layer build document obtained after performing vulnerability repair on the first-layer build document.

[0065] In the disclosed embodiment, for each vulnerability repair code, the vulnerability repair device of the container image can determine the instruction type of the vulnerability repair code, determine the code addition position corresponding to the instruction type in the first-layer build document, and add the vulnerability repair code to the code addition position. After performing the above processing for each vulnerability repair code, a second-layer build document is obtained.

[0066] In some embodiments of the present disclosure, if the vulnerability repair code includes a base image adjustment code, the vulnerability repair code is added to the first layer build document of the container image to be repaired, and a second layer build document is obtained, including:

[0067] The base image original code in the first-layer build document is determined, and the base image original code is replaced with the base image adjustment code to obtain a second-layer build document.

[0068] The base image original code may be the original code for determining the base image, and the base image corresponding to the base image original code may be the original base image. The base image adjustment code may be the code for determining the base image after replacement, and the base image corresponding to the base image adjustment code may be the adjusted base image.

[0069] In this embodiment, the container image vulnerability repair device can extract the base image original code in the first layer construction document based on the instruction, and replace the base image original code with the base image adjustment code to obtain the second layer construction document. Therefore, by replacing the original base image with the adjusted base image, the version upgrade of the application can be achieved, and then the vulnerability in the application can be repaired.

[0070] In some embodiments of the present disclosure, if the vulnerability repair code includes incremental code, wherein the incremental code includes at least one of directory replacement code, variable setting code, and command execution code. Accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired, and a second-layer build document is obtained, including:

[0071] Determine the code insertion layer corresponding to the incremental code in the first-layer build document, add the incremental code to the code insertion layer, and obtain the second-layer build document; wherein the code insertion layer and the incremental code correspond to the same code instructions.

[0072] The incremental code may be code added in a new way in the layer construction document. The code instruction may be an instruction contained in the code, for example, the code instruction may include a copy instruction, an environment variable setting instruction, and a run instruction.

[0073] In this embodiment, if the vulnerability repair code includes a directory replacement code. Accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain a second-layer build document, including: in the first-layer build document, the code layer corresponding to the copy instruction is determined as the code insertion layer of the target replacement code, and the directory replacement code is added to the code insertion layer to obtain the second-layer build document. Thus, while adding the directory replacement code, the codes corresponding to other copy instructions are retained, and the command for making the container image to be repaired is retained, so that the subsequent target container image can be made normally.

[0074] In this embodiment, if the vulnerability repair code includes a variable setting code, accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain a second-layer build document, including: in the first-layer build document, determining the code layer corresponding to the environment variable setting instruction as the code insertion layer of the variable setting code, adding the variable setting code to the code insertion layer, and obtaining the second-layer build document.

[0075] In this embodiment, if the vulnerability repair code includes a command execution code, accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain a second-layer build document, including: in the first-layer build document, the code layer corresponding to the execution instruction is determined as the code insertion layer of the command execution code, and the command execution code is added to the code insertion layer to obtain the second-layer build document. Thus, the vulnerability of the baseline configuration is repaired by the command execution code containing the execution instruction.

[0076] Optionally, in some embodiments of the present disclosure, the vulnerability repair code also includes a label code, which is used to record the vulnerability repair version of the container image, and the vulnerability repair version may include the repair user, the repair date, etc. Accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain the second-layer build document, including: in the first-layer build document, the code layer corresponding to the label (LABEL) instruction is determined as the code insertion layer of the label code, and the label code is added to the code insertion layer to obtain the second-layer build document. Thus, the label code provides a vulnerability repair version, which helps to record and mark each repair.

[0077] Optionally, in some embodiments of the present disclosure, the vulnerability repair code also includes a port opening code, and the port opening code is used to realize the opening of a specific port. Accordingly, the vulnerability repair code is added to the first layer of the build document of the container image to be repaired to obtain the second layer of the build document, including: in the first layer of the build document, the code layer corresponding to the port declaration (EXPOSE) instruction is determined as the code insertion layer of the port opening code, and the port opening code is added to the code insertion layer to obtain the second layer of the build document.

[0078] In the above scheme, the startup parameters, environment variables, running commands, maintenance information, etc. required for repairing the vulnerabilities of the container to be repaired are configured in the second-layer build document, so that when the target image container is started according to the second-layer build document, the vulnerabilities in the image container to be repaired can be repaired and the target image container can be started normally.

[0079] It should be noted that the above-mentioned method of generating a second-layer build document according to different vulnerability repair codes can be used in combination with each other. For example, if the vulnerability repair code includes a base image adjustment code and an incremental code, the vulnerability repair code is added to the first-layer build document of the container image to be repaired accordingly, and a second-layer build document is obtained, including: determining the base image original code in the first-layer build document, replacing the base image original code with the base image adjustment code, and determining the code insertion layer corresponding to the incremental code in the first-layer build document, adding the incremental code to the code insertion layer, and obtaining the second-layer build document.

[0080] Step 104, build a target container image according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

[0081] In an embodiment of the present disclosure, after the second-layer build document is determined, the vulnerability repair device of the container image can read the instructions in the second-layer build document. Specifically, the vulnerability repair device of the container image can obtain the specified base image based on the instructions. Then, the subsequent instructions in the second-layer build document are executed in sequence according to the order of the instructions. Each time an instruction is executed, a new layer is created on the already established layer, and the base image is the first layer established. These layers are combined to form the final target container image. It can be understood that since the repair of the container image to be repaired is performed on the part corresponding to each layer in the layer build document, in an embodiment of the present disclosure, the overall vulnerability repair of the container image is achieved by repairing the vulnerabilities of each layer of the container image.

[0082] Optionally, the container image vulnerability repair method further includes: if the target image container is started normally, scanning the target image container through a container scanning tool to confirm whether the application vulnerability in the container image to be repaired has been repaired. If the application vulnerability has been repaired, pushing the target container image to the container image repository in the continuous integration pipeline.

[0083] In the subsequent continuous deployment pipeline, the target container image with the fixed vulnerability is deployed to the target environment, which can include any of Kubernetes, OpenShift cluster, and Docker container. When the container is started, the sublayers in each layer that fix the application vulnerability are automatically loaded and initialized, and the target container runs normally.

[0084] The vulnerability repair method of the container image provided by the embodiment of the present disclosure includes: obtaining the target application identifier of the target application in the container image to be repaired; determining the vulnerability repair code for repairing the vulnerability of the target application in the vulnerability repair library according to the target application identifier; adding the vulnerability repair code to the first layer build document of the container image to be repaired to obtain the second layer build document; building the target container image according to the second layer build document; wherein the target container image is a container image obtained by completing the vulnerability repair based on the container image to be repaired. By adopting the above technical scheme, according to the target application identifier of the target application in the container image to be repaired, the determination of the vulnerability repair code is automatically realized, and the vulnerability repair code is automatically added to the corresponding position in the first layer build document corresponding to the container image to be repaired to obtain the second layer build document, and the target container image for completing the vulnerability repair is built based on the second layer build document, realizing the automatic modification of the layer build document based on the existing vulnerability, reducing the manual intervention in the vulnerability repair process, generating the container image that completes the repair of the original vulnerability according to the modified layer build document, realizing the full process automatic repair of the container image vulnerability, and being able to better meet the needs of rapid iteration and immediate response.

[0085] In addition, the vulnerability of the container image is fixed by adjusting the layer build document. The adjustment of the layer build document can be flexibly and automatically configured according to the specific content of the vulnerability repair library. The layer build document is flexible and variable and can adapt to different application scenarios. And by setting environment variables or mounting file systems, the configuration of the application is managed in the layer build document, which realizes configuration management and application decoupling, ensuring the flexibility and manageability of application configuration. And it makes the configuration consistent and correct in different environments such as development, testing, and production, avoiding the failure of application vulnerability repair due to differences in configuration in different environments.

[0086] Furthermore, the container image vulnerability repair method provided by the embodiment of the present disclosure interferes with the overall process of making container images as little as possible, so that the user's local development environment is not affected during the application vulnerability repair process, and is seamlessly connected with existing continuous integration / continuous deployment tools, thereby realizing early identification of application vulnerabilities, repairing application vulnerabilities, and verifying application vulnerabilities, thereby realizing a closed-loop processing process for application vulnerabilities, and having high practical value.

[0087] In some embodiments of the present disclosure, after building a target container image according to the second-layer construction document, the vulnerability repair method of the container image further includes:

[0088] If it is determined through the vulnerability scanning tool that the application vulnerability corresponding to the vulnerability repair code in the target container image has not been repaired, vulnerability information of the application vulnerability is generated; the vulnerability information is sent, and the target container image is pushed to the preset container image library.

[0089] The vulnerability information can be used to record application vulnerabilities. The preset container image library can be a library that is pre-set to provide container images for the continuous deployment pipeline.

[0090] In this embodiment, if the target image container is started normally, the target image container is scanned by a container scanning tool to confirm whether the application vulnerability in the container image to be repaired has been repaired. If the application vulnerability has not been repaired, the vulnerability information of the application vulnerability is automatically generated in the continuous integration pipeline, and the vulnerability information is sent to the corresponding R&D user to analyze the application vulnerability and improve the target application. In addition, the target container image is pushed to the container image warehouse in the continuous integration pipeline.

[0091] In the above solution, by sending vulnerability information to the corresponding R&D users, a timely feedback mechanism is established so that R&D users can quickly receive the identification and repair results of application vulnerabilities, promote rapid repairs, and ensure that security issues are resolved in a timely manner. In addition, the target container image is also retained in the container image repository, avoiding the blockage of the continuous deployment pipeline caused by the lack of the target container image, and ensuring the normal operation of the continuous deployment pipeline.

[0092] Next, the method for repairing a vulnerability in a container image in the embodiment of the present disclosure is further described by using a specific example. Figure 2 A schematic diagram of a container image vulnerability repair method provided by an embodiment of the present disclosure, such as Figure 2 As shown,

[0093] In the continuous integration stage, firstly, the continuous integration pipeline is triggered manually or automatically to start the production of the target container image. The target application identifier in the container image to be repaired is extracted through the continuous integration pipeline. The target application identifier includes the type and version of the target application program, and determines whether to obtain the target application identifier. The target application identifier is obtained in one of the following ways:

[0094] User application parameters are provided; provided based on instructions in the first-layer build document; the code base, framework and its version are determined through the dependency files in the project, and the target application identifier is determined based on the code base, framework and its version; the container image to be repaired is scanned by the container scanning tool to automatically obtain the target application identifier; the version identification information of the container image to be repaired is obtained through the version tool, and the target application identifier is determined based on the version identification information.

[0095] Furthermore, if the acquisition fails, the container image to be repaired is made normally. If the acquisition is successful, the known vulnerability repair library is queried to determine whether there is an application vulnerability and whether there is a corresponding vulnerability repair code for the application vulnerability. The vulnerability repair code can be recorded in the vulnerability repair file. If there is no application vulnerability or there is no corresponding vulnerability repair code for the application vulnerability, the container image to be repaired is made normally. If there is an application vulnerability and there is a corresponding vulnerability repair code, the vulnerability repair code is copied, and the pre-configured first-layer build document is modified according to the vulnerability repair code, so that the application vulnerability is repaired based on the vulnerability repair code when the container image is built. The process of building the first layer of documents may include: adding the basic image adjustment code, directory replacement code, etc. to the first layer of build documents, and configuring the startup parameters, environment variables, run commands, maintenance information, etc. required for the application vulnerability repair in the first layer of build documents, so that when the image container is started, the application vulnerability is repaired and the container image can start normally.

[0096] By replacing the original base image with a stable version of the adjusted base image, most of the application vulnerabilities are fixed, and the tag information provides the repair record information of the application vulnerabilities. The original copy instructions retain the original commands for making the container image to be repaired, and the baseline configuration vulnerabilities are repaired by running the instructions.

[0097] Furthermore, the target container image is created according to the second-layer construction document, the target container image is verified, and it is determined whether the target container image is started normally. If it cannot be started normally, the vulnerability information is recorded in the error log and the vulnerability information is sent, and then the container image to be repaired is created normally. If it can be started normally, the target container is scanned by a vulnerability scanning tool to determine whether there is a vulnerability in the target container image. If so, the target container image is pushed to the container image warehouse, and then the target container image is created normally.

[0098] In the continuous deployment pipeline, the target container image with the fixed application vulnerability is deployed to the target environment. When the target container corresponding to the target container image is started, the vulnerability repair sublayers in each layer of the target container are automatically loaded and initialized, so that the target container can run normally.

[0099] In the above solution, the vulnerability closed-loop processing of vulnerability identification, vulnerability repair and vulnerability verification of container images is completed through pipeline automation. The container image to be repaired is automatically identified, and the application vulnerabilities in the container image to be repaired are automatically repaired. A new image (i.e., the target container image) is reconstructed and pushed to the image repository. The tedious process of manually modifying the code or manually loading the repaired file into the container image is avoided. At the same time, security risks are reduced and potential attacks and data leaks are avoided.

[0100] In the vulnerability repair method for container images provided in the embodiments of the present disclosure, early defense of application vulnerabilities is achieved, reducing potential risks in container images. Specifically, by discovering and repairing vulnerabilities during the production phase of container images, security risks can be reduced before the system is put into production, avoiding potential attacks and data leaks. Identify vulnerabilities in advance, repair vulnerabilities, verify vulnerabilities, and implement a closed-loop vulnerability processing process. Improve rapid response capabilities. Specifically, by resolving known application vulnerabilities in container images, container images can be quickly updated when new application vulnerabilities are discovered, maintaining security sensitivity and responsiveness.

[0101] Achieved consistent and standardized management. Specifically, by pre-fixing application vulnerabilities in container images, it ensures that all deployed instances follow the same security standards, improving instance consistency and manageability. At the same time, it simplifies the deployment process and improves efficiency. Specifically, fixing application vulnerabilities before making images can reduce the patching and repair work for a single instance after subsequent deployment, saving time and resources.

[0102] In addition, the vulnerability repair method of the container image can be automatically integrated with the persistent integration / continuous deployment pipeline. Specifically, in the development and operation collaboration (DevOps) process, the vulnerability repair method of the container image is automatically built through the persistent integration / continuous deployment pipeline to include the repaired program, configuration, etc. The target container image is deployed to the test or production environment. While completing the closed-loop processing of application vulnerabilities, the collaboration efficiency between users of different roles can be greatly improved, manual intervention can be reduced, and application vulnerabilities can be responded to quickly.

[0103] Figure 3 This is a schematic diagram of the structure of a container image vulnerability repair device provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware, and the device can also be integrated in an electronic device. Figure 3 As shown, the vulnerability repair device of the container image includes:

[0104] An acquisition module 301 is used to acquire a target application identifier of a target application in a container image to be repaired;

[0105] A determination module 302 is used to determine, in a vulnerability repair library, a vulnerability repair code for repairing a vulnerability in the target application program according to the target application identifier;

[0106] An adding module 303 is used to add the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document;

[0107] The construction module 304 is used to build a target container image according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

[0108] Optionally, the acquisition module 301 includes the following submodule:

[0109] A first acquisition submodule is used to acquire a parameter value of an application parameter corresponding to the container image to be repaired, and determine the target application identifier according to the parameter value;

[0110] A second acquisition submodule is used to obtain the first layer construction document of the container image to be repaired, extract the basic image information in the first layer construction document, and determine the target application identifier according to the basic image information;

[0111] A third acquisition submodule is used to obtain a dependency document corresponding to the container image to be repaired, and determine the target application identifier according to the dependency document;

[0112] A fourth acquisition submodule is used to scan the container image to be repaired by using a container scanning tool to obtain the target application identifier;

[0113] The fifth acquisition submodule is used to obtain the version identification information of the container image to be repaired through a version tool, and determine the target application identifier according to the version identification information.

[0114] Optionally, the determining module 302 is configured to:

[0115] If the vulnerability repair library includes the target application identifier, it is determined whether there is a corresponding library code for the target application identifier in the vulnerability repair library, and if so, the library code is determined as the vulnerability repair code.

[0116] Optionally, the vulnerability repair code includes at least one of: a base image adjustment code, a directory replacement code, a variable setting code, and a command execution code.

[0117] Optionally, if the vulnerability repair code includes a base image adjustment code, accordingly, the adding module 303 is used to:

[0118] Determine the base image original code in the first-layer build document, replace the base image original code with the base image adjustment code, and obtain the second-layer build document.

[0119] Optionally, if the vulnerability repair code includes an incremental code, wherein the incremental code includes at least one of a directory replacement code, a variable setting code, and a command execution code,

[0120] Accordingly, the adding module 303 is used to:

[0121] Determine the code insertion layer corresponding to the incremental code in the first-layer construction document, add the incremental code to the code insertion layer, and obtain the second-layer construction document; wherein the code insertion layer and the incremental code correspond to the same code instructions.

[0122] Optionally, the container image vulnerability repair device further includes:

[0123] A generation module, configured to generate vulnerability information of the application vulnerability if it is determined through a vulnerability scanning tool that the application vulnerability corresponding to the vulnerability repair code in the target container image has not been repaired after the target container image is built according to the second-layer construction document;

[0124] The sending module is used to send the vulnerability information and push the target container image to a preset container image library.

[0125] It should be noted that Figure 3The container image vulnerability repair device 300 shown can execute each step in the above container image vulnerability repair method embodiment, and realize each process and effect in the above container image vulnerability repair method embodiment, which will not be described in detail here.

[0126] Figure 4 The structure diagram of an electronic device provided by the embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the electronic device 400 includes one or more processors 401 and a memory 402 .

[0127] The processor 401 may be a central processing unit (CPU) or other forms of processing units having vulnerability repair capabilities and / or instruction execution capabilities of container images, and may control other components in the electronic device 400 to perform desired functions.

[0128] The memory 402 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 401 may run the program instructions to implement the vulnerability repair method of the container image of the embodiment of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0129] In one example, the electronic device 400 may further include: an input device 403 and an output device 404, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0130] In addition, the input device 403 may also include, for example, a keyboard, a mouse, and the like.

[0131] The output device 404 can output various information to the outside, including the determined distance information, direction information, etc. The output device 404 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0132] Of course, to simplify, Figure 4 Only some of the components related to the present disclosure in the electronic device 400 are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device 400 may also include any other appropriate components.

[0133] In addition to the above-mentioned method and device, the embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, and when the computer program instructions are executed by a processor, the processor executes the container image vulnerability repair method provided by the embodiment of the present disclosure.

[0134] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0135] In addition, the embodiment of the present disclosure may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the container image vulnerability repair method provided by the embodiment of the present disclosure.

[0136] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0137] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0138] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for repairing a vulnerability in a container image, characterized in that: include: Obtain the target application identifier of the target application in the container image to be repaired; In the vulnerability repair library, determining a vulnerability repair code for repairing the vulnerability of the target application program according to the target application identifier; Adding the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document; A target container image is built according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

2. The method according to claim 1, characterized in that The step of obtaining the target application identifier of the target application in the container image to be repaired includes the following: Obtaining a parameter value of an application program parameter corresponding to the container image to be repaired, and determining the target application identifier according to the parameter value; Obtaining the first-layer build document of the container image to be repaired, extracting basic image information in the first-layer build document, and determining the target application identifier according to the basic image information; Obtain a dependency document corresponding to the container image to be repaired, and determine the target application identifier according to the dependency document; Scan the container image to be repaired by using a container scanning tool to obtain the target application identifier; The version identification information of the container image to be repaired is obtained through a version tool, and the target application identifier is determined according to the version identification information.

3. The method according to claim 1, characterized in that Determining, in the vulnerability repair library, a vulnerability repair code for repairing the vulnerability of the target application program according to the target application identifier includes: If the vulnerability repair library includes the target application identifier, it is determined whether there is a corresponding library code for the target application identifier in the vulnerability repair library, and if so, the library code is determined as the vulnerability repair code.

4. The method according to claim 1, characterized in that The vulnerability repair code includes at least one of: a base image adjustment code, a directory replacement code, a variable setting code, and a command execution code.

5. The method according to claim 4, characterized in that If the vulnerability repair code includes a base image adjustment code, accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain a second-layer build document, including: Determine the base image original code in the first-layer build document, replace the base image original code with the base image adjustment code, and obtain the second-layer build document.

6. The method according to claim 4, characterized in that If the vulnerability repair code includes an incremental code, wherein the incremental code includes at least one of a directory replacement code, a variable setting code, and a command execution code, accordingly, the vulnerability repair code is added to the first-layer build document of the container image to be repaired to obtain a second-layer build document, including: Determine the code insertion layer corresponding to the incremental code in the first-layer construction document, add the incremental code to the code insertion layer, and obtain the second-layer construction document; wherein the code insertion layer and the incremental code correspond to the same code instructions.

7. The method according to claim 1, characterized in that After building the target container image according to the second-layer building document, the method further includes: If it is determined through a vulnerability scanning tool that the application vulnerability corresponding to the vulnerability repair code in the target container image has not been repaired, vulnerability information of the application vulnerability is generated; The vulnerability information is sent, and the target container image is pushed to a preset container image library.

8. A container image vulnerability repair device, characterized in that: include: An acquisition module, used to obtain a target application identifier of a target application in a container image to be repaired; A determination module, configured to determine, in a vulnerability repair library, a vulnerability repair code for repairing a vulnerability in the target application program according to the target application identifier; An adding module is used to add the vulnerability repair code to the first-layer build document of the container image to be repaired to obtain a second-layer build document; A construction module is used to build a target container image according to the second-layer construction document; wherein the target container image is a container image obtained by completing vulnerability repair based on the container image to be repaired.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the container image vulnerability repair method described in any one of claims 1-7 above.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the container image vulnerability repair method described in any one of claims 1 to 7.

Images